@gcunharodrigues/wrxn 0.20.2 → 0.21.1

package/bin/wrxn.cjs

@@ -15,6 +15,7 @@ const connect = require('../lib/connect.cjs');
 const ship = require('../lib/ship.cjs');
 const protect = require('../lib/protect.cjs');
 const release = require('../lib/release.cjs');
+const releaseCut = require('../lib/release-cut.cjs');
 const brain = require('../lib/brain.cjs');
 const statusline = require('../lib/statusline.cjs');
 const { convert } = require('../lib/convert.cjs');
@@ -142,6 +143,16 @@ Usage:
                                  running it (a non-destructive preview). Stops at the first failing
                                  step (a failed push never opens a PR).
 
+  wrxn release [minor|patch|major] [--base <main>] [--root <dir>]
+                                 one-command deliberate release (ADR 0010): bump package.json+lock,
+                                 commit chore(release): <pkg> X.Y.Z on chore/release-X.Y.Z, then
+                                 delegate push → PR (base main) → arm auto-merge to the ship path. The
+                                 level is auto-computed from conventional commits since the last tag
+                                 (REUSE release-check); pass minor|patch|major to force it. Does NOT
+                                 publish or tag — CD publishes on merge. Repo-agnostic (cwd package.json
+                                 + git). Refuses loud (no mutation) when it can't safely release: not on
+                                 main, dirty tree, behind origin/main, or nothing releasable + no level.
+
   wrxn protect [--root <dir>]    apply the wrxn-main-gate server-side ruleset to this repo's origin —
                                  the hard gate that replaces the settings.local.json env-flag dance:
                                  block direct push to the default branch, require a PR + the wrxn-ci
@@ -544,6 +555,29 @@ async function main(argv) {
     return 2;
   }
 
+  if (cmd === 'release') {
+    // One-command deliberate release (ADR 0010): compute the bump (explicit level, else auto from
+    // conventional commits since the last tag — REUSE release-check) → npm version → commit
+    // chore(release) on chore/release-X.Y.Z → DELEGATE push/PR/arm to the ship path. Does NOT publish
+    // or tag — CD owns that on merge. Repo-agnostic (operates on the cwd package.json + git). The git/
+    // npm/ship side effects run through release-cut's realDeps (real invocation). Refuses loud (exit 2,
+    // NO mutation) on: not on main / dirty tree / behind origin/main / nothing releasable + no level.
+    const root = path.resolve(args.flags.root || process.cwd());
+    const arg = args._[1]; // optional minor|patch|major
+    const base = args.flags.base || releaseCut.DEFAULT_BASE;
+    const res = releaseCut.cutRelease({ arg, base, root });
+    if (res.refused) {
+      process.stderr.write(`wrxn: refusing to release — ${res.reason} (nothing changed)\n`);
+      return 2;
+    }
+    if (!res.ok) {
+      process.stderr.write(`wrxn: release failed at "${res.step}"${res.detail ? ` — ${res.detail}` : ''}\n`);
+      return 2;
+    }
+    process.stdout.write(`released ${res.version} (${res.bump}, ${res.source}) — committed ${res.branch}, delegated to ship → PR on ${res.base} with auto-merge armed (CD publishes on merge)\n`);
+    return 0;
+  }
+
   if (cmd === 'protect') {
     // Apply the wrxn-main-gate server-side ruleset to this repo's origin — the hard gate that replaces
     // the disarmable settings.local.json env-flag dance (ADR 0007). Repo-agnostic: the slug is read from

