@agfpd/iapeer 0.2.41 → 0.2.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/cli.test.ts

@@ -7,7 +7,7 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
-import { formatListTable, listPeers, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
+import { formatListTable, listPeers, newPeer, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
 import { findPeer, readPeersIndex, upsertPeer } from '../registry/index.ts'
 import { hasIdleReaped, isStopped, loadLifecycleConfig, setIdleReaped, setStopped } from '../lifecycle/index.ts'
 import { launchdPlistPath } from '../launch/launchd.ts'
@@ -40,9 +40,12 @@ async function register(personality: string, runtime = 'claude', intelligence: '
   await upsertPeer({ personality, runtime, cwd: `/tmp/${personality}`, intelligence }, { rootDir: root })
 }
 
-// ─── v1.2 provision-инверсия at the CLI joints (memory-plugin printer + remove) ───
+// ─── v1.2 provision-инверсия at the CLI joints (remove → unprovision) ─────────
+// NB: the memory-plugin verb was REMOVED 11.06 (ADR-017 — the plugin form is
+// retired ecosystem-wide; fleet sweeps are the provider's side). The core's
+// remaining v1.2 joints are birth (provision.test.ts) and remove (below).
 
-describe('memory-plugin / remove with a v1.2 provision slot', () => {
+describe('remove with a v1.2 provision slot', () => {
   function declareV12Slot(): string {
     const journal = join(root, 'journal.txt')
     const script = join(root, 'fake-provider.sh')
@@ -61,36 +64,30 @@ describe('memory-plugin / remove with a v1.2 provision slot', () => {
     return journal
   }
 
-  test('memory-plugin on --peer: printer survives plugin=null (v1.2 path), exit 0 (live-caught 11.06 smoke)', async () => {
-    declareV12Slot()
-    await register('alpha')
-    let captured = ''
-    const origWrite = process.stdout.write
-    process.stdout.write = ((s: string | Uint8Array) => {
-      captured += typeof s === 'string' ? s : Buffer.from(s).toString('utf8')
-      return true
-    }) as typeof process.stdout.write
-    try {
-      const code = await runCli(['memory-plugin', 'on', '--peer', 'alpha'], env())
-      expect(code).toBe(0)
-      expect(captured).toContain('provision: provider command')
-      expect(captured).toContain('alpha (claude): ok')
-    } finally {
-      process.stdout.write = origWrite
-    }
+  test('memory-plugin verb is GONE — unknown verb exits with usage (removal 11.06)', async () => {
+    const code = await runCli(['memory-plugin', 'on', '--all'], env())
+    expect(code).toBe(2) // usage exit — the verb no longer exists
   })
 
-  test('remove: unprovision runs with occasion=remove BEFORE the purge, outcome reported', async () => {
+  test('remove: unprovision runs with occasion=remove BEFORE the purge, outcome reported; cmdlog dir dies with the record', async () => {
     const journal = declareV12Slot()
     await register('beta')
+    // identity-keyed tmux command-log dir (0.2.40) — must die with the registry
+    // record (the leak class noted at the 0.2.40 acceptance)
+    const { mkdirSync: mkd } = await import('fs')
+    const cmdDir = join(root, 'logs', 'iapeer', 'tmux-cmdlog', 'claude-beta')
+    mkd(cmdDir, { recursive: true })
+    writeFileSync(join(cmdDir, 'tmux-server-1.log'), 'x')
     const o = await removePeerCli('beta', { env: env() })
     expect(o.action).toBe('removed')
     expect(o.unprovision).toEqual(['claude:ok'])
-    const { readFileSync } = await import('fs')
+    const { readFileSync, existsSync: ex } = await import('fs')
     const j = readFileSync(journal, 'utf8')
     expect(j).toContain('unprovision-peer')
     expect(j).toContain('--cwd\n/tmp/beta')
     expect(j).toContain('remove')
+    expect(ex(cmdDir)).toBe(false)
+    expect(o.purgedState).toContain('tmux-cmdlog/claude-beta')
   })
 })
 
@@ -400,3 +397,57 @@ describe('parseArgs (audit #27 — value beginning with --)', () => {
     expect(parseArgs(['x', '--description=']).flags.description).toBe('')
   })
 })
+
+// ─── new — the UNCONDITIONAL fresh-restart control (docs/Control-команды §new) ─
+
+describe('new (unconditional fresh restart)', () => {
+  test('happy path: fresh-slate (un-park + stale markers cleared) → fresh wake with resume:false task:"" → action fresh', async () => {
+    await register('alpha')
+    const e = env()
+    const cfg = loadLifecycleConfig(e)
+    // a parked peer with stale markers — /new must override ALL of it
+    setStopped(cfg, 'claude-alpha')
+    setIdleReaped(cfg, 'claude-alpha')
+    const calls: Array<{ personality: string; runtime: string; task: string; resume: boolean }> = []
+    const o = await newPeer('alpha', undefined, {
+      env: e,
+      wakeFn: async args => {
+        calls.push(args)
+        return { status: 'READY', woke: true, runtime: args.runtime, process_address: `${args.runtime}-${args.personality}`, taskDelivered: true }
+      },
+    })
+    expect(o.action).toBe('fresh')
+    expect(o.runtime).toBe('claude')
+    expect(calls).toEqual([{ personality: 'alpha', runtime: 'claude', task: '', resume: false }])
+    expect(isStopped(cfg, 'claude-alpha')).toBe(false) // un-parked: /new outranks the C1 stop
+    expect(hasIdleReaped(cfg, 'claude-alpha')).toBe(false) // stale marker cleared
+  })
+
+  test('wake FAILED → action failed with the reason (exit-1 contract for the bot)', async () => {
+    await register('beta2')
+    const o = await newPeer('beta2', undefined, {
+      env: env(),
+      wakeFn: async () => ({ status: 'FAILED', woke: false, reason: 'boot hang' }),
+    })
+    expect(o.action).toBe('failed')
+    expect(o.reason).toBe('boot hang')
+  })
+
+  test('refusals are explicit: foreign launchd / infra runtime / undeclared runtime / unknown peer', async () => {
+    const e = env()
+    // foreign PP plist → fleet guard
+    await register('boris')
+    writeFileSync(launchdPlistPath('boris', e), '<?xml version="1.0"?>\n<plist><dict><key>Label</key><string>com.iapeer.boris</string></dict></plist>\n')
+    expect((await newPeer('boris', undefined, { env: e })).action).toBe('refused-foreign-launchd')
+    // infra runtime → launchd-held, kickstart hint
+    await register('tg', 'telegram', 'natural')
+    const infra = await newPeer('tg', undefined, { env: e })
+    expect(infra.action).toBe('refused-infra')
+    expect(infra.reason).toContain('kickstart')
+    // undeclared runtime → explicit refusal, no silent launch
+    await register('gamma2')
+    expect((await newPeer('gamma2', 'codex', { env: e })).action).toBe('refused-undeclared-runtime')
+    // unknown peer → throws (same contract as stop/start)
+    await expect(newPeer('ghost-nobody', undefined, { env: e })).rejects.toThrow('not registered')
+  })
+})

package/src/cli/index.ts

@@ -27,6 +27,8 @@ import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../regist
 import { isPeerLive, routeControl, routeSend, type WakeFn } from '../transport/index.ts'
 import {
   attachPeer,
+  clearIdleReaped,
+  clearNewEager,
   clearStopped,
   folderLaunch,
   isLaunchdManaged,
@@ -41,6 +43,7 @@ import {
   setNewEager,
   setStopped,
   wakeOrSpawn,
+  type WakeResult,
 } from '../lifecycle/index.ts'
 import { getAdapter } from '../launch/index.ts'
 import { isFoundationOwnedPlist, kickstartDaemon, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
@@ -269,6 +272,90 @@ export function startPeer(personality: string, runtime: string | undefined, opts
   return out
 }
 
