@agfpd/iapeer 0.4.126 → 0.4.127

package/docs/19-notices.md

@@ -191,7 +191,11 @@ thread, no self-fresh, and auto-continuation genuinely resumed.
 A notice states who, which runtime, which error type, which model, and when the wall lifts.
 Two of those are **absent by design rather than guessed**:
 
-- **`resetsAtMs` on claude.** Claude does not say when a per-model bucket lifts. Its
+- **`resetsAtMs` on claude — only when stated.** An ACCOUNT-level wall (five-hour / weekly) IS
+  stated structurally on the refusal line (measured 18.10.2026, claude 2.1.302:
+  `quotaLimits.resetsAt` and `apiErrorParams.rate_limit_info.resetsAt`, epoch seconds,
+  `rateLimitType: "five_hour"`) — the notice carries it and §9 acts on it. A **per-model
+  bucket** states none: claude does not say when a per-model bucket lifts. Its
   `errorDetails` is a raw 429 reading *"Please try again later"* — no stamp. The 5h/7d
   `resets_at` in the statusline blob belongs to a **different limit** and must never be
   substituted: measured live on 15.07.2026, the 5h bucket sat at **11 %** and the 7d at
@@ -431,3 +435,38 @@ unanswered rather than inferred from the 429 result.**
 provider path could in principle record something this one did not.
 
 Artifacts (rollout, injector, config): `docs/internals/forensics/model-limit-2026-07-15/`.
+
+## 9. Limit-resume — a peer stopped by a limit continues by itself after the reset
+
+**Invariant.** A peer whose turn was stopped by an exhausted model limit that STATED its reset
+continues after that reset without a human. Incident 18.10.2026: the fleet hit the claude
+five-hour wall at 04:55; claude painted «resets 8:30am», the daemon idle-reaped the sessions at
+~05:55, nothing woke them after the reset and every peer stood still until a manual ping at 10:12.
+
+**Mechanism** (`lifecycle/limitpark.ts`, `daemon/limitresume.ts`):
+
+1. **Park.** A `peer-mute` detection that carries `resetsAtMs` writes one record per endpoint
+   (`state/lifecycle/limit-parks/<runtime>-<personality>.json`: reset, event time, session file).
+   A newer limit event supersedes it; the overlapping sweep re-reading the same line does not.
+   No stated reset → no park (the notice still tells the owner; nothing is extrapolated).
+2. **Hold.** While `now < resetsAt + 3 min` the idle-reap skips the session (`outcome=limit-hold`,
+   traced once per park): the context stays warm and the runtime's own continuation can fire.
+   Bounded: a reset more than 6 h after the event (a weekly wall) is not held — the session is
+   reaped normally and step 3 resumes it.
+3. **Nudge.** After `resetsAt + 3 min`, if the session made no progress since the event (claude: a
+   real, non-`<synthetic>` assistant line after it; codex: a `task_complete` with a message whose
+   `completed_at` is after it), the core delivers ONE continuation message through the normal
+   route — wake-on-miss resumes a reaped session (an idle reap is resume-eligible). Progress
+   already made → the park is dropped without a message (no duplicate turn). A failed delivery is
+   retried (5 min backoff, 3 attempts); an operator `stop` is never fought.
+4. **Sender** = the core's system identity `iapeer-system` (runtime `core`, intelligence
+   `absent`): synthesized, never registered, the name reserved by the registry — so it exists on
+   every install and is never the target (the target may be the peer named `iapeer` itself). The
+   same identity now signs the OC07 interrupted/undelivered notices and the composer-queue
+   failure notices.
+
+Every decision is in `lifecycle.log`: `ev=limit-park`, `outcome=limit-hold`, `ev=limit-resume
+outcome=nudged|progressed|retry|gave-up|dropped`.
+
+**Not covered:** opencode (its `session.error` states no reset) and a claude per-model bucket
+(no reset stated) — both still raise the notice; the owner resumes by hand.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.126",
+  "version": "0.4.127",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -1448,6 +1448,21 @@ export async function renamePeerCli(
       sideEffects.push(`claude .mcp.json: failed (${e instanceof Error ? e.message : String(e)})`)
     }
   }
+  if (peer.runtimes.includes('opencode')) {
+    // The opencode private dir is keyed by personality (docs/20): move it with the peer, or the endpoint
+    // loses its session (resume), journal history and provider/memory/capability fragments.
+    try {
+      const { opencodePrivateDir } = await import('../storage/index.ts')
+      const from = opencodePrivateDir(oldPersonality, { env })
+      const to = opencodePrivateDir(newPersonality, { env })
+      if (existsSync(from) && !existsSync(to)) {
+        renameSync(from, to)
+        sideEffects.push(`opencode private dir moved: ${to}`)
+      } else if (existsSync(from)) sideEffects.push(`opencode private dir NOT moved: ${to} already exists`)
+    } catch (e) {
+      sideEffects.push(`opencode private dir: failed (${e instanceof Error ? e.message : String(e)})`)
+    }
+  }
   const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, oldPersonality)))
   return { oldPersonality, newPersonality, action: 'renamed', oldCwd, newCwd, transcriptMoved, purgedState, sideEffects }
 }

