@agfpd/iapeer 0.4.1 → 0.4.2

package/docs/07-install-and-update.md

@@ -47,25 +47,32 @@ You'll see the core version, the daemon's health, and the memory-slot state. The
 
 A breakdown of each onboard step is in [02 — Quick start](02-quickstart.md); runtimes and memory in detail — in [09](09-runtimes.md) and [11](11-extensions-and-memory.md).
 
-## Updating the core
+## Updating
 
 ```bash
-iapeer update            # to the latest version
-iapeer update 0.2.80     # to a specific version
-iapeer update --force    # reinstall even if the version is already in place
+iapeer update                   # cascade-update the WHOLE stack: core + runtimes + memory
+iapeer update --foundation-only # update just the core
+iapeer update 0.2.80            # pin the CORE to a specific version (core only)
+iapeer update --force           # reinstall even if the version is already in place
 ```
 
-An update pulls the core version from npm and restarts the daemon onto it. Step by step:
+A bare `iapeer update` updates the **whole host stack** in one command — the core (foundation), every installed runtime, and the memory provider — so "updated" means the whole machine, not just the core. The core goes first; the runtimes and memory follow only if the core came up healthy.
+
+**1. Core (foundation)** — and it ABORTS the cascade on a hard failure (never update runtimes onto a broken core):
 
 1. Learns the target version from npm. If the installed one already matches and there's no `--force` — it does nothing.
-2. Downloads and builds the new binary. This is done via `npm pack`, not `npx`: the binary doesn't rebuild itself.
+2. Downloads and builds the new binary via `npm pack`, not `npx` (the binary doesn't rebuild itself).
 3. Restarts the daemon onto the new binary.
-4. Restarts the infrastructure launchd jobs the core owns (`com.iapeer.*` — the `timer`, `watcher`, Telegram routers), moving them onto the just-replaced binary. Their plists launch the same core binary as the daemon — without a restart a job would stay on the old code. It's the job that's restarted (booted out and back in); the runtimes' **package code** (telegram-runtime, notifier-runtime) is not updated by this — that's the separate `update-runtime` operation. The memory provider (`iapeer-memory`) and ordinary peers' plists aren't touched at all. If the daemon didn't come up in step 3, this step is skipped — no point moving jobs onto a binary the daemon didn't revive on.
-5. Verifies the daemon actually came up healthy — not by the restart command exiting successfully, but by a probe: it connects to the daemon's socket (the one the daemon opens right before the readiness signal). The daemon counts as healthy only when the socket accepts a connection **twice in a row** — a single probe would also pass for a daemon that bound the socket and immediately crashed. The check is given 15 seconds; if a run of successful probes doesn't accumulate in that time, the command says so directly and advises rolling back.
+4. Restarts the infrastructure launchd jobs the core owns (`com.iapeer.*` — the `timer`, `watcher`, Telegram routers), moving them onto the just-replaced binary. It's the JOBS that restart, not the runtimes' package code — that's the next step. If the daemon didn't come up in step 3, this is skipped.
+5. Verifies the daemon came up healthy — by a probe, not by the restart command exiting: it connects to the daemon's socket and counts it healthy only when it accepts a connection **twice in a row** (a single probe would also pass a daemon that bound the socket and immediately crashed). The check is given 15 seconds; on failure the command says so and advises rolling back.
+
+**2. Runtimes** — each installed runtime package (telegram-runtime, notifier-runtime) is version-gated, re-installed, re-provisioned, and its peers restarted (via the regular stop/start — the persistent-peer fleet is refused, never forced).
+
+**3. Memory provider** — if a provider is claimed, its own update verb runs (the provider owns its update, its slot version, and its memory-daemon restart).
 
-An update touches **only the core**. The daemon plist and third-party packages stay as they are.
+Runtimes and memory are **best-effort**: a component failure is reported and the rest still run; the command exits non-zero if anything failed. Agentic peers (Claude/Codex) pick up new core doctrine lazily on their next wake.
 