package/lib/release-cut.cjs

@@ -0,0 +1,160 @@
+'use strict';
+
+// wrxn release — one-command deliberate release (PRD #101 / issue #102).
+//
+// Collapses the manual 4-step chore(release) dance into one command: compute the bump, apply
+// `npm version <bump> --no-git-tag-version`, commit `chore(release): <pkg> X.Y.Z` on
+// `chore/release-X.Y.Z`, then DELEGATE push → PR(base main) → arm-auto-merge to the existing
+// `wrxn ship` path. It does NOT publish or tag — CD owns that on merge (ADR 0010).
+//
+// REUSE > CREATE: the bump is computed by lib/release.cjs's `shouldRelease` (the release-check
+// type-gate; its previously-vestigial `bump` is now consumed); the push/PR/arm is the existing
+// lib/ship.cjs `ship`. New code is only the thin orchestration + guards.
+//
+// Side effects go through an INJECTED `deps` boundary (readState / applyBump / commit / ship),
+// defaulting to the real git/npm/gh impls — so the whole flow is unit-testable with NO live push.
+// This mirrors lib/ship.cjs's injected invoker, finer-grained per the tdd skill's mocking.md
+// ("SDK-style boundary functions over one generic fetcher": each boundary returns one shape).
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { shouldRelease, parseLog } = require('./release.cjs');
+const ship = require('./ship.cjs');
+
+const BUMPS = ['major', 'minor', 'patch'];
+const TRUNK = 'main';
+const DEFAULT_BASE = 'main';
+
+function refusal(reason) {
+  return { ok: false, refused: true, reason };
+}
+
+/**
+ * Decide the release bump. PURE. An explicit level wins; otherwise it is auto-computed from the
+ * conventional commits since the last tag (REUSE lib/release.cjs's release-check classifier — its
+ * once-vestigial `bump` output is now consumed). No level AND nothing releasable → refuse.
+ * @returns {{ bump:string, source:'explicit'|'auto' } | { refuse:true, reason:string }}
+ * @throws on an unknown explicit level (a malformed release is never runnable).
+ */
+function decideBump({ arg, commits, lastTag } = {}) {
+  if (arg != null && arg !== '') {
+    if (!BUMPS.includes(arg)) throw new Error(`unknown release level "${arg}" — expected ${BUMPS.join(' | ')}`);
+    return { bump: arg, source: 'explicit' };
+  }
+  const { release, bump } = shouldRelease(commits || []);
+  if (!release) return { refuse: true, reason: `nothing to release since ${lastTag || 'the last release'}` };
+  return { bump, source: 'auto' };
+}
+
+/**
+ * The branch + PR title a release commits and ships, derived from the package name and the
+ * post-bump version. PURE. Version is passed through verbatim so prerelease tags (recon-wrxn's
+ * `6.0.0-wrxn.N`) survive — npm version is the authority on the new version, not this helper.
+ * @returns {{ branch:string, title:string }}
+ * @throws when name or version is missing.
+ */
+function releaseSpec({ name, version } = {}) {
+  if (!name || !version) throw new Error('releaseSpec requires a package name and version');
+  return {
+    branch: `chore/release-${version}`,
+    title: `chore(release): ${name} ${version}`,
+  };
+}
+
+/**
+ * Cut a deliberate release. Guards (each refuses loud, non-zero, NO mutation) → bump decision →
+ * npm version → commit → delegate to ship. Side effects run through the injected `deps` boundary.
+ * @returns {{ ok:true, ... } | { ok:false, refused?:true, reason?:string, step?:string, detail?:string }}
+ */
+function cutRelease({ arg, base = DEFAULT_BASE, root, deps } = {}) {
+  const d = deps || realDeps(root || process.cwd());
+  const state = d.readState();
+  // ── guards ──
+  if (state.branch !== TRUNK) return refusal(`not on ${TRUNK} (on "${state.branch}") — release is cut from ${TRUNK}`);
+  if (state.dirty) return refusal('the working tree is dirty — commit or stash before releasing');
+  if (state.behind > 0) return refusal(`behind origin/${TRUNK} by ${state.behind} — pull before releasing`);
+  // ── bump decision (explicit arg wins; else auto from commits since the tag; else refuse) ──
+  let decision;
+  try {
+    decision = decideBump({ arg, commits: state.commits, lastTag: state.lastTag });
