@agfpd/iapeer 0.2.48 → 0.2.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.48",
+  "version": "0.2.50",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/cli/cli.test.ts

@@ -7,10 +7,11 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
-import { addRuntime, defaultRuntime, formatListTable, listPeers, newPeer, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
+import { addRuntime, compactPeer, defaultRuntime, formatListTable, listPeers, newPeer, parseArgs, removePeerCli, runCli, sendMessage, startPeer, stopPeer } from './index.ts'
 import { findPeer, readPeersIndex, upsertPeer } from '../registry/index.ts'
 import { hasIdleReaped, isStopped, loadLifecycleConfig, setIdleReaped, setStopped } from '../lifecycle/index.ts'
 import { launchdPlistPath } from '../launch/launchd.ts'
+import { ok } from '../core/errors.ts'
 
 let root: string
 let laDir: string
@@ -452,6 +453,58 @@ describe('new (unconditional fresh restart)', () => {
   })
 })
 
+// ─── compact-resume — control addresses the dialogue, not just a live session ──
+
+describe('compact (resume sleeping dialogue)', () => {
+  test('clean idle-reaped asleep peer → explicit resume wake, then /compact control', async () => {
+    await register('sleepy', 'codex')
+    const e = env()
+    const cfg = loadLifecycleConfig(e)
+    setIdleReaped(cfg, 'codex-sleepy')
+    const wakeCalls: unknown[] = []
+    const controlCalls: unknown[] = []
+    const o = await compactPeer('sleepy', 'codex', {
+      env: e,
+      wakeFn: async args => {
+        wakeCalls.push(args)
+        return { status: 'READY', woke: true, runtime: args.runtime, process_address: `${args.runtime}-${args.personality}`, taskDelivered: true }
+      },
+      controlFn: (personality, runtime, command) => {
+        controlCalls.push({ personality, runtime, command })
+        return ok({ ok: true, controlled: { personality, runtime: runtime! }, command: command.name, ts: 't' })
+      },
+    })
+    expect(o).toMatchObject({ action: 'compacted', runtime: 'codex', woke: true })
+    expect(wakeCalls).toEqual([{ personality: 'sleepy', runtime: 'codex', task: '', resume: true }])
+    expect(controlCalls).toEqual([{ personality: 'sleepy', runtime: 'codex', command: { name: 'compact' } }])
+    expect(hasIdleReaped(cfg, 'codex-sleepy')).toBe(false)
+  })
+
+  test('crashed / first-wake asleep peer (no clean idle marker) → nothing-to-compact, no fresh wake', async () => {
+    await register('freshy', 'codex')
+    let woke = false
+    const o = await compactPeer('freshy', 'codex', {
+      env: env(),
+      wakeFn: async () => ((woke = true), { status: 'READY', woke: true }),
+    })
+    expect(o.action).toBe('nothing-to-compact')
+    expect(o.reason).toContain('nothing to compact')
+    expect(woke).toBe(false)
+  })
+
+  test('idle marker but no transcript/session to resume → nothing-to-compact (not fresh)', async () => {
+    await register('empty', 'codex')
+    const e = env()
+    setIdleReaped(loadLifecycleConfig(e), 'codex-empty')
+    const o = await compactPeer('empty', 'codex', {
+      env: e,
+      wakeFn: async args => ({ status: 'FAILED', woke: false, runtime: args.runtime, reason: 'no codex session to resume' }),
+    })
+    expect(o.action).toBe('nothing-to-compact')
+    expect(o.reason).toContain('nothing to compact')
+  })
+})
+
 // ─── add-runtime / default-runtime — the fleet-switch levers (codex-parity) ───
 
 describe('add-runtime / default-runtime (fleet-switch levers)', () => {

package/src/cli/index.ts

@@ -20,7 +20,7 @@ import {
   type Runtime,
 } from '../core/constants.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
+import { recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
@@ -31,10 +31,12 @@ import {
   clearNewEager,
   clearStopped,
   folderLaunch,
+  hasIdleReaped,
   isLaunchdManaged,
   isEphemeralPeer,
   isStopped,
   killSession,
+  lastActiveRuntime,
   loadLifecycleConfig,
   purgeIdentityState,
   removeSessionState,
@@ -63,6 +65,22 @@ import { readMemoryProvider } from '../status/index.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { pluginLogsDir } from '../storage/index.ts'
 
