@agfpd/iapeer 0.4.105 → 0.4.107

package/docs/09-runtimes.md

@@ -56,7 +56,20 @@ iapeer add-runtime codex --peer assistant   # for one peer
 iapeer add-runtime codex --all              # for all peers
 ```
 
-Adds an agent runtime to existing peers: appends it to `runtimes`, scaffolds the runtime space, and does the full Codex setup (pre-trusting the folder, the native-memory lever, attaching memory, MCP). The command **doesn't touch** `default_runtime` — this is extending options, not changing routing. Idempotent. Infrastructure peers are skipped: giving them an agent runtime is an operator decision via `create`, not a bulk operation.
+Adds a runtime to existing peers: appends it to `runtimes`, scaffolds the runtime space, and does the full Codex setup (pre-trusting the folder, the native-memory lever, attaching memory, MCP). The command **doesn't touch** `default_runtime` — this is extending options, not changing routing. Idempotent. A peer whose default is infrastructure is skipped when the runtime being added is an *agent* one: giving a router peer an agent runtime is an operator decision via `create`, not a bulk operation.
+
+An **infrastructure** runtime can also be added this way, but only to one named peer:
+
+```bash
+iapeer add-runtime voicetalk --peer arthur   # attach a second always-on channel
+iapeer connect voicetalk arthur              # the same thing, said the way `connect` taught you
+```
+
+This is the operator path for the multi-channel scheme above — giving an *existing* personality another always-on presence. It resolves the peer's folder from the registry, installs the per-runtime plist, runs the runtime package's own `selfConfig` hook (which owns `interfaces.<runtime>`), and loads the job. `--all` is refused for an infrastructure runtime: every channel is a launchd job, and fanning them across the fleet is never what an operator means.
+
+`create` cannot do this. It resolves a peer by **location** (`~/.iapeer/peers/<name>` unless `--path` is given), so for a peer whose folder lives elsewhere it never reaches the existing record — it would scaffold a second, bogus folder instead.
+
+Declaration and reality can diverge: `runtimes` only *declares* the channel, the plist *realizes* it. If the record declares the runtime but the plist is gone, the command re-provisions it rather than reporting "already" for a channel that does not exist.
 
 ### default-runtime — switch the primary
 
@@ -69,7 +82,7 @@ Switches the primary runtime — where routing goes and which runtime comes up f
 
 The routing choice is strict: a send without an explicit `runtime` always targets `default_runtime`. A live session on another declared runtime does not capture that send; if the default session is asleep, the daemon wakes it. Passing `runtime` explicitly remains the way to target a non-default surface.
 
-## Connecting Telegram: connect
+## Connecting a channel: connect
 
 ```bash
 iapeer connect telegram assistant --token <bot-token>
@@ -79,6 +92,8 @@ Connects a Telegram bot to a peer in one pass: registers the bot, writes it into
 
 The command is idempotent, and behavior depends on the token. **The same token** is a clean no-op: the bot's credentials file doesn't change, the live router already runs on these credentials, no restart. **A new or changed token** requires a router restart (credentials are read only at start) — a second's pause in delivery for all Telegram peers; inbound messages aren't lost (long-polling remembers the offset, Telegram holds messages for up to 24 hours). An invalid token is rejected at once, with the verbatim reason from Telegram.
 
+`connect` is not Telegram-only. `iapeer connect <runtime> <peer>` attaches any presence channel: Telegram keeps its bespoke flow (it owes a bot token, a `@BotFather` round-trip and a credential store), while every other infrastructure runtime takes the generic bind — the same per-peer path as `add-runtime <runtime> --peer <peer>`. The runtime package must be installed on the host first (`install-runtime`), which the command checks before touching anything.
+
 ## Runtime packages
 
 Infrastructure runtimes ship as separate npm packages (`*-runtime`). The core installs and updates them:

package/docs/12-cli-reference.md

@@ -49,7 +49,7 @@ The full list of `iapeer <command>`. General rules: `--help` / `-h` anywhere in
 | `attach <peer> [runtime]` | Bring up (if asleep), resume the conversation, open the session under the supervisor in the terminal (detach — `Ctrl-]`). |
 | `interrupt <peer> [runtime]` | Interrupt the current turn (Escape), context intact. |
 | `compact <peer> [runtime]` | Compact the conversation; a sleeper is resumed first after idle sleep. |
-| `add-runtime <runtime> (--peer <p> \| --all)` | Add an agent runtime to existing peers. Doesn't touch `default_runtime`. |
+| `add-runtime <runtime> (--peer <p> \| --all)` | Add a runtime to existing peers. Doesn't touch `default_runtime`. An infrastructure runtime attaches an always-on channel and is `--peer`-only (never an `--all` sweep). |
 | `default-runtime <runtime> (--peer <p> \| --all)` | Switch the primary runtime (routing / first bring-up). Refuses if the runtime isn't declared. |
 
 `stop`/`start`/`new` refuse to touch peers under a foreign launchd plist — the core doesn't intervene in what it doesn't manage.
@@ -69,6 +69,7 @@ The full list of `iapeer <command>`. General rules: `--help` / `-h` anywhere in
 |---|---|
 | `<runtime>` (e.g. `iapeer claude`) | Launch the current folder's peer on this runtime — always as a fresh session. |
 | `connect telegram <peer> [--token <t>]` | Connect a Telegram bot to a peer: register the bot → write into the profile → restart the router. Asks only for the token. |
+| `connect <runtime> <peer>` | Attach any other presence channel (web, voicetalk, …) to an existing peer: per-runtime plist → the package's `selfConfig` hook → load. Same path as `add-runtime <runtime> --peer <peer>`. |
 
 ## Extensions and memory
 

package/docs/14-configuration-and-logs.md

@@ -63,6 +63,8 @@ The daemon's supervisory tick is fixed — once a minute, not configurable.
 | `IAPEER_DELIVERY_LOG_KEEP` | `5` | How many `delivery.log` rotations to keep. |
 | `IAPEER_PANELOG_MAX_BYTES` | `16 MiB` | The per-peer pane-log (`logs/lifecycle/<runtime>-<peer>.log`, the raw terminal byte stream) size at which rotation happens. |
 | `IAPEER_PANELOG_KEEP` | `2` | How many rotated pane-log copies to keep (`<log>.1` newest … `.N`). |
+| `IAPEER_PANELOG_DIR_BUDGET` | `512 MiB` | The retention ceiling on the WHOLE `logs/lifecycle/` directory — the bound that does not grow with the fleet. |
+| `IAPEER_PANELOG_STALE_DAYS` | `14` | Age after which a pane-log artifact (base or copy) is reclaimed — this is what frees the logs of dead/removed peers. |
 | `IAPEER_SUPERVISE_LOG_VERBOSE` | off | A verbose log of supervisory ticks (by default only decisions are written, not routine "doing nothing"). |
 | `IAPEER_DAEMON_LOG` | off | An extended daemon log. |
 
@@ -84,6 +86,14 @@ The daemon keeps three durable logs in `~/.iapeer/logs/iapeer/`:
 
 Per-peer **pane-logs** live separately under `~/.iapeer/logs/lifecycle/<runtime>-<peer>.log` — the raw terminal (pty) byte stream the supervisor appends for a session's whole life (occupancy/typing detection, the boot ready-gate, and `tail`-based monitors read them). They are rotated on the supervise tick by **copytruncate** (`IAPEER_PANELOG_MAX_BYTES` × `IAPEER_PANELOG_KEEP`, default 16 MiB × 2): the base file keeps its path and inode (its last 8 MiB tail is retained in place, so the live writer and every reader are undisturbed) while the preceding window is promoted to `<log>.1` … `.N`. Total per peer is bounded by roughly `MAX_BYTES × (KEEP + 1)`.
 
