@agfpd/iapeer 0.4.15 → 0.4.17

package/CHANGELOG.md

@@ -10,6 +10,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.17] - 2026-06-21
+
+### Added
+
+- `iapeer rename <old> <new>` — first-class peer-identity rename (parity with remove/create).
+  Renames the personality in **both** the registry and the per-cwd profile atomically and
+  **keeps the cwd**, so the claude transcript history (keyed by `realpath(cwd)`) survives.
+  Refuses a LIVE peer unless `--force` (a running session carries the old identity in its
+  env), and purges the old identity's lifecycle markers. Memory re-key (the personality-keyed
+  operativka folder + author/index attribution) is the memory provider's separate step;
+  native-memory is cwd-keyed and unaffected.
+
+## [0.4.16] - 2026-06-21
+
+### Fixed
+
+- Idle-reap now uses the pane-log (TUI render-stream) mtime as its activity proxy, not the
+  transcript file mtime. A live claude session re-touches its session `.jsonl` periodically
+  *without a real turn*, so the transcript proxy never crossed `idleSecs` and **claude peers
+  never idle-reaped** — the fleet piled up warm while codex peers (whose session file isn't
+  re-touched) reaped normally. The pane-log goes truly quiet at the prompt, so idle peers now
+  reap as intended. Pane-log primary; transcript fallback only when the pane-log is missing
+  (legacy supervisor); the launch ready-gate still uses the transcript.
+
 ## [0.4.15] - 2026-06-21
 
 ### Fixed
@@ -233,7 +257,9 @@ Initial public release — the foundation core of the iapeer multi-agent ecosyst
 - **Heterogeneous peers** — AI agents (Claude, Codex), humans (Telegram), and services
   (timer = cron, watcher = event) are all first-class and addressed the same way.
 
-[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.15...HEAD
+[Unreleased]: https://github.com/agfpd/iapeer/compare/v0.4.17...HEAD
+[0.4.17]: https://github.com/agfpd/iapeer/compare/v0.4.16...v0.4.17
+[0.4.16]: https://github.com/agfpd/iapeer/compare/v0.4.15...v0.4.16
 [0.4.15]: https://github.com/agfpd/iapeer/compare/v0.4.14...v0.4.15
 [0.4.14]: https://github.com/agfpd/iapeer/compare/v0.4.13...v0.4.14
 [0.4.13]: https://github.com/agfpd/iapeer/compare/v0.4.12...v0.4.13

package/README.md

@@ -20,18 +20,18 @@ Agents on Claude and on Codex are different AI runtimes from different vendors,
 ## How it works
 
 ```text
-send_to_peer(name, text)     ← from any peer
+send_to_peer(name, text)   ← from any peer
         │
         ▼
-router daemon   — always on; finds the recipient, checks liveness, delivers
+router daemon              — always on; finds the recipient, checks liveness, delivers
         │
         ▼
-recipient peer  — asleep? the daemon wakes it and delivers on wake
+recipient peer             — asleep? the daemon wakes it and delivers on wake
 ```
 
