octwin-cli 0.8.12 → 0.8.13

package/CHANGELOG.md

@@ -7,6 +7,42 @@ repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut th
 
 ## [Unreleased]
 
+## [0.8.13] - 2026-09-27
+
+### Added
+- **`octwin records archive <id>` / `restore <id>`.** Archive is how a record leaves use — test data
+  included: it drops out of every list, count and report and fires the entity's `on.archived`
+  reactions, exactly like the console's Archive; `restore` undoes it. There is no delete, on the
+  platform or here, and `octwin records --help` now says so.
+
+### Fixed
+- **`octwin chat` said the AI Agent wrote every message.** A reminder that fired mid `--script` (a
+  `schedule_notify`, a reaction) printed as `← <body>`, was taken for the turn's reply, and ended
+  the turn on it — so the real reply looked lost while `octwin logs` showed the flow had worked.
+  Each line now says who sent it: `← [notify] …` (not the turn's answer — the wait for the real
+  reply goes on), `← [operator: Name] …` (a person in Live chat), `← [platform] …` (a handoff
+  joining or returning); plain `← …` is the AI Agent. After the last turn the stream stays open
+  3 s more, so a late message prints (marked "after the last turn") instead of reaching a closed
+  connection. Needs a platform that stamps `source: 'notify'` on web renders; an older one just
+  prints notifies unlabelled, as before.
+- **The "no such template" hint named a file the platform never loads.** It said
+  `templates/<name>.yaml`; pack templates load only as `templates/<name>.template.yaml`, so a
+  template saved as the hint said was silently ignored.
+
+### Changed
+- **`octwin validate` runs the platform's FULL check by default — and needs no login for it.** The
+  offline checks are a subset, and a subset that passes read as "deploy will pass": it passed a pack
+  the full check refused (a scaffold flow left behind with Arabic copy only, in a pack that ships
+  English). Now `validate` runs the offline checks, then the full one: through your workspace when you
+  have a token AND a `--project` (which also confirms the project exists), otherwise through the
+  platform's public validate route with no credential. When it cannot reach the full check — no url,
+  offline, rate-limited, an older platform — the LAST line says *"only the OFFLINE check ran — a
+  PARTIAL check"* and why, and it exits 0 as before. `--remote` now means "the full check is
+  required" (not reaching it is an error); the new `--offline` runs only the subset.
+- **The scaffold's example `browse` flow says it is an example.** Its header, its copy file and its
+  `manifest.yaml` line now say to replace it, or delete the flow, every `browse.locale.*.yaml` and the
+  `flows:` line together — a leftover never loads, but a second language makes it fail validation.
+
 ## [0.8.12] - 2026-09-25
 
