@agfpd/iapeer 0.4.8 → 0.4.10

package/src/launch/index.ts

@@ -15,13 +15,9 @@
 
 import { existsSync, mkdirSync, statSync } from 'fs'
 import { dirname } from 'path'
-import { spawnSync } from 'child_process'
 import { type Runtime } from '../core/constants.ts'
 import { buildLaunchInvocation } from './invocation.ts'
-import { canaryChannel, dismissCanary, ensureServerCanary, exitLogPath, signalCanaryClean } from './canary.ts'
-import { hardenCmdLogDir, prepareCmdLogDir } from './cmdlog.ts'
-import { logReadyGateCrossCheck, readyGatePtyFlipEnabled, readyGateViewport } from './readyGateModel.ts'
-import { deliverHosted, hostSessionAlive, ptyHostEnabled, startPtyHost, waitHostReady } from './ptyHost.ts'
+import { deliverHosted, hostSessionAlive, startPtyHost, waitHostReady } from './ptyHost.ts'
 import { appendLifecycleEvent } from '../lifecycle/eventlog.ts'
 import { claudeAdapter } from './adapters/claude.ts'
 import { codexAdapter } from './adapters/codex.ts'
@@ -95,23 +91,6 @@ export function getAdapter(runtime: Runtime): RuntimeAdapter {
   throw new Error(`no launch adapter for runtime "${runtime}"`)
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// tmux helpers (direct spawnSync; no lifecycle dependency)
-// ─────────────────────────────────────────────────────────────────────────────
-
-function tmux(sock: string, ...args: string[]): { ok: boolean; out: string; err: string } {
-  const r = spawnSync('tmux', ['-S', sock, ...args], { encoding: 'utf8' })
-  return { ok: r.status === 0, out: r.stdout ?? '', err: r.stderr ?? '' }
-}
-function sessionAlive(sock: string, identity: string): boolean {
-  return tmux(sock, 'has-session', '-t', identity).ok
-}
-function capturePane(sock: string, identity: string): string {
-  return tmux(sock, 'capture-pane', '-t', identity, '-p').out
-}
-function shellQuote(value: string): string {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`
-}
 function sleep(ms: number): Promise<void> {
   return new Promise(r => setTimeout(r, ms))
 }
@@ -120,101 +99,21 @@ function fail(identity: string, reason: string): LaunchResult {
   return { status: 'FAILED', identity, process_address: identity, reason }
 }
 
-/**
- * The last two non-empty lines of a pane capture, flattened for embedding in a
- * fail reason: quotes → ', whitespace runs collapsed, joined with ' ⏎ ', clipped
- * to 160 chars. '' for an empty/blank capture (caller omits the clause). Exported
- * for unit tests — the boot loop embeds this in `never-became-ready` so the
- * delivery.log err field shows what the TUI was actually displaying.
- */
-export function paneTail(pane: string): string {
-  const lines = pane
-    .split(/\r?\n/)
-    .map(l => l.replace(/\s+/g, ' ').trim())
-    .filter(Boolean)
-  if (lines.length === 0) return ''
-  return lines.slice(-2).join(' ⏎ ').replace(/"/g, "'").slice(0, 160)
-}
 function ready(identity: string): LaunchResult {
   return { status: 'READY', identity, process_address: identity }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Exit-cause observability — capture WHY a session's process died, AT THE MOMENT
-// of death. The daemon's 60 s supervise tick only learns of a death post-factum
-// (reaped-gone), by which time the exit code/signal — and often the whole tmux
-// server — is gone (a blind spot one level deeper than the supervise log). A
-// tmux `pane-died` hook closes it: it fires the instant the
-// pane's leader process exits (with `remain-on-exit on` retaining the dead pane so
-// `#{pane_dead_status}`/`#{pane_dead_signal}` are populated), logs one logfmt line,
-// then kill-sessions the now-dead pane so the daemon's `has-session` death
-// detection (and the always-on KeepAlive block-watch) stay intact.
-//
-// Scope — verified live on tmux 3.6a (3 death modes + the daemon-reap path):
-//   • graceful exit  → `dead_status=<code> dead_signal=`   (code, no signal)
-//   • SIGTERM/SIGKILL/crash to the PROCESS → `dead_status= dead_signal=<name>`
-//   • daemon-initiated `kill-session` (idle-reap / self-TTL / stop) does NOT fire
-//     pane-died → NO line here (those are already in lifecycle.log — no double-log).
-// SERVER-LEVEL GAP: SIGKILL to the tmux SERVER process itself runs no hook (the
-//   event loop is gone). Closed one level up by the server-death canary
-//   (canary.ts — `ev=server-exit` + forensics snapshot); the daemon's post-factum
-//   reaped-gone death-class remains the detection backstop.
+// Exit-cause observability — the supervisor records WHY a hosted session's child
+// died (dead_status/dead_signal) into <exitLogDir>/exits.log at the moment of death
+// (a death-EVENT, host=supervisor), passed in via startPtyHost's exitLogPath. The
+// daemon's supervise tick learns of the death post-factum (reaped-gone) and reads
+// the cause from that log.
 // ─────────────────────────────────────────────────────────────────────────────
 
