greprag 5.79.0 → 5.82.0

package/dist/index.js

@@ -60,14 +60,20 @@ const load_1 = require("./commands/load");
 const project_1 = require("./commands/project");
 const procedure_1 = require("./commands/procedure");
 const delivery_1 = require("./commands/delivery");
+const deploy_gate_1 = require("./commands/deploy-gate");
+const merge_lock_1 = require("./commands/merge-lock");
+const deploy_lock_1 = require("./commands/deploy-lock");
+const deploy_record_1 = require("./commands/deploy-record");
+const deploy_verify_1 = require("./commands/deploy-verify");
 const skillgain_1 = require("./commands/skillgain");
 const docptr_1 = require("./commands/docptr");
 const doc_1 = require("./commands/doc");
 const parity_1 = require("./commands/parity");
+const repodoc_1 = require("./commands/repodoc");
+const search_1 = require("./commands/search");
 const agents_1 = require("./commands/agents");
 const loadout_1 = require("./commands/loadout");
 const persona_1 = require("./commands/persona");
-const assistant_1 = require("./commands/assistant");
 const email_1 = require("./commands/email");
 const sms_1 = require("./commands/sms");
 const codex_1 = require("./commands/codex");
@@ -201,80 +207,78 @@ async function apiDelete(url, apiKey) {
         throw new Error(`API ${res.status}: ${await res.text()}`);
     return res.json();
 }
-const INBOX_HELP = `greprag inbox — read + manage your async message inbox.
-
-  greprag inbox                     List unread for THIS session: its own lines
-                                    only (sender or recipient). Other sessions'
-                                    private lines AND the front desk are hidden —
-                                    the front desk is opt-in (--front-desk).
-  greprag inbox --front-desk        Read the front desk: the tenant catch-all
-                                    (cold opens + inbound email). Add --peek to
-                                    survey without marking read.
-  greprag inbox --all               Audit peek: drop the per-session scope (every
-                                    session's lines) AND include already-read.
-  greprag inbox --peek              List WITHOUT marking read (non-mutating).
-  greprag inbox --session <8hex>    Scope to one specific session's view.
-  greprag inbox --project <name>    Filter to one project's inbox.
-  greprag inbox watch [...]         Long-lived SSE stream (run under Monitor).
-    [--receptionist]                Attend the front desk — wake live on a cold
-                                    open / inbound email (else only manual check).
-    [--assistant]                   Executive assistant — normal delivery PLUS a
-                                    wake on inbound EMAIL arrivals only.
-    [--mechanic]                    Live Mechanic — normal delivery PLUS a wake
-                                    on tenant mechanic_friction events.
-  greprag inbox watchers [--json]   List live armed GrepRAG/Claude/OpenCode
-                                    watchers under your tenant. Codex task
-                                    discovery, including repo/workspace, uses
-                                    codex_app.list_threads.
-  greprag inbox reap                Kill orphaned watcher processes (consumer gone)
-                                    + sweep stale pidfiles. Runs auto at session start.
-  greprag inbox claim <id>          Receptionist: claim a front-desk record so a
-                                    co-armed receptionist stands down (no dup reply).
-  greprag inbox keep <id>           Extend a message's TTL.
-  greprag inbox delete <id>         Delete a message.
-
-To SEND or REPLY (top-level command, NOT an inbox subcommand):
-  greprag send --to discord:<snowflake> "reply"            Reply to a Discord DM.
-  greprag send "msg" --to <handle>@greprag.com              Cold open (tenant catch-all).
-  greprag send "msg" --to <handle>@greprag.com/<session>   Message a specific session.
-  greprag send "msg" --to <h>@greprag.com/<session> --in-reply-to <front-desk-id>
-                                                           Reply that threads a cold open.
-
-Codex session-targeted sends are ordinary durable recipient messages. The
-target's Codex turn hooks surface them at SessionStart/UserPromptSubmit
-boundaries. Codex-to-Codex coordination uses
+const INBOX_HELP = `greprag inbox — read + manage your async message inbox.
+
+  greprag inbox                     List unread for THIS session: its own lines
+                                    only (sender or recipient). Other sessions'
+                                    private lines AND the front desk are hidden —
+                                    the front desk is opt-in (--front-desk).
+  greprag inbox --front-desk        Read the front desk: the tenant catch-all
+                                    (cold opens + inbound email). Add --peek to
+                                    survey without marking read.
+  greprag inbox --all               Audit peek: drop the per-session scope (every
+                                    session's lines) AND include already-read.
+  greprag inbox --peek              List WITHOUT marking read (non-mutating).
+  greprag inbox --session <8hex>    Scope to one specific session's view.
+  greprag inbox --project <name>    Filter to one project's inbox.
+  greprag inbox watch [...]         Long-lived SSE stream (run under Monitor).
+    [--receptionist]                Attend the front desk — wake live on a cold
+                                    open / inbound email (else only manual check).
+    [--mechanic]                    Live Mechanic — normal delivery PLUS a wake
+                                    on tenant mechanic_friction events.
+  greprag inbox watchers [--json]   List live armed GrepRAG/Claude/OpenCode
+                                    watchers under your tenant. Codex task
+                                    discovery, including repo/workspace, uses
+                                    codex_app.list_threads.
+  greprag inbox reap                Kill orphaned watcher processes (consumer gone)
+                                    + sweep stale pidfiles. Runs auto at session start.
+  greprag inbox claim <id>          Receptionist: claim a front-desk record so a
+                                    co-armed receptionist stands down (no dup reply).
+  greprag inbox keep <id>           Extend a message's TTL.
+  greprag inbox delete <id>         Delete a message.
+
+To SEND or REPLY (top-level command, NOT an inbox subcommand):
+  greprag send --to discord:<snowflake> "reply"            Reply to a Discord DM.
+  greprag send "msg" --to <handle>@greprag.com              Cold open (tenant catch-all).
+  greprag send "msg" --to <handle>@greprag.com/<session>   Message a specific session.
+  greprag send "msg" --to <h>@greprag.com/<session> --in-reply-to <front-desk-id>
+                                                           Reply that threads a cold open.
+
+Codex session-targeted sends are ordinary durable recipient messages. The
+target's Codex turn hooks surface them at SessionStart/UserPromptSubmit
+boundaries. Codex-to-Codex coordination uses
 codex_app.send_message_to_thread.`;
-const INBOX_WATCH_HELP = `greprag inbox watch — long-lived SSE subscriber for live inbox delivery.
-
-Run under the Claude Code Monitor tool: each printed line becomes one
-notification, so a parent waiting on a chip report gets it the instant it
-lands instead of polling.
-
-  greprag inbox watch                 Tenant-wide stream.
-  greprag inbox watch --project <name>  Only messages addressed to this project.
-  greprag inbox watch --session <id>    Only messages targeting this session.
-                                        Strictest — cold opens never wake it
-                                        (use --receptionist for the front desk).
-  greprag inbox watch --since <id|iso>  Resume from a known cursor.
-  greprag inbox watch --json            One JSON object per line (preferred under Monitor).
-  greprag inbox watch --quiet           JSON on stdout only. Auto-on when GROK_SESSION_ID is set.
-  greprag inbox watch --receptionist    Attend the front desk — wake live on a
-                                        cold open / inbound email.
-  greprag inbox watch --mechanic        Attend as the live Mechanic — wake on
-                                        mechanic_friction events.
-  greprag inbox watch --no-supervise    Run the SSE loop directly, skipping the
-                                        in-process supervisor (tests/debugging).
-  greprag inbox watch --owner-pid <n>   Owning claude.exe PID (stamped by the arm
-                                        directive; the reaper keeps this watcher
-                                        iff that PID is a live claude.exe).
-
-Arm it BARE under Monitor (persistent:true) — no "while true ... sleep 1" wrapper
-(removed 2026-06-04; it orphaned and OOM-crashed the host). Resilience by default:
-the watch SUPERVISES itself — a parent spawns the SSE loop as a child (Win32
-CreateProcess, not Cygwin fork) and respawns it on any non-clean exit (crash,
-undici error, OS kill); and it SELF-TERMINATES when its Monitor consumer's pipe
-breaks (session reload/end) so it never orphans. Within-session robustness only;
-a watcher cannot survive session reload / --resume / /compact.
+const INBOX_WATCH_HELP = `greprag inbox watch — long-lived SSE subscriber for live inbox delivery.
+
+Run under the Claude Code Monitor tool: each printed line becomes one
+notification, so a parent waiting on a chip report gets it the instant it
+lands instead of polling.
+
+  greprag inbox watch                 Tenant-wide stream.
+  greprag inbox watch --project <name>  Only messages addressed to this project.
+  greprag inbox watch --session <id>    Only messages targeting this session.
+                                        Strictest — cold opens never wake it
+                                        (use --receptionist for the front desk).
+  greprag inbox watch --since <id|iso>  Resume from a known cursor.
+  greprag inbox watch --json            One JSON object per line (preferred under Monitor).
