@agfpd/iapeer 0.4.106 → 0.4.107

package/docs/09-runtimes.md

@@ -56,7 +56,20 @@ iapeer add-runtime codex --peer assistant   # for one peer
 iapeer add-runtime codex --all              # for all peers
 ```
 
-Adds an agent runtime to existing peers: appends it to `runtimes`, scaffolds the runtime space, and does the full Codex setup (pre-trusting the folder, the native-memory lever, attaching memory, MCP). The command **doesn't touch** `default_runtime` — this is extending options, not changing routing. Idempotent. Infrastructure peers are skipped: giving them an agent runtime is an operator decision via `create`, not a bulk operation.
+Adds a runtime to existing peers: appends it to `runtimes`, scaffolds the runtime space, and does the full Codex setup (pre-trusting the folder, the native-memory lever, attaching memory, MCP). The command **doesn't touch** `default_runtime` — this is extending options, not changing routing. Idempotent. A peer whose default is infrastructure is skipped when the runtime being added is an *agent* one: giving a router peer an agent runtime is an operator decision via `create`, not a bulk operation.
+
+An **infrastructure** runtime can also be added this way, but only to one named peer:
+
+```bash
+iapeer add-runtime voicetalk --peer arthur   # attach a second always-on channel
+iapeer connect voicetalk arthur              # the same thing, said the way `connect` taught you
+```
+
+This is the operator path for the multi-channel scheme above — giving an *existing* personality another always-on presence. It resolves the peer's folder from the registry, installs the per-runtime plist, runs the runtime package's own `selfConfig` hook (which owns `interfaces.<runtime>`), and loads the job. `--all` is refused for an infrastructure runtime: every channel is a launchd job, and fanning them across the fleet is never what an operator means.
+
+`create` cannot do this. It resolves a peer by **location** (`~/.iapeer/peers/<name>` unless `--path` is given), so for a peer whose folder lives elsewhere it never reaches the existing record — it would scaffold a second, bogus folder instead.
+
+Declaration and reality can diverge: `runtimes` only *declares* the channel, the plist *realizes* it. If the record declares the runtime but the plist is gone, the command re-provisions it rather than reporting "already" for a channel that does not exist.
 
 ### default-runtime — switch the primary
 
@@ -69,7 +82,7 @@ Switches the primary runtime — where routing goes and which runtime comes up f
 
 The routing choice is strict: a send without an explicit `runtime` always targets `default_runtime`. A live session on another declared runtime does not capture that send; if the default session is asleep, the daemon wakes it. Passing `runtime` explicitly remains the way to target a non-default surface.
 
-## Connecting Telegram: connect
+## Connecting a channel: connect
 
 ```bash
 iapeer connect telegram assistant --token <bot-token>
@@ -79,6 +92,8 @@ Connects a Telegram bot to a peer in one pass: registers the bot, writes it into
 
 The command is idempotent, and behavior depends on the token. **The same token** is a clean no-op: the bot's credentials file doesn't change, the live router already runs on these credentials, no restart. **A new or changed token** requires a router restart (credentials are read only at start) — a second's pause in delivery for all Telegram peers; inbound messages aren't lost (long-polling remembers the offset, Telegram holds messages for up to 24 hours). An invalid token is rejected at once, with the verbatim reason from Telegram.
 
+`connect` is not Telegram-only. `iapeer connect <runtime> <peer>` attaches any presence channel: Telegram keeps its bespoke flow (it owes a bot token, a `@BotFather` round-trip and a credential store), while every other infrastructure runtime takes the generic bind — the same per-peer path as `add-runtime <runtime> --peer <peer>`. The runtime package must be installed on the host first (`install-runtime`), which the command checks before touching anything.
+
 ## Runtime packages
 