+  } catch (err) {
+    return refusal(err.message);
+  }
+  if (decision.refuse) return refusal(decision.reason);
+  // ── mutate: npm version (the version authority) → commit chore(release) → delegate to ship ──
+  const applied = d.applyBump(decision.bump);
+  if (!applied.ok) return { ok: false, step: 'npm-version', detail: applied.detail };
+  const spec = releaseSpec({ name: state.name, version: applied.newVersion });
+  const committed = d.commit({ branch: spec.branch, title: spec.title });
+  if (!committed.ok) return { ok: false, step: 'commit', detail: committed.detail };
+  const shipped = d.ship({ branch: spec.branch, title: spec.title, base });
+  if (!shipped.ok) return { ok: false, step: 'ship', failed: shipped.failed, detail: shipped.detail, branch: spec.branch };
+  return {
+    ok: true,
+    bump: decision.bump,
+    source: decision.source,
+    version: applied.newVersion,
+    branch: spec.branch,
+    title: spec.title,
+    base,
+  };
+}
+
+/**
+ * The real side-effect boundary (the CLI layer wires this — what makes the release "validated by
+ * invocation"). Each method is one SDK-style operation over the cwd repo, repo-agnostic (reads the
+ * package.json + git in `root`, so the SAME command releases wrxn-kernel and recon-wrxn):
+ *   readState — current branch, dirty, behind origin/main, last tag, commits since it, pkg name/version
+ *   applyBump — `npm version <bump> --no-git-tag-version`; npm is the version authority (returns it)
+ *   commit    — branch chore/release-X.Y.Z, stage package.json (+ lockfile if present), commit
+ *   ship      — REUSE lib/ship.cjs (push → PR base main → arm auto-merge); NOT reimplemented here
+ */
+function realDeps(root) {
+  const git = (...a) => execFileSync('git', ['-C', root, ...a], { encoding: 'utf8' }).trim();
+  return {
+    readState() {
+      let branch = '';
+      try { branch = git('branch', '--show-current'); } catch { branch = ''; }
+      let dirty = false;
+      try { dirty = git('status', '--porcelain') !== ''; } catch { dirty = false; }
+      // Best-effort fetch so "behind" reflects the real remote; never block on a fetch failure
+      // (offline / no remote) — the server-side require-up-to-date ruleset is the hard gate.
+      try { execFileSync('git', ['-C', root, 'fetch', 'origin', TRUNK, '--quiet'], { stdio: 'ignore' }); } catch { /* offline / no remote */ }
+      let behind = 0;
+      try { behind = parseInt(git('rev-list', '--count', `HEAD..origin/${TRUNK}`), 10) || 0; } catch { behind = 0; }
+      let lastTag = '';
+      try { lastTag = git('describe', '--tags', '--abbrev=0'); } catch { lastTag = ''; }
+      let commits = [];
+      try { commits = parseLog(git('log', '--format=%B%x00', lastTag ? `${lastTag}..HEAD` : 'HEAD')); } catch { commits = []; }
+      const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+      return { branch, dirty, behind, lastTag, commits, name: pkg.name, version: pkg.version };
+    },
+    applyBump(bump) {
+      try {
+        execFileSync('npm', ['version', bump, '--no-git-tag-version'], { cwd: root, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+        const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+        return { ok: true, newVersion: pkg.version };
+      } catch (err) {
+        return { ok: false, detail: `npm version ${bump} failed: ${err.message}` };
+      }
+    },
+    commit({ branch, title }) {
+      try {
+        git('checkout', '-b', branch);
+        const files = ['package.json'];
+        if (fs.existsSync(path.join(root, 'package-lock.json'))) files.push('package-lock.json');
+        git('add', '--', ...files);
+        git('commit', '-m', title);
+        return { ok: true };
+      } catch (err) {
+        return { ok: false, detail: `commit failed: ${err.message}` };
+      }
+    },
+    ship({ branch, title, base }) {
+      return ship.ship({ branch, title, base }); // real defaultInvoke (git push + gh)
+    },
+  };
+}
+
+module.exports = { decideBump, releaseSpec, cutRelease, realDeps, BUMPS, DEFAULT_BASE };

