@agfpd/iapeer 0.4.86 → 0.4.88

package/docs/09-runtimes.md

@@ -43,6 +43,8 @@ These are long-lived router processes, not AI. They run continuously under launc
 
 Infrastructure peers' plists, unlike the daemon's plist, are **loaded automatically** on `iapeer create --runtime telegram|notifier` and on `iapeer onboard` (unless `--no-bootstrap` is passed). So no separate `launchctl bootstrap` is needed for them.
 
+**Plist scheme (multi-infra).** One personality can carry several always-on channels (e.g. a human peer with both a Telegram bridge and a web console). Each (personality, runtime) pair resolves to its own launchd label: a **legacy base plist** `com.iapeer.<personality>` stays the channel of the runtime it already holds (no forced migration — existing single-channel hosts keep their plists untouched), while every new install gets the **per-runtime plist** `com.iapeer.<personality>.<runtime>`. Both channels are held by launchd KeepAlive simultaneously and independently; `stop`/`start <peer> <runtime>` bootout/bootstrap exactly that runtime's label, `remove` tears down **all** the personality's plists. The suffixed label can't collide with anything: peer names can't contain dots.
+
 ## Several runtimes on a peer
 
 A peer profile has two runtime fields: `runtimes` (all the peer can be present on) and `default_runtime` (the primary — where messages route and which comes up first). Extending the options and switching the primary runtime are different commands.

package/docs/ru/09-/321/200/320/260/320/275/321/202/320/260/320/271/320/274/321/213.md

@@ -43,6 +43,8 @@ iapeer codex      # в Codex
 
 Плисты инфраструктурных пиров, в отличие от плиста демона, **загружаются автоматически** при `iapeer create --runtime telegram|notifier` и при `iapeer onboard` (если не передан `--no-bootstrap`). Поэтому отдельный `launchctl bootstrap` для них не нужен.
 
+**Схема плистов (мульти-инфра).** Одна personality может нести несколько always-on каналов (например, человек с Telegram-мостом и веб-консолью одновременно). Каждая пара (personality, runtime) резолвится в собственный launchd-label: **легаси базовый плист** `com.iapeer.<personality>` остаётся каналом того рантайма, который он уже держит (без принудительной миграции — существующие одноканальные хосты не трогаются), а каждая новая установка получает **per-runtime плист** `com.iapeer.<personality>.<runtime>`. Оба канала держатся launchd KeepAlive одновременно и независимо; `stop`/`start <peer> <runtime>` делают bootout/bootstrap ровно label этого рантайма, `remove` сносит **все** плисты personality. Суффиксный label ни с чем не коллидирует: имена пиров не могут содержать точек.
+
 ## Несколько рантаймов у пира
 
 В профиле пира два поля про рантаймы: `runtimes` (все, на которых пир может присутствовать) и `default_runtime` (основной — куда маршрутизируются сообщения и какой поднимается первым). Расширить возможности и переключить основной рантайм — разные команды.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.86",
+  "version": "0.4.88",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -52,7 +52,12 @@ import {
 import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
-import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
+import {
+  cycleDaemon,
+  existingAlwaysOnPlists,
+  launchctlBootstrap,
+  resolveAlwaysOnTarget,
+} from '../launch/launchd.ts'
 import { readPeerProfile, renamePeer, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
 import { claudeProjectsRoot, transcriptSlug } from '../launch/adapters/claude.ts'
 import { peerProfilePath } from '../storage/index.ts'
@@ -206,9 +211,13 @@ function uid(): string {
 }
 
 /** FLEET GUARD: a peer launchd-managed by a NON-foundation plist (persistent-peer)
- *  is off-limits to stop/start — the foundation is read-only for it (H4). */
+ *  is off-limits to stop/start — the foundation is read-only for it (H4). Multi-infra
+ *  (0.4.88): the peer is foreign iff ANY of its existing template plists (legacy base
+ *  OR per-runtime suffixed) lacks the ownership sentinel. A personality whose only
+ *  plists are our suffixed ones must NOT read as foreign (the pre-multi-infra check
+ *  keyed on the base path alone, which is absent in that layout). */
 function isForeignLaunchd(personality: string, env: NodeJS.ProcessEnv): boolean {
-  return isLaunchdManaged(personality, env) && !isFoundationOwnedPlist(launchdPlistPath(personality, env))
+  return existingAlwaysOnPlists(personality, env).some(p => !p.foundationOwned)
 }
 