 ### Changed

package/README.md

@@ -65,15 +65,15 @@ octwin status               # "✓ live and current" once it's warm
 | Command | What it does |
 | --- | --- |
 | `octwin init <dir>` | Scaffold a new pure-YAML pack into `<dir>` (writes a starter `manifest.yaml`, flow, prompt, `.gitignore` and `README.md` — pack content only). Options: `--id`, `--description`, `--display-name`. |
-| `octwin validate` | Check the pack locally (structure + pure-YAML rules). `--remote` runs **the same validation the platform runs to load your pack** — every declaration file (`xrm.yaml`, `scheduling.yaml`, `worklist.yaml`, `roles.yaml`, `automation.yaml`, `integrations.yaml`, `surveys.yaml`, `taps.yaml`, `commands.yaml`, `journeys/`, `messages.<lang>.yaml`), the cross-file checks between them, and the **flow lint** — conventions the schema can't express, like an `assign:` whose value is a quoted literal or a `$t()` key with no namespace. These need template expansion and the platform's own schemas, which only the server has, so a local ✓ does not cover them. A `--remote` ✓ and a successful deploy are now the same answer by construction, not by convention. |
+| `octwin validate` | Fast offline checks (structure + pure-YAML rules + the checks the pulled KB drives), then — **by default, with no login needed** — **the same validation the platform runs to load your pack**. Without a token and a `--project` it asks the platform's public validate route; with both it goes through your workspace and also confirms the project exists. When it cannot reach the platform, the LAST line says *"only the OFFLINE check ran — a PARTIAL check"* and why. `--remote` makes the full check required (not reaching it is an error); `--offline` runs only the subset. The full check covers every declaration file (`xrm.yaml`, `scheduling.yaml`, `worklist.yaml`, `roles.yaml`, `automation.yaml`, `integrations.yaml`, `surveys.yaml`, `taps.yaml`, `commands.yaml`, `journeys/`, `messages.<lang>.yaml`), the cross-file checks between them, and the **flow lint** — conventions the schema can't express, like an `assign:` whose value is a quoted literal or a `$t()` key with no namespace. These need template expansion and the platform's own schemas, which only the server has, so an offline ✓ does not cover them. A full-check ✓ and a successful deploy are the same answer by construction, not by convention. |
 | `octwin login` | Sign in to a platform URL **and make it the default target** (both stored in `~/.octwin/credentials.json`). With no `--token` it prints a link to approve in the console, then collects a 30-day token itself — nothing is pasted. The wait is bounded and resumable: run it again to keep waiting on the same request. `--url`, `--token`, `--wait <seconds>`, `--json`. |
 | `octwin whoami` | Verify the saved/passed token is valid for a tenant. `--url`, `--tenant`. |
 | `octwin deploy` | Upload + install the pack onto your tenant's project. `--seed` also runs the pack's demo seed. Says **nothing** about the public marketplace unless asked: `--request-listing` submits the pack for operator review (needs `listing.public: true` in the manifest too), `--withdraw-listing` retracts. Reports the **listing verdict** whenever one exists. |
 | `octwin status` | Report what the platform has live for this pack — installed version, the **content sha** the instance loaded vs. the one the catalog holds (a redeploy of the *same* version changes it), its flows, and whether it is live on the public marketplace. |
 | `octwin pull <packId>` | Write a **deployed** pack's source back to disk — the inverse of `deploy`, and how a pack pushed from one machine is recovered. Defaults to the version installed on the target project; `--version` overrides, `--dir` defaults to `./<packId>`, a non-empty dir needs `--force`. You may pull a pack your tenant **owns**. |
-| `octwin chat "msg"` | Drive a turn through the dev web channel and print **every render with its tap ids**. `--as <handle>` picks the test user; `--tap "<tap-id>"` presses a rendered button/list row; `--json` dumps the raw envelopes. |
+| `octwin chat "msg"` | Drive a turn through the dev web channel and print **every render with its tap ids**. `--as <handle>` picks the test user; `--tap "<tap-id>"` presses a rendered button/list row; `--json` dumps the raw envelopes. Each reply line says who sent it: plain `← …` is the AI Agent, `← [notify] …` a reminder or notification (never taken for the turn's reply), `← [operator: Name] …` a person in Live chat, `← [platform] …` a handoff line. |
 | `octwin logs` | List recent conversations (handle, status, last activity; `--as` filters), or show one conversation's full event timeline — including what each turn rendered. `--json` for raw payloads. |
-| `octwin records` | Inspect the pack's XRM data (needs a `records:read` token). No args = list entities. |
+| `octwin records` | Inspect the pack's XRM data (needs a `records:read` token). No args = list entities. Writes (`records:write`): `create`, `patch`, `stage`, `note`, and `archive <id>` / `restore <id>` — there is no delete; archive takes a record (test data too) out of every list and count, and restore brings it back. |
 | `octwin work` | The work inbox: worked records across queues, one item + its timeline and decisions, or `--queues` for queue keys + open counts. Casework is one shape of it — the command spans every entity a pack works. |
 | `octwin projects` | The `--project <slug>` values this token can name, with the plan's project cap. `--archived` includes archived ones. A `pack:deploy` token reaches it — it names a project in every other command, so this turns "guess the slug" into "read the list". |
 | `octwin agents` | The agent roster with each agent's **effective** model / history window and **which layer set it** (project override → platform default → pack manifest) — an operator platform default can override what your manifest declares. `--prompt` prints the exact system prompt the LLM sees. Needs `agents:read`. |
@@ -88,7 +88,7 @@ octwin status               # "✓ live and current" once it's warm
 | `octwin usage` | Model calls, tokens and cost, by model / kind / agent / channel. Project when one is pinned, workspace otherwise. Needs no particular scope. **Model spend only** — WhatsApp/Meta message billing is operator-only and no API token can read it. |
 | `octwin media generate "<prompt>"` | AI-generate an image, store it as a public asset, and print its `MEDIA-` handle + serve URL. `--out` downloads the bytes (WhatsApp renders only `.png`/`.jpg`); `--json`. Pairs with `octwin chat --media` to drive media-collect flows. Needs `media:generate`. |
 | `octwin platform-kb pull` | Pull the platform's capability reference into `.octwin/platform-kb/` for the **`octwin-pack`** Claude Code authoring plugin: guides as markdown, plus **one JSON file per capability** (`primitives/record_list.json`, `render-intents/carousel.json`, `declarations/xrm.json`, …) and **three maps** — `INDEX.md` (the corpus, by family and size), `SYMBOLS.md` (every name → its exact file; grep this), `OUTLINE.md` (every heading with its line number). **No token needed** — the reference is served anonymously. `--if-stale` skips the download when your copy is current (cheap enough for every session); `--check` writes nothing and exits 0 current / 2 stale / 1 could-not-tell. |
-| `octwin test` | Alias for `octwin validate --remote` — the platform's full manifest + flow-DSL check. |
+| `octwin test` | Alias for `octwin validate --remote` — the platform's full check, required (a skipped full check is an error). |
 | `octwin feedback` | Submit this pack's `FEEDBACK.md` to the platform team, with the pack version, your CLI version and the `content_hash` of the capability reference you pulled — the two facts that separate a real platform gap from something already fixed or a stale KB. |
 | `octwin help` | Show usage. Every subcommand also answers `--help`. |
 