package/lib/release.cjs

@@ -60,4 +60,17 @@ function decidePublish({ typeRelease, versionOnNpm } = {}) {
   return Boolean(typeRelease) || !versionOnNpm;
 }
 
-module.exports = { shouldRelease, parseLog, decidePublish };
+/**
+ * decideWarn({ typeRelease, versionOnNpm }) → boolean. The silent-skip detector (#103): warn when the
+ * merged commits warrant a type release AND package.json.version is already on npm. In that case
+ * decidePublish is true (typeRelease), so the run proceeds — but the publish step's idempotency guard
+ * skips the already-published version, so nothing reaches npm: the releasable commits silently never
+ * ship. The workflow turns this into a visible `::warning::` to run `wrxn release` (bump + publish).
+ * Pure — the npm probe stays in the workflow. False for a normal publish (versionOnNpm false) and for
+ * non-release merges (the idempotent no-op is expected, not a mistake).
+ */
+function decideWarn({ typeRelease, versionOnNpm } = {}) {
+  return Boolean(typeRelease) && Boolean(versionOnNpm);
+}
+
+module.exports = { shouldRelease, parseLog, decidePublish, decideWarn };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.20.2",
+  "version": "0.21.1",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/skills/chat-search/SKILL.md

@@ -17,7 +17,7 @@ user-invocable: true
 - **Event log** — `.wrxn/events/*.jsonl`, the per-session, secret-redacted **user prompts** emit-event.cjs appends.
 - **Harness transcript** — `~/.claude/projects/<slug>/*.jsonl`, the only source of **assistant** turns and full user/assistant **message content**. The `<slug>` is the project's absolute path with every non-alphanumeric character replaced by `-` (how the harness names the dir). The transcript arm is **hygiene-cleaned** before matching (see below).
 
-A prompt that appears in **both** arms is de-duplicated — by `(session, timestamp, text)` — so it surfaces once. If the transcript dir is **missing or unreadable**, the search **degrades loudly to events-only** and says so in the output (it never crashes).
+A prompt that appears in **both** arms is de-duplicated — by `(session, whitespace-normalized text, timestamp within a tight window)` — so a single turn surfaces once even when its two arms stamp it ms apart or differ by whitespace. If the transcript dir is **missing, unreadable, or wholesale-drifted** (present but every line an unknown type, so it yields no usable turn), the search **degrades loudly to events-only** and says so in the output (it never crashes).
 
 Three optional flags refine a search — `--session` (scope to one session), `--since` (a time floor), and `--regex` (pattern match instead of substring). They compose with each other and with both arms. See **Scoping & match flags** below.
 
@@ -51,8 +51,8 @@ When the operator references an earlier moment ("like we discussed", "the decisi
 
 All three are optional, compose with each other, and apply across **both arms** (so scoping/filtering also covers assistant turns), preserving recency order and cross-arm dedup.
 
-- **`--session <id>`** — scope results to a single session (exact match on the session id). The id is the harness/event session id (letters, digits, `-`, `_`); a malformed id is rejected. Scoped rows render as `this session`.
-- **`--since <when>`** — keep only hits at or after a timestamp floor. `<when>` is either `today` (from 00:00 **UTC** of the current day — record stamps are UTC) or an ISO-8601 date/datetime (e.g. `2026-06-26` or `2026-06-26T12:00:00Z`). An undatable hit is excluded.
+- **`--session <id>`** — scope results to a single session (exact match on the session id). The id is the harness/event session id (letters, digits, `-`, `_`); a malformed id is rejected. Scoping only *narrows* the rows — it does **not** relabel them: the `this session` label tracks the genuinely-live session (`CLAUDE_SESSION_ID`), so scoping to a **past** session shows its real id, not `this session`.
+- **`--since <when>`** — keep only hits at or after a timestamp floor. `<when>` is either `today` (from 00:00 **UTC** of the current day — record stamps are UTC) or an ISO-8601 date/datetime (e.g. `2026-06-26` or `2026-06-26T12:00:00Z`). A datetime **without an explicit zone** is read as **UTC** (matching the record stamps), not machine-local time. An undatable hit is excluded.
 - **`--regex`** — match the search term as a **regular expression** instead of a case-insensitive substring. Regex mode is **case-sensitive** (the universal regex default; the substring default stays case-insensitive).
 
 ```bash
@@ -71,9 +71,9 @@ Hits are **most-recent-first**, one per line:
 ```
 
 - `role` is `user` (event log or a user transcript turn) or `assistant` (a transcript turn).
-- The session column collapses to `this session` for hits from the active session.
+- The session column collapses to `this session` for hits from the genuinely-live session (`CLAUDE_SESSION_ID`), independent of any `--session` scope.
 - No match → an explicit `chat-search: nothing found for "<term>" ...` line (never silence, never a crash).
-- If the transcript arm is unavailable, a trailing `chat-search: transcript arm unavailable — showing event-log results only.` line is appended (loud degrade).
+- If the transcript arm is unavailable (missing, unreadable, or wholesale-drifted), a trailing `chat-search: transcript arm unavailable — showing event-log results only.` line is appended (loud degrade).
 
