@awebai/oats 0.22.3 → 0.22.5

package/bin/oats.mjs

@@ -2206,8 +2206,20 @@ function migrateCmd() {
 /** oats update <package> — transactional package update with diff + trust reset. */
 function updatePackageCmd(id) {
   const dir = dirFlag();
+  // --to <selector>: move a catalog-sourced lock to another catalog ref
+  // (tag) through the same transactional update. A lock with an explicit
+  // selector keeps it on a plain update by design; this is the operator's
+  // way to advance it without remove + reinstall.
+  // Two spellings: `oats update <id> <id>@<selector>` (the engine's own spec
+  // form) or `oats update <id> --to <selector>`.
+  const to = flag("to");
+  if (to === true) { cmdFail("E_BAD_ARGS", "--to needs a catalog selector, e.g. --to v1.10.1"); return; }
+  if (to !== undefined && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(to)) { cmdFail("E_BAD_ARGS", `--to selector ${JSON.stringify(to)} is not a catalog ref`); return; }
+  const positional = args[2] && !args[2].startsWith("--") ? args[2] : undefined;
+  if (positional && to !== undefined) { cmdFail("E_BAD_ARGS", "give either <id>@<selector> or --to <selector>, not both"); return; }
+  const spec = positional || (to !== undefined ? `${id}@${to}` : undefined);
   let r;
-  try { r = updatePackage(dir, id); } catch (e) { cmdFail(e.code || "invalid-lock", e.message || e); return; }
+  try { r = updatePackage(dir, id, spec ? { spec } : {}); } catch (e) { cmdFail(e.code || "invalid-lock", e.message || e); return; }
   if (JSON_MODE) { jsonOk(r); return; }
   // A moved package root is reported even when the bytes are identical: the
   // lock now points somewhere else in the repository, and that is exactly the
@@ -3386,7 +3398,13 @@ else if (cmd === "doctor") {
   args.includes("--json") ? doctorJson(doctorDir) : doctor(doctorDir);
 }
 else if (cmd === "use") use();
-else if (cmd === "update") { const t = args[1] && !args[1].startsWith("--") ? args[1] : undefined; t ? updatePackageCmd(t) : updateCmd(); }
+else if (cmd === "update") {
+  const t = args[1] && !args[1].startsWith("--") ? args[1] : undefined;
+  // A selector without a package must never fall through to the kernel
+  // self-update (a different product) with the flag silently ignored.
+  if (!t && flag("to") !== undefined) { cmdFail("E_BAD_ARGS", "oats update --to needs a package: oats update <package> --to <ref> (or <package> <package>@<ref>)"); process.exit(1); }
+  t ? updatePackageCmd(t) : updateCmd();
+}
 else if (cmd === "type") typeCmd();
 else if (cmd === "inject") injectCmd();
 else if (cmd === "install") install();
@@ -3488,9 +3506,10 @@ Usage:
                                             report under error.details)
   oats list [--dir <d>] [--json]             installed packages, exported capabilities,
                                             scopes, trust state
-  oats update <package> [--dir <d>]          transactional package update: temp fetch,
-                                            closure validation, diff, lock replace,
-                                            all capability approvals invalidated
+  oats update <package> [<package>@<ref>]    transactional package update: temp fetch,
+      [--to <ref>] [--dir <d>]              closure validation, diff, lock replace,
+                                            all capability approvals invalidated; a
+                                            spec or --to moves a catalog lock to <ref>
   oats remove <package> [--dir <d>]          remove a package (refuses while config or
                                             dependent packages reference it)
   oats migrate [--dry-run] [--dir <d>]       map this scope's v1 capability locks to

package/capabilities/oats-aweb/oats.json

@@ -1,7 +1,7 @@
 {
   "capability": "oats.aweb",
   "command": "aweb",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "compatibility": {
     "oats": ">=0.22.3"
   },
@@ -42,6 +42,18 @@
       "why": "an ambient aweb pi extension, if one is installed, must honour AWEB_DELIVERY=session (0.3.10 and later); an older one would open a second event stream beside the wake broker; no extension at all is fine",
       "install": "pi install npm:@awebai/pi@latest",
       "ifInstalled": true
+    },
+    {
+      "runtime": "claude",
+      "package": "aweb-channel@awebai-marketplace",
+      "marketplace": "awebai/claude-plugins",
+      "minVersion": "1.7.9",
+      "when": {
+        "delivery": "session"
+      },
+      "why": "an ambient aweb-channel plugin for Claude Code, if one is installed, must honour AWEB_DELIVERY=session (1.7.9 and later); an older one starts its own channel server beside the wake broker and can fetch and acknowledge a message before the broker delivers it; no plugin at all is fine",
+      "install": "update the aweb-channel plugin from the awebai marketplace in Claude Code",
+      "ifInstalled": true
     }
   ],
   "skills": [

package/capabilities/oats-okf/agents/memory-harvest/soul.yaml

@@ -2,5 +2,4 @@ name: memory-harvest
 kind: capability
 work: attached
 runtime: pi
-model: github-copilot/gpt-5.5
 description: Ephemeral OKF service agent that promotes one live instance's pending notes into its soul.