package/dist/index.js

@@ -9,7 +9,7 @@
  *
  *   octwin --version | -v           # print the CLI version (+ any upgrade notice)
  *   octwin init <dir> [--id my-pack] [--description "..."] [--display-name "..."]
- *   octwin validate [--dir .] [--remote] [--require-kb]   # --remote → the platform's FULL schema check + lint, all errors at once
+ *   octwin validate [--dir .] [--remote | --offline] [--require-kb]   # the platform's FULL check by default (no login needed); --offline = the partial subset
  *   octwin login   --url <platformUrl> [--token oct_…]   # no token → approve in a browser
  *   octwin whoami  [--url <url>] [--tenant <slug>]
  *   octwin projects [--archived]    # the --project slugs this token can name
@@ -69,7 +69,7 @@ import { loadAllowedRenderKeys, findRenderKeyViolations, describeRenderFinding }
 import { loadPrimitiveArgSpecs, findArgViolations, describeArgFinding, findArgWarnings, describeArgWarning, } from './lib/args-check.js';
 import { yamlLineOf } from './lib/yaml-pos.js';
 import { localhostFamilyHint } from './lib/net-hint.js';
-import { authHeaders as buildAuthHeaders } from './lib/client-headers.js';
+import { authHeaders as buildAuthHeaders, clientReportHeaders } from './lib/client-headers.js';
 import { loadBuiltinNames, findBuiltinViolations, describeBuiltinFinding } from './lib/builtin-check.js';
 import { loadTemplateSpecs, findTemplateViolations, describeTemplateFinding } from './lib/template-check.js';
 import { loadSystemEntities, findEntityViolations, describeEntityFinding } from './lib/entity-check.js';
@@ -78,6 +78,7 @@ import { findPlatformKbDir } from './lib/kb-path.js';
 import { reportChecks } from './lib/outcome.js';
 import { classifyPackPath, isSkippedDir } from './lib/pack-source.js';
 import { readPage, morePageHint } from './lib/page.js';
+import { chatLabel, answersTheTurn } from './lib/chat-line.js';
 import { kbOneLiner, buildKbIndexMarkdown, buildKbOutlineMarkdown, } from './lib/kb-index.js';
 import { buildSymbols, linkExplainers, renderSymbolsMarkdown } from './lib/kb-symbols.js';
 import { readPending, writePending, clearPending, isPendingExpired, secondsLeft, interpretPoll, clientLabel, EXIT_STILL_PENDING, } from './lib/device-login.js';
@@ -199,6 +200,8 @@ const VERB_REQUIREMENTS = {
     'records patch': { scope: 'records:write', feature: 'records' },
     'records stage': { scope: 'records:write', feature: 'records' },
     'records note': { scope: 'records:write', feature: 'records' },
+    'records archive': { scope: 'records:write', feature: 'records' },
+    'records restore': { scope: 'records:write', feature: 'records' },
     'records tasks': { scope: 'records:read', feature: 'tasks' },
     'records task': { scope: 'records:write', feature: 'tasks' },
     'work assign': { scope: 'work:write', feature: 'work' },
@@ -872,7 +875,8 @@ function exitNow(code) {
  *  `platform-kb` refreshes the reference itself, so it needs no nudge). */
 function commandTouchesPlatform(command, flags) {
     switch (command) {
-        case 'validate': return flags.remote === true; // offline validate stays offline
+        // `validate` runs the FULL check against the platform by default now; only `--offline` stays offline.
+        case 'validate': return flags.offline !== true;
         case 'deploy':
         case 'status':
         case 'test':
@@ -1192,36 +1196,62 @@ async function cmdValidate(flags) {
     if (skipped.length && flags['require-kb'] === true) {
         die(`--require-kb: ${skipped.length} check${skipped.length === 1 ? '' : 's'} could not run (${skipped.join(', ')})`);
     }
-    if (flags.remote !== true) {
-        // The LAST line carries the skip. A reader who sees a ✓ and stops there is the
-        // failure mode; a caveat printed ABOVE the ✓ does not fix it.
-        if (skipped.length) {
-            console.log(`\n⚠ ${id}@${version} passed the checks that RAN — ${skipped.length} skipped: ${skipped.join(', ')}.`);
-            console.log('  Run `octwin platform-kb pull` (once, at your repo root — it covers every pack under it),');
-            console.log('  or `octwin validate --remote` to have the platform run everything server-side.');
-        }
-        else {
-            console.log('  Run `octwin validate --remote` to run the platform\'s FULL manifest + flow-DSL validation');
-            console.log('  (all errors at once) before you deploy.');
-        }
-        return;
-    }
-    // Remote: the SAME validation the deploy route runs — manifest `.strict()` +
-    // every flow (schema/expression/structure) — returning ALL errors at once.
-    const t = resolveTarget(flags);
-    const { url } = t;
-    console.log(`→ Validating against ${targetLabel(t)} @ ${url} …`);
+    /**
+     * ── The FULL check is the DEFAULT — the one deploy runs ─────────────────────────
+     *
+     * The checks above are a SUBSET: they replay what the KB publishes, file by file. On
+     * 2026-09-25 they passed a pack the platform refused — a starter flow left behind with
+     * Arabic copy only, in a pack that ships English — and "the offline check passed" had read
+     * as "deploy will pass". So `validate` now asks the platform unless told not to, and says
+     * PARTIAL, on its last line, whenever it could not.
+     *
+     * Two doors, one check (`routes/packs/_validate-bundle.ts` on the platform):
+     *   • a token AND a named project (`--project` / `PACK_PROJECT`) → the logged-in door,
+     *     which also confirms the project exists — the right pre-flight right before a deploy;
+     *   • anything else → `POST /api/public/packs/validate`, which needs no login and no