+function infraRecycleNote(infra: readonly { personality: string; state: string; detail?: string }[] | undefined): string {
+  if (!infra?.length) return ''
+  const touched = infra.filter(i => i.state === 'restarted').map(i => i.personality)
+  const failed = infra.filter(i => i.state === 'failed')
+  const passive = infra.filter(i => i.state !== 'restarted' && i.state !== 'failed')
+  const parts: string[] = []
+  if (touched.length) parts.push(`infra recycled: ${touched.join(', ')}`)
+  if (passive.length) parts.push(`infra ${passive.map(i => `${i.personality} ${i.state}`).join(', ')}`)
+  if (failed.length) parts.push(`infra FAILED: ${failed.map(i => `${i.personality}${i.detail ? ` (${i.detail})` : ''}`).join('; ')}`)
+  return parts.length ? `; ${parts.join('; ')}` : ''
+}
+
+function infraRecycleFailed(infra: readonly { state: string }[] | undefined): boolean {
+  return (infra ?? []).some(i => i.state === 'failed')
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // list — registry + per-runtime liveness (contract Примитивы §list)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -487,6 +505,95 @@ export async function newPeer(
   return { personality, runtime: rt, action: 'fresh' }
 }
 
+export interface CompactPeerOutcome {
+  personality: string
+  runtime: string
+  action: 'compacted' | 'nothing-to-compact' | 'refused-foreign-launchd' | 'refused-infra' | 'refused-undeclared-runtime' | 'failed'
+  woke?: boolean
+  reason?: string
+}
+
+/**
+ * compact <peer> [runtime] — compact the DIALOGUE, not merely the currently-live
+ * session. A live target receives the in-session `/compact` control as before. A
+ * cleanly idle-reaped target is first resumed into the same dialogue, then compacted.
+ * A crashed / never-run / non-resumable target returns an honest "nothing to compact"
+ * instead of starting a fresh empty session and compacting that.
+ */
+export async function compactPeer(
+  personality: string,
+  runtime: string | undefined,
+  opts: CliEnvOptions & {
+    wakeFn?: (args: { personality: string; runtime: Runtime; task: string; resume: true }) => Promise<WakeResult>
+    controlFn?: typeof routeControl
+  } = {},
+): Promise<CompactPeerOutcome> {
+  const env = opts.env ?? process.env
+  const cfg = loadLifecycleConfig(env)
+  const peer = findPeer(readPeersIndex({ env }), personality)
+  if (!peer) throw new Error(`peer "${personality}" is not registered`)
+  if (isForeignLaunchd(personality, env)) {
+    return {
+      personality,
+      runtime: peer.runtime,
+      action: 'refused-foreign-launchd',
+      reason: `"${personality}" is managed by persistent-peer (foreign launchd plist) — the foundation does not control it`,
+    }
+  }
+  if (runtime && !isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
+  if (runtime && peer.runtime !== runtime && !peer.runtimes.includes(runtime as Runtime)) {
+    return {
+      personality,
+      runtime,
+      action: 'refused-undeclared-runtime',
+      reason: `peer "${personality}" does not declare runtime "${runtime}" (declared: ${peer.runtimes.join(', ')})`,
+    }
+  }
+
+  const control = opts.controlFn ?? routeControl
+  const liveRuntimes = peer.runtimes.filter(rt => isPeerLive(rt, personality, cfg.sockDir))
+  if (runtime ? liveRuntimes.includes(runtime as Runtime) : liveRuntimes.length > 0) {
+    const r = control(personality, runtime, { name: 'compact' })
+    if (!r.ok) return { personality, runtime: runtime ?? peer.runtime, action: 'failed', reason: r.error.message }
+    return { personality, runtime: r.value.controlled.runtime, action: 'compacted', woke: false }
+  }
+
+  const rt: Runtime = (runtime as Runtime | undefined) ?? lastActiveRuntime(peer, cfg) ?? peer.runtime
+  if (!peer.runtimes.includes(rt)) {
+    return {
+      personality,
+      runtime: rt,
+      action: 'refused-undeclared-runtime',
+      reason: `peer "${personality}" does not declare runtime "${rt}" (declared: ${peer.runtimes.join(', ')})`,
+    }
+  }
+  if (isInfraRuntime(rt)) {
+    return {
+      personality,
+      runtime: rt,
+      action: 'refused-infra',
+      reason: `infra runtime "${rt}" is launchd-held and has no compactable TUI dialogue`,
+    }
+  }
+  const identity = buildProcessAddress(rt, personality)
+  if (!hasIdleReaped(cfg, identity)) {
+    return { personality, runtime: rt, action: 'nothing-to-compact', reason: 'context is fresh; nothing to compact' }
+  }
+  const wake = opts.wakeFn ?? (args => wakeOrSpawn(args, { cfg, env }))
+  const w = await wake({ personality, runtime: rt, task: '', resume: true })
+  if (w.status !== 'READY') {
+    const reason = w.reason ?? 'wake failed'
+    if (/no .*session to resume|no transcript to resume|nothing to resume/i.test(reason)) {
+      return { personality, runtime: rt, action: 'nothing-to-compact', reason: 'context is fresh; nothing to compact' }
+    }
+    return { personality, runtime: rt, action: 'failed', reason }
+  }
+  clearIdleReaped(cfg, identity)
+  const r = control(personality, rt, { name: 'compact' })
+  if (!r.ok) return { personality, runtime: rt, action: 'failed', woke: true, reason: r.error.message }
+  return { personality, runtime: rt, action: 'compacted', woke: true }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // remove — delete a peer's record from the registry through the LOCKED writer
 // (registry.removePeer). Direct edits of peers-profiles.json are refused at
@@ -760,8 +867,8 @@ export function parseArgs(argv: string[]): { positionals: string[]; flags: Recor
 