+That per-file bound alone is a *per-peer* one, so the directory total was still a product of the fleet size (peers × runtimes) and nothing ever reclaimed the artifacts of a peer that had died or been removed. The same supervise tick therefore also runs a **retention** pass over the directory, reclaiming in cheapest-loss-first order:
+
+1. **Age** — every artifact (base or copy) untouched for longer than `IAPEER_PANELOG_STALE_DAYS` (14 d) is deleted. Nothing live reads a base that cold — idle-reap ends a warm session in minutes, and only a *current* session's base feeds the ready-gate seed and the mtime-occupancy signal — so this is what finally frees dead, removed, and renamed peers. The supervisor recreates the file on the next wake.
+2. **Budget / copies** — while the directory exceeds `IAPEER_PANELOG_DIR_BUDGET` (512 MiB), rotated copies are deleted oldest-first. They are history nobody reads live, so they are the correct first casualty.
+3. **Budget / backstop** — if the copies run out and the directory is still over budget, the largest bases are shrunk in place to the 8 MiB reader-floor, inode *and mtime* preserved (a janitor write must never masquerade as peer activity in the occupancy contract).
+
+The floor of step 3 is `live-identities × 8 MiB`, so the budget is authoritative up to roughly 64 concurrently warm identities at the defaults; past that the reader-floor deliberately outranks the budget (truncating below the seed window would starve occupancy/ready-gate detection) and the pass records `outcome=over-budget-after-gc` in `lifecycle.log`, where raising `IAPEER_PANELOG_DIR_BUDGET` is the remedy. Every pass that reclaims anything leaves an `action=panelog-gc` line with the before/after megabytes. The whole pass is idempotent and best-effort by construction: it runs on each tick and never fails one.
+
 ### Postmortem diagnostics
 
 The cause of a session's death (exit code / signal) the supervisor records at the moment of death to `exits.log` — what an ordinary "is the process alive" check misses. It's the material for answering "why did the agent die".

package/docs/ru/09-/321/200/320/260/320/275/321/202/320/260/320/271/320/274/321/213.md

@@ -56,7 +56,20 @@ iapeer add-runtime codex --peer assistant   # одному пиру
 iapeer add-runtime codex --all              # всем пирам
 ```
 
-Добавляет агентский рантайм существующим пирам: дописывает его в `runtimes`, разворачивает пространство рантайма и проводит полную настройку для Codex (предварительное доверие к папке, рычаг родной памяти, подключение памяти, MCP). `default_runtime` команда **не трогает** — это расширение возможностей, не смена маршрутизации. Идемпотентна. Инфраструктурные пиры пропускаются: добавить им агентский рантайм — решение оператора через `create`, а не массовая операция.
+Добавляет рантайм существующим пирам: дописывает его в `runtimes`, разворачивает пространство рантайма и проводит полную настройку для Codex (предварительное доверие к папке, рычаг родной памяти, подключение памяти, MCP). `default_runtime` команда **не трогает** — это расширение возможностей, не смена маршрутизации. Идемпотентна. Пир с инфраструктурным дефолтом пропускается, когда добавляется *агентский* рантайм: дать роутер-пиру агентский рантайм — решение оператора через `create`, а не массовая операция.
+
+**Инфраструктурный** рантайм тоже добавляется этой командой, но только одному названному пиру:
+
+```bash
+iapeer add-runtime voicetalk --peer arthur   # прицепить второй always-on канал
+iapeer connect voicetalk arthur              # то же самое в привычной по connect форме
+```
+
+Это операторский путь для описанной выше мультиканальной схемы — дать *существующей* личности ещё одно постоянное присутствие. Команда резолвит папку пира из реестра, ставит пер-рантаймовый плист, вызывает собственный хук `selfConfig` рантайм-пакета (он владеет `interfaces.<рантайм>`) и загружает job. `--all` для инфраструктурного рантайма отвергается: каждый канал — это launchd-job, и разворачивать их по всему флоту оператор не имеет в виду никогда.
+
+`create` так не умеет. Он резолвит пира по **расположению** (`~/.iapeer/peers/<имя>`, если не передан `--path`), поэтому до записи пира, чья папка лежит в другом месте, не дотягивается вовсе — вместо этого создал бы вторую, ложную папку.
+
+Объявление и реальность расходятся: `runtimes` только *объявляет* канал, а *реализует* его плист. Если запись рантайм объявляет, а плиста нет — команда переставляет канал, а не рапортует «already» о канале, которого не существует.
 
 ### default-runtime — переключить основной
 
@@ -69,7 +82,7 @@ iapeer default-runtime codex --all              # все пиры
 
 Выбор для маршрутизации строгий: отправка без явного `runtime` всегда целится в `default_runtime`. Живая сессия на другом объявленном рантайме не перехватывает такую отправку; если дефолтная сессия спит, демон будит её. Явный `runtime` по-прежнему выбирает конкретную недефолтную поверхность.
 
-## Подключение Telegram: connect
+## Подключение канала: connect
 
 ```bash
 iapeer connect telegram assistant --token <токен-бота>
@@ -79,6 +92,8 @@ iapeer connect telegram assistant --token <токен-бота>
 
 Команда идемпотентна, и поведение зависит от токена. **Тот же токен** — чистый no-op: файл учётных данных бота не меняется, живой роутер уже работает на этих данных, перезапуска нет. **Новый или изменённый токен** требует перезапуска роутера (учётные данные читаются только при старте) — это секундная пауза в доставке для всех Telegram-пиров; входящие при этом не теряются (long-polling помнит смещение, Telegram держит сообщения до 24 часов). Неверный токен отсекается сразу, с дословной причиной от Telegram.
 
