@agfpd/iapeer 0.4.85 → 0.4.86

package/docs/10-messaging.md

@@ -34,7 +34,25 @@ The daemon finds the recipient in the registry and looks at its state:
 
 The key guarantee: `delivered` means the message actually landed in a live session (the daemon waited for confirmation), not that it was just sent into the void. If the session didn't confirm receipt in the allotted time, the daemon treats it as dead and doesn't lie about success.
 
-In every message's envelope travels the sender's nature (`intelligence`) — the recipient knows whether a human, an agent, or a service process is writing to it.
+In every message's envelope travels the sender's nature (`intelligence`) — the recipient knows whether a human, an agent, or a service process is writing to it — and the dispatch instant (`ts`): the moment the router accepted the send. The same instant is returned to the sender as the `ts` field of its `send_to_peer` result, so both sides of a conversation can literally compare timestamps — which is what makes an async desync (a reply addressing an already-outdated state) visible to the recipient instead of silent.
+
+## Envelope: wire form vs agent presentation
+
+The envelope exists in two renderings of the same content:
+
+- **Wire form** — the canonical durable shape: legacy attribute names (`from-personality` / `from-runtime` / `from-intelligence`), `ts` as a full local ISO instant with offset, the body always CDATA-wrapped, `<message>` tag. This is what travels through disk queues, what bridge runtimes (telegram / notifier / voicetalk) receive and parse, and what their pane logs show. It never slims: its bytes cost no tokens, and every deployed parser keeps working unchanged.
+- **Agent presentation** — rendered at the last hop wherever text enters an LLM context (a live delivery to a claude/codex session, a wake boot first-message, an ephemeral-queue drain):
+
+  ```
+  <iap from="boris" runtime="claude" intelligence="artificial" ts="01:23:45">
+  Reply via send_to_peer.
+  <msg>message body…</msg>
+  </iap>
+  ```
+
+  Short attribute names, `ts` compacted to local host time — time-only when the message was sent the same local calendar day it is delivered, date-prefixed (`2026-07-13 01:23:45`) otherwise, so a queue-drained or long-delayed message can never masquerade as fresh. The body is raw (no CDATA) unless it quotes envelope machinery itself — then it keeps the CDATA wrapping (a cosmetic fallback, nothing parses the presentation). The render is fail-open: any problem delivers the wire form as-is rather than risking the message.
+
+So host logs deliberately show two envelope shapes: bridge-bound pane logs carry the wire form, agent-bound pane logs and transcripts carry the compact presentation. The core decoder reads both name sets (and both `<message>`/`<msg>` tags), so any envelope ever emitted on the host — including historic transcripts — still decodes.
 
 ## Message limits
 

package/docs/16-tray.md

@@ -85,7 +85,7 @@ whole dashboard twice.
 | `iapeer tray render [--stream]` | Print the SwiftBar plugin output. `--stream` is the streamable loop the plugin runs; the one-shot form is the poll fallback and the test surface. |
 | `iapeer tray cmd <command> <peer> [runtime]` | POST a fleet command (`wake`/`stop`/`start`/`new`/`refresh`/`interrupt`/`compact`) — the menu's lifecycle actions call this. |
 | `iapeer tray approve <id>` · `iapeer tray deny <id> [reason]` | Resolve a pending human-approval (docs/17) — `POST /fleet/v1/approvals/<id>/(approve\|deny)` over the same unix-first fleet client. The menu's Allow/Deny items call these; the single-queue invariant means the resolution is seen by every channel (CLI, telegram). |
-| `iapeer tray status` | Read-only: is the fleet API up (from `router.json`), is SwiftBar installed and where is its plugin dir, is the plugin file present, **is the tray-host supervisor registered**. Repairs nothing. |
+| `iapeer tray status` | Read-only: is the fleet API up (from `router.json`), is SwiftBar installed and where is its plugin dir, is the plugin file present, **is the tray-host supervisor registered**, and **is the menu-bar icon visible right now** (the persisted `NSStatusItem VisibleCC` state — the ground truth to read first when "the icon is gone" is reported; no screen needed). Repairs nothing. |
 
