@agfpd/iapeer 0.2.76 → 0.2.78

package/src/launch/launchd.ts

@@ -185,7 +185,7 @@ function defaultEntrypointArgv(env: NodeJS.ProcessEnv = process.env): string[] {
 // ─────────────────────────────────────────────────────────────────────────────
 
 /** Resolve the current gui-domain uid for `launchctl bootstrap gui/<uid>`. NEVER
- *  falls back to 0 (that would aim the ROOT gui domain — audit #29); a non-numeric
+ *  falls back to 0 (that would aim the ROOT gui domain); a non-numeric
  *  `id -u` result throws. */
 function currentUid(): string {
   const r = spawnSync('id', ['-u'], { encoding: 'utf8' })
@@ -216,12 +216,11 @@ function isLaunchdLoaded(label: string, uid: string): boolean {
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// UNDEAD-JOB-SAFE bootstrap core (boris's live find 10.06, connect acceptance):
-// after `launchctl bootout` launchd dismantles the job ASYNCHRONOUSLY — an
-// immediate `bootstrap` hits the still-listed "undead" job and fails with
-// exit 5 "Input/output error" (the known PP race class, canon «Жизненный цикл
-// запуска persistent-peer и точки гонки»). On the connect flow that left the
-// WHOLE fleet's telegram router down. This core makes every restart-shaped flow
+// UNDEAD-JOB-SAFE bootstrap core: after `launchctl bootout` launchd dismantles
+// the job ASYNCHRONOUSLY — an immediate `bootstrap` hits the still-listed
+// "undead" job and fails with exit 5 "Input/output error" (the known
+// persistent-peer race class). On the connect flow this left the WHOLE fleet's
+// telegram router down. This core makes every restart-shaped flow
 // (stop→start, connect router restart, update-runtime) survive the race:
 //   (1) WAIT-FOR-GONE: while the job is still listed, poll `print` up to
 //       goneTimeoutMs. Vanished → proceed to bootstrap. STILL listed at the
@@ -363,13 +362,13 @@ export function cycleDaemonCore(
  * Restart the foundation daemon (`com.agfpd.iapeer`) onto the binary currently on
  * disk — `launchctl bootout` + `bootstrap`, DELIBERATELY NOT `kickstart -k`.
  *
- * LWCR (launch constraints, the deploy bomb — PROVEN LIVE 12.06 twice): after a
+ * LWCR (launch constraints, the deploy bomb — PROVEN LIVE twice): after a
  * binary replacement, launchd's managed Launch Constraint for the REGISTERED job
  * can still pin the OLD binary's signature — a kickstart then respawns into an
  * EX_CONFIG(78) crash-loop (`state = spawn scheduled`, exit 78 from launchd
- * itself; the binary runs fine by hand). Reproduced on com.iapeer.arthur
- * (telegram-runtime's v0.14.0 deploy, bridge down 6 min) AND on com.agfpd.iapeer
- * itself (the 0.2.43 deploy — daemon down until the manual cure). The ONLY cure
+ * itself; the binary runs fine by hand). Reproduced on a com.iapeer.* infra job
+ * (a telegram-runtime deploy, bridge down 6 min) AND on com.agfpd.iapeer
+ * itself (a daemon deploy — daemon down until the manual cure). The ONLY cure
  * is a full re-registration: bootout drops the job (and its constraint),
  * bootstrap registers it against the binary now on disk. kickstart is
  * structurally insufficient for this class.
@@ -441,14 +440,14 @@ export function launchctlBootstrap(
   // real launchd job regardless of where the plist file lives or what IAPEER_ROOT is.
   // So the skip MUST consult BOTH the passed env AND the PROCESS env: a test harness
   // that passes an explicit env (isolated IAPEER_ROOT) but omits the flag would
-  // otherwise bypass the guard and load a real job (this exact hole bit B1 once). The
+  // otherwise bypass the guard and load a real job (this exact hole bit once). The
   // process-level flag (set by `bun test`) forces the skip even then — mirror of the
   // registry's fail-closed sandbox lesson. A live e2e proof runs with NEITHER flag set.
   if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') {
     return { state: 'skipped-sandbox', label, detail: 'IAPEER_TEST_SANDBOX=1 — not loading a real launchd job' }
   }
   const uid = currentUid()
-  // UNDEAD-JOB-SAFE core (boris's connect-acceptance find): wait for a booted-out
+  // UNDEAD-JOB-SAFE core: wait for a booted-out
   // job to actually vanish, then bootstrap with backoff. A genuinely LIVE job
   // reads 'already-loaded' (idempotent no-op, same semantics as before); only a
   // job that stays failing through every attempt reads 'failed'.
@@ -525,7 +524,7 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
   // Resolve home the SAME way launchAgentsDir does (env.HOME first) so a test/
   // sandbox overriding HOME keeps the PATH fallback and the plist dir in step.
   const home = env.HOME?.trim() || homedir()
-  const defaultPath = `${home}/.bun/bin:${home}/.local/bin:/opt/homebrew/bin:/usr/bin:/bin`
+  const defaultPath = `${home}/.bun/bin:${home}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin`
   const environment: Record<string, string> = {
     PEER_PERSONALITY: opts.personality,
     PEER_RUNTIME: opts.runtime,
@@ -533,7 +532,7 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     PATH: opts.path ?? env.PATH ?? defaultPath,
   }
   // Propagate the non-default path overrides into the plist env (mirror of the daemon
-  // plist, audit #26): in PRODUCTION these are unset → nothing is baked, the always-on
+  // plist): in PRODUCTION these are unset → nothing is baked, the always-on
   // session uses the real ~/.iapeer + /tmp sockets (correct). In a SANDBOX they ARE set
   // → baked, so a sandboxed infra peer's run-infra resolves the SAME isolated root +
   // socket dir the provision used (its tmux endpoint lands in the sandbox, not /tmp).