 function targetRuntimes(peer: PeerRecord, runtime: string | undefined): Runtime[] {
@@ -249,7 +258,13 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // stop: the desired state ("not running") already holds, so it carries NO reason
       // and must not fail the verb. Any other non-zero is a REAL error and sets reason
       // (the CLI maps a reasoned bootout to exit 1).
-      const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
+      // Multi-infra: bootout the label that ACTUALLY holds this (personality, runtime)
+      // channel — the legacy base or the per-runtime suffixed one (resolveAlwaysOnTarget,
+      // the same authority install uses). A runtime with no plist at all (manually-run
+      // session) resolves to its suffixed label → bootout exit 3 (benign) → killSession
+      // below still tears the session down.
+      const target = resolveAlwaysOnTarget(personality, rt, env)
+      const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${target.label}`], { encoding: 'utf8' })
       killSession(sock, identity, env)
       const stderrText = (r.stderr ?? '').trim()
       const benign = r.status === 0 || r.status === 3 || /No such process/i.test(stderrText)
@@ -295,7 +310,9 @@ export function startPeer(personality: string, runtime: string | undefined, opts
   for (const rt of targetRuntimes(peer, runtime)) {
     const identity = buildProcessAddress(rt, personality)
     if (isInfraRuntime(rt)) {
-      const plist = launchdPlistPath(personality, env)
+      // Multi-infra: load the plist that holds THIS (personality, runtime) channel
+      // (legacy base or per-runtime suffixed — the same resolution install/stop use).
+      const plist = resolveAlwaysOnTarget(personality, rt, env).path
       // UNDEAD-JOB-SAFE start: a bootstrap right after a bootout used to hit the
       // still-dismantling job (exit 5 I/O
       // error) and leave the router DOWN. launchctlBootstrap now waits for the
@@ -552,7 +569,7 @@ export async function newPeer(
       personality,
       runtime: rt,
       action: 'refused-infra',
-      reason: `infra runtime "${rt}" is launchd-held — restart it with: launchctl kickstart -k gui/$(id -u)/${launchdLabel(personality)}`,
+      reason: `infra runtime "${rt}" is launchd-held — restart it with: launchctl kickstart -k gui/$(id -u)/${resolveAlwaysOnTarget(personality, rt, env).label}`,
     }
   }
   const identity = buildProcessAddress(rt, personality)
@@ -785,25 +802,33 @@ export async function removePeerCli(
       }
       plistTeardown = 'skipped-foreign (H4 — foreign plist left intact; --force dropped only the registry record)'
     } else {
-      const plistPath = launchdPlistPath(personality, env)
-      // Sandbox/test: never invoke real launchctl (a test peer's label isn't a real job);
-      // still remove the (temp-dir) plist file so the teardown is observable.
-      let bootoutNote: string
-      if (env.IAPEER_TEST_SANDBOX === '1') {
-        bootoutNote = 'skipped-sandbox'
-      } else {
-        const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
-        // bootout exits non-zero when the job was already unloaded — benign for a teardown.
-        bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
-      }
-      let rmNote: string
-      try {
-        rmSync(plistPath, { force: true })
-        rmNote = ' + plist removed'
-      } catch (e) {
-        rmNote = ` (plist rm FAILED: ${e instanceof Error ? e.message : String(e)} — remove ${plistPath} manually)`
+      // Multi-infra (0.4.88): tear down EVERY foundation plist of the personality —
+      // the legacy base AND each per-runtime suffixed one (a two-channel peer like
+      // arthur telegram+web holds two). A forgotten plist would leave launchd
+      // KeepAlive crash-looping run-infra against the deleted record (the exact
+      // "remove must dismantle ALL artifacts" class).
+      const notes: string[] = []
+      for (const entry of existingAlwaysOnPlists(personality, env)) {
+        // Sandbox/test: never invoke real launchctl (a test peer's label isn't a real
+        // job); still remove the (temp-dir) plist file so the teardown is observable.
+        let bootoutNote: string
+        if (env.IAPEER_TEST_SANDBOX === '1') {
+          bootoutNote = 'skipped-sandbox'
+        } else {
+          const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${entry.label}`], { encoding: 'utf8' })
+          // bootout exits non-zero when the job was already unloaded — benign for a teardown.
+          bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
+        }
+        let rmNote: string
+        try {
+          rmSync(entry.path, { force: true })
+          rmNote = ' + plist removed'
+        } catch (e) {
+          rmNote = ` (plist rm FAILED: ${e instanceof Error ? e.message : String(e)} — remove ${entry.path} manually)`
+        }
+        notes.push(`${entry.label}: ${bootoutNote}${rmNote}`)
       }
-      plistTeardown = `${bootoutNote}${rmNote}`
+      plistTeardown = notes.join('; ')
     }
   }
   await removePeer(personality, { env })

package/src/codec/index.ts

@@ -1,10 +1,20 @@
-// IAP envelope codec — encoder + decoder, both halves in one module.
+// IAP envelope codec — wire encoder + read-both decoder + agent-facing render.
 //
-// Encoder: inter-agent-protocol/src/lib/preamble.ts buildEnvelope (wins as-is).
-// Decoder: telegram-runtime/src/cli.ts parseIapEnvelope/extractIapEnvelopes,
-//   rewritten CDATA-AWARE (blueprint-v2 codec-fixes) so that an envelope whose
-//   message contains `</iap>`, `</message>`, `]]>` or a literal CR round-trips
-//   by FIELD-semantic equivalence, not byte-equality.
+// Three halves (envelope-compaction F, 0.4.86):
+//   buildEnvelope          → the WIRE form (legacy attr names, always-CDATA, full-ISO ts) —
+//                            what bridges parse and durable stores hold; never slims.
+//   decodeEnvelope         → READ-BOTH (legacy + compact names, <message>/<msg>, ts),
+//                            CDATA-AWARE so a body containing `</iap>`, `</message>`,
+//                            `]]>` or a literal CR round-trips by FIELD-semantic
+//                            equivalence, not byte-equality.
+//   renderEnvelopeForAgent → the compact presentation for LLM-context hops (bottom).
+//
+// Historic origin: encoder from inter-agent-protocol preamble.ts; decoder from
+// telegram-runtime parseIapEnvelope/extractIapEnvelopes. The sibling runtimes run
+// their own copies of the decoder, SYNCED to this canon 14.07.2026 (telegram-runtime
+// 0.26.0, notifier-runtime 0.3.6, voicetalk-runtime 0.1.1 — anchored attrValue, В37/В38,
+// read-both); a decoder-behavior change here should be mirrored there (or flagged to
+// their implementers). The wire form stays compatible with all of them regardless.
 //
 // Deliberately NO CR→LF fold here. The old telegram decoder did
 // `xml.replace(/\r\n?/g, '\n')` to repair tmux paste (which rewrites LF→CR).
@@ -45,19 +55,20 @@ export interface EnvelopeInput {
   message: string
 }
 
+const pad2 = (n: number): string => String(n).padStart(2, '0')
+
 /** Format a Date as ISO-8601 LOCAL time with numeric offset, second precision:
  *  `2026-07-14T01:23:45+03:00`. Local (not UTC-Z) on purpose: the fleet's agents
  *  compare envelope timestamps against their LOCAL statusline clock — a Z-form
  *  invites silent off-by-offset misreads by an LLM reader. */
 export function formatSentAt(date: Date): string {
-  const pad = (n: number): string => String(n).padStart(2, '0')
   const offMin = -date.getTimezoneOffset() // minutes EAST of UTC
   const sign = offMin >= 0 ? '+' : '-'
   const abs = Math.abs(offMin)
   return (
-    `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}` +
-    `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}` +
-    `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`
+    `${date.getFullYear()}-${pad2(date.getMonth() + 1)}-${pad2(date.getDate())}` +
+    `T${pad2(date.getHours())}:${pad2(date.getMinutes())}:${pad2(date.getSeconds())}` +
+    `${sign}${pad2(Math.floor(abs / 60))}:${pad2(abs % 60)}`
   )
 }
 
