agentacct 0.12.8

A reboot no longer strands the macOS app with a dead recorder and no way to act: the recording-health surfaces, the window's recovery gate, the setup sheet, and the menu bar all offer a one-click Start recorder that runs agentacct start in the background — including on a machine whose agentacct came from pipx/uv rather than the app's own install.

macOS app (no Python, pipx, or terminal needed): agentacct-0.12.8.dmg — signed, notarized, and stapled, built from this release's own commit; the frozen agentacct CLI it embeds carries the same behavior, and the app installs that CLI on first setup. It opens with a normal double-click.

CLI: pipx install agentacct==0.12.8 (or uv tool install agentacct==0.12.8).

What changed since 0.12.7:

• The app can start the recorder after a reboot. The window's "The recorder needs recovery" gate previously offered only View saved work and Open recording setup; it now leads with the same one-click start the health popover, the notice stack, the menu-bar dropdown, and the setup sheet's reconnect button use. It runs agentacct start --no-sync-clients --store-dir <the store this window displays> --json and confirms the result with the same status --json readiness check the app-owned reconnect uses.
• It also works when the app owns no verified recorder — a development build, or a machine where pipx/uv installed agentacct over the app's wrapper. The app resolves ~/.local/bin/agentacct and then agentacct on PATH, and accepts a candidate only if its own --version banner says agentacct <version>. The button's caption names what will run: "Starts agentacct 0.12.4 at ~/.local/bin/agentacct — not installed or managed by this app."
• The recorder is genuinely in the background. The CLI's runtime manager spawns the watcher and dashboard detached, so they outlive the app; the app only waits for the start command and then re-reads the recorder's own state.
• The app-owned path is unchanged. reconnectRecorder's provenance and ownership checks, and its precedence whenever it is available, are exactly as before. The external path never installs, updates, replaces or uninstalls that CLI, never refreshes client integrations (--no-sync-clients), and never signals a process it did not start.
• Coverage: 13 new Swift tests pin the external path (candidate order, symlink following, banner rejection, exact argv, store gate, readiness failure and retry, no writes) and the routing rule that the app-owned recorder always wins; the full suite is 669 tests in release mode.