@agfpd/iapeer 0.4.87 → 0.4.88

package/docs/09-runtimes.md

@@ -43,6 +43,8 @@ These are long-lived router processes, not AI. They run continuously under launc
 
 Infrastructure peers' plists, unlike the daemon's plist, are **loaded automatically** on `iapeer create --runtime telegram|notifier` and on `iapeer onboard` (unless `--no-bootstrap` is passed). So no separate `launchctl bootstrap` is needed for them.
 
+**Plist scheme (multi-infra).** One personality can carry several always-on channels (e.g. a human peer with both a Telegram bridge and a web console). Each (personality, runtime) pair resolves to its own launchd label: a **legacy base plist** `com.iapeer.<personality>` stays the channel of the runtime it already holds (no forced migration — existing single-channel hosts keep their plists untouched), while every new install gets the **per-runtime plist** `com.iapeer.<personality>.<runtime>`. Both channels are held by launchd KeepAlive simultaneously and independently; `stop`/`start <peer> <runtime>` bootout/bootstrap exactly that runtime's label, `remove` tears down **all** the personality's plists. The suffixed label can't collide with anything: peer names can't contain dots.
+
 ## Several runtimes on a peer
 
 A peer profile has two runtime fields: `runtimes` (all the peer can be present on) and `default_runtime` (the primary — where messages route and which comes up first). Extending the options and switching the primary runtime are different commands.

package/docs/ru/09-/321/200/320/260/320/275/321/202/320/260/320/271/320/274/321/213.md

@@ -43,6 +43,8 @@ iapeer codex      # в Codex
 
 Плисты инфраструктурных пиров, в отличие от плиста демона, **загружаются автоматически** при `iapeer create --runtime telegram|notifier` и при `iapeer onboard` (если не передан `--no-bootstrap`). Поэтому отдельный `launchctl bootstrap` для них не нужен.
 
+**Схема плистов (мульти-инфра).** Одна personality может нести несколько always-on каналов (например, человек с Telegram-мостом и веб-консолью одновременно). Каждая пара (personality, runtime) резолвится в собственный launchd-label: **легаси базовый плист** `com.iapeer.<personality>` остаётся каналом того рантайма, который он уже держит (без принудительной миграции — существующие одноканальные хосты не трогаются), а каждая новая установка получает **per-runtime плист** `com.iapeer.<personality>.<runtime>`. Оба канала держатся launchd KeepAlive одновременно и независимо; `stop`/`start <peer> <runtime>` делают bootout/bootstrap ровно label этого рантайма, `remove` сносит **все** плисты personality. Суффиксный label ни с чем не коллидирует: имена пиров не могут содержать точек.
+
 ## Несколько рантаймов у пира
 
 В профиле пира два поля про рантаймы: `runtimes` (все, на которых пир может присутствовать) и `default_runtime` (основной — куда маршрутизируются сообщения и какой поднимается первым). Расширить возможности и переключить основной рантайм — разные команды.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.87",
+  "version": "0.4.88",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/cli/index.ts

@@ -52,7 +52,12 @@ import {
 import { getAdapter } from '../launch/index.ts'
 import { hostRunDir } from '../launch/ptyHost.ts' // pty-only: attach via the supervisor client
 import { runSupervisorClient } from '../supervisor/client.ts' // @xterm-free attach client (both reattach port-deps baked in)
-import { cycleDaemon, isFoundationOwnedPlist, launchctlBootstrap, launchdLabel, launchdPlistPath } from '../launch/launchd.ts'
+import {
+  cycleDaemon,
+  existingAlwaysOnPlists,
+  launchctlBootstrap,
+  resolveAlwaysOnTarget,
+} from '../launch/launchd.ts'
 import { readPeerProfile, renamePeer, resolveCallerIdentity, resolveIdentity, writePeerProfileAtomic } from '../identity/index.ts'
 import { claudeProjectsRoot, transcriptSlug } from '../launch/adapters/claude.ts'
 import { peerProfilePath } from '../storage/index.ts'
@@ -206,9 +211,13 @@ function uid(): string {
 }
 
