@agfpd/iapeer 0.4.133 → 0.4.135

package/docs/04-lifecycle-and-daemon.md

@@ -23,11 +23,12 @@ Once a minute the daemon runs a supervisory pass. In one tick it sleeps agents i
 
 ## Peer states
 
-A claude/codex agent is, at any moment, in one of three states:
+A hosted agent is, at any moment, in one of four states:
 
 | State | What it means | Marker in `iapeer list` |
 |---|---|---|
 | **alive** | the session is running and answering | `●` |
+| **booting** | the supervisor is up, but this runtime hosting has not passed readiness | `◐` |
 | **asleep** | no session, the peer is ready to wake on a message | `○` |
 | **stopped** | the operator set a stop flag; the daemon won't wake it | `✕` |
 
@@ -101,6 +102,24 @@ So `stop`, `start`, `new` refuse to touch foreign launchd peers — for those th
 ### Process ownership at teardown
 
 Closing a hosted session is a **hard teardown**, not the MCP client's graceful stdin/EOF shutdown.
+Core-controlled termination first fsyncs a write-ahead `termination-request` (or a multi-target
+`termination-batch`) to `<supervisorRunDir>/terminations.log`, with caller identity/UID, caller PID
+and parent PID, target identity/PID/start token and reason. Failure to persist the audit refuses the
+signal. Stop-all, uninstall and infra-update record their scope before the first termination.
+Signals from external programs bypass this primitive: `shutdown-sigterm` in `exits.log` alone does
+not identify their sender. The supervisor's JavaScript signal handler cannot recover that attribution.
+
+The supervision process namespace is bound to `LifecycleConfig.supervisorRunDir`, not re-resolved
+from an invocation's environment. A partial config without that path uses a private subdirectory of
+its own `stateDir`. Under `IAPEER_TEST_SANDBOX=1`, the signal primitive also refuses the real host's
+supervisor run-dir (including symlink aliases).
+
+Readiness is specific to one hosting token. A never-ready process is not deliverable, even if its
+TTY echoes input. The launcher tears it down on its readiness deadline; a later message can replace
+an abandoned never-ready hosting under the wake lock. Process-control verbs can still address it.
+Migration of existing agent sessions checks their current host emulator (or native control ping),
+not old pane-log bytes and not merely a live PID.
+
 Before killing the runtime, the supervisor snapshots its descendants and kills those still attached
 to its controlling PTY, including stdio MCP launchers in separate process groups. Each PID's start
 token and terminal are re-checked before signalling; unrelated processes and detached daemon branches

package/docs/12-cli-reference.md

@@ -77,7 +77,7 @@ The full list of `iapeer <command>`. General rules: `--help` / `-h` anywhere in
 |---|---|
 | `enable <plugin> [peer] [--no-setup]` | Install and enable a capability plugin for a peer (across runtimes), run its setup step. |
 | `native-memory <off\|on> (--peer <p> \| --all)` | Turn off/restore a peer's runtimes' native memory. |
-| `trust-hooks <hooks.json> [--check]` | Pre-trust codex hooks from a file (without the modal). `--check` — a divergence report. |
+| `trust-hooks <hooks.json> [--check]` | Pre-trust codex hooks from a file (without the modal). `--check` — a divergence report. The core also re-asserts the trust of `<cwd>/.codex/hooks.json` on EVERY codex launch (idempotent), and `rename` / `approval-mode yolo` restore what must stay trusted — a codex peer boots to its input with no human even after its trust was wiped (18.10). |
 
 ## Agent self-calls
 

package/docs/14-configuration-and-logs.md

@@ -83,6 +83,7 @@ The daemon keeps three durable logs in `~/.iapeer/logs/iapeer/`:
 - **`lifecycle.log`** — lifecycle decisions: wakes, sleeps, restarts, supervisory-tick outcomes. The first place to look if a peer is behaving wrong.
 - **`delivery.log`** — the outcome of each delivery: who, to whom, into which runtime, the result, sizes, topic. Metadata only — **the message body is not written**.
 - **`exits.log`** — session deaths with postmortem data: the supervisor records the cause (exit code / signal) at the moment a session dies.
+- **`~/.iapeer/state/supervisor/terminations.log`** — strict write-ahead attribution of core-controlled termination: caller/UID, PID/parent PID, target scope/PID/start token, reason. Appended and fsynced before signalling; inability to write refuses the signal. Batch scope is recorded before stop-all, uninstall and infra-update. No entry means an external signal is unattributed, not evidence of any particular initiator. This audit follows the configured supervisor run-dir, including isolated tests.
 
