@awebai/oats 0.22.17 → 0.23.0

package/lib/schedule.mjs

@@ -24,7 +24,7 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Cron } from "croner";
-import { ensureRoot, findAgent, findCapabilityAgent, findInstanceHomes, teamAgentRoots, configChain, spawnInstance, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
+import { RESERVED_LAUNCH_ENV, ensureRoot, findAgent, findCapabilityAgent, findInstanceHomes, teamAgentRoots, configChain, spawnInstance, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
 
 export const SCHEDULE_FILE = "oats-schedules.json";
 export const SCHEDULE_API = 1;
@@ -355,7 +355,17 @@ function launchCommand(ws, def, io) {
   let envelope, timedOut = false, raw = "";
   if (io?.command) envelope = io.command({ cwd: def.cwd, argv });
   else {
-    const env = { ...process.env }; delete env.OATS_INSTANCE; delete env.OATS_INSTANCE_HOME; delete env.PI_AGENT_INSTANCE; delete env.PI_AGENT_HOME;
+    const env = { ...process.env };
+    // A schedule may be ticked/run-now from inside an unrelated instance.
+    // Dispatch belongs to the job's cwd/explicit selectors, never that
+    // caller's frozen capability snapshot (including legacy OATS_HOME).
+    // Keep host configuration such as OATS_HOME_DIR and credentials intact.
+    for (const key of [...RESERVED_LAUNCH_ENV,
+      "OATS_CAPABILITY", "OATS_LAYER", "OATS_LEVEL", "OATS_META", "OATS_OPERATION",
+      "OATS_REPO", "OATS_BRANCH", "OATS_WORK", "OATS_KIND", "OATS_TASK",
+      "OATS_RUNTIME", "OATS_PREVIOUS_RUNTIME", "OATS_RETIRE_INTENT",
+      "OATS_TEAM_NAME", "OATS_TEAM_ID", "OATS_TEAM_SCOPE",
+    ]) delete env[key];
     const r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: def.cwd, encoding: "utf8", timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env });
     timedOut = r.error?.code === "ETIMEDOUT" || (r.status === null && r.signal === "SIGTERM");
     raw = String(r.stdout || "");