@@ -351,11 +362,10 @@ function presentBody(value: string): string {
 function renderTsForAgent(sentAt: string, now: Date): string {
   const d = new Date(sentAt)
   if (Number.isNaN(d.getTime())) return sentAt
-  const pad = (n: number): string => String(n).padStart(2, '0')
-  const time = `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`
+  const time = `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`
   const sameLocalDay =
     d.getFullYear() === now.getFullYear() && d.getMonth() === now.getMonth() && d.getDate() === now.getDate()
-  return sameLocalDay ? time : `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${time}`
+  return sameLocalDay ? time : `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${time}`
 }
 
 /**

package/src/core/constants.ts

@@ -89,11 +89,18 @@ export function isIntelligenceAllowedForRuntime(runtime: string, intelligence: I
 // Infra runtimes are ALWAYS-ON (held live by launchd KeepAlive), as opposed to the
 // warm-on-demand agentic runtimes (claude/codex, woken by the daemon). Liveness is
 // a property of the RUNTIME, not the personality (zone Идентичность). Infra runtimes
-// are routers hosted by the pty supervisor: telegram/voicetalk carry a human channel
-// (inbound messages / voice), notifier receives send_to_peer(timer|watcher, …)
-// registration/live-reload — outbound to each is deliverHosted → the child's stdin.
+// are routers hosted by the pty supervisor: telegram/voicetalk/web carry a human
+// channel (inbound messages / voice / browser console), notifier receives
+// send_to_peer(timer|watcher, …) registration/live-reload — outbound to each is
+// deliverHosted → the child's stdin.
 // This set gates always-on launchd plist generation (src/launch/launchd.ts).
-const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk'])
+const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk', 'web'])
+
+/** The infra runtimes as a list — for callers that must ENUMERATE the always-on
+ *  plist candidates of a personality (H4 detector, remove teardown, update
+ *  re-cycle walk the per-runtime plist scheme `com.iapeer.<p>.<rt>.plist`).
+ *  Same membership as isInfraRuntime — single source, they cannot drift. */
+export const INFRA_RUNTIME_LIST: readonly string[] = [...INFRA_RUNTIMES]
 
 export function isInfraRuntime(runtime: string): boolean {
   return INFRA_RUNTIMES.has(runtime)
@@ -111,6 +118,7 @@ export const INFRA_RUNTIME_BIN_ENV: Readonly<Record<string, string>> = {
   notifier: 'NOTIFIER_RUNTIME_BIN',
   telegram: 'TELEGRAM_RUNTIME_BIN',
   voicetalk: 'VOICETALK_RUNTIME_BIN',
+  web: 'WEB_RUNTIME_BIN',
 }
 
 /** The PATH-resolvable default launcher name per infra runtime (when no abs path
@@ -120,6 +128,7 @@ export const INFRA_RUNTIME_DEFAULT_BIN: Readonly<Record<string, string>> = {
   notifier: 'notifier-runtime',
   telegram: 'telegram-runtime',
   voicetalk: 'voicetalk-runtime',
+  web: 'web-runtime',
 }
 
 // codex MCP token-free import (contract Установка §codex MCP). codex REFUSES to import

package/src/identity/index.ts

@@ -623,6 +623,12 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
   // and leaves no half-updated profile. Idempotent for our own (sentinel) plist.
   let intelligence = existing.intelligence
   if (isInfraRuntime(options.runtime)) {
+    // MULTI-INFRA (0.4.88): installAlwaysOnPlist resolves the per-(personality,
+    // runtime) target itself — the legacy base plist when it already carries this
+    // runtime, else the suffixed `com.iapeer.<p>.<rt>`. A second infra channel
+    // (arthur: telegram, now declaring web) therefore gets its OWN plist and the
+    // first channel's plist is untouched — the 0.4.87 declare-without-plist bridge
+    // (manual `run-infra` bring-up) is retired.
     installAlwaysOnPlist({
       personality: existing.personality,
       runtime: options.runtime,

package/src/init/index.ts

@@ -30,7 +30,7 @@ import {
 } from '../storage/index.ts'
 import { provisionPeer, type ProvisionResult } from '../provision/index.ts'
 import { claudeSettingsPath } from '../launch/nativeMemory.ts'
-import { launchctlBootstrap, launchdPlistPath, type BootstrapResult } from '../launch/launchd.ts'
+import { launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
 import { runtimeSelfConfig, type SelfConfigResult } from '../runtime/index.ts'
 import type { Intelligence } from '../core/constants.ts'
 
@@ -568,7 +568,14 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
     } else if (opts.bootstrap !== false) {
       // (2) AUTO-bootstrap (contract Фаза §5): load the plist NOW instead of
       //     write-and-wait. Fleet-safe / idempotent / sandbox-skipped inside.
-      bootstrapped = launchctlBootstrap(provisioned.personality, launchdPlistPath(provisioned.personality, env), env)
+      // Multi-infra: load the plist provision actually installed for THIS runtime
+      // (legacy base or per-runtime suffixed — resolveAlwaysOnTarget is stable
+      // post-install, so this is the same file installAlwaysOnPlist wrote).
+      bootstrapped = launchctlBootstrap(
+        provisioned.personality,
+        resolveAlwaysOnTarget(provisioned.personality, provisioned.runtime, env).path,
+        env,
+      )
       if (bootstrapped.state === 'failed' || bootstrapped.state === 'refused-foreign') {
         opts.warn?.(`bootstrap ${bootstrapped.state}: ${bootstrapped.detail ?? ''}`)
       }