package/src/core/constants.ts

@@ -237,3 +237,14 @@ export function isValidName(value: unknown): boolean {
 // module so the transliteration engine is swappable behind one interface; it is
 // re-exported here so existing `from '../core/constants.ts'` importers are unchanged.
 export { normalizeNameCandidate } from './normalize.ts'
+
+/**
+ * The CORE's own sender identity — the author of daemon-originated messages (OC07 interrupted /
+ * undelivered notices, the composer-queue failure outlet, the limit-resume nudge). It exists on EVERY
+ * install by construction: it is synthesized, never registered, so a host with no peer of any given
+ * name still gets its system notices (a registry-dependent sender was skipped silently there).
+ * The name is RESERVED: the registry refuses to register a peer under it, so it can never be spoofed
+ * by — or collide with — a real peer. Intelligence `absent`: a recipient does not answer it.
+ */
+export const SYSTEM_PERSONALITY = 'iapeer-system'
+export const SYSTEM_RUNTIME = 'core'

package/src/daemon/limitresume.ts

@@ -0,0 +1,98 @@
+// Limit-resume — the NUDGE half of the limit-park contract (lifecycle/limitpark.ts, docs/19 §9).
+//
+// Invariant: a peer stopped by an exhausted model limit mid-task continues by itself after the
+// stated reset — no human. Run after every supervise tick: for each park whose reset + grace has
+// passed, either the session already progressed (the runtime's own continuation fired, or a later
+// message got a real reply) → the park is dropped; or it did not → the core delivers ONE
+// continuation message through the normal route. Wake-on-miss resumes a reaped session (an idle
+// reap is resume-eligible), so the same message serves a held-alive and a reaped session.
+//
+// Sender = the core's system identity (identity/systemCaller): registry-independent, and never the
+// target — the target may well be the peer named `iapeer` itself (it was, on 18.10.2026).
+
+import type { LifecycleConfig } from '../lifecycle/index.ts'
+import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
+import {
+  LIMIT_MAX_NUDGE_ATTEMPTS,
+  LIMIT_RESUME_GRACE_MS,
+  clearLimitPark,
+  listLimitParks,
+  parkProgressed,
+  updateLimitPark,
+  type LimitPark,
+} from '../lifecycle/limitpark.ts'
+import { systemCaller } from '../identity/index.ts'
+import { routeSend, type RouteDeps } from '../transport/index.ts'
+
+/** Between two failed nudge attempts. */
+const RETRY_BACKOFF_MS = 5 * 60_000
+
+export function limitResumeMessage(p: LimitPark): string {
+  return (
+    `[iapeer] Your model limit (${p.errorType ?? 'rate limit'}) has reset — it lifted at ${new Date(p.resetsAtMs).toISOString()}. ` +
+    `Your previous turn was stopped by that limit at ${new Date(p.eventAtMs).toISOString()} and nothing has continued it since. ` +
+    `Resume the interrupted work from where it stopped (re-check its state first). ` +
+    `If that work is already finished, no reply is needed — this notice comes from the iapeer core, not a peer.`
+  )
+}
+
+export interface LimitResumeSeam {
+  send?: typeof routeSend
+  progressed?: (p: LimitPark) => boolean
+  now?: () => number
+}
+
+export async function processLimitResumes(
+  cfg: LifecycleConfig,
+  env: NodeJS.ProcessEnv,
+  routeDeps: RouteDeps,
+  seam: LimitResumeSeam = {},
+): Promise<void> {
+  const now = (seam.now ?? Date.now)()
+  const send = seam.send ?? routeSend
+  const progressed = seam.progressed ?? parkProgressed
+  const log = (fields: Record<string, string | number | undefined>): void => {
+    try {
+      appendLifecycleEvent(cfg.eventLogDir, { ev: 'limit-resume', ...fields }, { env })
+    } catch {
+      /* best-effort */
+    }
+  }
+  for (const p of listLimitParks(cfg)) {
+    if (now < p.resetsAtMs + LIMIT_RESUME_GRACE_MS) continue
+    if (p.lastAttemptMs && now - p.lastAttemptMs < RETRY_BACKOFF_MS) continue
+    let moved = false
+    try {
+      moved = progressed(p)
+    } catch {
+      moved = false
+    }
+    if (moved) {
+      clearLimitPark(cfg, p.identity)
+      log({ identity: p.identity, outcome: 'progressed', resets: new Date(p.resetsAtMs).toISOString() })
+      continue
+    }
+    let reason: string
+    try {
+      const r = await send(systemCaller(), { personality: p.personality, runtime: p.runtime, message: limitResumeMessage(p), topic: 'limit-resume' }, routeDeps)
+      if (r.ok) {
+        clearLimitPark(cfg, p.identity)
+        log({ identity: p.identity, outcome: 'nudged', woke: String(r.value.woke), resets: new Date(p.resetsAtMs).toISOString() })
+        continue
+      }
+      reason = r.error.message
+    } catch (e) {
+      reason = e instanceof Error ? e.message : String(e)
+    }
+    const attempts = (p.attempts ?? 0) + 1
+    // A deliberate operator halt (stopped) is not a transient — never fight it.
+    const permanent = /\bstopped\b|not in the iapeer peers index/.test(reason)
+    if (permanent || attempts >= LIMIT_MAX_NUDGE_ATTEMPTS) {
+      clearLimitPark(cfg, p.identity)
+      log({ identity: p.identity, outcome: permanent ? 'dropped' : 'gave-up', attempts, err: reason.slice(0, 300) })
+    } else {
+      updateLimitPark(cfg, { ...p, attempts, lastAttemptMs: now })
+      log({ identity: p.identity, outcome: 'retry', attempts, err: reason.slice(0, 300) })
+    }
+  }
+}