package/src/launch/launchdRun.ts

@@ -46,11 +46,11 @@ function sessionAlive(sock: string, identity: string): boolean {
  * last one) — the signal-exit counterpart of lifecycle.killSession, local to avoid
  * a launch ⇆ lifecycle import. Canary-signaled first: this is a DELIBERATE stop.
  *
- * Closes the live грабля «bootout не убивает поллера» (boris 10.06, second
- * strike): `launchctl bootout` TERMs THIS watcher process, but the detached tmux
- * server — and the runtime poller inside it — survived holding STALE in-memory
- * state (e.g. a notifier trigger's old target after a same-id replace), so a
- * plain bootout+bootstrap was NOT a real restart. With the teardown, the session
+ * Fixes the defect where bootout did not kill the poller: `launchctl bootout`
+ * TERMs THIS watcher process, but the detached tmux server — and the runtime
+ * poller inside it — survived holding STALE in-memory state (e.g. a notifier
+ * trigger's old target after a same-id replace), so a plain bootout+bootstrap was
+ * NOT a real restart. With the teardown, the session
  * dies with its watcher: bootout = full stop, bootstrap = fresh bring-up that
  * re-reads durable state. `iapeer stop` (bootout + killSession) is unchanged —
  * both paths now converge on the same end state.
@@ -196,7 +196,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   }
   // Signal-initiated exit (bootout / shutdown / kickstart -k) tears the session
   // down WITH this watcher — without it the detached tmux poller outlived bootout
-  // holding stale in-memory state (см. teardownAlwaysOnSession). A natural session
+  // holding stale in-memory state (see teardownAlwaysOnSession). A natural session
   // death (stop=false) skips this: there is nothing to tear down, exit 0 →
   // KeepAlive respawns a fresh bring-up.
   // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher.

package/src/launch/nativeMemory.ts

@@ -1,5 +1,5 @@
 // Native runtime-memory levers (контракт «Слот памяти» §Native-память рантаймов
-// при занятом слоте, agreed 10.06). The CORE canonizes the lever FORMS — runtime
+// при занятом слоте). The CORE canonizes the lever FORMS — runtime
 // knowledge lives in the runtime layer, like deliveryMarkers/buildArgv:
 //
 //   claude: merge `"autoMemoryEnabled": false` into `<cwd>/.claude/settings.json`
@@ -8,8 +8,8 @@
 //
 // Both files CARRY FOREIGN BLOCKS (plugin enables, statusline wrappers, …) —
 // every write here is a NO-CLOBBER merge (parse/patch + atomic temp+rename),
-// never a rewrite. Forms verified live on the fleet (12/12 + behavioral smoke
-// 09.06; codex reads project-local config when the cwd is TRUSTED — see
+// never a rewrite. Forms verified live on the fleet (12/12 + behavioral smoke;
+// codex reads project-local config when the cwd is TRUSTED — see
 // preTrustCodexCwd).
 //
 // `off` writes the explicit disable; `on` REMOVES the key (restores the
@@ -130,8 +130,8 @@ function applyCodexLever(cwd: string, state: NativeMemoryState): LeverOutcome {
  *  `[projects."<path>"] trust_level = "trusted"` blocks. Honors $CODEX_HOME
  *  first, SAME as init's codexConfigPath — the two writers of this shared prod
  *  file must respect one override set, or a sandbox isolating one path still
- *  leaks through the other (live-caught by iapeer-memory's D4 11.06: an
- *  IAPEER_ROOT sandbox pre-trusted a throwaway cwd into the PROD config). */
+ *  leaks through the other (live defect: an IAPEER_ROOT sandbox pre-trusted a
+ *  throwaway cwd into the PROD config). */
 export function codexGlobalConfigPath(env: NodeJS.ProcessEnv = process.env): string {
   const codexHome = env.CODEX_HOME?.trim()
   if (codexHome) return join(codexHome, 'config.toml')
@@ -152,8 +152,8 @@ export function codexGlobalConfigPath(env: NodeJS.ProcessEnv = process.env): str
 export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.env): LeverOutcome {
   const path = codexGlobalConfigPath(env)
   try {
-    // Codex keys trust on the RESOLVED real path (live fact, 10.06 acceptance: the
-    // /tmp → /private/tmp symlink made a literal-path entry MISS and left the lever
+    // Codex keys trust on the RESOLVED real path (live fact: the /tmp →
+    // /private/tmp symlink made a literal-path entry MISS and left the lever
     // inert — trust entries written by codex itself are all /private/tmp/...).
     let real = cwd
     try {
@@ -175,8 +175,8 @@ export function preTrustCodexCwd(cwd: string, env: NodeJS.ProcessEnv = process.e
 /**
  * Remove a peer's pre-trust entry from the codex GLOBAL config — the reap-side
  * counterpart of preTrustCodexCwd (backlog «remove не чистит pre-trust», made
- * live by iapeer-memory's D4 11.06: every sandboxed/throwaway codex birth left
- * a stale `[projects."<cwd>"]` block in the PROD config forever). Removes the
+ * live by a defect: every sandboxed/throwaway codex birth left a stale
+ * `[projects."<cwd>"]` block in the PROD config forever). Removes the
  * section for BOTH the resolved and the literal path form (the writer stores
  * realpath, but a since-deleted cwd cannot be resolved anymore — match either),
  * strictly section-scoped: from the `[projects."<p>"]` header up to the next