package/capabilities/oats-okf/bin/oats-okf.mjs

@@ -52,10 +52,6 @@ catch (e) {
   if (JSON_MODE) jsonFail("E_HARVEST_FAILED", `malformed OATS_SETTINGS: ${e.message || e}`);
   process.stderr.write(`oats-okf: malformed OATS_SETTINGS (ignoring): ${e.message || e}\n`);
 }
-/** Model for the memory-harvest agent — promotion judgment is cheap-but-good
- *  work; default gpt-5.5, overridable via okf settings { "harvest-model": ... }. */
-const DEFAULT_HARVEST_MODEL = "github-copilot/gpt-5.5";
-
 function runtimeError(code, message) {
   return Object.assign(new Error(message), { code });
 }
@@ -148,8 +144,19 @@ function planRecordHarvest(instanceHome) {
   // The exact next watermark is written beside the current one by the
   // package; the harvester's delivery is a rename, nothing retyped.
   const nextPath = join(instanceHome, RECORD_WATERMARK.replace(/\.json$/, ".next.json"));
-  writeFileSync(nextPath, JSON.stringify(next, null, 2) + "\n");
-  return { threads, watermarkPath, nextPath, watermark: next, unattributed: (report.unattributed || []).length, problems };
+  const windows = threads.map(({ thread, afterTurnId, untilTurnId }) => ({ thread, afterTurnId, untilTurnId }));
+  let pending;
+  try { pending = JSON.parse(readFileSync(nextPath, "utf8")).pendingHarvest; } catch { /* no prior plan */ }
+  const sameWindows = pending?.instance && JSON.stringify(pending.windows) === JSON.stringify(windows);
+  const warnings = sameWindows ? [
+    `previous harvester ${pending.instance} did not advance the watermark for ${windows.map((w) => `${w.thread} (${w.afterTurnId || "start"} -> ${w.untilTurnId})`).join(", ")}; inspect its outcome and use oats okf harvest --from-record --force to retry`,
+  ] : [];
+  // Reuse the existing prepared watermark; no extra journal. Stamp it only
+  // after a successful spawn, and never overwrite a stalled plan on a skip.
+  if (sameWindows && !process.argv.includes("--force")) return { stalled: true, warnings };
+  const prepared = JSON.stringify(next, null, 2) + "\n";
+  writeFileSync(nextPath, prepared);
+  return { threads, windows, watermarkPath, nextPath, watermark: next, prepared, unattributed: (report.unattributed || []).length, problems, warnings };
 }
 
 /** Briefing block for record-fed candidates, appended to the harvest task. */
@@ -198,11 +205,27 @@ async function spawnHarvester(spawnArgs, task) {
   }
 }
 
-function harvestSpawnArgs({ slug, parent, repo, work, workDir, branch, model }) {
-  const args = ["--purpose", slug, "--parent", parent, "--repo", repo, "--work", work];
+function harvestRuntime() {
+  const runtime = settings["harvest-runtime"] ?? "pi";
+  if (!["pi", "claude", "codex"].includes(runtime)) {
+    throw runtimeError("E_HARVEST_SETTINGS", "harvest-runtime must be pi, claude or codex");
+  }
+  const configured = settings["harvest-model"];
+  if (configured != null && (typeof configured !== "string" || !configured.trim())) {
+    throw runtimeError("E_HARVEST_SETTINGS", "harvest-model must be a nonempty model name");
+  }
+  const model = configured?.trim() || undefined;
+  if (runtime !== "pi" && model?.includes("/")) {
+    throw runtimeError("E_HARVEST_SETTINGS", `harvest-model for ${runtime} must be a native model name, without a Pi provider/ prefix`);
+  }
+  return { runtime, model };
+}
+
+function harvestSpawnArgs({ slug, parent, repo, work, workDir, branch, runtime, model }) {
+  const args = ["--purpose", slug, "--parent", parent, "--repo", repo, "--work", work, "--runtime", runtime];
   if (workDir) args.push("--work-dir", workDir);
   if (branch) args.push("--branch", branch);
-  args.push("--model", model);
+  if (model) args.push("--model", model);
   return args;
 }
 
@@ -331,7 +354,7 @@ _(the single next action — keep this current; a fresh session on any model res
       }
     }
     const notesDir = join(home, "notes");
-    const skip = (why) => (JSON_MODE ? jsonOk({ harvest: "skipped", reason: why }) : out({ meta: { harvestSpawn: "skipped", why } }));
+    const skip = (why, warnings = []) => (JSON_MODE ? jsonOk({ harvest: "skipped", reason: why, ...(warnings.length ? { warnings } : {}) }) : out({ meta: { harvestSpawn: "skipped", why }, ...(warnings.length ? { warnings } : {}) }));
     if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");
     const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];
 