 Infrastructure runtimes ship as separate npm packages (`*-runtime`). The core installs and updates them:

package/docs/12-cli-reference.md

@@ -49,7 +49,7 @@ The full list of `iapeer <command>`. General rules: `--help` / `-h` anywhere in
 | `attach <peer> [runtime]` | Bring up (if asleep), resume the conversation, open the session under the supervisor in the terminal (detach — `Ctrl-]`). |
 | `interrupt <peer> [runtime]` | Interrupt the current turn (Escape), context intact. |
 | `compact <peer> [runtime]` | Compact the conversation; a sleeper is resumed first after idle sleep. |
-| `add-runtime <runtime> (--peer <p> \| --all)` | Add an agent runtime to existing peers. Doesn't touch `default_runtime`. |
+| `add-runtime <runtime> (--peer <p> \| --all)` | Add a runtime to existing peers. Doesn't touch `default_runtime`. An infrastructure runtime attaches an always-on channel and is `--peer`-only (never an `--all` sweep). |
 | `default-runtime <runtime> (--peer <p> \| --all)` | Switch the primary runtime (routing / first bring-up). Refuses if the runtime isn't declared. |
 
 `stop`/`start`/`new` refuse to touch peers under a foreign launchd plist — the core doesn't intervene in what it doesn't manage.
@@ -69,6 +69,7 @@ The full list of `iapeer <command>`. General rules: `--help` / `-h` anywhere in
 |---|---|
 | `<runtime>` (e.g. `iapeer claude`) | Launch the current folder's peer on this runtime — always as a fresh session. |
 | `connect telegram <peer> [--token <t>]` | Connect a Telegram bot to a peer: register the bot → write into the profile → restart the router. Asks only for the token. |
+| `connect <runtime> <peer>` | Attach any other presence channel (web, voicetalk, …) to an existing peer: per-runtime plist → the package's `selfConfig` hook → load. Same path as `add-runtime <runtime> --peer <peer>`. |
 
 ## Extensions and memory
 

package/docs/ru/09-/321/200/320/260/320/275/321/202/320/260/320/271/320/274/321/213.md

@@ -56,7 +56,20 @@ iapeer add-runtime codex --peer assistant   # одному пиру
 iapeer add-runtime codex --all              # всем пирам
 ```
 
-Добавляет агентский рантайм существующим пирам: дописывает его в `runtimes`, разворачивает пространство рантайма и проводит полную настройку для Codex (предварительное доверие к папке, рычаг родной памяти, подключение памяти, MCP). `default_runtime` команда **не трогает** — это расширение возможностей, не смена маршрутизации. Идемпотентна. Инфраструктурные пиры пропускаются: добавить им агентский рантайм — решение оператора через `create`, а не массовая операция.
+Добавляет рантайм существующим пирам: дописывает его в `runtimes`, разворачивает пространство рантайма и проводит полную настройку для Codex (предварительное доверие к папке, рычаг родной памяти, подключение памяти, MCP). `default_runtime` команда **не трогает** — это расширение возможностей, не смена маршрутизации. Идемпотентна. Пир с инфраструктурным дефолтом пропускается, когда добавляется *агентский* рантайм: дать роутер-пиру агентский рантайм — решение оператора через `create`, а не массовая операция.
+
+**Инфраструктурный** рантайм тоже добавляется этой командой, но только одному названному пиру:
+
+```bash
+iapeer add-runtime voicetalk --peer arthur   # прицепить второй always-on канал
+iapeer connect voicetalk arthur              # то же самое в привычной по connect форме
+```
+
+Это операторский путь для описанной выше мультиканальной схемы — дать *существующей* личности ещё одно постоянное присутствие. Команда резолвит папку пира из реестра, ставит пер-рантаймовый плист, вызывает собственный хук `selfConfig` рантайм-пакета (он владеет `interfaces.<рантайм>`) и загружает job. `--all` для инфраструктурного рантайма отвергается: каждый канал — это launchd-job, и разворачивать их по всему флоту оператор не имеет в виду никогда.
+
+`create` так не умеет. Он резолвит пира по **расположению** (`~/.iapeer/peers/<имя>`, если не передан `--path`), поэтому до записи пира, чья папка лежит в другом месте, не дотягивается вовсе — вместо этого создал бы вторую, ложную папку.
+
+Объявление и реальность расходятся: `runtimes` только *объявляет* канал, а *реализует* его плист. Если запись рантайм объявляет, а плиста нет — команда переставляет канал, а не рапортует «already» о канале, которого не существует.
 
 ### default-runtime — переключить основной
 
@@ -69,7 +82,7 @@ iapeer default-runtime codex --all              # все пиры
 
 Выбор для маршрутизации строгий: отправка без явного `runtime` всегда целится в `default_runtime`. Живая сессия на другом объявленном рантайме не перехватывает такую отправку; если дефолтная сессия спит, демон будит её. Явный `runtime` по-прежнему выбирает конкретную недефолтную поверхность.
 
-## Подключение Telegram: connect
+## Подключение канала: connect
 