+  greprag inbox watch --quiet           JSON on stdout only. Auto-on when GROK_SESSION_ID is set.
+  greprag inbox watch --receptionist    Attend the front desk — wake live on a
+                                        cold open / inbound email.
+  greprag inbox watch --mechanic        Attend as the live Mechanic — wake on
+                                        mechanic_friction events.
+  greprag inbox watch --no-supervise    Run the SSE loop directly, skipping the
+                                        in-process supervisor (tests/debugging).
+  greprag inbox watch --owner-pid <n>   Owning claude.exe PID (stamped by the arm
+                                        directive; the reaper keeps this watcher
+                                        iff that PID is a live claude.exe).
+
+Arm it BARE under Monitor (persistent:true) — no "while true ... sleep 1" wrapper
+(removed 2026-06-04; it orphaned and OOM-crashed the host). Resilience by default:
+the watch SUPERVISES itself — a parent spawns the SSE loop as a child (Win32
+CreateProcess, not Cygwin fork) and respawns it on any non-clean exit (crash,
+undici error, OS kill); and it SELF-TERMINATES when its Monitor consumer's pipe
+breaks (session reload/end) so it never orphans. Within-session robustness only;
+a watcher cannot survive session reload / --resume / /compact.
 adr: adr/monitor-resilience.md`;
 function readProjectRegistry() {
     try {
@@ -299,6 +303,10 @@ function readProjectRegistry() {
  *    desk ensure   idempotently spawn a detached desk-line if none is running
  *    desk status   is a desk-line up + what local truth would it report now
  *  adr: adr/desk-line-relay.md */
+async function runAnnounce(args) {
+    const { runAnnounce: run } = await Promise.resolve().then(() => __importStar(require('./commands/announce')));
+    run(args);
+}
 async function runDesk(args) {
     ensureEnv(); // load ~/.greprag/.env so GREPRAG_API_KEY is present (self-heals in the detached child)
     const sub = args[0] || 'status';
@@ -350,6 +358,14 @@ async function inbox(args) {
             console.log(INBOX_WATCH_HELP);
             return;
         }
+        // The Assistant role was removed 2026-09-03 (adr/assistant-role.md). Fail
+        // loudly rather than silently arming a stock watcher — 5.44.0 already
+        // shipped a build where `--assistant` was dropped without error and the
+        // operator got a watcher that was not the one they asked for.
+        if (subArgs.includes('--assistant')) {
+            console.error('Error: --assistant is retired — the GrepRAG Assistant role was removed. Drop the flag for a normal watcher, or use --receptionist for the front desk.');
+            process.exit(1);
+        }
         await (0, inbox_watch_1.runInboxWatch)({
             project: getFlag(subArgs, '--project'),
             session: getFlag(subArgs, '--session'),
@@ -358,10 +374,6 @@ async function inbox(args) {
             // --receptionist: attend the front desk — wake live on tenant catch-all
             // (cold open / inbound email). adr: adr/address-grammar.md
             receptionist: subArgs.includes('--receptionist'),
-            // --assistant: attend as the executive assistant — normal session/project
-            // delivery PLUS a wake on inbound EMAIL arrivals only (not cold opens).
-            // adr: adr/assistant-role.md
-            assistant: subArgs.includes('--assistant'),
             mechanic: subArgs.includes('--mechanic'),
             // --no-supervise: run the SSE loop directly, skipping the in-process
             // supervisor. For tests/debugging — the default supervises.
@@ -1260,375 +1272,383 @@ async function retract(args) {
     console.log((0, inbox_retract_1.formatRetractResult)(result.status));
 }
 // -- Main ------------------------------------------------------------------
-const INIT_HELP = `greprag init — configure GrepRAG for an agent client.
-
-  greprag init
-  greprag init --codex [--api-key <existing-key>]
-  greprag init --claude [--api-key <existing-key>]
-  greprag init --opencode [--api-key <existing-key>]
-  greprag init --grok [--api-key <existing-key>]
-  greprag init --all [--root <path>]
-  greprag init --global [--name <name>]
-
-Options:
-  --api-key <key>          Use an existing GrepRAG API key. New accounts are closed.
-  --codex                  Configure Codex hooks + /greprag skill.
-  --claude                 Configure Claude Code hooks + /greprag skill.
-  --opencode               Configure OpenCode plugin.
-  --grok                   Configure Grok Build hooks + skill + rules.
-
-Codex Desktop trust step:
-  After init, start a fresh Codex session, then open Settings -> Settings -> Hooks
+const INIT_HELP = `greprag init — configure GrepRAG for an agent client.
+
+  greprag init
+  greprag init --codex [--api-key <existing-key>]
+  greprag init --claude [--api-key <existing-key>]
+  greprag init --opencode [--api-key <existing-key>]
+  greprag init --grok [--api-key <existing-key>]
+  greprag init --all [--root <path>]
+  greprag init --global [--name <name>]
+
+Options:
+  --api-key <key>          Use an existing GrepRAG API key. New accounts are closed.
+  --codex                  Configure Codex hooks + /greprag skill.
+  --claude                 Configure Claude Code hooks + /greprag skill.
+  --opencode               Configure OpenCode plugin.
+  --grok                   Configure Grok Build hooks + skill + rules.
+
+Codex Desktop trust step:
+  After init, start a fresh Codex session, then open Settings -> Settings -> Hooks
   and trust the GrepRAG hooks.`;
-const HELP = `
-greprag — agent memory for Claude Code, Codex, OpenCode, and Grok Build
-
-Commands:
-  (no command)                    Open the local GrepRAG app
-  app | dashboard [--port N]      Open the local app (use --no-open on remote machines)
-  init [--api-key <existing-key>]
-                                  Auto-detect/ask for Codex, Claude Code, or OpenCode
-  init --claude [--api-key <existing-key>]
-                                  Configure hooks + API key for Claude Code
-  init --global [--name <name>]    Create ~/.greprag/project.json (global anchor)
-  init --opencode [--api-key <existing-key>]
-                                  Configure plugin + anchor for OpenCode
-  init --codex [--api-key <existing-key>]
-                                  Configure lifecycle hooks + anchor for Codex
-  init --grok [--api-key <existing-key>]
-                                  Configure Grok Build hooks + skill + rules
-  grok spawn [--cwd <path>] [--prompt "<text>"]
-                                  Open a fresh Grok TUI in a new terminal
-                                  (Windows schtasks bootloader — survives the
-                                  tool Job Object; child arms its own watch)
-  init --all [--root <path>]       Standard init for cwd, then bulk-register every
-                                   other git repo at depth 1 under <path> (default:
-                                   parent of repo root). Each becomes inbox-addressable.
-  status [--json] [--claude|--codex|--opencode|--grok]
-                                  Installation, auth, platform hooks/plugins, and project state
-  codex doctor                    Diagnose Codex hooks, trust setup, and current thread
-  project-id                       Print the current project_id
-  session-id [--full]              Print this session's id (8-hex, 16-hex for UUIDv7, or full UUID with --full).
-  discover [--json]                Tenant-wide structure: every project, per-shape row counts,
-                                   activity ranges. For cross-project advisors.
-  doc <command>                    Mirror, search, and read project Markdown docs.
-  docptr <command>                 Document-pointer registry and reference backfill.
-  parity [seed]                    Doctrine drift-from-canon: the parity table (unit ·
-                                   lead · stale followers), plus the operator-run seed.
-  agents <adopt|optimize|sync|status>
-                                  Canonical global/repo CLAUDE.md + AGENTS.md doctrine.
-  doctor [--inspect] [--yes]       Diagnose + repair orphan project_ids and identity drift
-  desk [--json]                    Inspect the Agent Front Desk and live routing state.
-  sms <command>                    Configure or inspect SMS front-desk routing.
-  smell "<text>"                   Shortcut for \`greprag fix log "<text>"\`.
-  context status [--session <id>]  Context-size governor readout: live tokens, threshold,
-                                   % consumed, turns since the crossover advisory last fired.
-                                   "context --help" for config (threshold + off-switch).
-  delivery <command>                Resolve and inspect repo delivery profiles.
-  procedure <command>               Governed operational procedure watches and runs.
-  skillgain <command>               Skill-learning queue and installation helpers.
-
-Inbox (email-style messaging across tenants):
-  inbox [--all] [--front-desk] [--session <id>] [--project <name>] [--peek]
-                                List unread, auto-scoped to THIS session: its own
-                                lines (sender OR recipient) only. Other sessions'
-                                private lines AND the front desk are hidden by
-                                default — the front desk (cold opens + inbound
-                                email) is opt-in via --front-desk.
-                                --all = audit peek: drop the per-session scope
-                                (every session's lines) AND include read history.
-                                --session scopes to one specific session's view.
-                                --project filters by project name.
-                                --peek: NON-MUTATING — does not mark any message read.