package/src/launch/adapters/web.ts

@@ -0,0 +1,107 @@
+// web RuntimeAdapter — the "HOW to launch / observe ONE web session" half of the
+// launch contract (src/launch/types.ts). Like telegram/voicetalk, web is a
+// long-running ROUTER (`web-runtime run`: the owner's browser fleet-console —
+// local HTTP/WebSocket server the browser client connects to → IAP envelopes to
+// the fleet; <iap>-marked stdin → rendered into the console chat), NOT an LLM TUI.
+// So kind:'router' tells launch.launch to SKIP every TUI phase — no pane boot
+// dialog, no ready-marker, no first-user-turn delivery, no activity-proxy
+// ready-gate, no permission modal, no transcript to resume. The pane predicates
+// below are therefore trivial constants, present only to satisfy the frozen
+// interface.
+//
+// web is a presence-runtime for a HUMAN (the owner's browser console), modelled on
+// telegram/voicetalk per the foundation presence-runtime contract: kind:'router',
+// usesDoctrine:false, allowedIntelligences:['natural','absent'], argv = `<bin> run
+// <extra>`. The server/client mechanics (port, tunnel, auth) live in the
+// @agfpd/web-runtime package, NOT in this adapter and NOT interpreted by the
+// foundation — interfaces.web (if the package declares one) is opaque here.
+//
+// NO sender-guard for web (the voicetalk precedent): telegramSenderGuard is
+// telegram-specific (the bridge picks the SENDING bot from the sender's
+// bot_username); web is a single local owner endpoint — the console renders the
+// sender from the envelope's `from`, so any peer may write to it freely.
+//
+// NO currency on this path: no marketplace check, no plugin install/update — that
+// is install-time (the package self-deploys its runtime.json manifest), not
+// session bring-up.
+
+import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import { allowedIntelligencesForRuntime } from '../../core/constants.ts'
+
+// ─────────────────────────────────────────────────────────────────────────────
+// webAdapter
+// ─────────────────────────────────────────────────────────────────────────────
+
+export const webAdapter: RuntimeAdapter = {
+  runtime: 'web',
+  kind: 'router',
+  usesDoctrine: false,
+
+  /** No submit surface — a router takes no bracketed-paste-then-Enter turn; delivery
+   *  is deliverHosted → child stdin (<iap> reader), not submitIntoTui. Empty glyphs. */
+  deliveryMarkers: { promptGlyphs: [] },
+
+  /**
+   * web carries a HUMAN (natural) OR a FACELESS SERVICE bot (absent) — never an LLM
+   * agent (artificial), which would route the owner's console channel to an agent/script.
+   * Same nature gate as telegram/voicetalk, sourced from the single Ф0 truth
+   * (allowedIntelligencesForRuntime); enforced by the launch primitive against
+   * LaunchSpec.intelligence. Source → docs/Идентичность.
+   */
+  allowedIntelligences: allowedIntelligencesForRuntime('web'),
+
+  /**
+   * argv = webBin + 'run' + extraArgs.
+   *   - cfg.webBin ?? 'web-runtime'  the launch binary (the always-on plist pins an
+   *     absolute path via WEB_RUNTIME_BIN — launchd-minimal PATH; here we defer to
+   *     cfg.webBin when set, else emit the PATH-resolvable literal for launch.launch
+   *     to resolve).
+   *   - 'run'  the router subcommand: brings up the console server (browser client ↔
+   *     fleet) and pumps IAP envelopes both directions through the session's stdio
+   *     (outbound <iap> stdin → console chat; inbound browser input → fleet via the
+   *     daemon send_to_peer).
+   *   - ...extraArgs  LaunchSpec.extraArgs passthrough.
+   *
+   * NO --system-prompt-file: usesDoctrine:false — a router is not an LLM, no doctrine to
+   * merge. NO --resume: a router has no transcript. NO currency on this path.
+   */
+  buildArgv(spec: LaunchSpec, cfg: LaunchAdapterConfig): string[] {
+    return [cfg.webBin ?? 'web-runtime', 'run', ...(spec.extraArgs ?? [])]
+  },
+
+  /** No startup dialogs — a router has no pane TUI to answer. launch.launch skips the
+   *  boot phase for kind:'router', so this is never consulted; null = "no dialog". */
+  bootDialogKeys(_pane: string): string[] | null {
+    return null
+  },
+
+  /** Always ready: a router has no input surface waiting for a first message — it is
+   *  "up" the instant `web-runtime run` is launched. launch.launch skips the
+   *  ready-gate for kind:'router'; true = "nothing to wait for". */
+  isInputReady(_pane: string): boolean {
+    return true
+  },
+
+  /** No activity proxy: a router writes no transcript/session jsonl to mtime as a
+   *  ready-gate or idle signal. launch.launch skips the activity-proxy gate for a
+   *  router; null per the contract ("null for a router (no proxy)"). */
+  newestActivityMtime(_cwd: string): number | null {
+    return null
+  },
+
+  lastTurnMtime(_cwd: string): number | null {
+    return null // router — no transcript
+  },
+
+  /** Nothing to resume: a router does not replay a transcript, so resume cannot
+   *  fail-loud the way claude/codex do. Always {ok:true}. */
+  resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {
+    return { ok: true }
+  },
+
+  /** No in-session control: a router has no TUI turn to interrupt/compact. null for
+   *  every command → the daemon/CLI surfaces an explicit "unsupported" refusal. */
+  executeControl(_command: ControlCommand): ControlPlan | null {
+    return null
+  },
+}