+`connect` не только про Telegram. `iapeer connect <рантайм> <пир>` цепляет любой presence-канал: у Telegram остаётся его особый поток (нужны токен, поход к `@BotFather` и хранилище учётных данных), а любой другой инфраструктурный рантайм идёт по генеричной привязке — тот же пер-пировый путь, что и `add-runtime <рантайм> --peer <пир>`. Рантайм-пакет должен быть предварительно установлен на хосте (`install-runtime`); команда проверяет это до того, как что-либо тронуть.
+
 ## Рантайм-пакеты
 
 Инфраструктурные рантаймы поставляются отдельными npm-пакетами (`*-runtime`). Ставит и обновляет их ядро:

package/docs/ru/12-cli-reference.md

@@ -49,7 +49,7 @@
 | `attach <пир> [рантайм]` | Поднять (если спит), продолжить диалог, открыть сессию под супервизором в терминале (отсоединиться — `Ctrl-]`). |
 | `interrupt <пир> [рантайм]` | Прервать текущий ход (Escape), контекст цел. |
 | `compact <пир> [рантайм]` | Сжать диалог; спящего после усыпления сначала продолжить. |
-| `add-runtime <рантайм> (--peer <p> \| --all)` | Добавить агентский рантайм существующим пирам. `default_runtime` не трогает. |
+| `add-runtime <рантайм> (--peer <p> \| --all)` | Добавить рантайм существующим пирам. `default_runtime` не трогает. Инфраструктурный рантайм цепляет always-on канал и работает только с `--peer` (никогда не сметает `--all`). |
 | `default-runtime <рантайм> (--peer <p> \| --all)` | Переключить основной рантайм (маршрутизация/первый подъём). Откажет, если рантайм не объявлен. |
 
 `stop`/`start`/`new` отказываются трогать пиров под чужим launchd-плистом — ядро не вмешивается в то, чем управляет не оно.
@@ -69,6 +69,7 @@
 |---|---|
 | `<рантайм>` (например `iapeer claude`) | Запустить пир текущей папки в этом рантайме — всегда свежей сессией. |
 | `connect telegram <пир> [--token <t>]` | Подключить Telegram-бота к пиру: регистрация бота → запись в профиль → перезапуск роутера. Спрашивает только токен. |
+| `connect <рантайм> <пир>` | Прицепить любой другой presence-канал (web, voicetalk, …) существующему пиру: пер-рантаймовый плист → хук `selfConfig` пакета → загрузка. Тот же путь, что `add-runtime <рантайм> --peer <пир>`. |
 
 ## Расширения и память
 

package/docs/ru/14-/320/272/320/276/320/275/321/204/320/270/320/263/321/203/321/200/320/260/321/206/320/270/321/217-/320/270-/320/266/321/203/321/200/320/275/320/260/320/273/321/213.md

@@ -63,6 +63,8 @@
 | `IAPEER_DELIVERY_LOG_KEEP` | `5` | Сколько ротаций `delivery.log` хранить. |
 | `IAPEER_PANELOG_MAX_BYTES` | `16 МиБ` | Размер пер-пирового pane-лога (`logs/lifecycle/<runtime>-<peer>.log`, сырой байтовый поток терминала), при котором происходит ротация. |
 | `IAPEER_PANELOG_KEEP` | `2` | Сколько ротированных копий pane-лога хранить (`<log>.1` — свежайшая … `.N`). |
+| `IAPEER_PANELOG_DIR_BUDGET` | `512 МиБ` | Потолок хранения для ВСЕГО каталога `logs/lifecycle/` — граница, которая не растёт вместе с флотом. |
+| `IAPEER_PANELOG_STALE_DAYS` | `14` | Возраст, после которого артефакт pane-лога (база или копия) освобождается; именно это убирает логи мёртвых и удалённых пиров. |
 | `IAPEER_SUPERVISE_LOG_VERBOSE` | выкл. | Подробный лог надзорных тиков (по умолчанию пишутся только решения, не рутинные «ничего не делаю»). |
 | `IAPEER_DAEMON_LOG` | выкл. | Расширенный лог демона. |
 
@@ -84,6 +86,14 @@
 
 Пер-пировые **pane-логи** лежат отдельно в `~/.iapeer/logs/lifecycle/<runtime>-<peer>.log` — сырой байтовый поток терминала (pty), который супервизор дописывает всю жизнь сессии (его читают детект занятости/typing, boot ready-gate и `tail`-мониторы). Они ротируются на надзорном тике методом **copytruncate** (`IAPEER_PANELOG_MAX_BYTES` × `IAPEER_PANELOG_KEEP`, по умолчанию 16 МиБ × 2): базовый файл сохраняет путь и inode (его последние 8 МиБ остаются на месте, поэтому живой писатель и все читатели не задеты), а предшествующее окно повышается в `<log>.1` … `.N`. Суммарный объём на пира ограничен примерно `MAX_BYTES × (KEEP + 1)`.
 
+Эта пер-файловая граница действует лишь *на одного пира*, поэтому суммарный вес каталога оставался произведением размера флота (пиры × рантаймы), а артефакты умершего или удалённого пира не освобождались никогда. Поэтому тот же надзорный тик выполняет над каталогом проход **хранения (retention)**, освобождая место в порядке «сначала наименее ценное»:
+
+1. **Возраст** — любой артефакт (база или копия), не тронутый дольше `IAPEER_PANELOG_STALE_DAYS` (14 сут.), удаляется. Настолько холодную базу не читает ничто живое: idle-reap завершает тёплую сессию за минуты, а seed boot-гейта и сигнал занятости по mtime смотрят только на базу *текущей* сессии. Именно этот ярус освобождает мёртвых, удалённых и переименованных пиров; при следующем пробуждении супервизор создаёт файл заново.
+2. **Бюджет / копии** — пока каталог превышает `IAPEER_PANELOG_DIR_BUDGET` (512 МиБ), ротированные копии удаляются начиная с самых старых. Это история, которую никто не читает живьём, — верная первая жертва.
+3. **Бюджет / страховка** — если копии кончились, а каталог всё ещё сверх бюджета, крупнейшие базы усекаются на месте до читательского пола в 8 МиБ с сохранением inode *и mtime* (запись уборщика не должна выдавать себя за активность пира в контракте занятости).
+
+Пол яруса 3 равен `живые_идентичности × 8 МиБ`, поэтому на умолчаниях бюджет авторитетен примерно до 64 одновременно тёплых идентичностей; дальше читательский пол намеренно перевешивает бюджет (усечение ниже seed-окна лишило бы детект занятости и boot-гейт данных), проход пишет в `lifecycle.log` строку с `outcome=over-budget-after-gc`, и лечится это повышением `IAPEER_PANELOG_DIR_BUDGET`. Каждый проход, что-либо освободивший, оставляет строку `action=panelog-gc` с мегабайтами до и после. Проход идемпотентен и best-effort по построению: выполняется на каждом тике и никогда его не роняет.
+
 ### Посмертная диагностика
 
 Причину смерти сессии (код выхода / сигнал) супервизор фиксирует в момент смерти в `exits.log` — это то, что обычная проверка «жив ли процесс» не ловит. Это материал для ответа на вопрос «почему агент умер».