-  inbox watchers [--json]       List currently-attached live watchers
-                                (Claude / Codex / OpenCode / Grok). Each row:
-                                project · title (session_id) [platform] repo —
-                                project + nano title from session memory, repo
-                                from ~/.greprag/projects.json. Codex task
-                                discovery also uses codex_app.list_threads.
-  inbox watch                   Long-lived SSE stream — prints each message as it lands.
-                                Self-supervising by default: a parent process
-                                respawns the SSE loop (via CreateProcess) on any
-                                non-clean exit — within-session robustness, not
-                                reload-survival. "inbox watch --help" for details.
-    [--project <name>]          Filter to one project inbox (default: tenant-wide).
-    [--session <id>]            Filter to messages targeting this session
-                                (cold opens never wake it — use --receptionist).
-    [--receptionist]            Attend the front desk — wake live on a tenant
-                                catch-all (cold open / inbound email). Without it,
-                                cold opens surface only on a manual inbox check.
-    [--assistant]               Executive assistant — keep normal session/project
-                                delivery AND wake live on inbound EMAIL arrivals
-                                only (not greprag cold opens). adr/assistant-role.md
-    [--mechanic]                Live Mechanic — keep normal session/project
-                                delivery AND wake on tenant mechanic_friction events.
-    [--since <id|iso>]          Resume after a message id or timestamp.
-    [--json]                    Emit raw JSON per line (for piping to Monitor).
-    [--quiet]                   JSON on stdout only (Grok monitor). Auto-on under GROK_SESSION_ID.
-    [--no-supervise]            Run the SSE loop directly (no supervisor) — tests/debug.
-  inbox claim <id>              Receptionist: claim a front-desk record (cold open /
-                                inbound email). First claimant wins; a co-armed
-                                receptionist stands down — no double-reply.
-  inbox keep <id>               Extend a read message's TTL (default delete after 14 days)
-  inbox delete <id>             Permanently delete a message
-  send "body" --to <addr>       Send a message. Body is markdown.
-                                <addr> is a bare handle (tenant catch-all) or
-                                handle/<target> — see Addresses below.
-  send --body-file <path> --to <addr>
-                                Send a long/multiline body from a file.
-  send --stdin --to <addr>      Read message body from stdin.
-    --from-session <id>         Sender's session — denormalized so the recipient can
-                                reply by session without re-discovery.
-    --memory <uuid>             (repeatable) back-pointer to a memory row
-    --artifact <type:id>        (repeatable) e.g. commit:abc123, pr:#42, deploy:def
-    --file <path[:lines]>       (repeatable) e.g. src/auth.ts, src/auth.ts:42, src/x.ts:10-15
-    --ref-json '<json>'         escape hatch — full references object
-    --in-reply-to <id>          Thread a reply back to a front-desk record (cold open /
-                                inbound email) — sets references.in_reply_to so the
-                                ensuing private line continues that conversation.
-    --to-desk                   Self-addressed internal mail — posts to THIS project's own
-                                desk (no recipient; omit --to). Requires --type.
-    --type <internal-type>      Internal messageType for --to-desk (e.g. lore_smell). Queue
-                                item drained by its consumer — never wakes a watcher and is
-                                hidden from the default inbox (audit via 'inbox --all').
-  retract <code>                Pull back a previously-sent message (code is printed on send).
-  discord pair                  Pair Discord DMs to this project — generates a code to DM the bot.
-  discord unpair                Remove the Discord pairing.
-  discord me                    Show current Discord pairing + handoff state.
-  discord handoff [--ttl N]     Pin DMs to this session for N min (default 60); bot DMs a confirmation.
-  discord unhandoff             Clear the handoff pin (DMs revert to default project).
-  discord typing                Refresh the "typing…" indicator on the paired DM thread.
-  send "body" --to discord:<snowflake>
-                                Outbound DM to a paired Discord user from any session.
-                                Unread → hard delete. Read → body replaced with a retracted notice.
-                                Idempotent: double-retract is a no-op.
-
-  Addresses:
-    Cold open: <handle>@greprag.com                 tenant catch-all — first contact when
-                                                    you don't know their session. Lands in
-                                                    their inbox for a manual check; silent
-                                                    (no session wake, no operator ping).
-    Session:   <handle>@greprag.com/<session-uuid>  session-to-session (normal, live)
-    Self-desk: --to-desk --type <internal-type>     internal queue item on your own project
-                                                    desk — no recipient, no wake; drained by
-                                                    its typed consumer (e.g. lore_smell).
-    --session and --project flags were removed; the address carries the target.
-    Project broadcasts (<handle>@greprag.com/<project-name>) were removed.
-
-Email (agent-email front desk — drain inbound attachments to local disk):
-  email [pending]               List pending front-desk email (envelope only).
-  email pull --id <record>      Pull ONE record's attachments to local disk.
-  email pull --all-pending      Pull EVERY pending record's attachments.
-    [--to <dir>]                Save dir. Default: --to > $GREPRAG_EMAIL_DIR >
-                               anchor email_dir > ~/.greprag/email/<project>.
-    [--quiet]                  Only print the one-line summary.
-                               Saved as <subject-slug>-<index>.<ext>; re-pulls
-                               are idempotent. Auto-save: set email_autosave=true
-                               in .greprag/project.json so the mail hook pulls
-                               new attachments each turn.
-
-Memory (episodic project memory — turn/hourly/daily/ship-event):
-  memory search "<query>"        Lexical retrieval over the project's memory.
-                                Same v5 RRF + adjacency pipeline as 'corpus
-                                search'. Use when looking up a specific
-                                problem, bug, or topic.
-    [--limit N=5] [--shape <name>] [--project <name>] [--format markdown|json]
-  memory recap                   Recent daily summaries (SessionStart shape).
-    [--daily-last N=7] [--project <name>] [--format markdown|json]
-  memory daily   [--last N=7]    Most-recent daily summaries.
-  memory hourly  [--last N=24]   Most-recent hourly summaries.
-  memory turns   [--last N=20]   Raw per-turn envelopes (21-day TTL).
-  memory ships   [--last N=50]   Ship-event rows (commits/PRs/deploys/releases).
-    Common flags: [--project <name>] [--from ISO --to ISO] [--format markdown|json]
-  memory compact <hour|day|week> [--now ISO]
-                                Manual compaction trigger (backfill / admin use).
-  memory delete                  Bulk-delete nodes by filters (combinable). DRY
-                                RUN by default; pass --yes to execute. ≥1 filter
-                                required.
-    [--project <name>] [--shape <name>] [--from ISO] [--to ISO] [--session <id>] [--yes]
-  (Aliases: 'briefing' → 'recap' (renamed v5.16.0); 'odyssey' → 'memory'
-   top-level verb (kept for v5.8.0 scripts).)
-
-Project fixes (emergent friction → fix → repair):
-  fix spawn --type <harness|doctrine|injection|env|code> "<one unit>"
-                                [--parent-session <id>]
-                                THE friction reflex: emit a FIX CHIP mission for
-                                exactly this typed friction, now; the chip investigates,
-                                then >=90 repairs autonomously, <90 parks findings.
-  fix log "<text>" [--scope <S>] [--repaired] [--project <name>] [--source-session <id>]
-                                Audit/design-input note only, NOT the friction reflex.
-                                --repaired records a known durable rule directly
-                                (requires --scope).
-                                Top-level alias: greprag smell "<text>".
-  fix list [--all] [--repaired] [--project <name>] [--format json]
-                                Open queue by default; --repaired = resolved durable
-                                rules grouped by scope; --all = tenant-wide census.
-  fix repair <id> "<rule>" [--scope <S>] [--project <name>]
-                                Resolve a fix: record the durable rule, close the entry.
-  fix land <id> --commits <h1,h2> --summary "..." [--files <f,..>] [--units <u,..>] [--harness <h,..>]
-                                Close a fix with repair-ledger write-back.
-  fix ledger [--limit N] [--project <name>] [--format json]
-                                Fleet-activity digest: what chips repaired, when.
-  fix delete <nodeId> [--project <name>]
-                                Hard-remove a fix (noise / cleanup).
-  fix search "<query>" [--scope <S>] [--limit N=10] [--project <name>] [--format markdown|json]
-                                Lexical search across the project's fixes.
-  fix scopes [--project <name>] Distinct scope labels present in this project.
-
-Mechanic control plane (repairs as data — 'greprag mechanic --help'):
-  mechanic status [--format json]      Inventory of live repairs; ⚑ = ready to graduate.
-  mechanic set | unset                 Mark / unmark THIS project as the live Mechanic role.
-  mechanic role [status]               Show whether THIS project is the live Mechanic.
-  mechanic friction "<summary>"        RETIRED: use 'greprag fix spawn --type <type> "<unit>"'.
-  mechanic reply --to <8hex> "<msg>"   Reply on the typed mechanic rail.
-  mechanic attest <nodeId> ...           Record operator-attested regression evidence.
-  mechanic enable <nodeId>             Ratify a shadow repair → active.
