@agfpd/iapeer 0.2.77 → 0.2.79

package/src/core/constants.ts

@@ -18,12 +18,12 @@ export const PEERS_SCHEMA_VERSION = 2
 // 450 (was 250): self-documenting API-peer descriptions (notifier timer/watcher)
 // must fit "who the peer is + registration format + a live example" — dense full
 // texts run to ~408 chars; 250 cut them mid-word so the caller could not compose
-// the call. Bumped with Arthur's sanction (2026-06-08). NB: this is COMPILE-TIME
+// the call. NB: this is COMPILE-TIME
 // baked — the live daemon re-clamps descriptions on read (registry parsePeerRecord),
 // so the running router keeps the OLD limit until restarted onto the new binary.
 export const MAX_DESCRIPTION_LEN = 450
 
-// Contract vocabulary (docs/Идентичность, Артур 05.06): the nature of the
+// Contract vocabulary (docs/Идентичность): the nature of the
 // intelligence expressing itself through a runtime.
 //   artificial — AI agent · natural — human · absent — programmatic source
 export const INTELLIGENCE_VALUES = ['artificial', 'natural', 'absent'] as const
@@ -127,7 +127,7 @@ export const DEFAULT_SOCK_DIR = '/tmp'
 // agree — a site that hardcodes DEFAULT_SOCK_DIR would look in /tmp while a sandbox
 // (IAPEER_SOCK_DIR set) created the session elsewhere → a false "offline".
 //
-// IAPEER_ROOT IMPLIES SOCKET ISOLATION (boris's e2e find 10.06): an alt-root used
+// IAPEER_ROOT IMPLIES SOCKET ISOLATION: an alt-root used
 // to inherit the GLOBAL /tmp, so a sandboxed `list` saw PROD sessions live by name
 // collision, and a sandboxed stop/start would have HIT a prod session. A set root
 // now derives `<root>/socks` unless IAPEER_SOCK_DIR explicitly says otherwise; the

package/src/core/normalize.ts

@@ -11,7 +11,7 @@
 // and system `uconv`/`iconv` are forbidden by the zone (OS-nondeterministic) and
 // absent here. `transliteration` is the one pure-JS engine that reproduces ICU
 // across WRITING SYSTEMS — CJK → pinyin WITH syllable spacing (项目 → "Xiang Mu"),
-// Cyrillic (Артур → "Artur"), Greek (Ω → "O"), Latin diacritics (Köln → "Koln") —
+// Cyrillic (Привет → "Privet"), Greek (Ω → "O"), Latin diacritics (Köln → "Koln") —
 // and it bundles its own CLDR/unidecode-derived tables, so it is deterministic
 // across OSes (exactly the property the zone's iconv ban is protecting). It is the
 // deterministic CLDR-EQUIVALENT of ICU, NOT a literal ICU engine.
@@ -75,7 +75,7 @@ function slug(value: string): string {
  * derivation/comparison routes through (basename(cwd) → personality, PEER_*
  * comparisons, profile re-validation).
  *
- * IDEMPOTENT on already-valid names: normalize("boris") === "boris",
+ * IDEMPOTENT on already-valid names: normalize("alice") === "alice",
  * normalize("notifier-timer") === "notifier-timer" — required because
  * validatePersonality re-normalizes stored profile names.
  *

package/src/create/index.ts

@@ -11,7 +11,7 @@
 // NO-CLOBBER: making the folder is mkdir-recursive (never deletes); init is
 // idempotent (profile kept, .mcp.json merged, doctrine never overwritten). The one
 // hard refusal: a target that already holds a DIFFERENT peer's profile — creating
-// "maria" into a folder that is already "boris" would either silently adopt boris or
+// "alice" into a folder that is already "bob" would either silently adopt bob or
 // split an identity, so it fails loudly instead.
 //
 // INFRA (telegram human via operator-add / notifier function via a declared set):

