@detergent-software/conductor 1.0.0-dev.13 → 1.0.0-dev.15

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 Releases are tagged `conductor-v<version>` and staged on npm by `atk-conductor-release` (`pipelines/release-conductor.yml`), which writes each section below. `scripts/check-changelog.mjs` fails when a tag has no section here.
 
+## [1.0.0-dev.15](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/branchCompare?baseVersion=GTconductor-v1.0.0-dev.14&targetVersion=GTconductor-v1.0.0-dev.15) (2026-10-11)
+
+### Features
+
+* **conductor:** console escalations, conduct start and conduct console (ATK-314) ([8e394dd](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/commit/8e394ddb3a6ef2b7b7cafa905d49d6beb50d58aa))
+
+### Bug Fixes
+
+* **conductor:** console tab arguments in one tested place (ATK-314) ([58cb8f3](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/commit/58cb8f348cace168644400623e8cd4ea7ab12fce))
+* **conductor:** review fixes for the console commands (ATK-314) ([94cc9e1](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/commit/94cc9e1b7269b73ce3b7eca2ea4890815343c384))
+
+## [1.0.0-dev.14](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/branchCompare?baseVersion=GTconductor-v1.0.0-dev.13&targetVersion=GTconductor-v1.0.0-dev.14) (2026-10-11)
+
+### Bug Fixes
+
+* **conductor:** read an unclean exit from the event log alone (ATK-353) ([44ca320](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/commit/44ca3204a2947fa6df06d2a957565d38c7751d3c))
+* **conductor:** record an unclean daemon exit on the next start (ATK-353) ([b466dd9](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/commit/b466dd98e8876ae08cc5f298acf590dd4486ce4c))
+
 ## [1.0.0-dev.13](https://emergentcode.visualstudio.com/Emergent%20Software/_git/Emergent.AgenticToolkit/branchCompare?baseVersion=GTconductor-v1.0.0-dev.12&targetVersion=GTconductor-v1.0.0-dev.13) (2026-10-11)
 
 ### Features

package/README.md

@@ -1,11 +1,12 @@
 # Conductor
 
-`@detergent-software/conductor`: the local daemon that runs the work loop for every conducted project on this machine, and its `conduct` CLI. The design, decisions and build order are in the Linear document *Conductor: design note* (project *Conductor daemon*). This package has build step 1, the skeleton (ATK-308), step 2, the session manager (ATK-309), step 3, the watchers and `conduct wait` (ATK-310), the daemon's side of step 4, worker protocol v1's `conduct note` (ATK-311), step 5, the inbox with `conduct approve` / `revise` (ATK-312), step 6, the notifier (ATK-313), step 9, the conductor mod for Claude Code in `mod/` (ATK-265), and step 8, the scheduler, settings and rules (ATK-315).
+`@detergent-software/conductor`: the local daemon that runs the work loop for every conducted project on this machine, and its `conduct` CLI. The design, decisions and build order are in the Linear document *Conductor: design note* (project *Conductor daemon*). This package has build step 1, the skeleton (ATK-308), step 2, the session manager (ATK-309), step 3, the watchers and `conduct wait` (ATK-310), the daemon's side of step 4, worker protocol v1's `conduct note` (ATK-311), step 5, the inbox with `conduct approve` / `revise` (ATK-312), step 6, the notifier (ATK-313), step 9, the conductor mod for Claude Code in `mod/` (ATK-265), step 8, the scheduler, settings and rules (ATK-315), and the daemon's side of step 7, the console (ATK-314).
 