+export interface NewPeerOutcome {
+  personality: string
+  runtime: string
+  action: 'fresh' | 'refused-foreign-launchd' | 'refused-infra' | 'refused-undeclared-runtime' | 'failed'
+  reason?: string
+}
+
+/**
+ * new <peer> [runtime] — the UNCONDITIONAL fresh-restart control command
+ * (docs/Control-команды §new; постановка boris 01:32 12.06, санкция Артура).
+ *
+ * The emergency lever for a HUNG or dead agent session: /alias-new covers only
+ * the COOPERATIVE path (a live peer reads the expanded prompt and runs
+ * `iapeer self-fresh`); a stuck/raving/dead peer never reads a prompt — this
+ * command restarts it MECHANICALLY, bypassing the peer entirely:
+ *   fresh-slate markers (un-park C1 stop, clear stale .idle-reaped/.new-eager) →
+ *   canary-clean teardown of any live session (killSession — a deliberate kill,
+ *   never a death class; session-state dropped so supervise stays silent) →
+ *   wakeOrSpawn(resume:false, task:'') — fresh BY CONSTRUCTION, the same recipe
+ *   as the eager relaunch (the C2 initial_prompt seeds the first turn).
+ *
+ * exit-0 contract (сверка telegram-runtime): success ⟺ the fresh session is UP
+ * and READY (verified by the wake's ready gate, not merely scheduled) — for a
+ * sleeping, dead AND hung target alike. Duration is a real TUI boot: typically
+ * 5–30 s, bounded by cfg.bootDeadlineSecs. Idempotent in effect: each repeat
+ * leaves exactly one fresh live session (concurrent calls serialize on the
+ * wake lock). REFUSES foreign-launchd peers (fleet guard) and infra runtimes
+ * (launchd-held — their restart is `launchctl kickstart`'s domain), like
+ * stop/start; an explicitly-passed runtime the peer does not declare is an
+ * explicit refusal (never a silent launch of an undeclared runtime).
+ */
+export async function newPeer(
+  personality: string,
+  runtime: string | undefined,
+  opts: CliEnvOptions & { wakeFn?: (args: { personality: string; runtime: Runtime; task: string; resume: false }) => Promise<WakeResult> } = {},
+): Promise<NewPeerOutcome> {
+  const env = opts.env ?? process.env
+  const cfg = loadLifecycleConfig(env)
+  const peer = findPeer(readPeersIndex({ env }), personality)
+  if (!peer) throw new Error(`peer "${personality}" is not registered`)
+  if (isForeignLaunchd(personality, env)) {
+    return {
+      personality,
+      runtime: peer.runtime,
+      action: 'refused-foreign-launchd',
+      reason: `"${personality}" is managed by persistent-peer (foreign launchd plist) — the foundation does not restart it`,
+    }
+  }
+  if (runtime && !isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
+  const rt: Runtime = (runtime as Runtime | undefined) ?? peer.runtime
+  if (!peer.runtimes.includes(rt)) {
+    return {
+      personality,
+      runtime: rt,
+      action: 'refused-undeclared-runtime',
+      reason: `peer "${personality}" does not declare runtime "${rt}" (declared: ${peer.runtimes.join(', ')})`,
+    }
+  }
+  if (isInfraRuntime(rt)) {
+    return {
+      personality,
+      runtime: rt,
+      action: 'refused-infra',
+      reason: `infra runtime "${rt}" is launchd-held — restart it with: launchctl kickstart -k gui/$(id -u)/${launchdLabel(personality)}`,
+    }
+  }
+  const identity = buildProcessAddress(rt, personality)
+  const sock = buildSocketPath(rt, personality, cfg.sockDir)
+  // Fresh slate: an explicit operator /new outranks a C1 park (it demands a live
+  // fresh session NOW) and any stale death/fresh markers (the wake below is fresh
+  // by construction — markers must not leak into a LATER wake's decision).
+  clearStopped(cfg, identity)
+  clearIdleReaped(cfg, identity)
+  clearNewEager(cfg, identity)
+  killSession(sock, identity) // canary-clean deliberate teardown; no-op when dead
+  removeSessionState(cfg, identity) // never a death class — supervise stays silent
+  const wake = opts.wakeFn ?? (args => wakeOrSpawn(args, { cfg, env }))
+  const r = await wake({ personality, runtime: rt, task: '', resume: false })
+  if (r.status !== 'READY') {
+    return { personality, runtime: rt, action: 'failed', reason: r.reason ?? 'wake failed' }
+  }
+  return { personality, runtime: rt, action: 'fresh' }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // remove — delete a peer's record from the registry through the LOCKED writer
 // (registry.removePeer). Direct edits of peers-profiles.json are refused at
@@ -565,13 +652,13 @@ const USAGE = `usage: iapeer <verb> [args]
   <runtime>                                                      launch the cwd's peer (ALWAYS fresh)
   connect telegram <peer> [--token <t>]                          attach a telegram bot to a peer (bot add → interface → router restart; asks only the token)
   enable <plugin> [peer] [--no-setup]                            install + enable an agfpd capability for a peer
+  new <peer> [runtime]                                           UNCONDITIONAL fresh restart: canary-clean kill + fresh wake (emergency lever for a hung/dead session — bypasses the peer; exit 0 = fresh session up+ready)
   attach <peer> [runtime]                                        ensure-live + resume, then tmux attach
   interrupt <peer> [runtime]                                     interrupt the current turn (Escape) — context intact
   compact <peer> [runtime]                                       compact the peer's context (/compact)
   self-fresh                                                     (agent self-call) mark /new eager-fresh + self-kill — the daemon relaunches fresh
   self-done                                                      (agent self-call, ephemeral) silent finish: arm own quiet-reap, wake no one
   native-memory <off|on> (--peer <p> | --all)                    gate/restore runtimes' native memory (canonized lever; контракт «Слот памяти»)
-  memory-plugin <on|off> (--peer <p> | --all)                    install/remove the slot-declared provider plugin (claude per-peer, codex host-global)
   trust-hooks <hooks.json> [--check]                             pre-seed codex hooks trust for a file-form hooks.json (no modal); --check = drift report
 `
 
@@ -702,35 +789,6 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         }
         return failed ? 1 : 0
       }
-      case 'memory-plugin': {
-        // Slot-derived provider-plugin install/removal (контракт «Слот памяти»
-        // §Плагин провайдера; agreed iapeer-memory + boris 10.06). The plugin
-        // identity comes from the slot declaration's v1.1 plugin block — empty
-        // slot / v1 declaration → explicit refusal (generic `enable` exists for
-        // arbitrary plugins). Forms live in enable/ (ONE home); codex off is
-        // host-global (only --all removes; --peer reports it explicitly).
-        const state = positionals[0]
-        if (state !== 'on' && state !== 'off') return usage(errOut)
-        const peerName = typeof flags.peer === 'string' ? flags.peer : undefined
-        if (flags.all !== true && !peerName) return usage(errOut)
-        const { memoryPluginApply } = await import('../enable/memoryPlugin.ts')
-        const r = memoryPluginApply(state, { peer: peerName, all: flags.all === true, env })
-        if (r.error) {
-          errOut(`memory-plugin: ${r.error}\n`)
-          return 1
-        }
-        // v1.2: a provision-declaring slot routes through the provider's commands —
-        // r.plugin is null then (there is no marketplace plugin in play to print).
-        out(
-          r.plugin
-            ? `plugin: ${r.plugin.name}@${r.plugin.marketplace} (provider-declared)\n`
-            : `provision: provider command (declaration v1.2, occasion=${state === 'on' ? 'sweep-on' : flags.all === true ? 'off-all' : 'off-peer'})\n`,
-        )
-        for (const o of r.outcomes) {
-          out(`${o.personality} (${o.runtime}): ${o.state}${o.detail ? ` — ${o.detail}` : ''}\n`)
-        }
-        return r.ok ? 0 : 1
-      }
       case 'trust-hooks': {
         // Deterministic pre-seed of the codex hooks trust state for a FILE-form
         // hooks.json (user- or project-local layer) — the headless replacement for
@@ -978,6 +1036,20 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         return outcomes.some(o => o.action === 'refused-foreign-launchd') ? 1 : 0
       }
+      case 'new': {
+        // UNCONDITIONAL fresh restart (control, system class — docs/Control-команды
+        // §new): the emergency lever for a hung/dead session, bypasses the peer.
+        // Source: operator CLI, or telegram-runtime's clean-/new detect (their bot
+        // shells `iapeer new <peer> <runtime>` — exit 0 ⟺ fresh session up+ready).
+        if (!positionals[0]) return usage(errOut)
+        const o = await newPeer(positionals[0], positionals[1], { env })
+        if (o.action === 'fresh') {
+          out(`new: ${o.runtime}-${o.personality} fresh session up\n`)
+          return 0
+        }
+        errOut(`new: ${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
+        return 1
+      }
       case 'start': {
         // --all re-enables every REGISTERED peer (mirror of `stop --all` — the 11.06
         // incident: bringing a stopped fleet back required a manual loop over ~25