 /** FLEET GUARD: a peer launchd-managed by a NON-foundation plist (persistent-peer)
- *  is off-limits to stop/start — the foundation is read-only for it (H4). */
+ *  is off-limits to stop/start — the foundation is read-only for it (H4). Multi-infra
+ *  (0.4.88): the peer is foreign iff ANY of its existing template plists (legacy base
+ *  OR per-runtime suffixed) lacks the ownership sentinel. A personality whose only
+ *  plists are our suffixed ones must NOT read as foreign (the pre-multi-infra check
+ *  keyed on the base path alone, which is absent in that layout). */
 function isForeignLaunchd(personality: string, env: NodeJS.ProcessEnv): boolean {
-  return isLaunchdManaged(personality, env) && !isFoundationOwnedPlist(launchdPlistPath(personality, env))
+  return existingAlwaysOnPlists(personality, env).some(p => !p.foundationOwned)
 }
 
 function targetRuntimes(peer: PeerRecord, runtime: string | undefined): Runtime[] {
@@ -249,7 +258,13 @@ export function stopPeer(personality: string, runtime: string | undefined, opts:
       // stop: the desired state ("not running") already holds, so it carries NO reason
       // and must not fail the verb. Any other non-zero is a REAL error and sets reason
       // (the CLI maps a reasoned bootout to exit 1).
-      const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
+      // Multi-infra: bootout the label that ACTUALLY holds this (personality, runtime)
+      // channel — the legacy base or the per-runtime suffixed one (resolveAlwaysOnTarget,
+      // the same authority install uses). A runtime with no plist at all (manually-run
+      // session) resolves to its suffixed label → bootout exit 3 (benign) → killSession
+      // below still tears the session down.
+      const target = resolveAlwaysOnTarget(personality, rt, env)
+      const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${target.label}`], { encoding: 'utf8' })
       killSession(sock, identity, env)
       const stderrText = (r.stderr ?? '').trim()
       const benign = r.status === 0 || r.status === 3 || /No such process/i.test(stderrText)
@@ -295,7 +310,9 @@ export function startPeer(personality: string, runtime: string | undefined, opts
   for (const rt of targetRuntimes(peer, runtime)) {
     const identity = buildProcessAddress(rt, personality)
     if (isInfraRuntime(rt)) {
-      const plist = launchdPlistPath(personality, env)
+      // Multi-infra: load the plist that holds THIS (personality, runtime) channel
+      // (legacy base or per-runtime suffixed — the same resolution install/stop use).
+      const plist = resolveAlwaysOnTarget(personality, rt, env).path
       // UNDEAD-JOB-SAFE start: a bootstrap right after a bootout used to hit the
       // still-dismantling job (exit 5 I/O
       // error) and leave the router DOWN. launchctlBootstrap now waits for the
@@ -552,7 +569,7 @@ export async function newPeer(
       personality,
       runtime: rt,
       action: 'refused-infra',
-      reason: `infra runtime "${rt}" is launchd-held — restart it with: launchctl kickstart -k gui/$(id -u)/${launchdLabel(personality)}`,
+      reason: `infra runtime "${rt}" is launchd-held — restart it with: launchctl kickstart -k gui/$(id -u)/${resolveAlwaysOnTarget(personality, rt, env).label}`,
     }
   }
   const identity = buildProcessAddress(rt, personality)
@@ -785,25 +802,33 @@ export async function removePeerCli(
       }
       plistTeardown = 'skipped-foreign (H4 — foreign plist left intact; --force dropped only the registry record)'
     } else {
-      const plistPath = launchdPlistPath(personality, env)
-      // Sandbox/test: never invoke real launchctl (a test peer's label isn't a real job);
-      // still remove the (temp-dir) plist file so the teardown is observable.
-      let bootoutNote: string
-      if (env.IAPEER_TEST_SANDBOX === '1') {
-        bootoutNote = 'skipped-sandbox'
-      } else {
-        const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${launchdLabel(personality)}`], { encoding: 'utf8' })
-        // bootout exits non-zero when the job was already unloaded — benign for a teardown.
-        bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
-      }
-      let rmNote: string
-      try {
-        rmSync(plistPath, { force: true })
-        rmNote = ' + plist removed'
-      } catch (e) {
-        rmNote = ` (plist rm FAILED: ${e instanceof Error ? e.message : String(e)} — remove ${plistPath} manually)`
+      // Multi-infra (0.4.88): tear down EVERY foundation plist of the personality —
+      // the legacy base AND each per-runtime suffixed one (a two-channel peer like
+      // arthur telegram+web holds two). A forgotten plist would leave launchd
+      // KeepAlive crash-looping run-infra against the deleted record (the exact
+      // "remove must dismantle ALL artifacts" class).
+      const notes: string[] = []
+      for (const entry of existingAlwaysOnPlists(personality, env)) {
+        // Sandbox/test: never invoke real launchctl (a test peer's label isn't a real
+        // job); still remove the (temp-dir) plist file so the teardown is observable.
+        let bootoutNote: string
+        if (env.IAPEER_TEST_SANDBOX === '1') {
+          bootoutNote = 'skipped-sandbox'
+        } else {
+          const r = spawnSync('launchctl', ['bootout', `gui/${uid()}/${entry.label}`], { encoding: 'utf8' })
+          // bootout exits non-zero when the job was already unloaded — benign for a teardown.
+          bootoutNote = r.status === 0 ? 'bootout' : `bootout (exit ${r.status}${(r.stderr ?? '').trim() ? `: ${(r.stderr ?? '').trim()}` : ''})`
+        }
+        let rmNote: string
+        try {
+          rmSync(entry.path, { force: true })
+          rmNote = ' + plist removed'
+        } catch (e) {
+          rmNote = ` (plist rm FAILED: ${e instanceof Error ? e.message : String(e)} — remove ${entry.path} manually)`
+        }
+        notes.push(`${entry.label}: ${bootoutNote}${rmNote}`)
       }
-      plistTeardown = `${bootoutNote}${rmNote}`
+      plistTeardown = notes.join('; ')
     }
   }
   await removePeer(personality, { env })