 ## What makes it different
 
-- **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call (as of 2026-06-15, `claude -p` no longer counts against the subscription's main usage limits).
+- **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call.
 - **Warm-on-demand lifecycle.** A live session answers fast; after about an hour idle the daemon closes it; the next message brings it back with its context resumed. The message flow drives the lifecycle, not a human's presence.
 - **One identity across runtimes, with one memory.** A peer's `personality` is decoupled from its runtime: the same peer runs on Claude or Codex, switched with a command. By default (set up by `iapeer onboard`) it carries one shared memory (iapeer-memory) keyed to the personality, not the runtime — one personality, one memory, whatever runtime it runs on.
 - **Heterogeneous peers, one protocol.** AI agents, humans (Telegram), and services (timer = cron, watcher = event) are all first-class, addressed the same way over an always-on MCP daemon that exposes exactly one tool, `send_to_peer`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -53,7 +53,7 @@ import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
 import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
-import { readPeerProfile, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
+import { readPeerProfile, renamePeer, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import {
   isConformant,
@@ -827,6 +827,61 @@ export async function removePeerCli(
   }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// rename — first-class peer-identity rename (parity with remove/create). Wraps
+// renamePeer (registry + per-cwd profile, atomic, inside the lock) and KEEPS the
+// cwd, so the claude transcript history (slug = realpath(cwd)) survives the rename.
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface RenameOutcome {
+  oldPersonality: string
+  newPersonality: string
+  action: 'renamed' | 'absent' | 'target-exists' | 'refused-live'
+  reason?: string
+  cwd?: string
+  purgedState?: string[]
+}
+
+/**
+ * Rename a peer's personality through renamePeer (registry + per-cwd profile, atomic;
+ * cwd KEPT — the transcript history keyed by slug=realpath(cwd) survives). Refuses a LIVE
+ * peer unless --force: a running session carries the OLD identity in its env
+ * (PEER_PERSONALITY, set at launch), so renaming under it desyncs the registry from the
+ * live process — stop it first, it respawns under the new identity. Purges the OLD
+ * identity-keyed lifecycle markers (remove-parity) so a future namesake can't inherit
+ * them. Does NOT move memory: the operativka folder + author/index attribution are
+ * personality-keyed (the memory provider re-keys them separately); native-memory is
+ * cwd-keyed and rides the kept cwd unchanged.
+ */
+export async function renamePeerCli(
+  oldPersonality: string,
+  newPersonality: string,
+  opts: CliEnvOptions & { force?: boolean } = {},
+): Promise<RenameOutcome> {
+  const env = opts.env ?? process.env
+  const index = readPeersIndex({ env })
+  const peer = findPeer(index, oldPersonality)
+  if (!peer) return { oldPersonality, newPersonality, action: 'absent' }
+  if (findPeer(index, newPersonality)) {
+    return { oldPersonality, newPersonality, action: 'target-exists', reason: `"${newPersonality}" already exists` }
+  }
+  const cfg = loadLifecycleConfig(env)
+  if (!opts.force) {
+    const liveRt = peer.runtimes.find(rt => isPeerLive(rt, oldPersonality, cfg.sockDir))
+    if (liveRt) {
+      return {
+        oldPersonality,
+        newPersonality,
+        action: 'refused-live',
+        reason: `"${oldPersonality}" is LIVE on ${liveRt} — its running session carries the old identity in its env; stop it first (\`iapeer stop ${oldPersonality}\`) or pass --force`,
+      }
+    }
+  }
+  await renamePeer(oldPersonality, newPersonality, { env })
+  const purgedState = peer.runtimes.flatMap(rt => purgeIdentityState(cfg, buildProcessAddress(rt, oldPersonality)))
+  return { oldPersonality, newPersonality, action: 'renamed', cwd: peer.cwd, purgedState }
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // send — manual IAP send fallback (contract Примитивы §send). Goes through the
 // same router path as send_to_peer (resolve → deliver / wake), in-process so it
@@ -999,6 +1054,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
     desc: 'LAZY soft-reload: agentic peer comes up FRESH (re-reads doctrine) on its NEXT natural wake — no kill, no burst-wake; non-agentic runtimes skipped. --all = whole fleet. (eager: `new`/self-fresh)',
   },
   { sig: 'remove <peer> [--force]', desc: 'delete a peer\'s registry record (locked writer); refuses a LIVE peer unless --force' },
+  { sig: 'rename <old> <new> [--force]', desc: 'rename a peer\'s personality (registry + per-cwd profile, atomic; cwd/transcript-history kept); refuses a LIVE peer unless --force. Memory re-key is the provider\'s separate step.' },
   {
     sig: 'send <target> (--message <text> | --message-file <f|->) [--from <id>] [--attachment <p>]… [--topic <t>]',
     desc: 'manual IAP send (fallback)',
@@ -1702,6 +1758,25 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         else errOut(`remove: ${o.reason}\n`)
         return o.action === 'refused-live' ? 1 : 0
       }
+      case 'rename': {
+        // Rename a peer's personality (registry + per-cwd profile, atomic; cwd KEPT so
+        // the transcript history survives). Refuses a LIVE peer unless --force. Memory
+        // (operativka folder + author/index) is personality-keyed and re-keyed separately
+        // by the provider — say so, or it reads as a silent data loss.
+        if (!positionals[0] || !positionals[1]) {
+          return argErr(errOut, 'rename needs old and new names — usage: iapeer rename <old> <new> [--force]')
+        }
+        const o = await renamePeerCli(positionals[0], positionals[1], { force: flags.force === true, env })
+        if (o.action === 'renamed') {
+          out(`renamed "${o.oldPersonality}" → "${o.newPersonality}" (registry + per-cwd profile; cwd kept: ${o.cwd})\n`)
+          if (o.purgedState?.length) out(`lifecycle state purged (old identity): ${o.purgedState.join(', ')}\n`)
+          out(
+            `NOTE: memory is NOT moved by rename — re-key the operativka folder + author/index attribution under "${o.newPersonality}" via the memory provider (native-memory rides the kept cwd, unchanged). Wake "${o.newPersonality}" to verify identity + history.\n`,
+          )
+        } else if (o.action === 'absent') errOut(`rename: "${o.oldPersonality}" not registered\n`)
+        else errOut(`rename: ${o.reason}\n`)
+        return o.action === 'renamed' ? 0 : 1
+      }
       case 'send': {
         // Message body from EITHER --message <text> OR --message-file <f> (f='-' →
         // stdin). The runtime packages (telegram/notifier) + monitor deliver via