@@ -358,6 +381,7 @@ _(the single next action — keep this current; a fresh session on any model res
     // write few notes). --from-record asks for the record even with notes.
     // Planned only now, after every skip above: a capture pass is a real
     // write and index, and "calling it too often is safe" must stay true.
+    const execution = harvestRuntime();
     let recordPlan = null;
     if (notes.length === 0 || process.argv.includes("--from-record")) {
       let planned = null;
@@ -366,13 +390,14 @@ _(the single next action — keep this current; a fresh session on any model res
         process.stderr.write(`oats-okf: record unavailable${notes.length ? ", harvesting notes only" : ""}: ${planned.unavailable}\n`);
         if (notes.length === 0) skip("no pending notes");
       } else recordPlan = planned;
+      for (const warning of recordPlan?.warnings || []) process.stderr.write(`oats-okf: record: ${warning}\n`);
+      if (recordPlan?.stalled) skip("previous harvester did not advance the watermark", recordPlan.warnings);
       for (const line of recordPlan?.problems || []) process.stderr.write(`oats-okf: record: ${line}\n`);
       if (recordPlan?.unattributed) process.stderr.write(`oats-okf: record: ${recordPlan.unattributed} session file(s) carry no working directory and cannot be attributed to any home (oats capture --home <home> lists them)\n`);
       if (notes.length === 0 && !recordPlan) skip("no pending notes");
     }
     // Effective command settings are injected by capability dispatch. No
     // resolved-config read crosses the public package boundary.
-    const harvestModel = settings["harvest-model"] || DEFAULT_HARVEST_MODEL;
     const workDir = realpathSync(join(home, "work"));
     const realSoul = realpathSync(sDir);
     const harvName = `memory-harvest-${slug}`;
@@ -386,7 +411,7 @@ _(the single next action — keep this current; a fresh session on any model res
       // version. It must not touch the owner's work tree.
       const task = `Harvest the pending notes of live LOCAL-SOUL instance "${inst}" (agent "${agName}") into its soul — by direct edits, no commit.\n\n- Source notes: ${notes.length ? `${notesDir} (${notes.join(", ")})` : "none pending"}\n- Soul knowledge bundle to update: ${join(realSoul, "knowledge")}\n- Soul skills dir (for procedure-shaped notes): ${join(realSoul, "skills")}\n- This soul is LOCAL (uncommitted, gitignored): edit those soul files IN PLACE. Do NOT run git commit — not for the soul, and not in ./work (the shared tree belongs to the working instance; leave it untouched).\n- Follow your memory-harvest skill for everything else: promote/merge/drop each note, knowledge vs skill routing, index + log discipline, validate the bundle, DELETE processed notes from the source notes/ dir.\n${recordBrief(recordPlan, packageRuntimeCli())}\n- Then run \`oats retire ${harvName} --self\`.`;
       r = await spawnHarvester(harvestSpawnArgs({
-        slug, parent: inst, repo: context, work: "attached", workDir, model: harvestModel,
+        slug, parent: inst, repo: context, work: "attached", workDir, ...execution,
       }), task);
     } else if ((process.env.OATS_WORK || meta.work) === "workspace") {
       // WORKSPACE-MODE instance: ./work is the whole workspace, not a git repo —
@@ -399,7 +424,7 @@ _(the single next action — keep this current; a fresh session on any model res
       const task = `Harvest the pending notes of live WORKSPACE-MODE instance "${inst}" (agent "${agName}") into its soul — delivered as a PR.\n\n- Source notes: ${notes.length ? `${notesDir} (${notes.join(", ")})` : "none pending"}\n- Your ./work is a dedicated worktree of the soul's home repo (${soulRepo}), branch memory-harvest/${slug}.\n- Soul knowledge bundle to update: ./work/${join(relSoul, "knowledge")}\n- Soul skills dir (for procedure-shaped notes): ./work/${join(relSoul, "skills")}\n- Follow your memory-harvest skill: promote/merge/drop each note, knowledge vs skill routing, index + log discipline, validate the bundle, DELETE processed notes from the source notes/ dir, and commit once (prefixed "memory-harvest:") if anything changed.${recordBrief(recordPlan, packageRuntimeCli())}\n- If you changed anything: push the branch and open a PR (\`git push -u origin memory-harvest/${slug}\` then \`gh pr create --fill\`). Do NOT merge it; the humans/owners of ${soulRepo} review soul changes. If gh is unavailable, push the branch and report the compare URL. A harvest that promoted nothing has nothing to commit, push or open; that is a completed harvest, not a failed one.\n- Finally run \`oats retire ${harvName} --self\` (keep the branch: --self only).`;
       r = await spawnHarvester(harvestSpawnArgs({
         slug, parent: inst, repo: soulRepo, work: "worktree",
-        branch: `memory-harvest/${slug}`, model: harvestModel,
+        branch: `memory-harvest/${slug}`, ...execution,
       }), task);
     } else {
       // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the
@@ -410,11 +435,27 @@ _(the single next action — keep this current; a fresh session on any model res
         : realSoul;
       const task = `Harvest the pending notes of live instance "${inst}" (agent "${agName}") into its soul.\n\n- Source notes: ${notes.length ? `${notesDir} (${notes.join(", ")})` : "none pending"}\n- Soul knowledge bundle to update: ${join(soulTarget, "knowledge")}\n- Soul skills dir (for procedure-shaped notes): ${join(soulTarget, "skills")}\n- You are ATTACHED to the instance's work tree (./work) — commit your promotions there as a single commit, prefixed "memory-harvest:".\n- Follow your memory-harvest skill: promote/merge/drop each note, knowledge vs skill routing, index + log discipline, validate the bundle, DELETE processed notes from the source notes/ dir (so they are not re-harvested).${recordBrief(recordPlan, packageRuntimeCli())}\n- Commit if you changed anything (a harvest that promoted nothing has nothing to commit), then run \`oats retire ${harvName} --self\`.`;
       r = await spawnHarvester(harvestSpawnArgs({
-        slug, parent: inst, repo: context, work: "attached", workDir, model: harvestModel,
+        slug, parent: inst, repo: context, work: "attached", workDir, ...execution,
       }), task);
     }
-    if (JSON_MODE) jsonOk({ harvest: "spawned", instance: r.instance, window: r.tmux?.window || null, ...(recordPlan ? { record: { threads: recordPlan.threads.map((t) => t.thread), ...(recordPlan.unattributed ? { unattributed: recordPlan.unattributed } : {}), ...(recordPlan.problems?.length ? { problems: recordPlan.problems } : {}) } } : {}) });
-    out({ meta: { harvestSpawn: r.instance, window: r.tmux?.window } });
+    if (recordPlan) {
+      try {
+        // A fast harvester may already have renamed the prepared file. Never
+        // recreate that consumed plan or replace a different plan's contents.
+        if (readFileSync(recordPlan.nextPath, "utf8") === recordPlan.prepared) {
+          writeFileSync(recordPlan.nextPath, JSON.stringify({ ...recordPlan.watermark, pendingHarvest: { instance: r.instance, windows: recordPlan.windows } }, null, 2) + "\n");
+        }
+      } catch (e) {
+        if (e.code !== "ENOENT") {
+          const warning = `harvester ${r.instance} spawned but its retry marker could not be recorded: ${e.message}`;
+          recordPlan.warnings.push(warning);
+          process.stderr.write(`oats-okf: ${warning}\n`);
+        }
+      }
+    }
+    const warnings = recordPlan?.warnings?.length ? { warnings: recordPlan.warnings } : {};
+    if (JSON_MODE) jsonOk({ harvest: "spawned", instance: r.instance, window: r.tmux?.window || null, ...warnings, ...(recordPlan ? { record: { threads: recordPlan.threads.map((t) => t.thread), ...(recordPlan.unattributed ? { unattributed: recordPlan.unattributed } : {}), ...(recordPlan.problems?.length ? { problems: recordPlan.problems } : {}) } } : {}) });
+    out({ meta: { harvestSpawn: r.instance, window: r.tmux?.window }, ...warnings });
   } catch (e) {
     if (JSON_MODE) jsonFail(e.code || "E_HARVEST_FAILED", `harvest spawn failed (notes are safe on disk): ${e.message || e}`);
     warn(`harvest spawn failed (notes are safe on disk): ${e.message || e}`);