-Naming a specific version (`iapeer update <version>`) is useful when you need to roll back deeper than one step, or pin a proven version.
+`iapeer update --foundation-only` does just step 1 (the narrow case). A pinned `iapeer update <version>` is **core-only** by design — a version pin is core-specific (downgrade, or pin a proven version, deeper than one rollback step).
 
 ## Rollback
 

package/docs/ru/07-/321/203/321/201/321/202/320/260/320/275/320/276/320/262/320/272/320/260-/320/270-/320/276/320/261/320/275/320/276/320/262/320/273/320/265/320/275/320/270/320/265.md

@@ -47,25 +47,32 @@ iapeer status
 
 Разбор каждого шага onboard — в [02 — Быстрый старт](02-быстрый-старт.md); рантаймы и память подробно — в [09](09-рантаймы.md) и [11](11-расширения-и-память.md).
 
-## Обновление ядра
+## Обновление
 
 ```bash
-iapeer update            # до последней версии
-iapeer update 0.2.80     # до конкретной версии
-iapeer update --force    # переустановить, даже если версия уже стоит
+iapeer update                   # каскад: обновить ВЕСЬ стек — ядро + рантаймы + память
+iapeer update --foundation-only # обновить только ядро
+iapeer update 0.2.80            # запинить ЯДРО на конкретную версию (только ядро)
+iapeer update --force           # переустановить, даже если версия уже стоит
 ```
 
-Обновление тянет версию ядра из npm и перезапускает демон на неё. По шагам:
+Голый `iapeer update` обновляет **весь хостовый стек** одной командой — ядро (фундамент), каждый установленный рантайм и провайдер памяти, — чтобы «обновлено» значило всю машину, а не только ядро. Ядро идёт первым; рантаймы и память следуют, только если ядро поднялось здоровым.
+
+**1. Ядро (фундамент)** — и оно ПРЕРЫВАЕТ каскад при жёсткой ошибке (не обновлять рантаймы на сломанное ядро):
 
 1. Узнаёт нужную версию из npm. Если установленная уже совпадает и нет `--force` — ничего не делает.
-2. Скачивает и собирает новый бинарь. Это делается через `npm pack`, а не `npx`: бинарь не пересобирает себя сам.
+2. Скачивает и собирает новый бинарь через `npm pack`, а не `npx` (бинарь не пересобирает себя сам).
 3. Перезапускает демон на новый бинарь.
-4. Перезапускает launchd-джобы инфраструктуры, которыми владеет ядро (`com.iapeer.*` — роутеры `timer`, `watcher`, Telegram), переводя их на только что заменённый бинарь. Их плисты запускают тот же бинарь ядра, что и демон, — без перезапуска джоб остался бы на старом коде. Перезапускается именно джоб (снимается и поднимается заново); **пакетный код** рантаймов (telegram-runtime, notifier-runtime) при этом не обновляется — это отдельная операция `update-runtime`. Провайдер памяти (`iapeer-memory`) и плисты обычных пиров не трогаются вовсе. Если демон на шаге 3 не поднялся, этот шаг пропускается — нет смысла переводить джобы на бинарь, на котором демон не ожил.
-5. Проверяет, что демон действительно поднялся здоровым, — не по тому, что команда перезапуска завершилась успешно, а пробой: подключается к сокету демона (тому самому, что демон открывает прямо перед сигналом готовности). Здоровым демон считается, только когда сокет принимает соединение **дважды подряд** — одиночная проба прошла бы и у демона, который привязал сокет и тут же упал. На проверку отведено 15 секунд; если за это время серия успешных проб не набралась — команда говорит об этом прямо и советует откатиться.
+4. Перезапускает launchd-джобы инфраструктуры, которыми владеет ядро (`com.iapeer.*` — роутеры `timer`, `watcher`, Telegram), переводя их на заменённый бинарь. Перезапускаются именно ДЖОБЫ, а не пакетный код рантаймов — это следующий шаг. Если демон на шаге 3 не поднялся, шаг пропускается.
+5. Проверяет, что демон поднялся здоровым, — пробой, а не кодом возврата команды перезапуска: подключается к сокету демона и считает здоровым, только когда тот принимает соединение **дважды подряд** (одиночная проба прошла бы и у демона, который привязал сокет и тут же упал). На проверку 15 секунд; при провале команда говорит и советует откатиться.
+
+**2. Рантаймы** — каждый установленный рантайм-пакет (telegram-runtime, notifier-runtime) проходит version-gate, переустановку, ре-провижн, и его пиры перезапускаются (через обычный stop/start — флот persistent-peer отклоняется, не форсится).
+
+**3. Провайдер памяти** — если слот занят, запускается его собственный update-verb (провайдер владеет своим обновлением, версией слота и перезапуском memory-демона).
 