 const USAGE = `usage: iapeer <verb> [args]
   install                                                        build binary + global scaffold + daemon plist (one bootstrap)
-  update [version] [--force]                                     pull latest (or an exact version) of @agfpd/iapeer from npm + restart the daemon
-  rollback                                                       revert to the previous binary (.prev) + restart the daemon
+  update [version] [--force]                                     pull latest (or exact) @agfpd/iapeer from npm + restart daemon + recycle owned infra jobs
+  rollback                                                       revert to the previous binary (.prev) + restart daemon + recycle owned infra jobs
   version | --version | -v                                       print the installed binary's version
   help | --help | -h                                             print this usage (works appended to any verb; executes nothing)
   daemon [--install-plist]                                       run the host-wide HTTP-MCP router (launchd-held)
@@ -788,7 +895,7 @@ const USAGE = `usage: iapeer <verb> [args]
   default-runtime <runtime> (--peer <p> | --all)                 flip the PRIMARY (routing/wake default) — the fleet-switch lever; refuses an undeclared runtime; registry self-healed in the same command
   attach <peer> [runtime]                                        ensure-live + resume, then tmux attach
   interrupt <peer> [runtime]                                     interrupt the current turn (Escape) — context intact
-  compact <peer> [runtime]                                       compact the peer's context (/compact)
+  compact <peer> [runtime]                                       compact the peer's dialogue (/compact); resumes clean-asleep first
   self-fresh                                                     (agent self-call) mark /new eager-fresh + self-kill — the daemon relaunches fresh
   self-done                                                      (agent self-call, ephemeral) silent finish: arm own quiet-reap, wake no one
   native-memory <off|on> (--peer <p> | --all)                    gate/restore runtimes' native memory (canonized lever; контракт «Слот памяти»)
@@ -1324,7 +1431,12 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
               `roll back now: iapeer rollback\n`)
             return 1
           }
-          out(`updated ${r.from} → ${r.to}; daemon restarted and healthy\n`)
+          const note = infraRecycleNote(r.infra)
+          if (infraRecycleFailed(r.infra)) {
+            errOut(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
+            return 1
+          }
+          out(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
           return 0
         }
         const daemonNote =
@@ -1333,8 +1445,10 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             : r.daemon === 'failed'
               ? `WARNING — ${r.reason}; roll back with: iapeer rollback`
               : String(r.daemon)
-        out(`updated ${r.from} → ${r.to}; ${daemonNote}\n`)
-        return r.daemon === 'failed' ? 1 : 0
+        const note = infraRecycleNote(r.infra)
+        const failed = r.daemon === 'failed' || infraRecycleFailed(r.infra)
+        ;(failed ? errOut : out)(`updated ${r.from} → ${r.to}; ${daemonNote}${note}\n`)
+        return failed ? 1 : 0
       }
       case 'rollback': {