package/capabilities/oats-okf/oats.json

@@ -1,11 +1,21 @@
 {
   "capability": "oats.okf",
   "command": "okf",
-  "version": "1.5.0",
-  "compatibility": { "oats": ">=0.22.2" },
+  "version": "1.5.1",
+  "compatibility": { "oats": ">=0.22.3" },
   "layer": "knowledge",
   "description": "Knowledge layer via OKF: soul bundles, instance memory (STATE.md/log.md/notes/), continuous post-commit harvest into the soul (commit, PR, or direct-edit for local souls), craft + memory skills, validator.",
   "requires": [],
+  "settings": {
+    "harvest-runtime": {
+      "default": "pi",
+      "values": ["pi", "claude", "codex"],
+      "description": "Harness for the memory harvester, independent of the source instance's runtime."
+    },
+    "harvest-model": {
+      "description": "Optional model pin for the selected harvest runtime, for example to use a cheaper model: a Pi provider/model or a native Claude/Codex model. When omitted, each harness uses its configured default."
+    }
+  },
   "agents": [
     "agents/memory-harvest"
   ],

package/capabilities/oats-okf/skills/memory-harvest/SKILL.md

@@ -92,6 +92,9 @@ is how what they learned reaches the soul.
   one-line title, the claim, and its provenance as the turn ids it came from.
   A candidate is something the instance learned or decided, stated in the
   turns, not something you infer it should have learned.
+- Never promote a secret or credential, however it appears in the record.
+- Never promote third-party message content verbatim. A lesson may be about a
+  received message; unverified sender content is not soul knowledge by transcription.
 - Then judge every candidate exactly as a note: promote, merge, or drop
   against the same bar. Expect most to drop: session trivia, tool noise,
   restated repo facts and task-scoped decisions all fail it. Promoted

package/docs/integrations.md

@@ -140,6 +140,33 @@ Test an integration as a capability package: acquire, lock, trust, activate,
 spawn, retire, with the golden fixtures as the behavior oracle for the kernel
 side.
 
+## oats.okf harvest settings (1.5.1)
+
+The harvester can use a different harness from the source instance. Select one
+that is installed and authenticated on the host where the harvest runs:
+
+```bash
+oats use oats.okf --settings harvest-runtime=claude
+```
+
+- `harvest-runtime: pi | claude | codex` defaults to `pi`.
+- `harvest-model` is an optional pin, for example to use a cheaper model.
+  When omitted, each harness uses its configured default. Pi accepts
+  provider/model patterns. Claude and Codex require a native model name
+  (for example `sonnet` or `gpt-5.5`), without a Pi provider prefix.
+
+These settings apply to note and record harvests, including deferred retirement
+and remote harvests. For a remote instance, configure its host's knowledge
+binding; the local viewer does not supply its own provider credentials.
+
+If a record harvester was spawned but did not advance its watermark, planning
+the same windows again warns with that instance and the boundary IDs and skips
+another spawn. Inspect the previous attempt first. `oats okf harvest
+--from-record --force` retries those windows explicitly; it still refuses to
+start a second harvester while the first one's home exists. The check uses the
+existing prepared watermark file and does not treat a successful spawn as
+completed learning.
+
 ## oats.aweb settings (1.10.0)
 
 Set with `oats use oats.aweb --settings <key>=<value>` at a scope, or per
@@ -148,8 +175,11 @@ soul through the binding's `settings:` map.
 - `delivery: channel | session` (default `channel`). `session` hands
   notification delivery to the host wake broker: `AWEB_DELIVERY=session` in
   the launch environment (declared by the manifest), no Claude channel flag,
-  a pi extension that honours the opt-out (`@awebai/pi` 0.3.10 or later,
-  enforced as a conditional requirement with a version floor), and a briefing
+  a pi extension that honours the opt-out (`@awebai/pi` 0.3.10 or later) and
+  a Claude Code channel plugin that does too (`aweb-channel` 1.7.9 or later),
+  both enforced as conditional requirements with a version floor when
+  installed (an older plugin starts its own channel server beside the broker
+  and can fetch a message before the broker delivers it), and a briefing
   and registration of the home with the host wake broker (`aw wake register`).
   Until an aw that ships `aw wake` exists (aweb-abil), session mode REFUSES
   to spawn rather than leave an instance that nothing wakes: it is for broker

package/docs/operating-team-migration.md

@@ -9,7 +9,9 @@ The cjr runbook is owned by Merlin at
 `~/cjr/agents/docs/2026-09-05-oats-migration.md`. This document records the
 shared framework work and the wider rollout.
 
-Fresh identities are authorized for specialists and reviewers. Merlin retains
+Fresh identities are authorized for continuing seats as well as specialists and
+reviewers. Preserve the accepted retained-identity choice where it is useful.
+Merlin retains
 both `cjr.aweb.ai/merlin` and his existing durable DID. Aweb clarified that
 re-minting the same address changes identity and breaks continuity; the supported
 path is an explicit transfer of his existing authority with one live process.
@@ -27,21 +29,28 @@ Every continuing seat must have a supported OATS launch, composition,
 status, handover and retirement path. Its outstanding work, knowledge and
 required skills must survive a change of runtime session; identity/address
 continuity follows the explicit policy for that seat.
-Every remembering role must have a tested learning path; reviewers retain
-their explicit exclusion from accumulated memory. Config discovery alone
-establishes none of this.
-
-The installed baseline is OATS 0.22.2, including native Pi/Claude/Codex,
-tmux/Herdr, shared `yolo`, remote CLI launch/terminals and deferred retirement.
-The Mac Desktop app is installed and passed packaged renderer/PTY launch checks.
-Official oats.okf 1.5.0 provides record-fed harvesting. A source candidate for
-0.22.3 adds the retained-authority binding, remote Desktop roster/actions and
-retirement corrections; that candidate is not yet a published release.
-
-No standing seat has transferred yet. Cjr's worker pilot has landed reviewed
-code and knowledge; ordinary retirement passed using the next-patch candidate.
-A real harvester's automatic deferred completion, successor knowledge use and
-session-broker delivery remain explicit acceptance checks.
+Every remembering role must have a tested learning path. Preserve each role's
+explicit policy: Cjr reviewers exclude accumulated memory; Themis uses
+reviewed learning. Config discovery alone establishes none of this.
+
+The installed CLI baseline is published OATS 0.22.4 on this Mac and `aweb-agents`,
+including native Pi/Claude/Codex, tmux/Herdr, shared `yolo`, remote Desktop
+roster/actions, retained-authority binding and corrected deferred retirement.
+The installed Mac Desktop 0.22.4 passed published ZIP checksum, strict deep
+codesign, packaged renderer and PTY launch checks; the previous 0.22.3 app
+is preserved for rollback. Official oats.okf 1.5.0 provides record-fed harvesting; each
+deployment must select its authenticated provider. Version 1.5.1, adding
+harvest-runtime selection and detection of unadvanced record plans, remains
+under independent review and is not yet published.
+
+No standing seat has transferred yet. Cjr's workers have landed reviewed
+code and knowledge. Two ordinary cycles on published 0.22.3 completed automatic
+harvester retirement, independent knowledge review, integration and home-only
+worker retirement. A successor read promoted indexed knowledge at startup and
+identified how it shaped its implementation; both acceptance checks passed.
+The reviewed aweb broker candidate passed
+real harness delivery; installation of its published release as the normal
+host service remains a prerequisite for standing cutover.
 