package/src/launch/ptyHost.ts

@@ -27,7 +27,7 @@ export const HOST_COLS = 220
 export const HOST_ROWS = 50
 
 /** Per-peer pty-hosting decision. pty-supervisor hosting is the DEFAULT — a fresh peer is hosted under
- *  the supervisor (not `tmux new-session`) WITHOUT any marker (Артур: «pty из коробки»). A peer opts OUT
+ *  the supervisor (not `tmux new-session`) WITHOUT any marker (pty out of the box). A peer opts OUT
  *  to the legacy tmux path with a `<logDir>/<identity>.no-pty-host` marker (the dev/debug escape, valid
  *  only while tmux still exists). Read in TWO places, both of which want "is this peer pty-hosted": the
  *  spawn-gate (launch — host vs tmux) and the shadow observer (skip pty-hosted peers, they have no tmux

package/src/launch/readyGateModel.ts

@@ -6,7 +6,7 @@
 // emulation of the daemon's pane-log — the SAME raw child bytes tmux renders), keeping the SAME
 // production predicate (adapter.isInputReady) and an UNCONDITIONAL capture-pane fallback.
 //
-// Why this is low-radius (boris's frame): it is a viewport-SOURCE swap, NOT a predicate change.
+// Why this is low-radius: it is a viewport-SOURCE swap, NOT a predicate change.
 // The model verdict was validated 0-divergence vs capture-pane on the readiness predicate by the
 // burn-in gate (incl. the codex resume-with-history splash-off-screen center cell) before any peer
 // is flipped. It touches ONLY the isInputReady INPUT — dialog detection upstream and the delivery +
@@ -127,10 +127,10 @@ export async function paneLogViewport(log: string, cols: number, rows: number):
  * tmux predicate's capture-fail-is-busy stance — prefer a false-busy hold over a false-free paste into
  * a human composer.
  *
- * NB (sequence, boris): this is the DETECTION primitive. The end-to-end gate (attached-supervisor-
+ * NB (sequence): this is the DETECTION primitive. The end-to-end gate (attached-supervisor-
  * client + enqueue + host-aware drain) lands with the attach client in Ф0b-3 — until a human can
  * attach to a hosted session there is no human composer to protect. The caller composes the pane-log
- * path from logDir+identity (the threaded `logDir` finding), mirroring `waitHostReady`.
+ * path from logDir+identity, mirroring `waitHostReady`.
  */
 export async function paneLogComposerOccupied(log: string, cols: number, rows: number, runtime: string): Promise<boolean> {
   const term = await loadPaneLogModel(log, cols, rows)

package/src/launch/types.ts

@@ -30,7 +30,7 @@ export type { PublicPeerSummary } from '../registry/index.ts'
 //      in organically here — no special-casing.
 //   5. Doctrine fragments: every `*.md` in the `.iapeer/fragments/` subdir, global
 //      (~/.iapeer/fragments/) + local (<cwd>/.iapeer/fragments/) merged per stem.
-//      PRIMITIVE-owned, machine-regenerated (iapeer-memory's guide + note index, …)
+//      PRIMITIVE-owned, machine-regenerated (e.g. a memory provider's guide + note index, …)
 //      — a dedicated namespace kept OUT of the hand-authored IAPEER.md doctrine so
 //      the auto-writer and the human writer never share a file. Sits LAST: the most
 //      volatile layer, so edits to it never disturb the stable prefix above.
@@ -160,13 +160,13 @@ export interface LaunchSpec {
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Delivery markers — the tui submit surface (owned by the adapter, 07.06 refactor)
+// Delivery markers — the tui submit surface (owned by the adapter)
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
  * Markers the transport submit path (submitIntoTui) needs to detect that a
  * bracketed paste landed in the input row before pressing Enter. Contract refactor
- * 07.06 (docs/Рантайм-адаптеры): the ADAPTER owns delivery markers — they moved out
+ * (docs/Рантайм-адаптеры): the ADAPTER owns delivery markers — they moved out
  * of the transport's hardcoded `PROMPT_GLYPHS = ['❯','›']` union so the generic
  * submit logic carries NO runtime strings and a new runtime ships its own glyph
  * with its adapter, not by editing transport.
@@ -227,8 +227,8 @@ export interface RuntimeAdapter {
 