package/src/daemon/index.ts

@@ -79,7 +79,7 @@ export function resolveCallerFromHeader(value: string | undefined, index: PeersI
 // The roster of known peers is DELIBERATELY NOT in this description. It is rendered
 // ONCE, in the peer's system prompt (composeSystemPrompt → Layer 3 "## Known peers").
 // Embedding it here ALSO duplicated the full list into every agent's context on every
-// turn — a live consumer (boris) confirmed seeing the identical roster twice. The
+// turn — confirmed live: an agent saw the identical roster twice. The
 // description stays light: purpose + parameter semantics only; the model gets the
 // roster from its system prompt. Likewise the MCP server-level `instructions` field is
 // left unset (createMcpServer) — it would re-inject doctrine into the client system
@@ -211,7 +211,7 @@ export async function callTool(
     // Ф-#8a: ONE durable outcome line per delivery attempt (delivery.log, sibling
     // to lifecycle.log) — metadata only, never the body. Both branches of the
     // routeSend result are recorded, so a suspected loss is reconstructable from
-    // disk (the gap the 09.06 investigation hit). No-op when no dir is wired
+    // disk (the gap a delivery-loss investigation hit). No-op when no dir is wired
     // (library/test daemons); appendDeliveryEvent itself never throws.
     appendDeliveryEvent(deps.deliveryLogDir, {
       ev: 'delivery',
@@ -221,8 +221,8 @@ export async function callTool(
       ok: String(sent.ok),
       via: sent.ok ? `${sent.value.delivered_to.runtime}-${sent.value.delivered_to.personality}` : undefined,
       woke: sent.ok ? String(sent.value.woke) : undefined,
-      // M3 queue observability (boris acceptance (a)): a queued accept is marked
-      // and carries the queue depth at accept time — a stuck queue is visible.
+      // M3 queue observability: a queued accept is marked and carries the queue
+      // depth at accept time — a stuck queue is visible.
       queued: sent.ok && sent.value.queued ? 'true' : undefined,
       qkind: sent.ok ? sent.value.queuedBy : undefined,
       qd: sent.ok ? sent.value.queueDepth : undefined,
@@ -345,7 +345,7 @@ export interface StartDaemonOptions extends StorageOptions {
    * `Authorization: Bearer <token>` or it is rejected 401 BEFORE any MCP dispatch.
    * Unset → no auth (the same-uid unix-socket base / loopback default). This is the
    * structural layer for closing H8 on the TCP loopback listener — kept OFF until
-   * Артур enables it (the production main reads IAPEER_BEARER_TOKEN). Loopback is
+   * explicitly enabled (the production main reads IAPEER_BEARER_TOKEN). Loopback is
    * broader than same-uid, so a token gates it without changing the on-wire MCP.
    */
   bearerToken?: string

package/src/daemon/main.ts

@@ -118,10 +118,10 @@ export function makeArmEphemeralOnDelivered(cfg: LifecycleConfig): (caller: Reso
  * makeEphemeralRouteDeps): record a LIVE-delivered topic as the target identity's
  * `.topic` marker, so the marker tracks the topic the session LAST WORKED ON — the
  * semantics resolveWakeMode's executor discriminator actually wants — not merely the
- * topic it woke with. Live defect 11.06 (boris): an executor woke topicless at 13:13,
- * worked a delivered topic all day, was stop-parked clean, and the topic-matching
- * resume-wake at 17:06 compared against the STALE wake-time marker → cause=
- * idle-reaped-new-topic → FRESH; the day's context was lost despite the clean park.
+ * topic it woke with. Defect: an executor could wake topicless, work a delivered
+ * topic for a session, be stop-parked clean, and a later topic-matching resume-wake
+ * compared against the STALE wake-time marker → cause=idle-reaped-new-topic → FRESH;
+ * the session's context was lost despite the clean park.
  * Same-topic deliveries are a no-op (no marker churn, no log spam) — the lifecycle.log
  * line `ev=topic-note` therefore marks exactly the moments the session's working
  * topic SHIFTED, which is what a fresh-vs-resume postmortem needs. Best-effort: a
@@ -307,7 +307,7 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
     ephemeral,
     // Live-delivered topic → the target's .topic marker (see makeNoteLiveTopic):
     // the wake resolver's executor discriminator then compares against the topic
-    // the session last WORKED ON, not the one it woke with (defect 11.06).
+    // the session last WORKED ON, not the one it woke with.
     noteLiveTopic,
     // Busy-human-composer queue: fast queued ack, async drain, fail all pending
     // on daemon close/update so a queued envelope is never silently lost.
@@ -371,7 +371,7 @@ export interface InstallDaemonPlistOptions {
 export function buildDaemonPlistSpec(opts: InstallDaemonPlistOptions = {}): LaunchdPlistSpec {
   const env = opts.env ?? process.env
   const home = env.HOME?.trim() || homedir()
-  const defaultPath = `${home}/.bun/bin:${home}/.local/bin:/opt/homebrew/bin:/usr/bin:/bin`
+  const defaultPath = `${home}/.bun/bin:${home}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin`
   const logDir = pluginLogsDir('iapeer', { env })
   const environment: Record<string, string> = {
     PATH: opts.path ?? env.PATH ?? defaultPath,
@@ -417,9 +417,9 @@ export interface InstallDaemonPlistResult {
  * ~/Library/LaunchAgents/com.agfpd.iapeer.plist (or IAPEER_LAUNCHAGENTS_DIR),
  * returning {path, changed}. Writes the FILE only — does NOT bootstrap it (load
  * is a deliberate operator step). IDEMPOTENT BY CONTENT: writes only when the
- * rendered plist differs from what is already on disk (owner-caught 11.06: an
- * unconditional rewrite on every deploy spams the owner's Background Task
- * Management notification for zero benefit). Collision guard: refuses to
+ * rendered plist differs from what is already on disk (an unconditional rewrite
+ * on every deploy spams the owner's Background Task Management notification for
+ * zero benefit). Collision guard: refuses to
  * overwrite an existing com.agfpd.iapeer.plist that is not foundation-owned
  * (lacks the sentinel) — the same ownership proof the peer-plist installer uses.
  * com.agfpd.* is the foundation-exclusive daemon namespace, so this never