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.105",
+  "version": "0.4.107",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -15,6 +15,7 @@ import { existsSync, readFileSync, renameSync, rmSync } from 'fs'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import {
+  INFRA_RUNTIME_LIST,
   isInfraRuntime,
   isRuntime,
   type Intelligence,
@@ -53,6 +54,7 @@ import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import {
+  bootstrapFailed,
   cycleDaemon,
   existingAlwaysOnPlists,
   launchctlBootstrap,
@@ -195,7 +197,7 @@ export function formatListTable(rows: PeerListing[]): string {
 export interface StopStartOutcome {
   personality: string
   runtime: Runtime
-  action: 'stopped' | 'started' | 'bootout' | 'bootstrap' | 'refused-foreign-launchd'
+  action: 'stopped' | 'started' | 'bootout' | 'bootstrap' | 'refused-foreign-launchd' | 'no-plist'
   reason?: string
 }
 
@@ -320,6 +322,18 @@ export function startPeer(personality: string, runtime: string | undefined, opts
       // every attempt is LOUD with the manual rescue recipe. (Also gains the
       // sentinel fleet-guard + sandbox guard the raw spawn never had.)
       const r = launchctlBootstrap(personality, plist, env)
+      // NO PLIST ≠ FOREIGN PLIST. The peer declares this infra runtime but no always-on
+      // plist was ever provisioned for the (personality, runtime) channel — there is
+      // nothing to bootstrap, and the honest answer is the verb that PROVISIONS it, not
+      // a fleet-guard refusal (which is what the missing file used to be misread as).
+      if (r.state === 'missing-plist') {
+        const reason =
+          `no always-on plist for the "${rt}" channel (${plist}) — nothing to start. ` +
+          `Provision the channel first: \`iapeer add-runtime ${rt} --peer ${personality}\``
+        out.push({ personality, runtime: rt, action: 'no-plist', reason })
+        appendLifecycleEvent(cfg.eventLogDir, { ev: 'started', identity, personality, runtime: rt, action: 'no-plist', reason }, { env })
+        continue
+      }
       const ok = r.state === 'loaded' || r.state === 'already-loaded' || r.state === 'skipped-sandbox'
       const reason = ok
         ? undefined
@@ -380,16 +394,25 @@ export interface AddRuntimeOutcome {
 
 /**
  * add-runtime <runtime> (--peer <p> | --all) — give EXISTING peers an additional
- * AGENTIC runtime in one command (the fleet-switch enabler — a claude-only peer
- * has nothing to switch to).
+ * runtime in one command. Two shapes:
+ *   • AGENTIC runtime (claude/codex) — the fleet-switch enabler (a claude-only peer
+ *     has nothing to switch to); works per-peer or as an `--all` sweep.
+ *   • INFRA/presence runtime (telegram/web/voicetalk/notifier) — attach ANOTHER
+ *     always-on CHANNEL to an existing personality (`--peer` only, never a sweep).
+ *     This is the operator path the multi-plist scheme (docs/09 §Plist scheme)
+ *     always implied but nothing implemented: `create` resolves a peer by LOCATION
+ *     (default `~/.iapeer/peers/<p>`), so for a peer whose cwd lives elsewhere it
+ *     cannot reach the existing record at all — it would scaffold a second, bogus
+ *     folder. add-runtime resolves the cwd from the REGISTRY, which is exactly the
+ *     resolution this needs.
  * Per target: initPeer({cwd, runtime}) — ensurePeerProfile MERGES runtimes (the
  * default_runtime lever is deliberately untouched — capability ≠ routing flip; see
- * `default-runtime`), scaffolds the runtime scope, and the codex side runs its
- * whole birth chain: cwd pre-trust, native-memory lever, memory provision
- * (occasion=birth), host-wide MCP block + update-check-off. Idempotent by
- * construction (merge + append-if-absent everywhere). Infra PEERS (telegram/
- * notifier defaults) are skipped — adding an agentic runtime to a router peer is
- * an operator decision, not a sweep.
+ * `default-runtime`), scaffolds the runtime scope, and for infra installs the
+ * per-runtime always-on plist, runs the runtime package's own selfConfig hook (which
+ * owns `interfaces.<runtime>`), then bootstraps it. The codex side runs its whole
+ * birth chain: cwd pre-trust, native-memory lever, memory provision (occasion=birth),
+ * host-wide MCP block + update-check-off. Idempotent by construction (merge +
+ * append-if-absent everywhere).
  */
 export async function addRuntime(
   runtime: string,
@@ -397,8 +420,16 @@ export async function addRuntime(
 ): Promise<AddRuntimeOutcome[]> {
   const env = opts.env ?? process.env
   if (!isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
-  if (isInfraRuntime(runtime)) {
-    throw new Error(`"${runtime}" is an infra runtime — infra presence is operator-add via \`iapeer create\` (plist semantics), not a sweep`)
+  // The real invariant behind the old blanket infra refusal is "an always-on channel is
+  // never provisioned by a SWEEP" — each plist is a launchd job, and fanning them across
+  // the whole fleet is never what an operator means. That is a guard on `--all`, NOT on
+  // the runtime class: attaching one channel to ONE named peer is precisely the operator
+  // path the multi-plist scheme exists for, and it had no verb at all.
+  if (isInfraRuntime(runtime) && opts.all === true) {
+    throw new Error(
+      `"${runtime}" is an infra runtime — an always-on channel is provisioned per peer, never as an --all sweep; ` +
+        `target one peer: \`iapeer add-runtime ${runtime} --peer <peer>\``,
+    )
   }
   const index = readPeersIndex({ env })
   const targets = opts.all === true ? index.peers : index.peers.filter(p => p.personality === opts.peer)
@@ -414,18 +445,36 @@ export async function addRuntime(
   const { initPeer } = await import('../init/index.ts')
   const out: AddRuntimeOutcome[] = []
   for (const p of targets) {
-    if (isInfraRuntime(p.runtime)) {
+    // Skip an infra-DEFAULT peer only when the runtime being added is AGENTIC: giving a
+    // router peer (a human on telegram) an agent runtime is meaningless. Adding another
+    // CHANNEL to that same human is the whole point of this path, so it must not be
+    // caught by the same guard — the old check keyed on the peer alone and swallowed it.
+    if (isInfraRuntime(p.runtime) && !isInfraRuntime(runtime)) {
       out.push({ personality: p.personality, action: 'skipped-infra-peer', detail: `default runtime "${p.runtime}" is infra` })
       continue
     }
-    if (p.runtimes.includes(runtime as Runtime)) {
+    // DECLARED ≠ REALIZED. For an infra channel the record's `runtimes` is only the
+    // DECLARATION; the always-on plist is what actually realizes it, and the two can
+    // diverge (a hand-built bind, a torn-down plist, a record restored from backup).
+    // Short-circuiting on the declaration alone would report "already" while the channel
+    // does not exist — so for infra, converge: a missing plist means there IS work to do.
+    // initPeer is idempotent, so the repair costs nothing when everything is in place.
+    const realized = isInfraRuntime(runtime)
+      ? existsSync(resolveAlwaysOnTarget(p.personality, runtime as Runtime, env).path)
+      : true
+    if (p.runtimes.includes(runtime as Runtime) && realized) {
       out.push({ personality: p.personality, action: 'already' })
       continue
     }
     try {
       const warns: string[] = []
+      const repair = p.runtimes.includes(runtime as Runtime)
       await initPeer({ cwd: p.cwd, runtime: runtime as Runtime, env: cleanEnv, warn: m => warns.push(m) })
-      out.push({ personality: p.personality, action: 'added', detail: warns.length ? warns.join(' | ') : undefined })
+      out.push({
+        personality: p.personality,
+        action: 'added',
+        detail: [repair ? 'declared but no plist — channel re-provisioned' : undefined, ...warns].filter(Boolean).join(' | ') || undefined,
+      })
     } catch (e) {
       out.push({ personality: p.personality, action: 'failed', detail: e instanceof Error ? e.message : String(e) })
     }
@@ -1037,6 +1086,52 @@ async function connectTelegramVerb(
   return rs.state === 'restarted' ? 0 : 1
 }
 