         // Recovery: restore the .prev binary kept by the last install, restart the
@@ -1348,23 +1462,26 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
           return 1
         }
         const restart = cycleDaemon(env)
+        const infra = recycleFoundationOwnedInfraJobs(env)
+        const infraNote = infraRecycleNote(infra)
+        const infraFailed = infraRecycleFailed(infra)
         if (restart.state === 'restarted') {
           const h = await waitForDaemonHealthy({ env })
-          out(
-            h.healthy
-              ? `rolled back to the previous binary; daemon restarted and healthy\n`
-              : `rolled back, but the daemon is NOT healthy after restart (${h.detail})\n`,
-          )
-          return h.healthy ? 0 : 1
+          const msg = h.healthy
+            ? `rolled back to the previous binary; daemon restarted and healthy${infraNote}\n`
+            : `rolled back, but the daemon is NOT healthy after restart (${h.detail})${infraNote}\n`
+          ;(h.healthy && !infraFailed ? out : errOut)(msg)
+          return h.healthy && !infraFailed ? 0 : 1
         }
-        out(
+        const msg =
           `rolled back to the previous binary; ${
             restart.state === 'not-loaded'
               ? 'daemon not loaded — previous binary will be used on next start'
               : `daemon restart ${restart.state}${restart.detail ? ` (${restart.detail})` : ''}`
-          }\n`,
-        )
-        return restart.state === 'failed' ? 1 : 0
+          }${infraNote}\n`
+        const failed = restart.state === 'failed' || infraFailed
+        ;(failed ? errOut : out)(msg)
+        return failed ? 1 : 0
       }
       case 'install': {
         // UNIFIED foundation install (contract Установка §1 — "один npx ставит
@@ -1495,10 +1612,9 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         killSession(sock, identity)
         return 0
       }
-      case 'interrupt':
-      case 'compact': {
+      case 'interrupt': {
         // In-session control (Ф-E, clean-slash namespace): interrupt a stuck/raving
-        // turn (Escape) / compact context. UNCONDITIONAL — acts on the live session.
+        // turn (Escape). UNCONDITIONAL — acts on the live session.
         if (!positionals[0]) return usage(errOut)
         const r = routeControl(positionals[0], positionals[1], { name: verb })
         if (!r.ok) {
@@ -1508,6 +1624,19 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         out(`${verb} → ${r.value.controlled.personality} (${r.value.controlled.runtime})\n`)
         return 0
       }
+      case 'compact': {
+        // Dialogue control (UX directive 12.06): if the session is merely asleep
+        // after a clean idle-reap, resume the same dialogue and compact it; if there
+        // is no resumable dialogue, fail honestly instead of compacting a fresh one.
+        if (!positionals[0]) return usage(errOut)
+        const o = await compactPeer(positionals[0], positionals[1], { env })
+        if (o.action === 'compacted') {
+          out(`compact → ${o.personality} (${o.runtime})${o.woke ? ' after resume' : ''}\n`)
+          return 0
+        }
+        errOut(`compact: ${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
+        return 1
+      }
       case 'connect': {
         // Per-peer channel attachment in ONE flow (design «Onboard костяка» §(в)):
         // `connect telegram <peer> [--token <t>]`. The human owes only the token;