package/src/enable/index.ts

@@ -398,8 +398,9 @@ function enableRuntimeWithRetry(
  * The registry-FREE enable core: install per-runtime (claude project-scope IN cwd /
  * codex global) + enable + `setup` ONLY if declared — with marketplace ensure
  * (marketplaceRef given + not registered → add) and the stale-snapshot retry.
- * Consumers: enableCapability (peer-resolved verb), provisionPeer's birth-time
- * memory-plugin hook, and the `memory-plugin` verb — ONE home of the install forms.
+ * Consumer: enableCapability (the peer-resolved generic `iapeer enable` verb) —
+ * ONE home of the install forms. (The memory-plugin birth-hook and verb consumers
+ * were removed 11.06 — the provider plugin form is retired, ADR-017.)
  */
 export function enableCapabilityForCwd(o: CwdEnableOptions): EnableResult {
   const env = o.env ?? process.env
@@ -472,58 +473,9 @@ export function enableCapability(opts: EnableOptions): EnableResult {
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Removal forms (контракт §Плагин провайдера, off-direction) — verb names
-// verified live 10.06: claude `plugin uninstall <id> --scope project` (run in the
-// peer cwd), codex `plugin remove <id>` (host-global).
+// Removal forms — REMOVED 11.06 with the memory-plugin verb (their only caller;
+// ADR-017 retired the provider plugin form). Historical verb names, verified
+// live 10.06, for a future generic `disable`: claude `plugin uninstall <id>
+// --scope project` (run in the peer cwd), codex `plugin remove <id>`
+// (host-global). See git history ≤v0.2.41 for the implementations.
 // ─────────────────────────────────────────────────────────────────────────────
-
-export type RuntimeRemoveState = 'removed' | 'absent' | 'runtime-missing' | 'failed'
-
-export interface RuntimeRemoveResult {
-  runtime: CapabilityRuntime
-  state: RuntimeRemoveState
-  detail?: string
-}
-
-/** claude: uninstall the peer-scoped (projectPath-keyed) entry — fleet-safe by the
- *  same key enable uses; a peer without an entry is 'absent' (idempotent). */
-export function removeClaudeForCwd(
-  plugin: string,
-  marketplace: string,
-  peerCwd: string,
-  env: NodeJS.ProcessEnv = process.env,
-): RuntimeRemoveResult {
-  const bin = claudeBin(env)
-  if (!isExecutable(bin, env)) return { runtime: 'claude', state: 'runtime-missing' }
-  const id = `${plugin}@${marketplace}`
-  const existing = claudeEntry(bin, plugin, marketplace, peerCwd, env)
-  if (!existing) return { runtime: 'claude', state: 'absent' }
-  const r = spawnSync(bin, ['plugin', 'uninstall', id, '--scope', 'project'], {
-    cwd: peerCwd,
-    encoding: 'utf8',
-    env: env as Record<string, string>,
-  })
-  const after = claudeEntry(bin, plugin, marketplace, peerCwd, env)
-  if (after) {
-    return { runtime: 'claude', state: 'failed', detail: (r.stderr || r.stdout || `exit ${r.status}`).trim() }
-  }
-  return { runtime: 'claude', state: 'removed' }
-}
-
-/** codex: remove the HOST-GLOBAL plugin (codex has no project scope) — callers gate
- *  this on an explicit fleet-wide intent (`memory-plugin off --all`). */
-export function removeCodexGlobal(
-  plugin: string,
-  marketplace: string,
-  env: NodeJS.ProcessEnv = process.env,
-): RuntimeRemoveResult {
-  const bin = codexBin(env)
-  if (!isExecutable(bin, env)) return { runtime: 'codex', state: 'runtime-missing' }
-  const id = `${plugin}@${marketplace}`
-  if (codexState(bin, id, env) === 'absent') return { runtime: 'codex', state: 'absent' }
-  const r = spawnSync(bin, ['plugin', 'remove', id], { encoding: 'utf8', env: env as Record<string, string> })
-  if (codexState(bin, id, env) !== 'absent') {
-    return { runtime: 'codex', state: 'failed', detail: (r.stderr || r.stdout || `exit ${r.status}`).trim() }
-  }
-  return { runtime: 'codex', state: 'removed' }
-}

package/src/enable/provisionCommand.ts

@@ -8,8 +8,11 @@
 //   2. `command` is ABSOLUTE (parser refuses relative — launchd minimal PATH).
 //   3. Timeout 120 s; best-effort semantics live at the CALL SITES (LOUD warn,
 //      the birth/remove flow continues) — this module only reports structurally.
-//   4. {occasion} vocabulary: birth | sweep-on | off-peer | off-all | remove —
-//      ref-counting of host-global surfaces is the PROVIDER's business.
+//   4. {occasion} vocabulary (финален, contract §Provision): birth | sweep-on |
+//      off-peer | off-all | remove — ref-counting of host-global surfaces is the
+//      PROVIDER's business. Since the memory-plugin verb removal (11.06, ADR-017)
+//      the CORE emits only `birth` and `remove`; the sweep occasions remain part
+//      of the provider-command interface (their CLI may use them internally).
 // Idempotency is the provider's obligation by construction; the provider holds
 // its own lock against concurrent provisions.
 