 ## Commands
 
 ```text
 conduct serve                     run the daemon in this process (one per machine)
+conduct start                     start the daemon detached and wait until it answers (see Console)
 conduct stop                      stop the running daemon
 conduct status [--json]           the daemon's pid, port, projects and workers
 conduct project add <path>        register the project whose checkout holds .claude/conductor.json
@@ -32,6 +33,11 @@ conduct focus <project> [--slots <n>] [--weight <n>] --until <when>
                                   a project's slots or ordering weight, for a while (neither: it goes first)
 conduct why <event id | item> [--json]
                                   the rule behind an action, and the events that led to it
+conduct console [--project <name>] [--here]
+                                  open the console in a Windows Terminal tab, or in this terminal (see Console)
+conduct escalations [--json]      what rules escalated to the console and it hasn't handled
+conduct escalations done <id> [--ask] <text>
+                                  the console's finding on an escalation; --ask puts it in the inbox
 conduct history [<range>] [--since <when>] [--until <when>] [--project <name>] [--json]
                                   what a window of the log says: shipped, phases, waits, stalls, spend (see History)
 conduct retro [<range>] [--project <name>]
@@ -103,8 +109,10 @@ An item resolves itself when its condition is seen, and records what resolved it
 | `permission`, `stall` | `worker.stalled` | `worker.stall-cleared`, a park or resume, a new wait (stall only), or a daemon restart (it is raised again if it persists) |
 | `failed` | a failed launch, or a session that stopped unexpectedly | a new launch, the worker running again, or its retirement |
 | `runaway` | a worker passing `inbox.runawayTokens` (2M) input, output and cache-write tokens in all, once per worker | `conduct done`, or its retirement |
+| `ready-to-release`, `queue-drained` | the scheduler's default rules (see Scheduler) | `conduct done` |
+| `console` | the console's finding on an escalation, with `conduct escalations done <id> --ask` (see Console) | `conduct done` |
 
-Nothing raises `ready-to-release`, `queue-drained` or `prod-approval` yet. The scheduler (ATK-315) and `/release-atk` will raise them. When a worker is retired, its open items resolve with it.
+Nothing raises `prod-approval` yet; `/release-atk` will. When a worker is retired, its open items resolve with it.
 
 For an item raised from a note:
 
@@ -170,7 +178,7 @@ Rules say what the conductor does when something happens (design note, section 9
 ]
 ```
 
-- **Sources, in order:** the item's project's `rules` (in its `.claude/conductor.json`, changed by PR), then `~/.conductor/rules.json`, then the built-in defaults: conduct-atk's behavior written as rules (`launch`, `retire-closed`, `park-on-wait`, `resume-on-wait`, `runaway`, `daily-cap`, `ready-to-release`, `queue-drained`). A rule with an `id` replaces the rule with the same id further down, so a file holds only the differences.
+- **Sources, in order:** the item's project's `rules` (in its `.claude/conductor.json`, changed by PR), then `~/.conductor/rules.json`, then the built-in defaults: conduct-atk's behavior written as rules (`launch`, `retire-closed`, `park-on-wait`, `resume-on-wait`, `runaway`, `daily-cap`, `ready-to-release`, `queue-drained`, and `conductor-handoff`, which escalates a worker's `Handoff · conductor` note to the console). A rule with an `id` replaces the rule with the same id further down, so a file holds only the differences.