package/src/launch/index.ts

@@ -61,6 +61,8 @@ export {
   isFoundationOwnedPlist,
   launchctlBootstrap,
   bootstrapJobCore,
+  cycleLaunchdJob,
+  cycleLaunchdJobCore,
   cycleDaemon,
   cycleDaemonCore,
   resolveExecutable,
@@ -75,6 +77,8 @@ export type {
   BootstrapCoreResult,
   DaemonRestartResult,
   DaemonRestartState,
+  LaunchdJobCycleResult,
+  LaunchdJobCycleState,
   LaunchctlRunner,
 } from './launchd.ts'
 

package/src/launch/launchd.ts

@@ -298,38 +298,41 @@ export function bootstrapJobCore(
   }
 }
 
-export type DaemonRestartState =
-  | 'restarted' // bootout + bootstrap succeeded → the daemon runs the freshly-installed binary
-  | 'not-loaded' // com.agfpd.iapeer is not in the gui domain → nothing to restart (new binary
-  //                will be used whenever it IS next started; nothing to do here)
+export type LaunchdJobCycleState =
+  | 'restarted' // bootout + bootstrap succeeded → the job runs with the currently-referenced binaries
+  | 'not-loaded' // the label is not in the gui domain → nothing to restart (next start will use the current plist/binaries)
   | 'skipped-sandbox' // IAPEER_TEST_SANDBOX=1 → never touch the real launchd
   | 'failed' // bootout/bootstrap failed — the result carries the manual rescue recipe
 
-export interface DaemonRestartResult {
-  state: DaemonRestartState
+export interface LaunchdJobCycleResult {
+  state: LaunchdJobCycleState
   detail?: string
 }
 
+export type DaemonRestartState = LaunchdJobCycleState
+export interface DaemonRestartResult extends LaunchdJobCycleResult {}
+
 /**
- * DI core of cycleDaemon (unit-testable without launchctl): bootout → wait-for-gone
+ * DI core of cycleLaunchdJob (unit-testable without launchctl): bootout → wait-for-gone
  * → bootstrap, composed on bootstrapJobCore's undead-job-safe wait/backoff.
  * Disambiguation of bootstrapJobCore's 'already-loaded': at attempts=0 it means the
  * job NEVER unloaded after our bootout (undead beyond budget) → FAIL loud with the
  * manual recipe; at attempts>0 it means a retry found the job loaded (our previous
  * attempt half-succeeded or KeepAlive raced us in) → the job IS up → success.
  */
-export function cycleDaemonCore(
+export function cycleLaunchdJobCore(
   uid: string,
+  label: string,
   plistPath: string,
   deps: BootstrapCoreDeps,
-): DaemonRestartResult {
-  const listed = () => deps.run(['print', `gui/${uid}/${DAEMON_PLIST_LABEL}`]).status === 0
+): LaunchdJobCycleResult {
+  const listed = () => deps.run(['print', `gui/${uid}/${label}`]).status === 0
   if (!listed()) return { state: 'not-loaded' }
-  const bo = deps.run(['bootout', `gui/${uid}/${DAEMON_PLIST_LABEL}`])
+  const bo = deps.run(['bootout', `gui/${uid}/${label}`])
   if (bo.status !== 0) {
     return { state: 'failed', detail: `launchctl bootout failed: ${bo.stderr.trim() || `exit ${bo.status}`}` }
   }
-  const core = bootstrapJobCore(uid, DAEMON_PLIST_LABEL, plistPath, deps)
+  const core = bootstrapJobCore(uid, label, plistPath, deps)
   if (core.state === 'loaded' || (core.state === 'already-loaded' && core.attempts > 0)) {
     return { state: 'restarted' }
   }
@@ -338,7 +341,7 @@ export function cycleDaemonCore(
       state: 'failed',
       detail:
         `job never unloaded after bootout (undead beyond budget) — manual rescue: ` +
-        `launchctl bootout gui/${uid}/${DAEMON_PLIST_LABEL} && launchctl bootstrap gui/${uid} ${plistPath}`,
+        `launchctl bootout gui/${uid}/${label} && launchctl bootstrap gui/${uid} ${plistPath}`,
     }
   }
   return {
@@ -347,6 +350,15 @@ export function cycleDaemonCore(
   }
 }
 
