@agfpd/iapeer 0.4.134 → 0.4.135

package/docs/04-lifecycle-and-daemon.md

@@ -23,11 +23,12 @@ Once a minute the daemon runs a supervisory pass. In one tick it sleeps agents i
 
 ## Peer states
 
-A claude/codex agent is, at any moment, in one of three states:
+A hosted agent is, at any moment, in one of four states:
 
 | State | What it means | Marker in `iapeer list` |
 |---|---|---|
 | **alive** | the session is running and answering | `●` |
+| **booting** | the supervisor is up, but this runtime hosting has not passed readiness | `◐` |
 | **asleep** | no session, the peer is ready to wake on a message | `○` |
 | **stopped** | the operator set a stop flag; the daemon won't wake it | `✕` |
 
@@ -101,6 +102,24 @@ So `stop`, `start`, `new` refuse to touch foreign launchd peers — for those th
 ### Process ownership at teardown
 
 Closing a hosted session is a **hard teardown**, not the MCP client's graceful stdin/EOF shutdown.
+Core-controlled termination first fsyncs a write-ahead `termination-request` (or a multi-target
+`termination-batch`) to `<supervisorRunDir>/terminations.log`, with caller identity/UID, caller PID
+and parent PID, target identity/PID/start token and reason. Failure to persist the audit refuses the
+signal. Stop-all, uninstall and infra-update record their scope before the first termination.
+Signals from external programs bypass this primitive: `shutdown-sigterm` in `exits.log` alone does
+not identify their sender. The supervisor's JavaScript signal handler cannot recover that attribution.
+
+The supervision process namespace is bound to `LifecycleConfig.supervisorRunDir`, not re-resolved
+from an invocation's environment. A partial config without that path uses a private subdirectory of
+its own `stateDir`. Under `IAPEER_TEST_SANDBOX=1`, the signal primitive also refuses the real host's
+supervisor run-dir (including symlink aliases).
+
+Readiness is specific to one hosting token. A never-ready process is not deliverable, even if its
+TTY echoes input. The launcher tears it down on its readiness deadline; a later message can replace
+an abandoned never-ready hosting under the wake lock. Process-control verbs can still address it.
+Migration of existing agent sessions checks their current host emulator (or native control ping),
+not old pane-log bytes and not merely a live PID.
+
 Before killing the runtime, the supervisor snapshots its descendants and kills those still attached
 to its controlling PTY, including stdio MCP launchers in separate process groups. Each PID's start
 token and terminal are re-checked before signalling; unrelated processes and detached daemon branches

package/docs/14-configuration-and-logs.md

@@ -83,6 +83,7 @@ The daemon keeps three durable logs in `~/.iapeer/logs/iapeer/`:
 - **`lifecycle.log`** — lifecycle decisions: wakes, sleeps, restarts, supervisory-tick outcomes. The first place to look if a peer is behaving wrong.
 - **`delivery.log`** — the outcome of each delivery: who, to whom, into which runtime, the result, sizes, topic. Metadata only — **the message body is not written**.
 - **`exits.log`** — session deaths with postmortem data: the supervisor records the cause (exit code / signal) at the moment a session dies.
+- **`~/.iapeer/state/supervisor/terminations.log`** — strict write-ahead attribution of core-controlled termination: caller/UID, PID/parent PID, target scope/PID/start token, reason. Appended and fsynced before signalling; inability to write refuses the signal. Batch scope is recorded before stop-all, uninstall and infra-update. No entry means an external signal is unattributed, not evidence of any particular initiator. This audit follows the configured supervisor run-dir, including isolated tests.
 
 Per-peer **pane-logs** live separately under `~/.iapeer/logs/lifecycle/<runtime>-<peer>.log` — the raw terminal (pty) byte stream the supervisor appends for a session's whole life (occupancy/typing detection, the boot ready-gate, and `tail`-based monitors read them). They are rotated on the supervise tick by **copytruncate** (`IAPEER_PANELOG_MAX_BYTES` × `IAPEER_PANELOG_KEEP`, default 16 MiB × 2): the base file keeps its path and inode (its last 8 MiB tail is retained in place, so the live writer and every reader are undisturbed) while the preceding window is promoted to `<log>.1` … `.N`. Total per peer is bounded by roughly `MAX_BYTES × (KEEP + 1)`.
 

package/docs/15-fleet-api.md

@@ -77,7 +77,7 @@ The full fleet state. The peer rows are produced by the **same in-process functi
 
 Field notes:
 
-- `runtimes[].status` — `live` (session up) · `asleep` (wakeable on demand) · `stopped` (operator stop flag; the daemon won't wake it). Same glyph semantics as the CLI: `●` / `○` / `✕`.
+- `runtimes[].status` — `live` (runtime passed readiness in this hosting) · `booting` (supervisor up, runtime never reached ready) · `asleep` (wakeable on demand) · `stopped` (operator stop flag; the daemon won't wake it). Same glyph semantics as the CLI: `●` / `◐` / `○` / `✕`. `booting` is not a working session or a successful delivery; clients must not display it as `live`. Process controls can still address it. Added as a status value without changing the snapshot structure.
 - `runtimes[].agent` — **agent-endpoint discovery**: `true` iff this declared runtime is an agent runtime the running core can host (listed in `host.agent_runtimes`). A channel that offers a personality's agent endpoints (a Telegram menu, a web picker) offers exactly its `agent: true` runtimes — never a consumer-side runtime list, never a `which`/PATH probe. A declared runtime the core cannot host (a newer peer profile on an older core) is `false` and is not offered. A channel runtime (`telegram`, `web`, …) is always `false`. Additive: a pre-discovery daemon omits it — clients MUST then fall back to treating no runtime as discoverable rather than guessing. Which endpoint a send reaches is a separate rule: an omitted runtime is always `default_runtime` (config-anchored, never «the live one»); a control action for the same dialogue must name the same runtime its send used.
 - `runtimes[].private_dir` — the core-owned private directory of this endpoint (docs/20: the OpenCode journal, state and provider fragments), present only for a runtime that has one (today `opencode`). An observer that the core does not launch (a console, a collector) reads the path HERE or from `iapeer private-dir <peer> [--runtime r]` — it never derives the layout from the root. Additive.
 - `runtimes[].model` — the `provider/model` the endpoint ACTUALLY used for its last assistant turn, as the runtime itself reports it (today `opencode`, from its state; docs/20 §Provider pinning). Absent until a first turn. Lets an operator see an implicit default provider. Additive.

package/docs/20-opencode.md

@@ -232,6 +232,10 @@ process was SIGKILLed before any answer, and the fresh next session never saw it
   dies with the turn unfinished, the sender gets an explicit notice from iapeer
   («the turn was INTERRUPTED and its result is not guaranteed»), logged as
   `ev=inflight-interrupted`.
+  Several messages injected into one unfinished hosting are summarized in one notice per original
+  sender endpoint, listing every affected delivery; different hosting tokens and senders remain
+  separate. An outbound reply alone is not a terminal boundary. Completed native turns are removed
+  from the ledger before notification grouping, so destroying a finished session emits no notice.
 - Unknown is not failed. When a live receiver's acceptance record does not appear
   within the confirm window (a busy claude records a queued message late), the
   send returns `ok` with `unconfirmed: true` instead of «NOT delivered» — the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.134",
+  "version": "0.4.135",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",
@@ -35,6 +35,8 @@
     "bin",
     "docs",
     "scripts/proof-install-signature.ts",
+    "scripts/proof-fleet-isolation.ts",
+    "scripts/proof-inflight-turns.ts",
     "CHANGELOG.md",
     "tsconfig.json",
     "!src/**/*.test.ts",