 Per-peer **pane-logs** live separately under `~/.iapeer/logs/lifecycle/<runtime>-<peer>.log` — the raw terminal (pty) byte stream the supervisor appends for a session's whole life (occupancy/typing detection, the boot ready-gate, and `tail`-based monitors read them). They are rotated on the supervise tick by **copytruncate** (`IAPEER_PANELOG_MAX_BYTES` × `IAPEER_PANELOG_KEEP`, default 16 MiB × 2): the base file keeps its path and inode (its last 8 MiB tail is retained in place, so the live writer and every reader are undisturbed) while the preceding window is promoted to `<log>.1` … `.N`. Total per peer is bounded by roughly `MAX_BYTES × (KEEP + 1)`.
 

package/docs/15-fleet-api.md

@@ -77,7 +77,7 @@ The full fleet state. The peer rows are produced by the **same in-process functi
 
 Field notes:
 
-- `runtimes[].status` — `live` (session up) · `asleep` (wakeable on demand) · `stopped` (operator stop flag; the daemon won't wake it). Same glyph semantics as the CLI: `●` / `○` / `✕`.
+- `runtimes[].status` — `live` (runtime passed readiness in this hosting) · `booting` (supervisor up, runtime never reached ready) · `asleep` (wakeable on demand) · `stopped` (operator stop flag; the daemon won't wake it). Same glyph semantics as the CLI: `●` / `◐` / `○` / `✕`. `booting` is not a working session or a successful delivery; clients must not display it as `live`. Process controls can still address it. Added as a status value without changing the snapshot structure.
 - `runtimes[].agent` — **agent-endpoint discovery**: `true` iff this declared runtime is an agent runtime the running core can host (listed in `host.agent_runtimes`). A channel that offers a personality's agent endpoints (a Telegram menu, a web picker) offers exactly its `agent: true` runtimes — never a consumer-side runtime list, never a `which`/PATH probe. A declared runtime the core cannot host (a newer peer profile on an older core) is `false` and is not offered. A channel runtime (`telegram`, `web`, …) is always `false`. Additive: a pre-discovery daemon omits it — clients MUST then fall back to treating no runtime as discoverable rather than guessing. Which endpoint a send reaches is a separate rule: an omitted runtime is always `default_runtime` (config-anchored, never «the live one»); a control action for the same dialogue must name the same runtime its send used.
 - `runtimes[].private_dir` — the core-owned private directory of this endpoint (docs/20: the OpenCode journal, state and provider fragments), present only for a runtime that has one (today `opencode`). An observer that the core does not launch (a console, a collector) reads the path HERE or from `iapeer private-dir <peer> [--runtime r]` — it never derives the layout from the root. Additive.
 - `runtimes[].model` — the `provider/model` the endpoint ACTUALLY used for its last assistant turn, as the runtime itself reports it (today `opencode`, from its state; docs/20 §Provider pinning). Absent until a first turn. Lets an operator see an implicit default provider. Additive.

package/docs/20-opencode.md

@@ -232,6 +232,10 @@ process was SIGKILLed before any answer, and the fresh next session never saw it
   dies with the turn unfinished, the sender gets an explicit notice from iapeer
   («the turn was INTERRUPTED and its result is not guaranteed»), logged as
   `ev=inflight-interrupted`.
+  Several messages injected into one unfinished hosting are summarized in one notice per original
+  sender endpoint, listing every affected delivery; different hosting tokens and senders remain
+  separate. An outbound reply alone is not a terminal boundary. Completed native turns are removed
+  from the ledger before notification grouping, so destroying a finished session emits no notice.
 - Unknown is not failed. When a live receiver's acceptance record does not appear
   within the confirm window (a busy claude records a queued message late), the
   send returns `ok` with `unconfirmed: true` instead of «NOT delivered» — the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.133",
+  "version": "0.4.135",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",
@@ -35,6 +35,8 @@
     "bin",
     "docs",
     "scripts/proof-install-signature.ts",
+    "scripts/proof-fleet-isolation.ts",
+    "scripts/proof-inflight-turns.ts",
     "CHANGELOG.md",
     "tsconfig.json",
     "!src/**/*.test.ts",