 ## Scope inventory
 
@@ -51,13 +60,13 @@ of continuing seats.
 
 | Scope | Starting point | Required disposition |
 | --- | --- | --- |
-| `~/awebai/oats` | Live Claude coordinator and Codex lead; managed review workers also running | Oats owns coordinator handover; lead owns lead handover; preserve established identities |
-| `~/cjr` | Preparation `5afb3e8b`; developer pilot landed on master `062e2c75`; legacy Merlin and Minerva live | Merlin owns safe handovers; preserve his DID/address; prove automatic harvest completion and successor use |
-| `~/awebai/aweb` | Live Claude coordinator and frontend in legacy homes | Oats owns coordinator handover; lead coordinates frontend with aweb after its current work; preserve identities and cover child repositories |
-| `~/tsm` | Five live seats: Zeus, Prometeo, Argos, Themis on Claude; Hermes on Codex. No OATS config/souls found | Zeus prepared the five-seat handover plan; begin with Themis at a safe boundary, Zeus last; preserve session-local schedules and production authority |
+| `~/awebai/oats` | Live Claude coordinator and Codex lead; managed review workers also running | Oats owns coordinator handover; lead owns lead handover; follow the explicit fresh or retained identity choice |
+| `~/cjr` | Preparation `5afb3e8b`; developer pilot landed on master `062e2c75`; legacy Merlin and Minerva live | Merlin owns safe handovers; preserve his DID/address; automatic harvest completion and successor use are proven; prepare standing seats |
+| `~/awebai/aweb` | Live Claude coordinator and frontend in legacy homes | Oats owns coordinator handover; lead coordinates frontend with aweb after its current work; handover task responsibility and cover child repositories |
+| `~/tsm` | Five live seats: Zeus, Prometeo, Argos, Themis on Claude; Hermes on Codex. Themis and Argos config/souls integrated, official capabilities installed and trusted | Zeus prepared the five-seat handover plan; begin with Themis at a safe boundary, Zeus last; preserve session-local schedules and production authority |
 | `~/prj/beadhub-all` | Live Codex session, despite stale offline roster | Beadhub accepted preparation and is at a safe boundary; retain its global identity, native Codex and separate canonical code roots under `~/awebai/beadhub`; billing remains separately gated |
 | `~/prj/docflow` | Live Claude seat identified itself as local `juan.aweb.ai/alice` on `docflow:juan.aweb.ai` | Owner Juan; finish running mail backfill and register checks before transfer; retain identity, memory and Minerva route; accountant-sync remains deliberately unloaded |
-| `ai.aweb` on `aweb-agents` | Athena last seen 53 days ago; remote legacy home exists in inventory | Aweb and oats own archival inspection; do not resurrect as a continuing seat |
+| `ai.aweb` on `aweb-agents` | Aweb confirms Athena intentionally inactive; remote legacy home retained | Aweb and oats own archival inspection; do not resurrect as a continuing seat |
 | `~/awebai/demo-aweb/bob` | Live Pi demo | Aweb owns safe stop and archival disposition; it is not an operating-team migration |
 | `~/.turn-record` | Live Pi capture service under launchd | Retain as infrastructure; qualify record capture separately from standing seats |
 
@@ -101,7 +110,9 @@ uniquely named so no existing address has to be removed for the experiment.
 