-  mechanic disable <nodeId> [--retire] active → shadow (default) or terminal retire.
-  mechanic why <nodeId>                Provenance: friction → fix → repair chain.
-  mechanic off | on                    Panic switch — suspend/resume ALL repairs (local file).
-
-Corpus (upload + search arbitrary text — books, codebases, references):
-  corpus upload <file|url> --raw|--enriched   Create a store + ingest. Mode REQUIRED:
-    [--name <N>] [--kind <K>]   --raw (lexical — docs/code) | --enriched (per-node
-    [--refresh hourly|daily|manual|off]   LLM vocab bridge — prose/voice). K: docs|
-                                prose|transcript|codebase|voice|generic (default docs). html/pdf/docx/
-                                xlsx/csv convert server-side. --refresh tracks a URL
-                                for the freshness loop (URLs only; default off).
-  corpus search <store> "<intent>" [--limit 5] [--section "<h>"] [--shape S]
-                                Single-store search. <store> is a UUID or name.
-  corpus search "<intent>" --all|--store <ref>...  [--kind K] [--limit 8]
-                                Multistore search (RRF-fused). --all = every store.
-  corpus section <store> "<heading>"
-                                Every node under a heading (forgiving: any depth,
-                                dash/case-insensitive).
-  corpus walk <store> <nodeId> [--before 2 --after 2]
-                                Show a node and its surrounding context.
-  corpus status <store>         Write-side enrichment progress (per-node vocab bridge).
-  corpus refresh <store>        Manually re-check a tracked source (re-ingest changed blocks).
-  corpus sources <store>        Freshness state: source, policy, last change, next check.
-  corpus list [--kind K]        List stores under this tenant.
-  corpus delete <store> [--yes] Delete a store and its nodes.
-
-Crush (pre-LLM tool-output compression — safe inside pipes, always exits 0):
-  crush --type <log|search|json> [--ccr] [--query "words"]
-                                Read stdin, write the crushed version to stdout.
-                                log = build/test output (keep errors/traces/summaries),
-                                search = grep/rg output (keep scored top matches),
-                                json = large arrays (keep errors/outliers/first+last).
-                                --ccr stashes the ORIGINAL locally and appends a
-                                trailing <<ccr:HASH>> marker. If compression wouldn't
-                                save tokens (or input is tiny), stdin passes through
-                                verbatim — never breaks the pipe.
-  crush stats                   Totals + ratios from the pipe-wrap stats log
-                                (~/.greprag/crush-stats.jsonl — one record per
-                                --stats invocation; the PreToolUse pipe-wrap
-                                hook passes --stats on every rewrite).
-  retrieve <hash>               Print a CCR-stashed original back to stdout.
-                                Store: ~/.greprag/ccr.db (override GREPRAG_CCR_DB).
-  ccr put --type <t>            Internal: stash stdin byte-exact in the CCR store,
-                                print its 16-hex hash (the opencode inline crusher
-                                uses this to persist originals it crushed in-process).
-
-Archive (governed compact — lossless PNG snapshot of the pre-compact transcript):
-  archive render --transcript <path> [--out-dir <dir>] [--session <8hex>]
-                                Render the transcript main chain to pixel-font
-                                PNGs (~30K chars/page, pixel round-trip verified)
-                                and index pages in the CCR store. The PreCompact
-                                hook runs this automatically before compaction.
-  archive list [--session <id>] Indexed archives with page -> turn ranges.
-  archive snippet [--session <id>]
-                                Print the documented /compact instruction block
-                                (preserve/compress rules + archive pointer line).
-
-Identity (public handle + vanity alias — real email is auth-only, never a routing address):
-  identity show  |  whoami      Print numeric handle + claimed aliases.
-  identity claim <alias>        Claim a vanity alias (e.g. "travis" → travis@greprag.com).
-  identity release <alias>      Drop a claimed alias.
-
-Skills (opt-in advisor skills bundled with the CLI):
-  skill list                    Show bundled skills and install status
-  skill install <name>          Install a bundled advisor (e.g. discord, content-advisor)
-  skill uninstall <name>        Remove a previously-installed advisor
-  skill source stamp <name> --project <p> --path <rel> [--path <rel>...] [--baseline <ref>]
-                                Stamp a skill-staleness baseline against local Git
-
-Load (on-demand doctrine — the CLI is the payload, no .md files):
-  load                          Browse the catalog (chip-spawn, codex chips, mechanic, …)
-  load <name>                   Print that entry's full method inline
-
-Loadout (gift a skill bundle to another tenant — offer, never auto-install):
-  loadout send --to <handle>@greprag.com --skill <name> [--skill <n> …]
-                [--dir <path>] [--advisor <name>] [--note "…"]
-                                Freeze + send a loadout. --skill pulls from your
-                                mirror; --dir snapshots a skill dir from disk.
-  loadout list                  Offered loadouts waiting at your front desk.
-  loadout open <id>             Manifest + a bounded content preview (never ingests).
-  loadout equip <id>            Equip it (alias: accept) — copies skills to your load
-                                store + self-inflates via 'greprag load'.
-  loadout decline <id>          Decline — GCs the snapshot.
-  loadout status                Loadouts you've sent (offered/equipped/declined).
-  loadout unequip <name> [--delete-skills]
-                                Stop a loadout's auto-inflate.
-
-Persona (tenant-scoped speaking instructions):
-  persona list                  List built-in Persona templates.
-  persona use <template>        Activate a built-in Persona template.
-  persona set <text>|--file <f>|--stdin
-                                Save and activate a custom Persona verbatim.
-  persona show                  Show the active Persona.
-  persona clear                 Remove the active Persona.
-
-GrepRAG Instructions (canonical global/repo CLAUDE.md + AGENTS.md):
-  instructions pull <file> [--scope global|repo] [--push]
-                                Pull disk instructions into canon.
-  instructions push [--scope global|repo|all] [--check] [--force]
-                                Render canon back to managed instruction files.
-  agents ...                    Deprecated alias for instructions.
-
-Project metadata (rename / merge / list):
-  project rename <new-name> [--yes]
-                                Rename the project at cwd (anchor + registry + API
-                                + store metadata). Confirms before writing.
-  project merge --from <X> --into <Y> [--apply] [--name <override>] [--json]
-                                Consolidate one project into another. Defaults to
-                                dry-run. --from/--into accept a UUID or project_name.
-                                --name renames the target in the same step.
-  project list [--json]         Every project under this tenant, with anchor + rows.
-
-Assistant (designate this project as the tenant's GrepRAG Assistant — wakes on
-inbound email, drafts in the operator's voice, sends after Front Desk approval):
-  assistant set | unset         Mark / unmark THIS project as the Assistant (local
-                                role flag in .greprag/project.json). When set,
-                                SessionStart auto-loads the doctrine and the inbox
-                                watcher arms with --assistant.
-  assistant status              Show whether THIS project is the Assistant.
-
-Opencode (bridge inbox SSE into a running opencode desktop session — the
-Monitor equivalent, since opencode is turn-based by default):
-  opencode relay --session <id>  [options]
-                                Subscribe to /v1/inbox/stream and inject each
-                                message as a fresh turn in the named opencode
-                                desktop session via /session/{id}/prompt_async.
-                                See \`greprag opencode --help\` for flags.
-
-Other:
-  expand --chunk <id>           Expand a memory cluster (siblings, adjacent, linked)
-  help [--all]                  Show this overview. --all appends every command's
-                                full --help — the complete, always-current guide.
-
-Examples:
-  greprag                                            # open the local customer app
-  greprag init                                       # standard repo setup
-  greprag init --global                              # Cowork / unanchored sessions
-  greprag init --all                                 # register every sibling repo for inbox
-  greprag init --all --root C:\\                     # scan a specific directory
-  greprag inbox
-  greprag send "done with migration" --to alice@greprag.com/abc12345
-                                                     # session-targeted (normal)
-  greprag send "deploy approved" --to alice@greprag.com
-                                                     # cold open — alice's front desk
-  greprag send "Bug in auth flow — repro at line 42" --to alice@greprag.com/abc12345 \
-    --file src/auth.ts:42 --artifact commit:abc123
+const HELP = `
+greprag — agent memory for Claude Code, Codex, OpenCode, and Grok Build
+
+Commands:
+  (no command)                    Open the local GrepRAG app
+  app | dashboard [--port N]      Open the local app (use --no-open on remote machines)
+  init [--api-key <existing-key>]
+                                  Auto-detect/ask for Codex, Claude Code, or OpenCode
+  init --claude [--api-key <existing-key>]
+                                  Configure hooks + API key for Claude Code
+  init --global [--name <name>]    Create ~/.greprag/project.json (global anchor)
+  init --opencode [--api-key <existing-key>]
+                                  Configure plugin + anchor for OpenCode
+  init --codex [--api-key <existing-key>]
+                                  Configure lifecycle hooks + anchor for Codex
+  init --grok [--api-key <existing-key>]
+                                  Configure Grok Build hooks + skill + rules
+  grok spawn [--cwd <path>] [--prompt "<text>"]
+                                  Open a fresh Grok TUI in a new terminal
+                                  (Windows schtasks bootloader — survives the
+                                  tool Job Object; child arms its own watch)
+  init --all [--root <path>]       Standard init for cwd, then bulk-register every
+                                   other git repo at depth 1 under <path> (default:
+                                   parent of repo root). Each becomes inbox-addressable.