package/src/daemon/main.ts

@@ -51,9 +51,9 @@ import {
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { buildProcessAddress } from '../core/socket.ts'
 import { err, ok } from '../core/errors.ts'
-import { resolveCallerIdentity } from '../identity/index.ts'
+import { resolveCallerIdentity, systemCaller } from '../identity/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
-import { findPeer, readPeersIndex } from '../registry/index.ts'
+import { readPeersIndex } from '../registry/index.ts'
 import {
   createComposerDeliveryQueue,
   deliveryCompleted,
@@ -74,6 +74,8 @@ import { appendDeliveryEvent } from './deliverylog.ts'
 import { buildFleetHandler } from './fleet.ts'
 import { NoticeBoard } from './notices.ts'
 import { startMuteWatch } from './mutewatch.ts'
+import { processLimitResumes } from './limitresume.ts'
+import { recordLimitPark } from '../lifecycle/limitpark.ts'
 import { DEFAULT_PROFILE_SYNC_INTERVAL_MS, startProfileSync } from './profilesync.ts'
 import { startGoalWatch } from './goalwatch.ts'
 import { ActivityBoard, startTurnWatch } from './turnwatch.ts'
@@ -307,14 +309,12 @@ export async function processInflight(
 ): Promise<void> {
   const processed = seam.processed ?? ((e: InflightEntry) => deliveryProcessed(e, env))
   const send = seam.send ?? routeSend
-  /** A notice FROM iapeer to the entry's original sender (skipped when the sender is iapeer itself). */
+  /** A notice FROM the core's system identity to the entry's original sender. Registry-independent
+   *  (systemCaller is synthesized), so it is deliverable on every install — the earlier sender was the
+   *  peer named `iapeer`, and a host without it skipped the notice silently (linus 18.10). */
   const notifySender = async (e: InflightEntry, message: string): Promise<string> => {
     try {
-      const index = readPeersIndex({ env })
-      const self = findPeer(index, 'iapeer')
-      if (!self || `${e.caller.runtime}-${e.caller.personality}` === `${self.runtime}-iapeer`) return 'skipped'
-      const sender = resolveCallerIdentity({ personality: 'iapeer', runtime: self.runtime }, index)
-      const n = await send(sender, { personality: e.caller.personality, runtime: e.caller.runtime, message, topic: e.topic ?? 'delivery-failed' }, routeDeps)
+      const n = await send(systemCaller(), { personality: e.caller.personality, runtime: e.caller.runtime, message, topic: e.topic ?? 'delivery-failed' }, routeDeps)
       return String(n.ok)
     } catch {
       return 'false'
@@ -384,38 +384,9 @@ export function makeComposerQueueRouteDeps(cfg: LifecycleConfig, env: NodeJS.Pro
     noteInflight: makeNoteInflight(cfg),
     onDelivered,
     notifyFailed: async (job, reason) => {
-      const index = readPeersIndex({ env })
-      const self = findPeer(index, 'iapeer')
-      if (!self) {
-        appendDeliveryEvent(cfg.eventLogDir, {
-          ev: 'composer-queue-failed-notify',
-          caller: 'iapeer',
-          to: job.caller.personality,
-          rt: job.caller.runtime,
-          ok: 'false',
-          err: 'foundation peer "iapeer" is not registered; cannot notify queued sender',
-        })
-        return
-      }
-      const sender = resolveCallerIdentity({ personality: 'iapeer', runtime: self.runtime }, index)
-      // SELF-NOTIFY GUARD: the failure outlet sends FROM the foundation peer (iapeer). When the QUEUED
-      // sender IS the foundation peer on the same runtime (e.g. iapeer itself queued a cross-runtime send to