package/src/core/constants.ts

@@ -96,6 +96,12 @@ export function isIntelligenceAllowedForRuntime(runtime: string, intelligence: I
 // This set gates always-on launchd plist generation (src/launch/launchd.ts).
 const INFRA_RUNTIMES = new Set(['notifier', 'telegram', 'voicetalk', 'web'])
 
+/** The infra runtimes as a list — for callers that must ENUMERATE the always-on
+ *  plist candidates of a personality (H4 detector, remove teardown, update
+ *  re-cycle walk the per-runtime plist scheme `com.iapeer.<p>.<rt>.plist`).
+ *  Same membership as isInfraRuntime — single source, they cannot drift. */
+export const INFRA_RUNTIME_LIST: readonly string[] = [...INFRA_RUNTIMES]
+
 export function isInfraRuntime(runtime: string): boolean {
   return INFRA_RUNTIMES.has(runtime)
 }

package/src/identity/index.ts

@@ -26,7 +26,7 @@ import {
 // KeepAlive, so creating one installs its always-on plist. Imported from the
 // launchd module directly (not the launch barrel) to keep the dependency surface
 // minimal — launchd.ts pulls only core/*, so identity → launch introduces no cycle.
-import { installAlwaysOnPlist, installedPlistRuntime } from '../launch/launchd.ts'
+import { installAlwaysOnPlist } from '../launch/launchd.ts'
 import { buildProcessAddress } from '../core/socket.ts'
 import { IapError } from '../core/errors.ts'
 import {
@@ -623,30 +623,19 @@ export function ensurePeerProfile(options: EnsurePeerProfileOptions): PeerProfil
   // and leaves no half-updated profile. Idempotent for our own (sentinel) plist.
   let intelligence = existing.intelligence
   if (isInfraRuntime(options.runtime)) {
-    // MULTI-INFRA BRIDGE: the always-on plist scheme is ONE per personality, so when the
-    // personality's plist is already OCCUPIED by ANOTHER infra runtime (arthur: telegram,
-    // now declaring web), installing here would clobber the live channel — and the
-    // installAlwaysOnPlist collision guard would fail the whole declaration. Instead:
-    // DECLARE the runtime (runtimes += <rt> below — identity `<rt>-<p>` resolves, delivery
-    // to a LIVE hosted session works) but leave the first channel's plist untouched. The
-    // new runtime's session is NOT launchd-owned until per-runtime plists (multi-infra)
-    // land — bring it up manually via `iapeer run-infra <p> <rt>` meanwhile.
-    const occupied = installedPlistRuntime(existing.personality, options.env)
-    if (occupied && occupied !== options.runtime) {
-      options.warn?.(
-        `always-on plist for "${existing.personality}" already holds runtime "${occupied}" — ` +
-          `"${options.runtime}" is DECLARED but gets no launchd plist (one plist per personality); ` +
-          `until per-runtime plists land, bring the session up manually: iapeer run-infra ${existing.personality} ${options.runtime}`,
-      )
-    } else {
-      installAlwaysOnPlist({
-        personality: existing.personality,
-        runtime: options.runtime,
-        cwd,
-        runtimeBin: options.runtimeBin,
-        env: options.env,
-      })
-    }
+    // MULTI-INFRA (0.4.88): installAlwaysOnPlist resolves the per-(personality,
+    // runtime) target itself — the legacy base plist when it already carries this
+    // runtime, else the suffixed `com.iapeer.<p>.<rt>`. A second infra channel
+    // (arthur: telegram, now declaring web) therefore gets its OWN plist and the
+    // first channel's plist is untouched — the 0.4.87 declare-without-plist bridge
+    // (manual `run-infra` bring-up) is retired.
+    installAlwaysOnPlist({
+      personality: existing.personality,
+      runtime: options.runtime,
+      cwd,
+      runtimeBin: options.runtimeBin,
+      env: options.env,
+    })
     // Re-provision honors an EXPLICIT nature (a manifest-declared absent service bot survives
     // update-runtime re-provision), else the runtime default (the legacy vocab-flip this fix
     // preserved). resolvedIntelligence validates the explicit against the runtime's allowed set.

