@agfpd/iapeer 0.2.22 → 0.2.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/cli.test.ts

@@ -9,7 +9,7 @@ import { tmpdir } from 'os'
 import { join } from 'path'
 import { formatListTable, listPeers, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
 import { findPeer, readPeersIndex, upsertPeer } from '../registry/index.ts'
-import { hasIdleReaped, isStopped, loadLifecycleConfig, setStopped } from '../lifecycle/index.ts'
+import { hasIdleReaped, isStopped, loadLifecycleConfig, setIdleReaped, setStopped } from '../lifecycle/index.ts'
 import { launchdPlistPath } from '../launch/launchd.ts'
 
 let root: string
@@ -130,6 +130,31 @@ describe('remove (registry record via the locked writer)', () => {
     expect((await removePeerCli('twice', { env: e })).action).toBe('removed')
     expect((await removePeerCli('twice', { env: e })).action).toBe('absent')
   })
+  test('purges identity-keyed lifecycle state with the record — a namesake newborn must not inherit a dead peer\'s parking (boris 10.06)', async () => {
+    await register('reborn')
+    const e = env()
+    const cfg = loadLifecycleConfig(e)
+    // the dead peer left the full marker cemetery behind (the live-defect shape:
+    // .stopped + .idle-reaped → a namesake newborn is REFUSED its wake)
+    setStopped(cfg, 'claude-reborn')
+    setIdleReaped(cfg, 'claude-reborn')
+    writeFileSync(join(cfg.stateDir, 'claude-reborn.topic'), 'old-topic')
+    mkdirSync(join(cfg.stateDir, 'claude-reborn.queue'), { recursive: true })
+    // a NEIGHBOR identity sharing the name as a PREFIX must survive untouched
+    setStopped(cfg, 'claude-reborn2')
+
+    const o = await removePeerCli('reborn', { env: e })
+    expect(o.action).toBe('removed')
+    expect(o.purgedState?.sort()).toEqual([
+      'claude-reborn.idle-reaped',
+      'claude-reborn.queue',
+      'claude-reborn.stopped',
+      'claude-reborn.topic',
+    ])
+    expect(isStopped(cfg, 'claude-reborn')).toBe(false) // the newborn namesake wakes
+    expect(existsSync(join(cfg.stateDir, 'claude-reborn.queue'))).toBe(false)
+    expect(isStopped(cfg, 'claude-reborn2')).toBe(true) // dot-delimited: no prefix bleed
+  })
 })
 
 describe('send validation', () => {

package/src/cli/index.ts

@@ -33,6 +33,7 @@ import {
   isStopped,
   killSession,
   loadLifecycleConfig,
+  purgeIdentityState,
   removeSessionState,
   setIdleReaped,
   setNewEager,
@@ -271,6 +272,11 @@ export interface RemoveOutcome {
    *  deliberately keeps the folder — user data is never deleted by a registry reap
    *  (boris's finding 10.06: say so in the output instead of leaving silent orphans). */
   cwd?: string
+  /** Identity-keyed lifecycle artifacts purged with the record (state/lifecycle/
+   *  `<identity>.*` per runtime). Without this purge a NEWBORN peer reusing the
+   *  personality inherits the dead namesake's parking (live defect, boris 10.06:
+   *  stale .stopped → `mode=refused cause=stopped` on a freshly-created peer). */
+  purgedState?: string[]
 }
 