-      // its codex twin and that queue later failed), this notify would be iapeer→iapeer — a genuine
-      // self-send the address-based router correctly refuses with 'cannot send to self', logging ok=false
-      // and tripping monitoring alarms. The notification is moot anyway (the sender IS the one being
-      // notified about its own send). Skip it and log a benign skip instead of attempting a self-send.
-      if (`${job.caller.runtime}-${job.caller.personality}` === sender.address) {
-        appendDeliveryEvent(cfg.eventLogDir, {
-          ev: 'composer-queue-failed-notify',
-          caller: sender.address,
-          to: job.caller.personality,
-          rt: job.caller.runtime,
-          ok: 'true',
-          err: 'skipped self-notify (queued sender is the foundation peer itself)',
-          topic: job.topic ?? 'delivery-failed',
-        })
-        return
-      }
+      // The core's system identity — exists on every install and is never a peer, so there is no
+      // missing-sender case and no self-send to guard (it used to be the peer named `iapeer`).
+      const sender = systemCaller()
       const result = await routeSend(
         sender,
         {
@@ -508,6 +479,23 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
         appendLifecycleEvent(cfg.eventLogDir, { ev: 'mutewatch-error', error: detail.replace(/\s+/g, ' ').slice(0, 600) }, { env })
       } catch { /* best-effort */ }
     },
+    // Limit-park (docs/19 §9): a limit event that STATES its reset parks the endpoint — the supervise
+    // tick holds it from idle-reap and the limit-resume pass nudges it after the reset.
+    onLimit: d => {
+      const identity = `${d.runtime}-${d.personality}`
+      if (d.resetsAtMs === undefined) return
+      const fresh = recordLimitPark(cfg, {
+        identity,
+        personality: d.personality,
+        runtime: d.runtime,
+        resetsAtMs: d.resetsAtMs,
+        eventAtMs: d.atMs,
+        ...(d.file ? { file: d.file } : {}),
+        ...(d.sessionId ? { sessionId: d.sessionId } : {}),
+        errorType: d.errorType,
+      })
+      if (fresh) appendLifecycleEvent(cfg.eventLogDir, { ev: 'limit-park', identity, resets: new Date(d.resetsAtMs).toISOString(), error_type: d.errorType }, { env })
+    },
   })
   // Goal-watch (docs/19) — the SAME board and the same class as the mute-watch: a peer left
   // alive and green while the thing it was told to do quietly stopped. Separate detector
@@ -627,6 +615,16 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
           noteInflight,
           isLaunchdManaged: (personality: string) => isLaunchdManaged(personality, env),
         })
+        // Limit-resume (docs/19 §9): a peer stopped by a model limit continues after the reset.
+        await processLimitResumes(cfg, env, {
+          env,
+          wake: makeWakeFn(cfg, env),
+          ephemeral,
+          noteLiveTopic,
+          noteDelivered: identity => setLastDelivered(cfg, identity),
+          noteInflight,
+          isLaunchdManaged: (personality: string) => isLaunchdManaged(personality, env),
+        })
       },
       // Surface a supervise-tick throw that the daemon timer would otherwise SWALLOW (the class that
       // hid a stuck reaper for hours): record ev=supervise-error in lifecycle.log, flattened to one

package/src/daemon/mutewatch.ts

@@ -102,9 +102,11 @@ export interface MuteDetection {
   sessionId?: string
   atMs: number
   cwd: string
+  /** The session file the event was read from (the limit-park progress probe re-reads it). */
+  file?: string
 }
 