package/src/init/index.ts

@@ -30,7 +30,7 @@ import {
 } from '../storage/index.ts'
 import { provisionPeer, type ProvisionResult } from '../provision/index.ts'
 import { claudeSettingsPath } from '../launch/nativeMemory.ts'
-import { launchctlBootstrap, launchdPlistPath, type BootstrapResult } from '../launch/launchd.ts'
+import { launchctlBootstrap, resolveAlwaysOnTarget, type BootstrapResult } from '../launch/launchd.ts'
 import { runtimeSelfConfig, type SelfConfigResult } from '../runtime/index.ts'
 import type { Intelligence } from '../core/constants.ts'
 
@@ -568,7 +568,14 @@ export async function initPeer(opts: InitPeerOptions): Promise<InitPeerResult> {
     } else if (opts.bootstrap !== false) {
       // (2) AUTO-bootstrap (contract Фаза §5): load the plist NOW instead of
       //     write-and-wait. Fleet-safe / idempotent / sandbox-skipped inside.
-      bootstrapped = launchctlBootstrap(provisioned.personality, launchdPlistPath(provisioned.personality, env), env)
+      // Multi-infra: load the plist provision actually installed for THIS runtime
+      // (legacy base or per-runtime suffixed — resolveAlwaysOnTarget is stable
+      // post-install, so this is the same file installAlwaysOnPlist wrote).
+      bootstrapped = launchctlBootstrap(
+        provisioned.personality,
+        resolveAlwaysOnTarget(provisioned.personality, provisioned.runtime, env).path,
+        env,
+      )
       if (bootstrapped.state === 'failed' || bootstrapped.state === 'refused-foreign') {
         opts.warn?.(`bootstrap ${bootstrapped.state}: ${bootstrapped.detail ?? ''}`)
       }

package/src/launch/index.ts

@@ -55,6 +55,8 @@ export {
   launchdLabel,
   launchAgentsDir,
   launchdPlistPath,
+  resolveAlwaysOnTarget,
+  existingAlwaysOnPlists,
   renderLaunchdPlist,
   installAlwaysOnPlist,
   installedPlistRuntime,
@@ -69,6 +71,8 @@ export {
   IAPEER_PLIST_OWNER_KEY,
 } from './launchd.ts'
 export type {
+  AlwaysOnTarget,
+  PeerPlistEntry,
   LaunchdPlistSpec,
   InstallAlwaysOnPlistOptions,
   BootstrapResult,

package/src/launch/launchd.ts

@@ -23,6 +23,7 @@ import {
   IAPEER_DIR,
   INFRA_RUNTIME_BIN_ENV,
   INFRA_RUNTIME_DEFAULT_BIN,
+  INFRA_RUNTIME_LIST,
   LAUNCHD_LABEL_PREFIX,
   isInfraRuntime,
   type Runtime,
@@ -82,12 +83,12 @@ function readPlistEnvVar(path: string, key: string): string | undefined {
 }
 