 ```bash
 iapeer connect telegram assistant --token <токен-бота>
@@ -79,6 +92,8 @@ iapeer connect telegram assistant --token <токен-бота>
 
 Команда идемпотентна, и поведение зависит от токена. **Тот же токен** — чистый no-op: файл учётных данных бота не меняется, живой роутер уже работает на этих данных, перезапуска нет. **Новый или изменённый токен** требует перезапуска роутера (учётные данные читаются только при старте) — это секундная пауза в доставке для всех Telegram-пиров; входящие при этом не теряются (long-polling помнит смещение, Telegram держит сообщения до 24 часов). Неверный токен отсекается сразу, с дословной причиной от Telegram.
 
+`connect` не только про Telegram. `iapeer connect <рантайм> <пир>` цепляет любой presence-канал: у Telegram остаётся его особый поток (нужны токен, поход к `@BotFather` и хранилище учётных данных), а любой другой инфраструктурный рантайм идёт по генеричной привязке — тот же пер-пировый путь, что и `add-runtime <рантайм> --peer <пир>`. Рантайм-пакет должен быть предварительно установлен на хосте (`install-runtime`); команда проверяет это до того, как что-либо тронуть.
+
 ## Рантайм-пакеты
 
 Инфраструктурные рантаймы поставляются отдельными npm-пакетами (`*-runtime`). Ставит и обновляет их ядро:

package/docs/ru/12-cli-reference.md

@@ -49,7 +49,7 @@
 | `attach <пир> [рантайм]` | Поднять (если спит), продолжить диалог, открыть сессию под супервизором в терминале (отсоединиться — `Ctrl-]`). |
 | `interrupt <пир> [рантайм]` | Прервать текущий ход (Escape), контекст цел. |
 | `compact <пир> [рантайм]` | Сжать диалог; спящего после усыпления сначала продолжить. |
-| `add-runtime <рантайм> (--peer <p> \| --all)` | Добавить агентский рантайм существующим пирам. `default_runtime` не трогает. |
+| `add-runtime <рантайм> (--peer <p> \| --all)` | Добавить рантайм существующим пирам. `default_runtime` не трогает. Инфраструктурный рантайм цепляет always-on канал и работает только с `--peer` (никогда не сметает `--all`). |
 | `default-runtime <рантайм> (--peer <p> \| --all)` | Переключить основной рантайм (маршрутизация/первый подъём). Откажет, если рантайм не объявлен. |
 
 `stop`/`start`/`new` отказываются трогать пиров под чужим launchd-плистом — ядро не вмешивается в то, чем управляет не оно.
@@ -69,6 +69,7 @@
 |---|---|
 | `<рантайм>` (например `iapeer claude`) | Запустить пир текущей папки в этом рантайме — всегда свежей сессией. |
 | `connect telegram <пир> [--token <t>]` | Подключить Telegram-бота к пиру: регистрация бота → запись в профиль → перезапуск роутера. Спрашивает только токен. |
+| `connect <рантайм> <пир>` | Прицепить любой другой presence-канал (web, voicetalk, …) существующему пиру: пер-рантаймовый плист → хук `selfConfig` пакета → загрузка. Тот же путь, что `add-runtime <рантайм> --peer <пир>`. |
 
 ## Расширения и память
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.106",
+  "version": "0.4.107",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -15,6 +15,7 @@ import { existsSync, readFileSync, renameSync, rmSync } from 'fs'
 import { fileURLToPath } from 'url'
 import { dirname, join } from 'path'
 import {
+  INFRA_RUNTIME_LIST,
   isInfraRuntime,
   isRuntime,
   type Intelligence,
@@ -53,6 +54,7 @@ import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import {
+  bootstrapFailed,
   cycleDaemon,
   existingAlwaysOnPlists,
   launchctlBootstrap,
@@ -195,7 +197,7 @@ export function formatListTable(rows: PeerListing[]): string {
 export interface StopStartOutcome {
   personality: string
   runtime: Runtime
-  action: 'stopped' | 'started' | 'bootout' | 'bootstrap' | 'refused-foreign-launchd'
+  action: 'stopped' | 'started' | 'bootout' | 'bootstrap' | 'refused-foreign-launchd' | 'no-plist'
   reason?: string
 }
 