+     *     project. An unpinned token with no project would get a 400 on the other door, and a
+     *     default must not fail for a config gap the check itself does not care about.
+     *
+     * `--remote` REQUIRES the full check (a failure to reach it is an error); `--offline` skips it.
+     */
+    if (flags.offline === true)
+        return printPartialTrailer(id, version, skipped, 'you passed --offline');
+    const t = readTarget(flags);
+    if (!t.url) {
+        if (flags.remote === true)
+            die('--remote needs a platform url — pass --url, set PACK_PLATFORM_URL, or `octwin login --url <url>`');
+        return printPartialTrailer(id, version, skipped, 'no platform url is set — pass --url, set PACK_PLATFORM_URL, or `octwin login --url <url>`');
+    }
+    const loggedInDoor = !!t.token && !!t.project;
+    const endpoint = loggedInDoor ? `${t.url}/api/self/p/packs/validate` : `${t.url}/api/public/packs/validate`;
+    const headers = loggedInDoor
+        ? authHeaders(t)
+        // The public door takes no credential — but it still gets this run's client report, so a
+        // stale reference is flagged exactly as it is for a logged-in author.
+        : clientReportHeaders({ cliVersion: VERSION, kbContentHash: LOCAL_KB?.content_hash ?? null });
+    console.log(`→ Running the platform's full check${loggedInDoor ? ` against ${targetLabel(t)}` : ' (no login needed)'} @ ${t.url} …`);
     // `--strict-primitives` (opt-in): the server additionally type-checks LITERAL
     // `args:` values against each primitive's per-key input schema. Expression
     // strings are always exempt — this judges only plain YAML scalars.
-    const res = await fetchOrDie(`${url}/api/self/p/packs/validate`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', ...authHeaders(t) },
-        body: JSON.stringify({
-            files, blobs,
-            ...(flags['strict-primitives'] === true ? { strict_primitives: true } : {}),
-        }),
-    }, 'remote validate');
+    let res;
+    try {
+        res = await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...headers },
+            body: JSON.stringify({
+                files, blobs,
+                ...(flags['strict-primitives'] === true ? { strict_primitives: true } : {}),
+            }),
+        });
+    }
+    catch (err) {
+        const why = `platform unreachable at ${t.url} (${err?.message ?? err})`;
+        if (flags.remote === true) {
+            const hint = localhostFamilyHint(t.url, err);
+            die(`full check — ${why}${hint ? `\n  ${hint}` : ''}`);
+        }
+        return printPartialTrailer(id, version, skipped, why);
+    }
     const text = await res.text();
     let json;
     try {
@@ -1230,6 +1260,14 @@ async function cmdValidate(flags) {
     catch {
         json = text;
     }
+    // A platform older than the public door answers Fastify's default 404 — degrade to the
+    // subset (loudly), or fail when the full check was REQUIRED.
+    if (!loggedInDoor && res.status === 404 && (typeof json !== 'object' || json === null || json.error === 'Not Found')) {
+        const why = `the platform at ${t.url} has no public validate yet — log in and pass --project for the full check`;
+        if (flags.remote === true)
+            die(why);
+        return printPartialTrailer(id, version, skipped, why);
+    }
     if (!res.ok) {
         // A 404 here is AMBIGUOUS and must not be collapsed. The route resolves the
         // tenant and the project BEFORE it validates anything, so a 404 is usually an
@@ -1250,8 +1288,13 @@ async function cmdValidate(flags) {
                 die('this platform has no /packs/validate endpoint yet (older version) — deploy runs the full check');
             die(`remote validate${errDetail(json)} — check --tenant/--project (or PACK_TENANT/PACK_PROJECT); \`octwin projects\` lists what this token can reach`);
         }
-        console.error(`✗ remote validate failed (HTTP ${res.status})`);
-        printAuthHint(res.status, url);
+        // The public door is rate-limited per caller. Hitting it is not a verdict on the pack.
+        if (res.status === 429 && flags.remote !== true) {
+            return printPartialTrailer(id, version, skipped, `the platform's no-login check is rate-limited right now — retry shortly, or log in and pass --project`);
+        }
+        console.error(`✗ full check failed (HTTP ${res.status})`);
+        if (loggedInDoor)
+            printAuthHint(res.status, t.url);
         console.error(typeof json === 'string' ? json : JSON.stringify(json, null, 2));
         exitNow(1);
     }
@@ -1280,6 +1323,19 @@ async function cmdValidate(flags) {
     }
     exitNow(1);
 }
+/**
+ * The LAST lines when only the offline SUBSET ran. A reader who sees a ✓ and stops there is the
+ * failure mode, and a caveat printed ABOVE the ✓ does not fix it — so the word is PARTIAL, it is
+ * last, and it says why. Exit 0, as offline `validate` always has: the subset found nothing, and
+ * a config gap is not a finding (`--remote` is for when the full check must not be skipped).
+ */
+function printPartialTrailer(id, version, skipped, why) {
+    console.log(`\n⚠ ${id}@${version}: only the OFFLINE check ran — a PARTIAL check. Deploy runs more, and can still refuse this pack.`);
+    console.log(`  Why: ${why}.`);
+    if (skipped.length) {
+        console.log(`  Also skipped offline (${skipped.length}): ${skipped.join(', ')} — \`octwin platform-kb pull\` once at your repo root restores them.`);
+    }
+}
 /**
  * Two ways in, one saved result.
  *
@@ -2437,7 +2493,7 @@ function pagingQs(flags, defaultLimit = 50) {
  * guessed) so the ambiguity is documented rather than emergent — a pack that