+  status [--json] [--claude|--codex|--opencode|--grok]
+                                  Installation, auth, platform hooks/plugins, and project state
+  codex doctor                    Diagnose Codex hooks, trust setup, and current thread
+  project-id                       Print the current project_id
+  session-id [--full]              Print this session's id (8-hex, 16-hex for UUIDv7, or full UUID with --full).
+  discover [--json]                Tenant-wide structure: every project, per-shape row counts,
+                                   activity ranges. For cross-project advisors.
+  doc <command>                    Mirror, search, and read project Markdown docs.
+  docptr <command>                 Document-pointer registry and reference backfill.
+  parity [seed]                    Doctrine drift-from-canon: the parity table (unit ·
+                                   lead · stale followers), plus the operator-run seed.
+  repodoc <index|status>           Stable identity for a repo's own Markdown: blocks keep
+                                   their ids through edits, splits, merges and renames.
+  agents <adopt|optimize|sync|status>
+                                  Canonical global/repo CLAUDE.md + AGENTS.md doctrine.
+  doctor [--inspect] [--yes]       Diagnose + repair orphan project_ids and identity drift
+  desk [--json]                    Inspect the Agent Front Desk and live routing state.
+  sms <command>                    Configure or inspect SMS front-desk routing.
+  smell "<text>"                   Shortcut for \`greprag fix log "<text>"\`.
+  context status [--session <id>]  Context-size governor readout: live tokens, threshold,
+                                   % consumed, turns since the crossover advisory last fired.
+                                   "context --help" for config (threshold + off-switch).
+  delivery <command>                Resolve and inspect repo delivery profiles.
+  deploy-gate [--target <id>]       Repo-independent deploy pre-flight: may a deploy run
+                                   from here, is one already running, what is shipping.
+                                   Read-only; the artifact proof stays with the repo.
+  merge-lock <acquire|release|status>  Serialise merges into a shared canonical
+                                   checkout. Take it before you merge, release after.
+  deploy-lock <acquire|release|status> --target <id>
+                                   One deploy at a time per target. Pass --pid so the
+                                   lock names the deploying process, not this command.
+  deploy-record --target <id>       Remember what this checkout last shipped, so the
+                                   gate can say what a deploy is about to ship.
+  deploy-verify --origin <url> --sha <commit>
+                                   Prove production is serving the commit you shipped.
+                                   Refuses if the build stamp is edge-cacheable.
+  procedure <command>               Governed operational procedure watches and runs.
+  skillgain <command>               Skill-learning queue and installation helpers.
+
+Inbox (email-style messaging across tenants):
+  inbox [--all] [--front-desk] [--session <id>] [--project <name>] [--peek]
+                                List unread, auto-scoped to THIS session: its own
+                                lines (sender OR recipient) only. Other sessions'
+                                private lines AND the front desk are hidden by
+                                default — the front desk (cold opens + inbound
+                                email) is opt-in via --front-desk.
+                                --all = audit peek: drop the per-session scope
+                                (every session's lines) AND include read history.
+                                --session scopes to one specific session's view.
+                                --project filters by project name.
+                                --peek: NON-MUTATING — does not mark any message read.
+  inbox watchers [--json]       List currently-attached live watchers
+                                (Claude / Codex / OpenCode / Grok). Each row:
+                                project · title (session_id) [platform] repo —
+                                project + nano title from session memory, repo
+                                from ~/.greprag/projects.json. Codex task
+                                discovery also uses codex_app.list_threads.
+  inbox watch                   Long-lived SSE stream — prints each message as it lands.
+                                Self-supervising by default: a parent process
+                                respawns the SSE loop (via CreateProcess) on any
+                                non-clean exit — within-session robustness, not
+                                reload-survival. "inbox watch --help" for details.
+    [--project <name>]          Filter to one project inbox (default: tenant-wide).
+    [--session <id>]            Filter to messages targeting this session
+                                (cold opens never wake it — use --receptionist).
+    [--receptionist]            Attend the front desk — wake live on a tenant
+                                catch-all (cold open / inbound email). Without it,
+                                cold opens surface only on a manual inbox check.
+    [--mechanic]                Live Mechanic — keep normal session/project
+                                delivery AND wake on tenant mechanic_friction events.
+    [--since <id|iso>]          Resume after a message id or timestamp.
+    [--json]                    Emit raw JSON per line (for piping to Monitor).
+    [--quiet]                   JSON on stdout only (Grok monitor). Auto-on under GROK_SESSION_ID.
+    [--no-supervise]            Run the SSE loop directly (no supervisor) — tests/debug.
+  inbox claim <id>              Receptionist: claim a front-desk record (cold open /
+                                inbound email). First claimant wins; a co-armed
+                                receptionist stands down — no double-reply.
+  inbox keep <id>               Extend a read message's TTL (default delete after 14 days)
+  inbox delete <id>             Permanently delete a message
+  send "body" --to <addr>       Send a message. Body is markdown.
+                                <addr> is a bare handle (tenant catch-all) or
+                                handle/<target> — see Addresses below.
+  send --body-file <path> --to <addr>
+                                Send a long/multiline body from a file.
+  send --stdin --to <addr>      Read message body from stdin.
+    --from-session <id>         Sender's session — denormalized so the recipient can
+                                reply by session without re-discovery.
+    --memory <uuid>             (repeatable) back-pointer to a memory row
+    --artifact <type:id>        (repeatable) e.g. commit:abc123, pr:#42, deploy:def
+    --file <path[:lines]>       (repeatable) e.g. src/auth.ts, src/auth.ts:42, src/x.ts:10-15
+    --ref-json '<json>'         escape hatch — full references object
+    --in-reply-to <id>          Thread a reply back to a front-desk record (cold open /
+                                inbound email) — sets references.in_reply_to so the
+                                ensuing private line continues that conversation.
+    --to-desk                   Self-addressed internal mail — posts to THIS project's own
+                                desk (no recipient; omit --to). Requires --type.
+    --type <internal-type>      Internal messageType for --to-desk (e.g. lore_smell). Queue
+                                item drained by its consumer — never wakes a watcher and is
+                                hidden from the default inbox (audit via 'inbox --all').
+  retract <code>                Pull back a previously-sent message (code is printed on send).
+  discord pair                  Pair Discord DMs to this project — generates a code to DM the bot.
+  discord unpair                Remove the Discord pairing.
+  discord me                    Show current Discord pairing + handoff state.
+  discord handoff [--ttl N]     Pin DMs to this session for N min (default 60); bot DMs a confirmation.
+  discord unhandoff             Clear the handoff pin (DMs revert to default project).
+  discord typing                Refresh the "typing…" indicator on the paired DM thread.
+  send "body" --to discord:<snowflake>
+                                Outbound DM to a paired Discord user from any session.
+                                Unread → hard delete. Read → body replaced with a retracted notice.
+                                Idempotent: double-retract is a no-op.
+
+  Addresses:
+    Cold open: <handle>@greprag.com                 tenant catch-all — first contact when
+                                                    you don't know their session. Lands in
+                                                    their inbox for a manual check; silent
+                                                    (no session wake, no operator ping).
+    Session:   <handle>@greprag.com/<session-uuid>  session-to-session (normal, live)
+    Self-desk: --to-desk --type <internal-type>     internal queue item on your own project
+                                                    desk — no recipient, no wake; drained by
+                                                    its typed consumer (e.g. lore_smell).
+    --session and --project flags were removed; the address carries the target.
+    Project broadcasts (<handle>@greprag.com/<project-name>) were removed.
+
+Email (agent-email front desk — drain inbound attachments to local disk):
+  email [pending]               List pending front-desk email (envelope only).
+  email pull --id <record>      Pull ONE record's attachments to local disk.
+  email pull --all-pending      Pull EVERY pending record's attachments.
+    [--to <dir>]                Save dir. Default: --to > $GREPRAG_EMAIL_DIR >
+                               anchor email_dir > ~/.greprag/email/<project>.
+    [--quiet]                  Only print the one-line summary.
+                               Saved as <subject-slug>-<index>.<ext>; re-pulls
+                               are idempotent. Auto-save: set email_autosave=true
+                               in .greprag/project.json so the mail hook pulls
+                               new attachments each turn.
+
+Memory (episodic project memory — turn/hourly/daily/ship-event):
+  memory search "<query>"        Lexical retrieval over the project's memory.
+                                Same v5 RRF + adjacency pipeline as 'corpus
+                                search'. Use when looking up a specific
+                                problem, bug, or topic.