 /**
- * The PEER_RUNTIME baked into the personality's EXISTING foundation-owned always-on
- * plist, or undefined when there is no plist / it is foreign-owned / it carries no
- * runtime. The plist scheme is ONE per personality (`com.iapeer.<p>.plist` — the
- * runtime rides only in ProgramArguments/env), so this is how a caller detects that
- * the personality's always-on slot is already OCCUPIED by another infra runtime
- * (e.g. arthur's telegram) before asking for a second one (multi-infra collision).
+ * The PEER_RUNTIME baked into the personality's EXISTING foundation-owned BASE
+ * always-on plist (`com.iapeer.<p>.plist` — the legacy default channel), or
+ * undefined when there is no base plist / it is foreign-owned / it carries no
+ * runtime. This is the "who occupies the base label" probe resolveAlwaysOnTarget
+ * builds on: the base stays that runtime's channel (no forced migration), every
+ * other runtime resolves to its per-runtime suffixed plist.
  */
 export function installedPlistRuntime(personality: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
   const path = launchdPlistPath(personality, env)
@@ -136,6 +137,93 @@ export function launchdPlistPath(personality: string, env: NodeJS.ProcessEnv = p
   return join(launchAgentsDir(env), `${launchdLabel(personality)}.plist`)
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// MULTI-INFRA plist scheme — per-(personality, runtime) resolution
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface AlwaysOnTarget {
+  /** The launchd Label — also the plist basename stem. */
+  label: string
+  /** The plist path under launchAgentsDir. */
+  path: string
+  /** Which scheme resolved: the legacy one-per-personality base plist
+   *  (`com.iapeer.<p>`) or the per-runtime suffixed one (`com.iapeer.<p>.<rt>`). */
+  scheme: 'legacy-base' | 'per-runtime'
+}
+
+/**
+ * Resolve the always-on plist TARGET for one (personality, runtime) pair — the
+ * single scheme authority every side shares (install / stop / start / remove /
+ * update re-cycle), so the writer and the operators can never disagree on which
+ * label holds which channel.
+ *
+ * Resolution: the LEGACY base plist (`com.iapeer.<p>`) is the personality's
+ * default channel — it is the target iff it EXISTS, is foundation-owned and
+ * carries THIS runtime (its baked PEER_RUNTIME matches). Every other case —
+ * base absent, base occupied by another infra runtime, base foreign — resolves
+ * to the per-runtime label `com.iapeer.<p>.<rt>`. So a legacy single-infra host
+ * keeps its base plists untouched (no forced migration), while every NEW install
+ * (and every second channel of a personality) gets its own plist and the two
+ * channels can be KeepAlive simultaneously.
+ *
+ * The suffixed label is structurally collision-free: NAME_RE forbids '.' in
+ * personalities and RUNTIME_RE forbids it in runtimes, so `com.iapeer.<p>.<rt>`
+ * can never spell another personality's base label (and the persistent-peer
+ * fleet only ever uses base-shaped labels).
+ *
+ * Resolution is STABLE across install→bootstrap→stop/start: installing a
+ * suffixed plist never flips a later resolve (the base check looks at the base
+ * file only), and re-resolving after an install sees the same target.
+ */
+export function resolveAlwaysOnTarget(
+  personality: string,
+  runtime: string,
+  env: NodeJS.ProcessEnv = process.env,
+): AlwaysOnTarget {
+  if (installedPlistRuntime(personality, env) === runtime) {
+    return { label: launchdLabel(personality), path: launchdPlistPath(personality, env), scheme: 'legacy-base' }
+  }
+  const label = `${launchdLabel(personality)}.${runtime}`
+  return { label, path: join(launchAgentsDir(env), `${label}.plist`), scheme: 'per-runtime' }
+}
+
+export interface PeerPlistEntry {
+  label: string
+  path: string
+  /** The runtime the plist holds: the base plist's baked PEER_RUNTIME (undefined
+   *  when unreadable/foreign), or the suffix of a per-runtime plist. */
+  runtime?: string
+  foundationOwned: boolean
+}
+
+/**
+ * Every EXISTING always-on plist of a personality under the foundation TEMPLATE
+ * scheme: the base `com.iapeer.<p>.plist` (legacy default channel — also the shape
+ * a foreign persistent-peer plist takes) plus the suffixed `com.iapeer.<p>.<rt>.plist`
+ * for each known infra runtime. The enumerator for personality-wide operations:
+ * the H4 detector mirror, remove's full teardown, and the update re-cycle.
+ */
+export function existingAlwaysOnPlists(personality: string, env: NodeJS.ProcessEnv = process.env): PeerPlistEntry[] {
+  const out: PeerPlistEntry[] = []
+  const basePath = launchdPlistPath(personality, env)
+  if (existsSync(basePath)) {
+    out.push({
+      label: launchdLabel(personality),
+      path: basePath,
+      runtime: readPlistEnvVar(basePath, 'PEER_RUNTIME'),
+      foundationOwned: isFoundationOwnedPlist(basePath),
+    })
+  }
+  for (const rt of INFRA_RUNTIME_LIST) {
+    const label = `${launchdLabel(personality)}.${rt}`
+    const path = join(launchAgentsDir(env), `${label}.plist`)
+    if (existsSync(path)) {
+      out.push({ label, path, runtime: rt, foundationOwned: isFoundationOwnedPlist(path) })
+    }
+  }
+  return out
+}
+
 // XML-escape a plist <string> text node. cwd / personality / PATH can carry '&',
 // '<', '>' (or unicode) — a literal '&' or '<' would corrupt the XML, so escape the
 // three significant characters. Also DROP XML-1.0-illegal control characters (NUL +
@@ -538,12 +626,17 @@ export function launchctlBootstrap(
   plistPath: string,
   env: NodeJS.ProcessEnv = process.env,
 ): BootstrapResult {
-  const label = launchdLabel(personality)
+  // The label is the plist BASENAME stem — true for BOTH schemes (legacy base
+  // `com.iapeer.<p>.plist` and per-runtime `com.iapeer.<p>.<rt>.plist`), and the
+  // single derivation that cannot drift from the file actually being loaded.
+  // (Deriving from `personality` alone would mis-label a per-runtime plist.)
+  const base = plistPath.slice(plistPath.lastIndexOf('/') + 1)
+  const label = base.endsWith('.plist') ? base.slice(0, -'.plist'.length) : launchdLabel(personality)
   if (!isFoundationOwnedPlist(plistPath)) {
     return {
       state: 'refused-foreign',
       label,
-      detail: `${plistPath} is not foundation-owned (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — refusing to launchctl bootstrap a foreign plist`,
+      detail: `${plistPath} (peer "${personality}") is not foundation-owned (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — refusing to launchctl bootstrap a foreign plist`,
     }
   }
   // SANDBOX FAIL-CLOSED: `launchctl bootstrap gui/<uid>` is HOST-GLOBAL — it loads a
@@ -599,18 +692,24 @@ export interface InstallAlwaysOnPlistOptions {
  * entrypoint with PEER_* env + WorkingDirectory=cwd; logs land under
  * <cwd>/.iapeer/logs/<runtime>/.
  *
- * COLLISION GUARD (H4 — shared label namespace): the launchd Label is
- * com.iapeer.<personality> — keyed on PERSONALITY, not identity, and SHARED with the
+ * LABEL SCHEME (multi-infra, 0.4.88): the target label/path come from
+ * resolveAlwaysOnTarget — the legacy base `com.iapeer.<personality>` when that plist
+ * already carries this runtime (default channel, no forced migration), else the
+ * per-runtime `com.iapeer.<personality>.<runtime>`. Two infra channels of one
+ * personality (e.g. arthur: telegram + web) therefore hold two separate KeepAlive
+ * plists and never clobber each other.
+ *
+ * COLLISION GUARD (H4 — shared label namespace): the BASE label is SHARED with the
  * already-deployed persistent-peer fleet (~/Library/LaunchAgents/
  * com.iapeer.<persistent-peer>.plist run by start.sh). A personality collision (a
- * notifier peer named like a live PP peer) must NOT silently overwrite that foreign
- * plist — doing so would tear a live PP peer off launchd. So before writing we
- * REFUSE when a plist already sits at the target and is not foundation-owned
- * (isFoundationOwnedPlist: it lacks the sentinel renderLaunchdPlist embeds). The
- * label prefix alone cannot tell ours from theirs (PP is com.iapeer.* too); the
- * sentinel can. Re-installing our OWN plist (sentinel present) is allowed
- * (idempotent re-provision). The guard is checked FIRST, before any mkdir/write, so
- * a refusal leaves the filesystem untouched.
+ * notifier peer named like a live PP peer) must NOT put a second manager on that
+ * name — so we REFUSE when the base plist exists and is not foundation-owned
+ * (isFoundationOwnedPlist: it lacks the sentinel renderLaunchdPlist embeds), and
+ * equally refuse a foreign file squatting the resolved per-runtime path. The label
+ * prefix alone cannot tell ours from theirs (PP is com.iapeer.* too); the sentinel
+ * can. Re-installing our OWN plist (sentinel present) is allowed (idempotent