@@ -320,6 +322,18 @@ export function startPeer(personality: string, runtime: string | undefined, opts
       // every attempt is LOUD with the manual rescue recipe. (Also gains the
       // sentinel fleet-guard + sandbox guard the raw spawn never had.)
       const r = launchctlBootstrap(personality, plist, env)
+      // NO PLIST ≠ FOREIGN PLIST. The peer declares this infra runtime but no always-on
+      // plist was ever provisioned for the (personality, runtime) channel — there is
+      // nothing to bootstrap, and the honest answer is the verb that PROVISIONS it, not
+      // a fleet-guard refusal (which is what the missing file used to be misread as).
+      if (r.state === 'missing-plist') {
+        const reason =
+          `no always-on plist for the "${rt}" channel (${plist}) — nothing to start. ` +
+          `Provision the channel first: \`iapeer add-runtime ${rt} --peer ${personality}\``
+        out.push({ personality, runtime: rt, action: 'no-plist', reason })
+        appendLifecycleEvent(cfg.eventLogDir, { ev: 'started', identity, personality, runtime: rt, action: 'no-plist', reason }, { env })
+        continue
+      }
       const ok = r.state === 'loaded' || r.state === 'already-loaded' || r.state === 'skipped-sandbox'
       const reason = ok
         ? undefined
@@ -380,16 +394,25 @@ export interface AddRuntimeOutcome {
 
