kimi-plugin-cc 2.4.1 → 2.4.3

package/dist/git.js

@@ -85,12 +85,13 @@ async function runGit(args, cwd) {
     }
     return result.stdout;
 }
-async function runGitAllowFailure(args, cwd) {
+async function runGitAllowFailure(args, cwd, signal) {
     try {
         const { stdout, stderr } = await execFileAsync("git", args, {
             cwd,
             env: process.env,
             maxBuffer: 10 * 1024 * 1024,
+            signal,
         });
         return { ok: true, stdout, stderr };
     }
@@ -163,11 +164,11 @@ export async function createEphemeralWorktree(repoRoot, base, worktreePath) {
  *
  * Returns the patch text (empty string if the swarm changed nothing).
  */
-export async function captureWorktreePatch(worktreePath) {
+export async function captureWorktreePatch(worktreePath, signal) {
     // Intent-to-add is required so untracked files surface in `git diff HEAD`.
     // An add -N failure aborts capture rather than returning a patch that omits
     // new files.
-    const intentToAdd = await runGitAllowFailure(["add", "-N", "--", "."], worktreePath);
+    const intentToAdd = await runGitAllowFailure(["add", "-N", "--", "."], worktreePath, signal);
     if (!intentToAdd.ok) {
         throw new RuntimeError("GIT_WORKTREE_INTENT_TO_ADD_FAILED", `git add -N (worktree capture) failed: ${intentToAdd.stderr || "unknown error"}`, "swarm.worktree", { details: { worktreePath } });
     }
@@ -176,6 +177,7 @@ export async function captureWorktreePatch(worktreePath) {
             cwd: worktreePath,
             env: process.env,
             maxBuffer: MAX_PATCH_BYTES,
+            signal,
         });
         return stdout;
     }

package/dist/help.js

@@ -1,5 +1,5 @@
-import { hasHelpFlag, ASK_SUPPORTED_FLAGS, RESCUE_SUPPORTED_FLAGS, REVIEW_SUPPORTED_FLAGS, PURSUE_SUPPORTED_FLAGS, SWARM_SUPPORTED_FLAGS, JOB_LOOKUP_SUPPORTED_FLAGS, SETUP_SUPPORTED_FLAGS, REPAIR_SESSIONS_SUPPORTED_FLAGS, REPLAY_SUPPORTED_FLAGS, } from "./parsing.js";
-const SUBCOMMANDS = "setup, review, task, ask, status, result, cancel, replay, repair-sessions";
+import { hasHelpFlag, ASK_SUPPORTED_FLAGS, RESCUE_SUPPORTED_FLAGS, REVIEW_SUPPORTED_FLAGS, PURSUE_SUPPORTED_FLAGS, SWARM_SUPPORTED_FLAGS, JOB_LOOKUP_SUPPORTED_FLAGS, SETUP_SUPPORTED_FLAGS, REPAIR_SESSIONS_SUPPORTED_FLAGS, REPLAY_SUPPORTED_FLAGS, RECOVER_SWARM_SUPPORTED_FLAGS, } from "./parsing.js";
+const SUBCOMMANDS = "setup, review, task, ask, status, result, cancel, replay, repair-sessions, recover-swarm";
 const TASK_KINDS = "rescue, challenge, pursue, swarm";
 /** Help is a dispatch-only, side-effect-free exception to normal argument parsing. */
 export function companionHelp(argv) {
@@ -33,6 +33,7 @@ export function companionHelp(argv) {
         case "cancel":
             return usage(command, "[job-id] [options]", JOB_LOOKUP_SUPPORTED_FLAGS, command === "status" ? "Show job state as JSON." : command === "result" ? "Read a terminal artifact, optionally in a JSON envelope." : "Cancel a running job; without an id, target the repository's latest running job.");
         case "replay": return usage(command, "<job-id>", REPLAY_SUPPORTED_FLAGS, "Replay a completed job's persisted stream log.");
+        case "recover-swarm": return `Usage: companion.sh recover-swarm <job-id> [${RECOVER_SWARM_SUPPORTED_FLAGS}]. Preview durable swarm recovery; --apply stops verified orphans, disables the recorded session and captures a patch. Never resumes prompts or changes terminal job outcomes.`;
         case "repair-sessions": return usage(command, "[options]", REPAIR_SESSIONS_SUPPORTED_FLAGS, "Preview session metadata repair; --apply writes, --all selects all host-owned repositories.");
         case "worker": return "Usage: companion.sh worker <ask|rescue> <job-id>. Internal detached-worker entry point; launched by ask/rescue, not manually.";
         case "mcp": return "Usage: companion.sh mcp. Run the Kimi MCP stdio server; normally launched by Claude Code or Codex plugin configuration.";

package/dist/hooks/config-safety.js

@@ -594,7 +594,7 @@ function validateVersionSensitiveEvents(events, version) {
     }
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
-    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) and 2.3.2 (b8dd3a13): the additive
+    // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e) 2.3.2 (b8dd3a13), and 2.3.3 (ec495f0c): the additive
     // events and HookDefSchema are unchanged. Require the full version string AND matching components;
     // no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
@@ -605,7 +605,8 @@ function validateVersionSensitiveEvents(events, version) {
         (version.minor === 2 && ((version.version === "2.2.0" && version.patch === 0))) ||
         (version.minor === 3 && ((version.version === "2.3.0" && version.patch === 0) ||
             (version.version === "2.3.1" && version.patch === 1) ||
-            (version.version === "2.3.2" && version.patch === 2))))) {
+            (version.version === "2.3.2" && version.patch === 2) ||
+            (version.version === "2.3.3" && version.patch === 3))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/dist/job-store.js

@@ -122,6 +122,8 @@ export class JobStore {
       CREATE INDEX IF NOT EXISTS jobs_repo_updated_idx
         ON jobs (repo_id, updated_at DESC);
 
+      CREATE TABLE IF NOT EXISTS swarm_recovery (job_id TEXT PRIMARY KEY, payload TEXT NOT NULL, recovery_owner TEXT);
+
       CREATE INDEX IF NOT EXISTS jobs_repo_type_updated_idx
         ON jobs (repo_id, command_type, updated_at DESC);
 