+/** Back-compat wrapper for the foundation daemon's label. */
+export function cycleDaemonCore(
+  uid: string,
+  plistPath: string,
+  deps: BootstrapCoreDeps,
+): DaemonRestartResult {
+  return cycleLaunchdJobCore(uid, DAEMON_PLIST_LABEL, plistPath, deps)
+}
+
 /**
  * Restart the foundation daemon (`com.agfpd.iapeer`) onto the binary currently on
  * disk — `launchctl bootout` + `bootstrap`, DELIBERATELY NOT `kickstart -k`.
@@ -368,12 +380,26 @@ export function cycleDaemonCore(
  * version-stable (write-if-changed) and is NOT rewritten here. Sandbox-safe.
  */
 export function cycleDaemon(env: NodeJS.ProcessEnv = process.env): DaemonRestartResult {
+  return cycleLaunchdJob(DAEMON_PLIST_LABEL, join(launchAgentsDir(env), `${DAEMON_PLIST_LABEL}.plist`), env)
+}
+
+/**
+ * Restart any launchd job onto the executable(s) currently referenced by its plist:
+ * bootout → bootstrap, never kickstart. Used by the daemon update path AND by
+ * foundation-owned infra peers (`com.iapeer.*`) whose ProgramArguments also point at
+ * the installed `iapeer` binary. The caller owns any fleet/ownership guard; this
+ * primitive only cycles the concrete label/plist pair. Sandbox-safe.
+ */
+export function cycleLaunchdJob(
+  label: string,
+  plistPath: string,
+  env: NodeJS.ProcessEnv = process.env,
+): LaunchdJobCycleResult {
   if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') {
     return { state: 'skipped-sandbox' }
   }
   const uid = currentUid()
-  const plistPath = join(launchAgentsDir(env), `${DAEMON_PLIST_LABEL}.plist`)
-  return cycleDaemonCore(uid, plistPath, {
+  return cycleLaunchdJobCore(uid, label, plistPath, {
     run: args => {
       const r = spawnSync('launchctl', args, { encoding: 'utf8' })
       return { status: r.status, stderr: r.stderr ?? '' }

package/src/update/index.ts

@@ -11,11 +11,14 @@
 //      and run ITS own source installer. DELIBERATELY NOT `npx … install` (see
 //      defaultRunInstall for why npx is unsafe here).
 //   4. cycle com.agfpd.iapeer IF loaded (bootout+bootstrap) (activate the new binary; kickstart hits the LWCR EX_CONFIG(78) bomb)
+//   5. recycle loaded FOUNDATION-OWNED infra jobs (com.iapeer.* with the sentinel)
+//      because their plists also run the just-replaced `iapeer run-infra` binary.
 //
-// Scope: the foundation ONLY (the @agfpd/iapeer binary + its daemon). It never
-// touches the plist (version-stable launch path) and never touches other packages
-// on the host (telegram-runtime / notifier-runtime / MergeMind / the peer fleet) —
-// each of those has its own version and its own update.
+// Scope: the foundation ONLY (the @agfpd/iapeer binary + its daemon + launchd
+// registrations of foundation-owned infra jobs that point at that binary). It never
+// rewrites those plists, never updates runtime packages (telegram-runtime /
+// notifier-runtime / MergeMind), and never touches foreign / persistent-peer fleet
+// plists — only sentinel-marked foundation-owned com.iapeer.* jobs are recycled.
 //
 // updateIapeer takes its three side-effects as INJECTED deps so the version-gate is
 // unit-testable with no network and no launchctl; the defaults are the real impls.
@@ -25,9 +28,19 @@ import { mkdtempSync, readdirSync, rmSync } from 'fs'
 import { connect } from 'net'
 import { tmpdir } from 'os'
 import { join } from 'path'
+import { isInfraRuntime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { cycleDaemon, type DaemonRestartResult } from '../launch/launchd.ts'
+import { readPeersIndex } from '../registry/index.ts'
+import {
+  cycleDaemon,
+  cycleLaunchdJob,
+  isFoundationOwnedPlist,
+  launchdLabel,
+  launchdPlistPath,
+  type DaemonRestartResult,
+  type LaunchdJobCycleResult,
+} from '../launch/launchd.ts'
 import { defaultDaemonSocketPath } from '../daemon/index.ts'
 
