@agfpd/iapeer 0.4.54 → 0.4.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.54",
+  "version": "0.4.56",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -1261,7 +1261,7 @@ const VERBS: ReadonlyArray<{ sig: string; desc: string }> = [
     sig: 'default-runtime <runtime> (--peer <p> | --all)',
     desc: 'flip the PRIMARY (routing/wake default) — the fleet-switch lever; refuses an undeclared runtime; registry self-healed in the same command',
   },
-  { sig: 'attach <peer> [runtime]', desc: 'ensure-live + resume, then tmux attach' },
+  { sig: 'attach <peer> [runtime]', desc: 'ensure-live + resume, then attach to the pty session (Ctrl-] detaches)' },
   { sig: 'interrupt <peer> [runtime]', desc: 'interrupt the current turn (Escape) — context intact' },
   { sig: 'compact <peer> [runtime]', desc: 'compact the peer\'s dialogue (/compact); resumes clean-asleep first' },
   { sig: 'self-fresh', desc: '(agent self-call) mark /new eager-fresh + self-kill — the daemon relaunches fresh' },
@@ -2115,7 +2115,12 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         }
 
         // ── Foundation (the core; a hard failure aborts the cascade) ──
-        const r = updateIapeer({ env, force: flags.force === true, targetVersion: pinned })
+        // updateIapeer owns the whole settle sequence now: restart → health-gate →
+        // (infra recycle + known-good stamp) — В54: infra recycles ONLY after health;
+        // В50: the healthy binary is stamped so the next install may refresh `.prev`;
+        // В53: "already-latest" also verifies the LIVE daemon runs the binary's version
+        // (an interrupted prior update heals with a restart instead of a false no-op).
+        const r = await updateIapeer({ env, force: flags.force === true, targetVersion: pinned })
         let foundationHardFail = false
         if (r.status === 'failed') {
           errOut(`update failed: ${r.reason}\n`)
@@ -2123,15 +2128,13 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         } else if (r.status === 'already-latest') {
           out(`foundation: already at version ${r.from}\n`)
         } else if (r.daemon === 'restarted') {
-          // 'updated' + daemon restarted: VERIFY it actually came back up (a binary that
-          // fails to boot must not read as a healthy deploy — it's the cue to roll back).
-          const h = await waitForDaemonHealthy({ env })
-          if (!h.healthy) {
-            errOut(`foundation: updated ${r.from} → ${r.to} but the daemon is NOT healthy after restart (${h.detail}).\nroll back now: iapeer rollback\n`)
+          if (r.healthy !== true) {
+            errOut(`foundation: updated ${r.from} → ${r.to} but ${r.reason ?? 'the daemon is NOT healthy after restart'}.\nroll back now: iapeer rollback\n`)
             foundationHardFail = true
           } else {
             const note = infraRecycleNote(r.infra)
-            ;(infraRecycleFailed(r.infra) ? errOut : out)(`foundation: updated ${r.from} → ${r.to}; daemon restarted and healthy${note}\n`)
+            const healNote = r.healedStaleDaemon ? ` (live daemon was still on ${r.healedStaleDaemon} — healed)` : ''
+            ;(infraRecycleFailed(r.infra) ? errOut : out)(`foundation: updated ${r.from} → ${r.to}; daemon restarted and healthy${healNote}${note}\n`)
           }
         } else {
           const daemonNote =
@@ -2166,7 +2169,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         // daemon onto it, and verify health. ONE level deep (single .prev). Cloud is
         // still the source of truth — rollback is the local "undo the last update" while
         // a fixed version is published.
-        const { rollbackIapeer } = await import('../install/index.ts')
+        const { rollbackIapeer, stampBinaryHealthy } = await import('../install/index.ts')
         const rb = rollbackIapeer(env)
         if (rb.status === 'failed') {
           errOut(`rollback failed: ${rb.reason}\n`)
@@ -2178,6 +2181,9 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         const infraFailed = infraRecycleFailed(infra)
         if (restart.state === 'restarted') {
           const h = await waitForDaemonHealthy({ env })
+          // В50 — a restored binary that just proved healthy is known-good: stamp it so
+          // the NEXT install may refresh `.prev` from it (sandbox never reaches here).
+          if (h.healthy) stampBinaryHealthy(env)
           const msg = h.healthy
             ? `rolled back to the previous binary; daemon restarted and healthy${infraNote}\n`
             : `rolled back, but the daemon is NOT healthy after restart (${h.detail})${infraNote}\n`
@@ -2234,7 +2240,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
             return 1
           }
         }
-        const res = executeUninstall({ env, removeCodesignIdentity: removeCodesign })
+        const res = await executeUninstall({ env, removeCodesignIdentity: removeCodesign })
         for (const r of res.removed) out(`  removed: ${r}\n`)
         for (const s of res.skipped) out(`  skipped (absent): ${s}\n`)
         for (const f of res.failed) errOut(`  FAILED: ${f.what} — ${f.detail}\n`)
@@ -2276,6 +2282,7 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
         out(
           `installed iapeer → ${r.binPath}` +
             `${r.prevPath ? ` (previous kept: ${r.prevPath})` : ''}` +
+            `${r.prevKept ? ` (.prev NOT overwritten: ${r.prevKept.reason})` : ''}` +
             `${r.size ? ` (${Math.round(r.size / 1e6)}M)` : ''}\n` +
             signingLine +
             `  scaffold: ~/.iapeer/ ensured (peers/, state, logs, cache, runtimes)\n` +

package/src/daemon/index.ts

@@ -41,6 +41,7 @@ import {
 } from '../core/constants.ts'
 import { parseSessionName } from '../core/socket.ts'
 import { IapError } from '../core/errors.ts'
+import { IAPEER_VERSION } from '../core/version.ts'
 import { pluginStateDir, writeFileAtomic, type StorageOptions } from '../storage/index.ts'
 import { readPeersIndex, type PeersIndex } from '../registry/index.ts'
 import { resolveCallerIdentity, type CallerIdentity, type ResolvedCaller } from '../identity/index.ts'
@@ -48,7 +49,10 @@ import { routeSend, type ComposerQueueRouteDeps, type EphemeralRouteDeps, type S
 import { appendDeliveryEvent } from './deliverylog.ts'
 
 export const CALLER_HEADER = 'x-iapeer-identity'
-const SERVER_INFO = { name: 'iapeer', version: '0.0.0' }
+// В53 — the LIVE daemon's version must be observable (the update verb's
+// "already-latest" gate compares it against the installed binary to detect an
+// interrupted update: binary swapped, daemon never restarted). Baked at build time.
+const SERVER_INFO = { name: 'iapeer', version: IAPEER_VERSION }
 