package/src/launch/adapters/codex.ts

@@ -319,11 +319,16 @@ export const codexAdapter: RuntimeAdapter = {
    *     interrupts the turn — NOT a double. (Codex's own footer says "esc to
    *     interrupt"; one Escape yields "■ Conversation interrupted". The contract's
    *     open "×1/×2?" is resolved to ×1, same as claude.) Session + context intact.
-   *   - compact → null (codex has no '/compact'; context management is its own).
+   *   - compact → type '/compact' then Enter. SNAPPED LIVE 12.06 (codex-cli
+   *     0.138.0): the slash EXISTS now — autocomplete documents it («summarize
+   *     conversation to prevent hitting the context limit») and a live run
+   *     yields «• Context compacted». The 0.136-era "codex has no /compact"
+   *     finding is stale; the mapping is keyboard-identical to claude's.
    *   - anything else → null.
    */
   executeControl(command: ControlCommand): ControlPlan | null {
     if (command.name === 'interrupt') return { sequence: [['Escape']] }
+    if (command.name === 'compact') return { sequence: [['-l', '/compact'], ['Enter']], stepDelayMs: 300 }
     return null
   },
 }

package/src/launch/launch.test.ts

@@ -296,9 +296,10 @@ describe('executeControl (Ф-E control commands)', () => {
     expect(claudeAdapter.executeControl({ name: 'compact' })).toEqual({ sequence: [['-l', '/compact'], ['Enter']], stepDelayMs: 300 })
     expect(claudeAdapter.executeControl({ name: 'bogus' })).toBeNull()
   })
-  test('codex: interrupt → [Escape] (×1 baseline; ×2 snapped live); compact → null', () => {
+  test('codex: interrupt → [Escape] (×1, snapped live); compact → /compact + Enter (snapped live 12.06, codex-cli 0.138)', () => {
     expect(codexAdapter.executeControl({ name: 'interrupt' })).toEqual({ sequence: [['Escape']] })
-    expect(codexAdapter.executeControl({ name: 'compact' })).toBeNull()
+    expect(codexAdapter.executeControl({ name: 'compact' })).toEqual({ sequence: [['-l', '/compact'], ['Enter']], stepDelayMs: 300 })
+    expect(codexAdapter.executeControl({ name: 'bogus' })).toBeNull()
   })
   test('routers (telegram/notifier) refuse all control (no TUI turn)', () => {
     expect(telegramAdapter.executeControl({ name: 'interrupt' })).toBeNull()

package/src/lifecycle/index.ts

@@ -26,7 +26,7 @@ import {
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { err, ok, type Result } from '../core/errors.ts'
-import { capCmdLogs } from '../launch/cmdlog.ts'
+import { capCmdLogs, cmdLogDirFor } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readPeerProfile, resolveIdentity } from '../identity/index.ts'
 import {
@@ -422,7 +422,7 @@ export function purgeIdentityState(cfg: LifecycleConfig, identity: string): stri
   try {
     entries = readdirSync(cfg.stateDir)
   } catch {
-    return removed // no state dir → nothing to purge
+    entries = [] // no state dir → no markers; the cmdlog purge below still runs
   }
   for (const name of entries) {
     if (!name.startsWith(`${identity}.`)) continue
@@ -433,6 +433,18 @@ export function purgeIdentityState(cfg: LifecycleConfig, identity: string): stri
       /* best-effort — a locked/vanished entry must not fail the remove */
     }
   }
+  // tmux command-log dir (0.2.40 observability) — identity-keyed like the state
+  // markers above, so it must die with the registry record too (the leak class
+  // noted at the 0.2.40 acceptance: a removed peer left its cmdlog dir forever).
+  try {
+    const cmdDir = cmdLogDirFor(cfg.eventLogDir, identity)
+    if (existsSync(cmdDir)) {
+      rmSync(cmdDir, { recursive: true, force: true })
+      removed.push(`tmux-cmdlog/${identity}`)
+    }
+  } catch {
+    /* best-effort */
+  }
   return removed
 }
 

package/src/onboard/index.ts

@@ -124,8 +124,8 @@ export function isAgfpdInList(listOutput: string): boolean {
 }
 
 /** Register a marketplace for this runtime (`<runtime> plugin marketplace add <ref>`).
- *  Exported for the memory-plugin install path (контракт §Плагин провайдера: a
- *  third-party provider's marketplaceRef must self-register on a fresh host). */
+ *  Exported for the generic capability-enable path (a third-party marketplaceRef
+ *  must self-register on a fresh host). */
 export function registerMarketplace(
   runtime: OnboardRuntime,
   env: NodeJS.ProcessEnv,
@@ -142,7 +142,7 @@ export function registerMarketplace(
 }
 
 /** Is a marketplace (by name/ref) registered for this runtime? Generalized form of
- *  isMarketplaceRegistered for the memory-plugin install path. */
+ *  isMarketplaceRegistered for the generic capability-enable path. */
 export function isMarketplaceRegisteredAs(
   runtime: OnboardRuntime,
   name: string,

package/src/provision/index.ts

@@ -125,11 +125,11 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
       // v1.2 — ADR-009 inversion; решение Артура 10.06, схема сверена с
       // iapeer-memory 11.06): an occupied slot WITH a provision block shells into
       // the PROVIDER's command per agentic runtime (occasion=birth) — the core
-      // knows nothing about surface forms. PRECEDENCE: provision WINS over the
-      // deprecated v1.1 plugin block, with NO runtime fallback to plugin on
-      // failure (masking a provision refusal would hide a broken provider —
-      // LOUD warn + repair-hint instead). Runs AFTER preTrustCodexCwd above, so
-      // the provider's per-peer codex surfaces land in an already-trusted cwd.
+      // knows nothing about surface forms. A failure is NEVER masked (a broken
+      // provider must not hide) — LOUD warn; repair is provider-side (the core is
+      // provider-agnostic and names no command). Runs AFTER preTrustCodexCwd
+      // above, so the provider's per-peer codex surfaces land in an already-
+      // trusted cwd.
       if (slot.provision) {
         const { runProvisionCommand } = await import('../enable/provisionCommand.ts')
         const { appendLifecycleEvent } = await import('../lifecycle/eventlog.ts')
@@ -161,44 +161,15 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
             opts.warn?.(
               `memory provision (${rt}) ${o.state.toUpperCase()} for "${profile.personality}"` +
                 `${o.detail ? `: ${o.detail}` : ''} — память пира не подключена; ` +
-                `repair: iapeer memory-plugin on --peer ${profile.personality}`,
+                `repair: re-run the provider's provision for this peer (the provider's own CLI — verify/repair/init)`,
             )
           }
         }
       }
-      // Provider PLUGIN auto-install (контракт §Плагин провайдера, declaration
-      // v1.1, DEPRECATED by §Provision; agreed iapeer-memory + boris 10.06): an
-      // occupied slot WITH a plugin block and WITHOUT a provision block installs
-      // the provider's marketplace plugin into the newborn's scope (claude
-      // project-scope in cwd; codex host-global, idempotent) — «создал пира —
-      // память работает». A v1 declaration (no block) installs nothing.
-      // Best-effort with a LOUD warn; repair = `iapeer memory-plugin on --peer`.
-      else if (slot.plugin) {
-        const { enableCapabilityForCwd } = await import('../enable/index.ts')
-        const agentic = profile.runtimes.filter((r): r is 'claude' | 'codex' => r === 'claude' || r === 'codex')
-        if (agentic.length > 0) {
-          const r = enableCapabilityForCwd({
-            plugin: slot.plugin.name,
-            marketplace: slot.plugin.marketplace,
-            marketplaceRef: slot.plugin.marketplaceRef,
-            cwd,
-            personality: profile.personality,
-            runtimes: agentic,
-            env,
-          })
-          for (const rr of r.runtimes) {
-            if (rr.state === 'failed') {
-              opts.warn?.(
-                `memory-plugin install (${rr.runtime}) FAILED for "${profile.personality}": ${rr.detail} — ` +
-                  `repair: iapeer memory-plugin on --peer ${profile.personality}`,
-              )
-            }
-          }
-          if (r.setup === 'failed') {
-            opts.warn?.(`memory-plugin setup FAILED for "${profile.personality}": ${r.setupDetail ?? ''}`)
-          }
-        }
-      }
+      // NB: the v1.1 plugin auto-install branch (an occupied slot WITH a `plugin`
+      // block) was REMOVED 11.06 — the plugin form is retired ecosystem-wide
+      // (provider's ADR-017; contract §Плагин провайдера is a tombstone). A v1.2
+      // declaration without a provision block provisions nothing here.
     }
   } catch (e) {
     opts.warn?.(`memory birth-time hook failed: ${e instanceof Error ? e.message : String(e)}`)

package/src/provision/provision.test.ts

@@ -199,7 +199,7 @@ describe('provisionPeer birth-time native-memory lever', () => {
     expect(existsSync(join(cwd, '.codex', 'config.toml'))).toBe(false)
   })
 