package/lib/servers.mjs

@@ -252,7 +252,8 @@ export function checkRemoteSupport(remote, target, oatsArgs, roster) {
   // capability-defined agent, or one with no live instance) has no default
   // this side can establish: the remote kernel validates its own default at
   // spawn, and nothing is asserted here about it.
-  const runtime = flagOf("--runtime") || soul?.runtime;
+  const namedConfig = oatsArgs.includes("--launch-config");
+  const runtime = flagOf("--runtime") || (namedConfig ? undefined : soul?.runtime);
   // What the message may claim depends on what was established: an
   // advertising remote said what it supports; a silent one (before 0.22.2)
   // said nothing, and only pi and claude are assumed of it.
@@ -260,6 +261,7 @@ export function checkRemoteSupport(remote, target, oatsArgs, roster) {
     ? `it advertises runtimes ${remote.runtimes.join(", ")}${remote.sessionBackends.length ? `, session backends ${remote.sessionBackends.join(", ")}` : ", no session backend choice"}${remote.launchOptions.length ? `, launch options ${remote.launchOptions.join(", ")}` : ", no launch options"}`
     : `it does not advertise what it supports (kernels before 0.22.2 do not), so only pi and claude on tmux with no launch options are assumed of it; upgrade it there to use more`;
   const refuse = (what) => { throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost}: ${what} was not established as supported there (${supports})`); };
+  if (namedConfig && !remote.features.includes("launch-config")) refuse("a named launch configuration (the host must advertise launch-config)");
   if (runtime && !remote.runtimes.includes(runtime)) refuse(`runtime ${runtime}${flagOf("--runtime") ? "" : ` (the default of soul ${agent} there)`}`);
   // A wake schedule at spawn is saved by the host: it must advertise schedules.
   if (["--wake-json", "--wake-every", "--wake-cron"].some((f) => oatsArgs.includes(f)) && !remote.features.includes("schedule")) refuse("a wake schedule at spawn (the host must advertise the schedule feature)");
@@ -656,17 +658,100 @@ const OPERATIONS_COMMANDS = new Set(["inspect", "operation", "use", "soul"]);
 /** `session start` on the execution host for a remote instance: the same
  *  route resolution as inspect, refused before any mutation when the remote
  *  kernel does not advertise session-start, the envelope relayed as is. */
-export function startRemote(serverId, { instance, home, model } = {}, io = {}) {
-  const route = resolveRoute(serverId, { instance, home }, "session start");
+export function startRemote(serverId, choices = {}, io = {}) {
+  return launchRemoteSession(serverId, "start", choices, io);
+}
+
+export function restartRemote(serverId, choices = {}, io = {}) {
+  return launchRemoteSession(serverId, "restart", choices, io);
+}
+
+function remoteLaunchArgs({ launchConfig, runtime, model, yolo } = {}) {
+  const args = [];
+  if (launchConfig !== undefined) {
+    if (typeof launchConfig !== "string" || !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(launchConfig)) throw serverError("E_BAD_ARGS", "invalid launch configuration name");
+    args.push("--launch-config", launchConfig);
+  }
+  if (runtime !== undefined) {
+    if (!["pi", "claude", "codex"].includes(runtime)) throw serverError("E_BAD_ARGS", "runtime must be pi, claude or codex");
+    args.push("--runtime", runtime);
+  }
+  if (model !== undefined && model !== null && model !== "") {
+    if (typeof model !== "string" || model.startsWith("-") || model.includes("\0")) throw serverError("E_BAD_ARGS", "invalid model name");
+    args.push("--model", model);
+  }
+  if (yolo !== undefined) {
+    if (typeof yolo !== "boolean") throw serverError("E_BAD_ARGS", "yolo must be true or false");
+    args.push(yolo ? "--yolo" : "--no-yolo");
+  }
+  return args;
+}
+
+function requireRemoteFeature(remote, target, feature) {
+  if (!remote.features.includes(feature)) throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost} does not advertise ${feature}; upgrade it there; nothing was sent`);
+}
+
+function launchRemoteSession(serverId, action, choices, io) {
+  const { instance, home, launchConfig, runtime, yolo } = choices;
+  const choiceArgs = remoteLaunchArgs(choices);
+  const route = resolveRoute(serverId, { instance, home }, `session ${action}`);
   const remote = requireSessionRemote(route.target, io);
   if (!remote.features.includes("session-start")) {
     throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${route.target.sshHost} does not advertise session-start (kernels from ${SESSION_START_REMOTE_VERSION} do); upgrade it there, or start the instance on that host`);
   }
-  const args = ["session", "start", "--home", route.home, ...(model ? ["--model", String(model)] : []), "--json"];
+  if (action === "restart") requireRemoteFeature(remote, route.target, "session-restart");
+  if (launchConfig !== undefined || runtime !== undefined || yolo !== undefined) requireRemoteFeature(remote, route.target, "launch-config");
+  const args = ["session", action, "--home", route.home, ...choiceArgs, "--json"];
   const { envelope, stderr } = runRemote(route.target, args, io);
   return { envelope: envelope.ok ? { ...envelope, result: { ...envelope.result, server: serverId, instance: instance || route.snapshot?.instance || envelope.result.instance } } : envelope, stderr, route };
 }
 