-Обновление трогает **только ядро**. Плист демона и сторонние пакеты остаются как есть.
+Рантаймы и память — **best-effort**: ошибка компонента сообщается, остальные всё равно отрабатывают; код возврата ненулевой, если что-то упало. Агентские пиры (Claude/Codex) подхватывают новую доктрину ядра лениво на следующем пробуждении.
 
-Указать конкретную версию (`iapeer update <версия>`) полезно, когда нужно откатиться глубже, чем на один шаг назад, или встать на проверенную версию.
+`iapeer update --foundation-only` делает только шаг 1 (узкий случай). Запиненный `iapeer update <версия>` — **только ядро** by design: пин версии специфичен для ядра (откат глубже одного шага или фиксация проверенной версии).
 
 ## Откат
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -21,7 +21,7 @@ import {
   type Runtime,
 } from '../core/constants.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
+import { cascadeTail, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaemonHealthy } from '../update/index.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
@@ -955,7 +955,10 @@ export function parseArgs(argv: string[]): { positionals: string[]; flags: Recor
  *  narrow terminal). `sig` = the invocation signature, `desc` = one prose line. */
 const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
   { sig: 'install', desc: 'build binary + global scaffold + daemon plist (one bootstrap)' },
-  { sig: 'update [version] [--force]', desc: 'pull latest (or exact) @agfpd/iapeer from npm + restart daemon + recycle owned infra jobs' },
+  {
+    sig: 'update [version] [--force] [--foundation-only]',
+    desc: 'cascade-update the WHOLE stack (foundation + installed runtimes + memory) from npm + restart; --foundation-only = core only; a pinned <version> updates the core only',
+  },
   { sig: 'rollback', desc: 'revert to the previous binary (.prev) + restart daemon + recycle owned infra jobs' },
   {
     sig: 'uninstall [--dry-run] [--yes] [--remove-codesign-identity]',
@@ -1716,49 +1719,72 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         return 0
       }
       case 'update': {
-        // The single deploy path: pull a version of the foundation from npm and restart
-        // the daemon onto it (cloud-only — never a working-tree build). No arg → latest;
-        // an explicit `update <version>` pins to that exact version (downgrade / recover
-        // deeper than the single .prev). Foundation ONLY; the plist and other host packages
-        // are untouched. --force reinstalls even when already at the desired version. (Run
-        // from the installed binary; the first-ever install is `npx @agfpd/iapeer`.)
-        const r = updateIapeer({ env, force: flags.force === true, targetVersion: positionals[0] })
+        // CASCADE deploy (FU12): a bare `iapeer update` updates the WHOLE host stack —
+        // foundation → every installed runtime → the memory provider — in one command.
+        // Foundation goes FIRST and ABORTS the cascade on a hard failure (never update
+        // runtimes onto a broken core). Runtimes + memory are BEST-EFFORT (reported, not
+        // fatal). Two narrowings stay foundation-ONLY: `--foundation-only` (explicit) and
+        // a pinned `update <version>` (a version pin is foundation-specific — downgrade /
+        // recover). H4 holds throughout (foreign persistent-peer fleet is refused, never
+        // forced — the runtime restart goes via the guarded stop/start). Cloud-only; the
+        // first-ever install is `npx @agfpd/iapeer`.
+        const pinned = positionals[0]
+        const foundationOnly = flags['foundation-only'] === true
+        const cascading = !foundationOnly && !pinned
+        if (cascading) {
+          // no-surprise heads-up: this restarts peers and can run minutes.
+          out(
+            'iapeer update — updating the WHOLE stack: foundation + installed runtimes + memory provider.\n' +
+              'This rebuilds the daemon, restarts the telegram/notifier services and the memory daemon,\n' +
+              'and can take a few minutes; agentic peers pick up the new code on their next wake.\n' +