 ## Boundaries
 

package/payload/.wrxn/chat-search.cjs

@@ -38,10 +38,12 @@ function snippetFor(text, matchesLine) {
 }
 
 // ── render: one hit → "timestamp · session (or 'this session') · role · snippet" ──
-// The session column collapses to "this session" when the hit is from the caller's active session
-// (opts.session), so a result set reads as scrollback relative to where the operator stands now.
+// The session column collapses to "this session" when the hit is from the caller's genuinely-LIVE session
+// (opts.activeSession — the CLI wires it from CLAUDE_SESSION_ID), so a result set reads as scrollback relative
+// to where the operator stands now. This is DECOUPLED from the --session SCOPE filter (opts.session): scoping
+// to a PAST session narrows the rows but never relabels them "this session" (#98).
 function renderHit(hit, opts) {
-  const active = opts && opts.session;
+  const active = opts && opts.activeSession;
   const sessionLabel = active && hit.session === active ? 'this session' : hit.session;
   return `${hit.ts} · ${sessionLabel} · ${hit.role} · ${hit.snippet}`;
 }
@@ -89,7 +91,8 @@ const INJECTED_STRIP_MAX = 65536;
 // Strip hook-injected framework-context blocks from one text part BEFORE matching. Two phases: (1) every
 // well-delimited <tag>…</tag> block anywhere; (2) a part-LEADING unclosed <tag>… (transcript truncated
 // mid-block) to end-of-part — anchored so a sentinel merely MENTIONED mid-prose keeps its tail. PURE and
-// FAIL-OPEN: any fault returns the input unchanged. Byte-faithful copy of memory-synth.cjs (#62).
+// FAIL-OPEN: any fault returns the input unchanged. Logic-identical to memory-synth.cjs's stripInjectedContext
+// (#62) — same strip semantics, not a byte-for-byte copy (and the 64KB strip cap is the inherited #62 tradeoff).
 function stripInjectedContext(text) {
   try {
     let out = String(text || '');
@@ -223,7 +226,12 @@ function parseSince(raw) {
     d.setUTCHours(0, 0, 0, 0);
     return d.getTime();
   }
-  const t = Date.parse(s);
+  // N3 (#99): record stamps are UTC, but Date.parse reads an ISO datetime WITH a time component and NO zone
+  // designator ("2026-06-26T12:00:00") as MACHINE-LOCAL time — silently shifting the floor by the host offset.
+  // Normalize it to UTC by appending Z. A date-only form (no 'T') is already UTC under Date.parse, and an
+  // explicit zone (trailing Z or a ±HH[:MM] offset) is honored as written — both pass through untouched.
+  const normalized = /[tT]/.test(s) && !/[zZ]$/.test(s) && !/[+-]\d{2}(:?\d{2})?$/.test(s) ? `${s}Z` : s;
+  const t = Date.parse(normalized);
   if (Number.isNaN(t)) {
     throw inputError(`chat-search: --since value "${raw}" is not a date — use "today" or an ISO-8601 date (e.g. 2026-06-26)`);
   }
@@ -314,6 +322,23 @@ function compileUserRegex(pattern) {
   }
 }
 
+// ── cross-arm dedup identity (#97) ─────────────────────────────────────────────
+// The SAME prompt reaches both arms stamped by DIFFERENT processes: emit-event.cjs writes the event ts at
+// hook-fire, the harness writes the transcript timestamp when it persists the turn — they differ by ms — and
+// the transcript text can differ from the event text by whitespace (hygiene strip, soft-wrap). So the dedup
+// identity is (session, whitespace-normalized text, ts within a TIGHT ±window), NOT an exact triple. The
+// window is 2s: a single turn's two stamps land within ~1s in practice, while two genuinely-distinct prompts
+// are seconds-to-minutes apart AND (almost always) differ in text — so the window only ever collapses what is
+// really one turn. The normalized text is the primary discriminator; the window only absorbs the writer
+// clock-skew on an otherwise-identical turn (two distinct prompts inside the window keep their distinct text,
+// so they never merge; the same text outside the window stays two distinct moments).
+const DEDUP_WINDOW_MS = 2000;
+// Normalize a message's text for the dedup key: trim the ends and collapse every interior whitespace run
+// (spaces, tabs, newlines) to a single space, so an event/transcript pair that differs only in spacing keys alike.
+function normalizeForDedup(text) {
+  return String(text).trim().replace(/\s+/g, ' ');
+}
+
 // ── the engine seam ───────────────────────────────────────────────────────────
 // searchConversationalLog(query, opts, roots): scan BOTH arms across the given roots' sessions and return
 // the turns that match `query` — a case-insensitive substring by default, or (opts.regex) the compiled
@@ -325,7 +350,7 @@ function searchConversationalLog(query, opts, roots) {
   const q = String(query == null ? '' : query);
   const needle = q.toLowerCase();
   const hits = [];
-  const seen = new Set(); // a prompt present in BOTH arms (same session+ts+text) must surface only once.
+  const seen = new Map(); // dedup index (#97): `${session}${normText}` → [{ tsMs, ts }] already surfaced; a near-stamp match collapses cross-arm duplicates.
   let degraded = false; // set when the transcript arm could not be consulted → loud events-only degrade (#84).
 