+/** Scope operations follow the registration; existing-home operations follow
+ * its saved route. Definitions travel on stdin, never as remote file paths or
+ * shell arguments. The host resolves environment references and validates the
+ * definition; this client never substitutes its own environment. */
+export function launchConfigRemote(serverId, options = {}, io = {}) {
+  const { action, name, context, instance, home, soul, agentsRoot, definition, keepEnv } = options;
+  if (!["list", "set", "remove", "preview"].includes(action)) throw serverError("E_BAD_ARGS", "unknown launch configuration action");
+  const write = action === "set" || action === "remove";
+  const homeSelected = home !== undefined || instance !== undefined;
+  if (homeSelected && (context !== undefined || soul !== undefined || agentsRoot !== undefined)) throw serverError("E_BAD_ARGS", "select one home or configuration scope");
+  if (write && (homeSelected || soul !== undefined || agentsRoot !== undefined)) throw serverError("E_BAD_ARGS", "edit a launch configuration with --dir, not a home or soul");
+  if (action === "preview" && !homeSelected && !soul) throw serverError("E_BAD_ARGS", "select a home or soul to preview");
+  const args = ["launch-config", action];
+  if (write) {
+    if (typeof name !== "string" || !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name)) throw serverError("E_BAD_ARGS", "invalid launch configuration name");
+    args.push(name);
+  }
+  let input;
+  if (action === "set") {
+    if (!definition || typeof definition !== "object" || Array.isArray(definition)) throw serverError("E_BAD_ARGS", "specify a launch configuration object");
+    if (keepEnv !== undefined && typeof keepEnv !== "boolean") throw serverError("E_BAD_ARGS", "keepEnv must be true or false");
+    if (keepEnv && Object.hasOwn(definition, "env")) throw serverError("E_BAD_ARGS", "omit env when preserving the saved environment");
+    input = Buffer.from(JSON.stringify(definition));
+    args.push("--file", "-");
+    if (keepEnv) args.push("--keep-env");
+  }
+  const add = (flag, value, absolute = false) => {
+    if (typeof value !== "string" || !value || value.startsWith("-") || value.includes("\0") || (absolute && !value.startsWith("/"))) throw serverError("E_BAD_ARGS", `invalid ${flag}`);
+    args.push(flag, value);
+  };
+  // Validate explicit selectors before even probing the host.
+  if (context !== undefined) add("--dir", context, true);
+  if (soul !== undefined) add("--soul", soul);
+  if (agentsRoot !== undefined) add("--agents-root", agentsRoot, true);
+  if (action === "preview") args.push(...remoteLaunchArgs(options));
+  const route = homeSelected ? resolveRoute(serverId, { instance, home }, "launch-config") : undefined;
+  const target = route?.target || targetOf(io.server || getServer(serverId));
+  if (route) add("--home", route.home, true);
+  else if (context === undefined) args.push("--dir", target.workspace);
+  // stdin belongs only to the set operation, never its preceding version probe.
+  const remote = checkRemote(target, { ...io, input: undefined });
+  requireRemoteFeature(remote, target, "launch-config");
+  const { envelope, stderr } = runRemote(target, [...args, "--json"], { ...io, input });
+  return { envelope, stderr, target, ...(route ? { route } : {}) };
+}
+
 /** `oats schedule ...` on the execution host: schedules are host-owned, so
  *  every subcommand runs in the server's registered workspace; refused
  *  before any remote mutation when the remote kernel does not advertise

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.22.17",
+  "version": "0.23.0",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",
@@ -15,7 +15,7 @@
   "type": "module",
   "scripts": {
     "test": "node scripts/run-tests.mjs",
-    "check": "node --check lib/core.mjs && node --check lib/packages.mjs && node --check bin/oats.mjs",
+    "check": "node scripts/check-package-dry-runs.mjs --syntax-only",
     "check:pi": "node --experimental-strip-types --check packages/pi/extension/index.ts",
     "validate": "node scripts/validate-project.mjs",
     "validate:okf": "node scripts/validate-okf.mjs",

package/packages/record/README.md

@@ -209,3 +209,22 @@ into an orphaned inode until it restarts.
 