 - **when:** `and`, `or`, `not` and parentheses over comparisons (`==`, `!=`, `<`, `<=`, `>`, `>=`, `in [a, b]`, `<label> in item.labels`) and events. An event rule fires when one of its events happens: `note`, `plan`, `wait.resolved`, `run.failed`, `worker.idle`, `worker.exited`, `worker.permission`, `worker.waiting`, `inbox.raised`, `pr.comment`, `item.unblocked`, `item.closed`, `queue.pick`, `queue.drained`, `queue.ready-to-release`. A rule without one is a state rule, checked on each scheduler tick against each wait, inbox item, worker or project, or once for the machine, by the fields it reads. Fields: `project`, `item.id/area/labels/tier/priority`, `plan.tier`, `note.phase/kind`, `wait.kind/age`, `inbox.kind/age`, `worker.retries/phase`, `spend.worker/item/project/today`, `time`, `day`, `notify.profile`. Values carry units: `15m`, `2h`, `500k`, `2M`, `22:00`, `saturday`.
 - **do:** `launch`, `retire`, `park`, `resume worker`, `retry`, `pause launches [in <project>] [until <when> | for <duration>]`, `pause all launches …`, `unpause launches`, `focus [<project>] weight|slots <n> until <when>`, `auto-approve after <duration>`, `inbox <kind> ["<text>"]`, `remind jason`, `notify <channel> ["<text>"]`, `notify profile <name> [until <when>]`, `label add|remove human|triage|shipped-open`, `flag shipped-open`, `escalate console "<ask>"`, `none`. One string, or a list.
 - **Guardrails:** rules act inside Area locks, slots, quiet hours and config.json's limits. A rule that would go past one is refused when it loads: `focus … slots` over `scheduler.slots`, an override with no end or one over 14 days, `retire` on anything but `item.closed`, `launch` outside `queue.pick` / `item.unblocked`, `park` outside `worker.waiting`, `resume` outside `wait.resolved` / `pr.comment`, `retry` outside `run.failed`. `merge`, `publish`, `approve`, `delete` and `run` aren't in the vocabulary.
@@ -192,7 +200,7 @@ What each action does:
 - `inbox <kind>` raises an item, once while it is open. `inbox runaway` is raised once per worker.
 - `pause` / `unpause` / `focus` set overrides that name the rule.
 - `label add|remove` edits one label on the item (the profile's human label for `human`), at most 20 times a day per item.
-- `escalate console` emits `console.escalated`, which wakes the console's model.
+- `escalate console` emits `console.escalated`, which wakes the console's model; the console reports back with `conduct escalations done` (see Console).
 - `retry` launches a failed launch again, or wakes a session that stopped unexpectedly with the fact. It does this once per item, whatever the rule says: a second failure stays in the inbox. `worker.retries` counts the earlier tries.
 - `auto-approve after N` pushes "auto-approves at HH:MM" where plans go. At the deadline, if the plan still waits (no `revise:`, no newer Plan), it posts `approve: auto-approved by the conductor: rule "<id>", no revise by HH:MM` as the key's owner, which the worker's approval wait reads. No default rule auto-approves. A Plan note's `**Size tier: S**` gives `plan.tier` (and `item.tier` later).
 - `launch` on `item.unblocked` brings the scheduler's next tick forward.
@@ -214,8 +222,8 @@ The scheduler moves conduct-atk's tick into the daemon (design note, section 8).
 3. **Act.** It runs the rules on what it found: `queue.pick` → `launch` (default `launch`), `item.closed` → `retire` (default `retire-closed`; a refused retire raises an inbox item once), `queue.drained` and `queue.ready-to-release` → an inbox item once a day. Each action is a `rule.fired` event, then `rule.done` or `rule.failed`. A launch that failed isn't tried again while its inbox item is open.
 
