omp-conductor 0.13.0 → 0.15.0

package/src/cli.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env bun
 /**
- * Standalone entry point. Everything here is argument handling and printing —
- * the loop, the caps and the state all live in ./daemon.ts and the background
- * process lifecycle in ./lifecycle.ts, so the CLI and the `/conductor` plugin
- * cannot drift apart.
+ * Standalone entry point — the only operator surface after #309. Everything here
+ * is argument handling and printing: the loop, the caps and the state live in
+ * ./daemon.ts and the background process lifecycle in ./lifecycle.ts.
  */
+import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
 import { userInfo } from "node:os";
 import { dirname, join } from "node:path";
@@ -21,19 +21,21 @@ import {
   proposeRetrofit,
   repairPolicyBannerCrumbs,
 } from "./brief-upgrade.ts";
+import { interruptDisposition } from "./availability.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
 import { isPaused, pausedAt, runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
-  clearPaneHalt,
+  clearPaneHaltIfResolvable,
   disarmTicks,
-  halt,
-  haltWithPane,
   hold,
+  pinPaneHalt,
   releaseHold,
   renderStatus,
   startHerdrFleet,
+  stopConductorPane,
+  telegramStateDir,
 } from "./fleet.ts";
 import { formatGraphSetup, graphRepos, writeGraphSetup, type GraphSetupWrite } from "./graph.ts";
 import { readBaseChain } from "./gitops.ts";
@@ -51,12 +53,17 @@ import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { digestDedupeKey } from "./reports.ts";
 import { digestDue } from "./digest-schedule.ts";
 import {
+  AMEND_AREA_IDS,
   briefPathForProject,
   policyPathForProject,
   renderBriefForProject,
   renderFloorForProject,
   shippedBriefTemplate,
+  type AmendAreaId,
 } from "./setup.ts";
+import { runGraphInstall, runHostInstall } from "./setup-install.ts";
+import { DEFAULT_PROBES, NO_PROBES, setup } from "./setup-wizard.ts";
+import { terminalUi } from "./wizard-ui.ts";
 import { dbPath, LIVE_STATES, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { formatVerbLedgerEntry } from "./verbs/ledger.ts";
@@ -89,19 +96,18 @@ function packageVersion(): string {
 const USAGE = `omp-conductor — dispatch ready issues to omp coding sessions
 
 usage:
+  omp-conductor setup [area] [--no-ai] [--project NAME]
   omp-conductor start [--port N] [--project NAME]
   omp-conductor --version
-  omp-conductor stop
+  omp-conductor stop [--pane] [--project NAME | --all]
   omp-conductor restart [--now] [--timeout SECONDS] [--port N] [--project NAME]
   omp-conductor upgrade [--to VERSION] [--project NAME]
   omp-conductor board [--project NAME] [--json]
   omp-conductor status [--project NAME]
   omp-conductor ledger [--issue N] [--limit N] [--project NAME]
-  omp-conductor hold [--project NAME]
-  omp-conductor halt [--pane] [--project NAME]
-  omp-conductor arm [--project NAME]
-  omp-conductor disarm [--project NAME]
-  omp-conductor release-pane [--project NAME]
+  omp-conductor hold [--project NAME | --all]
+  omp-conductor arm [--project NAME | --all]
+  omp-conductor disarm [--project NAME | --all]
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor worker pause <issue> [--project NAME]
@@ -110,18 +116,22 @@ usage:
   omp-conductor unblock <issue> [--force] [--no-requeue] [--project NAME]
   omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
   omp-conductor daemon [--once] [--port N] [--project NAME]
-  omp-conductor pause [--reason TEXT]
-  omp-conductor resume
-  omp-conductor graph-setup [--project NAME] [--write]
+  omp-conductor resume [--project NAME | --all]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
-  omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
+  omp-conductor event record --category NAME --summary TEXT --evidence REF [--occurred-at ISO] [--project NAME]
+  omp-conductor report --text TEXT [--kind material|digest] [--events IDS] [--notices IDS] [--project NAME]
   omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
   omp-conductor decision resolve <id> --answer TEXT [--project NAME]
   omp-conductor decision withdraw <id> [--reason TEXT] [--project NAME]
   omp-conductor decision list [--project NAME]
   omp-conductor help
 