+ * re-provision). The guards run FIRST, before any mkdir/write, so a refusal leaves
+ * the filesystem untouched.
  */
 export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string {
   if (!isInfraRuntime(opts.runtime)) {
@@ -619,29 +718,33 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     )
   }
   const env = opts.env ?? process.env
-  // Collision guard FIRST — never clobber a plist the foundation does not own.
-  const path = launchdPlistPath(opts.personality, env)
-  if (existsSync(path) && !isFoundationOwnedPlist(path)) {
+  // PERSONALITY COLLISION GUARD FIRST — never touch a personality whose BASE label is
+  // owned by a foreign manager (the live persistent-peer fleet writes base-shaped
+  // com.iapeer.<p> plists). Even though a second channel would land on the suffixed
+  // label, installing ANY foundation plist for a foreign-managed personality would
+  // put two managers on one peer name — refuse before any write.
+  const basePath = launchdPlistPath(opts.personality, env)
+  if (existsSync(basePath) && !isFoundationOwnedPlist(basePath)) {
     throw new IapError(
-      `refusing to overwrite launchd plist ${path}: label ${launchdLabel(opts.personality)} ` +
-        `is not foundation-managed (no ${IAPEER_PLIST_OWNER_KEY} sentinel) — a persistent-peer ` +
-        `or other manager owns it; rename the peer to avoid the com.iapeer.<personality> collision`,
+      `refusing to install an always-on plist for "${opts.personality}": label ` +
+        `${launchdLabel(opts.personality)} is not foundation-managed (no ${IAPEER_PLIST_OWNER_KEY} ` +
+        `sentinel) — a persistent-peer or other manager owns it; rename the peer to avoid ` +
+        `the com.iapeer.<personality> collision`,
     )
   }
-  // MULTI-INFRA COLLISION GUARD (fail-loud, never a silent clobber): the plist scheme
-  // is ONE per personality, so installing a SECOND infra runtime for the same
-  // personality would OVERWRITE the first channel's plist (e.g. web over arthur's
-  // telegram) and kill that channel on the next bootout/reboot. Refuse loudly until
-  // per-runtime plists (multi-infra) land. A deliberate runtime SWITCH is an operator
-  // act: `iapeer stop <p>` + delete the plist, then re-provision.
-  const bakedRuntime = existsSync(path) ? readPlistEnvVar(path, 'PEER_RUNTIME') : undefined
-  if (bakedRuntime && bakedRuntime !== opts.runtime) {
+  // MULTI-INFRA (per-runtime plists): resolve the (personality, runtime) target —
+  // the legacy base plist iff it already carries THIS runtime (default channel, no
+  // forced migration), else the suffixed com.iapeer.<p>.<rt>. A second infra runtime
+  // therefore gets its OWN plist and can be KeepAlive alongside the first channel —
+  // the pre-0.4.88 fail-loud "one plist per personality" refusal is retired.
+  const target = resolveAlwaysOnTarget(opts.personality, opts.runtime, env)
+  const path = target.path
+  // Belt for the suffixed path too: a hand-planted foreign file at our per-runtime
+  // label is never clobbered (same sentinel rule as the base guard above).
+  if (existsSync(path) && !isFoundationOwnedPlist(path)) {
     throw new IapError(
-      `refusing to overwrite launchd plist ${path}: it already holds the always-on ` +
-        `"${bakedRuntime}" session for "${opts.personality}" (the plist scheme is one per ` +
-        `personality) — installing "${opts.runtime}" here would silently kill that channel. ` +
-        `Multi-infra per personality needs per-runtime plists (not yet supported); for a ` +
-        `deliberate runtime switch: iapeer stop ${opts.personality}, delete the plist, re-provision.`,
+      `refusing to overwrite launchd plist ${path}: it exists but is not foundation-managed ` +
+        `(no ${IAPEER_PLIST_OWNER_KEY} sentinel) — remove or rename the foreign file first`,
     )
   }
   // GLOBAL infra logs (Фаза §8): ~/.iapeer/logs/<personality>/, NOT per-peer
@@ -692,7 +795,7 @@ export function installAlwaysOnPlist(opts: InstallAlwaysOnPlistOptions): string
     if (fallback) environment.NOTIFIER_FALLBACK_TARGET = fallback
   }
   const spec: LaunchdPlistSpec = {
-    label: launchdLabel(opts.personality),
+    label: target.label,
     programArguments: [...(opts.entrypointArgv ?? defaultEntrypointArgv(env)), opts.personality, opts.runtime],
     workingDirectory: opts.cwd,
     environment,