package/scripts/proof-fleet-isolation.ts

@@ -0,0 +1,71 @@
+// Live, isolated reproduction of the 18.10 test-suite SIGTERM incident.
+// bun scripts/proof-fleet-isolation.ts [--expect-legacy-failure]
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { startSupervisorDaemon, killSession, sessionAlive } from '../src/supervisor/index.ts'
+import { loadLifecycleConfig, superviseTick } from '../src/lifecycle/index.ts'
+import { upsertPeer } from '../src/registry/index.ts'
+import { fileURLToPath } from 'node:url'
+
+const root = mkdtempSync(join(tmpdir(), 'iap-isolation-'))
+const foreign = join(root, 'foreign')
+const own = join(root, 'own')
+const runDir = join(foreign, 'state/supervisor')
+const env = { ...process.env, IAPEER_ROOT: foreign, IAPEER_LAUNCHAGENTS_DIR: join(own, 'LaunchAgents') }
+const cfg = loadLifecycleConfig({ ...env, IAPEER_ROOT: own, IAPEER_BOOT_DEADLINE_SECS: '1', IAPEER_READY_GATE_SECS: '1' })
+const ids = ['claude-sentinel', 'telegram-sentinel', 'notifier-sentinel']
+const arg = (name: string) => { const i = process.argv.indexOf(name); return i < 0 ? undefined : process.argv[i + 1] }
+const bin = arg('--bin')
+const artifacts = arg('--artifacts')
+const pids: Record<string, number | undefined> = {}
+const legacyFile = fileURLToPath(new URL(`../src/lifecycle/.proof-legacy-${process.pid}.ts`, import.meta.url))
+mkdirSync(cfg.stateDir, { recursive: true })
+try {
+  for (const session of ids) {
+    const r = await startSupervisorDaemon({ session, runtime: session.split('-')[0]!, runDir,
+      ...(bin ? { daemonArgv: [bin, 'supervisor'] } : {}),
+      serve: { argv: ['/bin/sleep', '600'], env: {}, cwd: root, exitLogPath: join(root, 'exits.log') } })
+    if (r.state !== 'started') throw new Error(JSON.stringify(r))
+    pids[session] = r.pid
+  }
+  // Exactly the problematic shape: cfg is isolated, env points at another fleet; no liveness seam.
+  let sweep = superviseTick
+  if (process.argv.includes('--replay-legacy-resolver')) {
+    // Re-run the actual sweep with ONLY its namespace selection restored to the incident's env
+    // resolution. Both fleets are created above, never supplied by the caller. Audit stays enabled.
+    const source = readFileSync(fileURLToPath(new URL('../src/lifecycle/index.ts', import.meta.url)), 'utf8')
+    const fixed = "const runDir = cfg.supervisorRunDir ?? join(cfg.stateDir, 'supervisor')"
+    if (!source.includes(fixed)) throw new Error('legacy replay patch no longer matches source')
+    writeFileSync(legacyFile, "import { hostRunDir } from '../launch/ptyHost.ts'\n" + source.replace(fixed, 'const runDir = hostRunDir(env)'))
+    sweep = (await import(legacyFile)).superviseTick
+  }
+  const outcomes = sweep(cfg, { env, nowMs: Date.now() + 3600_000 })
+  await Bun.sleep(1500)
+  const dead = ids.filter(id => !sessionAlive(runDir, id))
+  const read = (path: string) => { try { return readFileSync(path, 'utf8') } catch { return '' } }
+  const result: Record<string, unknown> = { pids, outcomes, foreignKilled: dead, exits: read(join(root, 'exits.log')) }
+  if (process.argv.includes('--expect-legacy-failure') ? dead.length !== ids.length : dead.length !== 0) throw new Error('isolation invariant failed')
+  if (bin && dead.length === 0) {
+    await upsertPeer({ personality: 'sentinel', runtime: 'claude', runtimes: ['claude', 'telegram', 'notifier'], cwd: root, intelligence: 'artificial' }, { rootDir: foreign })
+    const stop = Bun.spawn([bin, 'stop', 'sentinel', 'claude'], { env: { ...env, PEER_IDENTITY: 'test-operator' }, stdout: 'pipe', stderr: 'pipe' })
+    const code = await stop.exited
+    result.stop = { code, stdout: await new Response(stop.stdout).text(), stderr: await new Response(stop.stderr).text() }
+    await Bun.sleep(1000)
+    result.afterTargetedStop = Object.fromEntries(ids.map(id => [id, sessionAlive(runDir, id)]))
+    if (code || sessionAlive(runDir, ids[0]!) || ids.slice(1).some(id => !sessionAlive(runDir, id))) throw new Error('installed stop affected foreign endpoint')
+  }
+  result.audit = read(join(runDir, 'terminations.log'))
+  result.exits = read(join(root, 'exits.log'))
+  if (artifacts) {
+    mkdirSync(artifacts, { recursive: true })
+    writeFileSync(join(artifacts, 'result.json'), JSON.stringify(result, null, 2) + '\n')
+  }
+  console.log(JSON.stringify(result, null, 2))
+  console.log(dead.length ? 'REPRODUCED: cfg-only sandbox killed foreign supervisors' : 'PASS: foreign supervisors survived the real sweep')
+} finally {
+  for (const id of ids) killSession(runDir, id)
+  await Bun.sleep(1000)
+  rmSync(root, { recursive: true, force: true })
+  rmSync(legacyFile, { force: true })
+}