+  setup    interview, then write config.json, the labels, the briefs and the
+           staged host files behind one confirm. Bare is a full run — or, when
+           the project already exists, a chooser of which area to amend. Naming
+           an area positionally skips that chooser and amends only that area:
+           ${AMEND_AREA_IDS.join(", ")}.
   upgrade  update the Bun-global CLI, omp plugin, Herdr recovery plugin, and
            brief as one pinned release. Pauses only new claims, drains live
            workers, reloads, verifies twice, and restores the prior dispatch
@@ -129,9 +139,14 @@ usage:
   start    start the installed herdr-fleet.service when present, then run the
            dispatch loop in the background and wait until it answers GET
            /healthz on :8787 (override with --port). Refuses if one is running.
-  stop     stop the running daemon. Uses systemctl when the omp-conductor
-           unit owns the process (so Restart=on-failure cannot bring it back);
-           otherwise SIGTERM then SIGKILL.
+  stop     stop the conductor: pause claiming, disarm ticks, then stop the
+           dispatch daemon (systemctl-aware, so Restart=on-failure cannot bring
+           it back). Pane stays up unless --pane is passed. To bounce the daemon
+           without stopping the fleet, use restart.
+  stop --pane
+           also stop the conductor agent's pane and pin herdr-conductor recovery
+           off for that agent only — it does NOT stop herdr-fleet.service or any
+           other herdr session. resume clears the pin.
   restart  drain the fleet by default: pause new claims, wait until live workers
            reach 0/N (bounded by --timeout SECONDS, default 1800), restart keeping
            the running daemon's port and project unless a flag overrides them,
@@ -156,18 +171,12 @@ usage:
            as well as what they did. --issue narrows it to one issue's run.
   hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
            This is "stop the conductor overnight" without killing processes.
-  halt     hold, then stop the dispatch daemon (systemctl-aware). Pane stays up
-           unless --pane is passed.
-  halt --pane
-           halt, then pin herdr-conductor recovery off for the conductor agent
-           only — does NOT stop herdr-fleet.service or any other herdr session.
-           Clear the pin with release-pane when you want recovery again.
+           Use --all to target every configured project.
   arm      proof-gated: send a Telegram challenge and write the arm marker only
            after your reply appears as a user turn in the orchestrator transcript.
-           Never auto-armed by resume/hold.
-  disarm   remove the arm marker so ticks skip. Processes untouched.
-  release-pane
-           clear the halt --pane recovery pin so herdr-conductor may resume again.
+           Never auto-armed by resume/hold. Use --all for every project.
+  disarm   remove the arm marker so ticks skip. Processes untouched. Use --all
+           to target every configured project.
   tail     follow the newest run for <issue>: the worker's assistant text and
            the tools it calls, printed as they land. Workers are sessions inside
            the daemon rather than terminals, so this is the only way to watch
@@ -197,12 +206,17 @@ usage:
            strings, one per --arg (e.g. --arg prUrl=https://x --arg headSha=y).
            A refusal exits 3. See conductor_pr_merge/conductor_label/
            conductor_release/conductor_pr_update_branch in the brief.
+  event    persist one ordinary material outcome without sending it. Category
+           is a short lowercase slug; summary and evidence name what happened
+           and where it can be verified. --occurred-at defaults to now.
   report   hand a rendered report to the daemon's durable outbox. The report is
            persisted before anything is sent, delivered by the daemon with
            bounded retries, and shown by status until it lands. Delivery is
            at-least-once: a crash mid-send is retried and the retry says it may
            be a repeat. --kind digest is accepted at most once per local day,
            decided from the ledger rather than from what you remember sending.
+           A digest associates the comma-separated --events and --notices rows
+           atomically; omitted rows stay owed.
   decision record, list and close the questions you have put to your operator.
            A question that lives only in a session's context is lost to the next
            compaction, so \`decision open\` writes it down and every tick's prompt
@@ -220,16 +234,16 @@ usage:
            loop; recording one never edits policy by itself.
   daemon   run the dispatch loop in the foreground; --once runs a single tick
            and exits. This is what \`start\` launches.
-  pause    stop claiming new work only (ticks keep firing if armed). Prefer hold.
-           --reason TEXT is recorded in the pause sentinel (\`status\` shows it).
-  resume   clear pause only — does NOT re-arm. Prefer hold's inverse: resume + arm.
-  graph-setup
-           print how to set up the code-graph indexes workers query instead of
-           grepping: the clone commands for any missing index-only clone, the
-           index command per repo, and a systemd service+timer that keeps them
-           current. --write writes the two units and the script they run, and
-           prints the systemctl line to run — it never runs systemctl itself.
-           Exits 1 when no repo in the project has graphProject configured.
+  resume   clear pause and any pane-recovery pin. Does NOT re-arm: run arm after
+           an inbound Telegram proof to bring ticks back. Use --all for every project.
+  setup host
+           re-stage the systemd unit and run the install behind one confirm.
+  setup graph
+           set up the code-graph indexes workers query instead of grepping, end
+           to end: check prerequisites, clone any missing index-only clone as
+           you, install and enable the reindex timer as root, then seed one
+           indexing run and verify it. --no-seed enables without seeding;
+           --print changes nothing. Exits 1 when no repo has graphProject.
   brief-upgrade
            inspect the brief overlay (package floor + POLICY.md). Reports by
            default. --migrate lifts a bannered ORCHESTRATOR.md owned half into
@@ -243,19 +257,20 @@ usage:
   --version
            print the installed omp-conductor package version (also -V, version).
 