package/src/enable/index.ts

@@ -1,9 +1,9 @@
 // enable — per-peer capability install (contract Установка §3 + Per-рантайм
 // install-асимметрия; verb `enable <capability> [peer]`). The init→enable
-// capability story: a peer gains a capability (peer-voice / MergeMind) FROM our
-// marketplace. iapeer ORCHESTRATES — install + enable + call `setup` ONLY if the
-// plugin declares it — and deliberately does NOT resolve the plugin's dep-graph
-// (`requires`/`setup` internals are the plugin's job, → Стандарт iapeer плагина).
+// capability story: a peer gains a capability FROM our marketplace. iapeer
+// ORCHESTRATES — install + enable + call `setup` ONLY if the plugin declares it
+// — and deliberately does NOT resolve the plugin's dep-graph (`requires`/`setup`
+// internals are the plugin's job, → Стандарт iapeer плагина).
 //
 // Per-рантайм install-асимметрия (contract table):
 //   claude → `plugin install <p>@agfpd --scope project` run IN the peer's cwd; the
@@ -15,9 +15,10 @@
 //            against the real host under fleet-guard without an isolated CODEX_HOME.
 //
 // SIMPLE vs СЛОЖНЫЙ plugin (contract): a plugin MAY ship `iapeer.json` at its root
-// declaring `setup` (a multi-step installer) and `requires`. SIMPLE (peer-voice — no
-// iapeer.json/no setup): install + enable → works. СЛОЖНЫЙ (MergeMind): install +
-// enable → call `setup`. iapeer reads the manifest and calls setup ONLY if declared.
+// declaring `setup` (a multi-step installer) and `requires`. SIMPLE (no
+// iapeer.json/no setup): install + enable → works. СЛОЖНЫЙ (a multi-step
+// capability plugin): install + enable → call `setup`. iapeer reads the manifest
+// and calls setup ONLY if declared.
 
 import { spawnSync } from 'child_process'
 import { existsSync, readFileSync, realpathSync } from 'fs'
@@ -369,10 +370,10 @@ export interface CwdEnableOptions {
 }
 
 /** One install attempt for one runtime, WITH the stale-snapshot resilience the
- *  contract requires (просьба iapeer-memory): a failed attempt refreshes the
- *  runtime's local marketplace snapshot (claude `marketplace update` / codex
- *  `marketplace upgrade`) and retries ONCE — a plugin registered in the
- *  marketplace after the host's last pull reads as «unknown plugin» until then. */
+ *  contract requires: a failed attempt refreshes the runtime's local marketplace
+ *  snapshot (claude `marketplace update` / codex `marketplace upgrade`) and
+ *  retries ONCE — a plugin registered in the marketplace after the host's last
+ *  pull reads as «unknown plugin» until then. */
 function enableRuntimeWithRetry(
   rt: CapabilityRuntime,
   plugin: string,
@@ -399,8 +400,8 @@ function enableRuntimeWithRetry(
  * codex global) + enable + `setup` ONLY if declared — with marketplace ensure
  * (marketplaceRef given + not registered → add) and the stale-snapshot retry.
  * Consumer: enableCapability (the peer-resolved generic `iapeer enable` verb) —
- * ONE home of the install forms. (The memory-plugin birth-hook and verb consumers
- * were removed 11.06 — the provider plugin form is retired, ADR-017.)
+ * ONE home of the install forms. (The provider birth-hook and verb consumers were
+ * removed — the provider plugin form is retired, ADR-017.)
  */
 export function enableCapabilityForCwd(o: CwdEnableOptions): EnableResult {
   const env = o.env ?? process.env
@@ -473,9 +474,9 @@ export function enableCapability(opts: EnableOptions): EnableResult {
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Removal forms — REMOVED 11.06 with the memory-plugin verb (their only caller;
-// ADR-017 retired the provider plugin form). Historical verb names, verified
-// live 10.06, for a future generic `disable`: claude `plugin uninstall <id>
-// --scope project` (run in the peer cwd), codex `plugin remove <id>`
-// (host-global). See git history ≤v0.2.41 for the implementations.
+// Removal forms — REMOVED with the provider verb (their only caller; ADR-017
+// retired the provider plugin form). Historical verb names, for a future generic
+// `disable`: claude `plugin uninstall <id> --scope project` (run in the peer
+// cwd), codex `plugin remove <id>` (host-global). See git history ≤v0.2.41 for
+// the implementations.
 // ─────────────────────────────────────────────────────────────────────────────

package/src/enable/provisionCommand.ts

@@ -1,18 +1,18 @@
-// Provision-command executor — the v1.2 inversion joint (контракт «Слот памяти»
-// §Provision провайдера; ADR-009, решение Артура 10.06, схема сверена с
-// iapeer-memory 11.06). The slot declares provision/unprovision COMMANDS; the
-// core shells into them at the lifecycle joints and knows NOTHING about surface
-// forms. The four contract requirements live here:
+// Provision-command executor — the v1.2 inversion joint (contract «Слот памяти»
+// §Provision провайдера; ADR-009). The slot declares provision/unprovision
+// COMMANDS; the core shells into them at the lifecycle joints and knows NOTHING
+// about surface forms. The four contract requirements live here:
 //   1. argv-form {command, args[]} with PER-ARG placeholder substitution —
-//      spawned WITHOUT a shell (injection/quoting class; бэктик-грабли 10.06).
+//      spawned WITHOUT a shell (injection/quoting class — a backtick in an arg
+//      must never reach a shell).
 //   2. `command` is ABSOLUTE (parser refuses relative — launchd minimal PATH).
 //   3. Timeout 120 s; best-effort semantics live at the CALL SITES (LOUD warn,
 //      the birth/remove flow continues) — this module only reports structurally.
 //   4. {occasion} vocabulary (финален, contract §Provision): birth | sweep-on |
 //      off-peer | off-all | remove — ref-counting of host-global surfaces is the
-//      PROVIDER's business. Since the memory-plugin verb removal (11.06, ADR-017)
-//      the CORE emits only `birth` and `remove`; the sweep occasions remain part
-//      of the provider-command interface (their CLI may use them internally).
+//      PROVIDER's business. Since the provider-verb removal (ADR-017) the CORE
+//      emits only `birth` and `remove`; the sweep occasions remain part of the
+//      provider-command interface (their CLI may use them internally).
 // Idempotency is the provider's obligation by construction; the provider holds
 // its own lock against concurrent provisions.
 