@@ -186,6 +188,17 @@ export class JobStore {
             throw translateSqliteError(error);
         }
     }
+    getSwarmRecovery(jobId) {
+        const row = this.db.get("SELECT payload, recovery_owner FROM swarm_recovery WHERE job_id = ?", jobId);
+        return row ? { record: JSON.parse(row.payload), owner: row.recovery_owner } : null;
+    }
+    saveSwarmRecovery(jobId, record) {
+        this.db.run("INSERT INTO swarm_recovery (job_id, payload) VALUES (?, ?) ON CONFLICT(job_id) DO UPDATE SET payload = excluded.payload", [jobId, JSON.stringify(record)]);
+    }
+    claimSwarmRecovery(jobId, expected, owner) {
+        this.db.run("UPDATE swarm_recovery SET recovery_owner = ? WHERE job_id = ? AND recovery_owner IS ?", [owner, jobId, expected]);
+        return this.db.get("SELECT changes() AS count").count === 1;
+    }
     close() {
         this.db.close();
     }

package/dist/jobs.js

@@ -85,6 +85,9 @@ export async function sweepStaleJobs(store, paths) {
     for (const job of store.listRunningJobsWithProcessHints()) {
         if (store.getMcpTask(job.job_id))
             continue;
+        // Recovery owns orphaned swarm resources; PID-only sweeping must not signal replacements.
+        if (store.getSwarmRecovery(job.job_id))
+            continue;
         if (!isStaleEnoughToSweep(job)) {
             continue;
         }

package/dist/kimi-engine.js

@@ -42,6 +42,7 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.0",
     "2.3.1",
     "2.3.2",
+    "2.3.3",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([

package/dist/kimi-errors.js

@@ -44,6 +44,11 @@ export function classifyManagedCommandFailure(error, commandType, jobId, options
     const details = { availability: classification.kind };
     if (error instanceof RuntimeError) {
         details.cause_code = error.code;
+        for (const key of ["spawn_code", "spawn_errno", "spawn_message"]) {
+            if (error.details[key] !== undefined)
+                details[key] = key === "spawn_message" && typeof error.details[key] === "string"
+                    ? truncateCauseMessageForDetails(error.details[key]) : error.details[key];
+        }
         if (error.code === "RESPONSE_TIMEOUT") {
             for (const key of ["budget_ms", "record_count", "partial_output_chars", "aborted", "settled_post_abort", "hook_escapes"]) {
                 if (error.details[key] !== undefined)
@@ -129,28 +134,29 @@ function classifyKimiAvailability(error) {
             authProbe: "failed",
         };
     }
-    if (error instanceof RuntimeError && error.code === "CLI_SPAWN_FAILED") {
-        return {
-            kind: "binary_unavailable",
-            summary: "the Kimi CLI is missing from PATH or not executable in this environment.",
-            nextStep: "Run `/kimi:setup` to verify the install, then expose `kimi` on PATH and retry.",
-            runtimeProbe: "failed",
-            authProbe: "failed",
-        };
-    }
-    // v1.0 cli-client surfaces async ENOENT (Bun) as CLI_PROCESS_ERROR with
-    // "spawn ... ENOENT" in the message. Map that to binary_unavailable so
-    // the failure message points users at /kimi:setup.
     if (error instanceof RuntimeError &&
-        error.code === "CLI_PROCESS_ERROR" &&
-        /\bENOENT\b/.test(message)) {
-        return {
-            kind: "binary_unavailable",
-            summary: "the Kimi CLI is missing from PATH or not executable in this environment.",
-            nextStep: "Run `/kimi:setup` to verify the install, then expose `kimi` on PATH and retry.",
-            runtimeProbe: "failed",
-            authProbe: "failed",
-        };
+        (error.code === "CLI_SPAWN_FAILED" || error.code === "CLI_PROCESS_ERROR")) {
+        const spawnCode = error.details.spawn_code;
+        const binaryUnavailable = typeof spawnCode === "string" && ["ENOENT", "EACCES", "ENOEXEC"].includes(spawnCode);
+        if (typeof spawnCode === "string" && !binaryUnavailable) {
+            return {
+                kind: "startup_failed",
+                summary: "the Kimi subprocess could not be started or used.",
+                nextStep: "Check the underlying process error; shorten the prompt or environment if an argument-size limit was exceeded, then retry.",
+                runtimeProbe: "failed",
+                authProbe: "failed",
+            };
+        }
+        // Keep opaque synchronous failures and legacy async ENOENT diagnostics compatible.
+        if (binaryUnavailable || error.code === "CLI_SPAWN_FAILED" || /\bENOENT\b/.test(message)) {
+            return {
+                kind: "binary_unavailable",
+                summary: "the Kimi CLI is missing from PATH or not executable in this environment.",
+                nextStep: "Run `/kimi:setup` to verify the install, then expose `kimi` on PATH and retry.",
+                runtimeProbe: "failed",
+                authProbe: "failed",
+            };
+        }
     }
     // v1.0 cli-client surfaces non-ENOENT process errors and non-zero
     // exits as CLI_PROCESS_ERROR / CLI_NONZERO_EXIT. Treat both as

package/dist/parsing.js

@@ -18,6 +18,7 @@ export const RESCUE_SUPPORTED_FLAGS = "-m/--model <name>, --thinking <off|low|me
 export const REVIEW_SUPPORTED_FLAGS = "--base <ref>, -m/--model <name>, --thinking <off|low|medium|high>, --budget <30m|1h|90s>";
 export const JOB_LOOKUP_SUPPORTED_FLAGS = "--type <review|challenge|rescue|review_gate|ask>, --json";
 export const SETUP_SUPPORTED_FLAGS = "--check, --uninstall, --all (with --uninstall), --enable-review-gate, --disable-review-gate, --models [--json] (without other setup flags)";
+export const RECOVER_SWARM_SUPPORTED_FLAGS = "--apply";
 export const REPAIR_SESSIONS_SUPPORTED_FLAGS = "--apply, --all";
 export const REPLAY_SUPPORTED_FLAGS = "none (one job-id required)";
 /** Validate syntax only; upstream per-model supportEfforts remains authoritative. */