package/src/core/constants.ts

@@ -56,7 +56,7 @@ export function normalizeIntelligenceValue(value: unknown): Intelligence | undef
   return LEGACY_INTELLIGENCE[value]
 }
 
-const NATURAL_RUNTIMES = new Set(['telegram', 'discord', 'matrix', 'email', 'web'])
+const NATURAL_RUNTIMES = new Set(['telegram', 'discord', 'matrix', 'email', 'web', 'voicetalk'])
 const ABSENT_RUNTIMES = new Set(['notifier', 'webhook', 'api', 'cron'])
 
 export function defaultIntelligenceForRuntime(runtime: string): Intelligence {
@@ -67,12 +67,12 @@ export function defaultIntelligenceForRuntime(runtime: string): Intelligence {
 
 // Infra runtimes are ALWAYS-ON (held live by launchd KeepAlive), as opposed to the
 // warm-on-demand agentic runtimes (claude/codex, woken by the daemon). Liveness is
-// a property of the RUNTIME, not the personality (zone Идентичность). Both infra
-// runtimes are routers with a tmux endpoint: telegram receives inbound messages,
-// notifier receives send_to_peer(timer|watcher, …) registration/live-reload — so
-// each needs a live tmux pane for the daemon's deliverViaTmux to paste into. This
-// set gates always-on launchd plist generation (src/launch/launchd.ts).
-const INFRA_RUNTIMES = new Set(['notifier', 'telegram'])
+// a property of the RUNTIME, not the personality (zone Идентичность). Infra runtimes
+// are routers hosted by the pty supervisor: telegram/voicetalk carry a human channel
+// (inbound messages / voice), notifier receives send_to_peer(timer|watcher, …)
+// registration/live-reload — outbound to each is deliverHosted → the child's stdin.
+// This set gates always-on launchd plist generation (src/launch/launchd.ts).
+const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk'])
 
 export function isInfraRuntime(runtime: string): boolean {
   return INFRA_RUNTIMES.has(runtime)
@@ -89,6 +89,7 @@ export function isInfraRuntime(runtime: string): boolean {
 export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
   notifier: 'NOTIFIER_RUNTIME_BIN',
   telegram: 'TELEGRAM_RUNTIME_BIN',
+  voicetalk: 'VOICETALK_RUNTIME_BIN',
 }
 
 /** The PATH-resolvable default launcher name per infra runtime (when no abs path
@@ -97,6 +98,7 @@ export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
 export const INFRA_RUNTIME_DEFAULT_BIN: Readonly<Record<string, string>> = {
   notifier: 'notifier-runtime',
   telegram: 'telegram-runtime',
+  voicetalk: 'voicetalk-runtime',
 }
 
 // codex MCP token-free import (contract Установка §codex MCP). codex REFUSES to import

package/src/launch/adapters/voicetalk.ts

@@ -0,0 +1,95 @@
+// voicetalk RuntimeAdapter — the "HOW to launch / observe ONE voicetalk session"
+// half of the launch contract (src/launch/types.ts). Like telegram, voicetalk is a
+// long-running ROUTER (voicetalk-runtime run: mic + wake-word listen → IAP envelopes
+// to the fleet; <iap>-marked stdin → TTS to the owner's speaker), NOT an LLM TUI. So
+// kind:'router' tells launch.launch to SKIP every TUI phase — no pane boot dialog, no
+// ready-marker, no first-user-turn delivery, no activity-proxy ready-gate, no
+// permission modal, no transcript to resume. The pane predicates below are therefore
+// trivial constants, present only to satisfy the frozen interface.
+//
+// voicetalk is a presence-runtime for a HUMAN (the owner's voice channel), modelled on
+// telegram per the foundation presence-runtime contract: kind:'router',
+// usesDoctrine:false, requiresIntelligence:'natural', argv = `<bin> run <extra>`. The
+// STT/TTS engines and providers live in a shared voice service (voice-connect), NOT in
+// this adapter and NOT in the peer passport — interfaces.voicetalk carries only the
+// binding ({wake_word, device}), opaque to the foundation.
+//
+// NO currency on this path: no marketplace check, no plugin install/update — that is
+// install-time (the package self-deploys its runtime.json manifest), not session
+// bring-up.
+
+import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+
+// ─────────────────────────────────────────────────────────────────────────────
+// voicetalkAdapter
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const voicetalkAdapter: RuntimeAdapter = {
+  runtime: 'voicetalk',
+  kind: 'router',
+  usesDoctrine: false,
+
+  /** No submit surface — a router takes no bracketed-paste-then-Enter turn; delivery
+   *  is deliverHosted → child stdin (<iap> reader), not submitIntoTui. Empty glyphs. */
+  deliveryMarkers: { promptGlyphs: [] },
+
+  /**
+   * voicetalk is a HUMAN channel — launch REFUSES a non-natural peer (fail-loud).
+   * Same nature gate as telegram: a peer with intelligence artificial/absent must never
+   * be brought up on voicetalk (it would route the owner's voice channel to an
+   * agent/script). The launch primitive enforces this against LaunchSpec.intelligence;
+   * source of intelligence → docs/Идентичность.
+   */
+  requiresIntelligence: 'natural',
+
+  /**
+   * argv = voicetalkBin + 'run' + extraArgs.
+   *   - cfg.voicetalkBin ?? 'voicetalk-runtime'  the launch binary (the always-on
+   *     plist pins an absolute path via VOICETALK_RUNTIME_BIN — launchd-minimal PATH;
+   *     here we defer to cfg.voicetalkBin when set, else emit the PATH-resolvable
+   *     literal for launch.launch to resolve).
+   *   - 'run'  the router subcommand: reads the peer-profile binding (interfaces.voicetalk),
+   *     brings up mic + wake-word listening, and pumps IAP envelopes both directions
+   *     through the session's stdio (outbound <iap> stdin → TTS; inbound mic → fleet via
+   *     the daemon send_to_peer).
+   *   - ...extraArgs  LaunchSpec.extraArgs passthrough.
+   *
+   * NO --system-prompt-file: usesDoctrine:false — a router is not an LLM, no doctrine to
+   * merge. NO --resume: a router has no transcript. NO currency on this path.
+   */
+  buildArgv(spec: LaunchSpec, cfg: LaunchAdapterConfig): string[] {
+    return [cfg.voicetalkBin ?? 'voicetalk-runtime', 'run', ...(spec.extraArgs ?? [])]
+  },
+
+  /** No startup dialogs — a router has no pane TUI to answer. launch.launch skips the
+   *  boot phase for kind:'router', so this is never consulted; null = "no dialog". */
+  bootDialogKeys(_pane: string): string[] | null {
+    return null
+  },
+
+  /** Always ready: a router has no input surface waiting for a first message — it is
+   *  "up" the instant `voicetalk-runtime run` is launched. launch.launch skips the
+   *  ready-gate for kind:'router'; true = "nothing to wait for". */
+  isInputReady(_pane: string): boolean {
+    return true
+  },
+
+  /** No activity proxy: a router writes no transcript/session jsonl to mtime as a
+   *  ready-gate or idle signal. launch.launch skips the activity-proxy gate for a
+   *  router; null per the contract ("null for a router (no proxy)"). */
+  newestActivityMtime(_cwd: string): number | null {
+    return null
+  },
+
+  /** Nothing to resume: a router does not replay a transcript, so resume cannot
+   *  fail-loud the way claude/codex do. Always {ok:true}. */
+  resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {
+    return { ok: true }
+  },
+
+  /** No in-session control: a router has no TUI turn to interrupt/compact. null for
+   *  every command → the daemon/CLI surfaces an explicit "unsupported" refusal. */
+  executeControl(_command: ControlCommand): ControlPlan | null {
+    return null
+  },
+}

package/src/launch/index.ts

@@ -23,6 +23,7 @@ import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
 import { telegramAdapter } from './adapters/telegram.ts'
 import { notifierAdapter } from './adapters/notifier.ts'
+import { voicetalkAdapter } from './adapters/voicetalk.ts'
 import type {
   LaunchConfig,
   LaunchFn,
@@ -88,6 +89,7 @@ export function getAdapter(runtime: Runtime): RuntimeAdapter {
   if (runtime === 'codex') return codexAdapter
   if (runtime === 'telegram') return telegramAdapter
   if (runtime === 'notifier') return notifierAdapter
+  if (runtime === 'voicetalk') return voicetalkAdapter
   throw new Error(`no launch adapter for runtime "${runtime}"`)
 }
 

package/src/launch/launchdRun.ts

@@ -96,6 +96,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     // (installAlwaysOnPlist) uses — so the pin and the read can never drift.
     telegramBin: env[INFRA_RUNTIME_BIN_ENV.telegram],
     notifierBin: env[INFRA_RUNTIME_BIN_ENV.notifier],
+    voicetalkBin: env[INFRA_RUNTIME_BIN_ENV.voicetalk],
     sockDir,
     bootDeadlineSecs: 30,
     readyGateSecs: 30,

package/src/launch/types.ts

@@ -134,6 +134,8 @@ export interface LaunchAdapterConfig {
   telegramBin?: string
   /** notifier-runtime launch binary (router runtime, infra/always-on). */
   notifierBin?: string
+  /** voicetalk-runtime launch binary (router runtime, infra/always-on — the owner's voice channel). */
+  voicetalkBin?: string
 }
 