 /** Does a LIVE listener answer on this unix socket path? (В28) A successful connect ⇒ a daemon is
  *  running; ECONNREFUSED ⇒ a stale socket file (safe to unlink). Bounded by a short timeout so a wedged
@@ -561,7 +565,10 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   let discoveryPath: string | undefined
   if (opts.discovery) {
     discoveryPath = daemonDiscoveryPath(opts)
-    writeFileAtomic(discoveryPath, `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null })}\n`)
+    // `version` (В53): the RUNNING daemon's baked version — lets `iapeer update`
+    // detect an interrupted update (binary already at latest, live daemon still on
+    // the old code) and heal it with a restart instead of a false "already-latest".
+    writeFileAtomic(discoveryPath, `${JSON.stringify({ sock: socketPath ?? null, tcp: url ?? null, version: IAPEER_VERSION })}\n`)
   }
 
   const removeArtifacts = (): void => {

package/src/install/index.ts

@@ -13,7 +13,8 @@
 // signInstalledBinary (signing.ts) re-signs each install with the
 // stable local identity so the designated requirement — and the grants — survive.
 
-import { copyFileSync, cpSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from 'fs'
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'fs'
+import { createHash } from 'crypto'
 import { homedir } from 'os'
 import { basename, join, relative, sep } from 'path'
 import { spawnSync } from 'child_process'
@@ -35,6 +36,10 @@ export interface InstallResult {
   binPath: string
   /** The previous binary preserved for rollback (when one existed). */
   prevPath?: string
+  /** В50 — set when the outgoing binary was NOT copied to `.prev` because the healthy-stamp
+   *  says it never passed a post-deploy health-check: the existing `.prev` (last KNOWN-GOOD)
+   *  is preserved so a retry after a broken release cannot destroy the rollback target. */
+  prevKept?: { reason: string }
   /** Bytes of the installed binary. */
   size?: number
   /** Stable-identity re-sign outcome (TCC grants survive updates). Soft: a signing
@@ -42,6 +47,69 @@ export interface InstallResult {
   signing?: SigningOutcome
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// В50 — known-good `.prev`. Without a gate, EVERY install copies the current
+// binary to `.prev`: a series of broken releases overwrites the known-good
+// rollback target with a broken binary (retry of an update destroys the recovery
+// path). The gate: `iapeer update`/`rollback` stamp `<bin>.healthy` with the
+// sha256 of the binary ONLY after the daemon passed its post-deploy health-check.
+// The next install copies the current binary to `.prev` only when the stamp
+// matches it (proven-healthy). No stamp at all → legacy behavior (copy) — first
+// update after this ships, manual `bin/iapeer install` runs, and fresh bootstraps
+// keep working unchanged. NB the stamp is CROSS-VERSION state: install runs from
+// the NEWLY-FETCHED package's source while the stamp was written by the OUTGOING
+// version — keep the format trivial (hex digest + newline).
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** The healthy-stamp path kept next to the binary. */
+export function iapeerHealthyStampPath(env: NodeJS.ProcessEnv = process.env): string {
+  return `${iapeerBinPath(env)}.healthy`
+}
+
+function sha256File(path: string): string {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+/** Record the CURRENT installed binary as known-good (call ONLY after a passed
+ *  post-deploy health-check). Best-effort by design — a stamp hiccup must never
+ *  fail a successful update; it only means the next install falls back to
+ *  preserving the older `.prev`. */
+export function stampBinaryHealthy(env: NodeJS.ProcessEnv = process.env): boolean {
+  const binPath = iapeerBinPath(env)
+  assertInstallSandboxIsolated(binPath, env)
+  try {
+    writeFileSync(iapeerHealthyStampPath(env), `${sha256File(binPath)}\n`, { mode: 0o644 })
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** The В50 decision: should the CURRENT binary become `.prev`? Copy when the
+ *  healthy-stamp matches it (proven-good) or when no stamp exists (legacy /
+ *  first stamped update / manual install); preserve the existing `.prev` when
+ *  the stamp EXISTS but does not match (the current binary never passed a
+ *  health-check — a broken release being retried). Pure read — exported for
+ *  hermetic tests (installIapeer itself runs a full compile). */
+export function shouldCopyCurrentToPrev(binPath: string): { copy: boolean; reason?: string } {
+  let stamped: string | undefined
+  try {
+    const stampPath = `${binPath}.healthy`
+    stamped = existsSync(stampPath) ? readFileSync(stampPath, 'utf8').trim() : undefined
+  } catch {
+    stamped = undefined // unreadable stamp → treat as absent (legacy copy)
+  }
+  if (stamped && stamped !== sha256File(binPath)) {
+    return {
+      copy: false,
+      reason:
+        'current binary never passed a post-deploy health-check (healthy-stamp mismatch) — ' +
+        'keeping the existing .prev as the known-good rollback target',
+    }
+  }
+  return { copy: true }
+}
+
 /**
  * Build the standalone `iapeer` binary from the CLI entrypoint and place it at the
  * stable path ATOMICALLY: `bun build --compile <entry> → <bin>.tmp`, then rename over
@@ -76,14 +144,30 @@ export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = pr
     throw new Error(`iapeer build failed: ${(build.stderr ?? '').trim() || `exit ${build.status}`}`)
   }
   let prevPath: string | undefined
+  let prevKept: InstallResult['prevKept']
   if (existsSync(binPath)) {
-    prevPath = `${binPath}.prev`
-    // COPY (not move) the current binary to .prev so binPath is NEVER absent (audit
-    // #7): a move-then-move leaves no binary in the window between the two renames —
-    // if the second throws, the prod daemon + infra fleet crash-loop with no bin.
-    copyFileSync(binPath, prevPath)
+    // В50 — copy to .prev ONLY when shouldCopyCurrentToPrev says the current binary
+    // is trustworthy; otherwise preserve the existing .prev (last known-good).
+    const verdict = shouldCopyCurrentToPrev(binPath)
+    if (!verdict.copy) {
+      prevKept = { reason: verdict.reason! }
+    } else {
+      prevPath = `${binPath}.prev`
+      // COPY (not move) the current binary to .prev so binPath is NEVER absent (audit
+      // #7): a move-then-move leaves no binary in the window between the two renames —
+      // if the second throws, the prod daemon + infra fleet crash-loop with no bin.
+      copyFileSync(binPath, prevPath)
+    }
   }
   renameSync(tmp, binPath) // atomic replace in place (POSIX rename over an existing file)
+  // The stamp described the binary we just REPLACED — it must not vouch for the new
+  // bytes. Health of the new binary is proven (and re-stamped) by the update verb
+  // AFTER its health-check passes.
+  try {
+    unlinkSync(`${binPath}.healthy`)
+  } catch {
+    /* absent — fine */
+  }
   // Stable-identity re-sign (TCC grants survive updates). AFTER the rename: the
   // signature belongs to the final inode at the final path. Soft-fail by design.
   const signing = signInstalledBinary(binPath, env)
@@ -93,7 +177,7 @@ export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = pr
   } catch {
     /* best-effort */
   }
-  return { binPath, prevPath, size, signing }
+  return { binPath, prevPath, prevKept, size, signing }
 }
 