package/scripts/proof-fleet-isolation.ts

@@ -0,0 +1,71 @@
+// Live, isolated reproduction of the 18.10 test-suite SIGTERM incident.
+// bun scripts/proof-fleet-isolation.ts [--expect-legacy-failure]
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { startSupervisorDaemon, killSession, sessionAlive } from '../src/supervisor/index.ts'
+import { loadLifecycleConfig, superviseTick } from '../src/lifecycle/index.ts'
+import { upsertPeer } from '../src/registry/index.ts'
+import { fileURLToPath } from 'node:url'
+
+const root = mkdtempSync(join(tmpdir(), 'iap-isolation-'))
+const foreign = join(root, 'foreign')
+const own = join(root, 'own')
+const runDir = join(foreign, 'state/supervisor')
+const env = { ...process.env, IAPEER_ROOT: foreign, IAPEER_LAUNCHAGENTS_DIR: join(own, 'LaunchAgents') }
+const cfg = loadLifecycleConfig({ ...env, IAPEER_ROOT: own, IAPEER_BOOT_DEADLINE_SECS: '1', IAPEER_READY_GATE_SECS: '1' })
+const ids = ['claude-sentinel', 'telegram-sentinel', 'notifier-sentinel']
+const arg = (name: string) => { const i = process.argv.indexOf(name); return i < 0 ? undefined : process.argv[i + 1] }
+const bin = arg('--bin')
+const artifacts = arg('--artifacts')
+const pids: Record<string, number | undefined> = {}
+const legacyFile = fileURLToPath(new URL(`../src/lifecycle/.proof-legacy-${process.pid}.ts`, import.meta.url))
+mkdirSync(cfg.stateDir, { recursive: true })
+try {
+  for (const session of ids) {
+    const r = await startSupervisorDaemon({ session, runtime: session.split('-')[0]!, runDir,
+      ...(bin ? { daemonArgv: [bin, 'supervisor'] } : {}),
+      serve: { argv: ['/bin/sleep', '600'], env: {}, cwd: root, exitLogPath: join(root, 'exits.log') } })
+    if (r.state !== 'started') throw new Error(JSON.stringify(r))
+    pids[session] = r.pid
+  }
+  // Exactly the problematic shape: cfg is isolated, env points at another fleet; no liveness seam.
+  let sweep = superviseTick
+  if (process.argv.includes('--replay-legacy-resolver')) {
+    // Re-run the actual sweep with ONLY its namespace selection restored to the incident's env
+    // resolution. Both fleets are created above, never supplied by the caller. Audit stays enabled.
+    const source = readFileSync(fileURLToPath(new URL('../src/lifecycle/index.ts', import.meta.url)), 'utf8')
+    const fixed = "const runDir = cfg.supervisorRunDir ?? join(cfg.stateDir, 'supervisor')"
+    if (!source.includes(fixed)) throw new Error('legacy replay patch no longer matches source')
+    writeFileSync(legacyFile, "import { hostRunDir } from '../launch/ptyHost.ts'\n" + source.replace(fixed, 'const runDir = hostRunDir(env)'))
+    sweep = (await import(legacyFile)).superviseTick
+  }
+  const outcomes = sweep(cfg, { env, nowMs: Date.now() + 3600_000 })
+  await Bun.sleep(1500)
+  const dead = ids.filter(id => !sessionAlive(runDir, id))
+  const read = (path: string) => { try { return readFileSync(path, 'utf8') } catch { return '' } }
+  const result: Record<string, unknown> = { pids, outcomes, foreignKilled: dead, exits: read(join(root, 'exits.log')) }
+  if (process.argv.includes('--expect-legacy-failure') ? dead.length !== ids.length : dead.length !== 0) throw new Error('isolation invariant failed')
+  if (bin && dead.length === 0) {
+    await upsertPeer({ personality: 'sentinel', runtime: 'claude', runtimes: ['claude', 'telegram', 'notifier'], cwd: root, intelligence: 'artificial' }, { rootDir: foreign })
+    const stop = Bun.spawn([bin, 'stop', 'sentinel', 'claude'], { env: { ...env, PEER_IDENTITY: 'test-operator' }, stdout: 'pipe', stderr: 'pipe' })
+    const code = await stop.exited
+    result.stop = { code, stdout: await new Response(stop.stdout).text(), stderr: await new Response(stop.stderr).text() }
+    await Bun.sleep(1000)
+    result.afterTargetedStop = Object.fromEntries(ids.map(id => [id, sessionAlive(runDir, id)]))
+    if (code || sessionAlive(runDir, ids[0]!) || ids.slice(1).some(id => !sessionAlive(runDir, id))) throw new Error('installed stop affected foreign endpoint')
+  }
+  result.audit = read(join(runDir, 'terminations.log'))
+  result.exits = read(join(root, 'exits.log'))
+  if (artifacts) {
+    mkdirSync(artifacts, { recursive: true })
+    writeFileSync(join(artifacts, 'result.json'), JSON.stringify(result, null, 2) + '\n')
+  }
+  console.log(JSON.stringify(result, null, 2))
+  console.log(dead.length ? 'REPRODUCED: cfg-only sandbox killed foreign supervisors' : 'PASS: foreign supervisors survived the real sweep')
+} finally {
+  for (const id of ids) killSession(runDir, id)
+  await Bun.sleep(1000)
+  rmSync(root, { recursive: true, force: true })
+  rmSync(legacyFile, { force: true })
+}

package/scripts/proof-inflight-turns.ts

@@ -0,0 +1,89 @@
+// Real OpenCode + synthetic streaming provider, isolated root. No cloud calls or fleet traffic.
+// OPENCODE_BIN=... bun scripts/proof-inflight-turns.ts --seed-config <opencode config dir> [--keep]
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+const bin = process.env.OPENCODE_BIN
+if (!bin || !existsSync(bin)) throw new Error('set OPENCODE_BIN')
+const root = mkdtempSync('/tmp/iap-inflight-live-')
+const home = join(root, 'home')
+const env = { PATH: process.env.PATH, HOME: home, IAPEER_ROOT: join(root, 'iapeer'), IAPEER_PORT: '9',
+  IAPEER_OPENCODE_BIN: bin, XDG_CONFIG_HOME: join(home, 'config'), XDG_DATA_HOME: join(home, 'data'),
+  XDG_CACHE_HOME: join(home, 'cache'), XDG_STATE_HOME: join(home, 'state'),
+  OPENCODE_DISABLE_DEFAULT_PLUGINS: 'true', OPENCODE_DISABLE_MODELS_FETCH: 'true', HOMEBREW_NO_AUTO_UPDATE: '1' }
+mkdirSync(home, { recursive: true })
+const seed = process.argv.indexOf('--seed-config')
+if (seed >= 0) cpSync(process.argv[seed + 1]!, join(home, 'config/opencode'), { recursive: true })
+for (const k of Object.keys(process.env)) delete process.env[k]
+Object.assign(process.env, env)
+const { initPeer } = await import('../src/init/index.ts')
+const { loadLifecycleConfig, wakeOrSpawn } = await import('../src/lifecycle/index.ts')
+const { routeSend, deliveryProcessed, deliveryCompleted } = await import('../src/transport/index.ts')
+const { makeNoteInflight, processInflight } = await import('../src/daemon/main.ts')
+const { readInflight } = await import('../src/lifecycle/inflight.ts')
+const { opencodePaths } = await import('../src/opencode/config.ts')
+const { killPtyHost, hostSessionAlive } = await import('../src/launch/ptyHost.ts')
+const { ok } = await import('../src/core/errors.ts')
+const cfg = loadLifecycleConfig(env)
+const personality = 'turn-proof', identity = `opencode-${personality}`, cwd = join(root, personality)
+mkdirSync(cwd, { recursive: true })
+let hanging = false
+const provider = Bun.serve({ hostname: '127.0.0.1', port: 0, async fetch(req) {
+  await req.json()
+  const chunk = (delta: unknown, finish: string | null) => 'data: ' + JSON.stringify({ id: 'proof', object: 'chat.completion.chunk', created: 1, model: 'synthetic', choices: [{ index: 0, delta, finish_reason: finish }] }) + '\n\n'
+  const initial = chunk({ role: 'assistant', content: hanging ? 'STILL WORKING' : 'FINISHED' }, null)
+  return new Response(hanging ? new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode(initial)) } }) : initial + chunk({}, 'stop') + 'data: [DONE]\n\n', { headers: { 'Content-Type': 'text/event-stream' } })
+} })
+const notices: string[] = []
+const sink = (async (_caller: unknown, input: { message: string; personality: string }) => {
+  notices.push(input.message)
+  return ok({ ok: true, delivered_to: { personality: input.personality, runtime: 'codex' }, woke: false, ts: 'x' })
+}) as never
+const until = async (what: string, f: () => boolean) => {
+  for (let i = 0; i < 300; i++) { if (f()) return; await Bun.sleep(100) }
+  throw new Error(`timeout: ${what}`)
+}
+const snapshots: unknown[] = []
+let success = false
+try {
+  await initPeer({ cwd, runtime: 'opencode', personality, intelligence: 'artificial', env })
+  const paths = opencodePaths(personality, { env })
+  mkdirSync(paths.dir, { recursive: true })
+  writeFileSync(paths.config, JSON.stringify({ model: 'synthetic/synthetic', small_model: 'synthetic/synthetic', enabled_providers: ['synthetic'], provider: {
+    synthetic: { npm: '@ai-sdk/openai-compatible', name: 'Synthetic', options: { baseURL: provider.url.toString() + 'v1', apiKey: 'x' }, models: { synthetic: { name: 'Synthetic', limit: { context: 100000, output: 1000 } } } },
+  } }))
+  const caller = { personality: 'sender', runtime: 'codex', address: 'codex-sender', intelligence: 'artificial', cwd, description: '', record: { personality: 'sender', runtime: 'codex', runtimes: ['codex'], intelligence: 'artificial', cwd } } as never
+  const deps = { env, wake: (args: never) => wakeOrSpawn(args, { cfg, env }), noteInflight: makeNoteInflight(cfg) }
+  const send = async (message: string) => {
+    const r = await routeSend(caller, { personality, runtime: 'opencode', message }, deps)
+    if (!r.ok) throw r.error
+    return r.value
+  }
+  snapshots.push({ phase: 'finished-send', ack: await send('FINISHED_TURN_PROOF') })
+  await until('native terminal record', () => readInflight(cfg.stateDir, identity).some(e => deliveryCompleted(e, env)))
+  snapshots.push({ phase: 'native-completed', entries: readInflight(cfg.stateDir, identity).map(e => ({ id: e.id, processed: deliveryProcessed(e, env), completed: deliveryCompleted(e, env) })) })
+  // Do not sweep before killing: completion must still be recognized after the receiver is gone.
+  killPtyHost(identity, env, { reason: 'proof-kill-after-native-completion' })
+  await until('finished receiver gone', () => !hostSessionAlive(identity, env))
+  await processInflight(cfg, env, deps, { send: sink })
+  if (notices.length || readInflight(cfg.stateDir, identity).length) throw new Error('finished turn generated notice or retained ledger')
+  snapshots.push({ phase: 'kill-after-finish', noticeCount: notices.length })
+
+  hanging = true
+  snapshots.push({ phase: 'mid-send', ack: await send('UNFINISHED_TURN_PROOF') })
+  await until('native assistant starts without terminal', () => readInflight(cfg.stateDir, identity).some(e => deliveryProcessed(e, env) && !deliveryCompleted(e, env)))
+  snapshots.push({ phase: 'native-unfinished', entries: readInflight(cfg.stateDir, identity).map(e => ({ id: e.id, processed: deliveryProcessed(e, env), completed: deliveryCompleted(e, env) })) })
+  killPtyHost(identity, env, { reason: 'proof-kill-during-native-stream' })
+  await until('unfinished receiver gone', () => !hostSessionAlive(identity, env))
+  await processInflight(cfg, env, deps, { send: sink })
+  await processInflight(cfg, env, deps, { send: sink })
+  if (notices.length !== 1 || !notices[0]!.includes('INTERRUPTED')) throw new Error(`expected one notice, got ${notices.length}`)
+  snapshots.push({ phase: 'kill-mid-turn-two-sweeps', noticeCount: notices.length, notices })
+  success = true
+} finally {
+  killPtyHost(identity, env, { reason: 'proof-cleanup' })
+  provider.stop(true)
+  writeFileSync(join(root, 'result.json'), JSON.stringify({ success, codeSource: import.meta.url, snapshots }, null, 2))
+  console.log(JSON.stringify({ root, success, snapshots }, null, 2))
+  await Bun.sleep(300)
+  if (success && !process.argv.includes('--keep')) rmSync(root, { recursive: true, force: true })
+}