 /**
  * add-runtime <runtime> (--peer <p> | --all) — give EXISTING peers an additional
- * AGENTIC runtime in one command (the fleet-switch enabler — a claude-only peer
- * has nothing to switch to).
+ * runtime in one command. Two shapes:
+ *   • AGENTIC runtime (claude/codex) — the fleet-switch enabler (a claude-only peer
+ *     has nothing to switch to); works per-peer or as an `--all` sweep.
+ *   • INFRA/presence runtime (telegram/web/voicetalk/notifier) — attach ANOTHER
+ *     always-on CHANNEL to an existing personality (`--peer` only, never a sweep).
+ *     This is the operator path the multi-plist scheme (docs/09 §Plist scheme)
+ *     always implied but nothing implemented: `create` resolves a peer by LOCATION
+ *     (default `~/.iapeer/peers/<p>`), so for a peer whose cwd lives elsewhere it
+ *     cannot reach the existing record at all — it would scaffold a second, bogus
+ *     folder. add-runtime resolves the cwd from the REGISTRY, which is exactly the
+ *     resolution this needs.
  * Per target: initPeer({cwd, runtime}) — ensurePeerProfile MERGES runtimes (the
  * default_runtime lever is deliberately untouched — capability ≠ routing flip; see
- * `default-runtime`), scaffolds the runtime scope, and the codex side runs its
- * whole birth chain: cwd pre-trust, native-memory lever, memory provision
- * (occasion=birth), host-wide MCP block + update-check-off. Idempotent by
- * construction (merge + append-if-absent everywhere). Infra PEERS (telegram/
- * notifier defaults) are skipped — adding an agentic runtime to a router peer is
- * an operator decision, not a sweep.
+ * `default-runtime`), scaffolds the runtime scope, and for infra installs the
+ * per-runtime always-on plist, runs the runtime package's own selfConfig hook (which
+ * owns `interfaces.<runtime>`), then bootstraps it. The codex side runs its whole
+ * birth chain: cwd pre-trust, native-memory lever, memory provision (occasion=birth),
+ * host-wide MCP block + update-check-off. Idempotent by construction (merge +
+ * append-if-absent everywhere).
  */
 export async function addRuntime(
   runtime: string,
@@ -397,8 +420,16 @@ export async function addRuntime(
 ): Promise<AddRuntimeOutcome[]> {
   const env = opts.env ?? process.env
   if (!isRuntime(runtime)) throw new Error(`invalid runtime "${runtime}"`)
-  if (isInfraRuntime(runtime)) {
-    throw new Error(`"${runtime}" is an infra runtime — infra presence is operator-add via \`iapeer create\` (plist semantics), not a sweep`)
+  // The real invariant behind the old blanket infra refusal is "an always-on channel is
+  // never provisioned by a SWEEP" — each plist is a launchd job, and fanning them across
+  // the whole fleet is never what an operator means. That is a guard on `--all`, NOT on
+  // the runtime class: attaching one channel to ONE named peer is precisely the operator
+  // path the multi-plist scheme exists for, and it had no verb at all.
+  if (isInfraRuntime(runtime) && opts.all === true) {
+    throw new Error(
+      `"${runtime}" is an infra runtime — an always-on channel is provisioned per peer, never as an --all sweep; ` +
+        `target one peer: \`iapeer add-runtime ${runtime} --peer <peer>\``,
+    )
   }
   const index = readPeersIndex({ env })
   const targets = opts.all === true ? index.peers : index.peers.filter(p => p.personality === opts.peer)
@@ -414,18 +445,36 @@ export async function addRuntime(
   const { initPeer } = await import('../init/index.ts')
   const out: AddRuntimeOutcome[] = []
   for (const p of targets) {
-    if (isInfraRuntime(p.runtime)) {
+    // Skip an infra-DEFAULT peer only when the runtime being added is AGENTIC: giving a
+    // router peer (a human on telegram) an agent runtime is meaningless. Adding another
+    // CHANNEL to that same human is the whole point of this path, so it must not be
+    // caught by the same guard — the old check keyed on the peer alone and swallowed it.
+    if (isInfraRuntime(p.runtime) && !isInfraRuntime(runtime)) {
       out.push({ personality: p.personality, action: 'skipped-infra-peer', detail: `default runtime "${p.runtime}" is infra` })
       continue
     }
-    if (p.runtimes.includes(runtime as Runtime)) {
+    // DECLARED ≠ REALIZED. For an infra channel the record's `runtimes` is only the
+    // DECLARATION; the always-on plist is what actually realizes it, and the two can
+    // diverge (a hand-built bind, a torn-down plist, a record restored from backup).
+    // Short-circuiting on the declaration alone would report "already" while the channel
+    // does not exist — so for infra, converge: a missing plist means there IS work to do.
+    // initPeer is idempotent, so the repair costs nothing when everything is in place.
+    const realized = isInfraRuntime(runtime)
+      ? existsSync(resolveAlwaysOnTarget(p.personality, runtime as Runtime, env).path)
+      : true
+    if (p.runtimes.includes(runtime as Runtime) && realized) {
       out.push({ personality: p.personality, action: 'already' })
       continue
     }
     try {
       const warns: string[] = []
+      const repair = p.runtimes.includes(runtime as Runtime)
       await initPeer({ cwd: p.cwd, runtime: runtime as Runtime, env: cleanEnv, warn: m => warns.push(m) })
-      out.push({ personality: p.personality, action: 'added', detail: warns.length ? warns.join(' | ') : undefined })
+      out.push({
+        personality: p.personality,
+        action: 'added',
+        detail: [repair ? 'declared but no plist — channel re-provisioned' : undefined, ...warns].filter(Boolean).join(' | ') || undefined,
+      })
     } catch (e) {
       out.push({ personality: p.personality, action: 'failed', detail: e instanceof Error ? e.message : String(e) })
     }
@@ -1037,6 +1086,52 @@ async function connectTelegramVerb(
   return rs.state === 'restarted' ? 0 : 1
 }
 