-Pause is a flag file under the state directory, so it applies to every project
-and survives a daemon restart. Hold also removes the arm marker the heartbeat
-reads, so both brains go quiet without killing processes. A running daemon is
-tracked by a pidfile under $OMP_CONDUCTOR_RUNTIME_DIR (default
+Pause is a flag file under the state directory, so it applies to the selected
+project (or every configured project with --all) and survives a daemon restart.
+Hold also removes the arm marker the heartbeat reads, so both brains go quiet
+without killing processes. A running daemon is tracked by a pidfile under
+$OMP_CONDUCTOR_RUNTIME_DIR (default
 ~/.omp/run/daemons/omp-conductor), written whether it was started in the
 background or in the foreground, and probed for liveness on every read — a
 stale one never blocks a start.
 
 Stop the conductor:
   hold              no claims, no tick sends (inspectable)
-  halt              hold + stop dispatch daemon
-  halt --pane       halt + pin conductor-pane recovery off
-  resume && arm     clear pause, then prove inbound Telegram before ticks resume`;
+  stop              hold + stop dispatch daemon
+  stop --pane       stop + pin conductor-pane recovery off
+  resume && arm     clear pause and any pane pin, then prove inbound Telegram`;
 
 /** Accepts both `--port 9000` and `--port=9000`; returns undefined when absent. */
 function flag(argv: string[], name: string): string | undefined {
@@ -265,6 +280,26 @@ function flag(argv: string[], name: string): string | undefined {
   return prefixed?.slice(name.length + 3);
 }
 
+function digestIdsFlag(argv: string[], name: "events" | "notices"): string[] {
+  const raw = flag(argv, name);
+  if (raw === undefined) {
+    if (argv.includes(`--${name}`)) {
+      process.stderr.write(`omp-conductor: report --${name} needs comma-separated row ids\n`);
+      process.exit(2);
+    }
+    return [];
+  }
+  const ids = [...new Set(raw.split(",").map((id) => id.trim()).filter((id) => id.length > 0))];
+  if (
+    ids.length === 0 ||
+    ids.some((id) => !/^(?:[0-9a-f]{12}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/.test(id))
+  ) {
+    process.stderr.write(`omp-conductor: report --${name} needs comma-separated ledger row ids\n`);
+    process.exit(2);
+  }
+  return ids;
+}
+
 /**
  * `--port` for the three verbs that take one. Exits 2 rather than defaulting,
  * because silently ignoring a typo'd port would leave the operator probing an
@@ -446,6 +481,24 @@ async function tailRun(project: string, issue: number): Promise<void> {
 
 const argv = process.argv.slice(2);
 const cmd = argv[0];
+/**
+ * Parsed once, because nearly every verb takes it and a per-case
+ * `projectFlag` is a line each of them can forget. Named `projectFlag`
+ * rather than `project` because many cases bind their own resolved
+ * `ProjectConfig` under that name.
+ */
+const projectFlag = flag(argv, "project");
+
+function targetProjects(): ProjectConfig[] {
+  const cfg = loadConfig();
+  if (argv.includes("--all")) return cfg.projects;
+  if (projectFlag === undefined && cfg.projects.length > 1) {
+    throw new Error(
+      `config has ${cfg.projects.length} projects; use --project NAME or --all`,
+    );
+  }
+  return [findProject(cfg, projectFlag)];
+}
 