-type RawDetection = Omit<MuteDetection, 'personality' | 'runtime'>
+type RawDetection = Omit<MuteDetection, 'personality' | 'runtime' | 'file'>
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Pure parsers — string in, detection out (fs-free: tests need no temp tree)
@@ -165,12 +167,24 @@ export function parseClaudeTranscript(text: string, sinceMs: number): RawDetecti
       sessionId: typeof d.sessionId === 'string' ? d.sessionId : undefined,
       atMs,
       cwd,
-      // Claude states no reset for a per-model bucket → resetsAtMs deliberately absent.
+      // The reset ONLY when claude states it structurally (account-level walls, observed 18.10.2026 on
+      // claude 2.1.302: `quotaLimits.resetsAt` / `apiErrorParams.rate_limit_info.resetsAt`, epoch s,
+      // rateLimitType five_hour). A per-model bucket states none («try again later») → omitted, never
+      // extrapolated from the other buckets.
+      ...(claudeResetsAtMs(d) !== undefined ? { resetsAtMs: claudeResetsAtMs(d) } : {}),
     }
   }
   return found
 }
 
+/** Claude's structurally stated reset instant (ms), or undefined. Epoch SECONDS on the wire. */
+export function claudeResetsAtMs(d: Record<string, unknown>): number | undefined {
+  const q = d.quotaLimits as { resetsAt?: unknown } | undefined
+  const r = (d.apiErrorParams as { rate_limit_info?: { resetsAt?: unknown } } | undefined)?.rate_limit_info
+  const v = typeof q?.resetsAt === 'number' ? q.resetsAt : typeof r?.resetsAt === 'number' ? r.resetsAt : undefined
+  return v !== undefined && v > 0 ? v * 1000 : undefined
+}
+
 interface CodexWindow {
   used_percent?: unknown
   window_minutes?: unknown
@@ -463,21 +477,21 @@ export function resolveMuteWatchPaths(env: NodeJS.ProcessEnv): MuteWatchPaths {
 export function scanMuteEvents(deps: ScanDeps, sinceMs: number): MuteDetection[] {
   const floor = sinceMs - SCAN_OVERLAP_MS
   const out: MuteDetection[] = []
-  const push = (raw: RawDetection | null, runtime: 'claude' | 'codex'): void => {
+  const push = (raw: RawDetection | null, runtime: 'claude' | 'codex', file: string): void => {
     if (!raw) return
     const personality = deps.peerByCwd(raw.cwd)
     if (!personality) return // not a peer's session (a human's own shell) — never notify
-    out.push({ ...raw, personality, runtime })
+    out.push({ ...raw, personality, runtime, file })
   }
   // claude: ~/.claude/projects/<slug>/<sessionId>.jsonl — one level of slug dirs.
   for (const file of changedJsonl(deps.claudeProjectsDir, floor, 1)) {
     const t = readSessionSlices(file, TAIL_BYTES)
-    if (t) push(parseClaudeTranscript(t.tail, floor), 'claude')
+    if (t) push(parseClaudeTranscript(t.tail, floor), 'claude', file)
   }
   // codex: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl
   for (const file of changedJsonl(deps.codexSessionsDir, floor, CODEX_WALK_DEPTH)) {
     const t = readSessionSlices(file, TAIL_BYTES)
-    if (t) push(parseCodexRollout(t.tail, floor, t.head), 'codex')
+    if (t) push(parseCodexRollout(t.tail, floor, t.head), 'codex', file)
   }
   // opencode: the core-owned journal per endpoint (personality is known — no cwd mapping needed).
   for (const j of deps.opencodeJournals?.() ?? []) {
@@ -500,6 +514,8 @@ export interface MuteWatchDeps extends ScanDeps {
   now?: () => number
   /** Reported, never thrown — a detector must never take the daemon down. */
   onError?: (err: unknown) => void
+  /** Every detection that STATES a reset (deduped or not) — the limit-park writer (docs/19 §9). */
+  onLimit?: (d: MuteDetection) => void
 }
 