package/src/cli/index.ts

@@ -26,9 +26,11 @@ import { cascadeTail, recycleFoundationOwnedInfraJobs, updateIapeer, waitForDaem
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { ensureGlobalIapScaffold } from '../storage/index.ts'
 import { findPeer, readPeersIndex, removePeer, type PeerRecord } from '../registry/index.ts'
+import { auditTermination } from '../supervisor/index.ts'
 import {
   compactDoneBaseline,
   isPeerLive,
+  isPeerReady,
   purgeAttachmentInbox,
   routeControl,
   routeSend,
@@ -106,7 +108,9 @@ function infraRecycleFailed(infra: readonly { state: string }[] | undefined): bo
 // list — registry + per-runtime liveness (contract Примитивы §list)
 // ─────────────────────────────────────────────────────────────────────────────
 
-export type RuntimeLiveness = 'live' | 'asleep' | 'stopped'
+/** `booting` — the process is up but its runtime never reached its ready surface (yet, or ever: a
+ *  process hung before main, 18.10). Not deliverable; not ●. */
+export type RuntimeLiveness = 'live' | 'booting' | 'asleep' | 'stopped'
 export interface RuntimeStatus {
   runtime: Runtime
   status: RuntimeLiveness
@@ -145,9 +149,11 @@ export function listPeers(opts: CliEnvOptions = {}): PeerListing[] {
   return index.peers.map(peer => {
     const runtimes: RuntimeStatus[] = peer.runtimes.map(rt => ({
       runtime: rt,
-      status: isPeerLive(rt, peer.personality, cfg.sockDir, env)
+      status: isPeerReady(rt, peer.personality, env)
         ? 'live'
-        : isStopped(cfg, buildProcessAddress(rt, peer.personality))
+        : isPeerLive(rt, peer.personality, cfg.sockDir, env)
+          ? 'booting'
+          : isStopped(cfg, buildProcessAddress(rt, peer.personality))
           ? 'stopped'
           : 'asleep',
     }))
@@ -177,7 +183,7 @@ export function listPeers(opts: CliEnvOptions = {}): PeerListing[] {
   })
 }
 
-const GLYPH: Record<RuntimeLiveness, string> = { live: '●', asleep: '○', stopped: '✕' }
+const GLYPH: Record<RuntimeLiveness, string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
 
 /** Render the scriptable list table (non-tty default). Columns are PADDED to align
  *  (name · [default] · nature · liveness) — a ragged table reads as noise. The
@@ -260,7 +266,9 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
     return [{ personality, runtime: peer.runtime, action: 'refused-foreign-launchd', reason: `"${personality}" is managed by persistent-peer (foreign launchd plist) — the foundation does not stop it` }]
   }
   const out: StopStartOutcome[] = []
-  for (const rt of targetRuntimes(peer, runtime)) {
+  const targets = targetRuntimes(peer, runtime)
+  auditTermination(hostRunDir(env), targets.map(rt => buildProcessAddress(rt, personality)), { reason: 'stop', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
+  for (const rt of targets) {
     const identity = buildProcessAddress(rt, personality)
     const sock = buildSocketPath(rt, personality, cfg.sockDir)
     if (isInfraRuntime(rt)) {
@@ -276,7 +284,7 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // below still tears the session down.
       const target = resolveAlwaysOnTarget(personality, rt, env)
       const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${target.label}`], { encoding: 'utf8' })
-      killSession(sock, identity, env)
+      killSession(sock, identity, env, 'stop')
       const stderrText = (r.stderr ?? '').trim()
       const benign = r.status === 0 || r.status === 3 || /No such process/i.test(stderrText)
       const reason = benign ? undefined : `launchctl bootout exited ${r.status}${stderrText ? `: ${stderrText}` : ''}`
@@ -290,7 +298,7 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // no reaped-gone death class for a state the daemon knows 100%).
       setStopped(cfg, identity)
       setIdleReaped(cfg, identity)
-      killSession(sock, identity, env)
+      killSession(sock, identity, env, 'stop')
       removeSessionState(cfg, identity)
       out.push({ personality, runtime: rt, action: 'stopped' })
       // Durable trace (fleet-API follow-up): the verb was SILENT in lifecycle.log — a
@@ -674,7 +682,7 @@ export async function newPeer(
   clearStopped(cfg, identity)
   clearIdleReaped(cfg, identity)
   clearNewEager(cfg, identity)
-  killSession(sock, identity, env) // canary-clean deliberate teardown; no-op when dead
+  killSession(sock, identity, env, 'new') // canary-clean deliberate teardown; no-op when dead
   removeSessionState(cfg, identity) // never a death class — supervise stays silent
   const wake = opts.wakeFn ?? (args => wakeOrSpawn(args, { cfg, env }))
   const r = await wake({ personality, runtime: rt, task: '', resume: false })
@@ -961,7 +969,7 @@ export async function removeRuntimeCli(
       return { personality, runtime, action: 'refused-live', reason: `${identity} is LIVE — stop it first (iapeer stop ${personality} ${runtime}) or pass --force` }
     }
     const { killPtyHost } = await import('../launch/ptyHost.ts')
-    killPtyHost(identity, env)
+    killPtyHost(identity, env, { reason: 'remove-runtime-force' })
     steps.push('live session stopped (--force)')
   }
   // Slots for THIS endpoint (provider + capabilities), while the peer's state is still consistent.
@@ -1114,6 +1122,7 @@ export async function removePeerCli(
         if (env.IAPEER_TEST_SANDBOX === '1') {
           bootoutNote = 'skipped-sandbox'
         } else {
+          auditTermination(hostRunDir(env), [entry.label], { reason: 'remove', caller: env.PEER_IDENTITY })
           const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${entry.label}`], { encoding: 'utf8' })
           // bootout exits non-zero when the job was already unloaded — benign for a teardown.
           bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
@@ -2431,6 +2440,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             ? [positionals[0]]
             : null
         if (!peers) return argErr(errOut, 'stop needs a peer or --all — usage: iapeer stop <peer> [runtime] | --all')
+        if (flags.all === true) auditTermination(hostRunDir(env), peers, { reason: 'stop-all', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
         const outcomes = peers.flatMap(p => stopPeer(p, flags.all === true ? undefined : positionals[1], { env }))
         for (const o of outcomes) out(`${o.personality} (${o.runtime}): ${o.action}${o.reason ? ` — ${o.reason}` : ''}\n`)
         // В48 — a REAL bootout error (reason set; benign already-unloaded carries none) is exit 1:
@@ -3022,7 +3032,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         }
         out(`self-fresh: marked ${identity} for eager fresh re-launch; self-killing session\n`)
         const sock = buildSocketPath(addr.runtime, addr.personality, cfg.sockDir)
-        killSession(sock, identity, env)
+        killSession(sock, identity, env, 'self-fresh')
         return 0
       }
       case 'interrupt': {

package/src/cli/listTui.ts

@@ -12,7 +12,7 @@ import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the su
 import { runSupervisorClient } from '../supervisor/client.ts'
 import { listPeers, type PeerListing } from './index.ts'
 
-const GLYPH: Record<'live' | 'asleep' | 'stopped', string> = { live: '●', asleep: '○', stopped: '✕' }
+const GLYPH: Record<'live' | 'booting' | 'asleep' | 'stopped', string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
 
 // ─── pure render ─────────────────────────────────────────────────────────────
 

package/src/daemon/fleet.ts

@@ -82,7 +82,8 @@ export const FLEET_API_VERSION = 1
 
 export interface FleetRuntimeStatus {
   runtime: string
-  status: 'live' | 'asleep' | 'stopped'
+  /** `booting` — process up, runtime not (yet / ever) ready: not deliverable (18.10). */
+  status: 'live' | 'booting' | 'asleep' | 'stopped'
   /** AGENT-ENDPOINT discovery (docs/15 §Agent endpoints): true iff this declared runtime is an
    *  agent runtime THIS core can host (`host.agent_runtimes`). A channel offers exactly the
    *  `agent:true` runtimes of a personality — never a consumer-side hardcode or `Bun.which`.