 try {
   switch (cmd) {
@@ -454,10 +507,57 @@ try {
     case "version":
       process.stdout.write(`${packageVersion()}\n`);
       break;
+    case "setup": {
+      const sub = argv[1];
+      const positional = sub !== undefined && !sub.startsWith("--") ? sub : undefined;
+      // The terminal surface owns stdin for whichever path runs, and is released
+      // in a finally: a throw with readline still attached leaves the operator's
+      // shell without an echo.
+      const ui = terminalUi();
+      try {
+        // `host` and `graph` are install subcommands, checked BEFORE the amend
+        // areas. They are not areas — routing them through the area validation
+        // is how `setup host` came to exit 2 as an "unknown setup area".
+        if (positional === "host" || positional === "graph") {
+          const cfg = loadConfig();
+          const project = findProject(cfg, projectFlag);
+          const outcome =
+            positional === "host"
+              ? await runHostInstall(project, resolveCaps(project, cfg.defaults), telegramStateDir(), ui)
+              : await runGraphInstall(project, ui, {
+                  noSeed: argv.includes("--no-seed"),
+                  print: argv.includes("--print"),
+                });
+          // `staged` is a success on a host that has no systemd: the files are
+          // real, only the enable step is impossible.
+          if (outcome.kind === "refused" || outcome.kind === "failed") process.exit(1);
+          break;
+        }
+        let area: AmendAreaId | undefined;
+        if (positional !== undefined) {
+          if (!(AMEND_AREA_IDS as readonly string[]).includes(positional)) {
+            process.stderr.write(
+              `omp-conductor: unknown setup argument "${positional}" — ` +
+                `install subcommands are host, graph; amend areas are ${AMEND_AREA_IDS.join(", ")}\n`,
+            );
+            process.exit(2);
+          }
+          area = positional as AmendAreaId;
+        }
+        // `--no-ai` is the interview with its reading half removed: every question
+        // is still asked, nothing is proposed. For a host with no omp peer, a
+        // private repo no probe can clone, or an operator who would rather type the
+        // gates than review a model's reading of their CI.
+        await setup(ui, projectFlag, area, argv.includes("--no-ai") ? NO_PROBES : DEFAULT_PROBES);
+      } finally {
+        ui.close();
+      }
+      break;
+    }
     case "upgrade": {
       const result = await upgradeConductor({
         version: flag(argv, "to"),
-        project: flag(argv, "project"),
+        project: projectFlag,
       });
       process.stdout.write(
         `${result.alreadyCurrent ? "already current" : "upgrade complete"}:\n` +
@@ -479,7 +579,7 @@ try {
       // record here closes both holes.
       const once = argv.includes("--once");
       const port = portFlag(argv);
-      const project = flag(argv, "project");
+      const project = projectFlag;
 
       // `--once` registers nothing, on purpose. It is precisely the single-tick
       // drill the orphan guard exists to protect, so a drill that announced
@@ -520,7 +620,7 @@ try {
     }
 
     case "start": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       const herdr = startHerdrFleet(project);
       const rec = await startDaemon({ port: portFlag(argv), project });
       process.stdout.write(
@@ -532,14 +632,40 @@ try {
       break;
     }
 