@@ -20,7 +20,7 @@ import { spawnSync } from 'child_process'
 import { accessSync, constants as FS } from 'fs'
 import type { MemoryProviderProvision } from '../status/index.ts'
 
-/** The agreed occasion vocabulary (финален, сверено с iapeer-memory). */
+/** The agreed occasion vocabulary (финален). */
 export type ProvisionOccasion = 'birth' | 'sweep-on' | 'off-peer' | 'off-all' | 'remove'
 
 export const PROVISION_TIMEOUT_MS = 120_000

package/src/identity/index.ts

@@ -481,12 +481,12 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
   const mergedRuntimes = uniqueRuntimes([...existing.runtimes, ...discoveredRuntimes])
   ensureLocalRuntimeScopes(cwd, mergedRuntimes)
   // RE-PROVISION parity with the new-profile branch: an EXISTING infra peer (a
-  // migration / re-provision — e.g. `iapeer create arthur --runtime telegram` to move
+  // migration / re-provision — e.g. `iapeer create alice --runtime telegram` to move
   // a live telegram human onto the foundation) must ALSO get its always-on plist
   // installed and its intelligence set to the runtime's foundation default
   // (telegram→natural, notifier→absent). The old code only merged runtimes here, so
   // re-provisioning an infra peer wrote NO plist (bootstrap → refused-foreign on the
-  // missing plist) and left a stale legacy intelligence — the arthur cutover had to
+  // missing plist) and left a stale legacy intelligence — the cutover had to
   // install the plist + flip vocab by hand. Install BEFORE the write so a
   // collision-guard refusal (a foreign plist still sitting at the label) fails loudly
   // and leaves no half-updated profile. Idempotent for our own (sentinel) plist.

package/src/identity/profileStandard.ts

@@ -11,7 +11,7 @@
 //     (telegram/capability passport — PASSPORT ONLY: aliases are misfiled there and the
 //     contract relocates them to `expansion.aliases`, the runtime-agnostic plugin-config
 //     section owned by the chat-runtime — telegram-runtime today, future discord/matrix
-//     read the SAME section per the 25.05 expansion design), notifier (notifier-runtime),
+//     read the SAME section per the expansion design), notifier (notifier-runtime),
 //     expansion (chat-runtime aliases), <plugin> sections — each plugin writes only its
 //     own field via atomic merge. Plugin-config sections are NOT projected into the
 //     registry index (private config is read from the LOCAL profile by its owner).
@@ -130,12 +130,12 @@ export function validateProfileStandard(raw: unknown, cwd: string): ProfileIssue
       message: 'legacy top-level `aliases` — contract relocates to expansion.aliases (/alias-* namespace); owner migration pending',
     })
   }
-  // aliases misfiled in the PASSPORT (interfaces.telegram) — the 07.06 interim home.
-  // Taxonomy revision (11.06, Артур): aliases are PRIVATE plugin config (one reader,
-  // the chat-runtime at expansion), not a public passport attribute — the contract
-  // relocates them to the runtime-agnostic `expansion.aliases` section (25.05 замысел:
-  // future discord/matrix runtimes read the SAME aliases). Transition observability:
-  // this warn goes silent once the owner migration moves the data.
+  // aliases misfiled in the PASSPORT (interfaces.telegram) — an interim home.
+  // Taxonomy: aliases are PRIVATE plugin config (one reader, the chat-runtime at
+  // expansion), not a public passport attribute — the contract relocates them to the
+  // runtime-agnostic `expansion.aliases` section (future discord/matrix runtimes read
+  // the SAME aliases). Transition observability: this warn goes silent once the owner
+  // migration moves the data.
   const interfacesObj =
     obj.interfaces && typeof obj.interfaces === 'object' && !Array.isArray(obj.interfaces)
       ? (obj.interfaces as Record<string, unknown>)
@@ -254,7 +254,7 @@ export function reconcileIndex(options: PeersUpdateOptions = {}): ReconcileEntry
  * Self-heal the index: REPLACE every registry record with the projection from its
  * local profile (the source of truth). Unlike upsertPeer (which UNIONs runtimes so a
  * boot never drops one), reindex is a deliberate REWRITE — it is how a local profile's
- * narrowed runtimes (e.g. arthur dropped to [telegram]) propagate to the index. A peer
+ * narrowed runtimes (e.g. dropped to [telegram]) propagate to the index. A peer
  * whose local profile is missing is left untouched (and surfaced in `missing`). The
  * legacy-safe intelligenceRaw is preserved when the nature is unchanged (never silently
  * migrate the live vocab — the human→natural incident class).