package/dist/prompt-size.js

@@ -0,0 +1,18 @@
+import { RuntimeError } from "./errors.js";
+// Node/libuv's default CreateProcess argument quoting (UTF-16 code units).
+export function windowsCommandLineLength(command, args) {
+    const quotedLength = (value) => {
+        if (value.length > 0 && !/[\s"]/u.test(value))
+            return value.length;
+        return 2 + value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1').length;
+    };
+    return [command, ...args].reduce((size, value) => size + quotedLength(value) + 1, 0);
+}
+export function assertPromptFitsCommandLine(command, args, platform = process.platform) {
+    if (platform !== "win32")
+        return;
+    const size = windowsCommandLineLength(command, args);
+    if (size <= 32_767)
+        return;
+    throw new RuntimeError("CLI_COMMAND_LINE_TOO_LONG", "The Kimi prompt exceeds the Windows command-line limit; the CLI was not started. Narrow the review or split it into smaller scopes. A short ask prompt can reference a saved diff inside the workspace. Reinstalling Kimi or running setup will not fix this. The current print transport does not support stdin prompts.", "cli-client.pre-spawn", { details: { command_line_utf16_units: size, limit_utf16_units: 32_767, platform } });
+}

package/dist/swarm-activation.js

@@ -9,7 +9,7 @@ import { assertExecutionPlanMatchesSpawn, assertNoUnsafeExperimentalSelector, }
 import { resolveKimiHome } from "./kimi-home.js";
 import { assertNativeV2Preflight } from "./native-v2-preflight.js";
 import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities, waitForProcessTreeExit, } from "./process-tree.js";
-const PREACTIVATION_VERSION = "2.3.2";
+const PREACTIVATION_VERSIONS = ["2.3.2", "2.3.3"];
 const READY_TIMEOUT_MS = 10_000;
 const REST_TIMEOUT_MS = 5_000;
 const SHUTDOWN_TIMEOUT_MS = 5_000;
@@ -25,7 +25,7 @@ const ESCALATION_MS = 1_500;
 const POST_KILL_QUIESCENCE_MS = 500;
 const ENV_MODEL_ALIAS = "__kimi_env_model__";
 export function requiresSwarmPreactivation(version) {
-    return version === PREACTIVATION_VERSION;
+    return version !== null && PREACTIVATION_VERSIONS.includes(version);
 }
 export async function preactivateSwarmSession(options) {
     const failureCode = "SWARM_ACTIVATION_FAILED";
@@ -39,6 +39,7 @@ export async function preactivateSwarmSession(options) {
         await verifyMeta(web, prepared.expectedVersion, options.signal, failureCode);
         const model = await resolveProfileModel(web, options, failureCode);
         identity = await createSession(web, options, failureCode);
+        options.onRecoveryEvent?.({ kind: "session", ...identity });
         profileMutationAttempted = true;
         await postSwarmProfile(web, identity, true, model, options.signal, failureCode);
         await verifySwarmStatus(web, identity, true, model, options.signal, failureCode);
@@ -88,6 +89,7 @@ export async function deactivateSwarmSession(options) {
         await verifySwarmStatus(web, options, false, undefined, options.signal, failureCode);
         await shutdownWeb(web, options.signal, failureCode);
         await requireSwarmJournal(prepared.kimiHome, options, "exit", options.signal, failureCode);
+        options.onRecoveryEvent?.({ kind: "disabled" });
         throwIfAborted(options.signal, failureCode, "swarm-deactivation.complete");
     }
     catch (error) {
@@ -114,7 +116,7 @@ async function prepareWebSpawn(options, failureCode) {
     }
     const expectedVersion = options.expectedVersion ?? options.executionPlan.kimiVersion;
     if (expectedVersion === null || !requiresSwarmPreactivation(expectedVersion)) {
-        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSION}.`);
+        throw failure(failureCode, "swarm-activation.version", `Swarm web preactivation requires exact kimi-code ${PREACTIVATION_VERSIONS.join(" or ")}.`);
     }
     const kimiHome = resolveKimiHome(options.env, options.cwd);
     if (options.executionPlan.intendedEngine === "native-v2") {
@@ -144,6 +146,7 @@ async function startWebChild(options, env, failureCode) {
         "error",
     ];
     let child;
+    options.onRecoveryEvent?.({ kind: "web-spawn" });
     try {
         child = spawn(options.command, args, {
             cwd: options.cwd,
@@ -153,6 +156,7 @@ async function startWebChild(options, env, failureCode) {
         });
     }
     catch {
+        options.onRecoveryEvent?.({ kind: "web-exit" });
         throw failure(failureCode, "swarm-activation.spawn", "Failed to spawn the Kimi web lifecycle process.");
     }
     let exited = false;
@@ -184,6 +188,7 @@ async function startWebChild(options, env, failureCode) {
         child,
         closePromise,
         descendants: [],
+        onRecoveryEvent: options.onRecoveryEvent,
         trackingStopped: false,
         lastSnapshotComplete: false,
         snapshotIncomplete: false,
@@ -198,6 +203,8 @@ async function startWebChild(options, env, failureCode) {
     try {
         const ready = await waitForReadyLine(owned, options.signal, failureCode);
         await refreshOwnedDescendants(owned);
+        if (owned.recoveryFailed)
+            throw failure(failureCode, "swarm-activation.recovery", "Cannot persist web ownership; refusing session mutation.");
         return Object.assign(owned, ready);
     }
     catch (error) {
@@ -610,12 +617,26 @@ async function refreshOwnedDescendants(owned) {
             owned.snapshotIncomplete = true;
             owned.lastSnapshotComplete = false;
         }
+        try {
+            owned.onRecoveryEvent?.({ kind: "web-processes", identities: [...(owned.rootIdentity ? [owned.rootIdentity] : []), ...owned.descendants], complete: owned.lastSnapshotComplete });
+        }
+        catch {
+            owned.recoveryFailed = true;
+        }
     })().finally(() => {
         owned.refreshPromise = undefined;
     });
     return await owned.refreshPromise;
 }
 async function teardownOwnedChild(owned) {
+    const quiescent = await teardownOwnedChildInner(owned);
+    if (quiescent && !owned.recoveryFailed) {
+        owned.onRecoveryEvent?.({ kind: "web-exit" });
+        return true;
+    }
+    return false;
+}
+async function teardownOwnedChildInner(owned) {
     await stopDescendantTracking(owned);
     const childPid = owned.child.pid;
     if (childPid === undefined)