 /**

package/src/launch/launchd.ts

@@ -13,7 +13,7 @@
 // here so the crashloop bound is visible and tunable, not an implicit default; raise
 // throttleIntervalSecs for a wider window). RunAtLoad+KeepAlive = always-on.
 
-import { accessSync, constants as FS, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
+import { accessSync, constants as FS, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
 import { spawnSync } from 'child_process'
@@ -631,6 +631,24 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
   if (!(sandbox && logDir.startsWith(`${realRoot}/`))) {
     mkdirSync(logDir, { recursive: true, mode: 0o700 })
   }
-  writeFileSync(path, renderLaunchdPlist(spec), { mode: 0o644 })
+  // В46 — fail-closed sandbox guard on the PLIST WRITE itself (symmetric to the mkdir
+  // guard above and the registry/install guards): a sandboxed test that forgot
+  // IAPEER_LAUNCHAGENTS_DIR must NEVER write a real ~/Library/LaunchAgents/
+  // com.iapeer.<p>.plist — the live daemon reads that file as the H4 launchd-owned
+  // marker, so a leaked test plist silently stops the daemon from waking the
+  // matching peer (plist present but never loaded → peer reads as dead forever).
+  const realAgents = join(homedir(), 'Library', 'LaunchAgents')
+  if (sandbox && path.startsWith(`${realAgents}/`)) {
+    throw new IapError(
+      `refusing to write a REAL LaunchAgents plist (${path}) under IAPEER_TEST_SANDBOX=1 — ` +
+        'set IAPEER_LAUNCHAGENTS_DIR to an isolated path',
+    )
+  }
+  // В46 — atomic write (tmp + rename): an interrupted direct write leaves a TRUNCATED
+  // plist without the ownership sentinel, which the collision guard above then reads
+  // as foreign — the peer becomes permanently un-provisionable ("refused-foreign").
+  const tmp = `${path}.tmp-${process.pid}`
+  writeFileSync(tmp, renderLaunchdPlist(spec), { mode: 0o644 })
+  renameSync(tmp, path)
   return path
 }

package/src/runtime/deploy.ts

@@ -21,7 +21,7 @@ import { homedir } from 'os'
 import { type Runtime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { createPeer, type CreatePeerResult } from '../create/index.ts'
-import { readRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from './index.ts'
+import { readRuntimeManifest, writeRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from './index.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Built-in runtime → npm package registry (§6): onboard AUTO-resolves
@@ -131,7 +131,8 @@ export interface InstallRuntimePackageResult {
 }
 
 /** Injectable npx runner (so tests / a sandbox proof can simulate the package's
- *  self-deploy without a published npm package). Default: `npx -y <package>`. */
+ *  self-deploy without a published npm package). Default: `npx -y <spec>` — the spec
+ *  may carry a version pin (`pkg@1.2.3`, В51). */
 export type NpxRunner = (pkg: string, env: NodeJS.ProcessEnv) => { ok: boolean; detail?: string }
 