 /** The npm package the foundation publishes / updates from. */
@@ -45,11 +58,22 @@ export interface UpdateDeps {
   /** Resolve a spec ('latest' or an exact 'X.Y.Z') to the concrete published version it
    *  names, or null on a miss / npm error (default: `npm view @agfpd/iapeer@<spec> version`). */
   resolveVersion?: (spec: string, env: NodeJS.ProcessEnv) => string | null
-  /** Pull + rebuild the binary for `version` (default: `npx @agfpd/iapeer@<v> install`).
+  /** Pull + rebuild the binary for `version` (default: npm pack → extract → source install).
    *  Returns true on success. */
   runInstall?: (version: string, env: NodeJS.ProcessEnv) => boolean
   /** Restart the daemon onto the new binary (default: cycleDaemon — bootout+bootstrap, the LWCR-safe cycle). */
   restartDaemon?: (env: NodeJS.ProcessEnv) => DaemonRestartResult
+  /** Re-register loaded foundation-owned infra launchd jobs whose plists run the
+   *  installed iapeer binary (default: registry scan + sentinel guard). */
+  recycleInfraJobs?: (env: NodeJS.ProcessEnv) => InfraJobRecycleResult[]
+}
+
+export interface InfraJobRecycleResult {
+  personality: string
+  runtime: string
+  label: string
+  state: LaunchdJobCycleResult['state']
+  detail?: string
 }
 
 export interface UpdateResult {
@@ -62,6 +86,8 @@ export interface UpdateResult {
   to?: string
   /** What happened to the live daemon (only on 'updated'). */
   daemon?: DaemonRestartResult['state']
+  /** Foundation-owned infra jobs recycled after the binary swap (only on 'updated'). */
+  infra?: InfraJobRecycleResult[]
   /** Human reason on 'failed' / extra detail on a daemon restart hiccup. */
   reason?: string
 }
@@ -195,6 +221,30 @@ function defaultRunInstall(version: string, env: NodeJS.ProcessEnv): boolean {
   }
 }
 
+/**
+ * Re-register every loaded FOUNDATION-owned infra peer job after the installed
+ * iapeer binary is replaced. These plists run `iapeer run-infra <peer> <runtime>`;
+ * if launchd keeps the old managed launch constraint, a later KeepAlive respawn can
+ * hit the same EX_CONFIG(78) LWCR crash-loop that bit the daemon. Full bootout →
+ * bootstrap clears the registration. Foreign / persistent-peer plists are skipped
+ * by the sentinel guard, preserving H4.
+ */
+export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process.env): InfraJobRecycleResult[] {
+  if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') return []
+  const out: InfraJobRecycleResult[] = []
+  const index = readPeersIndex({ env })
+  for (const peer of index.peers) {
+    const runtime = (isInfraRuntime(peer.runtime) ? peer.runtime : peer.runtimes.find(isInfraRuntime)) ?? ''
+    if (!runtime) continue
+    const plist = launchdPlistPath(peer.personality, env)
+    if (!isFoundationOwnedPlist(plist)) continue
+    const label = launchdLabel(peer.personality)
+    const r = cycleLaunchdJob(label, plist, env)
+    out.push({ personality: peer.personality, runtime, label, state: r.state, detail: r.detail })
+  }
+  return out
+}
+
 /**
  * Update the foundation to the latest published version (cloud-only) and restart
  * the daemon onto it. Idempotent + version-gated: a no-op "already-latest" when the
@@ -242,12 +292,18 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
 