 - Deletion via tombstone is eventual: an offline replica retains bytes until
   it reconnects. The SOT says this plainly; so do we.
+
+## Per-home source authority
+
+`capture --home <dir>` defaults to the kernel's independent managed-launch
+record-location history, retained beside the home under `.oats-native-record/`.
+It does not re-resolve old `fromEnv` references using the capturing process.
+Missing history (legacy/standalone), pending launches, and missing historical
+roots fail closed instead of certifying empty observer storage. Runtime switches
+and resumed starts retain earlier roots. A managed scaffold with no starts has
+an empty managed-launch inventory; executing a saved recipe by hand is not a
+managed start.
+
+For a deliberately observer-time inventory, explicitly pass `--current-roots`.
+The JSON labels this `sourceRoots: "current-env"`, rather than `"launch-history"`;
+completion then applies only to the chosen current inventory, not historical
+source custody. The library alternative is `sessionsForHome(home, { roots })`:
+unspecified formats are excluded, and missing supplied roots fail. Synthetic
+standalone tests must choose one of these explicitly, not masquerade as a
+managed native launch. Background capture without `--home` is unchanged.

package/packages/record/bin/capture.mjs

@@ -14,7 +14,7 @@
 
 import { watch } from "node:fs";
 import { homedir, hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import process from "node:process";
 
 import { RecordStore } from "../lib/store.mjs";
@@ -53,6 +53,7 @@ const BOOL_FLAGS = new Set([
   "sessions-only",
   "aw-only",
   "no-index",
+  "current-roots",
 ]);
 
 const USAGE = `capture — land sessions and aw client logs in the turn record.
@@ -65,10 +66,21 @@ const USAGE = `capture — land sessions and aw client logs in the turn record.
   capture --status             show store/stream summary, capture nothing
   capture --home <dir>         capture the sessions that ran inside <dir> (an
                                OATS instance home) and print them as JSON:
-                               thread, stream, turn count, first/last turn id.
-                               Tombstoned turns are never a boundary. Codex
-                               keeps a day's rollouts in one directory, so the
-                               pass captures that day; the list is filtered.
+                               thread, stream, turn count, first/last turn id;
+                               status, complete, skipped, held, incomplete,
+                               failed, ignored (explicit privacy exclusions).
+                               Only complete:true confirms a performed pass
+                               with no holds, incomplete tails, unattributed
+                               sources or errors. Lock skips/holds exit 0 but
+                               report complete:false; failures exit 1.
+                               Only attributed files are captured, even in
+                               shared directories. Unattributed non-ignored
+                               sources conservatively block completion.
+                               Tombstoned turns are never a boundary.
+  capture --current-roots --home <dir>
+                               explicit observer-time inventory for standalone
+                               or legacy sources lacking launch history. Not a
+                               certificate of all historical source locations.
   capture --install-hint       print the Claude Code hook snippet
   capture --help               this text
   capture --quiet              suppress per-pass progress
@@ -160,27 +172,65 @@ function log(...parts) {
 