-  test('slot with v1.1 plugin block → birth hook attempts the plugin install; runtime-missing host stays silent and provision SUCCEEDS', async () => {
+  test('LEGACY v1.1 plugin block in the declaration → ignored entirely (form removed 11.06, ADR-017); native lever still applies', async () => {
     const root = mkTmp()
     const env = envFor(root)
     mkdirSync(join(root, 'iapeer'), { recursive: true })
@@ -210,21 +210,20 @@ describe('provisionPeer birth-time native-memory lever', () => {
         package: '@agfpd/iapeer-memory',
         version: '0.1.0',
         registeredAt: 'x',
+        // a stale v1.1 declaration on a legacy host — the core no longer parses it
         plugin: { name: 'iapeer-memory', marketplace: 'agfpd', marketplaceRef: 'agfpd/agfpd-marketplace' },
       }),
     )
     const cwd = join(root, 'wplug')
     const warns: string[] = []
-    // HOME-scoped claude bin + no codex on PATH → both runtimes 'runtime-missing':
-    // a clean skip (host without the runtime), NOT a failure warn, and never a throw.
     const r = await provisionPeer({ cwd, runtime: 'claude', env, warn: m => warns.push(m) })
     expect(r.personality).toBe('wplug')
-    expect(warns.filter(w => w.includes('memory-plugin install'))).toEqual([])
+    expect(warns).toEqual([]) // no install attempt, no warn — the block is unknown noise
     // the native lever still applied (same slot-gated block)
     expect(JSON.parse(readFileSync(join(cwd, '.claude', 'settings.json'), 'utf8')).autoMemoryEnabled).toBe(false)
   })
 
-  test('v1.2: slot with provision command → birth shells into it per runtime (occasion=birth), plugin path NOT taken', async () => {
+  test('v1.2: slot with provision command → birth shells into it per runtime (occasion=birth); a legacy plugin block alongside is inert', async () => {
     const root = mkTmp()
     const env = envFor(root)
     mkdirSync(join(root, 'iapeer'), { recursive: true })
@@ -240,7 +239,7 @@ describe('provisionPeer birth-time native-memory lever', () => {
         package: '@agfpd/iapeer-memory',
         version: '0.2.0',
         registeredAt: 'x',
-        // BOTH blocks declared → provision must WIN (precedence, no plugin attempt)
+        // legacy plugin block alongside (stale declaration) — must be inert
         plugin: { name: 'iapeer-memory', marketplace: 'agfpd', marketplaceRef: 'agfpd/agfpd-marketplace' },
         provision: {
           command: script,
@@ -258,7 +257,7 @@ describe('provisionPeer birth-time native-memory lever', () => {
     expect(j.slice(1, 9)).toEqual(['--cwd', cwd, '--runtime', 'claude', '--personality', 'wprov', '--occasion', 'birth'])
   })
 
-  test('v1.2: provision command FAILS → LOUD warn with repair-hint, provision of the peer still SUCCEEDS (best-effort)', async () => {
+  test('v1.2: provision command FAILS → LOUD warn (provider-side repair), provision of the peer still SUCCEEDS (best-effort)', async () => {
     const root = mkTmp()
     const env = envFor(root)
     mkdirSync(join(root, 'iapeer'), { recursive: true })
@@ -284,6 +283,6 @@ describe('provisionPeer birth-time native-memory lever', () => {
     expect(w).toBeDefined()
     expect(w).toContain('FAILED')
     expect(w).toContain('vault offline')
-    expect(w).toContain('memory-plugin on --peer wfail') // repair-hint
+    expect(w).toContain("re-run the provider's provision") // provider-side repair, no core verb named
   })
 })

package/src/status/index.ts

@@ -17,21 +17,10 @@ import { iapeerBinPath } from '../install/index.ts'
 /** The slot-declaration filename in the storage root (next to peers-profiles.json). */
 export const MEMORY_PROVIDER_FILE = 'memory-provider.json'
 
-/** The provider's marketplace plugin (declaration v1.1, контракт §Плагин
- *  провайдера — agreed with iapeer-memory + boris 10.06). Declares WHAT the core
- *  auto-installs into a newborn peer's scope (and what `memory-plugin` targets).
- *  All three fields are required when the block is present; an invalid block is
- *  treated as ABSENT (fail-open, like the whole file) = v1 behavior, no install. */
-export interface MemoryProviderPlugin {
-  /** Plugin id in the marketplace (forms `<name>@<marketplace>` for installs). */
-  name: string
-  /** Marketplace NAME the plugin id keys on (e.g. "agfpd"). */
-  marketplace: string
-  /** Source ref for `plugin marketplace add` when the marketplace is not yet
-   *  registered on the host (owner/repo or URL) — the third-party-provider path;
-   *  for the distribution default it matches what onboard already adds. */
-  marketplaceRef: string
-}
+// NB: the v1.1 `plugin` block (MemoryProviderPlugin + its parser) was REMOVED
+// 11.06 (provider's ADR-017 retired the plugin form ecosystem-wide; contract
+// §Плагин провайдера is a tombstone). An unknown `plugin` key in a legacy
+// declaration is simply ignored — the same fail-open as any unknown block.
 
 /** The provider's provision command (declaration v1.2, контракт §Provision
  *  провайдера — ADR-009 inversion, решение Артура 10.06 + дизайн-консенсус
@@ -58,30 +47,14 @@ export interface MemoryProvider {
   /** Optional liveness proxy: an absolute path whose mtime the provider's daemon
    *  refreshes. status reports its age; the core takes NO action on staleness. */
   heartbeat?: string
-  /** Optional marketplace-plugin declaration (v1.1) — see MemoryProviderPlugin.
-   *  DEPRECATED by v1.2: when `provision` is also present, provision WINS and
-   *  the plugin block is ignored (no runtime fallback — an explicit precedence,
-   *  agreed iapeer-memory 11.06). */
-  plugin?: MemoryProviderPlugin
-  /** Optional v1.2 provision command (peer-birth / sweep-on joints). */
+  /** Optional v1.2 provision command (the peer-birth joint). */
   provision?: MemoryProviderProvision
-  /** Optional v1.2 unprovision command (off-peer / off-all / remove joints). */
+  /** Optional v1.2 unprovision command (the remove joint). */
   unprovision?: MemoryProviderProvision
 }
 
-/** Parse the optional v1.1 `plugin` block; anything short of three non-empty
- *  strings → undefined (treated as absent — v1 declaration, core installs nothing). */
-function parsePluginBlock(raw: unknown): MemoryProviderPlugin | undefined {
-  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return undefined
-  const o = raw as Record<string, unknown>
-  if (typeof o.name !== 'string' || !o.name.trim()) return undefined
-  if (typeof o.marketplace !== 'string' || !o.marketplace.trim()) return undefined
-  if (typeof o.marketplaceRef !== 'string' || !o.marketplaceRef.trim()) return undefined
-  return { name: o.name.trim(), marketplace: o.marketplace.trim(), marketplaceRef: o.marketplaceRef.trim() }
-}
-
 /** Parse an optional v1.2 `provision`/`unprovision` block. Fail-open like the
- *  plugin block: anything short of an ABSOLUTE command string + an array of
+ *  whole file: anything short of an ABSOLUTE command string + an array of
  *  strings → undefined (treated as absent). A relative command is INVALID by
  *  contract (launchd minimal PATH would resolve it differently per caller). */
 function parseProvisionBlock(raw: unknown): MemoryProviderProvision | undefined {
@@ -108,7 +81,6 @@ export function readMemoryProvider(env: NodeJS.ProcessEnv = process.env): Memory
     if (typeof o.provider !== 'string' || !o.provider.trim()) return null
     if (typeof o.package !== 'string' || !o.package.trim()) return null
     if (typeof o.version !== 'string' || !o.version.trim()) return null
-    const plugin = parsePluginBlock(o.plugin)
     const provision = parseProvisionBlock(o.provision)
     const unprovision = parseProvisionBlock(o.unprovision)
     return {
@@ -117,7 +89,6 @@ export function readMemoryProvider(env: NodeJS.ProcessEnv = process.env): Memory
       version: o.version.trim(),
       registeredAt: typeof o.registeredAt === 'string' ? o.registeredAt : '',
       ...(typeof o.heartbeat === 'string' && o.heartbeat.trim() ? { heartbeat: o.heartbeat.trim() } : {}),
-      ...(plugin ? { plugin } : {}),
       ...(provision ? { provision } : {}),
       ...(unprovision ? { unprovision } : {}),
     }

package/src/status/status.test.ts

@@ -62,23 +62,19 @@ describe('readMemoryProvider (slot declaration, fail-open)', () => {
     }
   })
 