 `scheduler.mode` decides how far it goes:
-- **`observe`** (the default while conduct-atk's loop still launches, until ATK-314): it reads, plans and logs each action once, and does none of them.
-- **`on`:** it acts.
+- **`on`** (the default): it acts.
+- **`observe`:** it reads, plans and logs each action once, and does none of them. Set it on a machine where conduct-atk's loop still launches.
 - **`off`:** it doesn't run; `conduct queue --fresh` still works out a plan on request.
 
 `conduct queue` shows the last plan (`--fresh` reads again): slots, holds, picks with their Area, and why each other item waits. A change of plan is a `scheduler.planned` event. A project whose read fails picks nothing that tick and logs `scheduler.read-failed` once, then `scheduler.read-recovered`. An item whose last open blocker closed is an `item.unblocked` event.
@@ -279,7 +287,7 @@ Everything lives in `~/.conductor` (`CONDUCTOR_HOME` overrides it):
 
 | File | Holds |
 |---|---|
-| `config.json` | machine settings, JSONC (comments allowed), validated at startup; `inbox.runawayTokens` (2000000, the `runaway` rule's number); `notify` and `quietHours` (see Notifications); `scheduler` holds `mode` (`observe`, `on` or `off`), `slots` (4, across projects, and the most any rule can give one project), `dailyTokens` (20000000, the `daily-cap` rule's number) and `tickSeconds` (120); `sessions` holds `pollSeconds` (10), `settleSeconds` (5), `permissionMinutes` (5), `idleMinutes` (20); `watchers` holds `ado`, `github`, `health`, `linear` and `npm`, each `{ intervalSeconds, perMinute }` (30/60, 30/30, 30/30, 30/10, 20/30), and `statsMinutes` (10) |
+| `config.json` | machine settings, JSONC (comments allowed), validated at startup; `inbox.runawayTokens` (2000000, the `runaway` rule's number); `notify` and `quietHours` (see Notifications); `scheduler` holds `mode` (`on`, `observe` or `off`), `slots` (4, across projects, and the most any rule can give one project), `dailyTokens` (20000000, the `daily-cap` rule's number) and `tickSeconds` (120); `sessions` holds `pollSeconds` (10), `settleSeconds` (5), `permissionMinutes` (5), `idleMinutes` (20); `watchers` holds `ado`, `github`, `health`, `linear` and `npm`, each `{ intervalSeconds, perMinute }` (30/60, 30/30, 30/30, 30/10, 20/30), and `statsMinutes` (10) |
 | `rules.json` | machine rules, JSONC, reloaded on save (see Rules) |
 | `token` | the API token, readable by this user only; every request sends `Authorization: Bearer <token>` |
 | `conductor.pid`, `port` | the single-instance lock and where the API listens (`127.0.0.1`) |
@@ -291,6 +299,8 @@ Everything lives in `~/.conductor` (`CONDUCTOR_HOME` overrides it):
 - `GET /projects`: the registered projects. `POST /projects` with `{ "path": "<absolute path>" }` registers one.
 - `GET /events`: the event log as server-sent events. Add `?since=<id>` (or send `Last-Event-ID`) to replay from an id. Without either, the stream starts at the live end. `conduct events` prints it one JSON event per line: the events after `--since` (all of them without it), or with `--follow` everything from there on (live without `--since`). `--follow` reconnects with `Last-Event-ID` when the daemon goes away, so a restart loses nothing, and prints the stream's state as lines without an id: `{"kind":"conduct.connected"}` and, once per outage, `{"kind":"conduct.disconnected","error":…}`.
 - `POST /shutdown`: a clean stop (`conduct stop`).
+- `GET /console/escalations`: the open escalations, oldest first (see Console).
+- `POST /console/escalations/:id` with `{ "text": "<finding>", "ask"?: true }`: the console's report on one; 201 with the escalation, the `console.handled` event's id and the inbox item `ask` raised. 404 when the id isn't an escalation, 409 when it is handled already or older than 14 days.
 - `GET /fleet`: the workers in flight, with session activity, waits and spend (today, total).
 - `POST /workers` with `{ "item": "ATK-309", "project"?, "probe"?, "prompt"?, "conductor"? }`: launch; answers 202 with the `launching` worker. `GET /workers/:id` shows it with its latest events.
 - `DELETE /workers/:id` (`?force=true`): retire; 409 with the unfinished work when it refuses.
@@ -346,12 +356,28 @@ conduct install-startup
 
 To switch from a linked build to the package: `conduct stop`, `npm rm --global @detergent-software/conductor` (removes the link), install the package as above, and run `conduct install-startup` again so the logon task points at the installed `cli.js`.
 
+## Console
+
+The console (design note, section 11) is the one Claude session that stays open beside the daemon. The conductor mod in it does the plumbing in code (see Mod). Its model wakes only for an escalation or for you, and runs the project's console skill (`/conductor-console`, installed by ATK). It has no loop: no Monitor, no heartbeat, no ticks. Everything it knows comes from the daemon, so a new console after a close loses nothing.
+
+```bash
+conduct console                   # a tab in Windows Terminal (window "conductor"), in the project's main checkout
+conduct console --here            # the same session in this terminal
+conduct console --project cadence # with several projects registered: whose checkout it runs in
+```
+
+It runs `claude -n conductor --permission-mode auto -- /conductor-console` with `CONDUCTOR_CONSOLE=1`. The skill starts the daemon if it isn't running (`conduct start`, detached, so it doesn't end with the session), then handles what waits.
+
+**Escalations.** A rule's `escalate console "<ask>"` appends `console.escalated` (the default `conductor-handoff` does it for a worker's `Handoff · conductor` note). The mod wakes the model with `[conductor] escalation #<id> on <item>: <ask>`. The console does the job and reports back with `conduct escalations done <id> "<what it found or did>"`, which logs `console.handled` with the escalation as its cause, so `conduct why <that event>` leads to the rule. With `--ask`, the finding also goes in the inbox as a `console` item, pushed like any other, for something only you can do. `conduct escalations` lists those not yet handled, from the last 14 days, including the ones raised while no console was open; the console reads it when it starts.
+
+**Moving from conduct-atk.** Stop the conduct-atk session, `conduct upgrade` (the scheduler now launches by default), `atk install` in the main checkout, then `conduct console`. A machine that keeps conduct-atk's loop sets `"scheduler": { "mode": "observe" }` in `config.json`.
+
 ## Mod
 
 `mod/` is the conductor mod: a Claude Code plugin (a hooks module, code that costs no tokens) that does the console's plumbing. `conduct install-mod` installs it for this user from the package's own `mod/` folder, as a folder marketplace (`claude plugin install conductor --marketplace <package>/mod --scope user`). Claude Code reads a folder marketplace's plugin in place, so `conduct upgrade` replaces the mod along with the daemon; open sessions load the new version with `/reload-plugins`. `--remove` uninstalls it.
 