 /**
@@ -301,7 +307,13 @@ export async function removePeerCli(
     }
   }
   await removePeer(personality, { env })
-  return { personality, action: 'removed', cwd: peer.cwd }
+  // Purge identity-keyed lifecycle state WITH the record (per runtime): stale
+  // .stopped/.idle-reaped/... must never outlive the peer and ambush a future
+  // namesake (purgeIdentityState doc). After the registry write, so a failed
+  // remove never half-purges a still-registered peer.
+  const cfg = loadLifecycleConfig(env)
+  const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, personality)))
+  return { personality, action: 'removed', cwd: peer.cwd, purgedState }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -692,6 +704,11 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         const o = await removePeerCli(positionals[0], { force: flags.force === true, env })
         if (o.action === 'removed') {
           out(`removed "${o.personality}" from the registry\n`)
+          // Stale identity-keyed markers must die with the record (boris 10.06: a
+          // namesake newborn inherited a dead peer's .stopped → refused to wake).
+          if (o.purgedState?.length) {
+            out(`lifecycle state purged: ${o.purgedState.join(', ')}\n`)
+          }
           // Deliberate: the registry reap never deletes user data — but SAY so, or
           // the default-location peers leave silent orphan folders (boris 10.06).
           if (o.cwd && existsSync(o.cwd)) {

package/src/launch/canary.test.ts

@@ -17,6 +17,7 @@ import {
   signalCanaryClean,
 } from './canary.ts'
 import { killSession } from '../lifecycle/index.ts'
+import { teardownAlwaysOnSession } from './launchdRun.ts'
 
 const tmuxAvailable = spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0
 
@@ -92,7 +93,7 @@ describe.if(tmuxAvailable)('canary live (sandbox tmux servers)', () => {
   afterAll(() => {
     for (const sock of socks) {
       // teardown is DELIBERATE → signal each canary before killing its server
-      for (const id of ['claude-canadirty', 'claude-canaclean', 'claude-canakill']) {
+      for (const id of ['claude-canadirty', 'claude-canaclean', 'claude-canakill', 'notifier-canatear']) {
         signalCanaryClean(sock, id)
       }
       spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
@@ -152,6 +153,32 @@ describe.if(tmuxAvailable)('canary live (sandbox tmux servers)', () => {
     20000,
   )
 
+  test(
+    'teardownAlwaysOnSession (signal-exit of runAlwaysOn) kills session+server, canary stays silent',
+    async () => {
+      const identity = 'notifier-canatear'
+      const { sock, logDir } = bringUp(identity)
+      expect(ensureServerCanary({ identity, sock, exitLogDir: logDir })).toBe('spawned')
+      expect(await waitFor(() => canaryRunning(identity), 3000)).toBe(true)
+      await sleep(500)
+
+      teardownAlwaysOnSession(sock, identity) // the bootout/shutdown path
+      // the whole server must be gone (the poller dies WITH the watcher — грабля closed)
+      expect(
+        await waitFor(
+          () => spawnSync('tmux', ['-S', sock, 'has-session', '-t', identity], { stdio: 'ignore' }).status !== 0,
+          3000,
+        ),
+      ).toBe(true)
+      expect(await waitFor(() => !canaryRunning(identity), 3000)).toBe(true)
+      await sleep(300)
+      expect(existsSync(exitLogPath(logDir)) && readFileSync(exitLogPath(logDir), 'utf8').includes('ev=server-exit')).toBe(
+        false,
+      )
+    },
+    20000,
+  )
+
   test(
     'killSession (lifecycle clean reap) signals the canary before kill-server → no record',
     async () => {

package/src/launch/launchdRun.ts

@@ -23,6 +23,7 @@ import { buildProcessAddress, buildSocketPath } from '../core/socket.ts'
 import { peerLogsDir, pluginLogsDir } from '../storage/index.ts'
 import { readPeerProfile } from '../identity/index.ts'
 import { getAdapter, launch } from './index.ts'
+import { signalCanaryClean } from './canary.ts'
 import type { LaunchConfig, LaunchSpec } from './types.ts'
 
 /** Block-watch poll cadence — seconds, deliberately NOT a tight loop (the session
@@ -39,6 +40,29 @@ function sessionAlive(sock: string, identity: string): boolean {
   return spawnSync('tmux', ['-S', sock, 'has-session', '-t', identity], { stdio: 'ignore' }).status === 0
 }
 