package/scripts/proof-inflight-turns.ts

@@ -0,0 +1,89 @@
+// Real OpenCode + synthetic streaming provider, isolated root. No cloud calls or fleet traffic.
+// OPENCODE_BIN=... bun scripts/proof-inflight-turns.ts --seed-config <opencode config dir> [--keep]
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+const bin = process.env.OPENCODE_BIN
+if (!bin || !existsSync(bin)) throw new Error('set OPENCODE_BIN')
+const root = mkdtempSync('/tmp/iap-inflight-live-')
+const home = join(root, 'home')
+const env = { PATH: process.env.PATH, HOME: home, IAPEER_ROOT: join(root, 'iapeer'), IAPEER_PORT: '9',
+  IAPEER_OPENCODE_BIN: bin, XDG_CONFIG_HOME: join(home, 'config'), XDG_DATA_HOME: join(home, 'data'),
+  XDG_CACHE_HOME: join(home, 'cache'), XDG_STATE_HOME: join(home, 'state'),
+  OPENCODE_DISABLE_DEFAULT_PLUGINS: 'true', OPENCODE_DISABLE_MODELS_FETCH: 'true', HOMEBREW_NO_AUTO_UPDATE: '1' }
+mkdirSync(home, { recursive: true })
+const seed = process.argv.indexOf('--seed-config')
+if (seed >= 0) cpSync(process.argv[seed + 1]!, join(home, 'config/opencode'), { recursive: true })
+for (const k of Object.keys(process.env)) delete process.env[k]
+Object.assign(process.env, env)
+const { initPeer } = await import('../src/init/index.ts')
+const { loadLifecycleConfig, wakeOrSpawn } = await import('../src/lifecycle/index.ts')
+const { routeSend, deliveryProcessed, deliveryCompleted } = await import('../src/transport/index.ts')
+const { makeNoteInflight, processInflight } = await import('../src/daemon/main.ts')
+const { readInflight } = await import('../src/lifecycle/inflight.ts')
+const { opencodePaths } = await import('../src/opencode/config.ts')
+const { killPtyHost, hostSessionAlive } = await import('../src/launch/ptyHost.ts')
+const { ok } = await import('../src/core/errors.ts')
+const cfg = loadLifecycleConfig(env)
+const personality = 'turn-proof', identity = `opencode-${personality}`, cwd = join(root, personality)
+mkdirSync(cwd, { recursive: true })
+let hanging = false
+const provider = Bun.serve({ hostname: '127.0.0.1', port: 0, async fetch(req) {
+  await req.json()
+  const chunk = (delta: unknown, finish: string | null) => 'data: ' + JSON.stringify({ id: 'proof', object: 'chat.completion.chunk', created: 1, model: 'synthetic', choices: [{ index: 0, delta, finish_reason: finish }] }) + '\n\n'
+  const initial = chunk({ role: 'assistant', content: hanging ? 'STILL WORKING' : 'FINISHED' }, null)
+  return new Response(hanging ? new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode(initial)) } }) : initial + chunk({}, 'stop') + 'data: [DONE]\n\n', { headers: { 'Content-Type': 'text/event-stream' } })
+} })
+const notices: string[] = []
+const sink = (async (_caller: unknown, input: { message: string; personality: string }) => {
+  notices.push(input.message)
+  return ok({ ok: true, delivered_to: { personality: input.personality, runtime: 'codex' }, woke: false, ts: 'x' })
+}) as never
+const until = async (what: string, f: () => boolean) => {
+  for (let i = 0; i < 300; i++) { if (f()) return; await Bun.sleep(100) }
+  throw new Error(`timeout: ${what}`)
+}
+const snapshots: unknown[] = []
+let success = false
+try {
+  await initPeer({ cwd, runtime: 'opencode', personality, intelligence: 'artificial', env })
+  const paths = opencodePaths(personality, { env })
+  mkdirSync(paths.dir, { recursive: true })
+  writeFileSync(paths.config, JSON.stringify({ model: 'synthetic/synthetic', small_model: 'synthetic/synthetic', enabled_providers: ['synthetic'], provider: {
+    synthetic: { npm: '@ai-sdk/openai-compatible', name: 'Synthetic', options: { baseURL: provider.url.toString() + 'v1', apiKey: 'x' }, models: { synthetic: { name: 'Synthetic', limit: { context: 100000, output: 1000 } } } },
+  } }))
+  const caller = { personality: 'sender', runtime: 'codex', address: 'codex-sender', intelligence: 'artificial', cwd, description: '', record: { personality: 'sender', runtime: 'codex', runtimes: ['codex'], intelligence: 'artificial', cwd } } as never
+  const deps = { env, wake: (args: never) => wakeOrSpawn(args, { cfg, env }), noteInflight: makeNoteInflight(cfg) }
+  const send = async (message: string) => {
+    const r = await routeSend(caller, { personality, runtime: 'opencode', message }, deps)
+    if (!r.ok) throw r.error
+    return r.value
+  }
+  snapshots.push({ phase: 'finished-send', ack: await send('FINISHED_TURN_PROOF') })
+  await until('native terminal record', () => readInflight(cfg.stateDir, identity).some(e => deliveryCompleted(e, env)))
+  snapshots.push({ phase: 'native-completed', entries: readInflight(cfg.stateDir, identity).map(e => ({ id: e.id, processed: deliveryProcessed(e, env), completed: deliveryCompleted(e, env) })) })
+  // Do not sweep before killing: completion must still be recognized after the receiver is gone.
+  killPtyHost(identity, env, { reason: 'proof-kill-after-native-completion' })
+  await until('finished receiver gone', () => !hostSessionAlive(identity, env))
+  await processInflight(cfg, env, deps, { send: sink })
+  if (notices.length || readInflight(cfg.stateDir, identity).length) throw new Error('finished turn generated notice or retained ledger')
+  snapshots.push({ phase: 'kill-after-finish', noticeCount: notices.length })
+
+  hanging = true
+  snapshots.push({ phase: 'mid-send', ack: await send('UNFINISHED_TURN_PROOF') })
+  await until('native assistant starts without terminal', () => readInflight(cfg.stateDir, identity).some(e => deliveryProcessed(e, env) && !deliveryCompleted(e, env)))
+  snapshots.push({ phase: 'native-unfinished', entries: readInflight(cfg.stateDir, identity).map(e => ({ id: e.id, processed: deliveryProcessed(e, env), completed: deliveryCompleted(e, env) })) })
+  killPtyHost(identity, env, { reason: 'proof-kill-during-native-stream' })
+  await until('unfinished receiver gone', () => !hostSessionAlive(identity, env))
+  await processInflight(cfg, env, deps, { send: sink })
+  await processInflight(cfg, env, deps, { send: sink })
+  if (notices.length !== 1 || !notices[0]!.includes('INTERRUPTED')) throw new Error(`expected one notice, got ${notices.length}`)
+  snapshots.push({ phase: 'kill-mid-turn-two-sweeps', noticeCount: notices.length, notices })
+  success = true
+} finally {
+  killPtyHost(identity, env, { reason: 'proof-cleanup' })
+  provider.stop(true)
+  writeFileSync(join(root, 'result.json'), JSON.stringify({ success, codeSource: import.meta.url, snapshots }, null, 2))
+  console.log(JSON.stringify({ root, success, snapshots }, null, 2))
+  await Bun.sleep(300)
+  if (success && !process.argv.includes('--keep')) rmSync(root, { recursive: true, force: true })
+}