-// The exit-cause log path lives in canary.ts (no import cycle); re-exported here
-// so the public surface (`launch/index.ts → exitLogPath`) is unchanged.
-export { exitLogPath } from './canary.ts'
-
-/**
- * Build the tmux `pane-died` hook command string (the value of `set-hook -t <id>
- * pane-died <value>`). On the pane leader's death it appends ONE logfmt line —
- *   `ts=<ISO> ev=session-exit identity=<id> dead_status=#{…} dead_signal=#{…}`
- * — to `exitLogFile`, then runs a tmux-NATIVE `kill-session` (no shell `tmux`, so
- * it needs no PATH — launchd gives always-on servers a minimal one). Pure (no I/O)
- * so the exact string is unit-testable. Quoting: the `run-shell` arg is wrapped in
- * tmux SINGLE quotes (literal at the tmux layer, still `#{}`-format-expanded) with
- * sh DOUBLE quotes inside — the two levels never collide; `\n`/`$(…)` pass through
- * tmux untouched to sh. `identity`/`exitLogFile` are assumed free of single quotes
- * (runtime-personality identities and the ~/.iapeer/logs path always are). */
-export function exitCauseHook(identity: string, exitLogFile: string): string {
-  const line =
-    `ts=%s ev=session-exit identity=${identity} ` +
-    `dead_status=#{pane_dead_status} dead_signal=#{pane_dead_signal}\\n`
-  const log =
-    `printf "${line}" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${exitLogFile}"`
-  // Silence the server-death canary BEFORE kill-session: with a single-session
-  // server the kill empties the server and exit-empty takes it down — without
-  // explicit silence the canary would append a second, muddier `ev=server-exit`
-  // record for a death this very hook just captured (the session-exit line is
-  // the richer, authoritative one: it has the exit code/signal). v2 contract:
-  // deliberate = channel signal (tmux-NATIVE wait-for -S) + DISMISS the sh
-  // recorder (abs-path /usr/bin/pkill — survives the minimal launchd PATH;
-  // `\$` keeps the regex anchor literal through the sh double-quote layer; the
-  // `[i]` class keeps the pattern from matching its OWN occurrence in this
-  // hook-sh's cmdline — the pgrep self-match classic).
-  const dismiss = `/usr/bin/pkill -f "[i]${canaryChannel(identity).slice(1)}([^a-z0-9-]|\\$)"`
-  return `run-shell '${log} ; ${dismiss}' ; wait-for -S "${canaryChannel(identity)}" ; kill-session -t "${identity}"`
-}
-
-/** Install the exit-cause observability on a freshly-created session: ensure the
- *  exit-log dir exists, turn `remain-on-exit` on (so pane-died can read the dead
- *  pane's status/signal) and register the hook. Best-effort — a tmux/FS hiccup
- *  here must never fail the launch (observability is never load-bearing). No-op
- *  when `exitLogDir` is falsy (a partial/test cfg): `remain-on-exit` stays OFF so
- *  behavior is byte-identical to before (and no dead pane can linger un-reaped). */
-function installExitHook(sock: string, identity: string, exitLogDir: string | undefined): void {
-  if (!exitLogDir) return
-  try {
-    mkdirSync(exitLogDir, { recursive: true, mode: 0o700 })
-    // remain-on-exit must be ON before the process can die, else pane-died won't
-    // retain the dead pane and the status/signal are lost. Set it (and the hook)
-    // immediately after new-session — the only un-coverable window is the few ms
-    // before this runs, irrelevant for a runtime that takes seconds to initialize.
-    tmux(sock, 'set-option', '-t', identity, 'remain-on-exit', 'on')
-    tmux(sock, 'set-hook', '-t', identity, 'pane-died', exitCauseHook(identity, exitLogPath(exitLogDir)))
-  } catch {
-    /* observability is best-effort — never block a wake on a hook-install hiccup */
-  }
+/** The exit-cause log file (sibling to lifecycle.log) the supervisor appends death-EVENTs to. */
+export function exitLogPath(exitLogDir: string): string {
+  return `${exitLogDir}/exits.log`
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -264,7 +163,7 @@ export const launch: LaunchFn = async (
   // skipped; no transcript ready-gate — newestActivityMtime=null). @xterm stays out of THIS process
   // (ptyHost: @xterm-free start + deliver + sessionAlive; readiness's @xterm import is dynamic and only
   // loads here, default-on — and the router branch never reaches it).
-  if ((adapter.kind === 'tui' || adapter.kind === 'router') && ptyHostEnabled(cfg.logDir, identity)) {