package/src/daemon/main.ts

@@ -336,9 +336,22 @@ export async function processInflight(
   // A turn the session STARTED on a message but did not finish before dying: never redelivered (its side
   // effects may already have happened) — the sender is told explicitly that the result is not guaranteed.
   for (const identity of listInterruptedIdentities(cfg.stateDir)) {
+    // Multiple messages can be injected into ONE still-running turn. A session death must notify each
+    // affected sender once, not fan out one alert per injection (18.10: twenty alerts from one turn).
+    // Keep different hosting tokens and callers separate; no message is silently discarded: the one
+    // notice enumerates the affected deliveries. Completed entries have already left in the sweep.
+    const groups = new Map<string, InflightEntry[]>()
     for (const e of takeInterrupted(cfg.stateDir, identity)) {
-      const notified = await notifySender(e, interruptedNotice(e))
-      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-interrupted', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', notified })
+      const key = JSON.stringify([e.sessionToken, e.caller.runtime, e.caller.personality])
+      const entries = groups.get(key) ?? []
+      entries.push(e)
+      groups.set(key, entries)
+    }
+    for (const entries of groups.values()) {
+      const e = entries[0]!
+      const summary = entries.length > 1 ? `\nAffected deliveries (${entries.length}):\n` + entries.map(x => `${x.sentAt}${x.topic ? ` topic=${x.topic}` : ''}: ${x.message.split('\n')[0]!.slice(0, 200)}`).join('\n') : ''
+      const notified = await notifySender(e, interruptedNotice(e) + summary)
+      appendDeliveryEvent(cfg.eventLogDir, { ev: 'inflight-interrupted', caller: `${e.caller.runtime}-${e.caller.personality}`, to: e.personality, rt: e.runtime, ok: 'false', notified, count: entries.length })
     }
   }
   for (const identity of listOrphanIdentities(cfg.stateDir)) {
@@ -470,6 +483,14 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
   // Notice board (docs/19) — ONE instance shared by the mute-watch (raises) and the
   // fleet handler (serves /notices + the snapshot field). Constructed HERE, at the
   // composition point, because that sharing is the whole wiring.
+  // Readiness marker compatibility (18.10): sessions already running when this core first starts were
+  // launched without a ready marker — stamp them ONCE so delivery does not read the healthy fleet as
+  // booting. Every later hosting writes its own marker at its ready-gate.
+  try {
+    const { backfillHostReadyOnce } = await import('../launch/ptyHost.ts')
+    const stamped = await backfillHostReadyOnce(env)
+    if (stamped) appendLifecycleEvent(cfg.eventLogDir, { ev: 'ready-backfill', count: stamped.length }, { env })
+  } catch { /* best-effort */ }
   const board = new NoticeBoard({ logDir: cfg.eventLogDir, env })
   const stopMuteWatch = startMuteWatch(cfg, board, {
     env,

package/src/launch/index.ts

@@ -17,7 +17,7 @@ import { existsSync, mkdirSync, statSync } from 'fs'
 import { dirname } from 'path'
 import { type Runtime } from '../core/constants.ts'
 import { buildLaunchInvocation } from './invocation.ts'
-import { deliverHosted, hostSessionAlive, startPtyHost, waitHostReady } from './ptyHost.ts'
+import { deliverHosted, hostSessionAlive, hostSessionToken, killPtyHost, markHostReady, startPtyHost, waitHostReady } from './ptyHost.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
@@ -236,15 +236,24 @@ export const launch: LaunchFn = async (
       // router's <iap>-marker stdin reader). So confirm the hosted session is live and return ready —
       // no waitHostReady (would load @xterm for nothing), no first-message deliver, no ready-gate.
       if (adapter.kind === 'router') {
-        if (hostSessionAlive(identity, env)) return ready(identity)
+        if (hostSessionAlive(identity, env)) {
+          markHostReady(identity, env) // a router is up the instant its child serves
+          return ready(identity)
+        }
         return fail(identity, 'hosted router session not alive immediately after bringup')
       }
+      const hostingToken = hostSessionToken(identity, env)
       // STRUCTURAL runtime (opencode): readiness = the runtime's own ready record for THIS launch, and
       // the first message goes through the adapter's deliver, whose ack means THIS message is persisted
       // natively (a durable native queue) — so there is no pane gate and no activity ready-gate.
       if (adapter.structuralReady && readyToken) {
         const r = await adapter.structuralReady(spec, readyToken, Date.now() + cfg.bootDeadlineSecs * 1000, () => hostSessionAlive(identity, env), env)
-        if (!r.ok) return fail(identity, `never-became-ready (structural: ${r.reason ?? 'unknown'})`)
+        if (!r.ok) {
+          // A bring-up that never reached ready must not linger as a live-looking host (incident 18.10).
+          killPtyHost(identity, env, { reason: 'launch-structural-never-ready' })
+          return fail(identity, `never-became-ready (structural: ${r.reason ?? 'unknown'})`)
+        }
+        markHostReady(identity, env, hostingToken)
         for (const w of r.warnings ?? []) {
           if (!loggedWarnings.has(w)) appendLifecycleEvent(cfg.exitLogDir, { ev: 'launch-warning', identity, warning: w }, { env })
         }
@@ -261,7 +270,15 @@ export const launch: LaunchFn = async (
         { identity, logDir: cfg.logDir, adapter, bootDeadlineSecs: cfg.bootDeadlineSecs, paneLogStartByte, approvalMode: spec.approvalMode, env },
         sleep,
       )
-      if (!isReady) return fail(identity, 'never-became-ready (hosted: supervisor input surface not ready)')
+      if (!isReady) {
+        // Tear the host down: a process that never painted its input surface (hung before main —
+        // codex in dyld, 18.10) otherwise lived on under a healthy supervisor, read as ● by list and
+        // «live» by delivery, and swallowed a message with a false ok. Gone, the ledger redelivers its
+        // entries to the next session.
+        killPtyHost(identity, env, { reason: 'launch-never-ready' })
+        return fail(identity, 'never-became-ready (hosted: supervisor input surface not ready)')
+      }
+      markHostReady(identity, env, hostingToken)
       if (firstMessage.trim().length === 0) return ready(identity) // bare bring-up — no message to deliver
       // В18 — snap the ready-gate baseline AFTER boot, not before. newestActivityMtime is a raw
       // transcript-file mtime that BOOT ITSELF advances: codex writes its rollout-jsonl on start,

package/src/launch/launchd.ts

@@ -31,6 +31,8 @@ import {
 import { buildProcessAddress } from '../core/socket.ts'
 import { peerLogsDir } from '../storage/index.ts'
 import { IapError } from '../core/errors.ts'
+import { auditTermination } from '../supervisor/index.ts'
+import { defaultRunDir } from '../supervisor/paths.ts'
 
 const DEFAULT_THROTTLE_SECS = 10
 
@@ -556,6 +558,7 @@ export function cycleLaunchdJob(
   const uid = currentUid()
   return cycleLaunchdJobCore(uid, label, plistPath, {
     run: args => {
+      if (args[0] === 'bootout') auditTermination(defaultRunDir(env), [label], { reason: 'launchd-cycle', caller: env.PEER_IDENTITY })
       const r = spawnSync('launchctl', args, { encoding: 'utf8' })
       return { status: r.status, stderr: r.stderr ?? '' }
     },
@@ -610,6 +613,7 @@ export function bootoutLaunchdJob(label: string, env: NodeJS.ProcessEnv = proces
   }
   const uid = currentUid()
   if (!isLaunchdLoaded(label, uid)) return { state: 'not-loaded' }
+  auditTermination(defaultRunDir(env), [label], { reason: 'launchd-bootout', caller: env.PEER_IDENTITY })
   const r = spawnSync('launchctl', ['bootout', `gui/${uid}/${label}`], { encoding: 'utf8' })
   return r.status === 0 ? { state: 'booted-out' } : { state: 'failed', detail: (r.stderr ?? '').trim() || `exit ${r.status}` }
 }

package/src/launch/launchdRun.ts

@@ -165,7 +165,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   // kill the supervisor daemon (SIGTERM → hard teardown of its PTY-owned tree + sock/pid/serve cleanup)
   // so the detached child does not outlive bootout holding stale in-memory state. A NATURAL death
   // (stop=false) skips this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
-  if (stop) killPtyHost(identity, env)
+  if (stop) killPtyHost(identity, env, { reason: 'run-infra-shutdown' })
   return 0
 }
 

package/src/launch/ptyHost.ts

@@ -10,11 +10,12 @@
 //   - the deliver client is a pure-protocol leaf (no @xterm);
 //   - sessionAlive comes from client.ts (no @xterm);
 //   - readiness reuses paneLogViewport, whose @xterm import is dynamic and only loads flag-on.
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
 import { deliverToHost, sendControlToHost, type DeliverResult } from '../supervisor/deliver.ts'
 import { attachedPath, defaultRunDir, pidPath, readGeometry } from '../supervisor/paths.ts'
 import { sessionAlive as hostDaemonAlive } from '../supervisor/client.ts'
-import { killSession as killSupervisorSession, listSessions as listSupervisorSessions } from '../supervisor/index.ts'
+import { killSession as killSupervisorSession, listSessions as listSupervisorSessions, type TerminationContext } from '../supervisor/index.ts'
 import { parseSessionName } from '../core/socket.ts'
 import type { TmuxRuntime } from '../core/constants.ts'
 import { paneLogViewport } from './readyGateModel.ts'
@@ -45,10 +46,83 @@ export function hostSessionAlive(identity: string, env: NodeJS.ProcessEnv = proc
   return hostDaemonAlive(hostRunDir(env), identity)
 }
 