package/src/approval/install.ts

@@ -161,6 +161,10 @@ export function removeCodexApproval(cwd: string, env: NodeJS.ProcessEnv = proces
     return path
   }
   writeFileAtomic(path, `${JSON.stringify(obj, null, 2)}\n`, 0o644)
+  // The trust wipe above is cwd-wide (codex keys state POSITIONALLY, so removing our group shifts the
+  // others' keys). Re-seed whatever hooks REMAIN — the memory provider's among them — or the next codex
+  // boot stops at «hooks need review» (incident 18.10).
+  preSeedCodexHooksTrust(path, env)
   return path
 }
 

package/src/cli/index.ts

@@ -26,9 +26,11 @@ import { cascadeTail, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaem
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
+import { auditTermination } from '../supervisor/index.ts'
 import {
   compactDoneBaseline,
   isPeerLive,
+  isPeerReady,
   purgeAttachmentInbox,
   routeControl,
   routeSend,
@@ -106,7 +108,9 @@ function infraRecycleFailed(infra: readonly { state: string }[] | undefined): bo
 // list — registry + per-runtime liveness (contract Примитивы §list)
 // ─────────────────────────────────────────────────────────────────────────────
 
-export type RuntimeLiveness = 'live' | 'asleep' | 'stopped'
+/** `booting` — the process is up but its runtime never reached its ready surface (yet, or ever: a
+ *  process hung before main, 18.10). Not deliverable; not ●. */
+export type RuntimeLiveness = 'live' | 'booting' | 'asleep' | 'stopped'
 export interface RuntimeStatus {
   runtime: Runtime
   status: RuntimeLiveness
@@ -145,9 +149,11 @@ export function listPeers(opts: CliEnvOptions = {}): PeerListing[] {
   return index.peers.map(peer => {
     const runtimes: RuntimeStatus[] = peer.runtimes.map(rt => ({
       runtime: rt,
-      status: isPeerLive(rt, peer.personality, cfg.sockDir, env)
+      status: isPeerReady(rt, peer.personality, env)
         ? 'live'
-        : isStopped(cfg, buildProcessAddress(rt, peer.personality))
+        : isPeerLive(rt, peer.personality, cfg.sockDir, env)
+          ? 'booting'
+          : isStopped(cfg, buildProcessAddress(rt, peer.personality))
           ? 'stopped'
           : 'asleep',
     }))
@@ -177,7 +183,7 @@ export function listPeers(opts: CliEnvOptions = {}): PeerListing[] {
   })
 }
 
-const GLYPH: Record<RuntimeLiveness, string> = { live: '●', asleep: '○', stopped: '✕' }
+const GLYPH: Record<RuntimeLiveness, string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
 