 - **Every session** shows a status line, `conductor 3▶ 2⏸ ✉2` (running, parked, inbox), from `GET /fleet` and `GET /inbox` every 30 s. It clears while no daemon answers.
-- **The console**, the session started with `CONDUCTOR_CONSOLE=1` (`$env:CONDUCTOR_CONSOLE=1; claude -n conductor` until the console skill, ATK-314, starts it), also gets:
+- **The console**, the session started with `CONDUCTOR_CONSOLE=1` (`conduct console` starts it; see Console), also gets:
   - **the band** above the prompt while the inbox has items: one hotkey per item (a plan approves after a second press, `y`, since a digit typed into an empty prompt presses a band button; an npm OTP copies its `npm stage approve` line; the rest open the pane), and `o` for the pane;
   - **the pane** (`/conductor`, `o`, or opened at the start, docked as a sidebar on a fullscreen terminal of 144 columns or more): the notification profile (a picker; buttons on mobile) and Remote Control's state, the inbox with each item's actions (approve, revise, copy a command, open a link, done), the workers by project (each project's rule has [pause] and [focus]; a row expands to attach and why), and today's spend;
   - **commands answered in code**, never by the model: `/conductor`, `/inbox`, `/approve <item | #id>`, `/revise <item | #id> <text>`, `/attach <item | worker>`, `/notify [<profile> [--until <when>]]`, `/pause [<project>] [--until <when>]`, `/unpause [<project>]`, `/focus-project <project> [--until <when>]` (puts its items first, until midnight without `--until`; not `/focus`, which is Claude Code's own);
@@ -360,10 +386,10 @@ To switch from a linked build to the package: `conduct stop`, `npm rm --global @
 | Event | Data | The mod |
 |---|---|---|
 | `notify.requested` | `channel: "remote-control"`, `message` | pushes it to the phone (PushNotification), with no model turn, and reports every outcome to `POST /notify/report` (see Notifications). When the push comes back "Remote Control inactive" (PushNotification's `disabledReason` `no_transport`), mobile pushes are off in Claude Code's config (`config_off`), or the call fails, it toasts once, saying which; it says so again only after a push has reached the phone. A push Claude Code holds back while you are at the terminal (`user_present`) is reported as `skipped`, with no toast |
-| `console.escalated` | `text` | wakes the console's model once with `[conductor] escalation on <item>: <text>`; nothing else wakes it |
+| `console.escalated` | `text` | wakes the console's model once with `[conductor] escalation #<event id> on <item>: <text>`; nothing else wakes it |
 | `worker.message-requested` | `to`, `message` | sends the message to that worker's session |
 
-The notifier emits `notify.requested` (see Notifications). The rules engine (ATK-315) will emit the other two.
+The notifier emits `notify.requested` (see Notifications), and the rules' `escalate console` action emits `console.escalated`. Nothing emits `worker.message-requested` yet.
 
 Its checks: `pnpm -C apps/conductor test` runs `mod/tests/model.spec.ts` (the logic, in CI). `claude plugin validate apps/conductor/mod` and `claude plugin test apps/conductor/mod` (the hooks against the engine, UI on the terminal, desktop, VS Code and mobile surfaces) need Claude Code, so they run locally. To try a change before installing it: `claude --plugin-dir apps/conductor/mod`.
 

package/build/cli.js

@@ -7,7 +7,8 @@ import { parseArgs } from 'node:util';
 import { z } from 'zod';
 import { callApi, NotRunningError, ping, readEndpoint } from "./client.js";
 import { loadConfig } from "./config.js";
-import { startDaemon } from "./daemon.js";
+import { CONSOLE_ARGS, CONSOLE_WINDOW, consoleProject, consoleTabArgs, escalationLines, escalationSchema, handledSchema } from "./console.js";
+import { logCrashes, startDaemon } from "./daemon.js";
 import { ConductorError } from "./errors.js";
 import { eventsCommand } from "./events.js";
 import { flagWindow, historyLines, historyReport, historySchema, parseRange, retroMarkdown } from "./history.js";
@@ -28,12 +29,14 @@ import { queueLines, queueViewSchema } from "./scheduler.js";
 import { formatTokens } from "./spend.js";
 import { installStartup, removeStartup, runStartup, startupRunsCli, TASK_NAME } from "./startup.js";
 import { inboxItemSchema, openStore, projectSchema, waitSchema, workerSchema } from "./store.js";
-import { parseTag, upgrade } from "./upgrade.js";
+import { parseTag, restartDaemon, upgrade } from "./upgrade.js";
 import { waitCommand } from "./wait.js";
 import { whyLines, whySchema } from "./why.js";
 const USAGE = `Usage: conduct <command>
 