 Merlin retains his identity; other continuing seats follow their accepted
 policy. Oats implemented explicit source-authority binding in oats.aweb 1.10.0,
-reviewed and pinned for the next kernel patch. A disposable rehearsal verified
+reviewed and shipped with OATS 0.22.3. Published oats.aweb 1.10.1 additionally
+requires an installed ambient Claude channel to be at least 1.7.9 for session
+delivery, matching the existing Pi extension floor of 0.3.10. A disposable rehearsal verified
 stable identity/address, existing conversations, heartbeat, exclusive holder
 refusal, rollback and authority-preserving retirement. Aweb supplied this
 supported handover:
@@ -247,11 +258,21 @@ the shared rollout record.
 - TSM's owner plan is `~/tsm/history/2026-09-06-tsm-oats-handover-plan.md`.
   Preserve the five seats' worktrees, skills and knowledge; re-arm Zeus's
   session-local schedules. Production credentials remain solely with the
-  authorized production operator. His plan reserves Zeus's final cutover
-  for Juan's presence; the other seats can prepare in the meantime.
-- BeadHub supplied its retained-identity and source-root brief through aweb
-  mail. It awaits the reviewed declarative binding and cutover recipe.
-  Its Stripe-account dependency and production cutover gates remain separate.
+  authorized production operator. Zeus remains last. Juan's current direction
+  authorizes completing the migration while he is away; the earlier
+  presence-only pause does not override it. Actual job and production boundaries
+  remain. Themis's ten-commit packet landed at `46cf2083`; its installed
+  oats.aweb 1.10.1 and oats.okf 1.5.0 passed the actual doctor. The other three
+  specialist briefs are being prepared at their work checkpoints.
+- BeadHub configuration/soul commit `3ee13a8` in `awebai/beadhub-saas`
+  (`~/awebai/beadhub/beadhub-saas`) was independently ACKed by lead and
+  landed on `main`. Its tracked deployment template is materialized at the canonical
+  parent workspace, with trusted official capabilities and a clean actual
+  doctor result. The soul retains SaaS Git provenance and uses workspace mode
+  as a coordinator across the three canonical repositories. Its legacy holder
+  remains live; authenticated harvest-model configuration is installed and
+  verified. The published broker service precedes activation. Stripe and
+  production gates remain separate.
 - Docflow supplied its own identity and handover through its terminal. Its
   backfill and register verification define the safe boundary. Preserve its
   Claude memory and existing credentials in place; verify filesystem/TCC
@@ -264,6 +285,77 @@ the shared rollout record.
   the cross-team coordinator identity/contact policy explicitly before
   relying on those routes; do not silently replace retained identities.
 - Real remote Claude launch, terminal input and detach survival passed.
-  Remote Desktop projection and exact-home lifecycle are under independent
-  review for the next patch. Remote harvester completion remains blocked by
-  provider authentication, and no standing remote seat is declared migrated.
+  Remote Desktop projection and exact-home lifecycle shipped in 0.22.3; the
+  installed remote CLI serves the real registered roster. Remote harvester
+  completion remains blocked by provider authentication, and no standing
+  remote seat is declared migrated.
+- The aweb broker candidate `30469e22` ran as a private launchd service against
+  published OATS 0.22.3. Real Claude and Codex sessions in tmux and Pi
+  in Herdr, with Claude channel 1.7.9 and Pi extension 0.3.10, fetched mail and replied with exact qualification tokens,
+  with all GUI viewers closed. Pi also answered a sender-waiting chat. Mail
+  sent while the broker was stopped was recovered after restart. After the
+  Codex harness stopped, its registration became inactive and a subsequent
+  message remained unread. Pause also survived a daemon restart, keeping mail
+  unread until resume, after which the agent replied. The candidate does not
+  fetch or acknowledge mail.
+  Published aw installation and standing-seat acceptance are still separate.
+- Qualification found that tmux output loses tab separators in a minimal
+  launchd environment without a UTF-8 locale. Independently reviewed kernel
+  fixes `a0b0e14` and `0260ea9` shipped in 0.22.4, adding UTF-8 mode to
+  lifecycle/input and viewer calls. The host service also specifies
+  `LC_ALL=en_US.UTF-8`. Existing Claude plugin 1.7.8 also consumed mail before
+  the broker wake; updating to 1.7.9 eliminated that competing delivery path.
+  The deployed oats.aweb 1.10.1 floor now rejects the incompatible version.
+
+- Cjr's second and third worker cycles completed on published kernel 0.22.3
+  and oats.okf 1.4.1 (note-fed). The
+  second promoted three reviewed concepts; the third read them before working,
+  produced the normal host-service health reader (`3dfe3acf`) and completed
+  its own reviewed harvest. Both harvesters self-retired without operator
+  completion. Each worker's ordinary retirement took four seconds and removed
+  its temporary alias. A post-merge fixture mismatch was corrected forward in
+  `e8a87c71`, with 47 tests green on a clean export. The reader's real service
+  check awaits installation of `ai.aweb.wake`.
+- A record-only harvest of the fresh Claude wake-test session completed with
+  official oats.okf 1.5.0. It read its 27-turn source window, found no durable
+  lesson to promote, advanced the completed watermark and self-retired. The
+  first attempt exposed an unnecessary SQLite index write during pure journal
+  reads; reviewed fix `f100320` shipped in 0.22.4. The shared capture service
+  and its large index were preserved. Completion is proven; this run does not
+  claim a knowledge promotion.
+- Docflow's two-commit preparation at `4458097` is independently ACKed: native
+  Claude, retained authority, session delivery and 18 valid curated OKF concepts.
+  Its owner is integrating and acquiring official packages. The running backfill
+  and FY2025 register checks still determine its activation boundary.
+- The tracked aweb coordinator soul at `0a3a9a91` is independently ACKed; the
+  frontend soul at `b3985edb` is owner-reviewed and landed. They preserve the
+  coordinator's workspace and the frontend's managed primary SaaS worktree plus
+  explicitly assigned secondary OSS tree. Lead and Oats coordinator souls are
+  also reviewed and landed. Concrete deployment configuration and final
+  checkpoints precede each launch.
+- OATS 0.22.4 is published at tag `0260ea9`, with npm packages and six Desktop
+  installers. CI retried once after a disappearing Git maintenance lock in a
+  fixture; kernel and Desktop gates then passed. A manual reviewed version-bump
+  PR completed the bot's permission-blocked post-publication step. Published
+  npm JavaScript bytes match the tag. Aweb 1.36.1 publication is still pending
+  a gateway build dependency download; the private candidate broker is not
+  being represented as the permanent published service.
+
+- Cjr's retained declaration/runbook packet is independently ACKed through
+  `6dc6efc8` (three commits); its source authority remains in place and operator
+  stop-before-start applies to rollback as well as cutover. Its two soul startup
+  corrections also landed after independent review at `bd981b3a`. Official
+  oats.aweb 1.10.1 and oats.okf 1.5.0 are now installed and trusted for both
+  standing souls. These newer pins do not relabel the earlier worker proofs.
+- TSM's Argos packet is integrated at `f20c54bb` after both independent and
+  owner ACKs; actual doctor resolves the two retained reviewer seats. BeadHub
+  and Themis supplied final private startup briefings and idle checkpoints.
+  Hermes and Prometeo were explicitly woken to read unseen followups and prepare
+  their continuation briefs; their legacy channels had not delivered those
+  requests reliably.
+- A locked-selector update gap found during actual team setup is corrected
+  on main at `d95018e` (two independently reviewed commits). The next kernel
+  patch supports `oats update <package> --to <ref>` or a positional catalog
+  spec. A hermetic CLI test exercises the version transition, trust reset and
+  invalid arguments, including refusal to enter the kernel self-updater when
+  a package is missing. This change is not yet part of installed 0.22.4.

package/docs/packages.md

@@ -30,7 +30,11 @@ default. Only the selected subtree is installed and hashed, so repository docs,
 CI configuration, owner souls, and sibling packages stay outside the package's
 payload and integrity. One repository may ship several packages at different
 paths. The lock pins the selected root in its own `path` field, and only an
-explicit `oats update <package>` may move it. See
+explicit `oats update <package>` may move it. A catalog lock with an explicit
+selector (`catalog:oats.aweb@v1.8.0`) keeps that selector on a plain update;
+to advance it to another published ref, give the spec or `--to`:
+`oats update oats.aweb oats.aweb@v1.10.1` or `oats update oats.aweb --to v1.10.1`
+(same transactional path, approvals invalidated, then `oats trust`). See
 [`design/package-engine-contract.md` §1.1](design/package-engine-contract.md).
 