 /**
@@ -527,6 +543,13 @@ export function muteWatchTick(deps: MuteWatchDeps, sinceMs: number): { raised: n
         summary: `${d.personality} · ${d.runtime} — ${d.errorType}${d.model ? ` (${d.model})` : ''}`,
       })
       if (!deduped) raised += 1
+      if (d.resetsAtMs !== undefined && deps.onLimit) {
+        try {
+          deps.onLimit(d)
+        } catch (e) {
+          deps.onError?.(e)
+        }
+      }
     }
   } catch (e) {
     deps.onError?.(e)
@@ -543,6 +566,7 @@ export interface StartMuteWatchOptions {
   listPeers?: () => Array<{ personality: string; cwd: string; runtimes?: string[] }>
   now?: () => number
   onError?: (err: unknown) => void
+  onLimit?: (d: MuteDetection) => void
 }
 
 /**
@@ -579,6 +603,7 @@ export function startMuteWatch(cfg: LifecycleConfig, board: NoticeBoard, opts: S
         board,
         now,
         onError: opts.onError,
+        onLimit: opts.onLimit,
         peerByCwd: (cwd: string) => byCwd.get(cwd.replace(/\/+$/, '').toLowerCase()),
         opencodeJournals: () =>
           rows

package/src/identity/index.ts

@@ -11,6 +11,8 @@ import {
   IAPEER_DIR,
   PEER_PROFILE_FILE,
   NAME_RE,
+  SYSTEM_PERSONALITY,
+  SYSTEM_RUNTIME,
   allowedIntelligencesForRuntime,
   defaultIntelligenceForRuntime,
   isInfraRuntime,
@@ -781,6 +783,32 @@ export interface ResolvedCaller {
   record: PeerRecord
 }
 
+/**
+ * The core's own sender (core/constants SYSTEM_PERSONALITY). Synthesized — never read from the
+ * registry — so daemon-originated notices are deliverable on every install, independent of which
+ * peers happen to be registered. Never a request identity: resolveCallerIdentity refuses it (the
+ * name cannot be registered), so no client can send AS the core.
+ */
+export function systemCaller(): ResolvedCaller {
+  const record: PeerRecord = {
+    personality: SYSTEM_PERSONALITY,
+    runtime: SYSTEM_RUNTIME,
+    runtimes: [SYSTEM_RUNTIME],
+    description: 'iapeer core — system notices (no reply needed)',
+    intelligence: 'absent',
+    cwd: '',
+  }
+  return {
+    personality: SYSTEM_PERSONALITY,
+    runtime: SYSTEM_RUNTIME,
+    address: buildProcessAddress(SYSTEM_RUNTIME, SYSTEM_PERSONALITY),
+    description: record.description,
+    intelligence: 'absent',
+    cwd: '',
+    record,
+  }
+}
+
 /**
  * Resolve a caller identity carried IN THE REQUEST (X-IAPeer-Identity), against
  * the registry only. Deliberately does NOT read process.cwd(), process.env, or

package/src/lifecycle/index.ts

@@ -12,6 +12,7 @@
 // before any wake or reap. wakeOrSpawn refuses a launchd peer; superviseTick and
 // sweepZombies skip it. Only daemon-owned (no-plist) peers are managed here.
 
+import { limitHoldActive } from './limitpark.ts'
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
@@ -1520,6 +1521,18 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
     }
   }
   if (ageSecs > cfg.idleSecs) {
+    // LIMIT HOLD (docs/19 §9) — a session stopped by an exhausted model limit that STATED its reset is
+    // not idle, it is waiting: keep it (warm context; the runtime's own continuation gets to fire) until
+    // the reset + grace. Bounded in limitpark.ts; past the bound the reap proceeds and the limit-resume
+    // nudge wakes it (an idle reap is resume-eligible) — either way the turn is not lost.
+    const held = limitHoldActive(cfg, s.identity, nowMs)
+    if (held) {
+      // Traced ONCE per park (the tick runs every minute; a 3 h hold would flood lifecycle.log).
+      const key = `${s.identity}@${held.eventAtMs}`
+      if (verbose || !limitHoldTraced.has(key)) trace({ identity: s.identity, action: 'alive', age: `${ageSecs}s`, outcome: 'limit-hold', resets: new Date(held.resetsAtMs).toISOString() })
+      limitHoldTraced.add(key)
+      return { identity: s.identity, action: 'alive', reason: `limit hold until ${new Date(held.resetsAtMs).toISOString()}` }
+    }
     // THE ONLY place .idle-reaped is written: this is the one death the daemon
     // INITIATES. Its presence on the next wake = the session was parked cleanly =
     // RESUME-eligible (resolveWakeMode branch 3b). A crash/self-close (the dead
@@ -1536,6 +1549,9 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   return { identity: s.identity, action: 'alive' }
 }
 