+    [--limit N=5] [--shape <name>] [--project <name>] [--format markdown|json]
+  memory recap                   Recent daily summaries (SessionStart shape).
+    [--daily-last N=7] [--project <name>] [--format markdown|json]
+  memory daily   [--last N=7]    Most-recent daily summaries.
+  memory hourly  [--last N=24]   Most-recent hourly summaries.
+  memory turns   [--last N=20]   Raw per-turn envelopes (21-day TTL).
+  memory ships   [--last N=50]   Ship-event rows (commits/PRs/deploys/releases).
+    Common flags: [--project <name>] [--from ISO --to ISO] [--format markdown|json]
+  memory compact <hour|day|week> [--now ISO]
+                                Manual compaction trigger (backfill / admin use).
+  memory delete                  Bulk-delete nodes by filters (combinable). DRY
+                                RUN by default; pass --yes to execute. ≥1 filter
+                                required.
+    [--project <name>] [--shape <name>] [--from ISO] [--to ISO] [--session <id>] [--yes]
+  (Aliases: 'briefing' → 'recap' (renamed v5.16.0); 'odyssey' → 'memory'
+   top-level verb (kept for v5.8.0 scripts).)
+
+Project fixes (emergent friction → fix → repair):
+  fix spawn --type <harness|doctrine|injection|env|code> "<one unit>"
+                                [--parent-session <id>]
+                                THE friction reflex: emit a FIX CHIP mission for
+                                exactly this typed friction, now; the chip investigates,
+                                then >=90 repairs autonomously, <90 parks findings.
+  fix log "<text>" [--scope <S>] [--repaired] [--project <name>] [--source-session <id>]
+                                Audit/design-input note only, NOT the friction reflex.
+                                --repaired records a known durable rule directly
+                                (requires --scope).
+                                Top-level alias: greprag smell "<text>".
+  fix list [--all] [--repaired] [--project <name>] [--format json]
+                                Open queue by default; --repaired = resolved durable
+                                rules grouped by scope; --all = tenant-wide census.
+  fix repair <id> "<rule>" [--scope <S>] [--project <name>]
+                                Resolve a fix: record the durable rule, close the entry.
+  fix land <id> --commits <h1,h2> --summary "..." [--files <f,..>] [--units <u,..>] [--harness <h,..>]
+                                Close a fix with repair-ledger write-back.
+  fix ledger [--limit N] [--project <name>] [--format json]
+                                Fleet-activity digest: what chips repaired, when.
+  fix delete <nodeId> [--project <name>]
+                                Hard-remove a fix (noise / cleanup).
+  fix search "<query>" [--scope <S>] [--limit N=10] [--project <name>] [--format markdown|json]
+                                Lexical search across the project's fixes.
+  fix scopes [--project <name>] Distinct scope labels present in this project.
+
+Mechanic control plane (repairs as data — 'greprag mechanic --help'):
+  mechanic status [--format json]      Inventory of live repairs; ⚑ = ready to graduate.
+  mechanic set | unset                 Mark / unmark THIS project as the live Mechanic role.
+  mechanic role [status]               Show whether THIS project is the live Mechanic.
+  mechanic friction "<summary>"        RETIRED: use 'greprag fix spawn --type <type> "<unit>"'.
+  mechanic reply --to <8hex> "<msg>"   Reply on the typed mechanic rail.
+  mechanic attest <nodeId> ...           Record operator-attested regression evidence.
+  mechanic enable <nodeId>             Ratify a shadow repair → active.
+  mechanic disable <nodeId> [--retire] active → shadow (default) or terminal retire.
+  mechanic why <nodeId>                Provenance: friction → fix → repair chain.
+  mechanic off | on                    Panic switch — suspend/resume ALL repairs (local file).
+
+Corpus (upload + search arbitrary text — books, codebases, references):
+  corpus upload <file|url> --raw|--enriched   Create a store + ingest. Mode REQUIRED:
+    [--name <N>] [--kind <K>]   --raw (lexical — docs/code) | --enriched (per-node
+    [--refresh hourly|daily|manual|off]   LLM vocab bridge — prose/voice). K: docs|
+                                prose|transcript|codebase|voice|generic (default docs). html/pdf/docx/
+                                xlsx/csv convert server-side. --refresh tracks a URL
+                                for the freshness loop (URLs only; default off).
+  search "<query>" [--limit 8] [--kind K] [--store <ref>] [--section "<h>"] [--json]
+                                One search across EVERYTHING greprag holds —
+                                reference banks, repo markdown, skills, memory.
+                                Start here; the corpus forms below are narrower.
+  corpus search <store> "<intent>" [--limit 5] [--section "<h>"] [--shape S]
+                                Single-store search. <store> is a UUID or name.
+  corpus search "<intent>" --all|--store <ref>...  [--kind K] [--limit 8]
+                                Multistore search (RRF-fused). --all = every store.
+  corpus section <store> "<heading>"
+                                Every node under a heading (forgiving: any depth,
+                                dash/case-insensitive).
+  corpus walk <store> <nodeId> [--before 2 --after 2]
+                                Show a node and its surrounding context.
+  corpus status <store>         Write-side enrichment progress (per-node vocab bridge).
+  corpus refresh <store>        Manually re-check a tracked source (re-ingest changed blocks).
+  corpus sources <store>        Freshness state: source, policy, last change, next check.
+  corpus list [--kind K]        List stores under this tenant.
+  corpus delete <store> [--yes] Delete a store and its nodes.
+
+Crush (pre-LLM tool-output compression — safe inside pipes, always exits 0):
+  crush --type <log|search|json> [--ccr] [--query "words"]
+                                Read stdin, write the crushed version to stdout.
+                                log = build/test output (keep errors/traces/summaries),
+                                search = grep/rg output (keep scored top matches),
+                                json = large arrays (keep errors/outliers/first+last).
+                                --ccr stashes the ORIGINAL locally and appends a
+                                trailing <<ccr:HASH>> marker. If compression wouldn't
+                                save tokens (or input is tiny), stdin passes through
+                                verbatim — never breaks the pipe.
+  crush stats                   Totals + ratios from the pipe-wrap stats log
+                                (~/.greprag/crush-stats.jsonl — one record per
+                                --stats invocation; the PreToolUse pipe-wrap
+                                hook passes --stats on every rewrite).
+  retrieve <hash>               Print a CCR-stashed original back to stdout.
+                                Store: ~/.greprag/ccr.db (override GREPRAG_CCR_DB).
+  ccr put --type <t>            Internal: stash stdin byte-exact in the CCR store,
+                                print its 16-hex hash (the opencode inline crusher
+                                uses this to persist originals it crushed in-process).
+
+Archive (governed compact — lossless PNG snapshot of the pre-compact transcript):
+  archive render --transcript <path> [--out-dir <dir>] [--session <8hex>]
+                                Render the transcript main chain to pixel-font
+                                PNGs (~30K chars/page, pixel round-trip verified)
+                                and index pages in the CCR store. The PreCompact
+                                hook runs this automatically before compaction.
+  archive list [--session <id>] Indexed archives with page -> turn ranges.
+  archive snippet [--session <id>]
+                                Print the documented /compact instruction block
+                                (preserve/compress rules + archive pointer line).
+
+Identity (public handle + vanity alias — real email is auth-only, never a routing address):
+  identity show  |  whoami      Print numeric handle + claimed aliases.
+  identity claim <alias>        Claim a vanity alias (e.g. "travis" → travis@greprag.com).
+  identity release <alias>      Drop a claimed alias.
+
+Skills (opt-in advisor skills bundled with the CLI):
+  skill list                    Show bundled skills and install status
+  skill install <name>          Install a bundled advisor (e.g. discord, content-advisor)
+  skill uninstall <name>        Remove a previously-installed advisor
+  skill source stamp <name> --project <p> --path <rel> [--path <rel>...] [--baseline <ref>]
+                                Stamp a skill-staleness baseline against local Git
+
+Load (on-demand doctrine — the CLI is the payload, no .md files):
+  load                          Browse the catalog (chip-spawn, codex chips, mechanic, …)
+  load <name>                   Print that entry's full method inline
+
+Loadout (gift a skill bundle to another tenant — offer, never auto-install):
+  loadout send --to <handle>@greprag.com --skill <name> [--skill <n> …]
+                [--dir <path>] [--advisor <name>] [--note "…"]
+                                Freeze + send a loadout. --skill pulls from your
+                                mirror; --dir snapshots a skill dir from disk.
+  loadout list                  Offered loadouts waiting at your front desk.
+  loadout open <id>             Manifest + a bounded content preview (never ingests).
+  loadout equip <id>            Equip it (alias: accept) — copies skills to your load
+                                store + self-inflates via 'greprag load'.
+  loadout decline <id>          Decline — GCs the snapshot.
+  loadout status                Loadouts you've sent (offered/equipped/declined).
+  loadout unequip <name> [--delete-skills]
+                                Stop a loadout's auto-inflate.