+/**
+ * `connect <runtime> <peer>` for a NON-telegram presence runtime — attach one always-on
+ * channel to an EXISTING personality. Thin surface over addRuntime's per-peer infra path
+ * (registry-resolved cwd → initPeer → per-runtime plist + the package's selfConfig hook
+ * that owns `interfaces.<runtime>` → bootstrap); this exists so the operator reaches it
+ * by the same verb telegram taught them. Returns the process exit code.
+ */
+async function connectChannelVerb(
+  runtime: string,
+  peer: string,
+  env: NodeJS.ProcessEnv,
+  out: (s: string) => void,
+  errOut: (s: string) => void,
+): Promise<number> {
+  // A channel whose runtime package was never installed would provision a plist whose
+  // launcher does not resolve — provisionPeer refuses, but late and obscurely. Say it here.
+  const { isRuntimeInstalled } = await import('../init/index.ts')
+  if (!isRuntimeInstalled(runtime as Runtime, env)) {
+    errOut(`connect ${runtime} ${peer}: runtime "${runtime}" is not installed on this host — \`iapeer install-runtime ${runtime}\` first\n`)
+    return 1
+  }
+  let outcomes: AddRuntimeOutcome[]
+  try {
+    outcomes = await addRuntime(runtime, { peer, env })
+  } catch (e) {
+    errOut(`connect ${runtime} ${peer}: ${e instanceof Error ? e.message : String(e)}\n`)
+    return 1
+  }
+  const o = outcomes.find(x => x.personality === peer) ?? outcomes[0]
+  if (!o || o.action === 'failed') {
+    errOut(`connect ${runtime} ${peer}: ${o?.detail ?? 'failed'}\n`)
+    return 1
+  }
+  if (o.action === 'skipped-infra-peer') {
+    errOut(`connect ${runtime} ${peer}: ${o.detail ?? 'skipped'}\n`)
+    return 1
+  }
+  const plist = resolveAlwaysOnTarget(peer, runtime as Runtime, env)
+  out(
+    o.action === 'already'
+      ? `"${peer}" already carries the "${runtime}" channel (${plist.label}) — nothing to do\n`
+      : `connected "${runtime}" to "${peer}": plist ${plist.path} (${plist.label}) installed + loaded${o.detail ? `; ${o.detail}` : ''}\n`,
+  )
+  return 0
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // rename — first-class peer-identity rename (parity with remove/create). Wraps
 // renamePeer (registry + per-cwd profile, atomic, inside the lock) and KEEPS the
@@ -1381,6 +1476,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
   },
   { sig: '<runtime>', desc: "launch the cwd's peer FRESH; on a TTY drop into it (like attach), else detached" },
   { sig: 'connect telegram <peer> [--token <t>]', desc: 'attach a telegram bot to a peer (bot add → interface → router restart; asks only the token). Alias: `iapeer enable telegram <peer>`' },
+  { sig: 'connect <runtime> <peer>', desc: 'attach another always-on presence channel (web, voicetalk, …) to an EXISTING peer: per-runtime plist → the package self-config hook → load. Same as `add-runtime <runtime> --peer <peer>`' },
   { sig: 'enable <plugin> [peer] [--no-setup]', desc: 'install + enable an agfpd capability for a peer' },
   {
     sig: 'new <peer> [runtime]',
@@ -1883,7 +1979,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // В47 — a failed runtime self-config means initPeer deliberately did NOT bootstrap:
         // the always-on peer is not running. Exit 0 here read as success to automation.
         if (r.selfConfig?.state === 'failed') return 1
-        return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
+        return r.bootstrapped && bootstrapFailed(r.bootstrapped.state) ? 1 : 0
       }
       case 'create': {
         // cwd-INDEPENDENT: resolve a location (default ~/.iapeer/peers/<p> or --path),
@@ -1957,7 +2053,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // always-on peer is NOT running; `create x --runtime telegram` with a broken hook
         // exited 0 and automation read a dead telegram router as provisioned.
         if (r.selfConfig?.state === 'failed') return 1
-        return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
+        return r.bootstrapped && bootstrapFailed(r.bootstrapped.state) ? 1 : 0
       }
       case 'list': {
         // tty + no --json → the live Ink dashboard (Фаза 3: host header · live peer
@@ -2075,7 +2171,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // Fleet-switch enabler (codex-parity audit): add an agentic runtime to
         // existing peer(s) — full codex birth chain per target, idempotent.
         const rt = positionals[0]
-        if (!rt) return argErr(errOut, 'add-runtime needs a runtime — usage: iapeer add-runtime <runtime> (--peer <p> | --all)')
+        if (!rt) return argErr(errOut, 'add-runtime needs a runtime — usage: iapeer add-runtime <runtime> (--peer <p> | --all); an infra/presence runtime is --peer only')
         const peerName = typeof flags.peer === 'string' ? flags.peer : undefined
         if (flags.all !== true && !peerName) return argErr(errOut, 'add-runtime needs a target — pass --peer <p> or --all')
         const outcomes = await addRuntime(rt, { peer: peerName, all: flags.all === true, env })
@@ -2123,7 +2219,11 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         // В48 — a failed launchctl bootstrap (reason set) means the always-on peer is NOT
         // started; exit 0 here let automation read a dead telegram/notifier as running.
-        return outcomes.some(o => o.action === 'refused-foreign-launchd' || (o.action === 'bootstrap' && o.reason !== undefined)) ? 1 : 0
+        return outcomes.some(
+          o => o.action === 'refused-foreign-launchd' || o.action === 'no-plist' || (o.action === 'bootstrap' && o.reason !== undefined),
+        )
+          ? 1
+          : 0
       }
       case 'refresh': {
         // LAZY soft-reload (fleet doctrine refresh): arm `.fresh-next` so each agentic peer comes up FRESH
@@ -2651,8 +2751,24 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // `connect telegram <peer> [--token <t>]`. The human owes only the token;
         // alias/bot-add/interface/router-restart are resolved by the system. The
         // FIRST message from the human to the bot activates the chat (platform rule).
-        if (positionals[0] !== 'telegram' || !positionals[1]) return argErr(errOut, 'connect needs "telegram <peer>" — usage: iapeer connect telegram <peer> [--token <t>] (e.g. iapeer connect telegram boris)')
-        return await connectTelegramVerb(positionals[1], typeof flags.token === 'string' ? flags.token : undefined, env, out, errOut)
+        // GENERALIZED (was telegram-only): `connect <runtime> <peer>` attaches ANY
+        // presence channel. telegram keeps its bespoke flow (it owes a bot token, a
+        // @BotFather round-trip and a credential store); every other infra runtime is
+        // the generic bind — add-runtime's per-peer infra path. Same verb, same shape,
+        // so "give this person a voicetalk channel" is discoverable where the operator
+        // already looks.
+        const channel = positionals[0]
+        const channelPeer = positionals[1]
+        if (!channel || !channelPeer) {
+          return argErr(errOut, 'connect needs "<runtime> <peer>" — usage: iapeer connect telegram <peer> [--token <t>] | iapeer connect <runtime> <peer> (e.g. iapeer connect voicetalk arthur)')
+        }
+        if (channel === 'telegram') {
+          return await connectTelegramVerb(channelPeer, typeof flags.token === 'string' ? flags.token : undefined, env, out, errOut)
+        }
+        if (!isRuntime(channel) || !isInfraRuntime(channel)) {
+          return argErr(errOut, `connect: "${channel}" is not a presence runtime — connect attaches an always-on CHANNEL (${INFRA_RUNTIME_LIST.join(', ')}); for an agent runtime use \`iapeer add-runtime ${channel} --peer ${channelPeer}\``)
+        }
+        return await connectChannelVerb(channel, channelPeer, env, out, errOut)
       }
       case 'enable': {
         // DISCOVERABILITY ALIAS: `enable telegram <peer>` → `connect telegram <peer>`