+// ─── Runtime READINESS (incident 18.10) ──────────────────────────────────────
+// «Alive» (the supervisor daemon's pid) is not «the runtime is up». A codex process hung before main
+// (dyld, after a cask update) lived under a healthy supervisor for 35 min: `list` showed ●, a send
+// went «live» and was confirmed ok (the cooked tty echoed the paste into the pane-log), and the ledger
+// held the message as in-progress. The invariant: a session that never reached its runtime's ready
+// surface is NOT live for delivery/list. Operator controls still address the hung process.
+// The launch writes this marker (the hosting token) the moment its ready-gate passes; a marker from
+// another hosting (a replaced session) does not count.
+
+function readyPath(identity: string, env: NodeJS.ProcessEnv): string {
+  return join(hostRunDir(env), `${identity}.ready`)
+}
+
+/** Record that THIS hosting of the identity reached its runtime's ready surface. */
+export function markHostReady(identity: string, env: NodeJS.ProcessEnv = process.env, token = hostSessionToken(identity, env)): void {
+  if (!token || token !== hostSessionToken(identity, env)) throw new Error(`hosting changed before ready: ${identity}`)
+  writeFileSync(readyPath(identity, env), `${token}\n`, { mode: 0o600 })
+}
+
+export function clearHostReady(identity: string, env: NodeJS.ProcessEnv = process.env): void {
+  rmSync(readyPath(identity, env), { force: true })
+}
+
+/** When this hosting started (its supervisor pid-file mtime), or null. */
+export function hostStartedMs(identity: string, env: NodeJS.ProcessEnv = process.env, runDir = hostRunDir(env)): number | null {
+  try {
+    return statSync(pidPath(runDir, identity)).mtimeMs
+  } catch {
+    return null
+  }
+}
+
+/** Alive AND this very hosting reached ready. */
+export function hostSessionReady(identity: string, env: NodeJS.ProcessEnv = process.env, runDir = hostRunDir(env)): boolean {
+  if (!hostDaemonAlive(runDir, identity)) return false
+  const token = hostSessionToken(identity, env, runDir)
+  try {
+    return !!token && readFileSync(join(runDir, `${identity}.ready`), 'utf8').trim() === token
+  } catch {
+    return false
+  }
+}
+
+/**
+ * One-time compatibility for sessions that were already running when the readiness marker was
+ * introduced. Prove readiness in each current host, without trusting historical pane-log frames.
+ */
+export async function backfillHostReady(env: NodeJS.ProcessEnv = process.env): Promise<string[]> {
+  const out: string[] = []
+  for (const h of listHostedPeers(env)) {
+    const id = `${h.runtime}-${h.personality}`
+    if (existsSync(readyPath(id, env))) continue
+    const token = hostSessionToken(id, env)
+    // Migration must prove readiness too: blindly stamping legacy pids re-labels a dyld hang as live.
+    const { getAdapter } = await import('./index.ts')
+    const adapter = getAdapter(h.runtime)
+    if (h.runtime === 'opencode') {
+      const { opencodeControl } = await import('../opencode/control.ts')
+      const { opencodePaths } = await import('../opencode/config.ts')
+      const ping = await opencodeControl(join(opencodePaths(h.personality, { env }).dir, 'control.sock'), { op: 'ping' }, 1000)
+      if (!ping.ok) continue
+    } else if (adapter.kind !== 'router') {
+      const { captureHostViewport } = await import('../supervisor/capture.ts')
+      const view = await captureHostViewport(hostRunDir(env), id)
+      if (!view || !adapter.isInputReady(view, 'gated')) continue
+    }
+    markHostReady(id, env, token)
+    out.push(id)
+  }
+  return out
+}
+
 /** Reap a hosted session: SIGTERM the supervisor daemon (hard-kills its PTY-owned tree + cleans up).
  *  env sandboxes the run-dir: a test with an injected root must NEVER SIGTERM a real fleet peer. */
-export function killPtyHost(identity: string, env: NodeJS.ProcessEnv = process.env): void {
-  killSupervisorSession(hostRunDir(env), identity)
+export function killPtyHost(identity: string, env: NodeJS.ProcessEnv = process.env, context: TerminationContext = {}, runDir = hostRunDir(env)): void {
+  killSupervisorSession(runDir, identity, { ...context, sandbox: context.sandbox || env.IAPEER_TEST_SANDBOX === '1',
+    caller: context.caller ?? env.PEER_IDENTITY ?? (env.PEER_PERSONALITY ? `${env.PEER_RUNTIME ?? 'unknown'}-${env.PEER_PERSONALITY}` : undefined) })
 }
 
 /**
@@ -78,9 +152,9 @@ export function hostGeometry(identity: string, env: NodeJS.ProcessEnv = process.
  * session FAILS rather than landing in a fresh same-named session — the host equivalent of the tmux
  * `session_id:pane_id` token. null when no daemon pid is readable.
  */
-export function hostSessionToken(identity: string, env: NodeJS.ProcessEnv = process.env): string | null {
+export function hostSessionToken(identity: string, env: NodeJS.ProcessEnv = process.env, runDir = hostRunDir(env)): string | null {
   try {
-    const pid = readFileSync(pidPath(hostRunDir(env), identity), 'utf8').trim()
+    const pid = readFileSync(pidPath(runDir, identity), 'utf8').trim()
     return pid ? `host:${pid}` : null
   } catch {
     return null
@@ -93,9 +167,9 @@ export function hostSessionToken(identity: string, env: NodeJS.ProcessEnv = proc
  * scan (and the no-runtime delivery resolve) include hosted peers. Empty + cheap when flag-off (the
  * run-dir is empty).
  */
-export function listHostedPeers(env: NodeJS.ProcessEnv = process.env): Array<{ runtime: TmuxRuntime; personality: string }> {
+export function listHostedPeers(env: NodeJS.ProcessEnv = process.env, runDir = hostRunDir(env)): Array<{ runtime: TmuxRuntime; personality: string }> {
   const out: Array<{ runtime: TmuxRuntime; personality: string }> = []
-  for (const s of listSupervisorSessions(hostRunDir(env))) {
+  for (const s of listSupervisorSessions(runDir)) {
     if (!s.alive) continue
     const p = parseSessionName(s.session)
     if (p) out.push({ runtime: p.runtime, personality: p.personality })
@@ -206,3 +280,17 @@ export function deliverHosted(identity: string, message: string, env: NodeJS.Pro
 export function resubmitHosted(identity: string, env: NodeJS.ProcessEnv = process.env): Promise<DeliverResult> {
   return sendControlToHost(hostRunDir(env), identity, [Buffer.from('\r', 'utf8')])
 }
+
+/** Run backfillHostReady exactly once per host (sentinel in the run-dir). Every later hosting is a
+ *  launch that writes its own marker, so a repeat backfill could only mask a never-ready host. */
+export async function backfillHostReadyOnce(env: NodeJS.ProcessEnv = process.env): Promise<string[] | null> {
+  const sentinel = join(hostRunDir(env), 'ready-backfill.v1')
+  if (existsSync(sentinel)) return null
+  const stamped = await backfillHostReady(env)
+  try {
+    writeFileSync(sentinel, `${new Date().toISOString()} ${stamped.join(',')}\n`, { mode: 0o600 })
+  } catch {
+    /* best-effort */
+  }
+  return stamped
+}

package/src/lifecycle/index.ts

@@ -51,7 +51,8 @@ import {
   type LaunchSpec,
 } from '../launch/index.ts'
 import { composeSystemPrompt, gatherPromptInput } from '../launch/composeSystemPrompt.ts'
-import { hostSessionAlive, killPtyHost } from '../launch/ptyHost.ts'
+import { hostSessionAlive, hostSessionReady, hostStartedMs, killPtyHost, listHostedPeers } from '../launch/ptyHost.ts'
+import { sessionAlive as hostDaemonAlive } from '../supervisor/client.ts'
 import { appendLifecycleEvent, superviseLogVerbose } from './eventlog.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -59,6 +60,8 @@ import { appendLifecycleEvent, superviseLogVerbose } from './eventlog.ts'
 // ─────────────────────────────────────────────────────────────────────────────
 
 export interface LifecycleConfig {
+  /** Process-control namespace, bound when cfg is loaded; never re-resolve it from deps.env. */
+  supervisorRunDir?: string
   claudeBin: string
   codexBin: string
   /** OpenCode native binary (docs/20). Optional so hand-built test configs stay valid. */
@@ -110,6 +113,7 @@ export function loadLifecycleConfig(env: NodeJS.ProcessEnv = process.env): Lifec
     return Number.isFinite(n) && n > 0 ? n : dflt
   }
   return {
+    supervisorRunDir: join(root, STATE_DIR, 'supervisor'),
     claudeBin: env.IAPEER_CLAUDE_BIN ?? join(home, '.local', 'bin', 'claude'),
     codexBin: env.IAPEER_CODEX_BIN ?? 'codex',
     // The official installer's location is not on launchd's PATH; prefer it over a bare name.
@@ -1096,6 +1100,17 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
     }
     // Idempotent fast path inside the lock: a live session wins (a concurrent
     // wake already brought it up) — no second spawn.
+    // ALIVE but NOT READY while we hold the wake lock = no bring-up is in flight for it, yet it never
+    // reached its ready surface (a hung-before-main process, an abandoned bring-up). Not a session —
+    // replace it rather than report READY into a process that will never take input (18.10).
+    if (sessionAlive(sock, identity, env) && !hostSessionReady(identity, env)) {
+      killPtyHost(identity, env, { reason: 'wake-replace-never-ready' })
+      logWake({ identity, runtime, mode: 'replace', cause: 'alive-never-ready' })
+      // SIGTERM is asynchronous — wait (bounded) for the host to be gone, so the fast path below does
+      // not read the dying process as the live winner.
+      for (let i = 0; i < 25 && sessionAlive(sock, identity, env); i++) await new Promise(r => setTimeout(r, 200))
+      if (sessionAlive(sock, identity, env)) return { status: 'FAILED', woke: false, runtime, reason: 'never-ready host did not terminate; retry after recovery' }
+    }
     if (sessionAlive(sock, identity, env)) {
       writeSessionState(cfg, { identity, runtime, personality: args.personality, cwd, wokeAt: Date.now() })
       // taskDelivered:false — the winning concurrent wake delivered ITS OWN task as
@@ -1302,12 +1317,12 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
 // Reap — kill a session (used by idle-reap / supervise; H4-guarded by callers)
 // ─────────────────────────────────────────────────────────────────────────────
 
-export function killSession(_sock: string, identity: string, env: NodeJS.ProcessEnv = process.env): void {
+export function killSession(_sock: string, identity: string, env: NodeJS.ProcessEnv = process.env, reason = 'lifecycle-kill'): void {
   // pty-only: SIGTERM the supervisor daemon — its shutdown kills the PTY-owned tree and removes the
   // sock/pid/serve-spec/markers. Idempotent if the session is already gone. (`_sock` retained for
   // call-site compatibility; no tmux sockets exist.) env sandboxes the run-dir — a test with an
   // injected root must NEVER SIGTERM a real fleet peer's supervisor.
-  killPtyHost(identity, env)
+  killPtyHost(identity, env, { reason })
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1348,6 +1363,9 @@ export interface SuperviseDeps {
   /** Liveness seam (default: the real `sessionAlive` = pty-host pid-file check). Tests inject a fixed
    *  verdict so the idle path is exercised hermetically — no live pty session needed. */
   sessionAlive?: (sock: string, identity: string) => boolean
+  /** Readiness seam (default: launch's ready marker for THIS hosting; with only sessionAlive injected,
+   *  ready ≡ alive). */
+  sessionReady?: (identity: string) => boolean
   /** Reap seam (default: the real `killSession` = SIGTERM the supervisor daemon). Tests inject a no-op
    *  so exercising the reap path NEVER SIGTERMs a real process — the destructive-kill isolation guard. */
   killSession?: (sock: string, identity: string) => void
@@ -1361,7 +1379,9 @@ interface SuperviseCtx {
   lastTurnMt: (runtime: string, cwd: string, personality?: string) => number | null
   childActivityMt: (runtime: string, cwd: string) => number | null
   isAlive: (sock: string, identity: string) => boolean
-  kill: (sock: string, identity: string) => void
+  /** Has THIS hosting reached its runtime's ready surface (launch's ready marker)? */
+  isReady: (identity: string) => boolean
+  kill: (sock: string, identity: string, reason: string) => void
   verbose: boolean
   trace: (fields: Record<string, string | number | undefined>) => void
 }
@@ -1374,7 +1394,7 @@ interface SuperviseCtx {
  * returns exactly one outcome; the trace side-effects mirror the prior inline behaviour.
  */
 function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
-  const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace } = ctx
+  const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, isReady, kill, verbose, trace } = ctx
   // H4 — FIRST, before any reap. A launchd-managed peer is read-only: never wake,
   // never kill, never sweep its PROCESS. Its stale `.session` however is the
   // DAEMON'S own supervisory record (written back when the peer was daemon-owned),
@@ -1448,13 +1468,27 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   // cleared above; no legitimate alive+stopped state exists. Park like the stop verb (.idle-reaped is
   // idempotent with it) — .stopped keeps the peer down until `start`, .idle-reaped makes it resume-clean.
   if (isStopped(cfg, s.identity)) {
-    kill(sock, s.identity)
+    kill(sock, s.identity, 'supervise-stop-enforced')
     setIdleReaped(cfg, s.identity)
     clearEphemeralArmed(cfg, s.identity)
     removeSessionState(cfg, s.identity)
     trace({ identity: s.identity, action: 'reaped-idle', reason: 'alive-but-stopped', outcome: 'operator-halt-enforced' })
     return { identity: s.identity, action: 'reaped-idle', reason: 'live session carried .stopped — operator halt enforced (stop-vs-wake race)' }
   }
+  // NEVER-READY (incident 18.10): a process that never reached its runtime's ready surface well past
+  // the boot + ready-gate deadlines is not a session — a codex hung before main lived 35 min under a
+  // healthy supervisor. Launch now tears such a host down itself; this is the backstop for a bring-up
+  // the launcher could not finish (daemon restarted mid-boot, a launcher crash). Reaped as a FAULT
+  // (recordDeath → the crash-loop guard bounds a boot that keeps hanging); its ledger entries then
+  // orphan and are redelivered to the next session.
+  const boundMs = (cfg.bootDeadlineSecs + cfg.readyGateSecs + 60) * 1000
+  if (!isReady(s.identity) && nowMs - s.wokeAt > boundMs) {
+    kill(sock, s.identity, 'supervise-never-ready')
+    recordDeath(cfg, s.identity, nowMs)
+    removeSessionState(cfg, s.identity)
+    trace({ identity: s.identity, action: 'reaped-gone', reason: 'never-ready', age: `${Math.floor((nowMs - s.wokeAt) / 1000)}s`, outcome: 'fresh-next-msg' })
+    return { identity: s.identity, action: 'reaped-gone', reason: 'alive but never reached its ready surface' }
+  }
   // Idle accounting via the LAST MEANINGFUL TRANSCRIPT ENTRY's content-timestamp (adapter.lastTurnMtime)
   // — the only RELIABLE idle signal. The two raw mtimes both report FALSE freshness for an idle session:
   //   • pane-log mtime — a statusline / footer re-render writes pty bytes at idle (the clock/usage/ctx%
@@ -1495,7 +1529,7 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   // Deliberate, policy-driven death: NO .idle-reaped (an ephemeral peer never resumes)
   // and NO recordDeath (the crash-loop ring counts faults, not policy reaps).
   if (ephemeral && hasEphemeralArmed(cfg, s.identity) && ageSecs > cfg.ephemeralQuietSecs) {
-    kill(sock, s.identity)
+    kill(sock, s.identity, 'supervise-ephemeral-done')
     clearEphemeralArmed(cfg, s.identity)
     removeSessionState(cfg, s.identity)
     trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-done' })
@@ -1521,7 +1555,7 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
   // tool, no reply yet) keeps the pane-log fresh via the TUI render, so it is no longer
   // reaped mid-task — only a genuinely idle/wedged unarmed session crosses this bound.
   if (ephemeral && ageSecs > cfg.ephemeralUnarmedIdleSecs) {
-    kill(sock, s.identity)
+    kill(sock, s.identity, 'supervise-ephemeral-unarmed')
     clearEphemeralArmed(cfg, s.identity)
     removeSessionState(cfg, s.identity)
     trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-unarmed-bound' })
@@ -1550,7 +1584,7 @@ function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome
     // INITIATES. Its presence on the next wake = the session was parked cleanly =
     // RESUME-eligible (resolveWakeMode branch 3b). A crash/self-close (the dead
     // branch above) never writes it → that wakes FRESH (branch 3a).
-    kill(sock, s.identity)
+    kill(sock, s.identity, 'supervise-idle')
     setIdleReaped(cfg, s.identity)
     removeSessionState(cfg, s.identity)
     trace({ identity: s.identity, action: 'reaped-idle', age: `${ageSecs}s`, outcome: 'resume-eligible' })
@@ -1567,6 +1601,8 @@ const limitHoldTraced = new Set<string>()
 
 export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): SuperviseOutcome[] {
   const env = deps.env ?? process.env
+  // Legacy partial cfgs get a PRIVATE namespace, not the invoking host's fleet.
+  const runDir = cfg.supervisorRunDir ?? join(cfg.stateDir, 'supervisor')
   const nowMs = deps.nowMs ?? Date.now()
   const lastTurnMt =
     deps.lastTurnMtime ??
@@ -1574,8 +1610,12 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const childActivityMt =
     deps.childActivityMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).childActivityMtime?.(c) ?? null)
   // Default seams bind the injected env so a sandboxed tick never reads/kills the real fleet.
-  const isAlive = deps.sessionAlive ?? ((sock: string, identity: string) => sessionAlive(sock, identity, env))
-  const kill = deps.killSession ?? ((sock: string, identity: string) => killSession(sock, identity, env))
+  const isAlive = deps.sessionAlive ?? ((_sock: string, identity: string) => hostDaemonAlive(runDir, identity))
+  // Readiness seam. A test that injects ONLY sessionAlive gets ready ≡ alive (its fixtures predate the
+  // marker); production reads launch's ready marker for this very hosting.
+  const isReady =
+    deps.sessionReady ?? (deps.sessionAlive ? (identity: string) => deps.sessionAlive!('', identity) : (identity: string) => hostSessionReady(identity, env, runDir))
+  const kill = deps.killSession ?? ((_sock: string, identity: string, reason: string) => killPtyHost(identity, env, { reason }, runDir))
   const verbose = superviseLogVerbose(env)
   // Pane-log volume ROTATION (launch/cmdlog.ts capPaneLogs): the per-identity pane-log
   // (<logDir>/<identity>.log) is the RAW TUI byte stream pipe-pane/the supervisor
@@ -1613,7 +1653,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
     })
   }
   const out: SuperviseOutcome[] = []
-  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace }
+  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, isReady, kill, verbose, trace }
   for (const s of readSessionStates(cfg)) {
     // Per-peer ISOLATION: a throw while evaluating ONE peer must NOT abort the whole sweep — that is
     // the silent fleet-wide reap-outage class (one malformed peer-state and NO peer gets reaped, the
@@ -1627,6 +1667,30 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       trace({ identity: s.identity, action: 'skipped-error', reason, outcome: 'peer-error-isolated' })
     }
   }
+  // NEVER-READY hosts with NO `.session` (18.10): the session state is written only AFTER a successful
+  // bring-up, so a bring-up that hung and was then abandoned (the launcher died mid-boot, a daemon
+  // restart) leaves a live host the loop above never sees — exactly how codex-linus, hung in dyld,
+  // stayed ● for 35 min. Walk the run-dir itself. H4: never a launchd-managed peer's host.
+  if (!deps.sessionAlive) {
+    const known = new Set(out.map(o => o.identity))
+    const boundMs = (cfg.bootDeadlineSecs + cfg.readyGateSecs + 60) * 1000
+    for (const h of listHostedPeers(env, runDir)) {
+      const identity = `${h.runtime}-${h.personality}`
+      if (known.has(identity)) continue
+      try {
+        if (isLaunchdManaged(h.personality, env)) continue
+        if (hostSessionReady(identity, env, runDir)) continue
+        const started = hostStartedMs(identity, env, runDir)
+        if (started === null || nowMs - started <= boundMs) continue
+        kill('', identity, 'supervise-never-ready-unsupervised')
+        recordDeath(cfg, identity, nowMs)
+        trace({ identity, action: 'reaped-gone', reason: 'never-ready-unsupervised', age: `${Math.floor((nowMs - started) / 1000)}s`, outcome: 'fresh-next-msg' })
+        out.push({ identity, action: 'reaped-gone', reason: 'unsupervised host never reached its ready surface' })
+      } catch {
+        /* per-host isolation, like the loop above */
+      }
+    }
+  }
   return out
 }
 

package/src/supervisor/capture.ts

@@ -0,0 +1,43 @@
+import { frame, FRAME_DATA, FRAME_RESIZE, makeFramer, sizePayload } from './protocol.ts'
+import { readGeometry, sockPath } from './paths.ts'
+
+/** Read the running host's OWN emulator, never the shared cross-session pane-log.
+ * Legacy hosts already implement same-size attach: no resize or input is sent to the child. */
+export async function captureHostViewport(runDir: string, session: string): Promise<string | null> {
+  const geometry = readGeometry(runDir, session)
+  if (!geometry) return null
+  const { cols, rows } = geometry
+  const bytes = await new Promise<Buffer | null>(resolve => {
+    let conn: Awaited<ReturnType<typeof Bun.connect>> | undefined
+    const chunks: Buffer[] = []
+    let settled = false
+    let quiet: ReturnType<typeof setTimeout> | undefined
+    const finish = () => {
+      if (settled) return
+      settled = true
+      clearTimeout(deadline)
+      clearTimeout(quiet)
+      conn?.end()
+      resolve(chunks.length ? Buffer.concat(chunks) : null)
+    }
+    const deadline = setTimeout(finish, 1500)
+    const consume = makeFramer((type, payload) => {
+      if (type !== FRAME_DATA) return
+      chunks.push(Buffer.from(payload))
+      clearTimeout(quiet)
+      quiet = setTimeout(finish, 80)
+    })
+    Bun.connect({ unix: sockPath(runDir, session), socket: {
+      open(s) { s.write(frame(FRAME_RESIZE, sizePayload(cols, rows))) },
+      data(_s, data) { consume(data) }, close() { finish() }, error() { finish() }, connectError() { finish() },
+    } }).then(s => { conn = s; if (settled) s.end() }).catch(finish)
+  })
+  if (!bytes) return null
+  const { Terminal } = await import('@xterm/headless')
+  const { modelToPlainText } = await import('./render.ts')
+  const term = new Terminal({ cols, rows, allowProposedApi: true })
+  try {
+    await new Promise<void>(r => term.write(bytes, r))
+    return modelToPlainText(term, cols, rows)
+  } finally { term.dispose() }
+}

package/src/supervisor/index.ts

@@ -5,7 +5,10 @@
 // serving is productionized (a later block) the daemon-spawn argv is repointed at the installed
 // binary; for now it self-spawns from source (bun + this file), which is what the tests exercise.
 import { spawn as nodeSpawn } from 'node:child_process'
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
+import { appendFileSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { formatEventLine } from '../storage/rotatelog.ts'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
 import { defaultRunDir, logPath, ownershipVerdict, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
@@ -217,7 +220,30 @@ export function listSessions(runDir: string): Array<{ session: string; alive: bo
     })
 }
 
-export function killSession(runDir: string, session: string): boolean {
+export interface TerminationContext { reason?: string; caller?: string; sandbox?: boolean; targetPid?: number; targetToken?: string }
+
+/** Strict write-ahead audit: if attribution cannot be persisted, do not signal. No payload/env. */
+export function auditTermination(runDir: string, targets: string[], context: TerminationContext = {}): void {
+  const canonical = (p: string) => { try { return realpathSync(p) } catch { return resolve(p) } }
+  if ((context.sandbox || process.env.IAPEER_TEST_SANDBOX === '1') && canonical(runDir) === canonical(join(homedir(), '.iapeer/state/supervisor'))) {
+    throw new Error('refusing to signal the REAL supervisor run-dir under IAPEER_TEST_SANDBOX=1')
+  }
+  mkdirSync(runDir, { recursive: true, mode: 0o700 })
+  const fd = openSync(join(runDir, 'terminations.log'), 'a', 0o600)
+  try {
+    appendFileSync(fd, formatEventLine(Date.now(), {
+      ev: targets.length > 1 ? 'termination-batch' : 'termination-request',
+      targets: targets.join(','), caller: context.caller ?? process.env.PEER_IDENTITY ??
+        (process.env.PEER_PERSONALITY ? `${process.env.PEER_RUNTIME ?? 'unknown'}-${process.env.PEER_PERSONALITY}` : `uid:${process.getuid?.() ?? 'unknown'}`),
+      caller_pid: process.pid, caller_ppid: process.ppid,
+      target_pid: context.targetPid, target_token: context.targetToken,
+      reason: context.reason ?? `supervisor-kill:${process.argv[2] ?? 'api'}`,
+    }) + '\n')
+    fsyncSync(fd)
+  } finally { closeSync(fd) }
+}
+
+export function killSession(runDir: string, session: string, context: TerminationContext = {}): boolean {
   const rec = readPidFile(runDir, session)
   if (!rec) return false
   // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
@@ -228,6 +254,7 @@ export function killSession(runDir: string, session: string): boolean {
   if (rec.token && !ownershipVerdict(pidStartToken(rec.pid), rec.token)) {
     return false // reused pid — NOT our session; do not signal it
   }
+  auditTermination(runDir, [session], { ...context, targetPid: rec.pid, targetToken: rec.token })
   try {
     process.kill(rec.pid, 'SIGTERM')
   } catch {

package/src/transport/index.ts

@@ -53,6 +53,7 @@ import {
   hostGeometry,
   hostRunDir,
   hostSessionAlive,
+  hostSessionReady,
   hostSessionToken,
   listHostedPeers,
   resubmitHosted,
@@ -103,22 +104,29 @@ function monotonicMs(): number {
 }
 
 function sessionAlive(_sock: string, address: string, env: NodeJS.ProcessEnv = process.env): boolean {
-  // pty-only: a peer's liveness is its supervisor daemon (a cheap pid-file check). `address` IS the
-  // identity. (`_sock` is retained for call-site compatibility; tmux sockets no longer exist.)
-  // env sandboxes the run-dir — an env-injected verb must not read the real fleet's liveness.
-  return hostSessionAlive(address, env)
+  // DELIVERY liveness = the hosting is alive AND its runtime reached its ready surface (incident
+  // 18.10: a codex hung before main lived under a healthy supervisor and took a message with a false
+  // ok). A not-yet-ready session routes as a MISS → the wake path, which waits on the in-flight
+  // bring-up (wake.lock) or replaces a failed one. `address` IS the identity; `_sock` is legacy.
+  return hostSessionReady(address, env)
 }
 