  * declares an entity actually called `note` reaches it via `--entity note`.
  */
-const RECORD_VERBS = new Set(['create', 'patch', 'stage', 'note', 'tasks', 'task']);
+const RECORD_VERBS = new Set(['create', 'patch', 'stage', 'note', 'tasks', 'task', 'archive', 'restore']);
 /** `octwin records [entity] [id]` — inspect the pack's XRM data (needs a `records:read` token). */
 async function cmdRecords(flags) {
     // A leading reserved word is a write. To READ an entity whose name collides
@@ -2574,6 +2630,24 @@ async function cmdRecordsWrite(flags) {
         console.log(`✓ #${json?.record?.record_number ?? '?'} is now at '${json?.record?.stage ?? to}'`);
         return;
     }
+    // There is no delete — on the platform or here. Archive is how a record leaves use (test data
+    // included): it drops out of every list, count and report, fires the entity's `on.archived`
+    // reactions exactly as the console's Archive does, and `restore` brings it back.
+    if (verb === 'archive' || verb === 'restore') {
+        const archived = verb === 'archive';
+        // `||`, not `??`: an EMPTY id (a failed `$(…)` in a script) must not reach the route.
+        const id = arg || die(`usage: octwin records ${verb} <recordId>`);
+        console.log(`→ ${archived ? 'Archiving' : 'Restoring'} ${id} in ${targetLabel(t)} …`);
+        const { status, json } = await apiSend('POST', `${base}/xrm/records/${encodeURIComponent(id)}/archive`, { archived }, t);
+        if (status === 404)
+            die(`record '${id}' not found`);
+        if (status !== 200)
+            writeFail(`${verb} record ${id}`, status, json, url, true);
+        console.log(archived
+            ? `✓ Archived #${json?.record?.record_number ?? '?'} — out of every list and count. Undo: octwin records restore ${id}`
+            : `✓ Restored #${json?.record?.record_number ?? '?'} — back in use.`);
+        return;
+    }
     if (verb === 'note') {
         const id = arg ?? die('usage: octwin records note <recordId> "the note text"');
         const note = flags._[2] ?? die('octwin records note needs the note text as the last argument');
@@ -2958,6 +3032,7 @@ class SseFrameReader {
 const REPLAY_SETTLE_MS = 400; // quiet gap that marks the end of the connect replay burst
 const TURN_SETTLE_MS = 2_000; // quiet gap after a render = the turn finished sending
 const REPLY_TIMEOUT_MS = 45_000; // hard cap waiting for the first render of the turn
+const LATE_DRAIN_MS = 3_000; // after the last turn: stay connected for late pushes (`drainLateRenders`)
 /**
  * Parse a `--script` file — ONE TURN PER LINE, in order:
  *
@@ -3069,20 +3144,55 @@ async function runChatTurn(args) {
             if (!asJson)
                 console.log(heldLine(held));
         }
+        // Only an ANSWER ends the wait. A notify (a reminder firing mid-script) is printed, labelled,
+        // and the wait goes on — it used to count as the reply, end the turn on the reminder, and leave
+        // the real reply looking lost (`lib/chat-line.ts`).
         if (asJson) {
             console.log(JSON.stringify(f.ev));
-            if (f.ev?.kind === 'render')
+            if (f.ev?.kind === 'render' && answersTheTurn(f.ev))
                 rendersSeen++;
             continue;
         }
         if (f.ev?.kind !== 'render')
             continue; // status/typing noise
-        rendersSeen++;
-        console.log(`← ${f.ev.body ?? '(no text body)'}${f.ev.hint?.type && f.ev.hint.type !== 'text' ? `   (render: ${f.ev.hint.type})` : ''}`);
-        printHint(f.ev.hint);
+        if (answersTheTurn(f.ev))
+            rendersSeen++;
+        printRender(f.ev);
     }
     return { boundary, rendersSeen, held };
 }
+/** One render line — `← <label><body>` — and its interactive content. */
+function printRender(ev, note = '') {
+    console.log(`← ${chatLabel(ev)}${ev.body ?? '(no text body)'}${ev.hint?.type && ev.hint.type !== 'text' ? `   (render: ${ev.hint.type})` : ''}${note}`);
+    printHint(ev.hint);
+}
+/**
+ * After the LAST turn, keep reading for `LATE_DRAIN_MS` and print what arrives — a notify, a
+ * slow post-turn line — before closing the stream. A render the platform pushes to a stream the
+ * CLI has already closed reaches no one and is recorded as undelivered ("the visitor has no open
+ * chat connection"), which reads like a platform fault when it is only the CLI leaving early.
+ */
+async function drainLateRenders(frames, boundary, asJson) {
+    const deadline = Date.now() + LATE_DRAIN_MS;
+    for (;;) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            return;
+        const f = await frames.next(remaining);
+        if (f === 'timeout' || f === 'done')
+            return;
+        if (f.id != null && f.id <= boundary)
+            continue;
+        if (f.id != null)
+            boundary = f.id;
+        if (asJson) {
+            console.log(JSON.stringify(f.ev));
+            continue;
+        }
+        if (f.ev?.kind === 'render')
+            printRender(f.ev, '   (after the last turn)');
+    }
+}
 /** `octwin chat "message" [--as <handle>] [--tap <tap-id>] [--script <file>] [--json]`
  *  — drive a turn (or a whole scripted conversation) through the dev web channel
  *  and print everything it rendered.
@@ -3201,6 +3311,7 @@ async function cmdChat(flags) {
             exitNow(1);
         }
     }
+    await drainLateRenders(frames, boundary, asJson);
     await cancel();
     if (totalRenders === 0 && !anyHeld) {
         console.error(`  no reply after ${Math.round(REPLY_TIMEOUT_MS / 1000)}s — the pack may not be warm yet, or the turn produced no render.`);
@@ -5258,7 +5369,7 @@ function help() {
 