package/src/init/index.ts

@@ -30,7 +30,7 @@ import {
 } from '../storage/index.ts'
 import { provisionPeer, type ProvisionResult } from '../provision/index.ts'
 import { claudeSettingsPath } from '../launch/nativeMemory.ts'
-import { launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
+import { bootstrapFailed, launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
 import { runtimeSelfConfig, type SelfConfigResult } from '../runtime/index.ts'
 import type { Intelligence } from '../core/constants.ts'
 
@@ -576,7 +576,7 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
         resolveAlwaysOnTarget(provisioned.personality, provisioned.runtime, env).path,
         env,
       )
-      if (bootstrapped.state === 'failed' || bootstrapped.state === 'refused-foreign') {
+      if (bootstrapFailed(bootstrapped.state)) {
         opts.warn?.(`bootstrap ${bootstrapped.state}: ${bootstrapped.detail ?? ''}`)
       }
     }

package/src/launch/cmdlog.ts

@@ -21,7 +21,24 @@
 // swallows errors. The dropped head of an already-oversized legacy file is redraw noise; the
 // last maxBytes is snapshotted, older bytes are discarded (never a giant copy of the bloat).
 
-import { openSync, closeSync, readSync, readdirSync, statSync, unlinkSync, writeFileSync, fstatSync, renameSync } from 'fs'
+// VOLUME RETENTION (gcPaneLogs, below) is the SECOND half of the bound. Per-file rotation caps one
+// identity (16 MiB base + N×16 MiB copies), but the DIRECTORY total is then a product of the fleet
+// size — it only ever grows with peers × runtimes, and nothing ever reclaimed the artifacts of a peer
+// that died or was removed months ago. The janitor therefore also enforces an age retention and a
+// hard directory BUDGET each tick, so the ceiling is a fixed number instead of a per-peer multiple.
+
+import {
+  openSync,
+  closeSync,
+  readSync,
+  readdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+  fstatSync,
+  renameSync,
+  utimesSync,
+} from 'fs'
 import { join } from 'path'
 
 /** Rotate threshold (env IAPEER_PANELOG_MAX_BYTES) — a base pane-log over this is rotated.
@@ -36,6 +53,17 @@ export const PANELOG_COPIES = 2
  *  env-tunable: capping the base below the seed would starve occupancy/ready-gate detection. */
 export const PANELOG_TAIL_BYTES = 8 * 1024 * 1024
 