   /**
    * Delivery markers for the transport submit path (submitIntoTui) — the input-
-   * prompt glyph(s) and optional "paste landed" patterns. The adapter OWNS them
-   * (07.06 refactor): transport reads them from here instead of a hardcoded glyph
+   * prompt glyph(s) and optional "paste landed" patterns. The adapter OWNS them:
+   * transport reads them from here instead of a hardcoded glyph
    * union. A router declares `{ promptGlyphs: [] }` (no submit surface).
    */
   deliveryMarkers: DeliveryMarkers
@@ -236,8 +236,8 @@ export interface RuntimeAdapter {
   /**
    * If set, launch REFUSES unless the peer's intelligence equals this value
    * (fail-loud). telegram → 'natural' — it is a human channel; launching an
-   * artificial/absent peer on it is a category error (PP held a FATAL guard in two
-   * places). Most adapters omit it (no nature gate). Source of intelligence →
+   * artificial/absent peer on it is a category error (the persistent-peer path held
+   * a FATAL guard in two places). Most adapters omit it (no nature gate). Source of intelligence →
    * docs/Идентичность; enforced by the launch primitive against LaunchSpec.intelligence.
    */
   requiresIntelligence?: Intelligence

package/src/lifecycle/eventlog.ts

@@ -1,6 +1,6 @@
 // Lifecycle event log — the daemon's DURABLE, ROTATED trace of every lifecycle
-// DECISION it makes. This is the observability gap the boris-fresh incident hit:
-// a peer woke fresh and there was NO record of when/how its prior session ended,
+// DECISION it makes. This closes an observability gap: a peer could wake fresh
+// with NO record of when/how its prior session ended,
 // nor of the daemon's fresh-vs-resume reasoning, because superviseTick's outcomes
 // were dropped and the daemon never wrote a decision line anywhere.
 //

package/src/lifecycle/index.ts

@@ -76,16 +76,16 @@ export interface LifecycleConfig {
   /** wake_policy:ephemeral M2 — the quiet window (seconds of activity-proxy silence)
    *  after which an ARMED ephemeral session (it has sent its outbound reply) is
    *  reaped. Long enough for the post-reply housekeeping writes (operative notes)
-   *  to keep resetting it; far below idleSecs. ASSUMPTION (boris, by design): the
+   *  to keep resetting it; far below idleSecs. ASSUMPTION (by design): the
    *  transcript mtime is a LIVENESS proxy — "no longer writing" — not a semantic
    *  "done" signal. */
   ephemeralQuietSecs: number
   /** wake_policy:ephemeral — the UNARMED idle bound (seconds): an ephemeral session
    *  that never armed (finished silently / lost its arm to a daemon-restart window)
-   *  is reaped after this much activity-proxy silence. Live case (scriber 10.06):
-   *  a worker that ended «тихо» without its final outbound stalled its M3 FIFO for
-   *  the FULL generic idleSecs (1 h) — with serial drain that blocks the whole
-   *  conveyor per silent worker. Bound chosen ≫ the legitimate silent-tool case
+   *  is reaped after this much activity-proxy silence. Live case: a worker that
+   *  ended silently without its final outbound stalled its M3 FIFO for the FULL
+   *  generic idleSecs (1 h) — with serial drain that blocks the whole conveyor per
+   *  silent worker. Bound chosen ≫ the legitimate silent-tool case
    *  (sleep-180) and ≪ idleSecs. DOCUMENTED RISK: an ephemeral worker whose tool
    *  stays silent longer than this MID-TASK is reaped and its consumed queue item
    *  is lost — ephemeral workers must emit activity (or their reply) within it. */
@@ -215,7 +215,7 @@ export function clearStopped(cfg: LifecycleConfig, identity: string): void {
 //
 //   .idle-reaped : the CLEAN-PARK marker — written when the daemon idle-reaps the
 //     session AND by the deliberate `stop` verb (both are daemon/operator-initiated
-//     parks, not faults; boris 10.06: stop→start must survive ≥ idle-reap).
+//     parks, not faults; stop→start must survive ≥ idle-reap).
 //     Presence on the next wake = session was parked cleanly = RESUME-eligible.
 //     ABSENT on a dead session = it died on its own (crash / self-close) = FRESH.
 //     (resolver branch 3.)
@@ -226,9 +226,9 @@ export function clearStopped(cfg: LifecycleConfig, identity: string): void {
 //   .topic       : the topic the current/last session last WORKED ON (executor
 //     fresh-vs-resume discriminator). Written at wake (the boot topic) AND on
 //     every live delivery carrying a different non-empty topic (the daemon/CLI
-//     compositions wire transport's noteLiveTopic seam to writeTopic — defect
-//     11.06: a wake-only marker goes stale over a long session and false-freshes
-//     the stop→start resume the clean park promised).
+//     compositions wire transport's noteLiveTopic seam to writeTopic — defect:
+//     a wake-only marker goes stale over a long session and false-freshes the
+//     stop→start resume the clean park promised).
 //   .ephemeral-armed : wake_policy:ephemeral M2 — set by the DAEMON when it routes
 //     an OUTBOUND send from an ephemeral worker (its single final reply, ADR-006:
 //     workers send no intermediate messages, so outbound ⇒ the task is answered).
@@ -404,8 +404,8 @@ export function writeTopic(cfg: LifecycleConfig, identity: string, topic: string
  * and the M3 `.queue/` dir — everything matching `<identity>.*` (the dot
  * delimiter keeps `claude-bob` from ever matching `claude-bob2.*`).
  *
- * Consumer: `iapeer remove` (live defect, boris 10.06 cutover): a removed peer's
- * stale `.stopped`/`.idle-reaped` survived in state/lifecycle, and a NEWBORN peer
+ * Consumer: `iapeer remove` (live defect): a removed peer's stale
+ * `.stopped`/`.idle-reaped` survived in state/lifecycle, and a NEWBORN peer
  * REUSING the personality inherited the dead namesake's parking — the daemon
  * refused to wake it (`mode=refused cause=stopped`). Identity-keyed state must
  * die with the registry record. Deliberately NOT called at birth: provision runs
@@ -538,7 +538,7 @@ export function resolveWakeMode(
     return { resume: false, cause: 'ephemeral-policy' }
   }
   // 3a. NOT parked-clean → FRESH either way, but tell the two cases apart in the
-  // cause (boris finding, 10.06): a peer with NO transcript at all never ran here —
+  // cause: a peer with NO transcript at all never ran here —
   // that is its FIRST-ever wake, not a crash. (A peer whose transcripts were rotated
   // away also reads first-wake — equally honest: there is nothing it could resume.)
   if (!hasIdleReaped(cfg, identity)) {
@@ -659,9 +659,9 @@ function sessionAlive(sock: string, identity: string): boolean {
   return hostSessionAlive(identity) || tmux(sock, 'has-session', '-t', identity).ok
 }
 