+/**
+ * Tear down the always-on session WITH its tmux server (when this session was the
+ * last one) — the signal-exit counterpart of lifecycle.killSession, local to avoid
+ * a launch ⇆ lifecycle import. Canary-signaled first: this is a DELIBERATE stop.
+ *
+ * Closes the live грабля «bootout не убивает поллера» (boris 10.06, second
+ * strike): `launchctl bootout` TERMs THIS watcher process, but the detached tmux
+ * server — and the runtime poller inside it — survived holding STALE in-memory
+ * state (e.g. a notifier trigger's old target after a same-id replace), so a
+ * plain bootout+bootstrap was NOT a real restart. With the teardown, the session
+ * dies with its watcher: bootout = full stop, bootstrap = fresh bring-up that
+ * re-reads durable state. `iapeer stop` (bootout + killSession) is unchanged —
+ * both paths now converge on the same end state.
+ */
+export function teardownAlwaysOnSession(sock: string, identity: string): void {
+  signalCanaryClean(sock, identity)
+  spawnSync('tmux', ['-S', sock, 'kill-session', '-t', identity], { stdio: 'ignore' })
+  const ls = spawnSync('tmux', ['-S', sock, 'list-sessions', '-F', '#{session_name}'], { encoding: 'utf8' })
+  if (!(ls.stdout ?? '').trim()) {
+    spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
+  }
+}
+
 /**
  * Build the always-on LaunchSpec for an infra peer, reading intelligence from the
  * local peer-profile.json. launchd sets WorkingDirectory = peer cwd, so that file
@@ -159,6 +183,12 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     })
     interrupt = null
   }
+  // Signal-initiated exit (bootout / shutdown / kickstart -k) tears the session
+  // down WITH this watcher — without it the detached tmux poller outlived bootout
+  // holding stale in-memory state (см. teardownAlwaysOnSession). A natural session
+  // death (stop=false) skips this: there is nothing to tear down, exit 0 →
+  // KeepAlive respawns a fresh bring-up.
+  if (stop) teardownAlwaysOnSession(sock, identity)
   return 0
 }
 

package/src/lifecycle/index.ts

@@ -380,6 +380,44 @@ export function writeTopic(cfg: LifecycleConfig, identity: string, topic: string
   }
 }
 
+/**
+ * Purge EVERY identity-keyed lifecycle artifact of `<identity>` from stateDir:
+ * the marker files (`.stopped` / `.idle-reaped` / `.deaths` / `.topic` /
+ * `.new-eager` / `.ephemeral-armed`), the supervise `.session`, the `.wake.lock`
+ * and the M3 `.queue/` dir — everything matching `<identity>.*` (the dot
+ * delimiter keeps `claude-bob` from ever matching `claude-bob2.*`).
+ *
+ * Consumer: `iapeer remove` (live defect, boris 10.06 cutover): a removed peer's
+ * stale `.stopped`/`.idle-reaped` survived in state/lifecycle, and a NEWBORN peer
+ * REUSING the personality inherited the dead namesake's parking — the daemon
+ * refused to wake it (`mode=refused cause=stopped`). Identity-keyed state must
+ * die with the registry record. Deliberately NOT called at birth: provision runs
+ * on EXISTING peers too (init re-runs), and purging there would erase a parked
+ * peer's `.idle-reaped` → its next wake comes up FRESH instead of RESUME
+ * (violates «на resume нет потери контекста»).
+ *
+ * Returns the removed entry names (for the verb's output); never throws.
+ */
+export function purgeIdentityState(cfg: LifecycleConfig, identity: string): string[] {
+  const removed: string[] = []
+  let entries: string[]
+  try {
+    entries = readdirSync(cfg.stateDir)
+  } catch {
+    return removed // no state dir → nothing to purge
+  }
+  for (const name of entries) {
+    if (!name.startsWith(`${identity}.`)) continue
+    try {
+      rmSync(join(cfg.stateDir, name), { recursive: true, force: true })
+      removed.push(name)
+    } catch {
+      /* best-effort — a locked/vanished entry must not fail the remove */
+    }
+  }
+  return removed
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // resolveWakeMode — the resume-vs-fresh decision (TARGET redesign). The DAEMON
 // decides by the DEATH CAUSE it tracks (.idle-reaped marker), plus peer-type /