+/**
+ * `connect <runtime> <peer>` for a NON-telegram presence runtime — attach one always-on
+ * channel to an EXISTING personality. Thin surface over addRuntime's per-peer infra path
+ * (registry-resolved cwd → initPeer → per-runtime plist + the package's selfConfig hook
+ * that owns `interfaces.<runtime>` → bootstrap); this exists so the operator reaches it
+ * by the same verb telegram taught them. Returns the process exit code.
+ */
+async function connectChannelVerb(
+  runtime: string,
+  peer: string,
+  env: NodeJS.ProcessEnv,
+  out: (s: string) => void,
+  errOut: (s: string) => void,
+): Promise<number> {
+  // A channel whose runtime package was never installed would provision a plist whose
+  // launcher does not resolve — provisionPeer refuses, but late and obscurely. Say it here.
+  const { isRuntimeInstalled } = await import('../init/index.ts')
+  if (!isRuntimeInstalled(runtime as Runtime, env)) {
+    errOut(`connect ${runtime} ${peer}: runtime "${runtime}" is not installed on this host — \`iapeer install-runtime ${runtime}\` first\n`)
+    return 1
+  }
+  let outcomes: AddRuntimeOutcome[]
+  try {
+    outcomes = await addRuntime(runtime, { peer, env })
+  } catch (e) {
+    errOut(`connect ${runtime} ${peer}: ${e instanceof Error ? e.message : String(e)}\n`)
+    return 1
+  }
+  const o = outcomes.find(x => x.personality === peer) ?? outcomes[0]
+  if (!o || o.action === 'failed') {
+    errOut(`connect ${runtime} ${peer}: ${o?.detail ?? 'failed'}\n`)
+    return 1
+  }
+  if (o.action === 'skipped-infra-peer') {
+    errOut(`connect ${runtime} ${peer}: ${o.detail ?? 'skipped'}\n`)
+    return 1
+  }
+  const plist = resolveAlwaysOnTarget(peer, runtime as Runtime, env)
+  out(
+    o.action === 'already'
+      ? `"${peer}" already carries the "${runtime}" channel (${plist.label}) — nothing to do\n`
+      : `connected "${runtime}" to "${peer}": plist ${plist.path} (${plist.label}) installed + loaded${o.detail ? `; ${o.detail}` : ''}\n`,
+  )
+  return 0
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // rename — first-class peer-identity rename (parity with remove/create). Wraps
 // renamePeer (registry + per-cwd profile, atomic, inside the lock) and KEEPS the
@@ -1381,6 +1476,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
   },
   { sig: '<runtime>', desc: "launch the cwd's peer FRESH; on a TTY drop into it (like attach), else detached" },
   { sig: 'connect telegram <peer> [--token <t>]', desc: 'attach a telegram bot to a peer (bot add → interface → router restart; asks only the token). Alias: `iapeer enable telegram <peer>`' },
+  { sig: 'connect <runtime> <peer>', desc: 'attach another always-on presence channel (web, voicetalk, …) to an EXISTING peer: per-runtime plist → the package self-config hook → load. Same as `add-runtime <runtime> --peer <peer>`' },
   { sig: 'enable <plugin> [peer] [--no-setup]', desc: 'install + enable an agfpd capability for a peer' },
   {
     sig: 'new <peer> [runtime]',
@@ -1883,7 +1979,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // В47 — a failed runtime self-config means initPeer deliberately did NOT bootstrap:
         // the always-on peer is not running. Exit 0 here read as success to automation.
         if (r.selfConfig?.state === 'failed') return 1
-        return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
+        return r.bootstrapped && bootstrapFailed(r.bootstrapped.state) ? 1 : 0
       }
       case 'create': {
         // cwd-INDEPENDENT: resolve a location (default ~/.iapeer/peers/<p> or --path),
@@ -1957,7 +2053,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // always-on peer is NOT running; `create x --runtime telegram` with a broken hook
         // exited 0 and automation read a dead telegram router as provisioned.
         if (r.selfConfig?.state === 'failed') return 1
-        return r.bootstrapped && (r.bootstrapped.state === 'failed' || r.bootstrapped.state === 'refused-foreign') ? 1 : 0