package/dist/swarm-recovery.js

@@ -0,0 +1,134 @@
+import { RuntimeError } from "./errors.js";
+import { collectDescendantIdentities, collectProcessGroupsIdentities, probeProcessIdentity, revalidateProcessIdentities } from "./process-tree.js";
+export function recordRecoveryEvent(store, record, event) {
+    record.complete = false;
+    if (event.kind === "session") {
+        record.session = { sessionId: event.sessionId, workspaceId: event.workspaceId };
+        // Write-ahead: this must commit before the profile mutation is attempted.
+        record.sessionDirty = true;
+    }
+    else if (event.kind === "disabled") {
+        record.sessionDirty = false;
+    }
+    else if (event.kind.endsWith("-spawn")) {
+        record.launches.push({ kind: event.kind === "web-spawn" ? "web" : "print", pending: true, identities: [], quiescent: false, uncertain: false });
+    }
+    else {
+        const kind = event.kind.startsWith("web-") ? "web" : "print";
+        const launch = [...record.launches].reverse().find((entry) => entry.kind === kind);
+        if (!launch)
+            throw recoveryError("Missing durable launch intent.");
+        if (event.kind === "web-exit" || event.kind === "print-exit") {
+            launch.quiescent = true;
+            launch.pending = false;
+        }
+        else if ("identities" in event) {
+            const all = [...launch.identities, ...event.identities];
+            launch.identities = [...new Map(all.map((identity) => [`${identity.pid}:${identity.startToken}:${identity.processGroupId}`, identity])).values()];
+            launch.pending = launch.identities.length === 0;
+            launch.uncertain ||= !event.complete;
+        }
+    }
+    store.saveSwarmRecovery(record.jobId, record);
+}
+export function finishRecoveryRecord(store, record) {
+    record.complete = !record.sessionDirty && record.launches.every((entry) => entry.quiescent)
+        && (record.workspaceRoot === null || record.patchPath !== null);
+    store.saveSwarmRecovery(record.jobId, record);
+}
+export function recoveryError(message) {
+    return new RuntimeError("SWARM_RECOVERY_REQUIRED", message, "swarm.recovery");
+}
+export async function assertRecoveryOwnerGone(record) {
+    if (!record.owner || process.platform === "win32")
+        throw recoveryError("No durable, verifiable owner identity; recovery requires manual inspection on this host.");
+    const probe = await probeProcessIdentity(record.ownerPid);
+    if (!probe.complete)
+        throw recoveryError("Cannot verify the original companion's identity.");
+    if (probe.identity?.startToken === record.owner.startToken && !/^[ZX]/i.test(probe.identity.state)) {
+        throw recoveryError("The original companion is still alive. Use cancel for a running job, not recovery.");
+    }
+}
+/**
+ * Linux may fall back from /proc to ps for a whole-group snapshot while targeted
+ * identity reads still use /proc. Those start tokens are different namespaces,
+ * not different processes. Prove both representations current around the known
+ * identity read; never accept a member based on PID/PGID equality alone.
+ */
+export async function validateRecoveryGroupMembers(known, members, validate = revalidateProcessIdentities) {
+    const membership = await validate(members);
+    const ownership = await validate(known);
+    const membershipAfter = await validate(membership.identities);
+    for (const proof of [membership, ownership, membershipAfter]) {
+        if (!proof.complete || proof.groupChanged?.length)
+            throw recoveryError("Process ownership or group membership is uncertain.");
+    }
+    for (const member of membershipAfter.identities) {
+        const owner = ownership.identities.find((id) => id.pid === member.pid && id.processGroupId === member.processGroupId);
+        const crossNamespace = owner && ((owner.startToken.startsWith("proc:") && member.startToken.startsWith("ps:")) ||
+            (owner.startToken.startsWith("ps:") && member.startToken.startsWith("proc:")));
+        if (!owner || (owner.startToken !== member.startToken && !crossNamespace)) {
+            throw recoveryError("An unrecorded process survives in the recorded group; refusing group cleanup.");
+        }
+    }
+    return ownership.identities;
+}
+/** Never signal an unproven group, PID replacement, or changed-PGID process. */
+export async function recoverLaunch(launch, persist, signal) {
+    if (launch.quiescent)
+        return;
+    if (launch.pending || launch.uncertain || launch.identities.length === 0) {
+        throw recoveryError("Launch ownership was not fully recorded before interruption; manual inspection is required. No process was signalled.");
+    }
+    const root = launch.identities[0];
+    const rootProbe = await probeProcessIdentity(root.pid);
+    if (!rootProbe.complete)
+        throw recoveryError("Process identity probe is incomplete.");
+    if (rootProbe.identity?.startToken === root.startToken) {
+        if (rootProbe.identity.processGroupId !== root.processGroupId)
+            throw recoveryError("The recorded root changed process groups; refusing to signal it.");
+        const descendants = await collectDescendantIdentities(root.pid);
+        // Revalidate the ancestry anchor after collection before retaining new identities.
+        const after = await probeProcessIdentity(root.pid);
+        if (!after.complete || after.identity?.startToken !== root.startToken || after.identity.processGroupId !== root.processGroupId) {
+            throw recoveryError("Process ownership changed during recovery inspection.");
+        }
+        launch.identities = [...new Map([...launch.identities, ...descendants].map((id) => [`${id.pid}:${id.startToken}:${id.processGroupId}`, id])).values()];
+        persist();
+    }
+    const inspect = async () => {
+        const members = await collectProcessGroupsIdentities(launch.identities.map((id) => id.processGroupId));
+        if (members === undefined)
+            throw recoveryError("Process group membership is unreadable.");
+        return validateRecoveryGroupMembers(launch.identities, members);
+    };
+    for (const [killSignal, waitMs] of [["SIGTERM", 1500], ["SIGKILL", 500]]) {
+        signal?.throwIfAborted();
+        for (const identity of await inspect()) {
+            signal?.throwIfAborted();
+            const current = await revalidateProcessIdentities([identity]);
+            if (!current.complete || current.groupChanged?.length)
+                throw recoveryError("Process identity changed before signalling.");
+            if (current.identities.length) {
+                try {
+                    process.kill(identity.pid, killSignal);
+                }
+                catch (error) {
+                    if (error.code !== "ESRCH")
+                        throw recoveryError("Unable to stop the recorded process.");
+                }
+            }
+        }
+        const deadline = Date.now() + waitMs;
+        do {
+            signal?.throwIfAborted();
+            if ((await inspect()).length === 0) {
+                launch.quiescent = true;
+                persist();
+                return;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        } while (Date.now() < deadline);
+    }
+    throw recoveryError("Recorded processes did not become quiescent; recovery remains pending.");
+}