 /** Render the scriptable list table (non-tty default). Columns are PADDED to align
  *  (name · [default] · nature · liveness) — a ragged table reads as noise. The
@@ -260,7 +266,9 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
     return [{ personality, runtime: peer.runtime, action: 'refused-foreign-launchd', reason: `"${personality}" is managed by persistent-peer (foreign launchd plist) — the foundation does not stop it` }]
   }
   const out: StopStartOutcome[] = []
-  for (const rt of targetRuntimes(peer, runtime)) {
+  const targets = targetRuntimes(peer, runtime)
+  auditTermination(hostRunDir(env), targets.map(rt => buildProcessAddress(rt, personality)), { reason: 'stop', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
+  for (const rt of targets) {
     const identity = buildProcessAddress(rt, personality)
     const sock = buildSocketPath(rt, personality, cfg.sockDir)
     if (isInfraRuntime(rt)) {
@@ -276,7 +284,7 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // below still tears the session down.
       const target = resolveAlwaysOnTarget(personality, rt, env)
       const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${target.label}`], { encoding: 'utf8' })
-      killSession(sock, identity, env)
+      killSession(sock, identity, env, 'stop')
       const stderrText = (r.stderr ?? '').trim()
       const benign = r.status === 0 || r.status === 3 || /No such process/i.test(stderrText)
       const reason = benign ? undefined : `launchctl bootout exited ${r.status}${stderrText ? `: ${stderrText}` : ''}`
@@ -290,7 +298,7 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // no reaped-gone death class for a state the daemon knows 100%).
       setStopped(cfg, identity)
       setIdleReaped(cfg, identity)
-      killSession(sock, identity, env)
+      killSession(sock, identity, env, 'stop')
       removeSessionState(cfg, identity)
       out.push({ personality, runtime: rt, action: 'stopped' })
       // Durable trace (fleet-API follow-up): the verb was SILENT in lifecycle.log — a
@@ -674,7 +682,7 @@ export async function newPeer(
   clearStopped(cfg, identity)
   clearIdleReaped(cfg, identity)
   clearNewEager(cfg, identity)
-  killSession(sock, identity, env) // canary-clean deliberate teardown; no-op when dead
+  killSession(sock, identity, env, 'new') // canary-clean deliberate teardown; no-op when dead
   removeSessionState(cfg, identity) // never a death class — supervise stays silent
   const wake = opts.wakeFn ?? (args => wakeOrSpawn(args, { cfg, env }))
   const r = await wake({ personality, runtime: rt, task: '', resume: false })
@@ -961,7 +969,7 @@ export async function removeRuntimeCli(
       return { personality, runtime, action: 'refused-live', reason: `${identity} is LIVE — stop it first (iapeer stop ${personality} ${runtime}) or pass --force` }
     }
     const { killPtyHost } = await import('../launch/ptyHost.ts')
-    killPtyHost(identity, env)
+    killPtyHost(identity, env, { reason: 'remove-runtime-force' })
     steps.push('live session stopped (--force)')
   }
   // Slots for THIS endpoint (provider + capabilities), while the peer's state is still consistent.
@@ -1114,6 +1122,7 @@ export async function removePeerCli(
         if (env.IAPEER_TEST_SANDBOX === '1') {
           bootoutNote = 'skipped-sandbox'
         } else {
+          auditTermination(hostRunDir(env), [entry.label], { reason: 'remove', caller: env.PEER_IDENTITY })
           const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${entry.label}`], { encoding: 'utf8' })
           // bootout exits non-zero when the job was already unloaded — benign for a teardown.
           bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
@@ -1439,9 +1448,13 @@ export async function renamePeerCli(
       const { preTrustCodexCwd, removeCodexCwdTrust } = await import('../launch/nativeMemory.ts')
       preTrustCodexCwd(newCwd, env)
       removeCodexCwdTrust(oldCwd, env)
-      const { removeCodexHooksTrustUnder } = await import('../launch/codexHooksTrust.ts')
+      const { removeCodexHooksTrustUnder, preSeedCodexHooksTrust } = await import('../launch/codexHooksTrust.ts')
       removeCodexHooksTrustUnder(oldCwd, env)
-      sideEffects.push('codex-trust: re-trusted new cwd + cleaned old')
+      // Hooks trust is keyed by the hooks.json PATH, so it must move with the cwd — without this a
+      // rename round-trip (a→b→a) wiped it entirely and codex stopped at «hooks need review» (18.10).
+      const newHooks = join(newCwd, '.codex', 'hooks.json')
+      if (existsSync(newHooks)) preSeedCodexHooksTrust(newHooks, env)
+      sideEffects.push('codex-trust: re-trusted new cwd (+ hooks) + cleaned old')
     } catch (e) {
       sideEffects.push(`codex-trust: failed (${e instanceof Error ? e.message : String(e)})`)
     }
@@ -2427,6 +2440,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             ? [positionals[0]]
             : null
         if (!peers) return argErr(errOut, 'stop needs a peer or --all — usage: iapeer stop <peer> [runtime] | --all')
+        if (flags.all === true) auditTermination(hostRunDir(env), peers, { reason: 'stop-all', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
         const outcomes = peers.flatMap(p => stopPeer(p, flags.all === true ? undefined : positionals[1], { env }))
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         // В48 — a REAL bootout error (reason set; benign already-unloaded carries none) is exit 1:
@@ -3018,7 +3032,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         }
         out(`self-fresh: marked ${identity} for eager fresh re-launch; self-killing session\n`)
         const sock = buildSocketPath(addr.runtime, addr.personality, cfg.sockDir)
-        killSession(sock, identity, env)
+        killSession(sock, identity, env, 'self-fresh')
         return 0
       }
       case 'interrupt': {

package/src/cli/listTui.ts

@@ -12,7 +12,7 @@ import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the su
 import { runSupervisorClient } from '../supervisor/client.ts'
 import { listPeers, type PeerListing } from './index.ts'
 
-const GLYPH: Record<'live' | 'asleep' | 'stopped', string> = { live: '●', asleep: '○', stopped: '✕' }
+const GLYPH: Record<'live' | 'booting' | 'asleep' | 'stopped', string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
 
 // ─── pure render ─────────────────────────────────────────────────────────────
 

package/src/daemon/fleet.ts

@@ -82,7 +82,8 @@ export const FLEET_API_VERSION = 1
 
 export interface FleetRuntimeStatus {
   runtime: string
-  status: 'live' | 'asleep' | 'stopped'
+  /** `booting` — process up, runtime not (yet / ever) ready: not deliverable (18.10). */
+  status: 'live' | 'booting' | 'asleep' | 'stopped'
   /** AGENT-ENDPOINT discovery (docs/15 §Agent endpoints): true iff this declared runtime is an
    *  agent runtime THIS core can host (`host.agent_runtimes`). A channel offers exactly the
    *  `agent:true` runtimes of a personality — never a consumer-side hardcode or `Bun.which`.