 Ground truth for the contract: [`oats-package.schema.json`](oats-package.schema.json),

package/docs/release-notes/v0.22.4.md

@@ -0,0 +1,40 @@
+# OATS v0.22.4
+
+Two fixes found by running the wake broker and the record-fed harvester as
+real host services, the oats.aweb 1.10.1 floor, and the managed lead soul.
+
+## Session commands under a service locale
+
+launchd starts services without a UTF-8 locale, and tmux then replaces the
+tab delimiters in its list-panes output with underscores, so every session
+inspection from the wake broker reported an invalid pane. The shared session
+helper now runs tmux in UTF-8 mode (`-u`), which preserves the delimiters
+regardless of the service locale and makes typed input UTF-8-safe.
+
+## Record windows without the search index
+
+`recall --thread --json` used to open the record's SQLite search index just
+to extract turn text, and a capture indexing a large session cache could hold
+that database locked for longer than the harvester waits. Window reads now
+come from the journals alone; the search index opens only for indexed
+search, show and reindex.
+
+## Bundled: oats.aweb 1.10.1
+
+Session-mode delivery now requires an installed Claude Code channel plugin
+to be `aweb-channel` 1.7.9 or later (as it already required `@awebai/pi`
+0.3.10): an older plugin starts its own channel server beside the wake
+broker and can fetch a message before the broker delivers it.
+
+## Managed operating-lead soul
+
+`agents/lead/soul` is tracked: the operating lead's role instructions and
+two knowledge notes (runtime and messaging ownership; where rollout state
+lives), ready for a retained-identity binding at its cutover.
+
+## Also
+
+- `docs/operating-team-migration.md` records the published 0.22.3 rollout and
+  the live wake-broker acceptance on Claude, Codex and Pi.
+- oats.okf 1.5.1 (harvest-runtime, promotion exclusions, replan detector) is
+  not in this release; it ships when its independent review completes.

package/docs/release-notes/v0.22.5.md

@@ -0,0 +1,36 @@
+# OATS v0.22.5
+
+A small release: the knowledge package 1.5.1 pin, a way to move a pinned
+package lock from the CLI, and the operating records from the first team
+rollouts.
+
+## Bundled: oats.okf 1.5.1
+
+`harvest-runtime` chooses the harness that runs the memory harvester (pi,
+claude or codex; default pi), so a host authenticated for one harness need
+not authenticate another. No harness gets a vendor default: with no
+`harvest-model` set, the harvester inherits the harness's own configured
+model; `harvest-model` remains the way to pin a cheaper one. The promotion
+instructions exclude secrets, credentials and verbatim third-party message
+content from promotion. `okf harvest` warns instead of respawning when a
+plan's window boundaries did not move since the previous harvester was
+spawned.
+
+## Move a pinned package lock
+
+`oats update <package> <package>@<ref>` or `oats update <package> --to <ref>`
+moves a catalog-sourced lock to another published ref through the same
+transactional update (closure validation, lock replace, approvals
+invalidated, then `oats trust`). A plain `oats update <package>` keeps an
+explicit selector, as before, and `--to` without a package is refused rather
+than falling through to the kernel self-update (`oats update` with no
+package).
+
+## Also
+
+- The managed oats coordinator soul (`agents/oats-coordinator/soul`) is
+  tracked, with playbooks for the release lane, payload publication and
+  review routing.
+- `docs/operating-team-migration.md` records the installed 0.22.4 rollout,
+  the completed record-fed and note-fed harvest cycles, and the standing
+  seats prepared for cutover.

package/lib/core.mjs

@@ -3343,6 +3343,8 @@ export function updatePackage(startDir, packageId, opts = {}) {
   // the user's own selection, so it is re-appended and stays sticky across
   // updates; a catalog entry OWNS its path, so an update deliberately re-reads it
   // and may adopt a moved root (reported below).
+  if (opts.spec && src.kind !== "catalog") throw oatsError("invalid-source", `package "${packageId}" is locked from a ${src.kind} source; a selector (--to) applies to catalog-sourced packages only (its source is ${entry.source})`);
+  if (opts.spec && parsePackageSource(opts.spec).id !== src.id) throw oatsError("invalid-source", `selector spec "${opts.spec}" names a different catalog package than the lock's ${src.id}`);
   const spec = opts.spec || (src.kind === "catalog" ? (src.selector ? `${src.id}@${src.selector}` : src.id)
     : src.kind === "git" ? `${src.ref && !/^[0-9a-f]{40}$/.test(src.ref) ? `${src.url}@${src.ref}` : src.url}#${entry.path}`
       : src.path);

package/lib/session-input.mjs

@@ -6,7 +6,9 @@ import { inspectHerdr, inputHerdr, herdrCommand } from "./herdr.mjs";
 
 const shells = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "login"]);
 function tmux(target, args, { exec = execFileSync, input } = {}) {
-  return exec("tmux", ["-S", target.socket, ...args], {
+  // launchd does not supply a UTF-8 locale. In that environment tmux replaces
+  // the tab delimiters in list-panes output with underscores unless forced.
+  return exec("tmux", ["-u", "-S", target.socket, ...args], {
     encoding: "utf8", input, timeout: 10000, maxBuffer: 1024 * 1024,
     stdio: ["pipe", "pipe", "pipe"],
   });