+  if (adapter.kind === 'tui' || adapter.kind === 'router') {
     const invocation = buildLaunchInvocation(spec, adapter, cfg)
     mkdirSync(cfg.logDir, { recursive: true, mode: 0o700 }) // the supervisor writes the pane-log here
     const paneLogPath = `${cfg.logDir}/${identity}.log`
@@ -329,208 +228,9 @@ export const launch: LaunchFn = async (
       }
       return fail(identity, 'model-did-not-process-task (hosted: no activity advance after delivery)')
     }
-    // SPAWN-FALLBACK — host bringup failed; record it and fall through to the tmux path (never worse).
-    appendLifecycleEvent(cfg.exitLogDir, { ev: 'pty-host-fallback', identity, reason: host.error }, { env })
-  }
-
-  // (1) Pre-clean any stale tmux server on this socket, then launch detached.
-  //     Silence the server-death canary EXPLICITLY first — this teardown is
-  //     deliberate: signal the channel (client exits 0) AND dismiss the sh
-  //     recorder (TERM → trap → silent; canary v2 no longer reads a signaled
-  //     client alone as deliberate — an external killer sweeping server+client
-  //     was exactly the death-#4 silence). Only then sweep the server processes
-  //     (the pkill also matches a leftover canary client — harmless, both
-  //     canary processes are already dismissed).
-  signalCanaryClean(sock, identity)
-  dismissCanary(identity)
-  spawnSync('pkill', ['-f', `tmux -S ${sock} `], { stdio: 'ignore' })
-  tmux(sock, 'kill-server')
-
-  // (2) tmux new-session -d with the adapter-built, shell-quoted argv. The per-peer
-  //     per-runtime launch.env (zone Хранение / Рантайм-адаптеры) contributes
-  //     PEER_START_ARGS (APPENDED after the adapter's base flags — extraArgs is last
-  //     in every buildArgv) and extra child env. spec.extraArgs (an explicit caller
-  //     override) comes first, then launch.env's; both land after the base flags.
-  // argv + child env are composed by buildLaunchInvocation (invocation.ts) — the SINGLE source shared
-  // with the supervisor serving path (cutover Block 2) so a served session is byte-identical to this
-  // tmux-launched one. The tmux path shell-quotes+joins the argv into the new-session string; the
-  // supervisor path passes the same argv array to Bun.spawn. (PEER_START_ARGS append, codex bearer
-  // stub, identity ABI, PATH — all live there now, byte-for-byte unchanged.)
-  const { argv: runtimeArgv, env: childEnv } = buildLaunchInvocation(spec, adapter, cfg)
-  const runtimeCmd = runtimeArgv.map(shellQuote).join(' ')
-  // (2.4) tmux command-log (killer-hunt socket-command layer, cmdlog.ts): WARM
-  //       agent sessions start their server with `-v` so every client command —
-  //       incl. a killer's `kill-server`/`kill-session`, invisible to signal
-  //       forensics — lands in tmux-server-<pid>.log with client attribution
-  //       (`message: client-<pid> command: …`). The starting client runs FROM the
-  //       per-identity 0700 cmdlog dir (that is where tmux drops the logs; the
-  //       pane's cwd is still `-c cwd`). Gated like the other observability layers
-  //       on cfg.exitLogDir; skipped for always-on infra (rare relaunch = no
-  //       rotation point, and not the dying class). Best-effort: a failed dir
-  //       prepare just launches without -v.
-  const cmdLogDir = !cfg.alwaysOn && cfg.exitLogDir ? prepareCmdLogDir(cfg.exitLogDir, identity) : undefined
-  const start = spawnSync(
-    'tmux',
-    [
-      '-S', sock,
-      ...(cmdLogDir ? ['-v'] : []),
-      'new-session', '-d', '-s', identity, '-x', '220', '-y', '50', '-c', cwd, runtimeCmd,
-    ],
-    { env: childEnv as Record<string, string>, encoding: 'utf8', ...(cmdLogDir ? { cwd: cmdLogDir } : {}) },
-  )
-  if (start.status !== 0) {
-    return fail(identity, `tmux new-session failed: ${(start.stderr ?? '').trim() || 'exit ' + start.status}`)
-  }
-  // The server/client logs exist once new-session returns — clamp them to 0600.
-  if (cmdLogDir) hardenCmdLogDir(cmdLogDir)
-
-  // (2.5) Exit-cause observability: a `pane-died` hook that records WHY this
-  //       session's process dies (status/signal) at the moment of death into
-  //       <exitLogDir>/exits.log, then kill-sessions the dead pane (so the
-  //       daemon's has-session death detection + always-on KeepAlive stay intact).
-  //       Installed ASAP — before pipe-pane — so even a runtime that dies during
-  //       boot leaves a cause. No-op without cfg.exitLogDir (remain-on-exit off).
-  installExitHook(sock, identity, cfg.exitLogDir)
-
-  // (2.6) Server-death canary (canary.ts): the SERVER-level catcher pane-died
-  //       structurally cannot be — a detached wait-for client OUTSIDE the server
-  //       that records `ev=server-exit` + a forensics snapshot when the whole
-  //       server dies dirty (SIGKILL/OOM class). Same gate as the exit hook;
-  //       best-effort by construction (every failure → a state, never a throw).
-  //       The ensure-state is logged (origin=launch) so the arming trail is
-  //       complete in lifecycle.log: 'spawned' is the newborn-server norm here,
-  //       'failed' a newborn server starting its life UNWATCHED (death-#4
-  //       postmortem hinged on this very question being unanswerable).
-  const canaryState = ensureServerCanary({ identity, sock, exitLogDir: cfg.exitLogDir, env })
-  if (canaryState !== 'skipped') {
-    appendLifecycleEvent(cfg.exitLogDir, { ev: 'canary', identity, state: canaryState, origin: 'launch' }, { env })
-  }
-
-  // (3) pipe-pane the session output to the per-identity log.
-  mkdirSync(cfg.logDir, { recursive: true, mode: 0o700 })
-  const paneLog = `${cfg.logDir}/${identity}.log`
-  tmux(sock, 'pipe-pane', '-t', identity, `cat >> ${shellQuote(paneLog)}`)
-
-  // (4) [REMOVED 0.2.55] Session self-TTL. Was a tmux server-side
-  //     `run-shell -b -d <maxAgeSecs>` → `kill-session`, intended to bound a zombie
-  //     even if no supervise sweep runs. It was a BLIND wall-clock kill armed ONCE
-  //     at birth and never re-armed, so it guillotined HEALTHY long-lived sessions
-  //     at exactly birth+maxAge (4 h) — the recurrent "mystery deaths".
-  //     By construction any session that survives to maxAge is active: idle ones are
-  //     already idle-reaped at idleSecs (1 h) by the activity-aware supervisor — so
-  //     the blind kill could ONLY ever destroy live work (its sole "useful" case,
-  //     daemon dead the whole interval, leaves an inert orphan nothing can deliver
-  //     to, self-healed by idle-reap on daemon restart). The activity-aware idle-reap
-  //     (superviseTick) is now the SOLE lifecycle bound. (alwaysOn infra never armed it.)
-
-  // (5) Router runtime (telegram): no TUI input surface — there is no boot dialog
-  //     and no ready marker to gate on. The process is up; return READY.
-  if (adapter.kind === 'router') {
-    return ready(identity)
-  }
-
-  // (6) BOOT phase (tui) — baseline the activity proxy, answer startup dialogs,
-  //     wait for the input surface, then deliver firstMessage (load-buffer +
-  //     bracketed paste-buffer + Enter — the SAME byte-path as warm delivery).
-  //     An EMPTY firstMessage is a BARE bring-up (folder-launch with no seed, or an
-  //     attach-resume that carries no message): reach the input surface and return
-  //     READY — there is no message to deliver and nothing to ready-gate on (the
-  //     operator drives the session). A non-empty message takes the wake path
-  //     (deliver + ready-gate on a model turn).
-  const hasMessage = firstMessage.trim().length > 0
-  const baselineMtime = adapter.newestActivityMtime(cwd) ?? 0
-  const bootIters = Math.max(1, Math.ceil(cfg.bootDeadlineSecs / 2))
-  let delivered = false
-  let lastPane = '' // the final capture — surfaced in the never-became-ready reason
-  for (let i = 0; i < bootIters && !delivered; i++) {
-    await sleep(2000)
-    if (!sessionAlive(sock, identity)) {
-      return fail(identity, 'tmux session vanished during boot')
-    }
-    const pane = capturePane(sock, identity)
-    if (!pane) continue
-    lastPane = pane
-    const dialogKeys = adapter.bootDialogKeys(pane)
-    if (dialogKeys) {
-      tmux(sock, 'send-keys', '-t', identity, ...dialogKeys)
-      continue
-    }
-    // Ф1 READY-GATE SOURCE FLIP (per-peer flag, DARK by default). When the peer's flip flag is set,
-    // run the SAME isInputReady predicate on the pty-MODEL viewport (validated 0-divergence vs
-    // capture-pane by the burn-in gate, incl. the codex resume-with-history splash-off-screen center)
-    // instead of the capture-pane scrape, with an UNCONDITIONAL capture-pane fallback. This is the
-    // ONLY changed input — dialog detection (above) and delivery + delivery-confirm (below + transport)
-    // are untouched. Flag OFF → readyView === pane (byte-identical to today).
-    let readyView = pane
-    if (readyGatePtyFlipEnabled(cfg.logDir, identity)) {
-      const geo = tmux(sock, 'display', '-p', '-t', identity, '#{pane_width}x#{pane_height}')
-      const [c, r] = geo.ok ? geo.out.trim().split('x').map(Number) : [0, 0]
-      readyView = await readyGateViewport({ logDir: cfg.logDir, identity, fallback: pane, cols: c ?? 0, rows: r ?? 0 })
-      // SERVING-path cross-check (post-flip soak gate): the model verdict is AUTHORITATIVE (readyView);
-      // record what capture-pane WOULD have said, to prove 0 model-vs-capture divergence live in the
-      // serving path. Observability only — never affects the ready decision.
-      logReadyGateCrossCheck(cfg.exitLogDir, {
-        identity,
-        modelReady: adapter.isInputReady(readyView),
-        captureReady: adapter.isInputReady(pane),
-        geom: `${c ?? 0}x${r ?? 0}`,
-        nowISO: new Date().toISOString(),
-      })
-    }
-    if (adapter.isInputReady(readyView)) {
-      if (!hasMessage) return ready(identity) // bare bring-up — session up, no message
-      // Boot delivery = load-buffer → paste-buffer -p → Enter (Ф-#8b hardening):
-      // the SAME mechanism warm delivery uses (transport.deliverViaTmux), replacing
-      // the old `send-keys -l`. send-keys retypes the message as literal keystrokes —
-      // a multi-KB envelope replays key-by-key through the pty input buffer, and the
-      // two paths could diverge (a message that survives warm delivery could be
-      // mangled at cold-wake). load-buffer hands the TUI the whole envelope as ONE
-      // bracketed paste, byte-identical to the warm path. A load/paste hiccup →
-      // retry on the next boot iteration (previously the send-keys result was
-      // ignored and a failed inject was declared delivered, failing the wake later
-      // with the wrong reason at the ready-gate).
-      const bufferName = `iapeer-boot-${process.pid}-${Date.now()}`
-      const load = spawnSync(
-        'tmux',
-        ['-S', sock, 'load-buffer', '-b', bufferName, '-'],
-        { input: firstMessage, encoding: 'utf8' },
-      )
-      if (load.status !== 0) continue
-      const paste = tmux(sock, 'paste-buffer', '-p', '-b', bufferName, '-t', identity)
-      if (!paste.ok) {
-        tmux(sock, 'delete-buffer', '-b', bufferName)
-        continue
-      }
-      await sleep(300)
-      tmux(sock, 'send-keys', '-t', identity, 'Enter')
-      tmux(sock, 'delete-buffer', '-b', bufferName)
-      delivered = true
-    }
-  }
-  if (!delivered) {
-    // Surface WHAT the pane showed when the gate gave up — a codex-resume
-    // incident (splash scrolled off, composer ready, predicate false for 240 s) was
-    // undiagnosable from the bare reason alone. Last two non-empty lines, quotes
-    // flattened (the reason lands inside a logfmt-quoted err field), clipped.
-    const tail = paneTail(lastPane)
-    return fail(
-      identity,
-      `never-became-ready (stuck at a startup prompt or boot hang)${tail ? `; pane tail: ${tail}` : ''}`,
-    )
-  }
-
-  // (7) READY-GATE — the activity proxy must strictly advance past baseline
-  //     (the model picked up and processed the first message).
-  const readyDeadline = Date.now() + cfg.readyGateSecs * 1000
-  while (Date.now() < readyDeadline) {
-    await sleep(2000)
-    if (!sessionAlive(sock, identity)) {
-      return fail(identity, 'tmux session vanished during ready-gate')
-    }
-    const mt = adapter.newestActivityMtime(cwd) ?? 0
-    if (mt > baselineMtime) {
-      return ready(identity)
-    }
+    // pty-only: no tmux fallback — a failed host bringup fails the launch (loud, not silent).
+    appendLifecycleEvent(cfg.exitLogDir, { ev: 'pty-host-failed', identity, reason: host.error }, { env })
+    return fail(identity, `pty host bringup failed: ${host.error ?? 'unknown error'}`)
   }
-  return fail(identity, 'model-did-not-process-task (no activity advance after delivery)')
+  return fail(identity, `unsupported adapter kind "${adapter.kind}"`)
 }

package/src/launch/launchdRun.ts

@@ -16,7 +16,6 @@
 // with WorkingDirectory=<peer cwd> and EnvironmentVariables PEER_* set by launchd,
 // so process.cwd() IS the peer cwd.
 
-import { spawnSync } from 'child_process'
 import { join } from 'path'
 import { INFRA_RUNTIME_BIN_ENV, isInfraRuntime, resolveSockDir } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath } from '../core/socket.ts'
@@ -24,7 +23,6 @@ import { peerLogsDir, pluginLogsDir } from '../storage/index.ts'
 import { readPeerProfile } from '../identity/index.ts'
 import { getAdapter, launch } from './index.ts'
 import { hostSessionAlive, killPtyHost } from './ptyHost.ts'
-import { dismissCanary, signalCanaryClean } from './canary.ts'
 import type { LaunchConfig, LaunchSpec } from './types.ts'
 
 /** Block-watch poll cadence — seconds, deliberately NOT a tight loop (the session
@@ -37,36 +35,6 @@ const WATCH_INTERVAL_MS = 5000
  *  this turns that into a NON-zero diagnostic exit instead of a clean-looking run. */
 const BOOT_RECHECK_MS = 2000
 
-function sessionAlive(sock: string, identity: string): boolean {
-  return spawnSync('tmux', ['-S', sock, 'has-session', '-t', identity], { stdio: 'ignore' }).status === 0
-}
-
-/**
- * Tear down the always-on session WITH its tmux server (when this session was the
- * last one) — the signal-exit counterpart of lifecycle.killSession, local to avoid
- * a launch ⇆ lifecycle import. Canary-signaled first: this is a DELIBERATE stop.
- *
- * Fixes the defect where bootout did not kill the poller: `launchctl bootout`
- * TERMs THIS watcher process, but the detached tmux server — and the runtime
- * poller inside it — survived holding STALE in-memory state (e.g. a notifier
- * trigger's old target after a same-id replace), so a plain bootout+bootstrap was
- * NOT a real restart. With the teardown, the session
- * dies with its watcher: bootout = full stop, bootstrap = fresh bring-up that
- * re-reads durable state. `iapeer stop` (bootout + killSession) is unchanged —
- * both paths now converge on the same end state.
- */
-export function teardownAlwaysOnSession(sock: string, identity: string): void {
-  // Explicit canary silence (v2): channel signal (client exits 0) + dismiss the
-  // sh recorder — a signaled client alone is no longer read as deliberate.
-  signalCanaryClean(sock, identity)
-  dismissCanary(identity)
-  spawnSync('tmux', ['-S', sock, 'kill-session', '-t', identity], { stdio: 'ignore' })
-  const ls = spawnSync('tmux', ['-S', sock, 'list-sessions', '-F', '#{session_name}'], { encoding: 'utf8' })
-  if (!(ls.stdout ?? '').trim()) {
-    spawnSync('tmux', ['-S', sock, 'kill-server'], { stdio: 'ignore' })
-  }
-}
-
 /**
  * Build the always-on LaunchSpec for an infra peer, reading intelligence from the
  * local peer-profile.json. launchd sets WorkingDirectory = peer cwd, so that file
@@ -116,13 +84,10 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
   const sock = buildSocketPath(runtime, personality, sockDir)
   const adapter = getAdapter(runtime)
 
-  // Host-aware liveness (cutover infra-track): a flag-on router is supervisor-HOSTED (no tmux session);
-  // a flag-off one is tmux. Probe BOTH backings by RUNTIME STATE (not the `.pty-host` marker), so this
-  // is robust to a spawn-FALLBACK — if startPtyHost failed and launch fell back to tmux, the marker is
-  // present yet the live session is tmux. The router is "up" iff EITHER backing is alive; on child
-  // death BOTH go false → block-watch exits → run-infra exits → launchd KeepAlive respawns (the SOLE
-  // respawn owner; the supervisor never self-respawns — H4 held).
-  const isAlive = (): boolean => hostSessionAlive(identity) || sessionAlive(sock, identity)
+  // pty-only liveness: a router is supervisor-HOSTED. Probe by RUNTIME STATE (not the `.pty-host`
+  // marker). On child death it goes false → block-watch exits → run-infra exits → launchd KeepAlive
+  // respawns (the SOLE respawn owner; the supervisor never self-respawns — H4 held).
+  const isAlive = (): boolean => hostSessionAlive(identity)
 
   const cfg: LaunchConfig = {
     claudeBin: env.CLAUDE_BIN ?? 'claude',
@@ -194,19 +159,11 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     })
     interrupt = null
   }
-  // Signal-initiated exit (bootout / shutdown / kickstart -k) tears the session
-  // down WITH this watcher — without it the detached tmux poller outlived bootout
-  // holding stale in-memory state (see teardownAlwaysOnSession). A natural session
-  // death (stop=false) skips this: there is nothing to tear down, exit 0 →
-  // KeepAlive respawns a fresh bring-up.
-  // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher.
-  // A hosted router → kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans
-  // up); a tmux router → the tmux teardown. Pick by the live backing. A NATURAL death (stop=false) skips
-  // this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
-  if (stop) {
-    if (hostSessionAlive(identity)) killPtyHost(identity)
-    else teardownAlwaysOnSession(sock, identity)
-  }
+  // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher —
+  // kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans up sock/pid/serve)
+  // so the detached child does not outlive bootout holding stale in-memory state. A NATURAL death
+  // (stop=false) skips this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
+  if (stop) killPtyHost(identity)
   return 0
 }
 

package/src/launch/ptyHost.ts

@@ -26,18 +26,6 @@ import type { RuntimeAdapter } from './types.ts'
 export const HOST_COLS = 220
 export const HOST_ROWS = 50
 
-/** Per-peer pty-hosting decision. pty-supervisor hosting is the DEFAULT — a fresh peer is hosted under
- *  the supervisor (not `tmux new-session`) WITHOUT any marker (pty out of the box). A peer opts OUT
- *  to the legacy tmux path with a `<logDir>/<identity>.no-pty-host` marker (the dev/debug escape, valid
- *  only while tmux still exists). Read in TWO places, both of which want "is this peer pty-hosted": the
- *  spawn-gate (launch — host vs tmux) and the shadow observer (skip pty-hosted peers, they have no tmux
- *  to compare; an opt-OUT peer is tmux → compared). Legacy `.pty-host` opt-in markers are now REDUNDANT
- *  (pty is the default) and harmless — ignored here, so the 29 migrated peers keep hosting unchanged.
- *  The golden spawn-fallback (startPtyHost fail → tmux, in launch) is SEPARATE and unaffected: a
- *  pty-default peer whose host bring-up fails still falls through to tmux — never worse on spawn. */
-export function ptyHostEnabled(logDir: string, identity: string): boolean {
-  return !existsSync(`${logDir}/${identity}.no-pty-host`)
-}
 
 /** The supervisor's run dir (session sockets/pids/serve-specs). Env-isolatable via IAPEER_ROOT. */
 export function hostRunDir(): string {

package/src/launch/readyGateModel.ts

@@ -1,86 +1,15 @@
-// Ф1 READY-GATE viewport-source FLIP (cutover Block 3) — DARK / flag-gated, canary-first.
-//
-// The cold-wake ready-gate (launch index.ts step 6) decides "is the input surface ready?" by
-// running adapter.isInputReady on a VIEWPORT. Today that viewport is a `tmux capture-pane` scrape.
-// This is the FIRST migration mutation: swap the viewport SOURCE to the pty-MODEL (an @xterm/headless
-// emulation of the daemon's pane-log — the SAME raw child bytes tmux renders), keeping the SAME
-// production predicate (adapter.isInputReady) and an UNCONDITIONAL capture-pane fallback.
-//
-// Why this is low-radius: it is a viewport-SOURCE swap, NOT a predicate change.
-// The model verdict was validated 0-divergence vs capture-pane on the readiness predicate by the
-// burn-in gate (incl. the codex resume-with-history splash-off-screen center cell) before any peer
-// is flipped. It touches ONLY the isInputReady INPUT — dialog detection upstream and the delivery +
-// delivery-confirm downstream (submitIntoTui's submit-landed + deliverViaTmux's transcript-mtime
-// advance, the "real model advancement" final-arbiter) are untouched, so the canonical
-// harmless-false-glyph property is preserved by construction.
-//
-// FLAG: a per-peer marker `<logDir>/<identity>.pty-readygate`. Absent → capture-pane (byte-identical
-// to today). Present → the model viewport. Per-peer so the first flip is a single canary with the
-// whole fleet still on tmux; dynamic (touch/rm, no daemon restart). @xterm is dynamic-imported ONLY
-// when the flag is set, so the launch hot path stays @xterm-free with the flip off.
+// Pane-log MODEL leaf — render a supervisor pane-log (raw child pty bytes) through @xterm/headless to
+// the readiness viewport + composer-occupancy verdict. The pty-hosted ready-gate (ptyHost.waitHostReady)
+// and the warm-deliver busy-composer guard (transport) both read the session state from this model —
+// a hosted session has no capture-pane, so the pane-log model is the ONLY readiness/occupancy source.
+// @xterm is dynamic-imported (loaded only when a model is actually built), so callers that never build
+// one stay @xterm-free.
 
-import { appendFileSync, closeSync, existsSync, fstatSync, openSync, readSync } from 'node:fs'
-import { join } from 'node:path'
+import { closeSync, existsSync, fstatSync, openSync, readSync } from 'node:fs'
 import type { Terminal } from '@xterm/headless' // TYPE-ONLY (erased) — the runtime @xterm load is the dynamic import below
 
 const SEED_BYTES = 4 * 1024 * 1024
 
-/**
- * SERVING-path cross-check log (the post-flip soak gate). When a peer is flipped, the MODEL verdict
- * is AUTHORITATIVE in the cold-wake ready-gate; this records, per evaluation, what capture-pane WOULD
- * have said — so a soak can prove 0 model-vs-capture divergence IN THE SERVING PATH (the read-only
- * burn-in measures continuously but never drove the actual ready decision). Append-only jsonl under
- * the event-log dir. Best-effort: a log hiccup never affects the ready decision. No-op without a dir.
- */
-export function logReadyGateCrossCheck(
-  eventLogDir: string | undefined,
-  rec: { identity: string; modelReady: boolean; captureReady: boolean; geom: string; nowISO: string },
-): void {
-  if (!eventLogDir) return
-  try {
-    appendFileSync(
-      join(eventLogDir, 'readygate-flip.jsonl'),
-      JSON.stringify({
-        ts: rec.nowISO,
-        identity: rec.identity,
-        modelReady: rec.modelReady,
-        captureReady: rec.captureReady,
-        diverged: rec.modelReady !== rec.captureReady,
-        geom: rec.geom,
-      }) + '\n',
-    )
-  } catch {
-    /* observability only — never block the ready-gate */
-  }
-}
-
-/** Per-peer ready-gate flip flag: the marker `<logDir>/<identity>.pty-readygate`. */
-export function readyGatePtyFlipEnabled(logDir: string, identity: string): boolean {
-  return existsSync(`${logDir}/${identity}.pty-readygate`)
-}
-
-export interface ReadyGateViewportOpts {
-  logDir: string
-  identity: string
-  /** The capture-pane scrape — returned verbatim when the flag is off OR any model build fails. */
-  fallback: string
-  cols: number
-  rows: number
-}
-
-/**
- * Resolve the ready-gate viewport. Flag OFF → `fallback` (capture-pane) verbatim — zero work, the
- * caller never even reaches here unless it pre-checked the flag, but this stays safe regardless.
- * Flag ON → the pty-model viewport as plain text. ANY failure (unreadable/short log, @xterm hiccup)
- * → `fallback`: the flip can never make readiness WORSE than capture-pane today (tmux is the floor).
- */
-export async function readyGateViewport(opts: ReadyGateViewportOpts): Promise<string> {
-  if (!readyGatePtyFlipEnabled(opts.logDir, opts.identity)) return opts.fallback
-  if (!(opts.cols > 0 && opts.rows > 0)) return opts.fallback
-  const view = await paneLogViewport(`${opts.logDir}/${opts.identity}.log`, opts.cols, opts.rows)
-  return view ?? opts.fallback // tmux-fallback is unconditional — never worse than today
-}
-
 /**
  * Read a pane-log's tail into a headless @xterm and render the viewport as plain text — the SAME
  * 0-divergence-validated model the ready-gate flip uses, shared with the spawn-flip hosted path (a
@@ -124,7 +53,7 @@ async function loadPaneLogModel(log: string, cols: number, rows: number, startBy
 export async function paneLogViewport(log: string, cols: number, rows: number, startByte = 0): Promise<string | null> {
   const term = await loadPaneLogModel(log, cols, rows, startByte)
   if (!term) return null
-  const { modelToPlainText } = await import('../shadow/render.ts')
+  const { modelToPlainText } = await import('../supervisor/render.ts')
   return modelToPlainText(term, cols, rows)
 }
 
@@ -152,6 +81,6 @@ export async function paneLogViewport(log: string, cols: number, rows: number, s
 export async function paneLogComposerOccupied(log: string, cols: number, rows: number, runtime: string): Promise<boolean> {
   const term = await loadPaneLogModel(log, cols, rows)
   if (!term) return false // unreadable pane-log → no observed human composer text → deliver, never stall (see JSDoc)
-  const { composerOccupancyFromModel } = await import('../shadow/render.ts')
+  const { composerOccupancyFromModel } = await import('../supervisor/render.ts')
   return composerOccupancyFromModel(term, cols, rows, runtime)
 }