+
+Persona (tenant-scoped speaking instructions):
+  persona list                  List built-in Persona templates.
+  persona use <template>        Activate a built-in Persona template.
+  persona set <text>|--file <f>|--stdin
+                                Save and activate a custom Persona verbatim.
+  persona show                  Show the active Persona.
+  persona clear                 Remove the active Persona.
+
+GrepRAG Instructions (canonical global/repo CLAUDE.md + AGENTS.md):
+  instructions pull <file> [--scope global|repo] [--push]
+                                Pull disk instructions into canon.
+  instructions push [--scope global|repo|all] [--check] [--force]
+                                Render canon back to managed instruction files.
+  agents ...                    Deprecated alias for instructions.
+
+Project metadata (rename / merge / list):
+  project rename <new-name> [--yes]
+                                Rename the project at cwd (anchor + registry + API
+                                + store metadata). Confirms before writing.
+  project merge --from <X> --into <Y> [--apply] [--name <override>] [--json]
+                                Consolidate one project into another. Defaults to
+                                dry-run. --from/--into accept a UUID or project_name.
+                                --name renames the target in the same step.
+  project list [--json]         Every project under this tenant, with anchor + rows.
+
+Opencode (bridge inbox SSE into a running opencode desktop session — the
+Monitor equivalent, since opencode is turn-based by default):
+  opencode relay --session <id>  [options]
+                                Subscribe to /v1/inbox/stream and inject each
+                                message as a fresh turn in the named opencode
+                                desktop session via /session/{id}/prompt_async.
+                                See \`greprag opencode --help\` for flags.
+
+Other:
+  expand --chunk <id>           Expand a memory cluster (siblings, adjacent, linked)
+  help [--all]                  Show this overview. --all appends every command's
+                                full --help — the complete, always-current guide.
+
+Examples:
+  greprag                                            # open the local customer app
+  greprag init                                       # standard repo setup
+  greprag init --global                              # Cowork / unanchored sessions
+  greprag init --all                                 # register every sibling repo for inbox
+  greprag init --all --root C:\\                     # scan a specific directory
+  greprag inbox
+  greprag send "done with migration" --to alice@greprag.com/abc12345
+                                                     # session-targeted (normal)
+  greprag send "deploy approved" --to alice@greprag.com
+                                                     # cold open — alice's front desk
+  greprag send "Bug in auth flow — repro at line 42" --to alice@greprag.com/abc12345 \
+    --file src/auth.ts:42 --artifact commit:abc123
 `.trim();
 /** Groups that ship their own detailed `--help`. `help --all` invokes each one
  *  live and captures its output, so the assembled guide is rendered from the
@@ -1648,7 +1668,11 @@ const HELP_ALL_GROUPS = [
     ['identity', identity_1.runIdentity],
     ['project', project_1.runProject],
     ['delivery', delivery_1.runDelivery],
-    ['assistant', assistant_1.runAssistant],
+    ['deploy-gate', deploy_gate_1.runDeployGate],
+    ['merge-lock', merge_lock_1.runMergeLock],
+    ['deploy-lock', deploy_lock_1.runDeployLock],
+    ['deploy-record', deploy_record_1.runDeployRecord],
+    ['deploy-verify', deploy_verify_1.runDeployVerify],
     ['instructions', agents_1.runInstructions],
     ['persona', persona_1.runPersona],
     ['doc', doc_1.runDoc],
@@ -1657,125 +1681,125 @@ const HELP_ALL_GROUPS = [
     ['crush', crush_1.runCrush],
     ['archive', archive_1.runArchive],
 ];
-const OPENCODE_HELP = `greprag opencode — bridge greprag inbox into a running opencode desktop
-session, plus a file-watching capture pipeline for episodic memory.
-
-Two subcommands:
-
-  greprag opencode relay    Bridge greprag inbox into a running opencode
-                            desktop session. Single POST to
-                            /session/{id}/prompt_async enqueues a fresh turn;
-                            the desktop app renders it into the conversation
-                            feed via the same SSE channel the engine uses.
-                            Desktop-only by design — the TUI control plane
-                            is deprecated.
-
-                            Session-to-session by default: the relay derives
-                            the greprag 8-hex from the opencode session UUID
-                            and filters the inbox stream to only messages
-                            addressed to THIS session. Use --tenant-wide to
-                            opt into the noisy debug mode (every message in
-                            the tenant, including messages for other
-                            sessions).
-
-  greprag opencode chip     Spawn OpenCode Desktop chips (session.create + prompt_async).
-  greprag opencode watch    Long-lived SQLite poller on opencode's local DB.
-                            Captures every (user, assistant) turn pair to
-                            greprag memory. Bypasses opencode's event bus
-                            entirely — reads the same rows the engine writes
-                            the moment a turn completes.
-
-opencode is turn-based: it has no built-in "Monitor" tool like Claude Code.
-\`relay\` is the bridge for live inbox delivery. \`watch\` is the capture
-pipeline. Run both, in separate processes, as long-lived siblings.
-
-opencode relay — bridge greprag inbox into a running opencode desktop
-session.
-
-This command subscribes to /v1/inbox/stream (same SSE channel inbox watch
-uses) and POSTs every inbound message to /session/{id}/prompt_async on
-the running opencode server. The receiving desktop session renders the
-injected prompt as a fresh turn in its conversation feed.
-
-Usage:
-  greprag opencode relay --session <opencode-session-id> [options]
-
-Required:
-  --session <id>         opencode session id (UUID). Find via
-                          \`opencode session list\` or the session header in
-                          the opencode UI.
-
-Options:
-  --opencode-url <u>     opencode server base URL.
-                          Default http://127.0.0.1:4096.
-                          Env override: OPENCODE_URL.
-  --project <name>       Filter the inbox stream to one project.
-  --inbox-session <8hex> Filter to one greprag session (8-hex id). Default
-                          is auto-derived from --session (truncateSessionId)
-                          so the relay only sees messages addressed to THIS
-                          opencode session. Pass explicitly to override
-                          (e.g. share one greprag session across multiple
-                          opencode sessions).
-  --tenant-wide          See every message in the tenant's inbox stream,
-                          including messages addressed to other sessions.
-                          Debug flag — noisy, usually wrong.
-  --since <id-or-iso>    Resume cursor.
-  --print                Pretty-print each message to stdout.
-  --dry-run              Resolve + format, do not POST.
-
-Resilience mirrors inbox-watch: exponential backoff, idle timeout,
-cursor-preserving reconnect. Production wraps this in a \`while true\` shell
-loop so process death auto-restarts:
-
-  while true; do greprag opencode relay --session <id>; \\
-    echo "[restart]" >&2; sleep 1; done
-
-Senders reach THIS session by addressing
-\`<handle>@greprag.com/<8hex>\` where <8hex> is the first 8 hex chars of the
-opencode session id (or pass \`--from-session <8hex>\` so the recipient can
-reply back by session without re-discovering it).
-
-
-opencode watch — SQLite-polling turn capture for episodic memory.
-
-opencode persists every message + part as a row in
-  %USERPROFILE%\\.local\\share\\opencode\\opencode.db (SQLite, WAL mode)
-the moment the AI finishes streaming. This command polls that DB every
-1-2s, joins \`message\` to \`session\` to recover the working directory,
-walks up to the greprag anchor, and POSTs the (user, assistant) pair to
-/v1/memory/turn. No event bus. No sidecar auth. No plugin loader.
-
-Why this exists: opencode Desktop's event bus does not reliably emit
-\`message.updated\` for the user's active session, so a plugin hook is
-unreliable for capture. The on-disk DB is the source of truth — it is
-written by the engine itself the moment a turn completes.
-
-Usage:
-  greprag opencode watch [options]
-
-Options:
-  --interval <ms>        Poll interval. Default 1500.
-  --db <path>            Override DB path. Default
-                          %USERPROFILE%\\.local\\share\\opencode\\opencode.db
-  --project <dir>        Only capture turns whose session.directory
-                          resolves to this directory (anchor walk-up
-                          target). Useful when running this once per
-                          worktree.
-  --since <ms>           Resume from this epoch ms. Default reads the
-                          cursor (~/.greprag/opencode-watch.cursor).
-                          On first run, captures every historical turn.
-  --cursor <file>        Override the cursor file path.
-  --reset-cursor         Delete the cursor file before starting. Use
-                          with --since <ms> to re-capture from a point.
-  --json                 Print one JSON object per captured turn to
-                          stdout, instead of human-readable status to
-                          stderr.
-  --dry-run              Print the would-be POST body, do not send.
-
-Run under a long-lived shell loop or as a Windows service:
-
-  while true; do greprag opencode watch; \\
-    echo "[restart]" >&2; sleep 1; done
+const OPENCODE_HELP = `greprag opencode — bridge greprag inbox into a running opencode desktop
+session, plus a file-watching capture pipeline for episodic memory.