package/src/daemon/main.ts

@@ -336,9 +336,22 @@ export async function processInflight(
   // A turn the session STARTED on a message but did not finish before dying: never redelivered (its side
   // effects may already have happened) — the sender is told explicitly that the result is not guaranteed.
   for (const identity of listInterruptedIdentities(cfg.stateDir)) {
+    // Multiple messages can be injected into ONE still-running turn. A session death must notify each
+    // affected sender once, not fan out one alert per injection (18.10: twenty alerts from one turn).
+    // Keep different hosting tokens and callers separate; no message is silently discarded: the one
+    // notice enumerates the affected deliveries. Completed entries have already left in the sweep.
+    const groups = new Map<string, InflightEntry[]>()
     for (const e of takeInterrupted(cfg.stateDir, identity)) {
-      const notified = await notifySender(e, interruptedNotice(e))
-      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-interrupted', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', notified })
+      const key = JSON.stringify([e.sessionToken, e.caller.runtime, e.caller.personality])
+      const entries = groups.get(key) ?? []
+      entries.push(e)
+      groups.set(key, entries)
+    }
+    for (const entries of groups.values()) {
+      const e = entries[0]!
+      const summary = entries.length > 1 ? `\nAffected deliveries (${entries.length}):\n` + entries.map(x => `${x.sentAt}${x.topic ? ` topic=${x.topic}` : ''}: ${x.message.split('\n')[0]!.slice(0, 200)}`).join('\n') : ''
+      const notified = await notifySender(e, interruptedNotice(e) + summary)
+      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-interrupted', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', notified, count: entries.length })
     }
   }
   for (const identity of listOrphanIdentities(cfg.stateDir)) {
@@ -470,6 +483,14 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
   // Notice board (docs/19) — ONE instance shared by the mute-watch (raises) and the
   // fleet handler (serves /notices + the snapshot field). Constructed HERE, at the
   // composition point, because that sharing is the whole wiring.
+  // Readiness marker compatibility (18.10): sessions already running when this core first starts were
+  // launched without a ready marker — stamp them ONCE so delivery does not read the healthy fleet as
+  // booting. Every later hosting writes its own marker at its ready-gate.
+  try {
+    const { backfillHostReadyOnce } = await import('../launch/ptyHost.ts')
+    const stamped = await backfillHostReadyOnce(env)
+    if (stamped) appendLifecycleEvent(cfg.eventLogDir, { ev: 'ready-backfill', count: stamped.length }, { env })
+  } catch { /* best-effort */ }
   const board = new NoticeBoard({ logDir: cfg.eventLogDir, env })
   const stopMuteWatch = startMuteWatch(cfg, board, {
     env,

package/src/launch/adapters/codex.ts

@@ -41,10 +41,11 @@
 
 import { homedir } from 'os'
 import { join } from 'path'
-import { readdirSync, realpathSync, statSync } from 'fs'
+import { existsSync, readdirSync, realpathSync, statSync } from 'fs'
+import { preSeedCodexHooksTrust } from '../codexHooksTrust.ts'
 import { codexSessionCwd, lastTimestampedEntryMs } from './transcriptTail.ts'
 import { detectNumberedModal } from './modalDetect.ts'
-import type { ApprovalMode, ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import type { ApprovalMode, ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, PreparedLaunch, RuntimeAdapter } from '../types.ts'
 
 /**
  * The `/goal` subcommands we will type into a live codex session (see executeControl → 'goal').
@@ -170,6 +171,27 @@ export const codexAdapter: RuntimeAdapter = {
   kind: 'tui',
   usesDoctrine: true,
 
+  /**
+   * Hooks trust, re-asserted on EVERY launch (incident 18.10: oc-test-nemo/codex stopped at «PostToolUse
+   * hooks — 1 hook needs review» after a rename round-trip had wiped its `[hooks.state]` — a fresh codex
+   * that meets an untrusted hook waits for a human forever). The invariant «a codex peer boots to its
+   * input with no human» therefore lives HERE, not only at provision time: whatever erased the trust
+   * (rename, an approval-mode flip, a hand edit of config.toml), the next launch restores it. The peer's
+   * `.codex/hooks.json` is operator/provider-owned configuration, trusted like its `.mcp.json`.
+   * Idempotent (no write when the hashes already match); a failure is a launch WARNING, never a block —
+   * the modal is still better than no session, and the warning names it.
+   */
+  prepareLaunch(spec, _baseEnv, cfg): PreparedLaunch {
+    const env = cfg.env ?? process.env
+    const hooks = join(spec.cwd, '.codex', 'hooks.json')
+    const warnings: string[] = []
+    if (existsSync(hooks)) {
+      const t = preSeedCodexHooksTrust(hooks, env)
+      if (t.state === 'failed') warnings.push(`codex hooks trust not seeded (${t.detail ?? 'unknown'}) — a review modal may block the boot`)
+    }
+    return { env: {}, ...(warnings.length ? { warnings } : {}) }
+  },
+
   /**
    * Delivery markers for submitIntoTui (docs/Рантайм codex "Доставка"):
    *   - promptGlyphs ['›'] — codex's input-row arrow (the same stable invariant as