   serve                     run the daemon in this process (one per machine)
+  start                     start the daemon detached (the logon task, else a detached serve) and
+                            wait until it answers; nothing when it runs already
   stop                      stop the running daemon
   status [--json]           the daemon's pid, port, projects and workers
   project add <path>        register the project whose checkout holds .claude/conductor.json
@@ -65,6 +68,14 @@ const USAGE = `Usage: conduct <command>
                             its items go first (weight 100)
   why <event id | item> [--json]
                             the rule behind an action, and the events that led to it
+  console [--project <name>] [--here]
+                            open the console (the Claude session the conductor mod serves) in a
+                            Windows Terminal tab in the project's main checkout; --here runs it in
+                            this terminal. Also how to get it back after it closed
+  escalations [--json]      what rules escalated to the console and it hasn't handled (14 days)
+  escalations done <id> [--ask] <text>
+                            the console's finding on escalation #<id>, logged; --ask also puts it
+                            in the inbox for you (a "console" item)
   history [<range>] [--since <when>] [--until <when>] [--project <name>] [--json]
                             what a window of the log says: shipped items, time in each phase by tier,
                             plan latency, waits by kind, stalls, failures, inbox, slot use, rules, spend
@@ -207,6 +218,70 @@ async function awaitDaemon(paths) {
     }
     throw new ConductorError(`the conductor did not answer within ${START_WAIT_MS / 1000} s`, [`see ${paths.log}`]);
 }
+// `conduct console`: the console (design note, section 11), the Claude session the conductor mod
+// serves, started with CONDUCTOR_CONSOLE=1 in the project's main checkout, where the console skill
+// is installed. It keeps no state of its own, so a new one after a close loses nothing.
+async function consoleCommand(paths, options) {
+    const project = consoleProject(await projectsNow(paths), options.project);
+    if (options.here) {
+        const child = spawn('claude', CONSOLE_ARGS, { cwd: project.root, env: { ...process.env, CONDUCTOR_CONSOLE: '1' }, stdio: 'inherit' });
+        // Ctrl+C belongs to the session; this process only waits for it to end.
+        process.on('SIGINT', () => { });
+        process.exitCode = await new Promise((done, fail) => {
+            child.on('error', (error) => fail(new ConductorError('could not start claude', [error.message])));
+            child.on('exit', (code) => done(code ?? 1));
+        });
+        return;
+    }
+    if (process.platform !== 'win32') {
+        throw new ConductorError('conduct console opens a Windows Terminal tab', ['run `conduct console --here` in a terminal of your own']);
+    }
+    // A tab starts with Windows Terminal's environment, not this one's.
+    if (process.env.CONDUCTOR_HOME) {
+        throw new ConductorError('a console tab would not see CONDUCTOR_HOME', ['run `conduct console --here` in a terminal where it is set']);
+    }
+    const args = consoleTabArgs(project, process.execPath, realpathSync(fileURLToPath(import.meta.url)));
+    const result = await run('wt.exe', args, { cwd: project.root, timeoutMs: 60_000 });
+    if (result.code !== 0)
+        throw new ConductorError('could not open the console tab', [outputOf(result, 500), 'run `conduct console --here` in a terminal instead']);
+    out(`opened the console in ${project.root} (Windows Terminal window "${CONSOLE_WINDOW}")`);
+}
+// How `conduct start` and upgrade's restart start the daemon detached from this process.
+function daemonStarter(paths, cliPath) {
+    return {
+        awaitDaemon: () => awaitDaemon(paths),
+        runTask: runStartup,
+        // A failed start shows as awaitDaemon's timeout. The daemon runs in its home, not in the
+        // caller's directory, which it would hold open (a worktree it may later remove, say).
+        serveDetached: () => spawn(process.execPath, [cliPath, 'serve'], { cwd: paths.home, detached: true, stdio: 'ignore', windowsHide: true })
+            .on('error', () => { })
+            .unref(),
+        // The logon task's daemon uses ~/.conductor, so it can't start one kept in CONDUCTOR_HOME.
+        taskRunsCli: () => !process.env.CONDUCTOR_HOME && startupRunsCli(cliPath),