 /** Take the root's single-run lock, or say who holds it. A hook-triggered
  *  pass that finds it held exits 0: the holder's pass, or the next one,
- *  reconciles the same sessions. */
+ *  reconciles the same sessions.
+ *
+ *  `fn` must return or throw, never call process.exit: the lock is released
+ *  in the finally, and a release that did not happen is said so on stderr
+ *  with the operator recovery and a nonzero exit status. Likewise an owner
+ *  record that could not be written: the lock never silently outlives the
+ *  pass that created it. */
 function withCaptureLock(fn) {
-  const lock = acquireCaptureLock(root);
+  let lock;
+  try {
+    lock = acquireCaptureLock(root);
+  } catch (err) {
+    if (err.lockCleanup) {
+      const c = err.lockCleanup;
+      const outcome = c.removed ? "the initializing lock was removed"
+        : c.reason === "gone" ? "the initializing lock was already gone (removed by another party)"
+        : c.reason === "replaced" ? (c.owner
+          ? `the lock now belongs to pid ${c.owner.pid} (started ${c.owner.startedAt || "?"}) and was left alone`
+          : "the lock directory changed or its identity could not be verified, no owner record was readable, and it was left alone")
+        : `the initializing lock could NOT be removed${c.error ? ` (${c.error})` : ""}; ${c.recovery}`;
+      console.error(`capture: could not write the owner record of ${c.path}: ${err.message}; ${outcome}`);
+    }
+    throw err;
+  }
   if (lock.held) {
     // Never quiet: a stale lock after a killed pass needs the operator, and
     // the line says exactly what to check and what to remove.
     const line = `capture: another pass holds ${root}: ${lock.held.recovery}; skipping this pass`;
-    if (lock.held.liveness === "alive") log(line); else console.error(line);
-    return { appended: 0, skipped: true };
+    if (args.home) { if (!quiet || lock.held.liveness !== "alive") console.error(line); }
+    else if (lock.held.liveness === "alive") log(line); else console.error(line);
+    return { appended: 0, skipped: true, lock: lock.held };
+  }
+  try {
+    return fn();
+  } finally {
+    const r = lock.release();
+    if (!r.released) {
+      // Say what was observed: gone, unreadable (unknown), another owner, or
+      // our own lock that would not go away; never a guess about liveness.
+      const detail = r.reason === "gone" ? "it was already removed by another party (an operator recovery?); nothing to release"
+        : r.reason === "not-owner" ? `it now belongs to pid ${r.owner.pid} (started ${r.owner.startedAt || "?"}); left alone`
+        : r.reason === "unknown-owner" ? `its owner record is missing or unreadable, so it may be an operator removal in progress or a newer pass initializing; left alone; ${r.recovery}`
+        : `${r.error ? `${r.error}; ` : ""}${r.recovery}`;
+      console.error(`capture: did not release ${lock.path} (${r.reason}): ${detail}`);
+      process.exitCode = 1;
+    }
   }
-  try { return fn(); } finally { lock.release(); }
 }
 