package/src/init/index.ts

@@ -3,7 +3,7 @@
 // + registry + infra plist) and adds the per-peer ECOSYSTEM wiring a peer needs to
 // talk: the HTTP-MCP transport config + the local doctrine template.
 //
-// THE BIG SIMPLIFICATION (install-gate snapped LIVE 08.06): a peer gets send_to_peer
+// THE BIG SIMPLIFICATION (install-gate, proven live): a peer gets send_to_peer
 // purely from a project-scope `.mcp.json` pointing at the host-wide HTTP-MCP daemon —
 // NO plugin install, NO /reload-plugins, NO GC version-snapshots (the whole legacy
 // persistent-peer install-gate class is gone). Verified: a cold-start claude session
@@ -120,8 +120,8 @@ export function writeClaudeMcpConfig(cwd: string, personality: string, daemonUrl
 //
 // codex's CLI does NOT import tools from an OPEN streamable-HTTP MCP server — it marks
 // it authStatus=unsupported (and BLOCKS on startup) unless an auth scheme is configured
-// (codex bug #21532 / #4707). The token-free fix (PROVEN LIVE, codex 0.136, owner
-// decision 08.06 — Артур rejected a real host-wide bearer as a localhost crutch): set a
+// (codex bug #21532 / #4707). The token-free fix (PROVEN LIVE, codex 0.136; a real
+// host-wide bearer was rejected as a localhost crutch): set a
 // FIXED, NON-SECRET bearer (CODEX_DUMMY_BEARER). Setting `bearer_token_env_var` flips
 // authStatus to `bearer_token` purely from the config FACT — codex does NOT require the
 // server to validate the token. The daemon stays OPEN: it ignores `Authorization` and
@@ -183,16 +183,16 @@ export function writeCodexMcpConfig(daemonUrl: string, options: StorageOptions =
  * Idempotently ensure codex's startup update-check DIALOG is disabled host-wide:
  * `check_for_update_on_startup = false` as a TOP-LEVEL key in config.toml.
  *
- * Why (incident 11.06, codex-linus): the interactive "✨ Update available! …
- * Press enter to continue" dialog is a BOOT GATE — a daemon-woken codex session
- * sits on it until a human attaches. The wake reported never-became-ready after
- * 4+ minutes and a notifier alert of the EMERGENCY contour (mining farm) was
- * lost; the session came alive only from a manual attach. Warm-on-demand peers
+ * Why: the interactive "✨ Update available! … Press enter to continue" dialog is
+ * a BOOT GATE — a daemon-woken codex session sits on it until a human attaches.
+ * Observed: the wake never became ready after 4+ minutes and a notifier alert of
+ * the EMERGENCY contour was lost; the session came alive only from a manual
+ * attach. Warm-on-demand peers
  * must reach ready hands-free — codex updates stay operator-driven (`codex
  * update` / brew), never a boot-time question to a headless session.
  *
  * Mechanics: the key is a documented top-level config.toml option (present in
- * the binary's own config schema; suppression PROVEN LIVE 11.06 on codex 0.138
+ * the binary's own config schema; suppression PROVEN LIVE on codex 0.138
  * with the 0.139 update pending — control boot showed the dialog, the keyed
  * boot went straight past it). A TOML top-level key must precede the first
  * table header, so the key is PREPENDED — appending would land it inside the
@@ -346,7 +346,7 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
   let codexMcpConfigPath: string | undefined
   if (provisioned.runtime === 'codex' || hasCodexMarker(provisioned.cwd)) {
     codexMcpConfigPath = writeCodexMcpConfig(daemonUrl, { env }).path
-    // Boot-gate hygiene (incident 11.06): a codex peer must never sit on the
+    // Boot-gate hygiene: a codex peer must never sit on the
     // interactive update dialog at wake — disable the startup check host-wide.
     ensureCodexUpdateCheckDisabled({ env })
   }

package/src/install/index.ts

@@ -9,8 +9,8 @@
 //
 // macOS TCC: a stable PATH is NOT enough to keep grants through updates — TCC keys
 // on the code requirement, and an ad-hoc bun-compiled binary's requirement is its
-// CDHash (changes every build → re-prompts; live-proven 10.06, Артур's DX
-// requirement). signInstalledBinary (signing.ts) re-signs each install with the
+// CDHash (changes every build → re-prompts; live-proven).
+// signInstalledBinary (signing.ts) re-signs each install with the
 // stable local identity so the designated requirement — and the grants — survive.
 
 import { copyFileSync, existsSync, mkdirSync, renameSync, statSync } from 'fs'

package/src/install/signing.ts

@@ -1,6 +1,5 @@
 // Stable code-signing for the installed binary — TCC grants must SURVIVE updates
-// (Артур's DX requirement 10.06: «1 раз при установке, потом обновления не должны
-// опять триггерить»).
+// (grant once at install; subsequent updates must not re-trigger the TCC prompts).
 //
 // ROOT CAUSE (proven on the host): `bun build --compile` output is ad-hoc
 // linker-signed (Identifier=a.out, no cert chain) — its only stable identity is
@@ -8,7 +7,7 @@
 // requirement; for an ad-hoc binary that collapses to the cdhash → every update
 // is a NEW TCC subject → re-prompts.
 //
-// FIX (proven live, /tmp experiment 10.06): a LOCAL self-signed code-signing
+// FIX (proven live): a LOCAL self-signed code-signing
 // identity ("iapeer Local Codesign", created once at install) re-signs the binary
 // after every build. Two different binaries signed by it carry the IDENTICAL
 // designated requirement:
@@ -26,7 +25,7 @@ import { tmpdir } from 'os'
 import { join } from 'path'
 import { spawnSync } from 'child_process'
 