package/dist/version.js

@@ -4,4 +4,4 @@
 // and AGENTS.md on every release. A future improvement would read this from
 // package.json at build time, but that adds a build-step dependency we
 // don't want yet.
-export const KIMI_PLUGIN_CC_VERSION = "2.4.1";
+export const KIMI_PLUGIN_CC_VERSION = "2.4.3";

package/docs/registry-releases.md

@@ -6,7 +6,20 @@ remain available. The package has no install scripts and no separate CLI.
 
 ## Publishing status
 
-Plugin **2.4.1** certifies exact CLI **2.3.2** for all eight operations with host-preactivated swarm sessions. Its [certification evidence](./upstream-2.3.2-certification.md) includes the source scan, plan controls, hardened 15-test/115-assertion candidate matrix, and final 19-test/125-assertion production smoke in 296.67 seconds. Independent review is complete: Claude reports no blockers and Codex returned RESOLVED. The final repository gate passed 1,268 tests with zero failures and 16,055 assertions across 78 files, and package validation passed 224 files. CI, tagging, and registry verification are pending; the currently published release remains 2.4.0 until that closeout completes.
+Plugin **2.4.3** adds exact CLI **2.3.3** certification for all eight operations,
+with the existing host-preactivated swarm lifecycle and durable recovery.
+See the [certification record](./upstream-2.3.3-certification.md).
+Release execution and registry verification are recorded in the release notes;
+publication uses the same validated-tarball OIDC workflow below.
+
+Plugin **2.4.2** adds durable interrupted-swarm recovery and Windows spawn diagnostics.
+Exact CLI certification remains unchanged through **2.3.2**; this is not a new
+Windows-support or large-prompt-transport claim. See the [release](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.2),
+[recovery guide](./swarm-recovery.md), and [Windows community controls](./windows-validation.md).
+Publication uses the same validated-tarball OIDC workflow below; release execution
+and registry verification are recorded in the release notes.
+
+Plugin **2.4.1** certifies exact CLI **2.3.2** for all eight operations with host-preactivated swarm sessions. [Release v2.4.1](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.1) is anchored at `06a0a47f2b34dffb8dd71e7ce93646212e74ed19`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/40236704464) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/40237085945) passed. The registry tarball has SHA-1 `77fe6daaa0f23750cc9b5d857bdbdd5107a7d4ce`, contains 224 files, and matches the CI artifact byte-for-byte. Fresh installs from the CI artifact and npm registry both passed isolated setup/check for Claude Code and Codex. The earlier CI attempt 40231073897 exposed an intermittent root-exit cleanup issue; the root-continuity fix and independent review landed before tagging. Final closeout CI run 40238295139 passed.
 
 Plugin **2.4.0** preserves exact CLI **2.3.1** certification and adds the shared MCP transport. [Release v2.4.0](https://github.com/linxule/kimi-plugin-cc/releases/tag/v2.4.0) is anchored at `9232d1ec98465454d8d9328e439d3f31bfc53e04`; its [CI check](https://github.com/linxule/kimi-plugin-cc/actions/runs/40040084944) and [release-event publishing run](https://github.com/linxule/kimi-plugin-cc/actions/runs/40040442610) passed. The registry tarball has SHA-1 `8243616529aa9f03f26bf4fef68c36d90e2304ae`, contains 222 files, and matches the CI artifact byte-for-byte. A fresh npm install passed isolated setup/check for both hosts.
 The previous verified publication was **2.3.1**:

package/docs/safety.md

@@ -2,7 +2,7 @@
 
 This guide describes the current checkout runtime. Read-only tasks deny file writes and shell commands. Rescue and pursue can edit your workspace. Write-swarm returns a patch from a temporary Git worktree.
 
-Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, and `2.3.2`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
+Native agent-core-v2 is certified at exact CLI versions `0.42.0`, `0.43.0`, `0.43.1`, `2.0.0`, `2.0.1`, `2.0.2`, `2.1.0`, `2.1.1`, `2.2.0`, `2.3.0`, `2.3.1`, `2.3.2`, and `2.3.3`, with plan mode disabled. The [runtime certification table](../runtime/kimi-engine.ts) controls routing. The hook is not an operating-system sandbox.
 