+    // `stop` absorbs the old `halt`: one word for "stop the conductor", instead of
+    // an operator holding in their head that `halt` was `hold` plus stopping the
+    // daemon while `stop` killed only the process. Bouncing the daemon is
+    // `restart`, which is what the removed kill-only `stop` was reached for.
     case "stop": {
-      const result = await stopDaemon();
-      if (result.kind === "not-running") {
-        process.stdout.write("not running\n");
-      } else {
-        process.stdout.write(
-          `stopped — pid ${result.pid}${result.via === "systemctl" ? " (via systemctl)" : ""}\n`,
-        );
+      const withPane = argv.includes("--pane");
+      const targets = targetProjects().map((project) => ({
+        project,
+        hold: hold(project.name, "halt"),
+        pin: withPane ? pinPaneHalt(project.name).path : undefined,
+      }));
+      const stop = await stopDaemon();
+      const stopLine =
+        stop.kind === "not-running"
+          ? "daemon was not running"
+          : `daemon stopped — pid ${stop.pid}${stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+      for (const target of targets) {
+        if (target.pin !== undefined) {
+          const pane = await stopConductorPane(target.project.name);
+          process.stdout.write(
+            `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+              `${stopLine}\n` +
+              `pane recovery pinned at ${target.pin}\n` +
+              `pane stop: ${pane.stopped} — ${pane.detail}\n` +
+              `  (conductor agent "${pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
+              `   resume clears the pin when you want recovery again)\n`,
+          );
+        } else {
+          process.stdout.write(
+            `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+              `${stopLine}\n` +
+              `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+          );
+        }
       }
       break;
     }
@@ -552,7 +678,7 @@ try {
         // goes through systemctl so the replacement stays supervised.
         const { previous, record, via } = await restartDaemon({
           port: portFlag(argv),
-          project: flag(argv, "project"),
+          project: projectFlag,
         });
         if (previous !== undefined) {
           process.stdout.write(
@@ -578,16 +704,17 @@ try {
       let result!: RestartResult;
       const deps: UpgradeDeps = {
         ...DEFAULT_DEPS,
-        setPaused: (v) => setPaused(v, { source: "restart", reason: "restart, draining" }),
+        setPaused: (v, project) =>
+          setPaused(v, { source: "restart", reason: "restart, draining" }, project),
         restartDaemon: async () => {
           result = await restartDaemon({
             port: portFlag(argv),
-            project: flag(argv, "project"),
+            project: projectFlag,
           });
         },
       };
       try {
-        await drainAndRestart(deps, { project: flag(argv, "project"), timeoutMs });
+        await drainAndRestart(deps, { project: projectFlag, timeoutMs });
       } catch (err) {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
         process.exit(1);
@@ -606,7 +733,7 @@ try {
     }
 
     case "status": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       const text = await renderStatus(project);
       const stalled = stallLine();
       process.stdout.write(`${text}${stalled === undefined ? "\n" : `\n\n${stalled}\n`}`);
@@ -622,7 +749,7 @@ try {
      */
     case "ledger": {
       const cfg = loadConfig();
-      const p = findProject(cfg, flag(argv, "project"));
+      const p = findProject(cfg, projectFlag);
       const issueFlag = flag(argv, "issue");
       const issue = issueFlag === undefined ? undefined : issueArg("ledger", issueFlag);
       const limitFlag = flag(argv, "limit");
@@ -679,7 +806,7 @@ try {
     }
 
     case "board": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       // Headless one-shot mode: `--json` asks for it explicitly, and a
       // non-interactive stdin or stdout (pipe, redirect, cron, script) cannot
       // host the key-driven board anyway. The TTY throw inside runBoard stays
@@ -693,89 +820,78 @@ try {
     }
 
     case "hold": {
-      const r = hold(flag(argv, "project"));
-      process.stdout.write(
-        `held — claiming paused` +
-          `${r.wasPaused ? " (already paused)" : ""}` +
-          `; ticks disarmed at ${r.disarmed.path}` +
-          `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
-          `daemon and pane left running; halt to stop the daemon\n`,
-      );
-      break;
-    }
-
-    case "halt": {
-      const project = flag(argv, "project");
-      const withPane = argv.includes("--pane");
-      if (withPane) {
-        const r = await haltWithPane(project);
-        const stopLine =
-          r.stop.kind === "not-running"
-            ? "daemon was not running"
-            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
-        process.stdout.write(
-          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
-            `${stopLine}\n` +
-            `pane recovery pinned at ${r.pane.pinPath}\n` +
-            `pane stop: ${r.pane.stopped} — ${r.pane.detail}\n` +
-            `  (conductor agent "${r.pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
-            `   release-pane clears the pin when you want recovery again)\n`,
-        );
-      } else {
-        const r = await halt(project);
-        const stopLine =
-          r.stop.kind === "not-running"
-            ? "daemon was not running"
-            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+      for (const project of targetProjects()) {
+        const r = hold(project.name);
         process.stdout.write(
-          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
-            `${stopLine}\n` +
-            `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+          `held — claiming paused` +
+            `${r.wasPaused ? " (already paused)" : ""}` +
+            `; ticks disarmed at ${r.disarmed.path}` +
+            `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
+            `daemon and pane left running; stop to stop the daemon too\n`,
         );
       }
       break;
     }
 