 function pass() {
+  // The privacy loader fails closed by exiting; it runs before the lock is
+  // taken so that exit never leaves the lock behind.
+  const ignore = loadIgnoreOrExit(root);
   return withCaptureLock(() => {
   const out = { appended: 0 };
-  const ignore = loadIgnoreOrExit(root);
   if (!args["aw-only"]) {
     for (const r of captureAllSessions(store, { owner, ignore })) {
       out.appended += r.appended;
-      const extras = [r.ignored ? `${r.ignored} ignored` : "", r.held ? `${r.held} held` : ""]
+      const extras = [r.ignored ? `${r.ignored} ignored` : "", r.held ? `${r.held} held` : "", r.incomplete ? `${r.incomplete} incomplete` : ""]
         .filter(Boolean)
         .join(", ");
       log(
@@ -263,55 +313,94 @@ if (args.status) {
 // exists for programs.
 if (args.home) {
   warnOnStrangerOwner();
-  const ignore = loadIgnoreOrExit(root);
   const unattributed = [];
-  const found = sessionsForHome(args.home, { onUnattributed: (source, path) => unattributed.push({ source, path }) });
+  let found = [];
   const sessions = [];
-  const dirs = new Map(); // one capture pass per (format, directory)
-  for (const s of found) dirs.set(`${s.source}\0${dirname(s.path)}`, { format: s.source, dir: dirname(s.path) });
-  let appended = 0;
-  const homePass = withCaptureLock(() => {
-    let n = 0;
-    for (const { format, dir } of dirs.values()) {
-      n += captureSessions(store, { owner, roots: [dir], format, ignore }).appended;
+  const outcome = { appended: 0, skipped: false, held: 0, incomplete: 0, failed: 0, ignored: 0 };
+  const issues = [];
+  let error;
+  try {
+    // Unlike background passes, --home always answers JSON, including errors.
+    // Do not exit from inside the lock callback: its finally owns release.
+    const ignore = loadIgnore(root);
+    found = sessionsForHome(args.home, {
+      ignore,
+      ...(args["current-roots"] ? { fallback: "current-env" } : {}),
+      onIgnored: () => outcome.ignored++,
+      onUnattributed: (source, path) => unattributed.push({ source, path }),
+    });
+    const formats = new Map(); // exact files, not their shared directories
+    for (const s of found) {
+      if (!formats.has(s.source)) formats.set(s.source, []);
+      formats.get(s.source).push(s);
     }
-    if (!args["no-index"]) { // same as pass(): an earlier append-only pass may have left unindexed turns
-      const index = new RecordIndex(store);
-      try {
-        index.update();
-      } finally {
-        index.close();
+    Object.assign(outcome, withCaptureLock(() => {
+      for (const [format, files] of formats) {
+        const r = captureSessions(store, { owner, files, format, ignore, final: true });
+        outcome.appended += r.appended;
+        outcome.held += r.held;
+        outcome.incomplete += r.incomplete;
+        outcome.ignored += r.ignored;
+        issues.push(...r.issues);
       }
+      if (!args["no-index"]) { // an earlier append-only pass may have left unindexed turns
+        const index = new RecordIndex(store);
+        try {
+          index.update();
+        } finally {
+          index.close();
+        }
+      }
+      return outcome;
+    }));
+    // A tombstoned turn is hidden everywhere; a boundary naming one would be
+    // refused by recall, so boundaries come from the visible turns only.
+    const claims = store.tombstoneClaims();
+    for (const s of found) {
+      const stream = `${owner}~${s.source}.${s.sessionId}`;
+      const turns = store.readStream(stream).filter((t) => !store.claimHides(claims, t));
+      if (!turns.length) continue; // ignored by rule, nothing capturable yet, or all hidden
+      sessions.push({
+        thread: s.thread,
+        source: s.source,
+        sessionId: s.sessionId,
+        path: s.path,
+        cwd: s.cwd,
+        stream,
+        turns: turns.length,
+        firstTurnId: turns[0].id,
+        lastTurnId: turns[turns.length - 1].id,
+        lastTs: turns[turns.length - 1].ts,
+      });
     }
-    return { appended: n };
-  });
-  appended = homePass.appended;
-  // A tombstoned turn is hidden everywhere; a boundary naming one would be
-  // refused by recall, so boundaries come from the visible turns only.
-  const claims = store.tombstoneClaims();
-  for (const s of found) {
-    const stream = `${owner}~${s.source}.${s.sessionId}`;
-    const turns = store.readStream(stream).filter((t) => !store.claimHides(claims, t));
-    if (!turns.length) continue; // ignored by rule, nothing capturable yet, or all hidden
-    sessions.push({
-      thread: s.thread,
-      source: s.source,
-      sessionId: s.sessionId,
-      path: s.path,
-      cwd: s.cwd,
-      stream,
-      turns: turns.length,
-      firstTurnId: turns[0].id,
-      lastTurnId: turns[turns.length - 1].id,
-      lastTs: turns[turns.length - 1].ts,
-    });
+  } catch (err) {
+    error = err.message || String(err);
+    console.error(`capture pass failed: ${error}`);
+    outcome.failed++;
+    // captureSessions can throw after appending part of a directory. Do not
+    // claim zero (or a complete count) for a partially performed failed pass.
+    outcome.appended = null;
+    process.exitCode = 1;
   }
-  console.log(JSON.stringify({ home: args.home, owner, appended, sessions, ...(unattributed.length ? { unattributed } : {}) }, null, 2));
-  process.exit(0);
-}
+  if (process.exitCode && !outcome.failed) {
+    outcome.failed++;
+    error = "capture lock release failed; see stderr for recovery";
+  }
+  const status = outcome.failed ? "failed" : outcome.skipped ? "skipped" : outcome.held ? "held" : outcome.incomplete || unattributed.length ? "incomplete" : "complete";
+  console.log(JSON.stringify({ home: args.home, owner, ...outcome, status, complete: status === "complete", sessions, sourceRoots: args["current-roots"] ? "current-env" : "launch-history",
+    ...(error ? { error } : {}), ...(issues.length ? { issues } : {}), ...(unattributed.length ? { unattributed } : {}),
+  }, null, 2));
+  // Let stdout drain naturally, including large session-boundary receipts.
+} else {
 
 warnOnStrangerOwner();
-pass();
+try {
+  pass();
+} catch (err) {
+  // The lock's finally has run by now; one line, then the status.
+  console.error(`capture pass failed: ${err.message}`);
+  process.exit(1);
+}
 
 if (args.watch) {
   const roots = [
@@ -340,3 +429,5 @@ if (args.watch) {
   }
   setInterval(schedule, 15 * 60 * 1000); // reconcile even if events were missed
 }
+
+}

package/packages/record/bin/recall.mjs

@@ -43,12 +43,13 @@ const store = new RecordStore(root, {});
 let index;
 const getIndex = () => (index ??= new RecordIndex(store));
 