-  test('v1.1 plugin block: parsed when complete; INVALID block = absent (v1 behavior), declaration still valid', () => {
+  test('LEGACY v1.1 plugin block (any shape) → ignored as unknown noise; the declaration itself stays valid (form removed 11.06, ADR-017)', () => {
     const root = mkTmp()
     const env = envFor(root)
-    const plugin = { name: 'iapeer-memory', marketplace: 'agfpd', marketplaceRef: 'agfpd/agfpd-marketplace' }
-    writeFileSync(memoryProviderPath(env), JSON.stringify({ ...VALID, plugin }))
-    expect(readMemoryProvider(env)?.plugin).toEqual(plugin)
-    // incomplete / wrong-shape blocks → treated as ABSENT, the declaration itself stays valid
-    for (const bad of [
-      { name: 'x', marketplace: 'agfpd' }, // missing marketplaceRef
-      { name: '', marketplace: 'agfpd', marketplaceRef: 'r' }, // empty name
-      'iapeer-memory', // not an object
-      ['x'], // array
+    for (const legacy of [
+      { name: 'iapeer-memory', marketplace: 'agfpd', marketplaceRef: 'agfpd/agfpd-marketplace' }, // a complete v1.1 block
+      { name: 'x', marketplace: 'agfpd' },
+      'iapeer-memory',
+      ['x'],
     ]) {
-      writeFileSync(memoryProviderPath(env), JSON.stringify({ ...VALID, plugin: bad }))
+      writeFileSync(memoryProviderPath(env), JSON.stringify({ ...VALID, plugin: legacy }))
       const p = readMemoryProvider(env)
       expect(p).not.toBeNull()
-      expect(p?.plugin).toBeUndefined()
+      expect((p as Record<string, unknown> | null)?.plugin).toBeUndefined() // not parsed at all
     }
   })
 