-/** CROSS-PRODUCT CONTRACT (agreed with iapeer-memory, 10.06): this CN is the
+/** CROSS-PRODUCT CONTRACT: this CN is the
  *  SHARED signing identity of the whole agfpd stack. Each product signs with its
  *  OWN --identifier (foundation: com.agfpd.iapeer; memory: com.agfpd.iapeer-memory),
  *  so TCC subjects stay separate while the host carries ONE key (one keychain

package/src/launch/adapters/claude.ts

@@ -91,8 +91,8 @@ export const claudeAdapter: RuntimeAdapter = {
   usesDoctrine: true,
 
   /**
-   * Delivery markers for submitIntoTui (07.06 refactor — moved out of transport's
-   * PROMPT_GLYPHS union into the adapter; docs/Рантайм claude "Доставка"):
+   * Delivery markers for submitIntoTui (moved out of transport's PROMPT_GLYPHS
+   * union into the adapter; docs/Рантайм claude "Доставка"):
    *   - promptGlyphs ['❯'] — the same U+276F input-prompt glyph as isInputReady;
    *     submitIntoTui finds the prompt row by it. claude-only (codex uses '›'), so
    *     a stray codex glyph in a claude pane no longer false-matches.
@@ -151,10 +151,10 @@ export const claudeAdapter: RuntimeAdapter = {
    *   - RESUME COMPACT-PICKER ('Resume from summary …') → CURSOR-VERIFIED two-step.
    *     This menu's cursor DEFAULTS to "1. Resume from summary (recommended)",
    *     and selecting it COMPACTS the session (claude implements that choice as an
-   *     internal /compact) — the owner's invariant is «на resume не должно быть
-   *     компакта». The original blind ['Down','Enter'] burst (0e67e1f) put BOTH
-   *     keys into one pty chunk; under a heavy resume (boris 10.06, 313k-token
-   *     session) the TUI dropped the Down and the Enter confirmed the DEFAULT →
+   *     internal /compact) — but a resume must NOT trigger a compact. The original
+   *     blind ['Down','Enter'] burst (0e67e1f) put BOTH keys into one pty chunk;
+   *     under a heavy resume (a 313k-token session) the TUI dropped the Down and
+   *     the Enter confirmed the DEFAULT →
    *     silent /compact (proven: pane log shows the picker frame with ❯ on
    *     option 1 followed by "❯ /compact"; transcript compactMetadata
    *     trigger=manual). Fix: ONE key per boot-iteration — Down while the cursor
@@ -256,7 +256,7 @@ export const claudeAdapter: RuntimeAdapter = {
    * + docs/TUI-взаимодействие):
    *   - interrupt → ['Escape'] (claude interrupts the current turn with ONE Escape;
    *     the session + context stay intact — distinct from the `stop` verb which halts
-   *     the session). The "кнопка заткнуть бредящего" without losing context.
+   *     the session). Interrupts a runaway turn without losing context.
    *   - compact → type '/compact' then Enter (claude's context-compaction slash).
    *   - anything else → null (unsupported → explicit refusal upstream).
    */

package/src/launch/adapters/codex.ts

@@ -154,8 +154,7 @@ export const codexAdapter: RuntimeAdapter = {
   usesDoctrine: true,
 
   /**
-   * Delivery markers for submitIntoTui (07.06 refactor; docs/Рантайм codex
-   * "Доставка"):
+   * Delivery markers for submitIntoTui (docs/Рантайм codex "Доставка"):
    *   - promptGlyphs ['›'] — codex's input-row arrow (the same stable invariant as
    *     isInputReady's '› ' check; the exact glyph the prompt row starts with).
    *     codex-only, so a stray claude '❯' no longer false-matches.
@@ -234,12 +233,12 @@ export const codexAdapter: RuntimeAdapter = {
    *     the input arrow is the stable ready invariant — not any single tip.)
    *
    * DELIBERATELY no 'OpenAI Codex' splash check (the watcher.codexInputReady
-   * heritage requirement, removed 12.06): `resume --last` replays the prior
+   * heritage requirement, since removed): `resume --last` replays the prior
    * transcript ABOVE the composer, and a history taller than the pane scrolls
    * the splash box off the top of capture-pane — the predicate then stays false
    * for the entire boot deadline while the composer sits ready, failing the wake
-   * `never-became-ready` and LOSING the triggering message (live incidents
-   * 11.06 19:21Z + 12.06 12:07Z, codex-linus). A replayed history message also
+   * `never-became-ready` and LOSING the triggering message (observed live with a
+   * tall replayed history). A replayed history message also
    * renders with a leading '› ', so this can fire a frame before the composer
    * activates — benign: the paste/Enter queue in the pty and land in the
    * composer, and the ready-gate still verifies a real model turn (activity
@@ -302,7 +301,7 @@ export const codexAdapter: RuntimeAdapter = {
    *     interrupts the turn — NOT a double. (Codex's own footer says "esc to
    *     interrupt"; one Escape yields "■ Conversation interrupted". The contract's
    *     open "×1/×2?" is resolved to ×1, same as claude.) Session + context intact.
-   *   - compact → type '/compact' then Enter. SNAPPED LIVE 12.06 (codex-cli
+   *   - compact → type '/compact' then Enter. SNAPPED LIVE (codex-cli
    *     0.138.0): the slash EXISTS now — autocomplete documents it («summarize
    *     conversation to prevent hitting the context limit») and a live run
    *     yields «• Context compacted». The 0.136-era "codex has no /compact"