   octwin --version                                      # print the CLI version (+ any upgrade notice)
   octwin init <dir> [--id my-pack] [--description "..."] [--display-name "..."]
-  octwin validate [--dir .] [--remote] [--require-kb]   # --remote runs the platform's FULL schema check + lint (all errors at once)
+  octwin validate [--dir .] [--remote | --offline] [--require-kb]   # the platform's FULL check by default — no login needed
   octwin login   --url <platformUrl>                    # approve in a browser; the CLI collects the token
   octwin login   --url <platformUrl> --token oct_…      # or paste a deploy token from the console
   octwin whoami  [--url <url>] [--tenant <slug>]         # verify the token works
@@ -5290,7 +5401,7 @@ function help() {
   octwin memos   [--all] [--json]                        # read the platform's replies + notices (a reply to your feedback lands here)
 
 Writes — exercise the state your pack creates (each needs the matching :write scope):
-  octwin records create <entity> --set field=value …     # also: patch <id> --entity <e>, stage <id> --to <s>, note <id> "…"
+  octwin records create <entity> --set field=value …     # also: patch <id> --entity <e>, stage <id> --to <s>, note <id> "…", archive|restore <id>
   octwin records tasks | task complete <taskId> [--outcome done|cancelled]
   octwin work    assign <id> --to user:<uuid>|none | note <id> "…" | stage <id> --to <stage>
   octwin work    decide <id> --action <a> [--param k=v] [--dry-run]   # --dry-run previews, commits nothing
@@ -5317,15 +5428,22 @@ Per-command usage: octwin <command> --help`);
 const COMMAND_HELP = {
     init: `octwin init <dir> [--id my-pack] [--description "..."] [--display-name "..."]
   Scaffold a pure-YAML starter pack into <dir>.`,
-    validate: `octwin validate [--dir .] [--remote] [--require-kb] [--strict-primitives]
-  Offline structural check, plus two checks driven by the pulled capability
-  reference (render-intent fields, primitive arguments). Those two SKIP when the
-  reference is missing — the run says so, and --require-kb turns the skip into a
-  failure for CI. --remote additionally runs the platform's FULL manifest +
-  flow-DSL validation and its flow lint (all errors at once) — same check as deploy.
-  --strict-primitives (with --remote) additionally type-checks LITERAL args:
-  values against each primitive's declared input schema; expression strings
-  ('$found.id', '{$t(…)}') are always exempt.`,
+    validate: `octwin validate [--dir .] [--remote | --offline] [--require-kb] [--strict-primitives]
+  First the fast OFFLINE checks (structure, YAML, and the checks driven by the
+  pulled capability reference — those SKIP when the reference is missing, and
+  --require-kb turns the skip into a failure for CI). Then, BY DEFAULT, the
+  platform's FULL validation — the same check deploy runs, all errors at once.
+
+  The full check needs NO login: without a token + --project it goes to the
+  platform's public validate route. With a token AND --project (or PACK_PROJECT)
+  it goes through your workspace, which also confirms that project exists.
+
+  When the platform cannot be reached (no url, offline, rate-limited) the run
+  ends with "only the OFFLINE check ran — a PARTIAL check" and exits 0.
+  --remote REQUIRES the full check: not reaching it is an error. --offline runs
+  only the partial subset. --strict-primitives additionally type-checks LITERAL
+  args: values against each primitive's declared input schema; expression
+  strings ('$found.id', '{$t(…)}') are always exempt.`,
     login: `octwin login --url <platformUrl> [--token oct_…] [--wait <seconds>] [--json]
   Sign in to a platform and make that url the DEFAULT deploy target for every
   later command.
@@ -5403,14 +5521,20 @@ octwin projects rm <slug> [--yes]
     octwin records patch  <recordId> --entity <entity> --set field=value
     octwin records stage  <recordId> --to <stage> [--note "..."]
     octwin records note   <recordId> "the note text"
+    octwin records archive <recordId>          # out of every list and count (test data too)
+    octwin records restore <recordId>          # undo an archive
     octwin records tasks                       # open follow-up tasks (\`tasks\` plan feature)
     octwin records task complete <taskId> [--outcome done|cancelled] [--note "..."]
 