+/** Directory BUDGET (env IAPEER_PANELOG_DIR_BUDGET) — the observable ceiling on the WHOLE
+ *  pane-log dir, enforced every tick by gcPaneLogs. Default 512 MiB. Sized off the live shape of
+ *  this host: the artifacts that are load-bearing are the bases of CONCURRENTLY warm sessions
+ *  (~12 × ≤16 MiB here), everything else is history. See gcPaneLogs for the honest boundary. */
+export const PANELOG_DIR_BUDGET_BYTES = 512 * 1024 * 1024
+/** Age retention (env IAPEER_PANELOG_STALE_DAYS) — any pane-log artifact untouched for longer is
+ *  reclaimed. Default 14 d: FAR beyond any live signal (idle-reap kills a warm session in minutes,
+ *  the ready-gate seed and the mtime-occupancy contract only ever read a CURRENT session's base),
+ *  so a base this cold belongs to a peer that is dead, removed, or renamed. A wake recreates it. */
+export const PANELOG_STALE_MS = 14 * 24 * 60 * 60 * 1000
+
 /** Parse a positive integer env value, else the default (mirror of the daemon-log config helpers). */
 function envPosInt(raw: string | undefined, dflt: number): number {
   const n = raw !== undefined ? Number(raw) : NaN
@@ -135,3 +163,164 @@ export function capPaneLogs(
   }
   return rotated
 }
+
+// ─────────────────────────── volume retention (dir budget) ───────────────────────────
+
+/** Resolve the retention knobs from env (defaults above). */
+export function paneLogGcConfig(env: NodeJS.ProcessEnv = process.env): { budgetBytes: number; staleMs: number } {
+  const days = env.IAPEER_PANELOG_STALE_DAYS
+  const staleDays = days !== undefined && Number.isFinite(Number(days)) && Number(days) > 0 ? Number(days) : 14
+  return {
+    budgetBytes: envPosInt(env.IAPEER_PANELOG_DIR_BUDGET, PANELOG_DIR_BUDGET_BYTES),
+    staleMs: Math.round(staleDays * 24 * 60 * 60 * 1000),
+  }
+}
+
+/** One pane-log artifact on disk. `base` = `<identity>.log` (live-readable), else a rotated copy. */
+type PaneLogArtifact = { path: string; size: number; mtimeMs: number; base: boolean }
+
+/** Snapshot the dir's artifacts (bases + rotated copies). Unreadable entries are skipped. */
+function scanPaneLogs(logDir: string): PaneLogArtifact[] {
+  let names: string[]
+  try {
+    names = readdirSync(logDir)
+  } catch {
+    return []
+  }
+  const out: PaneLogArtifact[] = []
+  for (const name of names) {
+    const base = name.endsWith('.log')
+    if (!base && !/\.log\.\d+$/.test(name)) continue // only OUR artifacts — never a foreign file
+    const path = join(logDir, name)
+    try {
+      const st = statSync(path)
+      if (st.isFile()) out.push({ path, size: st.size, mtimeMs: st.mtimeMs, base })
+    } catch {
+      /* vanished mid-scan → fine */
+    }
+  }
+  return out
+}
+
+/** Truncate a base IN PLACE to its last tailBytes, PRESERVING its mtime. Same inode (writer's
+ *  O_APPEND fd + В19 heal survive, exactly as rotateFile step 3), and the mtime restore keeps the
+ *  pane-log OCCUPANCY contract honest: a janitor write must never masquerade as peer activity.
+ *  Returns the bytes reclaimed (0 on no-op/error). */
+function shrinkBase(path: string, tailBytes: number): number {
+  try {
+    const st = statSync(path)
+    if (st.size <= tailBytes) return 0
+    const tail = readTail(path, tailBytes)
+    if (tail === null) return 0
+    writeFileSync(path, tail, { mode: 0o600 })
+    try {
+      utimesSync(path, st.atime, st.mtime) // janitor ≠ activity
+    } catch {
+      /* best-effort */
+    }
+    return st.size - tail.length
+  } catch {
+    return 0
+  }
+}
+
+/** What one GC pass did — observability for the supervise-tick trace. */
+export type PaneLogGcResult = {
+  bytesBefore: number
+  bytesAfter: number
+  /** Artifacts deleted by the AGE retention (dead/removed peers, ancient rotations). */
+  reapedStale: number
+  /** Rotated copies deleted by the BUDGET, oldest first. */
+  droppedCopies: number
+  /** Live bases shrunk to the reader-floor as the budget backstop. */
+  shrunkBases: number
+  /** True when even the backstop could not reach the budget — see the honest boundary below. */
+  overBudget: boolean
+}
+
+/**
+ * RETENTION pass over the pane-log dir — turns the per-file rotation bound into a DIRECTORY bound.
+ * Runs right after capPaneLogs on every supervise tick (idempotent, best-effort, no manual step),
+ * reclaiming in cheapest-loss-first order:
+ *
+ *   1. AGE — every artifact (base OR copy) untouched for > staleMs is deleted. This is what finally
+ *      reclaims peers that died, were removed, or renamed: nothing live reads a base that cold, and
+ *      the supervisor recreates it on the next wake.
+ *   2. BUDGET / copies — while the dir exceeds budgetBytes, delete rotated copies OLDEST FIRST.
+ *      Copies are history nobody reads live, so they are the correct first casualty.
+ *   3. BUDGET / backstop — if copies ran out and the dir is STILL over, shrink the largest bases to
+ *      the reader-floor (tailBytes, ≥ the ready-gate seed window) with mtime preserved.
+ *
+ * HONEST BOUNDARY: the floor of step 3 is `live-identities × tailBytes` (8 MiB each). The budget is
+ * therefore authoritative up to ~`budgetBytes / tailBytes` concurrently warm identities (~64 at the
+ * defaults); beyond that the reader-floor wins, `overBudget` comes back true, and the budget must be
+ * raised via IAPEER_PANELOG_DIR_BUDGET. Truncating below the seed window would starve
+ * occupancy/ready-gate detection, so the floor deliberately outranks the budget.
+ */
+export function gcPaneLogs(
+  logDir: string,
+  opts: { budgetBytes?: number; staleMs?: number; tailBytes?: number; nowMs?: number } = {},
+): PaneLogGcResult {
+  const budgetBytes = opts.budgetBytes ?? PANELOG_DIR_BUDGET_BYTES
+  const staleMs = opts.staleMs ?? PANELOG_STALE_MS
+  const tailBytes = opts.tailBytes ?? PANELOG_TAIL_BYTES
+  const nowMs = opts.nowMs ?? Date.now()
+
+  let live = scanPaneLogs(logDir)
+  const bytesBefore = live.reduce((s, a) => s + a.size, 0)
+  const res: PaneLogGcResult = {
+    bytesBefore,
+    bytesAfter: bytesBefore,
+    reapedStale: 0,
+    droppedCopies: 0,
+    shrunkBases: 0,
+    overBudget: false,
+  }
+  if (live.length === 0) return res
+
+  let total = bytesBefore
+  const drop = (a: PaneLogArtifact): boolean => {
+    try {
+      unlinkSync(a.path)
+      total -= a.size
+      return true
+    } catch {
+      return false // per-file best-effort — retention never fails a supervise tick
+    }
+  }
+
+  // 1 — AGE retention.
+  const staleCutoff = nowMs - staleMs
+  const kept: PaneLogArtifact[] = []
+  for (const a of live) {
+    if (a.mtimeMs < staleCutoff && drop(a)) res.reapedStale++
+    else kept.push(a)
+  }
+  live = kept
+
+  // 2 — BUDGET: rotated copies, oldest first.
+  if (total > budgetBytes) {
+    const copies = live.filter((a) => !a.base).sort((x, y) => x.mtimeMs - y.mtimeMs)
+    for (const a of copies) {
+      if (total <= budgetBytes) break
+      if (drop(a)) res.droppedCopies++
+    }
+  }
+
+  // 3 — BUDGET backstop: shrink the largest bases to the reader-floor.
+  if (total > budgetBytes) {
+    const bases = live.filter((a) => a.base && a.size > tailBytes).sort((x, y) => y.size - x.size)
+    for (const a of bases) {
+      if (total <= budgetBytes) break
+      const freed = shrinkBase(a.path, tailBytes)
+      if (freed > 0) {
+        total -= freed
+        res.shrunkBases++
+      }
+    }
+  }
+
+  res.bytesAfter = total
+  res.overBudget = total > budgetBytes
+  return res
+}

package/src/launch/launchd.ts

@@ -320,7 +320,8 @@ export type BootstrapState =
   | 'loaded' // bootstrapped now (was not loaded)
   | 'already-loaded' // service already in the gui domain → no-op (idempotent)
   | 'skipped-sandbox' // IAPEER_TEST_SANDBOX=1 → never touch the real launchd
-  | 'refused-foreign' // the plist is not foundation-owned → never load someone else's
+  | 'refused-foreign' // the plist EXISTS but is not foundation-owned → never load someone else's
+  | 'missing-plist' // no plist at that path at all — nothing to load (NOT a foreign plist)
   | 'failed' // launchctl bootstrap exited non-zero
 
 export interface BootstrapResult {
@@ -329,6 +330,14 @@ export interface BootstrapResult {
   detail?: string
 }
 