+
+Two subcommands:
+
+  greprag opencode relay    Bridge greprag inbox into a running opencode
+                            desktop session. Single POST to
+                            /session/{id}/prompt_async enqueues a fresh turn;
+                            the desktop app renders it into the conversation
+                            feed via the same SSE channel the engine uses.
+                            Desktop-only by design — the TUI control plane
+                            is deprecated.
+
+                            Session-to-session by default: the relay derives
+                            the greprag 8-hex from the opencode session UUID
+                            and filters the inbox stream to only messages
+                            addressed to THIS session. Use --tenant-wide to
+                            opt into the noisy debug mode (every message in
+                            the tenant, including messages for other
+                            sessions).
+
+  greprag opencode chip     Spawn OpenCode Desktop chips (session.create + prompt_async).
+  greprag opencode watch    Long-lived SQLite poller on opencode's local DB.
+                            Captures every (user, assistant) turn pair to
+                            greprag memory. Bypasses opencode's event bus
+                            entirely — reads the same rows the engine writes
+                            the moment a turn completes.
+
+opencode is turn-based: it has no built-in "Monitor" tool like Claude Code.
+\`relay\` is the bridge for live inbox delivery. \`watch\` is the capture
+pipeline. Run both, in separate processes, as long-lived siblings.
+
+opencode relay — bridge greprag inbox into a running opencode desktop
+session.
+
+This command subscribes to /v1/inbox/stream (same SSE channel inbox watch
+uses) and POSTs every inbound message to /session/{id}/prompt_async on
+the running opencode server. The receiving desktop session renders the
+injected prompt as a fresh turn in its conversation feed.
+
+Usage:
+  greprag opencode relay --session <opencode-session-id> [options]
+
+Required:
+  --session <id>         opencode session id (UUID). Find via
+                          \`opencode session list\` or the session header in
+                          the opencode UI.
+
+Options:
+  --opencode-url <u>     opencode server base URL.
+                          Default http://127.0.0.1:4096.
+                          Env override: OPENCODE_URL.
+  --project <name>       Filter the inbox stream to one project.
+  --inbox-session <8hex> Filter to one greprag session (8-hex id). Default
+                          is auto-derived from --session (truncateSessionId)
+                          so the relay only sees messages addressed to THIS
+                          opencode session. Pass explicitly to override
+                          (e.g. share one greprag session across multiple
+                          opencode sessions).
+  --tenant-wide          See every message in the tenant's inbox stream,
+                          including messages addressed to other sessions.
+                          Debug flag — noisy, usually wrong.
+  --since <id-or-iso>    Resume cursor.
+  --print                Pretty-print each message to stdout.
+  --dry-run              Resolve + format, do not POST.
+
+Resilience mirrors inbox-watch: exponential backoff, idle timeout,
+cursor-preserving reconnect. Production wraps this in a \`while true\` shell
+loop so process death auto-restarts:
+
+  while true; do greprag opencode relay --session <id>; \\
+    echo "[restart]" >&2; sleep 1; done
+
+Senders reach THIS session by addressing
+\`<handle>@greprag.com/<8hex>\` where <8hex> is the first 8 hex chars of the
+opencode session id (or pass \`--from-session <8hex>\` so the recipient can
+reply back by session without re-discovering it).
+
+
+opencode watch — SQLite-polling turn capture for episodic memory.
+
+opencode persists every message + part as a row in
+  %USERPROFILE%\\.local\\share\\opencode\\opencode.db (SQLite, WAL mode)
+the moment the AI finishes streaming. This command polls that DB every
+1-2s, joins \`message\` to \`session\` to recover the working directory,
+walks up to the greprag anchor, and POSTs the (user, assistant) pair to
+/v1/memory/turn. No event bus. No sidecar auth. No plugin loader.
+
+Why this exists: opencode Desktop's event bus does not reliably emit
+\`message.updated\` for the user's active session, so a plugin hook is
+unreliable for capture. The on-disk DB is the source of truth — it is
+written by the engine itself the moment a turn completes.
+
+Usage:
+  greprag opencode watch [options]
+
+Options:
+  --interval <ms>        Poll interval. Default 1500.
+  --db <path>            Override DB path. Default
+                          %USERPROFILE%\\.local\\share\\opencode\\opencode.db
+  --project <dir>        Only capture turns whose session.directory
+                          resolves to this directory (anchor walk-up
+                          target). Useful when running this once per
+                          worktree.
+  --since <ms>           Resume from this epoch ms. Default reads the
+                          cursor (~/.greprag/opencode-watch.cursor).
+                          On first run, captures every historical turn.
+  --cursor <file>        Override the cursor file path.
+  --reset-cursor         Delete the cursor file before starting. Use
+                          with --since <ms> to re-capture from a point.
+  --json                 Print one JSON object per captured turn to
+                          stdout, instead of human-readable status to
+                          stderr.
+  --dry-run              Print the would-be POST body, do not send.
+
+Run under a long-lived shell loop or as a Windows service:
+
+  while true; do greprag opencode watch; \\
+    echo "[restart]" >&2; sleep 1; done
 `;
 /** greprag opencode <subcommand> — TUI bridge + capture watcher. */
 async function opencode(args) {
@@ -1906,6 +1930,10 @@ async function main() {
             return;
         }
         case 'inbox': return inbox(subArgs);
+        // The full SessionStart announce. The harness inlines only ~2KB of it, so the
+        // overflow is parked here and the inline pointer names this command.
+        // adr: adr/announce-inline-budget.md
+        case 'announce': return runAnnounce(subArgs);
         case 'desk': return runDesk(subArgs);
         case 'email': return (0, email_1.runEmail)(subArgs);
         case 'send': return send(subArgs);
@@ -1914,6 +1942,7 @@ async function main() {
         case 'sms': return (0, sms_1.runSms)(subArgs);
         case 'codex': return (0, codex_1.runCodex)(subArgs);
         case 'expand': return expand(subArgs);
+        case 'search': return (0, search_1.runSearch)(subArgs); // one lexical search across everything (adr/searchable-store-kinds.md)
         case 'corpus': return (0, corpus_1.runCorpus)(subArgs);
         case 'session': return (0, session_1.runSession)(subArgs);
         case 'discover': return (0, discover_1.runDiscover)(subArgs);
@@ -1937,16 +1966,21 @@ async function main() {
         case 'load': return (0, load_1.runLoad)(subArgs); // Interrupt System doctrine loader: bare = catalog, <name> = full entry
         case 'project': return (0, project_1.runProject)(subArgs);
         case 'delivery': return (0, delivery_1.runDelivery)(subArgs); // transitional repo delivery profile resolver
+        case 'deploy-gate': return (0, deploy_gate_1.runDeployGate)(subArgs); // portable deploy pre-flight (adr/deploy-gate-cli.md)
+        case 'merge-lock': return (0, merge_lock_1.runMergeLock)(subArgs); // serialise merges into a shared checkout
+        case 'deploy-lock': return (0, deploy_lock_1.runDeployLock)(subArgs); // one deploy at a time per target (adr/deploy-gate-cli.md)
+        case 'deploy-record': return (0, deploy_record_1.runDeployRecord)(subArgs); // remember what this checkout last shipped
+        case 'deploy-verify': return (0, deploy_verify_1.runDeployVerify)(subArgs); // did production take the upload? (adr/deploy-gate-cli.md)
         case 'procedure': return (0, procedure_1.runProcedure)(subArgs); // Procedure System: operational recipes (docs/procedure-system.md)
         case 'skillgain': return (0, skillgain_1.runSkillGain)(subArgs); // Skill Learning Loop: gain queue verbs (docs/skill-learning-loop.md)
         case 'doc': return (0, doc_1.runDoc)(subArgs); // Project Markdown mirror: sync/search/read exact docs through GrepRAG
         case 'docptr': return (0, docptr_1.runDocPtr)(subArgs); // Document Pointer System: backfill the doc registry (docs/doc-pointer-system.md)
         case 'parity': return (0, parity_1.runParity)(subArgs); // Parity System: doctrine drift table + manifest seed (docs/parity-system.md)
+        case 'repodoc': return (0, repodoc_1.runRepoDoc)(subArgs); // Repo markdown identity that survives edits (docs/node-identity-port.md)
         case 'instructions': return (0, agents_1.runInstructions)(subArgs); // Canonical GrepRAG Instructions + rendered followers
         case 'agents': return (0, agents_1.runAgents)(subArgs); // Deprecated alias for GrepRAG Instructions
         case 'loadout': return (0, loadout_1.runLoadout)(subArgs); // Loadout: cross-tenant skill-bundle gifting (docs/loadout.md)
         case 'persona': return (0, persona_1.runPersona)(subArgs); // tenant-scoped speaking instructions
-        case 'assistant': return (0, assistant_1.runAssistant)(subArgs); // designate this project as the tenant's Assistant (role flag)
         case 'opencode': return opencode(subArgs);
         case 'grok': return (0, grok_spawn_1.runGrok)(subArgs);
         default: