@agfpd/iapeer 0.2.47 → 0.2.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.47",
+  "version": "0.2.49",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/index.ts

@@ -20,7 +20,7 @@ import {
   type Runtime,
 } from '../core/constants.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
+import { recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
@@ -63,6 +63,22 @@ import { readMemoryProvider } from '../status/index.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { pluginLogsDir } from '../storage/index.ts'
 
+function infraRecycleNote(infra: readonly { personality: string; state: string; detail?: string }[] | undefined): string {
+  if (!infra?.length) return ''
+  const touched = infra.filter(i => i.state === 'restarted').map(i => i.personality)
+  const failed = infra.filter(i => i.state === 'failed')
+  const passive = infra.filter(i => i.state !== 'restarted' && i.state !== 'failed')
+  const parts: string[] = []
+  if (touched.length) parts.push(`infra recycled: ${touched.join(', ')}`)
+  if (passive.length) parts.push(`infra ${passive.map(i => `${i.personality} ${i.state}`).join(', ')}`)
+  if (failed.length) parts.push(`infra FAILED: ${failed.map(i => `${i.personality}${i.detail ? ` (${i.detail})` : ''}`).join('; ')}`)
+  return parts.length ? `; ${parts.join('; ')}` : ''
+}
+
+function infraRecycleFailed(infra: readonly { state: string }[] | undefined): boolean {
+  return (infra ?? []).some(i => i.state === 'failed')
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // list — registry + per-runtime liveness (contract Примитивы §list)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -760,8 +776,8 @@ export function parseArgs(argv: string[]): { positionals: string[]; flags: Recor
 
 const USAGE = `usage: iapeer <verb> [args]
   install                                                        build binary + global scaffold + daemon plist (one bootstrap)
-  update [version] [--force]                                     pull latest (or an exact version) of @agfpd/iapeer from npm + restart the daemon
-  rollback                                                       revert to the previous binary (.prev) + restart the daemon
+  update [version] [--force]                                     pull latest (or exact) @agfpd/iapeer from npm + restart daemon + recycle owned infra jobs
+  rollback                                                       revert to the previous binary (.prev) + restart daemon + recycle owned infra jobs
   version | --version | -v                                       print the installed binary's version
   help | --help | -h                                             print this usage (works appended to any verb; executes nothing)
   daemon [--install-plist]                                       run the host-wide HTTP-MCP router (launchd-held)
@@ -1324,7 +1340,12 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
               `roll back now: iapeer rollback\n`)
             return 1
           }
-          out(`updated ${r.from} → ${r.to}; daemon restarted and healthy\n`)
+          const note = infraRecycleNote(r.infra)
+          if (infraRecycleFailed(r.infra)) {
+            errOut(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
+            return 1
+          }
+          out(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
           return 0
         }
         const daemonNote =
@@ -1333,8 +1354,10 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             : r.daemon === 'failed'
               ? `WARNING — ${r.reason}; roll back with: iapeer rollback`
               : String(r.daemon)
-        out(`updated ${r.from} → ${r.to}; ${daemonNote}\n`)
-        return r.daemon === 'failed' ? 1 : 0
+        const note = infraRecycleNote(r.infra)
+        const failed = r.daemon === 'failed' || infraRecycleFailed(r.infra)
+        ;(failed ? errOut : out)(`updated ${r.from} → ${r.to}; ${daemonNote}${note}\n`)
+        return failed ? 1 : 0
       }
       case 'rollback': {
         // Recovery: restore the .prev binary kept by the last install, restart the
@@ -1348,23 +1371,26 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 1
         }
         const restart = cycleDaemon(env)
+        const infra = recycleFoundationOwnedInfraJobs(env)
+        const infraNote = infraRecycleNote(infra)
+        const infraFailed = infraRecycleFailed(infra)
         if (restart.state === 'restarted') {
           const h = await waitForDaemonHealthy({ env })
-          out(
-            h.healthy
-              ? `rolled back to the previous binary; daemon restarted and healthy\n`
-              : `rolled back, but the daemon is NOT healthy after restart (${h.detail})\n`,
-          )
-          return h.healthy ? 0 : 1
+          const msg = h.healthy
+            ? `rolled back to the previous binary; daemon restarted and healthy${infraNote}\n`
+            : `rolled back, but the daemon is NOT healthy after restart (${h.detail})${infraNote}\n`
+          ;(h.healthy && !infraFailed ? out : errOut)(msg)
+          return h.healthy && !infraFailed ? 0 : 1
         }
-        out(
+        const msg =
           `rolled back to the previous binary; ${
             restart.state === 'not-loaded'
               ? 'daemon not loaded — previous binary will be used on next start'
               : `daemon restart ${restart.state}${restart.detail ? ` (${restart.detail})` : ''}`
-          }\n`,
-        )
-        return restart.state === 'failed' ? 1 : 0
+          }${infraNote}\n`
+        const failed = restart.state === 'failed' || infraFailed
+        ;(failed ? errOut : out)(msg)
+        return failed ? 1 : 0
       }
       case 'install': {
         // UNIFIED foundation install (contract Установка §1 — "один npx ставит

package/src/launch/index.ts

@@ -61,6 +61,8 @@ export {
   isFoundationOwnedPlist,
   launchctlBootstrap,
   bootstrapJobCore,
+  cycleLaunchdJob,
+  cycleLaunchdJobCore,
   cycleDaemon,
   cycleDaemonCore,
   resolveExecutable,
@@ -75,6 +77,8 @@ export type {
   BootstrapCoreResult,
   DaemonRestartResult,
   DaemonRestartState,
+  LaunchdJobCycleResult,
+  LaunchdJobCycleState,
   LaunchctlRunner,
 } from './launchd.ts'
 

package/src/launch/launchd.ts

@@ -298,38 +298,41 @@ export function bootstrapJobCore(
   }
 }
 
-export type DaemonRestartState =
-  | 'restarted' // bootout + bootstrap succeeded → the daemon runs the freshly-installed binary
-  | 'not-loaded' // com.agfpd.iapeer is not in the gui domain → nothing to restart (new binary
-  //                will be used whenever it IS next started; nothing to do here)
+export type LaunchdJobCycleState =
+  | 'restarted' // bootout + bootstrap succeeded → the job runs with the currently-referenced binaries
+  | 'not-loaded' // the label is not in the gui domain → nothing to restart (next start will use the current plist/binaries)
   | 'skipped-sandbox' // IAPEER_TEST_SANDBOX=1 → never touch the real launchd
   | 'failed' // bootout/bootstrap failed — the result carries the manual rescue recipe
 
-export interface DaemonRestartResult {
-  state: DaemonRestartState
+export interface LaunchdJobCycleResult {
+  state: LaunchdJobCycleState
   detail?: string
 }
 
+export type DaemonRestartState = LaunchdJobCycleState
+export interface DaemonRestartResult extends LaunchdJobCycleResult {}
+
 /**
- * DI core of cycleDaemon (unit-testable without launchctl): bootout → wait-for-gone
+ * DI core of cycleLaunchdJob (unit-testable without launchctl): bootout → wait-for-gone
  * → bootstrap, composed on bootstrapJobCore's undead-job-safe wait/backoff.
  * Disambiguation of bootstrapJobCore's 'already-loaded': at attempts=0 it means the
  * job NEVER unloaded after our bootout (undead beyond budget) → FAIL loud with the
  * manual recipe; at attempts>0 it means a retry found the job loaded (our previous
  * attempt half-succeeded or KeepAlive raced us in) → the job IS up → success.
  */
-export function cycleDaemonCore(
+export function cycleLaunchdJobCore(
   uid: string,
+  label: string,
   plistPath: string,
   deps: BootstrapCoreDeps,
-): DaemonRestartResult {
-  const listed = () => deps.run(['print', `gui/${uid}/${DAEMON_PLIST_LABEL}`]).status === 0
+): LaunchdJobCycleResult {
+  const listed = () => deps.run(['print', `gui/${uid}/${label}`]).status === 0
   if (!listed()) return { state: 'not-loaded' }
-  const bo = deps.run(['bootout', `gui/${uid}/${DAEMON_PLIST_LABEL}`])
+  const bo = deps.run(['bootout', `gui/${uid}/${label}`])
   if (bo.status !== 0) {
     return { state: 'failed', detail: `launchctl bootout failed: ${bo.stderr.trim() || `exit ${bo.status}`}` }
   }
-  const core = bootstrapJobCore(uid, DAEMON_PLIST_LABEL, plistPath, deps)
+  const core = bootstrapJobCore(uid, label, plistPath, deps)
   if (core.state === 'loaded' || (core.state === 'already-loaded' && core.attempts > 0)) {
     return { state: 'restarted' }
   }
@@ -338,7 +341,7 @@ export function cycleDaemonCore(
       state: 'failed',
       detail:
         `job never unloaded after bootout (undead beyond budget) — manual rescue: ` +
-        `launchctl bootout gui/${uid}/${DAEMON_PLIST_LABEL} && launchctl bootstrap gui/${uid} ${plistPath}`,
+        `launchctl bootout gui/${uid}/${label} && launchctl bootstrap gui/${uid} ${plistPath}`,
     }
   }
   return {
@@ -347,6 +350,15 @@ export function cycleDaemonCore(
   }
 }
 
+/** Back-compat wrapper for the foundation daemon's label. */
+export function cycleDaemonCore(
+  uid: string,
+  plistPath: string,
+  deps: BootstrapCoreDeps,
+): DaemonRestartResult {
+  return cycleLaunchdJobCore(uid, DAEMON_PLIST_LABEL, plistPath, deps)
+}
+
 /**
  * Restart the foundation daemon (`com.agfpd.iapeer`) onto the binary currently on
  * disk — `launchctl bootout` + `bootstrap`, DELIBERATELY NOT `kickstart -k`.
@@ -368,12 +380,26 @@ export function cycleDaemonCore(
  * version-stable (write-if-changed) and is NOT rewritten here. Sandbox-safe.
  */
 export function cycleDaemon(env: NodeJS.ProcessEnv = process.env): DaemonRestartResult {
+  return cycleLaunchdJob(DAEMON_PLIST_LABEL, join(launchAgentsDir(env), `${DAEMON_PLIST_LABEL}.plist`), env)
+}
+
+/**
+ * Restart any launchd job onto the executable(s) currently referenced by its plist:
+ * bootout → bootstrap, never kickstart. Used by the daemon update path AND by
+ * foundation-owned infra peers (`com.iapeer.*`) whose ProgramArguments also point at
+ * the installed `iapeer` binary. The caller owns any fleet/ownership guard; this
+ * primitive only cycles the concrete label/plist pair. Sandbox-safe.
+ */
+export function cycleLaunchdJob(
+  label: string,
+  plistPath: string,
+  env: NodeJS.ProcessEnv = process.env,
+): LaunchdJobCycleResult {
   if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') {
     return { state: 'skipped-sandbox' }
   }
   const uid = currentUid()
-  const plistPath = join(launchAgentsDir(env), `${DAEMON_PLIST_LABEL}.plist`)
-  return cycleDaemonCore(uid, plistPath, {
+  return cycleLaunchdJobCore(uid, label, plistPath, {
     run: args => {
       const r = spawnSync('launchctl', args, { encoding: 'utf8' })
       return { status: r.status, stderr: r.stderr ?? '' }

package/src/lifecycle/index.ts

@@ -1251,20 +1251,29 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
  * consumed BEFORE the relaunch so a relaunch failure does not loop on the same eager mark
  * (it then fresh-wakes lazily on its next message — branch 3a — never lost). NB: a /new'd
  * peer is expected to carry an initial_prompt; without one the first turn delivers nothing.
+ *
+ * Runtime is DELIBERATELY NOT pinned to the dead session's runtime: the relaunch passes
+ * no runtime so resolveWakeRuntime falls through to the registry default (H5 — registry
+ * is the only source of wake-runtime truth). Pinning broke the fleet-switch procedure
+ * (`default-runtime <rt>` + `self-fresh`): the peer silently resurrected on the OLD
+ * runtime, ignoring the just-flipped default (live incident 12.06, claude-iapeer). A
+ * session deliberately living on a non-default runtime has explicit paths back (wake
+ * with an explicit runtime); an owner /new returns the peer to its declared default.
  */
 export async function processEagerRelaunches(
   cfg: LifecycleConfig,
   outcomes: SuperviseOutcome[],
-  deps: WakeDeps = {},
+  deps: WakeDeps & { wakeFn?: (args: WakeArgs, deps: WakeDeps) => Promise<WakeResult> } = {},
 ): Promise<WakeResult[]> {
+  const wake = deps.wakeFn ?? wakeOrSpawn
   const results: WakeResult[] = []
   for (const o of outcomes) {
-    if (o.action !== 'needs-eager-fresh' || !o.personality || !o.runtime) continue
+    if (o.action !== 'needs-eager-fresh' || !o.personality) continue
     clearNewEager(cfg, o.identity) // consume the eager mark — the relaunch is fresh by construction
     try {
       results.push(
-        await wakeOrSpawn(
-          { personality: o.personality, runtime: o.runtime, task: '', resume: false },
+        await wake(
+          { personality: o.personality, task: '', resume: false },
           { cfg, env: deps.env },
         ),
       )

package/src/lifecycle/lifecycle.test.ts

@@ -621,6 +621,38 @@ describe('superviseTick death-cause accounting (TARGET)', () => {
     }
   })
 
+  test('eager relaunch does NOT pin the dead session runtime — re-resolves from the registry (H5 fleet-switch)', async () => {
+    // Live incident 12.06: `default-runtime codex` + `self-fresh` resurrected the peer
+    // on the OLD runtime — the relaunch passed the dead session's runtime EXPLICITLY,
+    // so resolveWakeRuntime never consulted the just-flipped registry default.
+    const { env, cfg, root, laDir } = deadSessionEnv('rt')
+    try {
+      setNewEager(cfg, 'claude-rt')
+      const outcomes = superviseTick(cfg, { env })
+      const o = outcomes.find(x => x.identity === 'claude-rt')
+      expect(o?.action).toBe('needs-eager-fresh')
+      const seen: Array<{ personality: string; runtime?: string; resume?: boolean; task: string }> = []
+      const { processEagerRelaunches } = await import('./index.ts')
+      await processEagerRelaunches(cfg, outcomes, {
+        env,
+        wakeFn: async args => {
+          seen.push({ personality: args.personality, runtime: args.runtime, resume: args.resume, task: args.task })
+          return { status: 'READY', woke: true }
+        },
+      })
+      expect(seen.length).toBe(1)
+      expect(seen[0].personality).toBe('rt')
+      expect(seen[0].runtime).toBeUndefined() // ← the fix: wakeOrSpawn re-resolves from the registry
+      expect(seen[0].resume).toBe(false)
+      expect(seen[0].task).toBe('')
+      // the mark was consumed by the relaunch
+      expect(hasNewEager(cfg, 'claude-rt')).toBe(false)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+      rmSync(laDir, { recursive: true, force: true })
+    }
+  })
+
   test('a DEAD session with NO .new-eager → reaped-gone, NO .idle-reaped written (crash leaves no marker)', () => {
     const { env, cfg, root, laDir } = deadSessionEnv('w')
     try {

package/src/update/index.ts

@@ -11,11 +11,14 @@
 //      and run ITS own source installer. DELIBERATELY NOT `npx … install` (see
 //      defaultRunInstall for why npx is unsafe here).
 //   4. cycle com.agfpd.iapeer IF loaded (bootout+bootstrap) (activate the new binary; kickstart hits the LWCR EX_CONFIG(78) bomb)
+//   5. recycle loaded FOUNDATION-OWNED infra jobs (com.iapeer.* with the sentinel)
+//      because their plists also run the just-replaced `iapeer run-infra` binary.
 //
-// Scope: the foundation ONLY (the @agfpd/iapeer binary + its daemon). It never
-// touches the plist (version-stable launch path) and never touches other packages
-// on the host (telegram-runtime / notifier-runtime / MergeMind / the peer fleet) —
-// each of those has its own version and its own update.
+// Scope: the foundation ONLY (the @agfpd/iapeer binary + its daemon + launchd
+// registrations of foundation-owned infra jobs that point at that binary). It never
+// rewrites those plists, never updates runtime packages (telegram-runtime /
+// notifier-runtime / MergeMind), and never touches foreign / persistent-peer fleet
+// plists — only sentinel-marked foundation-owned com.iapeer.* jobs are recycled.
 //
 // updateIapeer takes its three side-effects as INJECTED deps so the version-gate is
 // unit-testable with no network and no launchctl; the defaults are the real impls.
@@ -25,9 +28,19 @@ import { mkdtempSync, readdirSync, rmSync } from 'fs'
 import { connect } from 'net'
 import { tmpdir } from 'os'
 import { join } from 'path'
+import { isInfraRuntime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { cycleDaemon, type DaemonRestartResult } from '../launch/launchd.ts'
+import { readPeersIndex } from '../registry/index.ts'
+import {
+  cycleDaemon,
+  cycleLaunchdJob,
+  isFoundationOwnedPlist,
+  launchdLabel,
+  launchdPlistPath,
+  type DaemonRestartResult,
+  type LaunchdJobCycleResult,
+} from '../launch/launchd.ts'
 import { defaultDaemonSocketPath } from '../daemon/index.ts'
 
 /** The npm package the foundation publishes / updates from. */
@@ -45,11 +58,22 @@ export interface UpdateDeps {
   /** Resolve a spec ('latest' or an exact 'X.Y.Z') to the concrete published version it
    *  names, or null on a miss / npm error (default: `npm view @agfpd/iapeer@<spec> version`). */
   resolveVersion?: (spec: string, env: NodeJS.ProcessEnv) => string | null
-  /** Pull + rebuild the binary for `version` (default: `npx @agfpd/iapeer@<v> install`).
+  /** Pull + rebuild the binary for `version` (default: npm pack → extract → source install).
    *  Returns true on success. */
   runInstall?: (version: string, env: NodeJS.ProcessEnv) => boolean
   /** Restart the daemon onto the new binary (default: cycleDaemon — bootout+bootstrap, the LWCR-safe cycle). */
   restartDaemon?: (env: NodeJS.ProcessEnv) => DaemonRestartResult
+  /** Re-register loaded foundation-owned infra launchd jobs whose plists run the
+   *  installed iapeer binary (default: registry scan + sentinel guard). */
+  recycleInfraJobs?: (env: NodeJS.ProcessEnv) => InfraJobRecycleResult[]
+}
+
+export interface InfraJobRecycleResult {
+  personality: string
+  runtime: string
+  label: string
+  state: LaunchdJobCycleResult['state']
+  detail?: string
 }
 
 export interface UpdateResult {
@@ -62,6 +86,8 @@ export interface UpdateResult {
   to?: string
   /** What happened to the live daemon (only on 'updated'). */
   daemon?: DaemonRestartResult['state']
+  /** Foundation-owned infra jobs recycled after the binary swap (only on 'updated'). */
+  infra?: InfraJobRecycleResult[]
   /** Human reason on 'failed' / extra detail on a daemon restart hiccup. */
   reason?: string
 }
@@ -195,6 +221,30 @@ function defaultRunInstall(version: string, env: NodeJS.ProcessEnv): boolean {
   }
 }
 
+/**
+ * Re-register every loaded FOUNDATION-owned infra peer job after the installed
+ * iapeer binary is replaced. These plists run `iapeer run-infra <peer> <runtime>`;
+ * if launchd keeps the old managed launch constraint, a later KeepAlive respawn can
+ * hit the same EX_CONFIG(78) LWCR crash-loop that bit the daemon. Full bootout →
+ * bootstrap clears the registration. Foreign / persistent-peer plists are skipped
+ * by the sentinel guard, preserving H4.
+ */
+export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process.env): InfraJobRecycleResult[] {
+  if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') return []
+  const out: InfraJobRecycleResult[] = []
+  const index = readPeersIndex({ env })
+  for (const peer of index.peers) {
+    const runtime = (isInfraRuntime(peer.runtime) ? peer.runtime : peer.runtimes.find(isInfraRuntime)) ?? ''
+    if (!runtime) continue
+    const plist = launchdPlistPath(peer.personality, env)
+    if (!isFoundationOwnedPlist(plist)) continue
+    const label = launchdLabel(peer.personality)
+    const r = cycleLaunchdJob(label, plist, env)
+    out.push({ personality: peer.personality, runtime, label, state: r.state, detail: r.detail })
+  }
+  return out
+}
+
 /**
  * Update the foundation to the latest published version (cloud-only) and restart
  * the daemon onto it. Idempotent + version-gated: a no-op "already-latest" when the
@@ -242,12 +292,18 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
 
   const restart = deps.restartDaemon ?? cycleDaemon
   const d = restart(env)
+  const recycleInfra = deps.recycleInfraJobs ?? recycleFoundationOwnedInfraJobs
+  // If the daemon re-registration itself failed, do NOT widen the blast radius by
+  // cycling infra jobs onto a binary whose daemon could not come up. Rollback will
+  // re-cycle them after restoring `.prev`.
+  const infra = d.state === 'failed' ? [] : recycleInfra(env)
   return {
     status: 'updated',
     from,
     to: desired,
     latest: desired,
     daemon: d.state,
+    infra,
     reason: d.state === 'failed' ? `binary updated but daemon restart failed: ${d.detail ?? ''}`.trim() : undefined,
   }
 }

package/src/update/update.test.ts

@@ -4,7 +4,7 @@
 // exercised too (a test must never npx-install over the prod binary).
 
 import { describe, expect, test } from 'bun:test'
-import { IAPEER_VERSION, updateIapeer, waitForDaemonHealthy } from '../index.ts'
+import { IAPEER_VERSION, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../index.ts'
 import type { DaemonRestartResult } from '../launch/launchd.ts'
 
 const restarted = (): DaemonRestartResult => ({ state: 'restarted' })
@@ -17,9 +17,10 @@ function harness(opts: {
   target?: string
   installOk?: boolean
   restart?: DaemonRestartResult
+  recycle?: ReturnType<typeof recycleFoundationOwnedInfraJobs>
   force?: boolean
 }) {
-  const calls = { install: [] as string[], restart: 0, resolved: [] as string[] }
+  const calls = { install: [] as string[], restart: 0, recycle: 0, resolved: [] as string[] }
   const result = updateIapeer({
     env: { IAPEER_TEST_SANDBOX: '1' },
     force: opts.force,
@@ -37,6 +38,10 @@ function harness(opts: {
       calls.restart++
       return opts.restart ?? restarted()
     },
+    recycleInfraJobs: () => {
+      calls.recycle++
+      return opts.recycle ?? []
+    },
   })
   return { result, calls }
 }
@@ -49,6 +54,7 @@ describe('updateIapeer — version gate', () => {
     expect(result.latest).toBe('0.2.2')
     expect(calls.install).toEqual([])
     expect(calls.restart).toBe(0)
+    expect(calls.recycle).toBe(0)
   })
 
   test('--force reinstalls + restarts even when already latest', () => {
@@ -65,8 +71,18 @@ describe('updateIapeer — version gate', () => {
     expect(result.from).toBe('0.2.2')
     expect(result.to).toBe('0.3.0')
     expect(result.daemon).toBe('restarted')
+    expect(result.infra).toEqual([])
     expect(calls.install).toEqual(['0.3.0']) // installs latest, not current
     expect(calls.restart).toBe(1)
+    expect(calls.recycle).toBe(1)
+  })
+
+  test('after binary install, loaded foundation-owned infra jobs are recycled too', () => {
+    const recycle = [{ personality: 'timer', runtime: 'notifier', label: 'com.iapeer.timer', state: 'restarted' as const }]
+    const { result, calls } = harness({ current: '0.2.2', latest: '0.3.0', recycle })
+    expect(result.status).toBe('updated')
+    expect(result.infra).toEqual(recycle)
+    expect(calls.recycle).toBe(1)
   })
 
   test('no target → resolves the "latest" spec', () => {
@@ -125,7 +141,7 @@ describe('updateIapeer — failure paths', () => {
   })
 
   test('binary updated but restart failed → updated with a warning reason', () => {
-    const { result } = harness({
+    const { result, calls } = harness({
       current: '0.2.2',
       latest: '0.3.0',
       restart: { state: 'failed', detail: 'kickstart exit 1' },
@@ -133,6 +149,7 @@ describe('updateIapeer — failure paths', () => {
     expect(result.status).toBe('updated')
     expect(result.daemon).toBe('failed')
     expect(result.reason).toMatch(/restart failed.*kickstart exit 1/i)
+    expect(calls.recycle).toBe(0)
   })
 })