 const defaultNpxRunner: NpxRunner = (pkg, env) => {
@@ -153,6 +154,10 @@ export interface InstallRuntimePackageOptions {
   runtime: Runtime
   /** Override the built-in package mapping (--package). */
   package?: string
+  /** В51 — pin the delivered version (`npx -y <pkg>@<version>`): without a pin an
+   *  unpinned npx can serve a STALE cached/propagating version while the caller
+   *  reports the npm-latest it resolved. Omit → unpinned (bootstrap convenience). */
+  version?: string
   /** Re-run npx even when a manifest is already present (force a package update). */
   force?: boolean
   env?: NodeJS.ProcessEnv
@@ -164,21 +169,39 @@ export interface InstallRuntimePackageOptions {
  * Ensure a runtime PACKAGE is installed (the package self-deploys its bin + manifest
  * via `npx`). IDEMPOTENT: when a manifest is already present (package installed) and
  * not forced, it is a no-op (`skipped`). Otherwise resolves the package (override →
- * built-in registry) and runs npx. No mapping + no --package + no manifest → `no-package`.
+ * the manifest's `package` stamp → built-in registry) and runs npx. No mapping + no
+ * --package + no manifest → `no-package`.
+ *
+ * В52 — after a successful run, the resolved package name is stamped into the
+ * manifest the package just wrote (when it differs from what the manifest carries):
+ * that is what lets a custom-packaged runtime survive the FU12 cascade and direct
+ * `update-runtime` without the operator repeating --package every time.
  */
 export function installRuntimePackage(opts: InstallRuntimePackageOptions): InstallRuntimePackageResult {
   const env = opts.env ?? process.env
-  const pkg = resolveRuntimePackage(opts.runtime, opts.package)
-  const manifestPresent = readRuntimeManifest(opts.runtime, { env }) !== null
-  if (manifestPresent && !opts.force) {
+  const existing = readRuntimeManifest(opts.runtime, { env })
+  const pkg = resolveRuntimePackage(opts.runtime, opts.package ?? existing?.package)
+  if (existing && !opts.force) {
     return { runtime: opts.runtime, package: pkg, state: 'skipped' }
   }
   if (!pkg) {
     return { runtime: opts.runtime, state: 'no-package' }
   }
   const run = opts.runNpx ?? defaultNpxRunner
-  const r = run(pkg, env)
-  return { runtime: opts.runtime, package: pkg, state: r.ok ? 'ran' : 'failed', detail: r.detail }
+  const spec = opts.version ? `${pkg}@${opts.version}` : pkg
+  const r = run(spec, env)
+  if (!r.ok) {
+    return { runtime: opts.runtime, package: pkg, state: 'failed', detail: r.detail }
+  }
+  // В52 — stamp the delivering package into the fresh manifest (best-effort: a
+  // missing manifest is the package's own contract breach, surfaced elsewhere).
+  try {
+    const fresh = readRuntimeManifest(opts.runtime, { env })
+    if (fresh && fresh.package !== pkg) writeRuntimeManifest({ ...fresh, package: pkg }, { env })
+  } catch {
+    /* malformed manifest → the read path reports it loudly on the next use */
+  }
+  return { runtime: opts.runtime, package: pkg, state: 'ran' }
 }
 
 export interface OnboardRuntimeOptions extends DeployRuntimeOptions {

package/src/runtime/index.ts

@@ -55,6 +55,12 @@ export interface RuntimeManifest {
    *  `update-runtime` version-gates on it; absent → no gate, the update
    *  re-installs idempotently. */
   version?: string
+  /** OPTIONAL npm package that delivered this runtime (В52). Stamped by the
+   *  FOUNDATION after a successful install with an explicit --package override, so
+   *  a custom-packaged runtime survives the FU12 cascade and a direct
+   *  `update-runtime` (resolution order: explicit override → this stamp → the
+   *  built-in registry). A package may also self-declare it. */
+  package?: string
   /** OPTIONAL per-peer self-config hook (the shared contract both modes call). */
   selfConfig?: SelfConfigDescriptor
   /** OPTIONAL fixed peer-set (mode a). Omitted by an operator-add runtime (mode b). */
@@ -113,7 +119,14 @@ function normalizeManifest(raw: unknown, runtime: Runtime): RuntimeManifest {
     })
   }
   const version = typeof obj.version === 'string' && obj.version.trim() ? obj.version.trim() : undefined
-  return { runtime: declaredRuntime, ...(version ? { version } : {}), ...(selfConfig ? { selfConfig } : {}), ...(peers ? { peers } : {}) }
+  const pkg = typeof obj.package === 'string' && obj.package.trim() ? obj.package.trim() : undefined
+  return {
+    runtime: declaredRuntime,
+    ...(version ? { version } : {}),
+    ...(pkg ? { package: pkg } : {}),
+    ...(selfConfig ? { selfConfig } : {}),
+    ...(peers ? { peers } : {}),
+  }
 }
 
 /** Read a runtime's manifest (~/.iapeer/runtimes/<runtime>/runtime.json), or null when

package/src/runtime/update.ts

@@ -18,8 +18,11 @@
 // the stamp cannot be gated — the update proceeds idempotently and says so.
 
 import { spawnSync } from 'child_process'
-import { type Runtime } from '../core/constants.ts'
+import { readdirSync } from 'fs'
+import { join } from 'path'
+import { isRuntime, type Runtime } from '../core/constants.ts'
 import { readPeersIndex } from '../registry/index.ts'
+import { resolveGlobalRoot } from '../storage/index.ts'
 import { readRuntimeManifest } from './index.ts'
 import {
   deployRuntime,
@@ -106,7 +109,9 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
       detail: `no manifest for "${runtime}" — install first: iapeer install-runtime ${runtime}`,
     }
   }
-  const pkg = resolveRuntimePackage(runtime)
+  // В52 — the manifest's `package` stamp (a custom --package install) wins over the
+  // built-in registry, so a custom-packaged runtime updates from ITS package.
+  const pkg = resolveRuntimePackage(runtime, manifest.package)
   if (!pkg) {
     return { runtime, state: 'not-installed', peers: [], restarted: [], detail: `no package mapping for "${runtime}"` }
   }
@@ -122,12 +127,31 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
     return { runtime, package: pkg, state: 'already-latest', from: installed, to: latest, peers: [], restarted: [] }
   }
 
-  // Re-install (forced npx — the package self-deploys its new bin + manifest).
-  const install = installRuntimePackage({ runtime, force: true, env, runNpx: opts.runNpx })
+  // Re-install, PINNED to the version the gate resolved (В51 — an unpinned npx can
+  // serve a stale cached/propagating build while we report "updated → latest").
+  const install = installRuntimePackage({ runtime, package: manifest.package, version: latest, force: true, env, runNpx: opts.runNpx })
   if (install.state !== 'ran') {
     return { runtime, package: pkg, state: 'install-failed', from: installed, to: latest, peers: [], restarted: [], detail: install.detail ?? install.state }
   }
 
+  // В51 — verify the DELIVERED version: re-read the manifest the package just wrote
+  // and compare its stamp against the gate's target. A mismatch = the npx cache/CDN
+  // served old code — fail LOUD, never report 'updated' for a version that did not
+  // arrive. (No stamp in the new manifest → unverifiable; reported, not fatal.)
+  const delivered = readRuntimeManifest(runtime, { env })
+  if (delivered?.version && delivered.version !== latest) {
+    return {
+      runtime,
+      package: pkg,
+      state: 'install-failed',
+      from: installed,
+      to: latest,
+      peers: [],
+      restarted: [],
+      detail: `delivered version ${delivered.version} ≠ target ${latest} (stale npx cache / CDN propagation) — retry in ~1 min`,
+    }
+  }
+
   // IDEMPOTENT re-provision via the SAME deploy path install-runtime uses: blurb
   // sync, re-self-config, no-clobber on live peers. Mode-b (telegram) declares no
   // peers — the deploy is an empty pass, by design.
@@ -157,6 +181,10 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
     )
   }
 