-/** Death-class tag for a gone session (live case: iapeer-memory 10.06 — the WHOLE
- *  tmux server died by SIGKILL-class and exits.log stayed empty, because the
- *  pane-died hook needs a living tmux event loop). Two distinguishable classes:
+/** Death-class tag for a gone session (live case: the WHOLE tmux server died by
+ *  SIGKILL-class and exits.log stayed empty, because the pane-died hook needs a
+ *  living tmux event loop). Two distinguishable classes:
  *  - `session-gone` — the server on the socket still ANSWERS but the session is not
  *    there: a pane died inside a living server → the pane-died hook had its chance,
  *    exits.log should carry the cause.
@@ -1020,7 +1020,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
     if (result.status === 'FAILED') {
       // enroll-on-FAILED (0.2.57): launch can return FAILED on a ready-gate false-negative
       // (model-did-not-process-task) while the tmux session + its process actually SURVIVE —
-      // observed live (ttlverify, 13.06). Since 0.2.55 removed the self-TTL, such a remnant
+      // observed live. Since 0.2.55 removed the self-TTL, such a remnant
       // would be an UNBOUNDED orphan: no .session → invisible to superviseTick's idle-reap,
       // and no wall-clock backstop. If the session is in fact ALIVE, enroll it so the
       // activity-aware idle-reap stays the UNIVERSAL bound (a genuinely wedged session is
@@ -1141,7 +1141,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
     }
     const sock = buildSocketPath(s.runtime, s.personality, cfg.sockDir)
     if (!sessionAlive(sock, s.identity)) {
-      // A DELIBERATE stop is not a death (boris 10.06): the stop verb parks clean
+      // A DELIBERATE stop is not a death: the stop verb parks clean
       // (.stopped + .idle-reaped) and kills the session itself. Catch-up branch for
       // a stop that raced this tick (or a pre-fix stop): drop the state quietly —
       // no crash-loop entry, no death class — and ensure the clean-park marker so
@@ -1222,14 +1222,14 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-done' })
       continue
     }
-    // UNARMED ephemeral idle bound (live case scriber 10.06): a worker that ended
+    // UNARMED ephemeral idle bound (live case): a worker that ended
     // SILENTLY (no final outbound → never armed; or its arm was lost to a CLI/
     // daemon-restart window) used to wait out the FULL generic idleSecs (1 h) —
     // and the M3 serial drain waits for the session's death, so ONE silent worker
     // stalled its whole conveyor. This bound is the defense-in-depth backstop:
     // ≫ the legitimate silent-tool case (sleep-180), ≪ idleSecs. The ШТАТНЫЙ
     // silent-finish path is `iapeer self-done` (arm without waking anyone —
-    // Артур's invariant «нет пустых пробуждений» stays intact); this branch only
+    // the invariant «нет пустых пробуждений» stays intact); this branch only
     // bounds the damage when a worker does neither. Policy reap: NO .idle-reaped
     // (ephemeral never resumes), NO recordDeath (the ring counts faults).
     if (isEphemeralPeer(s.cwd) && ageSecs > cfg.ephemeralUnarmedIdleSecs) {
@@ -1299,7 +1299,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
  * no runtime so resolveWakeRuntime falls through to the registry default (H5 — registry
  * is the only source of wake-runtime truth). Pinning broke the fleet-switch procedure
  * (`default-runtime <rt>` + `self-fresh`): the peer silently resurrected on the OLD
- * runtime, ignoring the just-flipped default (live incident 12.06, claude-iapeer). A
+ * runtime, ignoring the just-flipped default (live incident). A
  * session deliberately living on a non-default runtime has explicit paths back (wake
  * with an explicit runtime); an owner /new returns the peer to its declared default.
  */
@@ -1376,7 +1376,7 @@ export async function drainEphemeralQueue(
   if (sessionAlive(sock, identity)) return null // one task per session — wait for its reap
   const item = peekEphemeralTask(cfg, identity)
   if (!item) return null
-  // Durable drain trace (boris acceptance (a)): which item, how deep the queue.
+  // Durable drain trace: which item, how deep the queue.
   appendLifecycleEvent(
     cfg.eventLogDir,
     { ev: 'ephemeral-drain', identity, seq: item.seq, depth: ephemeralQueueDepth(cfg, identity) },