+        return r.bootstrapped && bootstrapFailed(r.bootstrapped.state) ? 1 : 0
       }
       case 'list': {
         // tty + no --json → the live Ink dashboard (Фаза 3: host header · live peer
@@ -2075,7 +2171,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // Fleet-switch enabler (codex-parity audit): add an agentic runtime to
         // existing peer(s) — full codex birth chain per target, idempotent.
         const rt = positionals[0]
-        if (!rt) return argErr(errOut, 'add-runtime needs a runtime — usage: iapeer add-runtime <runtime> (--peer <p> | --all)')
+        if (!rt) return argErr(errOut, 'add-runtime needs a runtime — usage: iapeer add-runtime <runtime> (--peer <p> | --all); an infra/presence runtime is --peer only')
         const peerName = typeof flags.peer === 'string' ? flags.peer : undefined
         if (flags.all !== true && !peerName) return argErr(errOut, 'add-runtime needs a target — pass --peer <p> or --all')
         const outcomes = await addRuntime(rt, { peer: peerName, all: flags.all === true, env })
@@ -2123,7 +2219,11 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         // В48 — a failed launchctl bootstrap (reason set) means the always-on peer is NOT
         // started; exit 0 here let automation read a dead telegram/notifier as running.
-        return outcomes.some(o => o.action === 'refused-foreign-launchd' || (o.action === 'bootstrap' && o.reason !== undefined)) ? 1 : 0
+        return outcomes.some(
+          o => o.action === 'refused-foreign-launchd' || o.action === 'no-plist' || (o.action === 'bootstrap' && o.reason !== undefined),
+        )
+          ? 1
+          : 0
       }
       case 'refresh': {
         // LAZY soft-reload (fleet doctrine refresh): arm `.fresh-next` so each agentic peer comes up FRESH
@@ -2651,8 +2751,24 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // `connect telegram <peer> [--token <t>]`. The human owes only the token;
         // alias/bot-add/interface/router-restart are resolved by the system. The
         // FIRST message from the human to the bot activates the chat (platform rule).
-        if (positionals[0] !== 'telegram' || !positionals[1]) return argErr(errOut, 'connect needs "telegram <peer>" — usage: iapeer connect telegram <peer> [--token <t>] (e.g. iapeer connect telegram boris)')
-        return await connectTelegramVerb(positionals[1], typeof flags.token === 'string' ? flags.token : undefined, env, out, errOut)
+        // GENERALIZED (was telegram-only): `connect <runtime> <peer>` attaches ANY
+        // presence channel. telegram keeps its bespoke flow (it owes a bot token, a
+        // @BotFather round-trip and a credential store); every other infra runtime is
+        // the generic bind — add-runtime's per-peer infra path. Same verb, same shape,
+        // so "give this person a voicetalk channel" is discoverable where the operator
+        // already looks.
+        const channel = positionals[0]
+        const channelPeer = positionals[1]
+        if (!channel || !channelPeer) {
+          return argErr(errOut, 'connect needs "<runtime> <peer>" — usage: iapeer connect telegram <peer> [--token <t>] | iapeer connect <runtime> <peer> (e.g. iapeer connect voicetalk arthur)')
+        }
+        if (channel === 'telegram') {
+          return await connectTelegramVerb(channelPeer, typeof flags.token === 'string' ? flags.token : undefined, env, out, errOut)
+        }
+        if (!isRuntime(channel) || !isInfraRuntime(channel)) {
+          return argErr(errOut, `connect: "${channel}" is not a presence runtime — connect attaches an always-on CHANNEL (${INFRA_RUNTIME_LIST.join(', ')}); for an agent runtime use \`iapeer add-runtime ${channel} --peer ${channelPeer}\``)
+        }
+        return await connectChannelVerb(channel, channelPeer, env, out, errOut)
       }
       case 'enable': {
         // DISCOVERABILITY ALIAS: `enable telegram <peer>` → `connect telegram <peer>`