package/src/launch/index.ts

@@ -17,7 +17,7 @@ import { existsSync, mkdirSync, statSync } from 'fs'
 import { dirname } from 'path'
 import { type Runtime } from '../core/constants.ts'
 import { buildLaunchInvocation } from './invocation.ts'
-import { deliverHosted, hostSessionAlive, startPtyHost, waitHostReady } from './ptyHost.ts'
+import { deliverHosted, hostSessionAlive, hostSessionToken, killPtyHost, markHostReady, startPtyHost, waitHostReady } from './ptyHost.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
@@ -236,15 +236,24 @@ export const launch: LaunchFn = async (
       // router's <iap>-marker stdin reader). So confirm the hosted session is live and return ready —
       // no waitHostReady (would load @xterm for nothing), no first-message deliver, no ready-gate.
       if (adapter.kind === 'router') {
-        if (hostSessionAlive(identity, env)) return ready(identity)
+        if (hostSessionAlive(identity, env)) {
+          markHostReady(identity, env) // a router is up the instant its child serves
+          return ready(identity)
+        }
         return fail(identity, 'hosted router session not alive immediately after bringup')
       }
+      const hostingToken = hostSessionToken(identity, env)
       // STRUCTURAL runtime (opencode): readiness = the runtime's own ready record for THIS launch, and
       // the first message goes through the adapter's deliver, whose ack means THIS message is persisted
       // natively (a durable native queue) — so there is no pane gate and no activity ready-gate.
       if (adapter.structuralReady && readyToken) {
         const r = await adapter.structuralReady(spec, readyToken, Date.now() + cfg.bootDeadlineSecs * 1000, () => hostSessionAlive(identity, env), env)
-        if (!r.ok) return fail(identity, `never-became-ready (structural: ${r.reason ?? 'unknown'})`)
+        if (!r.ok) {
+          // A bring-up that never reached ready must not linger as a live-looking host (incident 18.10).
+          killPtyHost(identity, env, { reason: 'launch-structural-never-ready' })
+          return fail(identity, `never-became-ready (structural: ${r.reason ?? 'unknown'})`)
+        }
+        markHostReady(identity, env, hostingToken)
         for (const w of r.warnings ?? []) {
           if (!loggedWarnings.has(w)) appendLifecycleEvent(cfg.exitLogDir, { ev: 'launch-warning', identity, warning: w }, { env })
         }
@@ -261,7 +270,15 @@ export const launch: LaunchFn = async (
         { identity, logDir: cfg.logDir, adapter, bootDeadlineSecs: cfg.bootDeadlineSecs, paneLogStartByte, approvalMode: spec.approvalMode, env },
         sleep,
       )
-      if (!isReady) return fail(identity, 'never-became-ready (hosted: supervisor input surface not ready)')
+      if (!isReady) {
+        // Tear the host down: a process that never painted its input surface (hung before main —
+        // codex in dyld, 18.10) otherwise lived on under a healthy supervisor, read as ● by list and
+        // «live» by delivery, and swallowed a message with a false ok. Gone, the ledger redelivers its
+        // entries to the next session.
+        killPtyHost(identity, env, { reason: 'launch-never-ready' })
+        return fail(identity, 'never-became-ready (hosted: supervisor input surface not ready)')
+      }
+      markHostReady(identity, env, hostingToken)
       if (firstMessage.trim().length === 0) return ready(identity) // bare bring-up — no message to deliver
       // В18 — snap the ready-gate baseline AFTER boot, not before. newestActivityMtime is a raw
       // transcript-file mtime that BOOT ITSELF advances: codex writes its rollout-jsonl on start,

package/src/launch/launchd.ts

@@ -31,6 +31,8 @@ import {
 import { buildProcessAddress } from '../core/socket.ts'
 import { peerLogsDir } from '../storage/index.ts'
 import { IapError } from '../core/errors.ts'
+import { auditTermination } from '../supervisor/index.ts'
+import { defaultRunDir } from '../supervisor/paths.ts'
 
 const DEFAULT_THROTTLE_SECS = 10
 
@@ -556,6 +558,7 @@ export function cycleLaunchdJob(
   const uid = currentUid()
   return cycleLaunchdJobCore(uid, label, plistPath, {
     run: args => {
+      if (args[0] === 'bootout') auditTermination(defaultRunDir(env), [label], { reason: 'launchd-cycle', caller: env.PEER_IDENTITY })
       const r = spawnSync('launchctl', args, { encoding: 'utf8' })
       return { status: r.status, stderr: r.stderr ?? '' }
     },
@@ -610,6 +613,7 @@ export function bootoutLaunchdJob(label: string, env: NodeJS.ProcessEnv = proces
   }
   const uid = currentUid()
   if (!isLaunchdLoaded(label, uid)) return { state: 'not-loaded' }
+  auditTermination(defaultRunDir(env), [label], { reason: 'launchd-bootout', caller: env.PEER_IDENTITY })
   const r = spawnSync('launchctl', ['bootout', `gui/${uid}/${label}`], { encoding: 'utf8' })
   return r.status === 0 ? { state: 'booted-out' } : { state: 'failed', detail: (r.stderr ?? '').trim() || `exit ${r.status}` }
 }

package/src/launch/launchdRun.ts

@@ -165,7 +165,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   // kill the supervisor daemon (SIGTERM → hard teardown of its PTY-owned tree + sock/pid/serve cleanup)
   // so the detached child does not outlive bootout holding stale in-memory state. A NATURAL death
   // (stop=false) skips this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
-  if (stop) killPtyHost(identity, env)
+  if (stop) killPtyHost(identity, env, { reason: 'run-infra-shutdown' })
   return 0
 }