package/src/lifecycle/queue.ts

@@ -16,7 +16,7 @@
 // concurrent enqueues can never share a seq; the loser just advances. Content
 // is complete before the link lands (no partial reads).
 //
-// Retry semantics (boris acceptance (b)): the consumer PEEKS (reads without
+// Retry semantics: the consumer PEEKS (reads without
 // removing), wakes the worker, and removes the item ONLY on READY — a failed
 // wake leaves the task at the head for the next supervise-tick drain. See
 // drainEphemeralQueue.

package/src/onboard/index.ts

@@ -51,7 +51,15 @@ export interface OnboardOptions {
 // ─────────────────────────────────────────────────────────────────────────────
 
 function runtimeBin(runtime: OnboardRuntime, env: NodeJS.ProcessEnv): string {
-  if (runtime === 'claude') return env.IAPEER_CLAUDE_BIN?.trim() || join(env.HOME?.trim() || homedir(), '.local', 'bin', 'claude')
+  if (runtime === 'claude') {
+    const override = env.IAPEER_CLAUDE_BIN?.trim()
+    if (override) return override
+    // Prefer the native installer location (~/.local/bin/claude), but fall back to the bare,
+    // PATH-resolved name so an npm/Homebrew claude installed elsewhere on PATH is not read as
+    // runtime-missing (symmetric with codex, which defaults to the bare name).
+    const native = join(env.HOME?.trim() || homedir(), '.local', 'bin', 'claude')
+    return isExecutable(native, env) ? native : 'claude'
+  }
   return env.IAPEER_CODEX_BIN?.trim() || 'codex'
 }
 
@@ -65,10 +73,9 @@ function isExecutable(binOrName: string, env: NodeJS.ProcessEnv = process.env):
     }
   }
   // bare name → PRESENCE probe over PATH (`command -v` semantics), NO spawn.
-  // History (live finds 10.06): the original `--version` ANSWER probe hung forever
-  // (three stray probes sat 25+ min); the 10 s timeout that replaced it then
-  // DEGRADED a live-looking codex to 'runtime-missing' (boris's catch). ROOT CAUSE
-  // (final, boris+iapeer-memory): macOS held the cask-updated codex on a GUI
+  // History: the original `--version` ANSWER probe hung forever (stray probes sat
+  // 25+ min); the 10 s timeout that replaced it then DEGRADED a live-looking codex
+  // to 'runtime-missing'. ROOT CAUSE: macOS held the cask-updated codex on a GUI
   // launch-approval dialog — EVERY invocation parked before main (observed as a
   // dyld hang) until the owner confirmed the dialog. NOT a non-tty class, not a
   // broken binary. The presence probe stays right regardless: the skip question is
@@ -94,8 +101,8 @@ function isExecutable(binOrName: string, env: NodeJS.ProcessEnv = process.env):
  */
 export function isMarketplaceRegistered(runtime: OnboardRuntime, env: NodeJS.ProcessEnv = process.env): boolean {
   const bin = runtimeBin(runtime, env)
-  // HARD TIMEOUT — a runtime CLI can wedge before main on ANY invocation (live
-  // 10.06: macOS launch-approval pending after a cask update parked codex — first
+  // HARD TIMEOUT — a runtime CLI can wedge before main on ANY invocation (e.g.
+  // macOS launch-approval pending after a cask update parked codex — first
   // `--version`, then this very `plugin marketplace list` after the presence
   // probe let the binary through). Timeout → status null → "not registered" →
   // the add (also time-bounded) decides; never a wedge.
@@ -132,7 +139,7 @@ export function registerMarketplace(
   ref: string = MARKETPLACE_REF,
 ): { ok: boolean; detail?: string } {
   const bin = runtimeBin(runtime, env)
-  // Same hard timeout as the list probe (the pre-main wedge class — known live
+  // Same hard timeout as the list probe (the pre-main wedge class — a known
   // representative: macOS launch-approval pending after a cask update) — a wedged
   // add degrades to a loud 'failed' line instead of freezing the host phase.
   const r = spawnSync(bin, ['plugin', 'marketplace', 'add', ref], { encoding: 'utf8', timeout: 120_000 })
@@ -156,11 +163,10 @@ export function isMarketplaceRegisteredAs(
 }
 