+              '(`iapeer update --foundation-only` updates just the core.)\n\n',
+          )
+        }
+
+        // ── Foundation (the core; a hard failure aborts the cascade) ──
+        const r = updateIapeer({ env, force: flags.force === true, targetVersion: pinned })
+        let foundationHardFail = false
         if (r.status === 'failed') {
           errOut(`update failed: ${r.reason}\n`)
-          return 1
-        }
-        if (r.status === 'already-latest') {
-          out(`already at version ${r.from}\n`)
-          return 0
-        }
-        // 'updated': the binary is swapped. If the daemon was restarted, VERIFY it
-        // actually came back up before declaring success — a new binary that fails to
-        // boot must not read as a healthy deploy (it's the cue to roll back).
-        if (r.daemon === 'restarted') {
+          foundationHardFail = true
+        } else if (r.status === 'already-latest') {
+          out(`foundation: already at version ${r.from}\n`)
+        } else if (r.daemon === 'restarted') {
+          // 'updated' + daemon restarted: VERIFY it actually came back up (a binary that
+          // fails to boot must not read as a healthy deploy — it's the cue to roll back).
           const h = await waitForDaemonHealthy({ env })
           if (!h.healthy) {
-            errOut(`updated ${r.from} → ${r.to} but the daemon is NOT healthy after restart (${h.detail}).\n` +
-              `roll back now: iapeer rollback\n`)
-            return 1
+            errOut(`foundation: updated ${r.from} → ${r.to} but the daemon is NOT healthy after restart (${h.detail}).\nroll back now: iapeer rollback\n`)
+            foundationHardFail = true
+          } else {
+            const note = infraRecycleNote(r.infra)
+            ;(infraRecycleFailed(r.infra) ? errOut : out)(`foundation: updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
           }
+        } else {
+          const daemonNote =
+            r.daemon === 'not-loaded'
+              ? 'daemon not loaded — new binary will be used on next start'
+              : r.daemon === 'failed'
+                ? `WARNING — ${r.reason}; roll back with: iapeer rollback`
+                : String(r.daemon)
+          if (r.daemon === 'failed') foundationHardFail = true
           const note = infraRecycleNote(r.infra)
-          if (infraRecycleFailed(r.infra)) {
-            errOut(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
-            return 1
-          }
-          out(`updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
-          return 0
+          ;(r.daemon === 'failed' || infraRecycleFailed(r.infra) ? errOut : out)(`foundation: updated ${r.from} → ${r.to}; ${daemonNote}${note}\n`)
         }
-        const daemonNote =
-          r.daemon === 'not-loaded'
-            ? 'daemon not loaded — new binary will be used on next start'
-            : r.daemon === 'failed'
-              ? `WARNING — ${r.reason}; roll back with: iapeer rollback`
-              : String(r.daemon)
-        const note = infraRecycleNote(r.infra)
-        const failed = r.daemon === 'failed' || infraRecycleFailed(r.infra)
-        ;(failed ? errOut : out)(`updated ${r.from} → ${r.to}; ${daemonNote}${note}\n`)
-        return failed ? 1 : 0
+        const foundationExit = foundationHardFail || infraRecycleFailed(r.infra) ? 1 : 0
+
+        // foundation-only / pinned / hard-fail → stop here (don't cascade onto a broken core).
+        if (!cascading || foundationHardFail) return foundationExit
+
+        // ── Cascade tail: runtimes + memory provider (best-effort) ──
+        const { updateAllRuntimes } = await import('../runtime/update.ts')
+        const { updateMemoryProvider } = await import('../onboard/memory.ts')
+        const tail = await cascadeTail({
+          runtimes: () => updateAllRuntimes({ force: flags.force === true, env, warn: m => errOut(`warn: ${m}\n`) }),
+          memory: () => updateMemoryProvider({ env }),
+          out,
+        })
+        return foundationExit === 0 && !tail.failed ? 0 : 1
       }
       case 'rollback': {
         // Recovery: restore the .prev binary kept by the last install, restart the