 ## Why the safety story is hook-based
 
@@ -205,11 +205,13 @@ If another installed host still points to an older hook, that hook may veto thes
 - **Resume is intentionally not exposed yet.** In goal mode `goal.summary` emits a *goalId* distinct from the resume-hint *sessionId*; `kimi -r <sessionId>` re-enters the session but not necessarily the goal continuation. The plugin captures and surfaces the goalId but does not offer `--resume` for pursue until that split is reconciled upstream — exposing it now would be a silent-failure trap. **Re-verified against kimi-code 0.26.0 (2026-07-16):** the headless CLI still has no argv, prompt syntax, or session-resume path that calls `resumeGoal()`. `parseHeadlessGoalCreate` (`apps/kimi-code/src/cli/goal-prompt.ts`) accepts only the `/goal <objective>` *create* shape on both the v1 and experimental-v2 drivers, and upstream's own docs (`docs/en/guides/goals.md`, § "Use goal mode carefully") state that in non-interactive prompt mode *only goal creation is supported* — goal management is a TUI/kimi-web control. PR #552 makes a plain `-r <sessionId>` correctly *restore* the paused goal snapshot, but nothing in the headless path *acts* on it; the real `resumeGoal()` is wired only to the TUI (`/goal resume`) and kimi-web RPC (PR #1693, web-only). Implementing `--resume` would therefore require either prompt-injected model compliance (rejected — the plugin bounds autonomy with hard limits, not model goodwill) or abandoning the subprocess model for kimi-web's RPC. Re-check if upstream ever ships a headless `goal resume` verb.
 - **A model-invocable `kimi-pursue` agent (v1.3) wraps this command.** The main thread can dispatch autonomous goal mode, not just the human-typed `/kimi:pursue` — the same command↔agent mirror as rescue/review/swarm. Auto-dispatch does NOT widen the blast radius: pursue runs under `commandLabel: "rescue"`, so the managed PreToolUse hook + workspace allowlist gate every tool call on every continuation turn (no git mutation), and the mandatory `--budget` wall-clock ceiling bounds the autonomy regardless of who launched it. Because it is write-capable AND autonomous — the plugin's highest blast radius — the agent's description requires an explicit user request for hands-off multi-turn pursuit, steers single bounded tasks to `kimi-rescue`, and never auto-promotes a fix or a question into a goal loop. Like the command, it refuses without the hook and offers no `--resume`.
 
-## Swarm activation on CLI 2.3.2
+## Swarm activation on CLI 2.3.2 and 2.3.3
+
+For interrupted runs, see [durable recovery and its explicit limits](swarm-recovery.md).
 
 Upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print sessions. A rejected call can therefore coexist with zero child journals and a successful exit; a tool-call record, aggregate denial, or coordinator-produced patch does not prove fan-out. The plugin does not use prompt workarounds or replace its print transport with general RPC.
 
-For versions requiring activation (currently exact 2.3.2), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
+For versions requiring activation (currently exact 2.3.2 and 2.3.3), both slash-command and MCP swarm operations use the same `runSwarm` implementation and one ordinary `kimi -p -r` prompt runner per job, bracketed by short-lived host-managed web lifecycles:
 
 1. The exact planned CLI starts `web --no-open --host 127.0.0.1 --port 0 --log-level error`. The plugin accepts only the expected loopback ready URL, uses a supplied token for authenticated REST requests, and keeps that token in memory, never writing it to logs. `/api/v1/meta` must confirm backend v2, the exact planned version, and no dangerous authentication bypass. The plugin uses the explicit model or environment-model alias, otherwise reading the default alias from `/api/v1/config`; creates a session in the job cwd; binds that model with `permission_mode:auto` and `swarm_mode:true`; verifies those settings and `plan_mode:false` through `/status`; verifies clean shutdown; and requires the main journal's manual `swarm_mode.enter` record.
 2. The ordinary stream-json print runner resumes that session with `kimi -p -r`. The job records `kimi_session_id_source:"preactivated"`, and the session returned by print must exactly match the preactivated id. Every coordinator and child tool call remains governed by the same managed PreToolUse hook and operation allowlist.
@@ -222,7 +224,7 @@ Older certified versions keep the direct `kimi -p` path. The web processes are n
 `/kimi:swarm` (v1.2) fans a **read-only** review out across subagents using kimi-code's `AgentSwarm` tool (kimi-code 0.12.0+). The coordinator launches one subagent per target (file/module/question); each inspects the workspace with read tools and reports findings, which the coordinator consolidates into one markdown report. It opens **zero new write surface**.
 