package/src/init/index.ts

@@ -30,7 +30,7 @@ import {
 } from '../storage/index.ts'
 import { provisionPeer, type ProvisionResult } from '../provision/index.ts'
 import { claudeSettingsPath } from '../launch/nativeMemory.ts'
-import { launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
+import { bootstrapFailed, launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
 import { runtimeSelfConfig, type SelfConfigResult } from '../runtime/index.ts'
 import type { Intelligence } from '../core/constants.ts'
 
@@ -576,7 +576,7 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
         resolveAlwaysOnTarget(provisioned.personality, provisioned.runtime, env).path,
         env,
       )
-      if (bootstrapped.state === 'failed' || bootstrapped.state === 'refused-foreign') {
+      if (bootstrapFailed(bootstrapped.state)) {
         opts.warn?.(`bootstrap ${bootstrapped.state}: ${bootstrapped.detail ?? ''}`)
       }
     }

package/src/launch/launchd.ts

@@ -320,7 +320,8 @@ export type BootstrapState =
   | 'loaded' // bootstrapped now (was not loaded)
   | 'already-loaded' // service already in the gui domain → no-op (idempotent)
   | 'skipped-sandbox' // IAPEER_TEST_SANDBOX=1 → never touch the real launchd
-  | 'refused-foreign' // the plist is not foundation-owned → never load someone else's
+  | 'refused-foreign' // the plist EXISTS but is not foundation-owned → never load someone else's
+  | 'missing-plist' // no plist at that path at all — nothing to load (NOT a foreign plist)
   | 'failed' // launchctl bootstrap exited non-zero
 
 export interface BootstrapResult {
@@ -329,6 +330,14 @@ export interface BootstrapResult {
   detail?: string
 }
 
+/** Did a bootstrap attempt leave the job NOT running? The single definition every caller
+ *  shares, so adding a state can never silently pass someone's hand-rolled failure check
+ *  (`state === 'failed' || state === 'refused-foreign'` had to be edited in three places).
+ *  `skipped-sandbox` is a deliberate no-op, not a failure. */
+export function bootstrapFailed(state: BootstrapState): boolean {
+  return state === 'failed' || state === 'refused-foreign' || state === 'missing-plist'
+}
+
 /** Is `com.iapeer.<personality>` already loaded in the gui domain? (`launchctl print`
  *  exits 0 when the service exists.) Used to make bootstrap idempotent. */
 function isLaunchdLoaded(label: string, uid: string): boolean {
@@ -632,6 +641,20 @@ export function launchctlBootstrap(
   // (Deriving from `personality` alone would mis-label a per-runtime plist.)
   const base = plistPath.slice(plistPath.lastIndexOf('/') + 1)
   const label = base.endsWith('.plist') ? base.slice(0, -'.plist'.length) : launchdLabel(personality)
+  // ABSENT ≠ FOREIGN. isFoundationOwnedPlist reads the file and returns false on ANY
+  // read error, so a plist that simply does not exist used to be reported as "not
+  // foundation-owned (no sentinel) — refusing a foreign plist": a sentinel verdict on a
+  // file that was never there. That is a FALSE ownership accusation, and it sent the
+  // operator hunting for a foreign fleet plist instead of the real cause (no channel
+  // provisioned yet). Discriminate first — the caller turns this into an actionable
+  // "provision it with <verb>" instead of a fleet-guard refusal.
+  if (!existsSync(plistPath)) {
+    return {
+      state: 'missing-plist',
+      label,
+      detail: `${plistPath} does not exist — no always-on plist has been provisioned for peer "${personality}" on this channel`,
+    }
+  }
   if (!isFoundationOwnedPlist(plistPath)) {
     return {
       state: 'refused-foreign',
@@ -799,8 +822,16 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     programArguments: [...(opts.entrypointArgv ?? defaultEntrypointArgv(env)), opts.personality, opts.runtime],
     workingDirectory: opts.cwd,
     environment,
-    stdoutPath: join(logDir, 'launchd-stdout.log'),
-    stderrPath: join(logDir, 'launchd-stderr.log'),
+    // MULTI-INFRA log separation: the log dir is PERSONALITY-scoped, so with a second
+    // always-on channel both plists pointed at the SAME launchd-stdout/stderr.log and the
+    // two routers interleaved into one file (live on this host: arthur's telegram and web
+    // channels shared it) — unreadable, and a crash-loop in one channel looks like noise
+    // from the other. The per-runtime plist gets a per-runtime file. The LEGACY BASE plist
+    // keeps the unsuffixed names: it is the personality's original single channel, and
+    // renaming its log on an unrelated regeneration would orphan the operator's existing
+    // tails for no gain (same no-forced-migration rule resolveAlwaysOnTarget follows).
+    stdoutPath: join(logDir, target.scheme === 'per-runtime' ? `launchd-${opts.runtime}-stdout.log` : 'launchd-stdout.log'),
+    stderrPath: join(logDir, target.scheme === 'per-runtime' ? `launchd-${opts.runtime}-stderr.log` : 'launchd-stderr.log'),
     throttleIntervalSecs: opts.throttleIntervalSecs,
   }
   mkdirSync(launchAgentsDir(env), { recursive: true })