 ## How it is wired
 

package/docs/ru/16-tray.md

@@ -81,7 +81,7 @@ SwiftBar.app, если его нет.
 | `iapeer tray render [--stream]` | Печатает вывод плагина SwiftBar. `--stream` — streamable-цикл, который крутит плагин; одноразовая форма — поллинг-фолбэк и тест-поверхность. |
 | `iapeer tray cmd <command> <peer> [runtime]` | POST fleet-команды (`wake`/`stop`/`start`/`new`/`refresh`/`interrupt`/`compact`) — lifecycle-пункты меню зовут это. |
 | `iapeer tray approve <id>` · `iapeer tray deny <id> [reason]` | Резолв ожидающего human-approval (docs/17) — `POST /fleet/v1/approvals/<id>/(approve\|deny)` через тот же unix-first fleet-клиент. Пункты Allow/Deny меню зовут это; инвариант единой очереди — резолв виден каждому каналу (CLI, telegram). |
-| `iapeer tray status` | Только чтение: жив ли fleet API (из `router.json`), установлен ли SwiftBar и где его каталог плагинов, на месте ли файл плагина, **зарегистрирован ли супервизор tray-хоста**. Ничего не чинит. |
+| `iapeer tray status` | Только чтение: жив ли fleet API (из `router.json`), установлен ли SwiftBar и где его каталог плагинов, на месте ли файл плагина, **зарегистрирован ли супервизор tray-хоста** и **видима ли иконка в менюбаре прямо сейчас** (персистентное состояние `NSStatusItem VisibleCC` — ground truth, который читают первым при жалобе «иконка пропала»; экран не нужен). Ничего не чинит. |
 
 ## Как устроено
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.85",
+  "version": "0.4.86",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -2607,8 +2607,10 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
                 `  sock: ${s.daemon.sock ?? '—'}\n` +
                 `  tcp:  ${s.daemon.tcp ?? '—'}\n` +
                 `SwiftBar: ${s.swiftbar.installed ? `installed (plugin dir: ${s.swiftbar.pluginDir ?? 'unset'})` : 'not installed'}\n` +
+                // the persisted NSStatusItem visibility — ground truth for "the icon is gone"
+                `menu-bar icon: ${s.swiftbar.iconVisible === undefined ? 'unknown (no persisted state)' : s.swiftbar.iconVisible ? 'visible' : 'HIDDEN (persisted NSStatusItem VisibleCC=0)'}\n` +
                 `plugin: ${s.plugin.installed ? s.plugin.path : 'not installed'}\n` +
-                `login autostart: ${s.autostart.registered ? s.autostart.path : 'not registered'}\n`,
+                `supervisor (autostart): ${s.autostart.registered ? s.autostart.path : 'not registered'}\n`,
             )
             return 0
           }

package/src/codec/index.ts

@@ -30,11 +30,37 @@ export interface EnvelopeInput {
   fromPersonality: string
   fromRuntime: Runtime
   fromIntelligence: Intelligence
+  /** ISO-8601 LOCAL instant with offset (formatSentAt) — the moment the router
+   *  ACCEPTED the send; the same string is returned to the sender as the `ts`
+   *  field of its send_to_peer result, so recipient-side `ts` and sender-side
+   *  `ts` correspond literally. Rendered as the `ts` open-tag attribute.
+   *  ADDITIVE and optional: every known envelope consumer reads attributes by
+   *  NAME and ignores unknown ones; absent on legacy envelopes. On the WIRE this
+   *  is always the FULL date-time (durable stores — disk queues, pane logs —
+   *  must be unambiguous); the agent-facing render compacts it (see
+   *  renderEnvelopeForAgent). */
+  sentAt?: string
   topic?: string
   attachments?: readonly string[]
   message: string
 }
 