+async function main() {
 try {
   if (args.reindex) {
     const index = getIndex();
     index.rebuild();
     console.log(JSON.stringify(index.counts()));
-    process.exit(0);
+    return;
   }
 
   if (args.show) {
@@ -58,21 +59,21 @@ try {
     const turn = resolveTurn(store, index, args.show, byId);
     if (!turn) {
       console.error(`no turn ${args.show}`);
-      process.exit(1);
+      process.exitCode = 1; return;
     }
     // Tombstoned turns are hidden from tool output, id lookup included.
     if (store.hiddenIds(byId).has(args.show)) {
       console.error(`turn ${args.show} is tombstoned`);
-      process.exit(1);
+      process.exitCode = 1; return;
     }
     console.log(JSON.stringify(turn, null, 2));
-    process.exit(0);
+    return;
   }
 
   const query = args._.join(" ").trim();
   if (!query && !args.thread) {
     console.error("usage: recall [--kind k] [--thread t] [--from f] [--role r] [--limit n] <query>");
-    process.exit(2);
+    process.exitCode = 2; return;
   }
 
   // Thread turns straight from the journal, in capture SEQUENCE: the order a
@@ -100,12 +101,12 @@ try {
     let end = turns.length;
     if (args.after) {
       const i = ids.indexOf(args.after);
-      if (i < 0) { console.error(`--after: no turn ${args.after} in thread ${args.thread}`); process.exit(1); }
+      if (i < 0) { console.error(`--after: no turn ${args.after} in thread ${args.thread}`); process.exitCode = 1; return; }
       start = i + 1;
     }
     if (args.until) {
       const i = ids.indexOf(args.until);
-      if (i < 0) { console.error(`--until: no turn ${args.until} in thread ${args.thread}`); process.exit(1); }
+      if (i < 0) { console.error(`--until: no turn ${args.until} in thread ${args.thread}`); process.exitCode = 1; return; }
       end = i + 1;
     }
     const cap = args.limit ? Number(args.limit) : Infinity;
@@ -123,7 +124,7 @@ try {
       return full;
     });
     console.log(JSON.stringify({ thread: args.thread, total: turns.length, from: start, to: stop, remaining: end - stop, turns: out }, null, 2));
-    process.exit(0);
+    return;
   }
 
   const index = getIndex();
@@ -150,15 +151,15 @@ try {
 
   if (rows.length === 0 && args.json) {
     console.log("[]");
-    process.exit(0);
+    return;
   }
   if (rows.length === 0) {
     console.error("no matches");
-    process.exit(1);
+    process.exitCode = 1; return;
   }
   if (args.json) {
     console.log(JSON.stringify(rows, null, 2));
-    process.exit(0);
+    return;
   }
   for (const r of rows) {
     const where = r.loc ? ` @${r.loc}` : "";
@@ -170,3 +171,8 @@ try {
 } finally {
   index?.close();
 }
+
+}
+// Natural process termination drains piped stdout; process.exit after a JSON
+// write truncates large recall windows even though it reports exit status 0.
+await main();

package/packages/record/bin/record-native-start.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+// The environment/argv stays in this process, never in the custody receipt.
+import { recordNativeStart } from "../lib/native-history.mjs";
+try {
+  const [home, id, runtime, args] = process.argv.slice(2);
+  recordNativeStart(home, id, runtime, JSON.parse(args));
+} catch {
+  // Native paths can contain user-chosen data; never echo argv or env on errors.
+  console.error("native record location receipt failed; launch refused and pending custody retained");
+  process.exitCode = 1;
+}