+/** Parks whose hold was already traced (process-local; a daemon restart re-traces once — harmless). */
+const limitHoldTraced = new Set<string>()
+
 export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): SuperviseOutcome[] {
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()

package/src/lifecycle/limitpark.ts

@@ -0,0 +1,163 @@
+// Limit-park — a peer whose turn was stopped by an exhausted model limit must CONTINUE on its own
+// once the limit lifts (docs/19 §9). Incident 18.10.2026: the fleet hit the claude five-hour limit
+// at 04:55; claude painted «resets 8:30am» in the pane, the daemon idle-reaped the sessions an hour
+// later, nothing woke them after the reset, and every peer stood still until a human pinged it.
+//
+// TWO HALVES, one record per endpoint (identity = <runtime>-<personality>):
+//   • HOLD — while a park is live (now < resetsAt + grace) superviseTick does NOT idle-reap the
+//     session. The context stays warm and a runtime that resumes by itself (claude's own «Continuing
+//     automatically») gets the chance to. Bounded by MAX_HOLD_MS: a weekly wall is not worth a
+//     process held for days — beyond it the session is reaped normally and the nudge resumes it.
+//   • NUDGE — after resetsAt + grace, if the session made NO progress since the limit event, the
+//     daemon delivers a continuation message (daemon/limitresume.ts). Wake-on-miss resumes a reaped
+//     session (an idle reap is resume-eligible), so the nudge works whether the hold applied or not.
+//
+// The record is written by the mute-watch on a structural limit event that STATES a reset time —
+// never extrapolated: no resetsAt, no park (the notice still tells the owner). A newer limit event
+// for the same endpoint replaces the record (each event earns exactly one nudge).
+
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import type { LifecycleConfig } from './index.ts'
+import { writeFileAtomic } from '../storage/index.ts'
+import { readSessionSlices } from '../daemon/sessionfiles.ts'
+
+/** Wait this long past the stated reset before nudging: the runtime's own continuation (and a clock
+ *  skew between the provider and this host) gets to win first. */
+export const LIMIT_RESUME_GRACE_MS = 3 * 60_000
+/** The hold never keeps a session alive longer than this past the limit event. */
+export const LIMIT_MAX_HOLD_MS = 6 * 60 * 60_000
+/** A failed nudge is retried at most this many times (then the park is dropped, logged). */
+export const LIMIT_MAX_NUDGE_ATTEMPTS = 3
+
+export interface LimitPark {
+  identity: string
+  personality: string
+  runtime: string
+  /** The runtime's own stated reset instant. */
+  resetsAtMs: number
+  /** The limit event's own time (transcript timestamp / codex completed_at). */
+  eventAtMs: number
+  /** The session file the event was read from — the progress probe re-reads it. */
+  file?: string
+  sessionId?: string
+  errorType?: string
+  attempts?: number
+  lastAttemptMs?: number
+}
+
+const DIR = 'limit-parks'
+
+function parkPath(cfg: LifecycleConfig, identity: string): string {
+  return join(cfg.stateDir, DIR, `${identity}.json`)
+}
+
+export function readLimitPark(cfg: LifecycleConfig, identity: string): LimitPark | null {
+  try {
+    const p = JSON.parse(readFileSync(parkPath(cfg, identity), 'utf8')) as LimitPark
+    return typeof p.resetsAtMs === 'number' && typeof p.eventAtMs === 'number' ? p : null
+  } catch {
+    return null
+  }
+}
+
+/** Record (or supersede) a park. Returns false when an equal-or-newer event is already recorded —
+ *  the overlapping mute-watch window re-reads the same line every sweep. */
+export function recordLimitPark(cfg: LifecycleConfig, park: LimitPark): boolean {
+  const cur = readLimitPark(cfg, park.identity)
+  if (cur && cur.eventAtMs >= park.eventAtMs) return false
+  mkdirSync(join(cfg.stateDir, DIR), { recursive: true, mode: 0o700 })
+  writeFileAtomic(parkPath(cfg, park.identity), `${JSON.stringify({ ...park, attempts: 0 })}\n`)
+  return true
+}
+
+export function updateLimitPark(cfg: LifecycleConfig, park: LimitPark): void {
+  mkdirSync(join(cfg.stateDir, DIR), { recursive: true, mode: 0o700 })
+  writeFileAtomic(parkPath(cfg, park.identity), `${JSON.stringify(park)}\n`)