package/src/onboard/memory.ts

@@ -144,3 +144,74 @@ export async function onboardMemoryProvider(opts: MemoryOnboardOptions = {}): Pr
   }
   return { state: 'installed', provider: after }
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// updateMemoryProvider — the memory leg of the cascade `iapeer update` (FU12)
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface MemoryUpdateResult {
+  state:
+    | 'updated' // provider update ran and the slot version advanced
+    | 'already-latest' // ran but the slot version is unchanged
+    | 'no-slot' // no provider claimed — nothing to update
+    | 'skipped-unavailable' // package not published / no network — soft skip
+    | 'failed' // provider update exited non-zero
+  package?: string
+  from?: string
+  to?: string
+  detail?: string
+}
+
+/** The provider's CLI bin name = the unscoped package name (`@agfpd/iapeer-memory` →
+ *  `iapeer-memory`). */
+function memoryBinName(pkg: string): string {
+  return pkg.replace(/^@[^/]+\//, '')
+}
+
+function defaultRunMemoryUpdate(pkg: string, env: NodeJS.ProcessEnv): { status: number | null; unavailable: boolean } {
+  // Availability probe FIRST (cheap, bounded): unpublished / no network → soft-skip.
+  const probe = spawnSync('npm', ['view', `${pkg}@latest`, 'version'], { encoding: 'utf8', env, timeout: 60_000 })
+  if (probe.status !== 0) return { status: probe.status, unavailable: true }
+  // The provider ships a COMPILED bin on PATH (~/.local/bin/<bin>), NOT an npm package,
+  // so a bare `npx <bin>` / `npx <pkg>@latest` re-runs the STALE installed binary —
+  // verified by the provider: it reports the OLD version, "running FROM the installed
+  // binary", a SILENT non-update (fatal for the upgrade case). `npm exec
+  // --package=<pkg>@latest -- <bin> update` fetches latest + rebuilds, bypassing the PATH
+  // name-shadow. The provider OWNS update + slot-write + its own daemon (memoryd) restart.
+  const r = spawnSync(
+    'npm',
+    ['exec', '--yes', `--package=${pkg}@latest`, '--', memoryBinName(pkg), 'update'],
+    { stdio: 'inherit', env },
+  )
+  return { status: r.status, unavailable: false }
+}
+
+/**
+ * Update the CLAIMED memory provider via ITS OWN npx update verb (slot contract: the
+ * provider owns install/update + slot-write + peer restart; the core only invokes +
+ * reads the slot). No slot → nothing to update. Reports from→to by reading the slot
+ * version before/after. BEST-EFFORT by the caller (the cascade never aborts on it).
+ */
+export function updateMemoryProvider(opts: {
+  env?: NodeJS.ProcessEnv
+  dryRun?: boolean
+  runUpdate?: (pkg: string, env: NodeJS.ProcessEnv) => { status: number | null; unavailable: boolean }
+} = {}): MemoryUpdateResult {
+  const env = opts.env ?? process.env
+  const slot = readMemoryProvider(env)
+  if (!slot) return { state: 'no-slot', detail: 'no memory provider claimed — nothing to update' }
+  const pkg = slot.package
+  const from = slot.version
+  if (opts.dryRun) {
+    return { state: 'updated', package: pkg, from, detail: `would run: npm exec --package=${pkg}@latest -- ${memoryBinName(pkg)} update` }
+  }
+  const run = opts.runUpdate ?? defaultRunMemoryUpdate
+  const r = run(pkg, env)
+  if (r.unavailable) {
+    return { state: 'skipped-unavailable', package: pkg, from, detail: `${pkg}@latest not reachable (no network / unpublished)` }
+  }
+  if (r.status !== 0) return { state: 'failed', package: pkg, from, detail: `provider update exited ${r.status ?? 'null'}` }
+  const to = readMemoryProvider(env)?.version
+  if (from && to && from === to) return { state: 'already-latest', package: pkg, from, to }
+  return { state: 'updated', package: pkg, from, to }
+}