+  const notes = [
+    installed ? undefined : 'no version stamp in the old manifest — gate skipped, re-installed idempotently',
+    delivered?.version ? undefined : 'no version stamp in the NEW manifest — delivered version unverified',
+  ].filter(Boolean)
   return {
     runtime,
     package: pkg,
@@ -165,16 +193,32 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
     to: latest,
     peers,
     restarted,
-    detail: installed ? undefined : 'no version stamp in the old manifest — gate skipped, re-installed idempotently',
+    detail: notes.length ? notes.join('; ') : undefined,
+  }
+}
+
+/** Every runtime with a manifest on THIS host (~/.iapeer/runtimes/<r>/runtime.json) —
+ *  the union the FU12 cascade must cover. В52: scanning the disk (not the frozen
+ *  built-in registry) is what keeps a custom `--package` runtime in the cascade. */
+function installedRuntimes(env: NodeJS.ProcessEnv): Runtime[] {
+  let entries: string[] = []
+  try {
+    entries = readdirSync(join(resolveGlobalRoot(env), 'runtimes'))
+  } catch {
+    /* no runtimes dir → nothing installed */
   }
+  return entries.filter(e => isRuntime(e) && readRuntimeManifest(e as Runtime, { env }) !== null) as Runtime[]
 }
 
-/** `--all`: update every KNOWN runtime that is actually installed (manifest present);
- *  the rest are reported as not-installed, never an error. */
+/** `--all`: update every runtime that is actually installed — the disk scan (manifest
+ *  present) UNION the built-in registry (В52: a custom --package runtime has no
+ *  built-in mapping but IS installed; it must not fall out of the cascade). Known
+ *  runtimes without a manifest are reported as not-installed, never an error. */
 export async function updateAllRuntimes(opts: Omit<UpdateRuntimeOptions, 'runtime'> = {}): Promise<UpdateRuntimeResult[]> {
   const env = opts.env ?? process.env
   const out: UpdateRuntimeResult[] = []
-  for (const rt of Object.keys(RUNTIME_PACKAGES) as Runtime[]) {
+  const known = new Set<Runtime>([...(Object.keys(RUNTIME_PACKAGES) as Runtime[]), ...installedRuntimes(env)])
+  for (const rt of known) {
     if (!readRuntimeManifest(rt, { env })) {
       out.push({ runtime: rt, state: 'not-installed', peers: [], restarted: [], detail: 'not installed — skipped' })
       continue

package/src/tui/dashboard/app.tsx

@@ -41,6 +41,12 @@ function RuntimeCells({ row }: { row: PeerListing }): React.ReactElement {
   )
 }
 
+/** Absolute screen reset written on every terminal resize: erase-all + cursor-home.
+ *  Goes through Ink's OWN write path (useStdout().write → writeToStdout), which
+ *  erases Ink's frame, writes these bytes, then REPLAYS the last frame with reset
+ *  erase bookkeeping — so the replay lands at a KNOWN absolute origin (row 1). */
+const RESIZE_SCREEN_RESET = '\x1b[2J\x1b[H'
+
 export function DashboardApp({
   env,
   onAction,
@@ -49,7 +55,7 @@ export function DashboardApp({
   onAction: (a: DashAction) => void
 }): React.ReactElement {
   const { exit } = useApp()
-  const { stdout } = useStdout()
+  const { stdout, write } = useStdout()
   const [rows, setRows] = useState<PeerListing[]>(() => takePeersSnapshot(env))
   const [host, setHost] = useState<HostHeader | null>(null)
   const [now, setNow] = useState<number>(() => Date.now())
@@ -95,12 +101,26 @@ export function DashboardApp({
   }, [env])
   useEffect(() => {
     if (!stdout) return
-    const onResize = (): void => setSize({ cols: dim(stdout.columns, 80), rows: dim(stdout.rows, 24) })
+    const onResize = (): void => {
+      // Ink erases frames by RELATIVE cursor math (cursor-up × line-count), and a real
+      // terminal displaces alt-screen content on window resize (Apple Terminal shifts it
+      // on height changes; a width change can re-wrap) — after which that relative erase
+      // misses rows and stale frame fragments survive FOREVER (live incident: a drag-
+      // resize stacked 9 footers; Ink itself full-clears only on width SHRINK). So on
+      // EVERY resize force an ABSOLUTE reset: wipe the screen + home the cursor, then let
+      // Ink replay the frame from that known origin. Written through Ink's write API —
+      // never raw to stdout behind its back (the 0.4.51 lesson): writeToStdout keeps its
+      // erase model in sync (clear → our bytes → replay with reset line-counts). This
+      // listener registers AFTER Ink's own resize handler (mount effect vs render), so
+      // the absolute reset is always the LAST word on the resize tick.
+      write(RESIZE_SCREEN_RESET)
+      setSize({ cols: dim(stdout.columns, 80), rows: dim(stdout.rows, 24) })
+    }
     stdout.on('resize', onResize)
     return () => {
       stdout.off('resize', onResize)
     }
-  }, [stdout])
+  }, [stdout, write])
 
   const visible = filterRows(rows, filter)
   const cur = clampCursor(cursor, visible.length)