   // ── slice-3 filters (#85): each is an opts field applied per-record inside consider(), so it composes
@@ -344,9 +369,21 @@ function searchConversationalLog(query, opts, roots) {
     if (sessionScope != null && session !== sessionScope) return; // --session: exact-match a single session
     if (typeof text !== 'string' || !lineMatches(text)) return; // --regex pattern, else case-insensitive substring
     if (sinceThreshold != null && !(Date.parse(ts) >= sinceThreshold)) return; // --since: drop hits before the floor (an undatable ts → NaN → dropped)
-    const key = `${session}${ts}${text}`; // the AC dedup key — NUL-joined so the parts can't bleed.
-    if (seen.has(key)) return;
-    seen.add(key);
+    // Cross-arm dedup (#97): same session + whitespace-normalized text + a ts within the tight window = the
+    // same turn → surface once. NUL-joined so session and text can't bleed. An undatable or exactly-equal
+    // stamp falls back to ts-string equality, so an unparseable ts still collapses its exact twin.
+    const key = `${session}${normalizeForDedup(text)}`;
+    const tsMs = Date.parse(ts);
+    const prior = seen.get(key);
+    if (prior) {
+      const dup = prior.some(
+        (e) => (Number.isFinite(tsMs) && Number.isFinite(e.tsMs) && Math.abs(e.tsMs - tsMs) <= DEDUP_WINDOW_MS) || e.ts === ts,
+      );
+      if (dup) return; // a near-identical turn from the other arm (or an exact twin) already surfaced
+      prior.push({ tsMs, ts });
+    } else {
+      seen.set(key, [{ tsMs, ts }]);
+    }
     hits.push({ ts, session, role, snippet: snippetFor(text, lineMatches) });
   }
 
@@ -388,6 +425,7 @@ function searchConversationalLog(query, opts, roots) {
     if (!tfiles) {
       degraded = true;
     } else {
+      let recognizedTurns = 0; // user/assistant turns this dir yielded; zero across a non-empty dir = wholesale drift (#99 F3)
       for (const file of tfiles) {
         let lines;
         try {
@@ -404,12 +442,17 @@ function searchConversationalLog(query, opts, roots) {
             continue; // skip a malformed transcript line, never crash the scan
           }
           if (!rec || (rec.type !== 'user' && rec.type !== 'assistant')) continue; // only user/assistant turns; unknown line types (summary/system/…) skipped
+          recognizedTurns++; // a recognized turn (matchable or not) → this dir is NOT wholesale-drifted (#99 F3)
           // hygiene pipeline: flatten → strip injected framework context (a block holding the term is not a
           // hit) → redact secrets (raw chat can echo a credential; scrub BEFORE it can surface in a snippet).
           const text = redactSecrets(stripInjectedContext(transcriptText(rec)));
           consider(rec.timestamp, rec.sessionId, rec.type, text);
         }
       }
+      // F3 (#99): a present, readable dir whose EVERY line is an unknown type yielded zero usable turns — the
+      // arm is effectively unavailable → loud events-only degrade. Per-RECORD drift (some good turns) stays
+      // silent, and a present-but-empty dir ([]) is reachable-but-nothing and stays silent, both as before.
+      if (tfiles.length > 0 && recognizedTurns === 0) degraded = true;
     }
   }
 