+/** Format a Date as ISO-8601 LOCAL time with numeric offset, second precision:
+ *  `2026-07-14T01:23:45+03:00`. Local (not UTC-Z) on purpose: the fleet's agents
+ *  compare envelope timestamps against their LOCAL statusline clock — a Z-form
+ *  invites silent off-by-offset misreads by an LLM reader. */
+export function formatSentAt(date: Date): string {
+  const pad = (n: number): string => String(n).padStart(2, '0')
+  const offMin = -date.getTimezoneOffset() // minutes EAST of UTC
+  const sign = offMin >= 0 ? '+' : '-'
+  const abs = Math.abs(offMin)
+  return (
+    `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
+    `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}` +
+    `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`
+  )
+}
+
 function escapeAttr(value: string): string {
   return value
     .replace(/&/g, '&')
@@ -49,12 +75,20 @@ function cdata(value: string): string {
   return `<![CDATA[${value.replaceAll(']]>', ']]]]><![CDATA[>')}]]>`
 }
 
+/** WIRE encoder — the canonical durable form (disk queues, bridge deliveries,
+ *  pane logs): legacy attribute names + always-CDATA body, so every deployed
+ *  sibling parser (telegram-/notifier-/voicetalk-runtime) keeps working
+ *  unchanged. `ts` is the only additive attribute (envelope-compaction F).
+ *  Agent-bound deliveries are re-rendered compactly at the LAST hop — see
+ *  renderEnvelopeForAgent; the wire form itself never slims (its bytes cost no
+ *  tokens; only the LLM-context presentation does). */
 export function buildEnvelope(input: EnvelopeInput): string {
   const attrs = [
     `from-personality="${escapeAttr(input.fromPersonality)}"`,
     `from-runtime="${escapeAttr(input.fromRuntime)}"`,
     `from-intelligence="${escapeAttr(input.fromIntelligence)}"`,
   ]
+  if (input.sentAt) attrs.push(`ts="${escapeAttr(input.sentAt)}"`)
   const topic = input.topic?.trim()
   if (topic) {
     attrs.push(`topic="${escapeAttr(topic.slice(0, MAX_TOPIC_LEN))}"`)
@@ -146,13 +180,21 @@ export interface IapEnvelope {
   fromPersonality: string
   fromRuntime: Runtime
   fromIntelligence?: Intelligence
+  /** The sender's dispatch instant (`ts` attribute) — full local ISO on the wire;
+   *  absent on legacy envelopes. */
+  sentAt?: string
   topic?: string
   attachments: string[]
   message: string
 }
 
+/** NAME-ANCHORED attribute lookup. The anchor `(^|\s)` is load-bearing: the old
+ *  unanchored regex made `runtime="` match the TAIL of `from-runtime="…"` (and
+ *  `intelligence="` the tail of `from-intelligence="…"`) — a latent mine that the
+ *  read-both decoder below would have stepped on (the short-name lookup must NOT
+ *  be satisfied by a legacy long-name attribute). */
 function attrValue(attrs: string, name: string): string | undefined {
-  const re = new RegExp(`${name}="([^"]*)"`)
+  const re = new RegExp(`(?:^|\\s)${name}="([^"]*)"`)
   const m = re.exec(attrs)
   return m ? unescapeAttr(m[1]) : undefined
 }
@@ -167,25 +209,34 @@ function unescapeAttr(value: string): string {
     .replace(/&amp;/g, '&')
 }
 