package/src/tui/dashboard/run.tsx

@@ -38,13 +38,25 @@ export const DASHBOARD_NOT_INTERACTIVE = -1
 /** argv prefix that re-invokes THIS package's CLI (compiled binary by verb / src via
  *  bun). Same discriminator as supervisor/index.ts resolveDaemonSelfArgv: `$bunfs` in
  *  the module path marks the compiled standalone (existsSync is NO discriminator —
- *  Bun intercepts bunfs reads). */
-export function resolveSelfCliArgv(execPath: string, selfPath: string): string[] {
-  return selfPath.includes('$bunfs') ? [execPath] : [execPath, selfPath]
+ *  Bun intercepts bunfs reads).
+ *
+ *  Discriminate on the MODULE's OWN url — NEVER on a `../..`-navigated path. The
+ *  compiled bundle lives at `file:///$bunfs/root/<bundle>` (depth 2), so navigating
+ *  two levels up ESCAPES /$bunfs and URL-normalization silently drops the marker
+ *  (proven: compiled probe → `new URL('../../cli/index.ts', import.meta.url)` =
+ *  `/cli/index.ts`). The prior code passed that navigated path here, so the COMPILED
+ *  dashboard took the src branch and spawned `<binary> /cli/index.ts attach <peer>`
+ *  → unknown verb → full usage + exit 2 (live incident: Enter→attach dead in
+ *  `iapeer list`; from-src runs masked it — the navigated path is real there). The
+ *  cli path is resolved lazily and ONLY on the src branch. */
+export function resolveSelfCliArgv(execPath: string, moduleUrl: string): string[] {
+  return moduleUrl.includes('$bunfs')
+    ? [execPath]
+    : [execPath, fileURLToPath(new URL('../../cli/index.ts', moduleUrl))]
 }
 
 function selfCliArgv(): string[] {
-  return resolveSelfCliArgv(process.execPath, fileURLToPath(new URL('../../cli/index.ts', import.meta.url)))
+  return resolveSelfCliArgv(process.execPath, import.meta.url)
 }
 
 export interface DashboardOptions {

package/src/uninstall/index.ts

@@ -18,10 +18,11 @@ import { spawnSync } from 'child_process'
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
-import { DAEMON_PLIST_LABEL, IapError } from '../core/index.ts'
-import { iapeerBinPath } from '../install/index.ts'
+import { buildProcessAddress, DAEMON_PLIST_LABEL, IapError } from '../core/index.ts'
+import { iapeerBinPath, iapeerHealthyStampPath } from '../install/index.ts'
 import { SIGNING_IDENTITY_CN } from '../install/signing.ts'
 import { daemonPlistPath } from '../daemon/main.ts'
+import { hostSessionAlive, killPtyHost, listHostedPeers } from '../launch/ptyHost.ts'
 import { isFoundationOwnedPlist, launchAgentsDir } from '../launch/launchd.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 
@@ -32,6 +33,7 @@ export type UninstallActionKind =
   | 'remove-file'
   | 'remove-dir'
   | 'bootout-remove-plist'
+  | 'stop-pty-sessions'
   | 'strip-profile-lines'
   | 'remove-keychain-identity'
 
@@ -61,6 +63,11 @@ export interface UninstallOptions {
   removeCodesignIdentity?: boolean
   /** Injected sys runner (launchctl / security) for hermetic tests. */
   run?: SysRunner
+  /** В56 — how long to wait for a booted-out launchd job to actually unload before
+   *  declaring it stuck (default 10 s; tests inject a short value). */
+  launchdWaitMs?: number
+  /** В55 — how long to wait for SIGTERM'd pty sessions to die (default 8 s). */
+  sessionWaitMs?: number
 }
 
 const defaultRun: SysRunner = (cmd, args) => {
@@ -153,8 +160,26 @@ export function planUninstall(opts: UninstallOptions = {}): UninstallPlan {
     })
   }
 
+  // В55 — live warm-on-demand pty sessions (detached supervisors, NO plist: the
+  // launchd guard above cannot see them). Their run-dir/state live INSIDE ~/.iapeer —
+  // removing the tree under ~30 running agent processes leaves an orphaned live
+  // fleet working out of deleted directories. Stop them FIRST (before remove-dir).
+  const hosted = listHostedPeers(env).map(h => buildProcessAddress(h.runtime, h.personality))
+  items.push({
+    what: `live pty sessions (${hosted.length ? hosted.join(', ') : 'none'})`,
+    action: 'stop-pty-sessions',
+    present: hosted.length > 0,
+    detail: hosted.length ? 'will be stopped before ~/.iapeer is removed' : undefined,
+  })
+
   items.push({ what: 'binary ~/.local/bin/iapeer', action: 'remove-file', path: bin, present: existsSync(bin) })
   items.push({ what: 'previous binary (.prev)', action: 'remove-file', path: prev, present: existsSync(prev) })
+  items.push({
+    what: 'healthy-stamp (.healthy)',
+    action: 'remove-file',
+    path: iapeerHealthyStampPath(env),
+    present: existsSync(iapeerHealthyStampPath(env)),
+  })
   items.push({ what: 'state + config ~/.iapeer', action: 'remove-dir', path: root, present: existsSync(root) })
 
   for (const pf of profileFiles(env)) {
@@ -181,8 +206,47 @@ export interface UninstallResult {
   refused?: { reason: string; foreignLabels: string[] }
 }
 
-/** Remove a foundation install per the plan. Refuses if a foreign fleet is present. */
-export function executeUninstall(opts: UninstallOptions = {}): UninstallResult {
+const sleep = (ms: number): Promise<void> => new Promise(r => setTimeout(r, ms))
+
+/** В56 — poll `launchctl print gui/<uid>/<label>` until the job is GONE (print exits
+ *  non-zero) or the deadline passes. bootout is ASYNC in launchd: firing rm/rmdir the
+ *  moment it returns races the dying daemon's shutdown writes (recreated fragments)
+ *  and, on a bootout failure, leaves an orphaned KeepAlive job holding the port while
+ *  the item reads "removed". Same wait-for-gone contract the update cycle uses. */
+async function waitJobGone(run: SysRunner, uid: number, label: string, timeoutMs = 10_000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  for (;;) {
+    if (run('launchctl', ['print', `gui/${uid}/${label}`]).status !== 0) return true // not loaded → gone
+    if (Date.now() >= deadline) return false
+    await sleep(250)
+  }
+}
+
+/** В55 — stop every live warm-on-demand pty session (SIGTERM the supervisor daemon,
+ *  wait for its pidfile-liveness to drop). Best-effort per session; reports laggards. */
+async function stopHostedSessions(env: NodeJS.ProcessEnv, timeoutMs = 8000): Promise<{ stopped: string[]; stuck: string[] }> {
+  const identities = listHostedPeers(env).map(h => buildProcessAddress(h.runtime, h.personality))
+  for (const id of identities) {
+    try {
+      killPtyHost(id, env)
+    } catch {
+      /* verified-dead / permission — the wait below reports it */
+    }
+  }
+  const deadline = Date.now() + timeoutMs
+  let pending = identities
+  while (pending.length > 0 && Date.now() < deadline) {
+    await sleep(250)
+    pending = pending.filter(id => hostSessionAlive(id, env))
+  }
+  return { stopped: identities.filter(id => !pending.includes(id)), stuck: pending }
+}
+
+/** Remove a foundation install per the plan. Refuses if a foreign fleet is present.
+ *  Ordering contract: live pty sessions are stopped and launchd jobs are FULLY
+ *  unloaded (wait-for-gone) BEFORE ~/.iapeer is removed — a failed unload FAILS the
+ *  remove-dir step (never delete the tree out from under a still-running daemon). */
+export async function executeUninstall(opts: UninstallOptions = {}): Promise<UninstallResult> {
   const env = opts.env ?? process.env
   assertSandboxSafe(env)
   const run = opts.run ?? defaultRun
@@ -194,6 +258,9 @@ export function executeUninstall(opts: UninstallOptions = {}): UninstallResult {
   }
 