 /**
- * Refresh a runtime's local marketplace SNAPSHOT (контракт §Плагин провайдера,
- * просьба iapeer-memory): a plugin registered in the marketplace AFTER the host's
- * last pull reads as «unknown plugin» until the snapshot updates. Verb names
- * verified live 10.06: claude `plugin marketplace update <name>`, codex
- * `plugin marketplace upgrade <name>`.
+ * Refresh a runtime's local marketplace SNAPSHOT (контракт §Плагин провайдера):
+ * a plugin registered in the marketplace AFTER the host's last pull reads as
+ * «unknown plugin» until the snapshot updates. Verb names: claude `plugin
+ * marketplace update <name>`, codex `plugin marketplace upgrade <name>`.
  */
 export function refreshMarketplace(
   runtime: OnboardRuntime,

package/src/onboard/memory.ts

@@ -1,5 +1,5 @@
-// Memory-slot onboard step (docs/Слот памяти — контракт memory provider.md,
-// agreed with iapeer-memory + boris 10.06). Host-phase, optional, DEFAULT-YES:
+// Memory-slot onboard step (docs/Слот памяти — контракт memory provider.md).
+// Host-phase, optional, DEFAULT-YES:
 // install the default memory provider package and run ITS OWN init-verb — the
 // provider writes the slot declaration and deploys its surfaces; the core never
 // writes the slot itself. The provider OWNS the install questions (two-mode
@@ -17,7 +17,7 @@ import { normalizeIntelligenceValue } from '../core/constants.ts'
 import { readPeersIndex } from '../registry/index.ts'
 import { readMemoryProvider, type MemoryProvider } from '../status/index.ts'
 
-/** The distribution default provider (Артур: memory is a first-class core option). */
+/** The distribution default provider (memory is a first-class core option). */
 export const DEFAULT_MEMORY_PACKAGE = '@agfpd/iapeer-memory'
 
 export interface MemoryOnboardOptions {
@@ -56,7 +56,7 @@ function defaultRunInit(
   const probe = spawnSync('npm', ['view', `${pkg}@latest`, 'version'], { encoding: 'utf8', env })
   if (probe.status !== 0) return { status: probe.status, unavailable: true }
   // INHERITED stdio — the provider owns its install questions (tty interactive
-  // happens here, once). npx bin-name nuance (cf. the 0.2.9 update грабли): with
+  // happens here, once). npx bin-name nuance (cf. the 0.2.9 update pitfall): with
   // the provider bin already on PATH npx runs the INSTALLED one — acceptable for
   // an idempotent init (unlike the self-update case where it was a structural bug).
   const r = spawnSync('npx', ['-y', pkg, ...args], { stdio: 'inherit', env })
@@ -84,7 +84,7 @@ export async function onboardMemoryProvider(opts: MemoryOnboardOptions = {}): Pr
   if (opts.skip) return { state: 'skipped-flag', provider: existing }
   if (existing) {
     if (existing.package === pkg) return { state: 'already', provider: existing }
-    // Never silently install over an occupied slot (contract: ЗАПРЕЩЕНО).
+    // Never silently install over an occupied slot (contract: FORBIDDEN).
     return {
       state: 'refused-foreign',
       provider: existing,

package/src/onboard/steps.ts

@@ -1,7 +1,6 @@
 // Default-yes onboard steps for the distribution BACKBONE (design doc
-// docs/«Onboard костяка — notifier, telegram, каналы, update» — FINAL 10.06,
-// sanctioned by Артур; owners' facts baked: notifier ack «ноль вопросов»,
-// telegram self-config contract v0.10.0+).
+// docs/«Onboard костяка — notifier, telegram, каналы, update»; baked facts:
+// notifier «ноль вопросов», telegram self-config contract v0.10.0+).
 //
 // Backbone = core + memory slot + notifier-runtime + telegram-runtime. The onboard
 // step ORDER is significant: marketplace → notifier → TELEGRAM (creates the human
@@ -25,8 +24,8 @@ import {
 } from '../runtime/deploy.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
-// (а) notifier — default-yes, ZERO questions (owner-confirmed: the whole chain
-// has no prompt/stdin/tty dependency; all failures are fail-closed exit≠0).
+// (а) notifier — default-yes, ZERO questions (the whole chain has no
+// prompt/stdin/tty dependency; all failures are fail-closed exit≠0).
 // Prereq (not a question): `bun` on PATH — without it the npx shim exits non-zero
 // → SOFT SKIP with a clear message (design: unavailability is not a core error).
 // Idempotent re-onboard: install is manifest-gated (skipped), deploy is no-clobber
@@ -97,8 +96,8 @@ export async function onboardNotifierStep(opts: NotifierStepOptions = {}): Promi
 // writes interfaces.telegram.user_id itself; no prepare / interface-human calls.
 // Bot tokens are NOT asked here — they are per-channel (`iapeer connect telegram`).
 //
-// IDEMPOTENT re-onboard (boris's check, baked into the design): an EXISTING
-// natural peer in the registry → the step is a no-op/skip with a clear message —
+// IDEMPOTENT re-onboard: an EXISTING natural peer in the registry → the step is
+// a no-op/skip with a clear message —
 // NEVER an offer to create a second human peer.
 //
 // Interactive lives INSIDE the step (tty only); non-tty without the flags
@@ -222,8 +221,8 @@ export async function onboardTelegramStep(opts: TelegramStepOptions = {}): Promi
 