+/** READ-BOTH decoder: accepts the legacy wire names (`from-personality` /
+ *  `from-runtime` / `from-intelligence`, `<message>`) AND the compact
+ *  presentation names (`from` / `runtime` / `intelligence`, `<msg>`) — so any
+ *  envelope form ever emitted on this host (wire, agent-facing render, historic
+ *  transcripts) decodes. Short names win when both are present. */
 export function decodeEnvelope(xml: string): IapEnvelope {
   const open = /^<iap\s+([^>]*)>/.exec(xml.trim())
   if (!open) throw new IapError('invalid IAP envelope: missing <iap ...>')
-  const fromPersonality = attrValue(open[1], 'from-personality')
-  const fromRuntime = attrValue(open[1], 'from-runtime')
+  const fromPersonality = attrValue(open[1], 'from') ?? attrValue(open[1], 'from-personality')
+  const fromRuntime = attrValue(open[1], 'runtime') ?? attrValue(open[1], 'from-runtime')
   if (!fromPersonality || !fromRuntime) {
     throw new IapError('invalid IAP envelope: missing from-personality/from-runtime')
   }
   // READ-COMPAT: a legacy peer (live telegram) may stamp from-intelligence="human";
   // normalize human→natural / scripted→absent, drop a genuinely unknown value.
-  const fromIntelligence = normalizeIntelligenceValue(attrValue(open[1], 'from-intelligence'))
-  const message = readTagContent(xml, 'message')
+  const fromIntelligence = normalizeIntelligenceValue(
+    attrValue(open[1], 'intelligence') ?? attrValue(open[1], 'from-intelligence'),
+  )
+  const message = readTagContent(xml, 'message') ?? readTagContent(xml, 'msg')
   if (message === undefined) throw new IapError('invalid IAP envelope: missing message')
   const attachmentsRaw = readTagContent(xml, 'attachments')
   const topic = attrValue(open[1], 'topic')
+  const sentAt = attrValue(open[1], 'ts')
   return {
     fromPersonality,
     fromRuntime,
     ...(fromIntelligence ? { fromIntelligence } : {}),
+    ...(sentAt ? { sentAt } : {}),
     ...(topic ? { topic } : {}),
     attachments: attachmentsRaw
       ? attachmentsRaw.split('\n').map(item => item.trim()).filter(Boolean)
@@ -209,7 +260,12 @@ function openTagVerdict(candidate: string): 'valid' | 'invalid' | 'incomplete' {
     return unclosed && candidate.length <= MAX_OPEN_TAG_LEN ? 'incomplete' : 'invalid'
   }
   if (m[0].length > MAX_OPEN_TAG_LEN) return 'invalid'
-  return m[1].includes('from-personality="') && m[1].includes('from-runtime="') ? 'valid' : 'invalid'
+  // Read-both (envelope-compaction F): a real open tag carries the required pair
+  // under EITHER naming — legacy wire (from-personality/from-runtime) or compact
+  // presentation (from/runtime, name-anchored so a legacy tail never satisfies it).
+  const hasPersonality = m[1].includes('from-personality="') || /(?:^|\s)from="/.test(m[1])
+  const hasRuntime = m[1].includes('from-runtime="') || /(?:^|\s)runtime="/.test(m[1])
+  return hasPersonality && hasRuntime ? 'valid' : 'invalid'
 }
 