package/src/launch/canary.ts

@@ -1,15 +1,15 @@
 // Server-death canary — the SERVER-level catcher for the exit-cause gap the
 // pane-died hook structurally cannot close (контракт: pane-died needs a living
 // tmux event loop; SIGKILL/OOM to the tmux SERVER runs no hook). Raised from the
-// deferred backlog after the SECOND live case of the class (iapeer-memory 10.06
-// 01:43, boris 10.06 11:41 — both: a healthy session with active Bash
-// subprocessing, the whole server gone silently, zero system traces).
+// deferred backlog after the SECOND live case of the class (both: a healthy
+// session with active Bash subprocessing, the whole server gone silently, zero
+// system traces).
 //
 // Mechanism: one tiny detached `sh` per LIVE tmux server, holding a blocking
 // client `tmux -S <sock> wait-for iap-canary-<identity>` — a process OUTSIDE the
 // dying server, connected via its socket, so the server's death (any cause,
 // including SIGKILL) is observed the moment the connection drops. Protocol (v2 —
-// death #4 10.06 15:42Z proved v1's exit-code trust wrong twice over: the killer
+// a live death proved v1's exit-code trust wrong twice over: the killer
 // took the SERVER and the canary CLIENT together, AND a TERMed tmux client
 // returns rc=0 — indistinguishable from a clean channel signal — so the rc-based
 // `0 || ≥128 → silent` guard silenced a real death):
@@ -26,11 +26,11 @@
 //     into exits.log (the per-peer death-cause home, next to pane-died's
 //     `ev=session-exit`) + a forensics snapshot (vm_stat / swap / top-RSS ps /
 //     fresh DiagnosticReports) captured within seconds — the evidence the 60 s
-//     supervise tick can never recover ("системных следов ноль" was the recurring
+//     supervise tick can never recover (zero system traces was the recurring
 //     investigation outcome). PID identity matters: a wake/attach can replace the
 //     tmux server on the same socket before the 2 s grace elapses; probing only
 //     the socket would mistake the successor for the dead original and lose the
-//     canary record (live canary-gap 11.06).
+//     canary record (a live canary-gap).
 //     The raw wait_rc still ATTRIBUTES the death (cause=server-vanished /
 //     signaled-server-gone / client-killed-server-gone).
 // Residual blind spot (structural): a killer that SIGKILLs the sh recorder
@@ -103,7 +103,7 @@ export function canaryScript(o: CanaryScriptOptions): string {
     `'${o.tmuxBin}' -S '${o.sock}' wait-for '${ch}'`,
     `rc=$?`,
     // NO wait-for exit code is trusted as "deliberate" by itself — PROVEN live
-    // (death-#4 postmortem): a TERM to the tmux CLIENT returns rc=0, identical
+    // (a death postmortem): a TERM to the tmux CLIENT returns rc=0, identical
     // to a clean channel signal, so an external killer sweeping server+client
     // rides the clean-looking code straight past any rc-based guard (v1's
     // `rc=0 || rc>=128 → silent` was exactly that hole). v2 contract instead:
@@ -217,7 +217,7 @@ export function signalCanaryClean(sock: string, identity: string): void {
 /** The pgrep/pkill ERE matching BOTH canary processes of ONE identity — the sh
  *  wrapper (its -c script quotes the channel: `…'iap-canary-<id>'…`) and the
  *  tmux client (argv ends with the bare channel). Anchored so an identity can
- *  never match another identity's prefix (claude-iapeer ≠ claude-iapeer-memory). */
+ *  never match another identity's prefix (claude-alice ≠ claude-alice-bob). */
 export function canaryProcessPattern(identity: string): string {
   return `${canaryChannel(identity)}([^a-z0-9-]|$)`
 }

package/src/launch/cmdlog.ts

@@ -1,6 +1,6 @@
 // tmux command-log — the SOCKET-COMMAND observability layer of the killer hunt.
 //
-// Why (death class 11.06, boris's session-deaths track): a tmux server killed by a
+// Why (a session-death class): a tmux server killed by a
 // CLIENT COMMAND (`kill-server` / `kill-session` over the unix socket) dies with
 // zero signals — structurally invisible to ALL THREE existing layers: the eslogger
 // trap (no kill(2) anywhere; kernel-originated SIGHUP to the panes is also proven
@@ -11,7 +11,7 @@
 // the attribution (client pid + exact command + timestamp) that decides the class
 // binarily: "killed by client X" vs "no command ⇒ internal exit".
 //
-// Sensitivity (boris's requirement): the -v log carries FULL send-keys payloads
+// Sensitivity: the -v log carries FULL send-keys payloads
 // (every delivered envelope, plaintext) — tmux has no commands-only level and the
 // server writes the file itself (name tmux-server-<pid>.log in the STARTING
 // client's cwd — no FIFO/pipe interposition possible). Containment instead:
@@ -63,7 +63,7 @@ export function prepareCmdLogDir(eventLogDir: string, identity: string): string
 