+  There is NO delete — on the platform or here. \`archive\` is how a record leaves use:
+  it fires the entity's \`on.archived\` reactions, exactly like the console's Archive,
+  and \`restore\` brings it back.
+
   --set coerces JSON scalars: \`--set rating=4.5\` sends a number, \`--set x=null\`
   sends null. Use --fields-json '{"a":{"b":1}}' for anything nested.
   \`patch\` needs --entity even though it has an id: the route resolves the field
-  validator from it. A leading \`create/patch/stage/note/tasks/task\` is read as a
-  VERB — to list an entity actually named one of those, use \`--entity <name>\`.`,
+  validator from it. A leading \`create/patch/stage/note/archive/restore/tasks/task\` is
+  read as a VERB — to list an entity actually named one of those, use \`--entity <name>\`.`,
     work: `octwin work [recordId] [--queues] [--unrouted] [--limit 50] [--offset n] [--json]
   Inspect the work inbox — every entity the pack declares worked (cases, orders
   needing review, applications, …): the inbox, one item + its timeline
@@ -5449,6 +5573,13 @@ octwin projects rm <slug> [--yes]
   running media-collect flow (e.g. activate-app).
   --json dumps the raw SSE envelopes for the turn.
 
+  Each reply line says who sent it. Plain \`← …\` is the AI Agent. \`← [notify] …\` is a
+  reminder or notification (a \`schedule_notify\`, a reaction) — NOT the turn's answer,
+  so the wait for the real reply goes on. \`← [operator: Name] …\` is a person in
+  Live chat; \`← [platform] …\` is a platform line (a handoff joining or returning).
+  After the last turn the stream stays open ${LATE_DRAIN_MS / 1000}s more, so a late message
+  still prints (marked "after the last turn") instead of reaching a closed connection.
+
   --script drives a WHOLE conversation from a file, ONE TURN PER LINE, in one
   process over one connection — waiting for each turn to settle before sending
   the next. Use this for any multi-step flow: chaining shell invocations races