package/src/enable/memoryPlugin.test.ts

@@ -1,197 +0,0 @@
-// memory-plugin — slot-derived gating + target resolution + codex host-global
-// semantics (контракт §Плагин провайдера). Install forms are NOT exercised here
-// (they spawn runtime CLIs); the bins are pointed at /nonexistent so every
-// runtime resolves 'runtime-missing' — the orchestration around them is what
-// these tests pin.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtempSync, rmSync, writeFileSync } from 'fs'
-import { tmpdir } from 'os'
-import { join } from 'path'
-import { upsertPeer } from '../registry/index.ts'
-import { memoryProviderPath } from '../status/index.ts'
-import { memoryPluginApply } from './memoryPlugin.ts'
-
-let root: string
-function env(): NodeJS.ProcessEnv {
-  const e: NodeJS.ProcessEnv = {
-    ...process.env,
-    IAPEER_ROOT: root,
-    IAPEER_CLAUDE_BIN: '/nonexistent/claude',
-    IAPEER_CODEX_BIN: '/nonexistent/codex',
-  }
-  delete e.PEER_PERSONALITY
-  delete e.PEER_IDENTITY
-  delete e.PEER_RUNTIME
-  return e
-}
-
-beforeEach(() => {
-  root = mkdtempSync(join(tmpdir(), 'iapeer-memplugin-'))
-})
-afterEach(() => {
-  rmSync(root, { recursive: true, force: true })
-})
-
-const DECLARATION = {
-  provider: 'iapeer-memory',
-  package: '@agfpd/iapeer-memory',
-  version: '0.1.0',
-  registeredAt: '2026-06-10T00:00:00Z',
-}
-const PLUGIN = { name: 'iapeer-memory', marketplace: 'agfpd', marketplaceRef: 'agfpd/agfpd-marketplace' }
-
-function declareSlot(withPlugin: boolean): void {
-  writeFileSync(memoryProviderPath(env()), JSON.stringify(withPlugin ? { ...DECLARATION, plugin: PLUGIN } : DECLARATION))
-}
-
-describe('memory-plugin gating (slot-derived)', () => {
-  test('EMPTY slot → explicit refusal, no outcomes', () => {
-    const r = memoryPluginApply('on', { all: true, env: env() })
-    expect(r.ok).toBe(false)
-    expect(r.error).toContain('EMPTY')
-    expect(r.outcomes).toEqual([])
-  })
-
-  test('v1 declaration (no plugin block) → explicit refusal pointing at generic enable', () => {
-    declareSlot(false)
-    const r = memoryPluginApply('on', { all: true, env: env() })
-    expect(r.ok).toBe(false)
-    expect(r.error).toContain('declares no plugin block')
-  })
-
-  test('unknown --peer → explicit refusal', async () => {
-    declareSlot(true)
-    const r = memoryPluginApply('on', { peer: 'ghost', env: env() })
-    expect(r.ok).toBe(false)
-    expect(r.error).toContain('not in the iapeer peers index')
-  })
-
-  test('on --all: plugin derived from the slot; runtime-missing host → clean per-runtime outcomes, ok', async () => {
-    declareSlot(true)
-    await upsertPeer({ personality: 'alpha', runtime: 'claude', cwd: join(root, 'alpha'), intelligence: 'artificial' }, { rootDir: root })
-    await upsertPeer({ personality: 'tim', runtime: 'notifier', cwd: join(root, 'tim'), intelligence: 'absent' }, { rootDir: root })
-    const r = memoryPluginApply('on', { all: true, env: env() })
-    expect(r.plugin).toEqual(PLUGIN)
-    expect(r.ok).toBe(true) // runtime-missing is a skip, not a failure
-    const alpha = r.outcomes.find(o => o.personality === 'alpha')
-    expect(alpha?.state).toBe('runtime-missing')
-    // a peer with NO agentic runtime is skipped explicitly
-    const tim = r.outcomes.find(o => o.personality === 'tim')
-    expect(tim?.state).toBe('skipped-no-agentic-runtime')
-  })
-
-  test('off --peer on a codex peer → explicit host-global message, NOT a silent skip', async () => {
-    declareSlot(true)
-    await upsertPeer({ personality: 'cx', runtime: 'codex', cwd: join(root, 'cx'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('off', { peer: 'cx', env: env() })
-    const o = r.outcomes.find(x => x.personality === 'cx' && x.runtime === 'codex')
-    expect(o?.state).toBe('skipped-host-global')
-    expect(o?.detail).toContain('--all')
-  })
-
-  test('off --all: codex host-global remove runs ONCE across the fleet', async () => {
-    declareSlot(true)
-    await upsertPeer({ personality: 'cx1', runtime: 'codex', cwd: join(root, 'cx1'), intelligence: 'artificial' }, { rootDir: root })
-    await upsertPeer({ personality: 'cx2', runtime: 'codex', cwd: join(root, 'cx2'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('off', { all: true, env: env() })
-    const codexOutcomes = r.outcomes.filter(x => x.runtime === 'codex')
-    // one real attempt (runtime-missing on this sandbox) + one 'already' dedupe
-    expect(codexOutcomes.filter(x => x.state === 'runtime-missing').length).toBe(1)
-    expect(codexOutcomes.filter(x => x.state === 'already').length).toBe(1)
-  })
-})
-
-// ─── v1.2 provision-инверсия (контракт §Provision провайдера, ADR-009) ───────
-
-import { chmodSync, readFileSync, existsSync } from 'fs'
-
-/** Declare a v1.2 slot whose provision/unprovision are fake journaling scripts. */
-function declareProvisionSlot(o: { provision?: boolean; unprovision?: boolean; alsoPlugin?: boolean; failing?: boolean }): {
-  journal: string
-} {
-  const journal = join(root, 'journal.txt')
-  const script = join(root, 'fake-provider.sh')
-  writeFileSync(
-    script,
-    o.failing ? `#!/bin/sh\necho provider broken >&2\nexit 7\n` : `#!/bin/sh\nprintf '%s\\n' "$@" >> '${journal}'\n`,
-  )
-  chmodSync(script, 0o755)
-  const block = (occ: string) => ({
-    command: script,
-    args: [occ, '--cwd', '{cwd}', '--runtime', '{runtime}', '--personality', '{personality}', '--occasion', '{occasion}'],
-  })
-  writeFileSync(
-    memoryProviderPath(env()),
-    JSON.stringify({
-      ...DECLARATION,
-      ...(o.alsoPlugin ? { plugin: PLUGIN } : {}),
-      ...(o.provision !== false ? { provision: block('provision-peer') } : {}),
-      ...(o.unprovision !== false ? { unprovision: block('unprovision-peer') } : {}),
-    }),
-  )
-  return { journal }
-}
-
-describe('memory-plugin v1.2 provision routing', () => {
-  test('on --peer: provision command invoked per agentic runtime with occasion=sweep-on, substituted argv', async () => {
-    const { journal } = declareProvisionSlot({})
-    await upsertPeer({ personality: 'alpha', runtime: 'claude', cwd: join(root, 'alpha'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('on', { peer: 'alpha', env: env() })
-    expect(r.ok).toBe(true)
-    expect(r.outcomes).toEqual([{ personality: 'alpha', runtime: 'claude', state: 'ok', detail: undefined }])
-    const j = readFileSync(journal, 'utf8').split('\n')
-    expect(j[0]).toBe('provision-peer')
-    expect(j.slice(1, 9)).toEqual(['--cwd', join(root, 'alpha'), '--runtime', 'claude', '--personality', 'alpha', '--occasion', 'sweep-on'])
-  })
-
-  test('PRECEDENCE: slot with BOTH blocks routes to provision; the plugin path is never touched', async () => {
-    const { journal } = declareProvisionSlot({ alsoPlugin: true })
-    await upsertPeer({ personality: 'beta', runtime: 'claude', cwd: join(root, 'beta'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('on', { peer: 'beta', env: env() })
-    expect(r.ok).toBe(true)
-    // plugin path on this sandbox would yield 'runtime-missing' (bins at /nonexistent);
-    // 'ok' from the journaling script proves the provision command ran instead.
-    expect(r.outcomes[0]?.state).toBe('ok')
-    expect(readFileSync(journal, 'utf8')).toContain('provision-peer')
-  })
-
-  test('provision failure → ok=false with detail, NO fallback to the plugin path', async () => {
-    declareProvisionSlot({ failing: true, alsoPlugin: true })
-    await upsertPeer({ personality: 'gamma', runtime: 'claude', cwd: join(root, 'gamma'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('on', { peer: 'gamma', env: env() })
-    expect(r.ok).toBe(false)
-    expect(r.outcomes[0]?.state).toBe('failed')
-    expect(r.outcomes[0]?.detail).toContain('provider broken')
-  })
-
-  test('off --peer → unprovision occasion=off-peer; off --all → off-all; codex has NO host-global special-casing', async () => {
-    const { journal } = declareProvisionSlot({})
-    await upsertPeer({ personality: 'cx', runtime: 'codex', cwd: join(root, 'cx'), intelligence: 'artificial' }, { rootDir: root })
-    const r1 = memoryPluginApply('off', { peer: 'cx', env: env() })
-    expect(r1.ok).toBe(true)
-    expect(r1.outcomes[0]).toEqual({ personality: 'cx', runtime: 'codex', state: 'ok', detail: undefined })
-    const r2 = memoryPluginApply('off', { all: true, env: env() })
-    expect(r2.ok).toBe(true)
-    const j = readFileSync(journal, 'utf8')
-    expect(j).toContain('off-peer')
-    expect(j).toContain('off-all')
-    expect(j).toContain('unprovision-peer')
-  })
-
-  test('missing direction block → explicit refusal (no silent skip, no plugin fallback)', async () => {
-    declareProvisionSlot({ unprovision: false, alsoPlugin: true })
-    await upsertPeer({ personality: 'delta', runtime: 'claude', cwd: join(root, 'delta'), intelligence: 'artificial' }, { rootDir: root })
-    const r = memoryPluginApply('off', { peer: 'delta', env: env() })
-    expect(r.ok).toBe(false)
-    expect(r.error).toContain('declares no unprovision command')
-  })
-
-  test('non-agentic peer → explicit skip (provision never invoked)', async () => {
-    const { journal } = declareProvisionSlot({})
-    await upsertPeer({ personality: 'tim2', runtime: 'notifier', cwd: join(root, 'tim2'), intelligence: 'absent' }, { rootDir: root })
-    const r = memoryPluginApply('on', { peer: 'tim2', env: env() })
-    expect(r.outcomes[0]?.state).toBe('skipped-no-agentic-runtime')
-    expect(existsSync(journal)).toBe(false)
-  })
-})