 /** Clamp every file the freshly-started server/client dropped into the dir to
  *  0600 (the dir's 0700 already blocks traversal; this is the belt to that
- *  suspender — boris's acceptance criterion: no file wider than 0600). */
+ *  suspender — the acceptance criterion: no file wider than 0600). */
 export function hardenCmdLogDir(dir: string): void {
   try {
     for (const name of readdirSync(dir)) {

package/src/launch/composeSystemPrompt.ts

@@ -158,7 +158,8 @@ function renderRegistry(peers: readonly PublicPeerSummary[]): string {
 //   • Layer 4: every non-IAPEER `<DOMAIN>.md` pair at the .iapeer/ root (operator /
 //     plugin user-settings; SPAWNER_INSTRUCTIONS.md, … flow in organically).
 //   • Layer 5: every `<STEM>.md` pair in .iapeer/fragments/ (primitive-owned,
-//     machine-regenerated doctrine fragments — iapeer-memory's guide + note index).
+//     machine-regenerated doctrine fragments — e.g. a memory provider's guide +
+//     note index).
 // Each block contributes its GLOBAL half then its LOCAL half (general → specific),
 // EACH as its own marked file-section (a 0-byte / newline-only file → no section,
 // no dangling marker). Blocks are appended in the order given (the gatherer sorts

package/src/launch/index.ts

@@ -143,8 +143,8 @@ function ready(identity: string): LaunchResult {
 // Exit-cause observability — capture WHY a session's process died, AT THE MOMENT
 // of death. The daemon's 60 s supervise tick only learns of a death post-factum
 // (reaped-gone), by which time the exit code/signal — and often the whole tmux
-// server — is gone (the boris-fresh-style blind spot one level deeper than the
-// supervise log). A tmux `pane-died` hook closes it: it fires the instant the
+// server — is gone (a blind spot one level deeper than the supervise log). A
+// tmux `pane-died` hook closes it: it fires the instant the
 // pane's leader process exits (with `remain-on-exit on` retaining the dead pane so
 // `#{pane_dead_status}`/`#{pane_dead_signal}` are populated), logs one logfmt line,
 // then kill-sessions the now-dead pane so the daemon's `has-session` death
@@ -394,14 +394,13 @@ export const launch: LaunchFn = async (
   //     `run-shell -b -d <maxAgeSecs>` → `kill-session`, intended to bound a zombie
   //     even if no supervise sweep runs. It was a BLIND wall-clock kill armed ONCE
   //     at birth and never re-armed, so it guillotined HEALTHY long-lived sessions
-  //     at exactly birth+maxAge (4 h) — the recurrent boris/iapeer "mystery deaths".
+  //     at exactly birth+maxAge (4 h) — the recurrent "mystery deaths".
   //     By construction any session that survives to maxAge is active: idle ones are
   //     already idle-reaped at idleSecs (1 h) by the activity-aware supervisor — so
   //     the blind kill could ONLY ever destroy live work (its sole "useful" case,
   //     daemon dead the whole interval, leaves an inert orphan nothing can deliver
   //     to, self-healed by idle-reap on daemon restart). The activity-aware idle-reap
-  //     (superviseTick) is now the SOLE lifecycle bound. See ADR «миграция …» / vault
-  //     note «Четырёхчасовой TTL-backstop …». (alwaysOn infra never armed it.)
+  //     (superviseTick) is now the SOLE lifecycle bound. (alwaysOn infra never armed it.)
 
   // (5) Router runtime (telegram): no TUI input surface — there is no boot dialog
   //     and no ready marker to gate on. The process is up; return READY.
@@ -488,7 +487,7 @@ export const launch: LaunchFn = async (
     }
   }
   if (!delivered) {
-    // Surface WHAT the pane showed when the gate gave up — the 12.06 codex-resume
+    // Surface WHAT the pane showed when the gate gave up — a codex-resume
     // incident (splash scrolled off, composer ready, predicate false for 240 s) was
     // undiagnosable from the bare reason alone. Last two non-empty lines, quotes
     // flattened (the reason lands inside a logfmt-quoted err field), clipped.

package/src/launch/invocation.ts

@@ -50,7 +50,7 @@ export function buildLaunchInvocation(
     PEER_PERSONALITY: spec.personality,
     PEER_RUNTIME: spec.runtime,
     PEER_IDENTITY: spec.identity,
-    PATH: env.PATH ?? `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/usr/bin:/bin`,
+    PATH: env.PATH ?? `${homedir()}/.bun/bin:${homedir()}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin`,
   }
   // Strip the claude-code-internal session namespace from the inherited env. When a launch is
   // INITIATED from inside a running claude session (an operator CLI, or a claude peer shelling out),