package/dist/lib/chat-line.js

@@ -0,0 +1,44 @@
+/**
+ * Who sent a render on the chat stream — and whether it answers the turn.
+ *
+ * `octwin chat` reads ONE stream for a conversation, and more than the AI Agent writes to it:
+ *
+ *   - a `notify` send — a `schedule_notify` reminder, a reaction's notification, a queued
+ *     briefing — which answers nothing the author just sent (`source: 'notify'` on the web
+ *     envelope);
+ *   - a person holding the conversation in Live chat (`author.kind: 'human'`, with a name);
+ *   - a platform line such as a handoff's join / return copy (`author.kind: 'system'`).
+ *
+ * Every one of them used to print as `← <body>`, exactly like the AI Agent's reply. The case
+ * that cost an author real time (chughtai, 2026-09-23): a reminder fired mid `--script`, the CLI
+ * took it for the turn's reply and ended the turn on it, and the real reply — which `octwin logs`
+ * showed the flow had produced correctly — looked lost.
+ *
+ * Kept free of I/O so the rules can be tested without a stream.
+ */
+export function chatSender(ev) {
+    if (ev.source === 'notify')
+        return 'notify';
+    if (ev.author?.kind === 'human')
+        return 'operator';
+    if (ev.author?.kind === 'system')
+        return 'platform';
+    return 'agent';
+}
+/** The label printed before the body — empty for the AI Agent, whose replies stay `← …`. */
+export function chatLabel(ev) {
+    switch (chatSender(ev)) {
+        case 'notify': return '[notify] ';
+        case 'operator': return ev.author?.name ? `[operator: ${ev.author.name}] ` : '[operator] ';
+        case 'platform': return '[platform] ';
+        default: return '';
+    }
+}
+/**
+ * Whether this render is an ANSWER to the message the author just sent — what ends a turn's wait.
+ * A notify is not: it would have been sent whether or not the author wrote anything. An operator's
+ * line and a platform line are: in a held conversation they ARE the reply.
+ */
+export function answersTheTurn(ev) {
+    return chatSender(ev) !== 'notify';
+}

package/dist/lib/template-check.js

@@ -9,7 +9,7 @@
  * platform's own `approve_apply` is the common case: `confirm_title` misspelled
  * silently falls back to the hardcoded Arabic default.
  *
- * PACK TEMPLATES SHADOW PLATFORM ONES. A pack may ship `templates/<name>.yaml`
+ * PACK TEMPLATES SHADOW PLATFORM ONES. A pack may ship `templates/<name>.template.yaml`
  * of its own, and a pack template of the same name wins. So the caller passes
  * the pack's own template names and this check stays silent about them entirely
  * — it has no schema for a template it did not publish, and inventing one would
@@ -96,7 +96,9 @@ export function describeTemplateFinding(f) {
     switch (f.kind) {
         case 'unknown':
             return `${f.file}: \`use: ${f.template}\` — no such template. Platform templates: ${f.known.join(', ')}`
-                + `. (A template of your own must live at templates/${f.template}.yaml in the pack.)`;
+                // `.template.yaml`, not `.yaml`: the platform loads only that suffix, so a template saved
+                // as this hint used to say was silently ignored and the `use:` stayed unresolved.
+                + `. (A template of your own must live at templates/${f.template}.template.yaml in the pack.)`;
         case 'unknown-param':
             return `${f.file}: \`use: ${f.template}\` passes ${f.keys.map(k => `'${k}'`).join(', ')}, which the template declares no param for `
                 + `— dropped in silence, and the body sees undefined. Params: ${f.params.join(', ')}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "octwin-cli",
-  "version": "0.8.12",
+  "version": "0.8.13",
   "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
   "type": "module",
   "bin": {

package/templates/starter/flows/tools/browse.flow.yaml

@@ -1,6 +1,13 @@
+# EXAMPLE — replace it or delete it; do not leave it behind.
 # An example capability the home hub invokes. Replace this with your real tool
 # (record_list + a carousel, a collect: intake, a case_open, …). Kept trivial here
 # so the scaffold is chattable end-to-end: home menu → tap "browse" → this renders.
+#
+# If you do not keep it, delete THREE things together: this file, every
+# `browse.locale.<lang>.yaml` beside it, and the `browse` line in manifest.yaml
+# `flows:` (plus the home menu row that invokes it). A file left here with its
+# manifest line removed never loads — but its copy is still checked, so a pack that
+# adds a second language fails validation over a flow nobody uses.
 flow_id:     browse
 version:     1
 description: An example capability, reached from the home menu. Replace with your real tool.

package/templates/starter/flows/tools/browse.locale.ar.yaml

@@ -1,3 +1,4 @@
+# EXAMPLE copy for the example `browse` flow — delete it together with browse.flow.yaml.
 flow_id: browse
 
 strings:

package/templates/starter/manifest.yaml

@@ -33,7 +33,7 @@ default_settings:
 # front door; add each new tool here as you build it.
 flows:
   - home      # the menu / navigation hub (see references/ux-patterns.md)
-  - browse    # an example tool the hub invokes — replace with your real capability
+  - browse    # an EXAMPLE tool the hub invokes — replace it, or delete this line AND flows/tools/browse.*
 
 # One agent. The platform's universal agent protocol is auto-appended by
 # `createPackAgents` — `instructions:` carries only pack-supplied parts.