 - **The hook label is `swarm`, and it allows the read-only tool set PLUS `AgentSwarm`.** The coordinator must be allowed to call `AgentSwarm` (else the swarm never launches), but no write/edit/shell tool is allowed. The exact allowed tool name is `AgentSwarm` (verified at 0.42.0 against `packages/agent-core-v2/src/features/swarm/tools/agent-swarm/agentSwarmTool.ts`: `'AgentSwarm'`, strict schema). The singular `Agent` tool is deliberately *not* allowed — swarm is the fan-out surface, not arbitrary delegation.
-- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
+- **Every subagent inherits the `swarm` label and fires the same hook.** On native v2 (0.42.0) `AgentSwarm` children run in-process in a child DI scope with their OWN eager external-hooks service, so every child tool call passes the same before-execute channel and the same managed hook — there is no sub-vs-main branch and no deny-all shortcut on the swarm route. So a subagent's `Write`/`Edit`/`Bash` is denied exactly like a single-turn review's. The swarm listener in that channel is non-terminal and nothing auto-approves `AgentSwarm` ahead of the hook. (Legacy-v1 ≤ 0.41 reached the same result by placing the hook policy at index 0 of every agent's permission stack.) **Required for final certification evidence** (`tests/runtime/real-binary-smoke.test.ts`, run via `bun run smoke:real`): distinct child journals must exist, and each assigned Write/Edit `path` must be correlated through its `toolCallId` with the managed denial in that exact tool result; unrelated denials and coordinator-only reports are insufficient. On 2.3.2 and 2.3.3, targeted controls also prove that direct OFF produces no children while the preactivated ON path produces the real child journals and denials.
 - **The managed hook is the read-only boundary; no `explore`-profile second layer is assumed.** Production deliberately omits `subagent_type` for read-only swarm rather than selecting kimi-code's `explore` profile. Every coordinator and subagent tool call is enforced by the same managed hook.
 - **Swarm refuses without the hook, like every model-spawning command.** A swarm makes the reason especially acute: it asks for up to `--cap` subagents, but this total-count hint is advisory, so a missing hook would remove enforcement from all of them at once. `KIMI_PLUGIN_CC_SKIP_HOOK_CHECK=1` remains an explicit tests/diagnostics escape hatch, not a recovery path.
 - **The only new risk is COST, and the plugin bounds it.** Read-only swarm writes nothing, so the new risk is runaway cost from N parallel model runs (and possible nested `AgentSwarm`). `/kimi:swarm` enforces a **mandatory finite wall-clock ceiling** via its AbortController (`--budget`, default 30m); the SIGTERM→SIGKILL descendant-reaping cancellation reaps the whole subagent process tree. Two **distinct** subagent bounds: `--cap N` is a *soft* prompt-injected hint on TOTAL subagent count (the hook is stateless and cannot enforce a count, so the model may exceed it), and `--max-concurrency N` is a *hard* ceiling on how many subagents kimi-code's `SubagentBatch` runs concurrently — exported as `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` (PR #888) on **kimi-code 0.18.0+** (older binaries ignore the unknown env var, so on < 0.18 only the soft hint applies). It **defaults to 4** when the user passes none (`resolveSwarmMaxConcurrency` in swarm.ts), so every swarm run — agent-dispatched or human-typed — carries an enforced peak-parallelism ceiling on 0.18.0+ rather than falling back to kimi-code's internal ramp; pass an explicit value to widen or throttle. **Never merge them into one flag:** concurrency ≠ total count — a hard concurrency cap of N still permits more than N subagents over the life of the run, just never more than N at once. The `--budget` bounds elapsed time, not a dollar amount or total token count; `--max-concurrency` bounds *peak* parallelism (the spike in simultaneous model spend), and `--cap` is only an advisory total-count nudge. Folding both onto one flag would create the "cap-as-total-count illusion" — a user reading `--cap N` would expect a total bound but receive only a peak-parallelism one.
@@ -236,7 +238,7 @@ Older certified versions keep the direct `kimi -p` path. The web processes are n
 - **Writes are confined by the hook to a forge-proof trusted root.** The `swarm-write` hook label routes write/edit/shell through the **rescue allowlist verbatim** (workspace check, symlink/realpath reject, mutating-flag + exec-delegating-flag detector, git-mutation deny), but scoped to `KIMI_PLUGIN_CC_WORKSPACE_ROOT` — the worktree path the plugin exports on the spawn — **NOT** the hook payload `cwd`. The model running inside kimi cannot set an env var on its already-spawned process, so confinement does not depend on how upstream derives the payload cwd for an in-process subagent. A missing trusted root **fails closed** (all writes denied). An out-of-worktree write (absolute path into the user's real tree) is rejected by the allowlist's `isWithin` check; a write to the worktree's `.git` pointer is rejected by the `.git`-segment check.
 - **`coder` subagents really can write, and the hook is the sole boundary.** Verified at kimi-code 0.42.0: swarm subagents get their own eager external-hooks service under the standard before-execute channel — there is no deny-all path on the swarm route (the `btw` side-question path is separate). Write-swarm's `coder` subagents DO have edit tools, and the managed PreToolUse hook is the **only** write boundary — which is why the trusted-root confinement above is load-bearing and gated tightly.
 - **The plugin never touches git; the main thread owns the merge.** Subagents cannot run git (allowlist denies mutation). The plugin captures the change set with `git add -N` (intent-to-add, so new files appear in the diff WITHOUT writing loose objects into the shared object DB) + `git diff --binary` (untruncated, applyable), writes it to a `swarm-write-<jobId>.patch` artifact, and prints the path. It does **not** `git apply`, commit, or move any ref — the user/main thread reviews the patch and applies it (`git apply <path>`). The worktree shares the main repo's object DB and refs, but no ref/HEAD is ever moved, so the user's repository state is untouched.
-- **The patch is captured on every terminal path, before cleanup.** Success, cancel, budget-expiry, and failure all capture the (possibly partial) patch BEFORE `git worktree remove --force` discards the tree, so a cancelled run never silently loses the work the subagents already did. If capture itself fails, the job fails instead of completing and the worktree is retained with its path in the error details for recovery. That guarantee covers the plugin's own terminal paths, including `companion.sh cancel`. It does **not** cover a harness interrupt: Esc/TaskStop delivers SIGTERM then SIGKILL after ~1.35s (measured, process-group-wide), which is shorter than the 1500ms child escalation plus quiescence plus patch capture — so a hard interrupt can kill the companion mid-teardown and lose the patch. `companion.sh cancel` signals from a separate process not racing that deadline and is the work-preserving stop. A startup sweep reaps worktrees orphaned by a hard kill (SIGKILL of the plugin process); its reap TTL is derived as `MAX_DURATION_MS + 2h` so it always exceeds the longest a run can live (the 24h `--budget` cap) and can never force-remove a still-live worktree out from under a concurrent run — the sweep's only liveness signal is the worktree dir mtime, which a run editing only existing files leaves frozen at `git worktree add` time.
+- **The patch is captured on every terminal path, before cleanup.** Success, cancel, budget-expiry, and failure all capture the (possibly partial) patch BEFORE `git worktree remove --force` discards the tree, so a cancelled run never silently loses the work the subagents already did. If capture itself fails, the job fails instead of completing and the worktree is retained with its path in the error details for recovery. That guarantee covers the plugin's own terminal paths, including `companion.sh cancel`. It does **not** cover a harness interrupt: Esc/TaskStop delivers SIGTERM then SIGKILL after ~1.35s (measured, process-group-wide), which is shorter than the 1500ms child escalation plus quiescence plus patch capture — so a hard interrupt can kill the companion mid-teardown and lose the patch. `companion.sh cancel` signals from a separate process not racing that deadline and is the work-preserving stop. Abandoned worktrees are retained, never age-deleted. Use the preview/apply recovery procedure in [swarm-recovery.md](swarm-recovery.md); uncertain ownership refuses automatic cleanup.
 - **Gated tightly.** Requires kimi-code **≥ 0.18.0** (below it `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` is ignored, so a write fan-out would have no hard peak bound — unacceptable for concurrent writers); because that cap cannot be guaranteed without a confirmed version, the write-mode version gate **fails closed** on an unconfirmable `kimi --version` probe (the shared execution-plan gate also refuses unverified or uncertified binaries for read-only swarm; older certified legacy versions may lack the hard concurrency setting). Also requires a git repo with a **committed HEAD**, and the PreToolUse hook (**refuses** without it, like read swarm). Bases the worktree on HEAD, so a **loud warning** fires when the working tree is dirty (uncommitted work is not visible to the swarm). Default `--max-concurrency` is **1** (serialize) since disjoint-target partitioning is prompt-only and unenforceable by the stateless hook; the coordinator prompt also forbids git mutation and nested `AgentSwarm`.
 - **Required for final certification evidence.** `tests/runtime/real-binary-smoke.test.ts` runs the real `runSwarm --write` and requires the POSITIVE end-to-end: distinct child journals contain their assigned edits with `Write`/`Replaced` results on the same `toolCallId`, those child-authored changes land in the worktree and captured patch, the user's real tree is byte-identical + git-clean, and the worktree is cleaned up. A patch without per-call child provenance is not accepted as fan-out evidence. The NEGATIVE lane correlates each absolute out-of-root `path` and `toolCallId` with its managed denial. It is the check that catches `tool_input` field-name drift — `Write`/`Edit` carry `path`, not `file_path`, and reading the wrong key denies every real write silently.
 - **Model-invocable agent (v1.5), patch-only by construction.** Following the field-proof above, `--write` now has a `kimi-swarm-write` subagent so the main thread can dispatch a write fan-out on its own judgement — the same human-command + model-invocable-agent split the rest of the suite uses. Auto-dispatch is a safe extension here because it widens **no** write surface and removes **no** bound: the agent path runs the identical `runSwarm --write` code, so edits still land only in the throwaway worktree, the managed hook still gates every `coder` subagent, the patch is still handed back for the user to apply (**the plugin never applies or commits**), and `--budget` + default `--max-concurrency` 1 + the hook requirement all still hold. In fact write-swarm is a *less* dangerous agent than the `kimi-pursue` agent already shipped: pursue writes directly into the workspace, whereas write-swarm's output is a patch the human reviews before anything reaches a real tree. Because it is still a write surface, the agent description demands BOTH signals — many disjoint write targets AND explicit fan-out intent — and steers single edits to `kimi-rescue`, read-only fan-outs to `kimi-swarm`, and autonomous loops to `kimi-pursue`. Default `--max-concurrency` stays **1**; raising it (concurrent writers) remains a deliberate, human-or-explicitly-requested choice.
@@ -291,9 +293,9 @@ at it (the runtime resolves that path instead of `kimi` on `PATH`; every spawn
 still exports `KIMI_CODE_NO_AUTO_UPDATE=1`, so the pinned copy never drifts).
 
 ```sh
-PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.3.2
+PIN=~/.local/share/kimi-plugin-cc/kimi-bin/2.3.3
 mkdir -p "$PIN" && cd "$PIN" && printf '{"name":"kimi-plugin-cc-pin","private":true}\n' > package.json
-bun add @moonshot-ai/kimi-code@2.3.2
+npm install @moonshot-ai/kimi-code@2.3.3
 export KIMI_PLUGIN_CC_KIMI_BIN="$PIN/node_modules/.bin/kimi"   # e.g. in ~/.zshenv
 ```
 