package/src/launch/index.ts

@@ -24,6 +24,7 @@ import { codexAdapter } from './adapters/codex.ts'
 import { telegramAdapter } from './adapters/telegram.ts'
 import { notifierAdapter } from './adapters/notifier.ts'
 import { voicetalkAdapter } from './adapters/voicetalk.ts'
+import { webAdapter } from './adapters/web.ts'
 import type {
   LaunchConfig,
   LaunchFn,
@@ -54,8 +55,11 @@ export {
   launchdLabel,
   launchAgentsDir,
   launchdPlistPath,
+  resolveAlwaysOnTarget,
+  existingAlwaysOnPlists,
   renderLaunchdPlist,
   installAlwaysOnPlist,
+  installedPlistRuntime,
   isFoundationOwnedPlist,
   launchctlBootstrap,
   bootstrapJobCore,
@@ -67,6 +71,8 @@ export {
   IAPEER_PLIST_OWNER_KEY,
 } from './launchd.ts'
 export type {
+  AlwaysOnTarget,
+  PeerPlistEntry,
   LaunchdPlistSpec,
   InstallAlwaysOnPlistOptions,
   BootstrapResult,
@@ -90,6 +96,7 @@ export function getAdapter(runtime: Runtime): RuntimeAdapter {
   if (runtime === 'telegram') return telegramAdapter
   if (runtime === 'notifier') return notifierAdapter
   if (runtime === 'voicetalk') return voicetalkAdapter
+  if (runtime === 'web') return webAdapter
   throw new Error(`no launch adapter for runtime "${runtime}"`)
 }
 

package/src/launch/launchd.ts

@@ -23,6 +23,7 @@ import {
   IAPEER_DIR,
   INFRA_RUNTIME_BIN_ENV,
   INFRA_RUNTIME_DEFAULT_BIN,
+  INFRA_RUNTIME_LIST,
   LAUNCHD_LABEL_PREFIX,
   isInfraRuntime,
   type Runtime,
@@ -81,6 +82,20 @@ function readPlistEnvVar(path: string, key: string): string | undefined {
   }
 }
 