package/src/lifecycle/index.ts

@@ -18,6 +18,7 @@ import { join } from 'path'
 import { spawnSync } from 'child_process'
 import * as lockfile from 'proper-lockfile'
 import {
+  INFRA_RUNTIME_LIST,
   STATE_DIR,
   LOGS_DIR,
   isRuntime,
@@ -131,18 +132,26 @@ export function loadLifecycleConfig(env: NodeJS.ProcessEnv = process.env): Lifec
 // ─────────────────────────────────────────────────────────────────────────────
 
 /**
- * True iff the peer is launchd-managed: `~/Library/LaunchAgents/
- * com.iapeer.<personality>.plist` exists. A launchd peer is in the launchd
- * domain — KeepAlive owns its lifecycle — and the daemon must be READ-ONLY for
- * it (deliver to it if live, but never wake / reap / respawn / sweep it). This
- * is the hard guard against fighting launchd on the live fleet.
+ * True iff the peer is launchd-managed: ANY foundation-template always-on plist
+ * of the personality exists under ~/Library/LaunchAgents — the legacy base
+ * `com.iapeer.<personality>.plist` (also the shape a foreign persistent-peer
+ * plist takes) OR a per-runtime `com.iapeer.<personality>.<runtime>.plist`
+ * (multi-infra, 0.4.88). A launchd peer is in the launchd domain — KeepAlive
+ * owns its lifecycle — and the daemon must be READ-ONLY for it (deliver to it
+ * if live, but never wake / reap / respawn / sweep it). This is the hard guard
+ * against fighting launchd on the live fleet. H4 stays PERSONALITY-scoped: one
+ * launchd-held channel marks the whole peer launchd-owned, same as before.
  */
 export function isLaunchdManaged(personality: string, env: NodeJS.ProcessEnv = process.env): boolean {
   // Label + LaunchAgents dir come from the SAME helpers the plist generator uses
   // (launch/launchd.ts), so this H4 detector and installAlwaysOnPlist can never
-  // disagree on `com.iapeer.<personality>.plist`. IAPEER_LAUNCHAGENTS_DIR overrides
-  // the dir for tests (so an H4-guard test never touches ~/Library/LaunchAgents).
-  return existsSync(join(launchAgentsDir(env), `${launchdLabel(personality)}.plist`))
+  // disagree on the scheme. The per-runtime candidates are enumerated from
+  // INFRA_RUNTIME_LIST (the same set that gates plist generation) — cheap
+  // existsSync probes, no file reads, since this runs on every route/sweep.
+  // IAPEER_LAUNCHAGENTS_DIR overrides the dir for tests.
+  const dir = launchAgentsDir(env)
+  if (existsSync(join(dir, `${launchdLabel(personality)}.plist`))) return true
+  return INFRA_RUNTIME_LIST.some(rt => existsSync(join(dir, `${launchdLabel(personality)}.${rt}.plist`)))
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/provision/index.ts

@@ -24,7 +24,7 @@ import { IapError } from '../core/errors.ts'
 import { peerProfilePath } from '../storage/index.ts'
 import { ensurePeerProfile } from '../identity/index.ts'
 import { readPeersIndex, upsertPeer } from '../registry/index.ts'
-import { launchdPlistPath, resolveExecutable } from '../launch/launchd.ts'
+import { resolveAlwaysOnTarget, resolveExecutable } from '../launch/launchd.ts'
 
 export interface ProvisionPeerOptions {
   /** The peer's working directory. personality defaults to normalized basename. */
@@ -222,7 +222,10 @@ export async function provisionPeer(opts: ProvisionPeerOptions): Promise<Provisi
     cwd,
     profilePath: peerProfilePath(cwd),
     intelligence: opts.intelligence ?? profile.intelligence,
-    plistPath: isInfraRuntime(opts.runtime) ? launchdPlistPath(profile.personality, env) : undefined,
+    // Multi-infra: the plist ensurePeerProfile actually installed for THIS runtime
+    // (legacy base or per-runtime suffixed) — resolveAlwaysOnTarget re-resolves to
+    // the same target the install used (resolution is stable once the file exists).
+    plistPath: isInfraRuntime(opts.runtime) ? resolveAlwaysOnTarget(profile.personality, opts.runtime, env).path : undefined,
     runtimeBin,
   }
 }

package/src/update/index.ts

@@ -42,8 +42,7 @@ import {
   cycleDaemon,
   cycleLaunchdJob,
   isFoundationOwnedPlist,
-  launchdLabel,
-  launchdPlistPath,
+  resolveAlwaysOnTarget,
   type DaemonRestartResult,
   type LaunchdJobCycleResult,
 } from '../launch/launchd.ts'
@@ -261,13 +260,18 @@ export function recycleFoundationOwnedInfraJobs(env: NodeJS.ProcessEnv = process
   const out: InfraJobRecycleResult[] = []
   const index = readPeersIndex({ env })
   for (const peer of index.peers) {
-    const runtime = (isInfraRuntime(peer.runtime) ? peer.runtime : peer.runtimes.find(isInfraRuntime)) ?? ''
-    if (!runtime) continue
-    const plist = launchdPlistPath(peer.personality, env)
-    if (!isFoundationOwnedPlist(plist)) continue
-    const label = launchdLabel(peer.personality)
-    const r = cycleLaunchdJob(label, plist, env)
-    out.push({ personality: peer.personality, runtime, label, state: r.state, detail: r.detail })
+    // Multi-infra (0.4.88): a personality can hold SEVERAL always-on channels
+    // (e.g. arthur: telegram on the legacy base plist + web on the per-runtime
+    // one) — re-cycle EVERY declared infra runtime's job, not just the first.
+    // resolveAlwaysOnTarget is the same scheme authority install/stop/start use;
+    // an absent plist reads as not-foundation-owned → skipped.
+    const infraRuntimes = [...new Set([peer.runtime, ...peer.runtimes])].filter(isInfraRuntime)
+    for (const runtime of infraRuntimes) {
+      const target = resolveAlwaysOnTarget(peer.personality, runtime, env)
+      if (!isFoundationOwnedPlist(target.path)) continue
+      const r = cycleLaunchdJob(target.label, target.path, env)
+      out.push({ personality: peer.personality, runtime, label: target.label, state: r.state, detail: r.detail })
+    }
   }
   return out
 }