@@ -446,13 +489,16 @@ function findInstallRoot(start) {
   return null;
 }
 
-// Value of a --name <value> flag. A following token that is itself a --flag (or a missing value) is NOT
-// consumed as the value — so `--session --regex` can't silently swallow --regex as the session id.
+// Value of a --name <value> flag, or undefined when the flag is ABSENT (optional). A PRESENT flag whose value
+// is missing or is itself a --flag fails LOUD (N2, #99) — parity with `--session ""`, never a silent
+// scope-widening drop: so `--session --regex` can't swallow --regex as the id and a trailing `--since` can't
+// vanish. The throw is userFacing, so main()'s catch prints one clean line and exits non-zero.
 function flag(name) {
   const i = process.argv.indexOf(`--${name}`);
   if (i < 0) return undefined;
   const val = process.argv[i + 1];
-  return val == null || val.startsWith('--') ? undefined : val;
+  if (val == null || val.startsWith('--')) throw inputError(`chat-search: --${name} requires a value`);
+  return val;
 }
 
 // Presence of a boolean --name flag (e.g. --regex), which carries no value.
@@ -476,34 +522,39 @@ function main() {
     process.stdout.write('Usage: node .wrxn/chat-search.cjs <search-term...> [--root <dir>] [--session <id>] [--since <when>] [--regex]\n');
     process.exit(2);
   }
-  const root = flag('root') || findInstallRoot();
-  if (!root) {
-    process.stderr.write('chat-search: cannot resolve the install root — run inside a wrxn install or pass --root <dir>\n');
-    process.exit(2);
-  }
-  // Wire the slice-3 flags (#85) into engine opts. The engine validates them (it throws a clean, user-facing
-  // error on a bad regex / unparseable --since); the CLI catch below prints that one line and exits non-zero.
-  const opts = {};
-  const session = flag('session');
-  if (session !== undefined) opts.session = session;
-  const since = flag('since');
-  if (since !== undefined) opts.since = since;
-  if (hasFlag('regex')) opts.regex = true;
-
-  let result;
+  // Flag parsing AND the engine call live inside ONE user-facing try: a value-flag with a missing/--prefixed
+  // value (flag(), N2 #99) and a bad regex / unparseable --since (the engine) both throw a clean userFacing
+  // error → the catch prints that one line and exits non-zero (never a Node stack or absolute path).
   try {
-    result = searchConversationalLog(terms.join(' '), opts, root);
+    const root = flag('root') || findInstallRoot();
+    if (!root) {
+      process.stderr.write('chat-search: cannot resolve the install root — run inside a wrxn install or pass --root <dir>\n');
+      process.exit(2);
+    }
+    // Wire the slice-3 flags (#85) into engine opts.
+    const opts = {};
+    const session = flag('session');
+    if (session !== undefined) opts.session = session;
+    const since = flag('since');
+    if (since !== undefined) opts.since = since;
+    if (hasFlag('regex')) opts.regex = true;
+    // The "this session" label tracks the genuinely-LIVE session (Claude Code exports CLAUDE_SESSION_ID), NOT
+    // the --session SCOPE filter — so scoping to a PAST session never relabels its rows "this session" (#98).
+    const activeSession = process.env.CLAUDE_SESSION_ID;
+    if (activeSession) opts.activeSession = activeSession;
+
+    const result = searchConversationalLog(terms.join(' '), opts, root);
+    process.stdout.write(result.rendered + '\n');
+    process.exit(0);
   } catch (err) {
     if (err && err.userFacing) {
-      // invalid flag input (bad/catastrophic regex, unparseable --since): fail LOUD with the one clean line
-      // the engine already built — never a Node stack or path — and exit non-zero (usage error).
+      // invalid flag input (missing flag value, bad/catastrophic regex, unparseable --since): fail LOUD with
+      // the one clean line — never a Node stack or path — and exit non-zero (usage error).
       process.stderr.write(err.message + '\n');
       process.exit(2);
     }
     throw err; // an unexpected fault → the entrypoint wrap turns it into a clean path-free diagnostic
   }
-  process.stdout.write(result.rendered + '\n');
-  process.exit(0);
 }
 
 // Belt-and-suspenders fail-loud (mirrors emit-event.cjs's entrypoint wrap): the per-file read and root