+/**
+ * The PEER_RUNTIME baked into the personality's EXISTING foundation-owned BASE
+ * always-on plist (`com.iapeer.<p>.plist` — the legacy default channel), or
+ * undefined when there is no base plist / it is foreign-owned / it carries no
+ * runtime. This is the "who occupies the base label" probe resolveAlwaysOnTarget
+ * builds on: the base stays that runtime's channel (no forced migration), every
+ * other runtime resolves to its per-runtime suffixed plist.
+ */
+export function installedPlistRuntime(personality: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const path = launchdPlistPath(personality, env)
+  if (!existsSync(path) || !isFoundationOwnedPlist(path)) return undefined
+  return readPlistEnvVar(path, 'PEER_RUNTIME')
+}
+
 /**
  * Resolve an executable to an ABSOLUTE path against `env.PATH` (the RICH
  * provisioning PATH), so the result can be baked into a launchd plist whose own
@@ -122,6 +137,93 @@ export function launchdPlistPath(personality: string, env: NodeJS.ProcessEnv = p
   return join(launchAgentsDir(env), `${launchdLabel(personality)}.plist`)
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// MULTI-INFRA plist scheme — per-(personality, runtime) resolution
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface AlwaysOnTarget {
+  /** The launchd Label — also the plist basename stem. */
+  label: string
+  /** The plist path under launchAgentsDir. */
+  path: string
+  /** Which scheme resolved: the legacy one-per-personality base plist
+   *  (`com.iapeer.<p>`) or the per-runtime suffixed one (`com.iapeer.<p>.<rt>`). */
+  scheme: 'legacy-base' | 'per-runtime'
+}
+
+/**
+ * Resolve the always-on plist TARGET for one (personality, runtime) pair — the
+ * single scheme authority every side shares (install / stop / start / remove /
+ * update re-cycle), so the writer and the operators can never disagree on which
+ * label holds which channel.
+ *
+ * Resolution: the LEGACY base plist (`com.iapeer.<p>`) is the personality's
+ * default channel — it is the target iff it EXISTS, is foundation-owned and
+ * carries THIS runtime (its baked PEER_RUNTIME matches). Every other case —
+ * base absent, base occupied by another infra runtime, base foreign — resolves
+ * to the per-runtime label `com.iapeer.<p>.<rt>`. So a legacy single-infra host
+ * keeps its base plists untouched (no forced migration), while every NEW install
+ * (and every second channel of a personality) gets its own plist and the two
+ * channels can be KeepAlive simultaneously.
+ *
+ * The suffixed label is structurally collision-free: NAME_RE forbids '.' in
+ * personalities and RUNTIME_RE forbids it in runtimes, so `com.iapeer.<p>.<rt>`
+ * can never spell another personality's base label (and the persistent-peer
+ * fleet only ever uses base-shaped labels).
+ *
+ * Resolution is STABLE across install→bootstrap→stop/start: installing a
+ * suffixed plist never flips a later resolve (the base check looks at the base
+ * file only), and re-resolving after an install sees the same target.
+ */
+export function resolveAlwaysOnTarget(
+  personality: string,
+  runtime: string,
+  env: NodeJS.ProcessEnv = process.env,
+): AlwaysOnTarget {
+  if (installedPlistRuntime(personality, env) === runtime) {
+    return { label: launchdLabel(personality), path: launchdPlistPath(personality, env), scheme: 'legacy-base' }
+  }
+  const label = `${launchdLabel(personality)}.${runtime}`
+  return { label, path: join(launchAgentsDir(env), `${label}.plist`), scheme: 'per-runtime' }
+}
+
+export interface PeerPlistEntry {
+  label: string
+  path: string
+  /** The runtime the plist holds: the base plist's baked PEER_RUNTIME (undefined
+   *  when unreadable/foreign), or the suffix of a per-runtime plist. */
+  runtime?: string
+  foundationOwned: boolean
+}
+
+/**
+ * Every EXISTING always-on plist of a personality under the foundation TEMPLATE
+ * scheme: the base `com.iapeer.<p>.plist` (legacy default channel — also the shape
+ * a foreign persistent-peer plist takes) plus the suffixed `com.iapeer.<p>.<rt>.plist`
+ * for each known infra runtime. The enumerator for personality-wide operations:
+ * the H4 detector mirror, remove's full teardown, and the update re-cycle.
+ */
+export function existingAlwaysOnPlists(personality: string, env: NodeJS.ProcessEnv = process.env): PeerPlistEntry[] {
+  const out: PeerPlistEntry[] = []
+  const basePath = launchdPlistPath(personality, env)
+  if (existsSync(basePath)) {
+    out.push({
+      label: launchdLabel(personality),
+      path: basePath,
+      runtime: readPlistEnvVar(basePath, 'PEER_RUNTIME'),
+      foundationOwned: isFoundationOwnedPlist(basePath),
+    })
+  }
+  for (const rt of INFRA_RUNTIME_LIST) {
+    const label = `${launchdLabel(personality)}.${rt}`
+    const path = join(launchAgentsDir(env), `${label}.plist`)
+    if (existsSync(path)) {
+      out.push({ label, path, runtime: rt, foundationOwned: isFoundationOwnedPlist(path) })
+    }
+  }
+  return out
+}
+
 // XML-escape a plist <string> text node. cwd / personality / PATH can carry '&',
 // '<', '>' (or unicode) — a literal '&' or '<' would corrupt the XML, so escape the
 // three significant characters. Also DROP XML-1.0-illegal control characters (NUL +
@@ -524,12 +626,17 @@ export function launchctlBootstrap(
   plistPath: string,
   env: NodeJS.ProcessEnv = process.env,
 ): BootstrapResult {
-  const label = launchdLabel(personality)
+  // The label is the plist BASENAME stem — true for BOTH schemes (legacy base
+  // `com.iapeer.<p>.plist` and per-runtime `com.iapeer.<p>.<rt>.plist`), and the
+  // single derivation that cannot drift from the file actually being loaded.
+  // (Deriving from `personality` alone would mis-label a per-runtime plist.)
+  const base = plistPath.slice(plistPath.lastIndexOf('/') + 1)
+  const label = base.endsWith('.plist') ? base.slice(0, -'.plist'.length) : launchdLabel(personality)
   if (!isFoundationOwnedPlist(plistPath)) {
     return {
       state: 'refused-foreign',
       label,
-      detail: `${plistPath} is not foundation-owned (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — refusing to launchctl bootstrap a foreign plist`,
+      detail: `${plistPath} (peer "${personality}") is not foundation-owned (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — refusing to launchctl bootstrap a foreign plist`,
     }
   }
   // SANDBOX FAIL-CLOSED: `launchctl bootstrap gui/<uid>` is HOST-GLOBAL — it loads a
@@ -585,18 +692,24 @@ export interface InstallAlwaysOnPlistOptions {
  * entrypoint with PEER_* env + WorkingDirectory=cwd; logs land under
  * <cwd>/.iapeer/logs/<runtime>/.
  *
- * COLLISION GUARD (H4 — shared label namespace): the launchd Label is
- * com.iapeer.<personality> — keyed on PERSONALITY, not identity, and SHARED with the
+ * LABEL SCHEME (multi-infra, 0.4.88): the target label/path come from
+ * resolveAlwaysOnTarget — the legacy base `com.iapeer.<personality>` when that plist
+ * already carries this runtime (default channel, no forced migration), else the
+ * per-runtime `com.iapeer.<personality>.<runtime>`. Two infra channels of one
+ * personality (e.g. arthur: telegram + web) therefore hold two separate KeepAlive
+ * plists and never clobber each other.
+ *
+ * COLLISION GUARD (H4 — shared label namespace): the BASE label is SHARED with the
  * already-deployed persistent-peer fleet (~/Library/LaunchAgents/
  * com.iapeer.<persistent-peer>.plist run by start.sh). A personality collision (a
- * notifier peer named like a live PP peer) must NOT silently overwrite that foreign
- * plist — doing so would tear a live PP peer off launchd. So before writing we
- * REFUSE when a plist already sits at the target and is not foundation-owned
- * (isFoundationOwnedPlist: it lacks the sentinel renderLaunchdPlist embeds). The
- * label prefix alone cannot tell ours from theirs (PP is com.iapeer.* too); the
- * sentinel can. Re-installing our OWN plist (sentinel present) is allowed
- * (idempotent re-provision). The guard is checked FIRST, before any mkdir/write, so
- * a refusal leaves the filesystem untouched.
+ * notifier peer named like a live PP peer) must NOT put a second manager on that
+ * name — so we REFUSE when the base plist exists and is not foundation-owned
+ * (isFoundationOwnedPlist: it lacks the sentinel renderLaunchdPlist embeds), and
+ * equally refuse a foreign file squatting the resolved per-runtime path. The label
+ * prefix alone cannot tell ours from theirs (PP is com.iapeer.* too); the sentinel
+ * can. Re-installing our OWN plist (sentinel present) is allowed (idempotent
+ * re-provision). The guards run FIRST, before any mkdir/write, so a refusal leaves
+ * the filesystem untouched.
  */
 export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string {
   if (!isInfraRuntime(opts.runtime)) {
@@ -605,13 +718,33 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     )
   }
   const env = opts.env ?? process.env
-  // Collision guard FIRST — never clobber a plist the foundation does not own.
-  const path = launchdPlistPath(opts.personality, env)
+  // PERSONALITY COLLISION GUARD FIRST — never touch a personality whose BASE label is
+  // owned by a foreign manager (the live persistent-peer fleet writes base-shaped
+  // com.iapeer.<p> plists). Even though a second channel would land on the suffixed
+  // label, installing ANY foundation plist for a foreign-managed personality would
+  // put two managers on one peer name — refuse before any write.
+  const basePath = launchdPlistPath(opts.personality, env)
+  if (existsSync(basePath) && !isFoundationOwnedPlist(basePath)) {
+    throw new IapError(
+      `refusing to install an always-on plist for "${opts.personality}": label ` +
+        `${launchdLabel(opts.personality)} is not foundation-managed (no ${IAPEER_PLIST_OWNER_KEY} ` +
+        `sentinel) — a persistent-peer or other manager owns it; rename the peer to avoid ` +
+        `the com.iapeer.<personality> collision`,
+    )
+  }
+  // MULTI-INFRA (per-runtime plists): resolve the (personality, runtime) target —
+  // the legacy base plist iff it already carries THIS runtime (default channel, no
+  // forced migration), else the suffixed com.iapeer.<p>.<rt>. A second infra runtime
+  // therefore gets its OWN plist and can be KeepAlive alongside the first channel —
+  // the pre-0.4.88 fail-loud "one plist per personality" refusal is retired.
+  const target = resolveAlwaysOnTarget(opts.personality, opts.runtime, env)
+  const path = target.path
+  // Belt for the suffixed path too: a hand-planted foreign file at our per-runtime
+  // label is never clobbered (same sentinel rule as the base guard above).
   if (existsSync(path) && !isFoundationOwnedPlist(path)) {
     throw new IapError(
-      `refusing to overwrite launchd plist ${path}: label ${launchdLabel(opts.personality)} ` +
-        `is not foundation-managed (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — a persistent-peer ` +
-        `or other manager owns it; rename the peer to avoid the com.iapeer.<personality> collision`,
+      `refusing to overwrite launchd plist ${path}: it exists but is not foundation-managed ` +
+        `(no ${IAPEER_PLIST_OWNER_KEY} sentinel) — remove or rename the foreign file first`,
     )
   }
   // GLOBAL infra logs (Фаза §8): ~/.iapeer/logs/<personality>/, NOT per-peer
@@ -662,7 +795,7 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     if (fallback) environment.NOTIFIER_FALLBACK_TARGET = fallback
   }
   const spec: LaunchdPlistSpec = {
-    label: launchdLabel(opts.personality),
+    label: target.label,
     programArguments: [...(opts.entrypointArgv ?? defaultEntrypointArgv(env)), opts.personality, opts.runtime],
     workingDirectory: opts.cwd,
     environment,