-    case "arm": {
-      process.stdout.write("arm: sending inbound Telegram challenge…\n");
-      const r = await armTicks(flag(argv, "project"));
-      process.stdout.write(
-        `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
-          `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
-      );
+    // Removed verbs keep a case rather than falling through to usage: an operator
+    // who typed the old word gets the new one, not a wall of help text. Exit 2 is
+    // the same code an unknown verb uses.
+    case "halt":
+      process.stderr.write('omp-conductor: "halt" is now "stop" — see help\n');
+      process.exit(2);
       break;
-    }
 
-    case "disarm": {
-      const r = disarmTicks(flag(argv, "project"));
-      process.stdout.write(
-        `disarmed — ticks will be skipped` +
-          `${r.wasArmed ? "" : " (was already disarmed)"}\n` +
-          `marker ${r.path}\n`,
+    case "pause":
+      process.stderr.write(
+        'omp-conductor: "pause" is gone — "hold" pauses claiming AND disarms ticks; see help\n',
       );
+      process.exit(2);
+      break;
+
+    case "release-pane":
+      process.stderr.write('omp-conductor: "release-pane" is now part of "resume" — see help\n');
+      process.exit(2);
+      break;
+
+    case "graph-setup":
+      process.stderr.write('omp-conductor: "graph-setup" is now "setup graph" — see help\n');
+      process.exit(2);
+      break;
+
+    case "arm": {
+      for (const project of targetProjects()) {
+        process.stdout.write("arm: sending inbound Telegram challenge…\n");
+        const r = await armTicks(project.name);
+        process.stdout.write(
+          `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
+            `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
+        );
+      }
       break;
     }
 
-    case "release-pane": {
-      const r = clearPaneHalt(flag(argv, "project"));
-      process.stdout.write(
-        r.wasHalted
-          ? `pane recovery pin cleared — ${r.path}\nherdr-conductor may resume the fleet agent again\n`
-          : `no pane recovery pin at ${r.path}\n`,
-      );
+    case "disarm": {
+      for (const project of targetProjects()) {
+        const r = disarmTicks(project.name);
+        process.stdout.write(
+          `disarmed — ticks will be skipped` +
+            `${r.wasArmed ? "" : " (was already disarmed)"}\n` +
+            `marker ${r.path}\n`,
+        );
+      }
       break;
     }
 
     case "tail": {
       const issue = issueArg("tail", argv[1]);
-      await tailRun(findProject(loadConfig(), flag(argv, "project")).name, issue);
+      await tailRun(findProject(loadConfig(), projectFlag).name, issue);
       break;
     }
 
     case "extend": {
       const issue = issueArg("extend", argv[1]);
       const maxTurns = turnsFlag(argv);
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const daemon = livingDaemon();
       if (daemon === undefined) throw new Error("daemon is not running");
       if (daemon.project !== undefined && daemon.project !== project.name) {
@@ -843,7 +959,7 @@ try {
         );
         process.exit(2);
       }
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const daemon = livingDaemon();
       if (daemon === undefined) throw new Error("daemon is not running");
       if (daemon.project !== undefined && daemon.project !== project.name) {
@@ -919,7 +1035,7 @@ try {
     case "unblock": {
       const issue = issueArg("unblock", argv[1]);
       const cfg = loadConfig();
-      const project = findProject(cfg, flag(argv, "project"));
+      const project = findProject(cfg, projectFlag);
       const store = openStore(dbPath());
       try {
         const outcome = await unblockIssue(project, makeTracker(project), store, issue, {
@@ -961,7 +1077,7 @@ try {
         process.exit(2);
       }
       const cfg = loadConfig();
-      const project = findProject(cfg, flag(argv, "project"));
+      const project = findProject(cfg, projectFlag);
       const args: Record<string, string> = {};
       for (let i = 2; i < argv.length; i++) {
         const token = argv[i];
@@ -975,7 +1091,7 @@ try {
           args[pair.slice(0, eq)] = pair.slice(eq + 1);
           i++;
         } else if (token === "--project" || token?.startsWith("--project=") === true) {
-          // Consumed by `flag(argv, "project")` above; both spellings skip here.
+          // Consumed by `projectFlag` above; both spellings skip here.
           if (token === "--project") i++;
         } else {
           process.stderr.write(
@@ -999,10 +1115,10 @@ try {
             tracker: makeTracker(project),
             actions: githubVerbActions(project),
             fleetStop: () =>
-              isPaused()
-                ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+              isPaused(project.name)
+                ? "claiming is paused for this fleet (omp-conductor hold or stop)"
                 : undefined,
-            pausedAt,
+            pausedAt: () => pausedAt(project.name),
             log: (m) => process.stderr.write(`${m}\n`),
             now: () => Date.now(),
             chain: { readBaseChain },
@@ -1019,6 +1135,58 @@ try {
       break;
     }
 