package/docs/swarm-recovery.md

@@ -0,0 +1,33 @@
+# Recovering an interrupted swarm
+
+Normal stop: use `scripts/companion.sh cancel` for a shell-owned run, or the MCP job cancel tool for an MCP-owned run. A hard kill cannot execute cleanup. Cancellation still starts no fresh cleanup server.
+
+For exact CLI 2.3.2 and 2.3.3 swarm runs created by this runtime, status includes a durable `swarm_recovery` record. It contains the resolved home/workspace, companion identity, launch intent, verified process identities and session identity. It never contains the web authentication token, credentials, prompt or config contents. Session identity is committed before the request enabling swarm mode.
+
+## Preview, then recover
+
+Run from the original repository with its original plugin data root and Kimi home:
+
+```sh
+scripts/companion.sh recover-swarm <job-id>
+scripts/companion.sh recover-swarm <job-id> --apply
+```
+
+Preview does not signal processes, modify sessions, or capture patches. Apply:
+
+1. Requires the original companion to be gone and acquires an identity-checked recovery claim. A second recovery cannot race the first; a dead recovery owner can be reclaimed by compare-and-swap.
+2. Revalidates recorded processes and groups. It stops only verified individual identities, never a guessed PID or unproven group. An unknown surviving group member, changed group, incomplete probe or unrecorded launch refuses recovery.
+3. If session cleanup is pending, requires the selected exact certified CLI and valid managed hook. It starts one bounded authenticated web lifecycle, disables the recorded session's swarm mode, verifies status and the exit journal, then verifies process quiescence. It does not resume a prompt, generate model output, install hooks or retry failed cleanup automatically. New recovery web launches are themselves journaled.
+4. Captures a binary patch from a retained write worktree. It does not apply the patch or delete the tree. The result names both paths for inspection.
+
+The recovery attempt has a 30-second cancellation signal, with bounded identity probes and normal teardown. Interrupting recovery retains its journal. An already-recovered record is an idempotent no-op. Failed/cancelled/completed job outcomes are immutable; a previously running abandoned job becomes failed, never completed. Recovery status is separate from task success.
+
+## Limits and manual inspection
+
+- SIGKILL between process creation and durable identity capture leaves an explicit pending launch. Apply refuses to guess ownership. A supervisor/OS-owned launch primitive would be required to eliminate this remaining crash window; the journal does not claim that guarantee.
+- No recovery record means no automatic recovery: older runs, or a failure before the record was created, require inspection. Recovery is not general-purpose process or native-session cleanup.
+- Windows does not currently provide the required durable process-identity proof. Preview is available; apply refuses. This does not change existing Windows direct-child cancellation limits.
+- A changed home, missing/redirected worktree, CLI mismatch, invalid hook or uncertain identity leaves evidence intact and reports failure. Do not repair this by bypassing the hook or killing processes by name.
+- Abandoned worktrees are no longer age-deleted. Inspect and recover them before explicitly removing them. This also protects legacy orphaned trees without a recovery record.
+
+The trust boundary is the same local, host-owned plugin database used for execution plans. Recovery does not make an attacker-modified database trustworthy. Internal Git capture retains the repository-configuration trust boundary documented in [safety.md](safety.md).