package/src/launch/launchdRun.ts

@@ -97,6 +97,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     telegramBin: env[INFRA_RUNTIME_BIN_ENV.telegram],
     notifierBin: env[INFRA_RUNTIME_BIN_ENV.notifier],
     voicetalkBin: env[INFRA_RUNTIME_BIN_ENV.voicetalk],
+    webBin: env[INFRA_RUNTIME_BIN_ENV.web],
     sockDir,
     bootDeadlineSecs: 30,
     readyGateSecs: 30,

package/src/launch/types.ts

@@ -141,6 +141,8 @@ export interface LaunchAdapterConfig {
   notifierBin?: string
   /** voicetalk-runtime launch binary (router runtime, infra/always-on — the owner's voice channel). */
   voicetalkBin?: string
+  /** web-runtime launch binary (router runtime, infra/always-on — the owner's browser fleet-console). */
+  webBin?: string
 }
 
 export interface LaunchSpec {

package/src/lifecycle/index.ts

@@ -18,6 +18,7 @@ import { join } from 'path'
 import { spawnSync } from 'child_process'
 import * as lockfile from 'proper-lockfile'
 import {
+  INFRA_RUNTIME_LIST,
   STATE_DIR,
   LOGS_DIR,
   isRuntime,
@@ -131,18 +132,26 @@ export function loadLifecycleConfig(env: NodeJS.ProcessEnv = process.env): Lifec
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * True iff the peer is launchd-managed: `~/Library/LaunchAgents/
- * com.iapeer.<personality>.plist` exists. A launchd peer is in the launchd
- * domain — KeepAlive owns its lifecycle — and the daemon must be READ-ONLY for
- * it (deliver to it if live, but never wake / reap / respawn / sweep it). This
- * is the hard guard against fighting launchd on the live fleet.
+ * True iff the peer is launchd-managed: ANY foundation-template always-on plist
+ * of the personality exists under ~/Library/LaunchAgents — the legacy base
+ * `com.iapeer.<personality>.plist` (also the shape a foreign persistent-peer
+ * plist takes) OR a per-runtime `com.iapeer.<personality>.<runtime>.plist`
+ * (multi-infra, 0.4.88). A launchd peer is in the launchd domain — KeepAlive
+ * owns its lifecycle — and the daemon must be READ-ONLY for it (deliver to it
+ * if live, but never wake / reap / respawn / sweep it). This is the hard guard
+ * against fighting launchd on the live fleet. H4 stays PERSONALITY-scoped: one
+ * launchd-held channel marks the whole peer launchd-owned, same as before.
  */
 export function isLaunchdManaged(personality: string, env: NodeJS.ProcessEnv = process.env): boolean {
   // Label + LaunchAgents dir come from the SAME helpers the plist generator uses
   // (launch/launchd.ts), so this H4 detector and installAlwaysOnPlist can never
-  // disagree on `com.iapeer.<personality>.plist`. IAPEER_LAUNCHAGENTS_DIR overrides
-  // the dir for tests (so an H4-guard test never touches ~/Library/LaunchAgents).
-  return existsSync(join(launchAgentsDir(env), `${launchdLabel(personality)}.plist`))
+  // disagree on the scheme. The per-runtime candidates are enumerated from
+  // INFRA_RUNTIME_LIST (the same set that gates plist generation) — cheap
+  // existsSync probes, no file reads, since this runs on every route/sweep.
+  // IAPEER_LAUNCHAGENTS_DIR overrides the dir for tests.
+  const dir = launchAgentsDir(env)
+  if (existsSync(join(dir, `${launchdLabel(personality)}.plist`))) return true
+  return INFRA_RUNTIME_LIST.some(rt => existsSync(join(dir, `${launchdLabel(personality)}.${rt}.plist`)))
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1320,10 +1329,17 @@ interface SuperviseCtx {
  */
 function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
   const { cfg, env, nowMs, lastTurnMt, childActivityMt, isAlive, kill, verbose, trace } = ctx
-  // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
+  // H4 — FIRST, before any reap. A launchd-managed peer is read-only: never wake,
+  // never kill, never sweep its PROCESS. Its stale `.session` however is the
+  // DAEMON'S own supervisory record (written back when the peer was daemon-owned),
+  // not the peer's — a peer that moved under launchd would otherwise re-enter this
+  // skip on every tick forever (follow-up 09.06: latent garbage, not a delivery
+  // bug). Drop the record once; if the plist is ever removed again, the next wake
+  // recreates it.
   if (isLaunchdManaged(s.personality, env)) {
-    if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
-    return { identity: s.identity, action: 'skipped-launchd' }
+    removeSessionState(cfg, s.identity)
+    if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4-stale-state-dropped' })
+    return { identity: s.identity, action: 'skipped-launchd', reason: 'launchd-managed; stale daemon .session dropped' }
   }
   const sock = buildSocketPath(s.runtime, s.personality, cfg.sockDir)
   if (!isAlive(sock, s.identity)) {