   const restart = deps.restartDaemon ?? cycleDaemon
   const d = restart(env)
+  const recycleInfra = deps.recycleInfraJobs ?? recycleFoundationOwnedInfraJobs
+  // If the daemon re-registration itself failed, do NOT widen the blast radius by
+  // cycling infra jobs onto a binary whose daemon could not come up. Rollback will
+  // re-cycle them after restoring `.prev`.
+  const infra = d.state === 'failed' ? [] : recycleInfra(env)
   return {
     status: 'updated',
     from,
     to: desired,
     latest: desired,
     daemon: d.state,
+    infra,
     reason: d.state === 'failed' ? `binary updated but daemon restart failed: ${d.detail ?? ''}`.trim() : undefined,
   }
 }

package/src/update/update.test.ts

@@ -4,7 +4,7 @@
 // exercised too (a test must never npx-install over the prod binary).
 
 import { describe, expect, test } from 'bun:test'
-import { IAPEER_VERSION, updateIapeer, waitForDaemonHealthy } from '../index.ts'
+import { IAPEER_VERSION, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../index.ts'
 import type { DaemonRestartResult } from '../launch/launchd.ts'
 
 const restarted = (): DaemonRestartResult => ({ state: 'restarted' })
@@ -17,9 +17,10 @@ function harness(opts: {
   target?: string
   installOk?: boolean
   restart?: DaemonRestartResult
+  recycle?: ReturnType<typeof recycleFoundationOwnedInfraJobs>
   force?: boolean
 }) {
-  const calls = { install: [] as string[], restart: 0, resolved: [] as string[] }
+  const calls = { install: [] as string[], restart: 0, recycle: 0, resolved: [] as string[] }
   const result = updateIapeer({
     env: { IAPEER_TEST_SANDBOX: '1' },
     force: opts.force,
@@ -37,6 +38,10 @@ function harness(opts: {
       calls.restart++
       return opts.restart ?? restarted()
     },
+    recycleInfraJobs: () => {
+      calls.recycle++
+      return opts.recycle ?? []
+    },
   })
   return { result, calls }
 }
@@ -49,6 +54,7 @@ describe('updateIapeer — version gate', () => {
     expect(result.latest).toBe('0.2.2')
     expect(calls.install).toEqual([])
     expect(calls.restart).toBe(0)
+    expect(calls.recycle).toBe(0)
   })
 
   test('--force reinstalls + restarts even when already latest', () => {
@@ -65,8 +71,18 @@ describe('updateIapeer — version gate', () => {
     expect(result.from).toBe('0.2.2')
     expect(result.to).toBe('0.3.0')
     expect(result.daemon).toBe('restarted')
+    expect(result.infra).toEqual([])
     expect(calls.install).toEqual(['0.3.0']) // installs latest, not current
     expect(calls.restart).toBe(1)
+    expect(calls.recycle).toBe(1)
+  })
+
+  test('after binary install, loaded foundation-owned infra jobs are recycled too', () => {
+    const recycle = [{ personality: 'timer', runtime: 'notifier', label: 'com.iapeer.timer', state: 'restarted' as const }]
+    const { result, calls } = harness({ current: '0.2.2', latest: '0.3.0', recycle })
+    expect(result.status).toBe('updated')
+    expect(result.infra).toEqual(recycle)
+    expect(calls.recycle).toBe(1)
   })
 
   test('no target → resolves the "latest" spec', () => {
@@ -125,7 +141,7 @@ describe('updateIapeer — failure paths', () => {
   })
 
   test('binary updated but restart failed → updated with a warning reason', () => {
-    const { result } = harness({
+    const { result, calls } = harness({
       current: '0.2.2',
       latest: '0.3.0',
       restart: { state: 'failed', detail: 'kickstart exit 1' },
@@ -133,6 +149,7 @@ describe('updateIapeer — failure paths', () => {
     expect(result.status).toBe('updated')
     expect(result.daemon).toBe('failed')
     expect(result.reason).toMatch(/restart failed.*kickstart exit 1/i)
+    expect(calls.recycle).toBe(0)
   })
 })