+    };
+}
+// `conduct escalations done`: the console reports back on an escalation.
+async function escalationDone(paths, ref, finding) {
+    const id = /^#?(\d+)$/.exec(ref)?.[1];
+    if (id === undefined)
+        throw new ConductorError(`"${ref}" is not an escalation id`, ['`conduct escalations` lists them as #<id>']);
+    const answer = await callApi(paths, { body: finding, method: 'POST', path: `/console/escalations/${id}` });
+    if (answer.status === 404 && !errorBody.safeParse(answer.body).data?.details)
+        throw olderDaemon('no console escalations');
+    const { escalation, event, inbox: raised } = handledSchema.parse(await expectOk(Promise.resolve(answer)));
+    out(`handled escalation #${escalation.id}${escalation.item ? ` on ${escalation.item}` : ''} (event #${event})`);
+    if (raised)
+        out(`and raised inbox item #${raised.id} (console) for you`);
+}
+async function escalations(paths, json) {
+    const answer = await callApi(paths, { method: 'GET', path: '/console/escalations' });
+    if (answer.status === 404)
+        throw olderDaemon('no console escalations');
+    const { escalations: open } = z.object({ escalations: z.array(escalationSchema) }).parse(await expectOk(Promise.resolve(answer)));
+    if (json)
+        return out(JSON.stringify(open, null, 2));
+    escalationLines(open, new Date()).forEach((line) => out(line));
+}
 // `conduct events`: until Ctrl+C with --follow.
 async function events(paths, follow, since) {
     if (since !== undefined && !/^\d+$/.test(since))
@@ -324,15 +399,7 @@ async function launch(paths, item, options) {
     ]);
 }
 async function listProjects(paths, json) {
-    let projects;
-    try {
-        projects = projectsBody.parse(await expectOk(callApi(paths, { method: 'GET', path: '/projects' }))).projects;
-    }
-    catch (error) {
-        if (!(error instanceof NotRunningError))
-            throw error;
-        projects = withStore(paths, (store) => store.listProjects());
-    }
+    const projects = await projectsNow(paths);
     if (json)
         return out(JSON.stringify(projects, null, 2));
     if (projects.length === 0)
@@ -352,6 +419,15 @@ async function main(argv) {
             throw new ConductorError('usage: conduct revise <item> "<what to change>"');
         return answer(conductorPaths(), ref, { action: 'revise', text });
     }
+    // The same for a finding: free text after the id, with --ask as a word of its own anywhere.
+    if (argv[0] === 'escalations' && argv[1] === 'done') {
+        const [ref, ...rest] = argv.slice(2);
+        const ask = rest.includes('--ask');
+        const text = rest.filter((word) => word !== '--ask').join(' ').trim();
+        if (ref === undefined || !text)
+            throw new ConductorError('usage: conduct escalations done <id> [--ask] "<what you found or did>"');
+        return escalationDone(conductorPaths(), ref, { ask, text });
+    }
     const { positionals, values } = parseArgs({
         allowPositionals: true,
         args: argv,
@@ -363,6 +439,7 @@ async function main(argv) {
             force: { type: 'boolean' },
             fresh: { type: 'boolean' },
             help: { short: 'h', type: 'boolean' },
+            here: { type: 'boolean' },
             json: { type: 'boolean' },
             kind: { type: 'string' },
             probe: { type: 'boolean' },
@@ -395,10 +472,16 @@ async function main(argv) {
             if (sub === undefined)
                 throw new ConductorError('usage: conduct attach <worker>');
             return attach(paths, sub);
+        case 'console':
+            return consoleCommand(paths, { here: values.here === true, project: values.project });
         case 'done':
             if (sub === undefined)
                 throw new ConductorError('usage: conduct done <inbox id>');
             return answer(paths, sub, { action: 'done' });
+        case 'escalations':
+            if (sub !== undefined)
+                throw new ConductorError('usage: conduct escalations [--json] | conduct escalations done <id> [--ask] <text>');
+            return escalations(paths, values.json === true);
         case 'events':
             return events(paths, values.follow === true, values.since);
         case 'history':
@@ -468,6 +551,8 @@ async function main(argv) {
             return retire(paths, sub, values.force === true);
         case 'serve':
             return serve(paths);
+        case 'start':
+            return start(paths);