+}
+
+export function clearLimitPark(cfg: LifecycleConfig, identity: string): void {
+  try {
+    rmSync(parkPath(cfg, identity), { force: true })
+  } catch {
+    /* already gone */
+  }
+}
+
+export function listLimitParks(cfg: LifecycleConfig): LimitPark[] {
+  const dir = join(cfg.stateDir, DIR)
+  if (!existsSync(dir)) return []
+  const out: LimitPark[] = []
+  for (const name of readdirSync(dir)) {
+    if (!name.endsWith('.json')) continue
+    const p = readLimitPark(cfg, name.slice(0, -'.json'.length))
+    if (p) out.push(p)
+  }
+  return out
+}
+
+/** True while superviseTick must NOT idle-reap this identity: a live park whose reset (plus grace)
+ *  has not arrived yet and whose hold is within the bound. */
+export function limitHoldActive(cfg: LifecycleConfig, identity: string, nowMs: number): LimitPark | null {
+  const p = readLimitPark(cfg, identity)
+  if (!p) return null
+  if (nowMs >= p.resetsAtMs + LIMIT_RESUME_GRACE_MS) return null
+  if (p.resetsAtMs - p.eventAtMs > LIMIT_MAX_HOLD_MS) return null
+  return p
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Progress probe — did the session do real work AFTER the limit event?
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Claude: a REAL assistant reply (model ≠ "<synthetic>", which is the refusal itself) stamped after
+ *  the event. A new limit refusal is not progress — it supersedes the park instead. */
+export function claudeProgressedSince(text: string, eventAtMs: number): boolean {
+  for (const line of text.split('\n')) {
+    const s = line.trim()
+    if (!s.startsWith('{') || !s.includes('"assistant"')) continue
+    let d: { type?: unknown; timestamp?: unknown; isApiErrorMessage?: unknown; message?: { model?: unknown } }
+    try {
+      d = JSON.parse(s)
+    } catch {
+      continue
+    }
+    if (d.type !== 'assistant' || d.isApiErrorMessage === true) continue
+    const model = d.message?.model
+    if (typeof model !== 'string' || !model || model === '<synthetic>') continue
+    const at = typeof d.timestamp === 'string' ? Date.parse(d.timestamp) : NaN
+    if (Number.isFinite(at) && at > eventAtMs) return true
+  }
+  return false
+}
+
+/** Codex: a turn that COMPLETED with a message after the event. Keyed on completed_at (replay-safe:
+ *  a resumed rollout re-stamps line timestamps but keeps completed_at — see mutewatch.ts). */
+export function codexProgressedSince(text: string, eventAtMs: number): boolean {
+  for (const line of text.split('\n')) {
+    const s = line.trim()
+    if (!s.startsWith('{') || !s.includes('task_complete')) continue
+    let d: { payload?: { type?: unknown; last_agent_message?: unknown; completed_at?: unknown } }
+    try {
+      d = JSON.parse(s)
+    } catch {
+      continue
+    }
+    const p = d.payload
+    if (!p || p.type !== 'task_complete') continue
+    if (typeof p.last_agent_message !== 'string' || !p.last_agent_message) continue
+    if (typeof p.completed_at === 'number' && p.completed_at * 1000 > eventAtMs) return true
+  }
+  return false
+}
+
+/** Did the parked session progress since its limit event? Unknown (no file / unreadable) → false:
+ *  the nudge is cheap and a missed continuation is exactly the defect this exists for. */
+export function parkProgressed(park: LimitPark): boolean {
+  if (!park.file) return false
+  const t = readSessionSlices(park.file, 512 * 1024)
+  if (!t) return false
+  if (park.runtime === 'claude') return claudeProgressedSince(t.tail, park.eventAtMs)
+  if (park.runtime === 'codex') return codexProgressedSince(t.tail, park.eventAtMs)
+  return false
+}

package/src/registry/index.ts

@@ -18,6 +18,7 @@ import {
   MAX_DESCRIPTION_LEN,
   PEERS_PROFILES_FILE,
   PEERS_SCHEMA_VERSION,
+  SYSTEM_PERSONALITY,
   defaultIntelligenceForRuntime,
   isIntelligence,
   isRuntime,
@@ -120,6 +121,9 @@ function ensurePersonality(personality: string): void {
       `invalid personality "${personality}" — must match /^[a-z][a-z0-9-]{0,31}$/`,
     )
   }
+  if (personality === SYSTEM_PERSONALITY) {
+    throw new IapError(`personality "${personality}" is reserved for the iapeer core's own sender identity`)
+  }
 }
 
 function ensureRuntime(runtime: string): Runtime {