+/** Did a bootstrap attempt leave the job NOT running? The single definition every caller
+ *  shares, so adding a state can never silently pass someone's hand-rolled failure check
+ *  (`state === 'failed' || state === 'refused-foreign'` had to be edited in three places).
+ *  `skipped-sandbox` is a deliberate no-op, not a failure. */
+export function bootstrapFailed(state: BootstrapState): boolean {
+  return state === 'failed' || state === 'refused-foreign' || state === 'missing-plist'
+}
+
 /** Is `com.iapeer.<personality>` already loaded in the gui domain? (`launchctl print`
  *  exits 0 when the service exists.) Used to make bootstrap idempotent. */
 function isLaunchdLoaded(label: string, uid: string): boolean {
@@ -632,6 +641,20 @@ export function launchctlBootstrap(
   // (Deriving from `personality` alone would mis-label a per-runtime plist.)
   const base = plistPath.slice(plistPath.lastIndexOf('/') + 1)
   const label = base.endsWith('.plist') ? base.slice(0, -'.plist'.length) : launchdLabel(personality)
+  // ABSENT ≠ FOREIGN. isFoundationOwnedPlist reads the file and returns false on ANY
+  // read error, so a plist that simply does not exist used to be reported as "not
+  // foundation-owned (no sentinel) — refusing a foreign plist": a sentinel verdict on a
+  // file that was never there. That is a FALSE ownership accusation, and it sent the
+  // operator hunting for a foreign fleet plist instead of the real cause (no channel
+  // provisioned yet). Discriminate first — the caller turns this into an actionable
+  // "provision it with <verb>" instead of a fleet-guard refusal.
+  if (!existsSync(plistPath)) {
+    return {
+      state: 'missing-plist',
+      label,
+      detail: `${plistPath} does not exist — no always-on plist has been provisioned for peer "${personality}" on this channel`,
+    }
+  }
   if (!isFoundationOwnedPlist(plistPath)) {
     return {
       state: 'refused-foreign',
@@ -799,8 +822,16 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     programArguments: [...(opts.entrypointArgv ?? defaultEntrypointArgv(env)), opts.personality, opts.runtime],
     workingDirectory: opts.cwd,
     environment,
-    stdoutPath: join(logDir, 'launchd-stdout.log'),
-    stderrPath: join(logDir, 'launchd-stderr.log'),
+    // MULTI-INFRA log separation: the log dir is PERSONALITY-scoped, so with a second
+    // always-on channel both plists pointed at the SAME launchd-stdout/stderr.log and the
+    // two routers interleaved into one file (live on this host: arthur's telegram and web
+    // channels shared it) — unreadable, and a crash-loop in one channel looks like noise
+    // from the other. The per-runtime plist gets a per-runtime file. The LEGACY BASE plist
+    // keeps the unsuffixed names: it is the personality's original single channel, and
+    // renaming its log on an unrelated regeneration would orphan the operator's existing
+    // tails for no gain (same no-forced-migration rule resolveAlwaysOnTarget follows).
+    stdoutPath: join(logDir, target.scheme === 'per-runtime' ? `launchd-${opts.runtime}-stdout.log` : 'launchd-stdout.log'),
+    stderrPath: join(logDir, target.scheme === 'per-runtime' ? `launchd-${opts.runtime}-stderr.log` : 'launchd-stderr.log'),
     throttleIntervalSecs: opts.throttleIntervalSecs,
   }
   mkdirSync(launchAgentsDir(env), { recursive: true })

package/src/lifecycle/index.ts

@@ -28,7 +28,7 @@ import {
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { renderEnvelopeForAgent } from '../codec/index.ts'
 import { err, ok, type Result } from '../core/errors.ts'
-import { capPaneLogs, paneLogRotateConfig } from '../launch/cmdlog.ts'
+import { capPaneLogs, gcPaneLogs, paneLogGcConfig, paneLogRotateConfig } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { resolveMemoryWritableRoots } from '../status/index.ts'
 import { approvalModeOf, readPeerProfile, resolveIdentity, type ApprovalMode } from '../identity/index.ts'
@@ -1524,12 +1524,31 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   // to lifecycle ownership, so launchd-managed routers' pane-logs are rotated too.
   const paneLogRc = paneLogRotateConfig(env)
   capPaneLogs(cfg.logDir, paneLogRc.maxBytes, paneLogRc.copies)
+  // Pane-log volume RETENTION (gcPaneLogs): rotation bounds ONE identity, but the DIRECTORY total
+  // is that bound × the fleet — it only grew with peers × runtimes, and the artifacts of dead /
+  // removed peers were never reclaimed. Enforce the age retention + the directory BUDGET right
+  // after the rotation, on the same tick and the same best-effort contract (knobs:
+  // IAPEER_PANELOG_DIR_BUDGET / IAPEER_PANELOG_STALE_DAYS, defaults 512 MiB / 14 d).
+  const paneLogGc = gcPaneLogs(cfg.logDir, { ...paneLogGcConfig(env), nowMs })
   // Durable decision trace (eventlog.ts): every reap/death/eager-fresh gets a line
   // so a postmortem can answer "when & how did peer X's prior session end" even
   // after the .idle-reaped / .deaths markers are consumed. alive / skipped-launchd
   // are steady-state non-decisions → logged only under IAPEER_SUPERVISE_LOG_VERBOSE.
   const trace = (fields: Record<string, string | number | undefined>): void =>
     appendLifecycleEvent(cfg.eventLogDir, { ev: 'supervise', ...fields }, { env, nowMs })
+  // Retention is silent in steady state (nothing to reclaim); a pass that actually reclaimed —
+  // or that could NOT reach the budget even after the backstop — leaves a durable line.
+  if (paneLogGc.reapedStale || paneLogGc.droppedCopies || paneLogGc.shrunkBases || paneLogGc.overBudget) {
+    trace({
+      action: 'panelog-gc',
+      stale: paneLogGc.reapedStale,
+      copies: paneLogGc.droppedCopies,
+      shrunk: paneLogGc.shrunkBases,
+      mb_before: Math.round(paneLogGc.bytesBefore / (1024 * 1024)),
+      mb_after: Math.round(paneLogGc.bytesAfter / (1024 * 1024)),
+      outcome: paneLogGc.overBudget ? 'over-budget-after-gc' : 'within-budget',
+    })
+  }
   const out: SuperviseOutcome[] = []
   const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace }
   for (const s of readSessionStates(cfg)) {