package/src/provision/index.ts

@@ -24,7 +24,7 @@ import { IapError } from '../core/errors.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import { ensurePeerProfile } from '../identity/index.ts'
 import { readPeersIndex, upsertPeer } from '../registry/index.ts'
-import { launchdPlistPath, resolveExecutable } from '../launch/launchd.ts'
+import { resolveAlwaysOnTarget, resolveExecutable } from '../launch/launchd.ts'
 
 export interface ProvisionPeerOptions {
   /** The peer's working directory. personality defaults to normalized basename. */
@@ -222,7 +222,10 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
     cwd,
     profilePath: peerProfilePath(cwd),
     intelligence: opts.intelligence ?? profile.intelligence,
-    plistPath: isInfraRuntime(opts.runtime) ? launchdPlistPath(profile.personality, env) : undefined,
+    // Multi-infra: the plist ensurePeerProfile actually installed for THIS runtime
+    // (legacy base or per-runtime suffixed) — resolveAlwaysOnTarget re-resolves to
+    // the same target the install used (resolution is stable once the file exists).
+    plistPath: isInfraRuntime(opts.runtime) ? resolveAlwaysOnTarget(profile.personality, opts.runtime, env).path : undefined,
     runtimeBin,
   }
 }

package/src/runtime/deploy.ts

@@ -33,6 +33,7 @@ export const RUNTIME_PACKAGES: Readonly<Record<string, string>> = {
   telegram: '@agfpd/telegram-runtime',
   notifier: '@agfpd/notifier-runtime',
   voicetalk: '@agfpd/voicetalk-runtime',
+  web: '@agfpd/web-runtime',
 }
 
 /** Resolve the npm package for a runtime: explicit override wins, else the built-in

package/src/transport/index.ts

@@ -308,11 +308,13 @@ async function deliverViaHost(
   // codex took the socket-ack short-circuit above). A bare transcript/pane-log mtime BUMP is NOT proof
   // the session took THIS message: a receiver in an active turn advances both mtimes with its OWN
   // rendering even when our paste was swallowed at the turn boundary (incident 2026-06-23: ok=true,
-  // message gone). The ONLY proof is a NEW transcript record CARRYING our envelope — for claude, a
-  // queue-operation `content` (busy → enqueued) or the user-turn message (idle), written sub-second so
-  // a short grace covers it. The receiver's own assistant/tool turn never reproduces the
-  // `<iap from-personality=…>` wrapper, so it cannot forge a confirm. No such record within the grace →
-  // false-FAIL (the sender retries) — NOT a false-OK (silent loss the contract forbids).
+  // message gone). The ONLY proof is a NEW transcript record CARRYING the DELIVERED payload (for an
+  // agent target that is the compact `<iap from=…>` presentation — deliverWarm rendered it before this
+  // point, so the needle matches what was actually pasted) — for claude, a queue-operation `content`
+  // (busy → enqueued) or the user-turn message (idle), written sub-second so a short grace covers it.
+  // The receiver's own assistant/tool turn never reproduces the full delivered envelope verbatim, so it
+  // cannot forge a confirm. No such record within the grace → false-FAIL (the sender retries) — NOT a
+  // false-OK (silent loss the contract forbids).
   const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload, { env }))
   const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
   const graceMs = confirmGraceMs()

package/src/update/index.ts

@@ -42,8 +42,7 @@ import {
   cycleDaemon,
   cycleLaunchdJob,
   isFoundationOwnedPlist,
-  launchdLabel,
-  launchdPlistPath,
+  resolveAlwaysOnTarget,
   type DaemonRestartResult,
   type LaunchdJobCycleResult,
 } from '../launch/launchd.ts'
@@ -261,13 +260,18 @@ export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process
   const out: InfraJobRecycleResult[] = []
   const index = readPeersIndex({ env })
   for (const peer of index.peers) {
-    const runtime = (isInfraRuntime(peer.runtime) ? peer.runtime : peer.runtimes.find(isInfraRuntime)) ?? ''
-    if (!runtime) continue
-    const plist = launchdPlistPath(peer.personality, env)
-    if (!isFoundationOwnedPlist(plist)) continue
-    const label = launchdLabel(peer.personality)
-    const r = cycleLaunchdJob(label, plist, env)
-    out.push({ personality: peer.personality, runtime, label, state: r.state, detail: r.detail })
+    // Multi-infra (0.4.88): a personality can hold SEVERAL always-on channels
+    // (e.g. arthur: telegram on the legacy base plist + web on the per-runtime
+    // one) — re-cycle EVERY declared infra runtime's job, not just the first.
+    // resolveAlwaysOnTarget is the same scheme authority install/stop/start use;
+    // an absent plist reads as not-foundation-owned → skipped.
+    const infraRuntimes = [...new Set([peer.runtime, ...peer.runtimes])].filter(isInfraRuntime)
+    for (const runtime of infraRuntimes) {
+      const target = resolveAlwaysOnTarget(peer.personality, runtime, env)
+      if (!isFoundationOwnedPlist(target.path)) continue
+      const r = cycleLaunchdJob(target.label, target.path, env)
+      out.push({ personality: peer.personality, runtime, label: target.label, state: r.state, detail: r.detail })
+    }
   }
   return out
 }