package/src/enable/memoryPlugin.ts

@@ -1,210 +0,0 @@
-// memory-plugin — the slot-derived operator verb (контракт «Слот памяти»
-// §Плагин провайдера — авто-установка при рождении; agreed iapeer-memory + boris
-// 10.06). By analogy with native-memory: `iapeer memory-plugin <on|off>
-// (--peer <p> | --all)`. The plugin identity is DERIVED from the slot
-// declaration's v1.1 `plugin` block — an empty slot or a v1 declaration without
-// the block is an EXPLICIT refusal (for arbitrary plugins the generic `iapeer
-// enable` exists). Install/removal forms live in enable/index.ts (the ONE home);
-// this module only orchestrates targets and the codex host-global semantics.
-//
-// Consumers: the operator, the provider's init-sweep (`on --all` after writing
-// the declaration), and the provider's uninstall (`off --all` BEFORE deleting
-// the declaration — agreed AUTO-removal: a dead provider's plugin actively
-// errors in every session, unlike the native-memory restore asymmetry).
-
-import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
-import { findPeer, readPeersIndex } from '../registry/index.ts'
-import { readMemoryProvider, type MemoryProviderPlugin, type MemoryProviderProvision } from '../status/index.ts'
-import { pluginLogsDir } from '../storage/index.ts'
-import {
-  enableCapabilityForCwd,
-  removeClaudeForCwd,
-  removeCodexGlobal,
-  type CapabilityRuntime,
-} from './index.ts'
-import { runProvisionCommand, type ProvisionOccasion } from './provisionCommand.ts'
-
-export interface MemoryPluginOutcome {
-  personality: string
-  runtime: CapabilityRuntime | 'none'
-  /** enable states (on) | remove states (off) | orchestration-level skips. */
-  state: string
-  detail?: string
-}
-
-export interface MemoryPluginResult {
-  ok: boolean
-  /** The derived plugin (null when the slot refused — see error). */
-  plugin: MemoryProviderPlugin | null
-  /** Refusal reason (empty slot / v1 declaration / no targets). */
-  error?: string
-  outcomes: MemoryPluginOutcome[]
-}
-
-export interface MemoryPluginOptions {
-  peer?: string
-  all?: boolean
-  env?: NodeJS.ProcessEnv
-}
-
-/**
- * Apply the slot-declared provider plugin across targets. `on` = install per the
- * canonical forms (claude project-scope per peer cwd; codex host-global once —
- * idempotent). `off` = claude per-peer project-scope uninstall; codex is
- * HOST-GLOBAL, so off with `--peer` on a codex runtime reports an explicit
- * «host-global — use --all» (no silent skip, сверка boris) and the global remove
- * runs only under `--all` (once).
- */
-export function memoryPluginApply(state: 'on' | 'off', opts: MemoryPluginOptions = {}): MemoryPluginResult {
-  const env = opts.env ?? process.env
-  const slot = readMemoryProvider(env)
-  if (!slot) {
-    return { ok: false, plugin: null, error: 'memory slot is EMPTY — no provider declared, nothing to install', outcomes: [] }
-  }
-  // v1.2 PRECEDENCE (контракт §Provision провайдера): a provision-declaring slot
-  // routes BOTH verb directions through the provider's commands; the deprecated
-  // v1.1 plugin block is ignored entirely (no fallback — masking a provision
-  // failure would hide a broken provider behind a stale plugin install).
-  if (slot.provision || slot.unprovision) {
-    return memoryProvisionApply(state, slot.provision, slot.unprovision, slot.provider, opts, env)
-  }
-  if (!slot.plugin) {
-    return {
-      ok: false,
-      plugin: null,
-      error: `provider "${slot.provider}" declares no plugin block (declaration v1) — for arbitrary plugins use \`iapeer enable\``,
-      outcomes: [],
-    }
-  }
-  const plugin = slot.plugin
-  const index = readPeersIndex({ env })
-  const targets = opts.all === true ? index.peers : opts.peer ? (p => (p ? [p] : []))(findPeer(index, opts.peer)) : []
-  if (targets.length === 0) {
-    return {
-      ok: false,
-      plugin,
-      error: opts.peer ? `peer "${opts.peer}" is not in the iapeer peers index` : 'no targets — pass --peer <p> or --all',
-      outcomes: [],
-    }
-  }
-
-  const outcomes: MemoryPluginOutcome[] = []
-  let codexHandledGlobally = false
-  for (const p of targets) {
-    const agentic = p.runtimes.filter((r): r is CapabilityRuntime => r === 'claude' || r === 'codex')
-    if (agentic.length === 0) {
-      outcomes.push({ personality: p.personality, runtime: 'none', state: 'skipped-no-agentic-runtime' })
-      continue
-    }
-    if (state === 'on') {
-      const r = enableCapabilityForCwd({
-        plugin: plugin.name,
-        marketplace: plugin.marketplace,
-        marketplaceRef: plugin.marketplaceRef,
-        cwd: p.cwd,
-        personality: p.personality,
-        runtimes: agentic,
-        env,
-      })
-      for (const rr of r.runtimes) {
-        outcomes.push({ personality: p.personality, runtime: rr.runtime, state: rr.state, detail: rr.detail })
-      }
-      if (r.setup !== 'absent') {
-        outcomes.push({ personality: p.personality, runtime: agentic[0]!, state: `setup-${r.setup}`, detail: r.setupDetail })
-      }
-    } else {
-      for (const rt of agentic) {
-        if (rt === 'claude') {
-          const rr = removeClaudeForCwd(plugin.name, plugin.marketplace, p.cwd, env)
-          outcomes.push({ personality: p.personality, runtime: 'claude', state: rr.state, detail: rr.detail })
-        } else {
-          // codex plugin is HOST-GLOBAL: per-peer off is impossible — explicit
-          // message (сверка boris), the actual remove runs ONCE under --all.
-          if (opts.all !== true) {
-            outcomes.push({
-              personality: p.personality,
-              runtime: 'codex',
-              state: 'skipped-host-global',
-              detail: 'codex plugin is host-global — use `memory-plugin off --all`',
-            })
-          } else if (!codexHandledGlobally) {
-            codexHandledGlobally = true
-            const rr = removeCodexGlobal(plugin.name, plugin.marketplace, env)
-            outcomes.push({ personality: p.personality, runtime: 'codex', state: rr.state, detail: rr.detail })
-          } else {
-            outcomes.push({ personality: p.personality, runtime: 'codex', state: 'already', detail: 'host-global remove already done this run' })
-          }
-        }
-      }
-    }
-  }
-  const failed = outcomes.some(o => o.state === 'failed' || o.state === 'setup-failed')
-  return { ok: !failed, plugin, outcomes }
-}
-
-/**
- * v1.2 verb routing through the provider's provision/unprovision commands
- * (occasion: on → sweep-on; off --peer → off-peer; off --all → off-all). One
- * invocation per target peer × agentic runtime — NO host-global special-casing
- * here: ref-counting of host-global surfaces (codex) moved to the PROVIDER with
- * the inversion (contract requirement 4). A direction whose command block is
- * absent is an explicit refusal (never silently skipped, never plugin-fallback).
- */
-function memoryProvisionApply(
-  state: 'on' | 'off',
-  provision: MemoryProviderProvision | undefined,
-  unprovision: MemoryProviderProvision | undefined,
-  provider: string,
-  opts: MemoryPluginOptions,
-  env: NodeJS.ProcessEnv,
-): MemoryPluginResult {
-  const block = state === 'on' ? provision : unprovision
-  if (!block) {
-    return {
-      ok: false,
-      plugin: null,
-      error:
-        `provider "${provider}" declares no ${state === 'on' ? 'provision' : 'unprovision'} command ` +
-        `(declaration v1.2 requires both directions) — fix the provider's declaration`,
-      outcomes: [],
-    }
-  }
-  const index = readPeersIndex({ env })
-  const targets = opts.all === true ? index.peers : opts.peer ? (p => (p ? [p] : []))(findPeer(index, opts.peer)) : []
-  if (targets.length === 0) {
-    return {
-      ok: false,
-      plugin: null,
-      error: opts.peer ? `peer "${opts.peer}" is not in the iapeer peers index` : 'no targets — pass --peer <p> or --all',
-      outcomes: [],
-    }
-  }
-  const occasion: ProvisionOccasion = state === 'on' ? 'sweep-on' : opts.all === true ? 'off-all' : 'off-peer'
-  const outcomes: MemoryPluginOutcome[] = []
-  for (const p of targets) {
-    const agentic = p.runtimes.filter((r): r is CapabilityRuntime => r === 'claude' || r === 'codex')
-    if (agentic.length === 0) {
-      outcomes.push({ personality: p.personality, runtime: 'none', state: 'skipped-no-agentic-runtime' })
-      continue
-    }
-    for (const rt of agentic) {
-      const o = runProvisionCommand({ block, cwd: p.cwd, runtime: rt, personality: p.personality, occasion, env })
-      appendLifecycleEvent(
-        pluginLogsDir('iapeer', { env }),
-        {
-          ev: 'memory-provision',
-          identity: `${rt}-${p.personality}`,
-          occasion,
-          state: o.state,
-          exit: o.exitCode ?? undefined,
-          ms: o.durationMs,
-          detail: o.detail,
-        },
-        { env },
-      )
-      outcomes.push({ personality: p.personality, runtime: rt, state: o.state, detail: o.detail })
-    }
-  }
-  const failed = outcomes.some(o => o.state !== 'ok' && o.state !== 'skipped-no-agentic-runtime')
-  return { ok: !failed, plugin: null, outcomes }
-}