   const uid = process.getuid?.() ?? 0
+  // Set when a launchd job survived bootout (В56) — ~/.iapeer must NOT be removed
+  // from under a job launchd may respawn (KeepAlive) into the deleted tree.
+  let jobStillLoaded: string | undefined
   for (const item of plan.items) {
     if (!item.present) {
       res.skipped.push(item.what)
@@ -203,16 +270,37 @@ export function executeUninstall(opts: UninstallOptions = {}): UninstallResult {
       switch (item.action) {
         case 'bootout-remove-plist': {
           const label = (item.path ?? '').replace(/\.plist$/, '').split('/').pop() ?? ''
-          run('launchctl', ['bootout', `gui/${uid}/${label}`]) // best-effort (not-loaded → non-zero, fine)
+          run('launchctl', ['bootout', `gui/${uid}/${label}`]) // not-loaded → non-zero, benign (wait-for-gone verifies)
+          if (!(await waitJobGone(run, uid, label, opts.launchdWaitMs))) {
+            jobStillLoaded = label
+            res.failed.push({ what: item.what, detail: `job ${label} still loaded after bootout (wait-for-gone timeout)` })
+            continue // plist kept — the operator can bootout manually and re-run
+          }
           if (item.path) rmSync(item.path, { force: true })
           break
         }
+        case 'stop-pty-sessions': {
+          const r = await stopHostedSessions(env, opts.sessionWaitMs)
+          if (r.stuck.length > 0) {
+            res.failed.push({ what: item.what, detail: `still alive after SIGTERM+wait: ${r.stuck.join(', ')}` })
+            continue
+          }
+          break
+        }
         case 'remove-file':
           if (item.path) rmSync(item.path, { force: true })
           break
-        case 'remove-dir':
+        case 'remove-dir': {
+          if (jobStillLoaded) {
+            res.failed.push({
+              what: item.what,
+              detail: `NOT removed — launchd job ${jobStillLoaded} is still loaded (KeepAlive would respawn into a deleted tree); bootout it manually, then re-run uninstall`,
+            })
+            continue
+          }
           if (item.path) rmSync(item.path, { recursive: true, force: true })
           break
+        }
         case 'strip-profile-lines':
           if (item.path) stripInstallerLines(item.path)
           break

package/src/update/index.ts

@@ -29,13 +29,14 @@
 // unit-testable with no network and no launchctl; the defaults are the real impls.
 
 import { spawnSync } from 'child_process'
-import { mkdtempSync, readdirSync, rmSync } from 'fs'
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from 'fs'
 import { connect } from 'net'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { isInfraRuntime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
+import { stampBinaryHealthy } from '../install/index.ts'
 import { readPeersIndex } from '../registry/index.ts'
 import {
   cycleDaemon,
@@ -46,7 +47,7 @@ import {
   type DaemonRestartResult,
   type LaunchdJobCycleResult,
 } from '../launch/launchd.ts'
-import { defaultDaemonSocketPath } from '../daemon/index.ts'
+import { daemonDiscoveryPath, defaultDaemonSocketPath } from '../daemon/index.ts'
 // Type-only (erased at runtime → no import cycle): the cascade tail renders these
 // shapes but receives the component-updaters as injected deps.
 import type { UpdateRuntimeResult } from '../runtime/update.ts'
@@ -76,6 +77,15 @@ export interface UpdateDeps {
   /** Re-register loaded foundation-owned infra launchd jobs whose plists run the
    *  installed iapeer binary (default: registry scan + sentinel guard). */
   recycleInfraJobs?: (env: NodeJS.ProcessEnv) => InfraJobRecycleResult[]
+  /** В54 — post-restart health gate (default: waitForDaemonHealthy). Infra jobs are
+   *  recycled ONLY after this passes — never onto an unproven binary. */
+  waitHealthy?: (env: NodeJS.ProcessEnv) => Promise<HealthResult>
+  /** В53 — the LIVE daemon's version (default: read router.json's `version`), or null
+   *  when no live daemon / unreadable / pre-В53 daemon (no version field). */
+  liveDaemonVersion?: (env: NodeJS.ProcessEnv) => string | null
+  /** В50 — record the installed binary as known-good after a passed health-check
+   *  (default: stampBinaryHealthy; skipped under the test sandbox). */
+  stampHealthy?: (env: NodeJS.ProcessEnv) => boolean
 }
 
 export interface InfraJobRecycleResult {
@@ -96,8 +106,15 @@ export interface UpdateResult {
   to?: string
   /** What happened to the live daemon (only on 'updated'). */
   daemon?: DaemonRestartResult['state']
+  /** Post-restart health verdict (set only when the daemon was restarted): true =
+   *  socket accepting (infra recycled + binary stamped known-good), false = did NOT
+   *  come up (the rollback cue). Undefined when there was nothing to health-check. */
+  healthy?: boolean
   /** Foundation-owned infra jobs recycled after the binary swap (only on 'updated'). */
   infra?: InfraJobRecycleResult[]
+  /** В53 — set when the "already-latest" gate found the LIVE daemon running an older
+   *  version (interrupted prior update) and healed it with a restart. */
+  healedStaleDaemon?: string
   /** Human reason on 'failed' / extra detail on a daemon restart hiccup. */
   reason?: string
 }
@@ -255,13 +272,57 @@ export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process
   return out
 }
 