   try {
     // TELEGRAM_USER_ID rides the env into createPeer → initPeer → the package's
-    // self-config hook, which writes interfaces.telegram.user_id itself (owner's
-    // simplification, contract v0.10.0+ — no prepare / interface-human from the core).
+    // self-config hook, which writes interfaces.telegram.user_id itself
+    // (contract v0.10.0+ — no prepare / interface-human from the core).
     const r = await createPeer({
       personality,
       runtime: 'telegram',

package/src/provision/index.ts

@@ -122,8 +122,7 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
         }
       }
       // Provider PROVISION command (контракт §Provision провайдера, declaration
-      // v1.2 — ADR-009 inversion; решение Артура 10.06, схема сверена с
-      // iapeer-memory 11.06): an occupied slot WITH a provision block shells into
+      // v1.2 — ADR-009 inversion): an occupied slot WITH a provision block shells into
       // the PROVIDER's command per agentic runtime (occasion=birth) — the core
       // knows nothing about surface forms. A failure is NEVER masked (a broken
       // provider must not hide) — LOUD warn; repair is provider-side (the core is
@@ -167,7 +166,7 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
         }
       }
       // NB: the v1.1 plugin auto-install branch (an occupied slot WITH a `plugin`
-      // block) was REMOVED 11.06 — the plugin form is retired ecosystem-wide
+      // block) was REMOVED — the plugin form is retired ecosystem-wide
       // (provider's ADR-017; contract §Плагин провайдера is a tombstone). A v1.2
       // declaration without a provision block provisions nothing here.
     }

package/src/runtime/deploy.ts

@@ -6,7 +6,7 @@
 // per-peer self-config hook + auto-bootstrap, uniformly.
 //
 // MODE (b) "operator-add" (telegram human) does NOT come through here — it is a direct
-// `iapeer create maria --runtime telegram`. Both modes share the SAME per-peer
+// `iapeer create alice --runtime telegram`. Both modes share the SAME per-peer
 // self-config hook (invoked inside createPeer→initPeer); deployRuntime is just the
 // enumeration of the declared set. "1 always-on infra peer = 1 plist", idempotent
 // (re-deploy of an existing peer does not duplicate or clobber).
@@ -24,7 +24,7 @@ import { createPeer, type CreatePeerResult } from '../create/index.ts'
 import { readRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from './index.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Built-in runtime → npm package registry (§6, Артур 08.06): onboard AUTO-resolves
+// Built-in runtime → npm package registry (§6): onboard AUTO-resolves
 // the package for a known infra runtime and `npx`-installs it (the package self-
 // deploys its bin + manifest). The operator overrides per-runtime with --package.
 // FROZEN map; a runtime absent here needs an explicit --package.

package/src/runtime/index.ts

@@ -10,7 +10,7 @@
 //       declared set. Static.
 //   (b) operator-add  — a package whose peers are PEOPLE the package can't know ahead
 //       (telegram: a human) declares NO peers; the operator adds one dynamically with
-//       `iapeer create maria --runtime telegram`. Dynamic.
+//       `iapeer create alice --runtime telegram`. Dynamic.
 // BOTH converge on the SAME per-peer self-config hook ("configure runtime state for
 // peer X", idempotent). The hook is per-peer; only the enumeration/trigger differs.
 // So manifest.peers is OPTIONAL (mode b omits it); manifest.selfConfig is the shared
@@ -51,9 +51,9 @@ export interface RuntimePeerDecl {
 export interface RuntimeManifest {
   /** The runtime id this manifest describes (must match the folder it lives in). */
   runtime: Runtime
-  /** OPTIONAL installed package version (the owners' self-install stamp — the
-   *  telegram owner's 10.06 obligation). `update-runtime` version-gates on it;
-   *  absent → no gate, the update re-installs idempotently. */
+  /** OPTIONAL installed package version (the package's self-install stamp).
+   *  `update-runtime` version-gates on it; absent → no gate, the update
+   *  re-installs idempotently. */
   version?: string
   /** OPTIONAL per-peer self-config hook (the shared contract both modes call). */
   selfConfig?: SelfConfigDescriptor