 export interface LaunchSpec {

package/src/lifecycle/index.ts

@@ -1246,42 +1246,41 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       trace({ identity: s.identity, action: 'reaped-gone', death: gone.death, reason: gone.reason, outcome: 'fresh-next-msg' })
       continue
     }
-    // Idle accounting via the runtime adapter's activity proxy (claude transcript
-    // / codex session mtime), FLOORED at wokeAt: a session cannot be idle longer than
-    // it has been awake. A wake that produced no model turn (e.g. an attach-only resume)
-    // leaves the proxy at its PRE-wake value; the old `?? wokeAt` floored only the NULL
-    // case, so a stale-but-non-null proxy (older than this wake) made a freshly-woken
-    // session look idle for its entire prior life → idle-reaped on the very next tick,
-    // out from under an attaching operator. max(), not ??, is the fix — and it still
-    // reaps a session that produced zero further turns (mt=wokeAt → reaped idleSecs
-    // after the wake), and falls back to wokeAt when no adapter exists for the runtime.
-    let mt = s.wokeAt
-    try {
-      mt = Math.max(activityMtime(s.runtime, s.cwd) ?? 0, s.wokeAt)
-    } catch {
-      /* no adapter for this runtime yet → wokeAt baseline */
-    }
+    // Idle accounting via the PANE-LOG (TUI render-stream) mtime — the RELIABLE idle
+    // signal: it advances ~1s while the TUI renders ANY turn (model generation OR a tool
+    // run — the "esc to interrupt" elapsed counter ticks) and goes quiet ONLY at the
+    // prompt. NOT the transcript file mtime: a live claude session RE-TOUCHES its session
+    // .jsonl ~every 30-45min WITHOUT a real turn (a system/bridge re-save), so the
+    // transcript proxy is perpetually < idleSecs and a claude peer NEVER idle-reaps — the
+    // fleet-reap incident: a warm claude pile, last real turn hours ago, never reaped;
+    // codex's session file is NOT re-touched, so codex reaps (the claude-vs-codex split).
+    // The transcript stays the launch ready-gate's signal (it needs "a real turn produced
+    // output"); only this idle proxy moves to the pane-log. FLOORED at wokeAt: a session
+    // cannot be idle longer than it has been awake (a wake that produced no turn →
+    // mt=wokeAt → reaped idleSecs after the wake, never out from under an attaching op).
     const ephemeral = isEphemeralPeer(s.cwd)
-    if (ephemeral) {
-      // FOLD IN the pane-log (TUI render-stream) mtime for ephemeral peers. The transcript
-      // proxy goes QUIET during a long model generation (no JSONL write until the message
-      // completes), so the short ephemeral windows below mis-read mid-generation as "done"
-      // and reap the worker MID-TURN (live incident 2026-06-20: Index reaped age=29s while
-      // generating the next step after a tool_result). The pane-log advances ~1s while the
-      // TUI renders a turn (model generation OR a tool run — the "esc to interrupt" elapsed
-      // counter ticks) and goes quiet only at the prompt, so it is the truer active-turn
-      // signal. max() means "quiet" iff BOTH are silent — it can only DELAY a reap, never
-      // cause an earlier one, so the pipeline serial-drain (idle → quiet → reaped) is
-      // preserved while a working session is never killed mid-turn.
-      const plMt = paneLogMt(s.identity)
-      if (plMt !== null) mt = Math.max(mt, plMt)
+    const plMt = paneLogMt(s.identity)
+    let mt: number
+    if (plMt !== null) {
+      mt = Math.max(plMt, s.wokeAt)
+    } else {
+      // Pane-log MISSING (a legacy pre-pane-log supervisor) → fall back to the transcript
+      // proxy, NEVER to wokeAt-as-activity: a wokeAt-only age would read an ACTIVE legacy
+      // session's idle from its hours-old wokeAt and reap it MID-WORK. The transcript is
+      // false-fresh at idle (so an IDLE legacy peer lingers warm until its next respawn
+      // earns a pane-log — bounded, self-heals), but an ACTIVE legacy peer keeps a
+      // genuinely-fresh transcript and is correctly protected. Safe direction preserved.
+      let tx = 0
+      try { tx = activityMtime(s.runtime, s.cwd) ?? 0 } catch { /* no adapter → wokeAt */ }
+      mt = Math.max(tx, s.wokeAt)
     }
     const ageSecs = Math.floor((nowMs - mt) / 1000)
     // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
     // daemon routed its outbound reply) is reaped after a QUIET window, checked
-    // BEFORE the idle branch (quiet ≪ idle). Quiet = transcript AND pane-log both
-    // silent for ephemeralQuietSecs — a still-rendering turn keeps the pane-log fresh,
-    // so the worker finishes its turn first; post-reply housekeeping also resets it.
+    // BEFORE the idle branch (quiet ≪ idle). Quiet = the pane-log silent for
+    // ephemeralQuietSecs (the reliable render signal above) — a still-rendering turn
+    // keeps it fresh, so the worker finishes its turn first; post-reply housekeeping
+    // (operative-note writes) also advances it.
     // NOT armed (still mid-task) → the ordinary idle bound below is its only reaper.
     // Deliberate, policy-driven death: NO .idle-reaped (an ephemeral peer never resumes)
     // and NO recordDeath (the crash-loop ring counts faults, not policy reaps).

package/src/runtime/deploy.ts

@@ -32,6 +32,7 @@ import { readRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from
 export const RUNTIME_PACKAGES: Readonly<Record<string, string>> = {
   telegram: '@agfpd/telegram-runtime',
   notifier: '@agfpd/notifier-runtime',
+  voicetalk: '@agfpd/voicetalk-runtime',
 }
 
 /** Resolve the npm package for a runtime: explicit override wins, else the built-in