+/** В53 default — the live daemon's version from the discovery file (router.json).
+ *  Null when there is no live daemon (file absent — it is removed on clean
+ *  shutdown), the file is unreadable, or the daemon predates the version field. */
+function defaultLiveDaemonVersion(env: NodeJS.ProcessEnv): string | null {
+  try {
+    const raw = JSON.parse(readFileSync(daemonDiscoveryPath({ env }), 'utf8')) as { version?: unknown }
+    return typeof raw.version === 'string' && SEMVER_RE.test(raw.version) ? raw.version : null
+  } catch {
+    return null
+  }
+}
+
+/** Restart → health-gate → (recycle infra + stamp known-good) — the SETTLE half every
+ *  update path shares. В54: infra jobs are recycled ONLY after the daemon proved
+ *  healthy — a broken release must take down the daemon alone, never also flip
+ *  telegram/notifier onto the broken binary (rollback re-cycles them after restoring
+ *  `.prev`). В50: the healthy binary is stamped known-good so the NEXT install may
+ *  refresh `.prev` from it. 'not-loaded' (no daemon on this host) keeps the legacy
+ *  behavior — recycle loaded infra jobs, nothing to health-check or stamp. */
+async function settleDaemon(
+  d: DaemonRestartResult,
+  env: NodeJS.ProcessEnv,
+  deps: UpdateDeps,
+): Promise<{ healthy?: boolean; infra: InfraJobRecycleResult[]; reason?: string }> {
+  if (d.state === 'failed') {
+    return { infra: [], reason: `binary updated but daemon restart failed: ${d.detail ?? ''}`.trim() }
+  }
+  const recycleInfra = deps.recycleInfraJobs ?? recycleFoundationOwnedInfraJobs
+  if (d.state !== 'restarted') {
+    return { infra: recycleInfra(env) } // not-loaded: no live daemon → no health verdict, no stamp
+  }
+  const h = await (deps.waitHealthy ?? ((e: NodeJS.ProcessEnv) => waitForDaemonHealthy({ env: e })))(env)
+  if (!h.healthy) {
+    return { healthy: false, infra: [], reason: `daemon is NOT healthy after restart (${h.detail ?? 'socket not accepting'})` }
+  }
+  // Default stamp is skipped under the test sandbox (a real stamp writes next to the
+  // REAL binary); tests that care inject stampHealthy.
+  const stamp = deps.stampHealthy ?? ((e: NodeJS.ProcessEnv) => (e.IAPEER_TEST_SANDBOX === '1' ? false : stampBinaryHealthy(e)))
+  stamp(env)
+  return { healthy: true, infra: recycleInfra(env) }
+}
+
 /**
  * Update the foundation to the latest published version (cloud-only) and restart
  * the daemon onto it. Idempotent + version-gated: a no-op "already-latest" when the
- * installed version equals the published one (unless `force`). Pure-ish — the three
- * effects are injected, so this is fully unit-testable.
+ * installed version equals the published one (unless `force`) AND the live daemon
+ * actually runs it (В53 — an interrupted prior update left the binary swapped but
+ * the daemon on old code; that heals with a restart, not a false no-op). Pure-ish —
+ * every effect is injected, so this is fully unit-testable.
  */
-export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
+export async function updateIapeer(deps: UpdateDeps = {}): Promise<UpdateResult> {
   const env = deps.env ?? process.env
   const from = deps.currentVersion ?? IAPEER_VERSION
   const resolve = deps.resolveVersion ?? defaultResolveVersion
@@ -281,7 +342,26 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
     }
   }
   if (desired === from && !deps.force) {
-    return { status: 'already-latest', from, latest: desired }
+    // В53 — the binary is at the target, but is the LIVE daemon running it? A prior
+    // update that swapped the binary and then died before/inside cycleDaemon leaves
+    // the fleet on the old core FOREVER while every retry says "already-latest".
+    const live = (deps.liveDaemonVersion ?? defaultLiveDaemonVersion)(env)
+    if (!live || live === from) {
+      return { status: 'already-latest', from, latest: desired }
+    }
+    const d = (deps.restartDaemon ?? cycleDaemon)(env)
+    const settled = await settleDaemon(d, env, deps)
+    return {
+      status: 'updated',
+      from: live,
+      to: desired,
+      latest: desired,
+      daemon: d.state,
+      healthy: settled.healthy,
+      infra: settled.infra,
+      healedStaleDaemon: live,
+      reason: settled.reason,
+    }
   }
 
   const runInstall = deps.runInstall ?? defaultRunInstall
@@ -300,21 +380,17 @@ export function updateIapeer(deps: UpdateDeps = {}): UpdateResult {
     }
   }
 
-  const restart = deps.restartDaemon ?? cycleDaemon
-  const d = restart(env)
-  const recycleInfra = deps.recycleInfraJobs ?? recycleFoundationOwnedInfraJobs
-  // If the daemon re-registration itself failed, do NOT widen the blast radius by
-  // cycling infra jobs onto a binary whose daemon could not come up. Rollback will
-  // re-cycle them after restoring `.prev`.
-  const infra = d.state === 'failed' ? [] : recycleInfra(env)
+  const d = (deps.restartDaemon ?? cycleDaemon)(env)
+  const settled = await settleDaemon(d, env, deps)
   return {
     status: 'updated',
     from,
     to: desired,
     latest: desired,
     daemon: d.state,
-    infra,
-    reason: d.state === 'failed' ? `binary updated but daemon restart failed: ${d.detail ?? ''}`.trim() : undefined,
+    healthy: settled.healthy,
+    infra: settled.infra,
+    reason: settled.reason,
   }
 }