+    case "event": {
+      if (argv[1] !== "record") {
+        process.stderr.write("omp-conductor: event needs the record subcommand\n");
+        process.exit(2);
+      }
+      const category = flag(argv, "category");
+      const summary = flag(argv, "summary")?.replace(/\s+/g, " ").trim();
+      const evidence = flag(argv, "evidence")?.replace(/\s+/g, " ").trim();
+      if (
+        category === undefined ||
+        !/^[a-z0-9][a-z0-9-]{0,31}$/.test(category) ||
+        summary === undefined ||
+        summary.length === 0 ||
+        summary.length > 240 ||
+        summary.startsWith("--") ||
+        evidence === undefined ||
+        evidence.length === 0 ||
+        evidence.length > 500 ||
+        evidence.startsWith("--")
+      ) {
+        process.stderr.write(
+          "omp-conductor: event record needs --category with a lowercase slug, --summary (1-240 chars), and --evidence (1-500 chars)\n",
+        );
+        process.exit(2);
+      }
+      const rawOccurredAt = flag(argv, "occurred-at");
+      const recordedAt = Date.now();
+      const occurredAt = rawOccurredAt === undefined ? recordedAt : Date.parse(rawOccurredAt);
+      if (!Number.isFinite(occurredAt)) {
+        process.stderr.write("omp-conductor: event record --occurred-at needs an ISO timestamp\n");
+        process.exit(2);
+      }
+      const project = findProject(loadConfig(), projectFlag);
+      const store = openStore(dbPath());
+      try {
+        const event = store.recordMaterialEvent({
+          project: project.name,
+          category,
+          summary,
+          evidence,
+          occurredAt,
+          recordedAt,
+        });
+        process.stdout.write(
+          `event ${event.id} recorded for ${project.name} (${event.category}, ${new Date(event.occurredAt).toISOString()}) — nothing sent\n`,
+        );
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
     /**
      * The handover point. Authorship stays with the model; from here the daemon
      * owns delivery, so "I sent the report" stops being a claim the model makes
@@ -1043,7 +1211,13 @@ try {
         process.exit(2);
       }
       const kind = rawKind as ReportKind;
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      if (kind !== "digest" && (argv.includes("--events") || argv.includes("--notices"))) {
+        process.stderr.write(
+          "omp-conductor: report --events and --notices are valid only with --kind digest\n",
+        );
+        process.exit(2);
+      }
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         const at = Date.now();
@@ -1051,8 +1225,8 @@ try {
         // policy defers is refused here rather than silently turning into a
         // page, or a digest going out off-schedule.
         const policy = project.reporting;
+        const digestPolicy = policy?.digest ?? { cadence: "per-tick" };
         if (kind === "digest") {
-          const digestPolicy = policy?.digest ?? { cadence: "per-tick" };
           if (digestPolicy.cadence === "none") {
             process.stderr.write(`omp-conductor: report: digest cadence is "none" for this project\n`);
             process.exit(2);
@@ -1070,32 +1244,54 @@ try {
           }
         }
         if (kind === "material") {
-          const interruptOn = policy?.interruptOn;
-          if (interruptOn !== undefined && !interruptOn.includes("material")) {
+          const disposition = interruptDisposition(policy, "material", at);
+          if (disposition === "digest") {
             process.stderr.write(
               "omp-conductor: report: material updates are digest-only under this reporting policy; fold this into the next digest (--kind digest)\n",
             );
             process.exit(2);
           }
+          if (disposition === "availability") {
+            const noticeId = randomUUID();
+            store.addHeldNotice({
+              id: noticeId,
+              project: project.name,
+              category: "material",
+              summary: body.split("\n", 1)[0]!.slice(0, 240),
+              detail: body,
+              createdAt: at,
+              releaseOnAvailable: true,
+            });
+            process.stdout.write(
+              `held notice ${noticeId} queued for ${project.name} (material; quiet hours)\n` +
+                "the daemon will include it in the next digest or working-hours catch-up\n",
+            );
+            break;
+          }
         }
-        const { report, deduped } = store.enqueueReport({
+        const draft = {
           project: project.name,
           kind,
           body,
-          // Only the digest is at-most-once. A material report describes one
-          // event as it happens, and two of those in a day are two events.
-          ...(kind === "digest"
-            ? { dedupeKey: digestDedupeKey(at, project.reporting?.digest?.timezone) }
+          // Only a daily digest is at-most-once. Per-tick digests and material
+          // reports describe new outcomes each time, so they carry no daily key.
+          ...(kind === "digest" && digestPolicy.cadence === "daily"
+            ? { dedupeKey: digestDedupeKey(at, digestPolicy.timezone) }
             : {}),
           at,
-        });
-        // The held notices an accepted digest re-surfaces are now owed by it,
-        // whatever the model goes on to write.
-        if (kind === "digest") store.markNoticesDigested(project.name, at);
+        };
+        const { report, deduped } =
+          kind === "digest"
+            ? store.enqueueDigestReport(
+                draft,
+                digestIdsFlag(argv, "events"),
+                digestIdsFlag(argv, "notices"),
+              )
+            : store.enqueueReport(draft);
         process.stdout.write(
           deduped
             ? `today's digest was already handed over as report ${report.id} (${report.state}) — nothing queued\n` +
-                "the ledger decides this, not your memory of the last tick; use --kind material for a second event\n"
+                "the ledger decides this, not your memory of the last tick; newly named rows remain owed for a later digest\n"
             : `report ${report.id} queued for ${project.name} (${kind})\n` +
                 "the daemon owns delivery from here; omp-conductor status shows it until it lands\n",
         );
@@ -1107,7 +1303,7 @@ try {
 