package/src/update/index.ts

@@ -1,8 +1,13 @@
-// `iapeer update` — the SINGLE deploy path: pull the latest published foundation
-// from npm (the cloud) and restart the daemon onto it. There is deliberately NO
-// "deploy from a working tree" — every host, including the dev host, activates a
+// `updateIapeer` — the FOUNDATION leg of the deploy: pull the latest published
+// foundation from npm (the cloud) and restart the daemon onto it. There is deliberately
+// NO "deploy from a working tree" — every host, including the dev host, activates a
 // release the same way: `npm run release` (publish) → `iapeer update` (pull + restart).
 //
+// NB the `iapeer update` VERB cascades the whole stack (FU12): it runs this foundation
+// leg FIRST (aborting on a hard failure), then `updateAllRuntimes` + the memory provider
+// (best-effort) via cascadeTail (below). updateIapeer itself stays foundation-scoped —
+// the cascade is composed in the CLI verb.
+//
 // Flow:
 //   1. latest = `npm view @agfpd/iapeer version`           (the cloud's truth)
 //   2. installed == latest && !--force → "already latest"  (no needless rebuild/restart)
@@ -43,6 +48,10 @@ import {
 } from '../launch/launchd.ts'
 import { cycleShadowJob, SHADOW_PERSONALITY, SHADOW_PLIST_LABEL } from '../shadow/install.ts'
 import { defaultDaemonSocketPath } from '../daemon/index.ts'
+// Type-only (erased at runtime → no import cycle): the cascade tail renders these
+// shapes but receives the component-updaters as injected deps.
+import type { UpdateRuntimeResult } from '../runtime/update.ts'
+import type { MemoryUpdateResult } from '../onboard/memory.ts'
 
 /** The npm package the foundation publishes / updates from. */
 export const IAPEER_PACKAGE = '@agfpd/iapeer'
@@ -316,3 +325,42 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
     reason: d.state === 'failed' ? `binary updated but daemon restart failed: ${d.detail ?? ''}`.trim() : undefined,
   }
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// cascadeTail — the runtimes + memory legs of the cascade `iapeer update` (FU12).
+// Runs AFTER a healthy foundation update (the CLI owns that, abort-on-hard-fail);
+// here we update every installed runtime then the memory provider, BEST-EFFORT — a
+// component failure is reported, never aborts the rest. Pure orchestration over
+// injected component-updaters (no value-import of runtime/onboard → no cycle), so it
+// is hermetically testable. Returns whether anything failed (→ exit≠0).
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface CascadeTailDeps {
+  /** = updateAllRuntimes (runtime/update.ts). */
+  runtimes: () => Promise<UpdateRuntimeResult[]>
+  /** = updateMemoryProvider (onboard/memory.ts). */
+  memory: () => MemoryUpdateResult | Promise<MemoryUpdateResult>
+  out: (s: string) => void
+}
+
+export async function cascadeTail(deps: CascadeTailDeps): Promise<{ failed: boolean }> {
+  let failed = false
+
+  deps.out('runtimes:\n')
+  const rs = await deps.runtimes()
+  if (rs.length === 0) deps.out('  (none installed)\n')
+  for (const r of rs) {
+    const ver = r.from || r.to ? ` ${r.from ?? '?'} → ${r.to ?? '?'}` : ''
+    deps.out(`  ${r.runtime}: ${r.state}${ver}${r.detail ? ` — ${r.detail}` : ''}\n`)
+    for (const p of r.restarted) deps.out(`    restart ${p.personality}: ${p.state}${p.detail ? ` — ${p.detail}` : ''}\n`)
+    if (r.state === 'install-failed' || r.state === 'deploy-failed' || r.state === 'npm-unreachable') failed = true
+    if (r.restarted.some(p => p.state === 'failed')) failed = true
+  }
+
+  const m = await deps.memory()
+  const mver = m.from || m.to ? ` ${m.from ?? '?'} → ${m.to ?? '?'}` : ''
+  deps.out(`memory: ${m.state}${m.package ? ` (${m.package}${mver})` : ''}${m.detail ? ` — ${m.detail}` : ''}\n`)
+  if (m.state === 'failed') failed = true
+
+  return { failed }
+}