-/** Is the (runtime,personality) endpoint live right now? Public liveness predicate. */
-export function isPeerLive(runtime: string, personality: string, sockDir = resolveSockDir(), env: NodeJS.ProcessEnv = process.env): boolean {
-  const socketPath = buildSocketPath(runtime, personality, sockDir)
-  return sessionAlive(socketPath, buildProcessAddress(runtime, personality), env)
+/** Is the (runtime,personality) endpoint's PROCESS up right now (ready or not)? The operator-verb
+ *  guard (stop/remove/rename must still reach a hung process) — NOT a delivery predicate. */
+export function isPeerLive(runtime: string, personality: string, _sockDir = resolveSockDir(), env: NodeJS.ProcessEnv = process.env): boolean {
+  return hostSessionAlive(buildProcessAddress(runtime, personality), env)
+}
+
+/** Is the endpoint up AND its runtime ready (accepts input)? — what `list` shows as ●. */
+export function isPeerReady(runtime: string, personality: string, env: NodeJS.ProcessEnv = process.env): boolean {
+  return hostSessionReady(buildProcessAddress(runtime, personality), env)
 }
 
 export function listOnlinePeers(_sockDir = resolveSockDir(), env: NodeJS.ProcessEnv = process.env): OnlinePeer[] {
   // pty-only: every live peer is a supervisor-hosted session (no tmux sockets to scan).
   const out = new Map<string, OnlinePeer>()
   for (const h of listHostedPeers(env)) {
+    // Operator discovery includes booting/hung processes so interrupt/stop can still address them.
     out.set(buildProcessAddress(h.runtime, h.personality), { personality: h.personality, runtime: h.runtime })
   }
   return Array.from(out.values()).sort(
@@ -132,6 +140,8 @@ export function resolveDeliveryTarget(args: {
   sockDir?: string
   /** Б7 — injected env sandboxes the liveness reads (supervisor run-dir); default process.env (prod). */
   env?: NodeJS.ProcessEnv
+  /** Operator control can address a hung/booting process; delivery cannot. */
+  processOnly?: boolean
 }): Result<DeliveryTarget> {
   const env = args.env ?? process.env
   const sockDir = args.sockDir ?? resolveSockDir(env)
@@ -143,12 +153,13 @@ export function resolveDeliveryTarget(args: {
     const runtime = args.runtime
     const socketPath = buildSocketPath(runtime, args.personality, sockDir)
     const address = buildProcessAddress(runtime, args.personality)
-    if (!sessionAlive(socketPath, address, env)) {
+    if (!(args.processOnly ? hostSessionAlive(address, env) : sessionAlive(socketPath, address, env))) {
       return err(`peer offline: ${args.personality} (${args.runtime})`)
     }
     return ok({ runtime, personality: args.personality, address, socketPath })
   }
-  const matches = listOnlinePeers(sockDir, env).filter(peer => peer.personality === args.personality)
+  const matches = listOnlinePeers(sockDir, env).filter(peer => peer.personality === args.personality &&
+    (args.processOnly || hostSessionReady(buildProcessAddress(peer.runtime, peer.personality), env)))
   if (matches.length === 0) return err(`peer offline: ${args.personality}`)
   if (matches.length > 1) {
     return err(
@@ -1220,13 +1231,13 @@ export interface ControlResult {
  * live endpoints stays ambiguous → explicit refusal. An explicit runtime is exact.
  */
 export function resolveControlTarget(personality: string, runtime: string | undefined, env: NodeJS.ProcessEnv = process.env): Result<DeliveryTarget> {
-  if (runtime) return resolveDeliveryTarget({ personality, runtime, env })
+  if (runtime) return resolveDeliveryTarget({ personality, runtime, env, processOnly: true })
   const peer = findPeer(readPeersIndex({ env }), personality)
   if (peer) {
-    const anchored = resolveDeliveryTarget({ personality, runtime: peer.runtime, env })
+    const anchored = resolveDeliveryTarget({ personality, runtime: peer.runtime, env, processOnly: true })
     if (anchored.ok) return anchored
   }
-  return resolveDeliveryTarget({ personality, env })
+  return resolveDeliveryTarget({ personality, env, processOnly: true })
 }
 
 export async function routeControl(personality: string, runtime: string | undefined, command: ControlCommand): Promise<Result<ControlResult>> {

package/src/tray/render.ts

@@ -12,7 +12,7 @@
 // peer row hands off to `iapeer attach`, the terminal-handoff the API deliberately
 // keeps client-side).
 
-const GLYPH: Record<'live' | 'asleep' | 'stopped', string> = { live: '●', asleep: '○', stopped: '✕' }
+const GLYPH: Record<'live' | 'booting' | 'asleep' | 'stopped', string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
 
 const COLOR = {
   meta: '#8b949e',
@@ -31,7 +31,7 @@ const APPROVAL_CONTENT_MAX_CHARS = 8000
 
 export interface TrayRuntime {
   runtime: string
-  status: 'live' | 'asleep' | 'stopped'
+  status: 'live' | 'booting' | 'asleep' | 'stopped'
   attached?: boolean
 }
 
@@ -134,13 +134,14 @@ export function fmtClock(now: number): string {
 
 // ── peer status aggregation ─────────────────────────────────────────────────────
 
-function aggregate(p: TrayPeer): 'live' | 'asleep' | 'stopped' {
+function aggregate(p: TrayPeer): 'live' | 'booting' | 'asleep' | 'stopped' {
   if (p.runtimes.some(r => r.status === 'live')) return 'live'
+  if (p.runtimes.some(r => r.status === 'booting')) return 'booting'
   if (p.runtimes.some(r => r.status === 'asleep')) return 'asleep'
   return 'stopped'
 }
 
-const RANK: Record<'live' | 'asleep' | 'stopped', number> = { live: 0, asleep: 1, stopped: 2 }
+const RANK: Record<'live' | 'booting' | 'asleep' | 'stopped', number> = { live: 0, booting: 1, asleep: 2, stopped: 3 }
 
 // 🔒 launchd-managed peers (the human channel + service infra — arthur/timer/watcher) are
 // NON-clickable status rows. They form ONE contiguous block at the very TOP, before the first

package/src/tui/dashboard/app.tsx

@@ -23,8 +23,8 @@ const POLL_MS = 2000
 const HOST_POLL_MS = 10_000
 const LOG_LIMIT = 12
 
-const STATUS_GLYPH: Record<RuntimeLiveness, string> = { live: '●', asleep: '○', stopped: '✕' }
-const STATUS_COLOR: Record<RuntimeLiveness, string | undefined> = { live: 'green', asleep: undefined, stopped: 'red' }
+const STATUS_GLYPH: Record<RuntimeLiveness, string> = { live: '●', booting: '◐', asleep: '○', stopped: '✕' }
+const STATUS_COLOR: Record<RuntimeLiveness, string | undefined> = { live: 'green', booting: 'yellow', asleep: undefined, stopped: 'red' }
 
 function RuntimeCells({ row }: { row: PeerListing }): React.ReactElement {
   return (

package/src/uninstall/index.ts

@@ -226,9 +226,12 @@ async function waitJobGone(run: SysRunner, uid: number, label: string, timeoutMs
  *  wait for its pidfile-liveness to drop). Best-effort per session; reports laggards. */
 async function stopHostedSessions(env: NodeJS.ProcessEnv, timeoutMs = 8000): Promise<{ stopped: string[]; stuck: string[] }> {
   const identities = listHostedPeers(env).map(h => buildProcessAddress(h.runtime, h.personality))
+  const { auditTermination } = await import('../supervisor/index.ts')
+  const { hostRunDir } = await import('../launch/ptyHost.ts')
+  if (identities.length) auditTermination(hostRunDir(env), identities, { reason: 'uninstall-hosted-sessions', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
   for (const id of identities) {
     try {
-      killPtyHost(id, env)
+      killPtyHost(id, env, { reason: 'uninstall-hosted-sessions' })
     } catch {
       /* verified-dead / permission — the wait below reports it */
     }
@@ -258,6 +261,10 @@ export async function executeUninstall(opts: UninstallOptions = {}): Promise<Uni
   }
 
   const uid = process.getuid?.() ?? 0
+  const { auditTermination } = await import('../supervisor/index.ts')
+  const { hostRunDir } = await import('../launch/ptyHost.ts')
+  const targets = plan.items.filter(i => i.present && i.action === 'bootout-remove-plist').map(i => i.path ?? i.what)
+  if (targets.length) auditTermination(hostRunDir(env), targets, { reason: 'uninstall', caller: env.PEER_IDENTITY, sandbox: env.IAPEER_TEST_SANDBOX === '1' })
   // Set when a launchd job survived bootout (В56) — ~/.iapeer must NOT be removed
   // from under a job launchd may respawn (KeepAlive) into the deleted tree.
   let jobStillLoaded: string | undefined

package/src/update/index.ts

@@ -39,6 +39,8 @@ import { IAPEER_VERSION } from '../core/version.ts'
 import { iapeerBinPath, stampBinaryHealthy } from '../install/index.ts'
 import { ensureExecutableSignature } from '../install/signature.ts'
 import { readPeersIndex } from '../registry/index.ts'
+import { auditTermination } from '../supervisor/index.ts'
+import { defaultRunDir } from '../supervisor/paths.ts'
 import {
   cycleDaemon,
   cycleLaunchdJob,
@@ -263,6 +265,9 @@ export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process
   if (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1') return []
   const out: InfraJobRecycleResult[] = []
   const index = readPeersIndex({ env })
+  const targets = index.peers.flatMap(peer => [...new Set([peer.runtime, ...peer.runtimes])].filter(isInfraRuntime)
+    .map(runtime => resolveAlwaysOnTarget(peer.personality, runtime, env)).filter(t => isFoundationOwnedPlist(t.path)).map(t => t.label))
+  if (targets.length) auditTermination(defaultRunDir(env), targets, { reason: 'update-recycle-infra', caller: env.PEER_IDENTITY })
   for (const peer of index.peers) {
     // Multi-infra (0.4.88): a personality can hold SEVERAL always-on channels
     // (e.g. arthur: telegram on the legacy base plist + web on the per-runtime