package/lib/session-viewer.mjs

@@ -10,7 +10,9 @@ export function prepareSessionViewer(target, { exec = execFileSync } = {}) {
     delete env.HERDR_SESSION;
     return { binary: target.binary, args: ["terminal", "attach", target.terminalId], env, cleanup() {} };
   }
-  const run = (args) => exec("tmux", ["-S", target.socket, ...args], {
+  // UTF-8 mode (-u) like the shared session helper: a service without a
+  // UTF-8 locale (launchd) otherwise mangles tmux output.
+  const run = (args) => exec("tmux", ["-u", "-S", target.socket, ...args], {
     encoding: "utf8", timeout: 10000, stdio: ["ignore", "pipe", "pipe"],
   }).trim();
   const viewer = `oatsview-${process.pid}-${randomUUID().slice(0, 8)}`;
@@ -28,7 +30,7 @@ export function prepareSessionViewer(target, { exec = execFileSync } = {}) {
     run(["bind-key", "-T", "oatsview-locked", "WheelUpPane", "if-shell", "-F", "#{||:#{pane_in_mode},#{mouse_any_flag}}", "send-keys -M", "copy-mode -e; send-keys -M"]);
     run(["set-option", "-t", viewer, "mouse", "on"]);
     const env = { ...process.env }; delete env.TMUX;
-    return { binary: "tmux", args: ["-S", target.socket, "attach-session", "-t", `=${viewer}`], env, cleanup };
+    return { binary: "tmux", args: ["-u", "-S", target.socket, "attach-session", "-t", `=${viewer}`], env, cleanup };
   } catch (e) { cleanup(); throw e; }
 }
 

package/package-catalog.json

@@ -2,12 +2,12 @@
   "packages": {
     "oats.okf": {
       "url": "https://github.com/awebai/oats-okf.git",
-      "ref": "v1.5.0",
+      "ref": "v1.5.1",
       "path": "oats-package"
     },
     "oats.aweb": {
       "url": "https://github.com/awebai/oats-aweb.git",
-      "ref": "v1.10.0",
+      "ref": "v1.10.1",
       "path": "oats-package"
     },
     "oats.jira": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.22.3",
+  "version": "0.22.5",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/packages/record/bin/recall.mjs

@@ -23,7 +23,7 @@ import { join } from "node:path";
 import process from "node:process";
 
 import { RecordStore } from "../lib/store.mjs";
-import { RecordIndex } from "../lib/index-db.mjs";
+import { extractTurnText, RecordIndex } from "../lib/index-db.mjs";
 
 function parseArgs(argv) {
   const args = { _: [] };
@@ -40,16 +40,19 @@ function parseArgs(argv) {
 const args = parseArgs(process.argv.slice(2));
 const root = args.root ?? process.env.TURN_RECORD_ROOT ?? join(homedir(), ".turn-record");
 const store = new RecordStore(root, {});
-const index = new RecordIndex(store);
+let index;
+const getIndex = () => (index ??= new RecordIndex(store));
 
 try {
   if (args.reindex) {
+    const index = getIndex();
     index.rebuild();
     console.log(JSON.stringify(index.counts()));
     process.exit(0);
   }
 
   if (args.show) {
+    const index = getIndex();
     const { resolveTurn } = await import("../lib/index-db.mjs");
     const byId = store.readAll();
     const turn = resolveTurn(store, index, args.show, byId);
@@ -111,7 +114,7 @@ try {
     // A window is a bounded read: a consumer that plans one (the OKF
     // harvester) sizes it with --ids-only first, then reads exactly that.
     const out = window.map((t) => {
-      const docs = index.extractText(t);
+      const docs = extractTurnText(t);
       const base = { id: t.id, ts: t.ts, thread: t.thread, kind: t.kind, source: t.provenance?.source ?? null };
       const full = { ...base, text: docs.map((d) => ({ role: d.role, text: d.text })) };
       // bytes = what this turn occupies in the pretty-printed --json answer,
@@ -123,6 +126,7 @@ try {
     process.exit(0);
   }
 
+  const index = getIndex();
   const limit = args.limit ? Number(args.limit) : 20;
   let rows;
   if (query) {
@@ -164,5 +168,5 @@ try {
     console.log(`    ${r.id}`);
   }
 } finally {
-  index.close();
+  index?.close();
 }

package/packages/record/lib/index-db.mjs

@@ -413,20 +413,7 @@ export class RecordIndex {
   // Text documents for one turn. Mail/chat: one doc. Session: one doc per
   // conversational event extracted from the transcript blob.
   extractText(turn) {
-    if (turn.kind === "note" && turn.body?.segment) return []; // dedicated role "segment" row
-    if (turn.kind === "mail" || turn.kind === "chat" || turn.kind === "note") {
-      const subject = turn.body?.subject ?? "";
-      const text = turn.body?.text ?? "";
-      const joined = subject ? subject + "\n" + text : text;
-      return joined.trim() ? [{ loc: "", role: turn.kind, text: joined }] : [];
-    }
-    if (turn.kind === "session" && typeof turn.body?.line === "string") {
-      const loc = `line:${turn.provenance?.origin?.line ?? 0}`;
-      return extractSessionTextFor(turn.provenance?.source, Buffer.from(turn.body.line, "utf8")).map(
-        (d) => ({ ...d, loc }),
-      );
-    }
-    return [];
+    return extractTurnText(turn);
   }
 
   // FTS query with optional filters. Returns rows with turn metadata and a
@@ -502,6 +489,24 @@ export class RecordIndex {
   }
 }
 
+// Journal text extraction is independent of the derived search database.
+export function extractTurnText(turn) {
+  if (turn.kind === "note" && turn.body?.segment) return []; // dedicated role "segment" row
+  if (turn.kind === "mail" || turn.kind === "chat" || turn.kind === "note") {
+    const subject = turn.body?.subject ?? "";
+    const text = turn.body?.text ?? "";
+    const joined = subject ? subject + "\n" + text : text;
+    return joined.trim() ? [{ loc: "", role: turn.kind, text: joined }] : [];
+  }
+  if (turn.kind === "session" && typeof turn.body?.line === "string") {
+    const loc = `line:${turn.provenance?.origin?.line ?? 0}`;
+    return extractSessionTextFor(turn.provenance?.source, Buffer.from(turn.body.line, "utf8")).map(
+      (d) => ({ ...d, loc }),
+    );
+  }
+  return [];
+}
+
 // Claude Code text extraction, re-exported for compatibility; the
 // per-format extractors live in formats.mjs.
 export const extractSessionText = extractCcText;