         case 'status':
             return status(paths, values.json === true);
         case 'stop':
@@ -594,6 +679,17 @@ function projectLine(p) {
     const state = p.problem ? `${p.problem}; run \`conduct project add\` again` : p.enabled ? 'enabled' : 'disabled';
     return `  ${p.name}  ${p.root}  (protocol ${p.protocol}, ${state})`;
 }
+// The registered projects: from the daemon, or from the store when it isn't running.
+async function projectsNow(paths) {
+    try {
+        return projectsBody.parse(await expectOk(callApi(paths, { method: 'GET', path: '/projects' }))).projects;
+    }
+    catch (error) {
+        if (!(error instanceof NotRunningError))
+            throw error;
+        return withStore(paths, (store) => store.listProjects());
+    }
+}
 async function queue(paths, json, fresh) {
     // A fresh read asks every project's tracker, within the shared rate budget.
     const answer = await callApi(paths, { method: 'GET', path: `/queue${fresh ? '?fresh=true' : ''}`, timeoutMs: 120_000 });
@@ -679,17 +775,38 @@ async function serve(paths) {
     for (const signal of ['SIGINT', 'SIGTERM', 'SIGBREAK']) {
         process.once(signal, () => void daemon.stop(signal));
     }
-    // Under the logon task nobody sees stderr, so a crash goes to the log. The pid file it leaves
-    // names a dead process, which the next start replaces.
-    process.on('uncaughtException', (error) => {
-        daemon.log.log('error', 'uncaught exception', { error: error.stack ?? String(error) });
-        process.exit(1);
-    });
+    logCrashes(daemon.log);
     await daemon.closed;
 }
 function sleep(ms) {
     return new Promise((done) => setTimeout(done, ms));
 }
+// `conduct start`: the daemon, detached from this process, so it outlives the shell or the Claude
+// session that started it (the console's start runs this). Nothing when one answers already.
+async function start(paths) {
+    const pid = readPid(paths.pid);
+    if (pid !== null && (await ping(paths, pid)))
+        return out(`the conductor is running (pid ${pid})`);
+    // A daemon that is still starting (the logon task's, say) holds the lock: wait for it rather than
+    // start a second one, which would exit on that lock. A pid a reboot reused gets a start after.
+    if (pid !== null && processAlive(pid)) {
+        try {
+            return out(`the conductor is running (pid ${await awaitDaemon(paths)})`);
+        }
+        catch {
+            // Not a daemon that answers: start one, which replaces a stale lock (or says who holds it).
+        }
+    }
+    try {
+        out(`started the conductor ${await restartDaemon(daemonStarter(paths, realpathSync(fileURLToPath(import.meta.url))))}`);
+    }
+    catch (error) {
+        const holder = readPid(paths.pid);
+        if (holder === null || !processAlive(holder))
+            throw error;
+        throw new ConductorError(`process ${holder} holds the conductor's lock (${paths.pid}) but doesn't answer`, ['if it is a hung conductor, stop it, then run conduct start again', `see ${paths.log}`]);
+    }
+}
 async function status(paths, json) {
     let projects;
     try {
@@ -755,7 +872,7 @@ function untilOf(text) {
 async function upgradeCommand(paths, tag, allowDowngrade) {
     const cliPath = realpathSync(fileURLToPath(import.meta.url));
     await upgrade({ allowDowngrade, tag: parseTag(tag) }, {
-        awaitDaemon: () => awaitDaemon(paths),
+        ...daemonStarter(paths, cliPath),
         cliPath,
         installedVersion: version,
         npmInstall: (spec) => npm(['install', '--global', spec], NPM_INSTALL_TIMEOUT_MS),
@@ -773,15 +890,7 @@ async function upgradeCommand(paths, tag, allowDowngrade) {
             return found;
         },
         out,
-        runTask: runStartup,
-        // A failed start shows as awaitDaemon's timeout. The daemon runs in its home, not in the
-        // caller's directory, which it would hold open (a worktree it may later remove, say).
-        serveDetached: () => spawn(process.execPath, [cliPath, 'serve'], { cwd: paths.home, detached: true, stdio: 'ignore', windowsHide: true })
-            .on('error', () => { })
-            .unref(),
         stopDaemon: () => stopDaemon(paths),
-        // The logon task's daemon uses ~/.conductor, so it can't restart one kept in CONDUCTOR_HOME.
-        taskRunsCli: () => !process.env.CONDUCTOR_HOME && startupRunsCli(cliPath),
     });
 }
 // Read from disk each time: upgrade asks again after npm has replaced the package.