 /**
@@ -257,3 +313,85 @@ export function extractEnvelopes(buffer: string): { envelopes: string[]; rest: s
     rest = rest.slice(envelopeEnd)
   }
 }
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Agent-facing presentation render (envelope-compaction F)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Presentation-hybrid gate: a body that itself contains envelope machinery
+ *  (a quoted envelope, tag markers, CDATA syntax) or a literal CR keeps its
+ *  CDATA wrapping in the presentation too — the cost of the gate firing is
+ *  purely COSMETIC (the agent sees today's CDATA form), whereas rendering such
+ *  a body raw would show the agent a "broken" nested envelope. Plain `<` (code
+ *  snippets etc.) renders raw: nothing parses the presentation. */
+const PRESENTATION_CDATA_MARKERS = [
+  '<iap ',
+  '</iap>',
+  '<message>',
+  '</message>',
+  '<msg>',
+  '</msg>',
+  '<attachments>',
+  '</attachments>',
+  '<![CDATA[',
+  ']]>',
+  '\r',
+] as const
+
+function presentBody(value: string): string {
+  return PRESENTATION_CDATA_MARKERS.some(marker => value.includes(marker)) ? cdata(value) : value
+}
+
+/** Compact the wire `ts` (full local ISO with offset) for the agent's eyes:
+ *  time-only `01:23:45` when the send happened on the SAME local calendar day
+ *  as the render (the normal case), date-prefixed `2026-07-13 01:23:45` when it
+ *  did not (queue drains, long sleeps, midnight crossings) — so a stale message
+ *  can never masquerade as fresh. Renders happen at the LAST delivery hop, so
+ *  "today" is delivery-time local. An unparseable ts passes through verbatim. */
+function renderTsForAgent(sentAt: string, now: Date): string {
+  const d = new Date(sentAt)
+  if (Number.isNaN(d.getTime())) return sentAt
+  const pad = (n: number): string => String(n).padStart(2, '0')
+  const time = `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`
+  const sameLocalDay =
+    d.getFullYear() === now.getFullYear() && d.getMonth() === now.getMonth() && d.getDate() === now.getDate()
+  return sameLocalDay ? time : `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${time}`
+}
+
+/**
+ * Render a WIRE envelope into the compact agent-facing presentation:
+ *
+ *   <iap from="boris" runtime="claude" intelligence="artificial" ts="01:23:45">
+ *   Reply via send_to_peer.
+ *   <msg>raw body…</msg>
+ *   </iap>
+ *
+ * Short attribute names, time-only `ts` (cross-day rule above), raw body
+ * (hybrid CDATA when the body quotes envelope machinery). Called ONLY at the
+ * two hops where text enters an LLM context (composeFirstMessage — wake boot +
+ * ephemeral drain; deliverWarm — live paths, gated on agent runtimes); bridge
+ * targets always receive the wire form their parsers expect.
+ *
+ * FAIL-OPEN: any decode/render problem returns the wire text unchanged — a
+ * presentation hiccup must never lose or mangle a delivery.
+ */
+export function renderEnvelopeForAgent(wire: string, now: Date = new Date()): string {
+  try {
+    const env = decodeEnvelope(wire)
+    const attrs = [`from="${escapeAttr(env.fromPersonality)}"`, `runtime="${escapeAttr(env.fromRuntime)}"`]
+    if (env.fromIntelligence) attrs.push(`intelligence="${escapeAttr(env.fromIntelligence)}"`)
+    if (env.sentAt) attrs.push(`ts="${escapeAttr(renderTsForAgent(env.sentAt, now))}"`)
+    if (env.topic) attrs.push(`topic="${escapeAttr(env.topic)}"`)
+    return [
+      `<iap ${attrs.join(' ')}>`,
+      IAP_INSTRUCTION,
+      ...(env.attachments.length
+        ? [`<attachments>${presentBody(env.attachments.join('\n'))}</attachments>`]
+        : []),
+      `<msg>${presentBody(env.message)}</msg>`,
+      '</iap>',
+    ].join('\n')
+  } catch {
+    return wire // fail-open: deliver the wire form rather than risk the message
+  }
+}

package/src/core/constants.ts

@@ -197,8 +197,9 @@ export const PEERS_HOME_DIR = 'peers'
 export const LAUNCHD_LABEL_PREFIX = 'com.iapeer.'
 export const DAEMON_PLIST_LABEL = 'com.agfpd.iapeer'
 
-export const IAP_INSTRUCTION =
-  'IAP message from known peers. Reply via send_to_peer.'
+// Shortened 0.4.86 (envelope-compaction F): the long preamble duplicated doctrine
+// (origin-routing) for live sessions; the reply-routing cue is the load-bearing part.
+export const IAP_INSTRUCTION = 'Reply via send_to_peer.'
 
 export const ALWAYS_LOAD_META = {
   'anthropic/alwaysLoad': true,

package/src/daemon/index.ts

@@ -121,7 +121,7 @@ export function buildSendDescription(): string {
     'Peers can be agents, humans, or services. Runtime is the delivery surface, not the peer type.',
     'Current delivery supports any runtime endpoint that follows the IAP tmux socket convention. Claude/Codex are built-in local runtimes; external runtimes such as telegram can be exposed by runtime-router packages.',
     '',
-    "Use `personality`, not a runtime-prefixed identity. Set `runtime` to target a specific declared runtime for this send. If that runtime is warm-asleep, the daemon wakes it and delivers there; use this to intentionally bring up a second session of the same peer in parallel to the default runtime (for example codex alongside claude). Inbound peer messages arrive as <iap from-personality=\"...\" from-runtime=\"...\" from-intelligence=\"...\"> blocks. The topic attribute is optional.",
+    "Use `personality`, not a runtime-prefixed identity. Set `runtime` to target a specific declared runtime for this send. If that runtime is warm-asleep, the daemon wakes it and delivers there; use this to intentionally bring up a second session of the same peer in parallel to the default runtime (for example codex alongside claude). Inbound peer messages arrive as <iap from=\"...\" runtime=\"...\" intelligence=\"...\" ts=\"...\"> blocks; `ts` is the sender's dispatch time (local host time; date-prefixed when not sent today) — compare it with the current time to spot a stale/desynced message. The topic attribute is optional.",
   ].join('\n')
 }
 

package/src/daemon/main.ts

@@ -181,7 +181,7 @@ export function makeEphemeralRouteDeps(
 ): EphemeralRouteDeps {
   return {
     isEphemeral: cwd => isEphemeralPeer(cwd),
-    deliver: async ({ peer, envelope, topic, runtime }) => {
+    deliver: async ({ peer, envelope, topic, runtime, sentAt }) => {
       const rt = resolveWakeRuntime(runtime, peer)
       if (!rt.ok) return rt
       const identity = buildProcessAddress(rt.value, peer.personality)
@@ -201,7 +201,7 @@ export function makeEphemeralRouteDeps(
         queued: true,
         queuedBy: 'ephemeral',
         queueDepth: depth,
-        ts: new Date().toISOString(),
+        ts: sentAt ?? new Date().toISOString(),
       })
     },
   }

package/src/lifecycle/index.ts

@@ -25,6 +25,7 @@ import {
   type Runtime,
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
+import { renderEnvelopeForAgent } from '../codec/index.ts'
 import { err, ok, type Result } from '../core/errors.ts'
 import { capPaneLogs, paneLogRotateConfig } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
@@ -917,17 +918,23 @@ function composePeerPrompt(
  * yields no seed and never blocks the wake (the seed is optional).
  */
 export function composeFirstMessage(cwd: string, task: string, fresh: boolean): string {
-  if (!fresh) return task
+  // Envelope-compaction F: the boot first-message enters an LLM context (wake
+  // targets are agent runtimes by construction — launchd-held bridges are never
+  // woken, H4), so the routed WIRE envelope is rendered into the compact
+  // agent-facing presentation here — the boot-side twin of deliverWarm's render.
+  // fail-open inside the renderer (non-envelope/empty task passes through as-is).
+  const presented = task ? renderEnvelopeForAgent(task) : task
+  if (!fresh) return presented
   let seed: string | undefined
   try {
     seed = readPeerProfile(cwd)?.initial_prompt
   } catch {
     /* invalid/absent profile → no seed */
   }
-  if (!seed) return task
+  if (!seed) return presented
   // seed + the routed message (both delivered, seed first). When there is NO incoming
   // message (an eager /new re-launch, C4b — task is empty), the seed is self-sufficient.
-  return task ? `${seed}\n\n${task}` : seed
+  return presented ? `${seed}\n\n${presented}` : seed
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/transport/index.ts

@@ -32,7 +32,7 @@ import {
   buildSocketPath,
   type ProcessAddress,
 } from '../core/socket.ts'
-import { buildEnvelope } from '../codec/index.ts'
+import { buildEnvelope, formatSentAt, renderEnvelopeForAgent } from '../codec/index.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { findPeer, readPeersIndex, type PeerRecord } from '../registry/index.ts'
 import type { ResolvedCaller } from '../identity/index.ts'
@@ -238,12 +238,18 @@ export async function deliverWarm(
   seam: WarmDeliverSeam = {},
   env: NodeJS.ProcessEnv = process.env,
 ): Promise<Result<void>> {
+  // Envelope-compaction F: an AGENT target (claude/codex — an LLM reads the text)
+  // receives the compact presentation; a bridge target (telegram/notifier/…)
+  // receives the WIRE form its parser expects. Rendered BEFORE deliverViaHost so
+  // the transcript-confirm matches the text actually delivered. fail-open inside
+  // the renderer: a render problem degrades to the wire form, never to a loss.
+  const payload = isSupportedLocalRuntime(target.runtime) ? renderEnvelopeForAgent(envelope) : envelope
   const address = target.address
   const prev = deliverTails.get(address) ?? Promise.resolve()
   // run AFTER prev settles (success or failure) — a prior delivery's error must not stall the chain
   const run = prev.then(
-    () => deliverViaHost(target, envelope, cwd, seam, env),
-    () => deliverViaHost(target, envelope, cwd, seam, env),
+    () => deliverViaHost(target, payload, cwd, seam, env),
+    () => deliverViaHost(target, payload, cwd, seam, env),
   )
   deliverTails.set(
     address,
@@ -884,6 +890,9 @@ export interface EphemeralRouteDeps {
     envelope: string
     topic?: string
     runtime?: string
+    /** Router-acceptance instant (formatSentAt) — the enqueue ACK's `ts` mirrors
+     *  it so sender-side ts ≡ envelope ts holds on the queued path too. */
+    sentAt?: string
   }) => Promise<Result<RouteResult>>
 }
 
@@ -904,6 +913,8 @@ export interface ComposerQueueTryEnqueueArgs {
   target: DeliveryTarget
   envelope: string
   topic?: string
+  /** Router-acceptance instant (formatSentAt) — the queued ACK's `ts` mirrors it. */
+  sentAt?: string
 }
 
 export interface ComposerQueueRouteDeps {
@@ -1192,7 +1203,7 @@ export function createComposerDeliveryQueue(opts: ComposerDeliveryQueueOptions):
         queued: true,
         queuedBy: 'composer',
         queueDepth: q.length,
-        ts: new Date().toISOString(),
+        ts: args.sentAt ?? new Date().toISOString(),
       })
     },
     failAll: async reason => {
@@ -1317,12 +1328,19 @@ export async function routeSend(
   const intendedGuard = telegramSenderGuard(caller, runtime ?? peer.runtime, personality)
   if (!intendedGuard.ok) return intendedGuard
 
+  // Stamped ONCE at router acceptance: the same instant travels as the envelope's
+  // `ts` attribute (recipient side) AND is returned as the result's `ts` (sender
+  // side) — the two correspond literally, which is what makes async-desync
+  // visible (the recipient can tell how old the message it is reading is).
+  const sentAt = formatSentAt(new Date())
   // Built once — it is both the live-delivery payload and, on a miss, the wake
-  // first-message (the woken session receives it as its boot task).
+  // first-message (the woken session receives it as its boot task). This is the
+  // WIRE form; agent-bound hops re-render it compactly at delivery.
   const envelope = buildEnvelope({
     fromPersonality: caller.personality,
     fromRuntime: caller.runtime,
     fromIntelligence: caller.intelligence,
+    sentAt,
     topic,
     attachments: attachmentsResult.value,
     message,
@@ -1336,7 +1354,7 @@ export async function routeSend(
   // would deadlock its own die-after-reply reap on a forever-non-empty queue).
   if (deps.ephemeral?.isEphemeral(peer.cwd)) {
     if (caller.personality === peer.personality) return err('cannot send to self')
-    return deps.ephemeral.deliver({ peer, envelope, topic, runtime })
+    return deps.ephemeral.deliver({ peer, envelope, topic, runtime, sentAt })
   }
 
   const target = resolvePeerDeliveryTarget(personality, runtime, peer, env)
@@ -1346,7 +1364,7 @@ export async function routeSend(
     // land on telegram without an override and without telegram being the default).
     const liveGuard = telegramSenderGuard(caller, target.value.runtime, personality)
     if (!liveGuard.ok) return liveGuard
-    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: target.value, envelope, topic })
+    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: target.value, envelope, topic, sentAt })
     if (queued) return queued
     // peer.cwd enables the Ф-B transcript-mtime liveness probe (busy-session case).
     // deliverWarm is HOST-AWARE (spawn-flip Ф0b-2): a supervisor-hosted target delivers over its
@@ -1359,7 +1377,7 @@ export async function routeSend(
       ok: true,
       delivered_to: { personality: target.value.personality, runtime: target.value.runtime },
       woke: false,
-      ts: new Date().toISOString(),
+      ts: sentAt,
     })
   }
 
@@ -1391,7 +1409,7 @@ export async function routeSend(
           ok: true,
           delivered_to: { personality: revived.value.personality, runtime: revived.value.runtime },
           woke: false,
-          ts: new Date().toISOString(),
+          ts: sentAt,
         })
       }
       // resolved but the deliver didn't land (session still settling) → keep polling
@@ -1427,7 +1445,7 @@ export async function routeSend(
   // a false ok:true — the class the contract forbids. A delivery failure here is
   // surfaced loudly (false-FAIL over false-OK).
   if (woke.taskDelivered === false) {
-    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: live.value, envelope, topic })
+    const queued = await deps.composerQueue?.tryEnqueue({ caller, peer, target: live.value, envelope, topic, sentAt })
     if (queued) return queued
     const delivered = await deliverWarm(live.value, envelope, peer.cwd, {}, env)
     if (!delivered.ok) return delivered
@@ -1436,7 +1454,7 @@ export async function routeSend(
       ok: true,
       delivered_to: { personality: live.value.personality, runtime: live.value.runtime },
       woke: false, // honest: this sender's envelope went the LIVE path, not a boot
-      ts: new Date().toISOString(),
+      ts: sentAt,
     })
   }
   // The envelope was delivered as the boot first-message during wake.
@@ -1444,6 +1462,6 @@ export async function routeSend(
     ok: true,
     delivered_to: { personality: live.value.personality, runtime: live.value.runtime },
     woke: true,
-    ts: new Date().toISOString(),
+    ts: sentAt,
   })
 }

package/src/tray/install.ts

@@ -486,9 +486,18 @@ export function trayAttachTerm(opts: {
 
 export interface TrayStatus {
   daemon: { fleet: boolean; version?: string; sock?: string; tcp?: string }
-  swiftbar: { installed: boolean; pluginDir?: string }
+  swiftbar: {
+    installed: boolean
+    pluginDir?: string
+    /** GROUND TRUTH of the menu-bar icon: AppKit persists NSStatusItem visibility per
+     *  autosaveName in SwiftBar's defaults (`NSStatusItem VisibleCC <plugin>`). false =
+     *  the icon is hidden RIGHT NOW (whatever hid it — a mid-chunk decode nil on an old
+     *  binary, a ⌘-drag removal); undefined = key absent / SwiftBar not installed. The
+     *  first thing to read when "the icon is gone" is reported — no screen needed. */
+    iconVisible?: boolean
+  }
   plugin: { installed: boolean; path?: string }
-  /** Login-autostart LaunchAgent: registered (our plist present) + its path. */
+  /** Tray-host supervisor LaunchAgent: registered (our plist present) + its path. */
   autostart: { registered: boolean; path?: string }
 }
 
@@ -503,9 +512,14 @@ export function trayStatus(opts: { env?: NodeJS.ProcessEnv; run?: Runner; probeA
   const found = searchDirs.map(d => join(d, PLUGIN_BASENAME)).find(f => existsSync(f))
   const autostartPath = swiftBarAutostartPlistPath(env)
   const autostartOurs = existsSync(autostartPath) && isFoundationOwnedPlist(autostartPath)
+  let iconVisible: boolean | undefined
+  if (installed) {
+    const r = run('defaults', ['read', SWIFTBAR_DOMAIN, `NSStatusItem VisibleCC ${PLUGIN_BASENAME}`])
+    if (r.status === 0) iconVisible = r.stdout.trim() === '1'
+  }
   return {
     daemon: { fleet: addr.fleet === 1, version: addr.version, sock: addr.sock, tcp: addr.tcp },
-    swiftbar: { installed, pluginDir: cfgDir },
+    swiftbar: { installed, pluginDir: cfgDir, iconVisible },
     plugin: { installed: Boolean(found), path: found },
     autostart: { registered: autostartOurs, path: autostartOurs ? autostartPath : undefined },
   }