     case "decision": {
       const sub = argv[1];
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         if (sub === "open") {
@@ -1218,7 +1414,7 @@ try {
       }
       const issueText = flag(argv, "issue");
       const issue = issueText === undefined ? undefined : issueArg("friction --issue", issueText);
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         store.recordFriction(project.name, {
@@ -1235,70 +1431,18 @@ try {
       break;
     }
 
-    case "pause":
-      setPaused(true, { source: "pause", reason: flag(argv, "reason") });
-      process.stdout.write(
-        "paused — no new work will be claimed\n" +
-          "note: ticks keep firing if armed; use hold to silence both\n",
-      );
-      break;
-
-    case "resume":
-      releaseHold();
-      process.stdout.write(
-        "resumed — claiming allowed on the next tick\n" +
-          "note: did NOT re-arm; run arm after an inbound Telegram proof to resume ticks\n",
-      );
-      break;
-
-    case "graph-setup": {
-      // Refused rather than accommodated. Under sudo every path this command
-      // derives — the config it loads, the state directory it writes to, the
-      // HOME and User= it bakes into the unit — resolves as root instead of the
-      // fleet's account, and the result is a timer that goes green while
-      // building indexes in a store no worker session ever reads. Nothing about
-      // that announces itself, so the only safe answer is to stop.
-      if (process.env["SUDO_USER"] !== undefined) {
-        process.stderr.write(
-          "omp-conductor: run graph-setup as the account the fleet runs as, not under sudo.\n" +
-            `Under sudo the config, ~/.cache and the unit's User= all resolve as root, and the\n` +
-            `indexes land where no worker can read them. Only installing the units needs root,\n` +
-            "and this command prints those two lines for you at the end.\n",
-        );
-        process.exit(1);
-      }
-
-      const project = findProject(loadConfig(), flag(argv, "project"));
-      if (graphRepos(project).length === 0) {
-        // Not a warning: with nothing configured there is nothing to print, and
-        // the fix is a wizard answer rather than a flag on this command.
-        process.stderr.write(
-          `omp-conductor: no repo in project "${project.name}" has graphProject set — re-run\n` +
-            "/conductor setup and say yes to code-graph discovery.\n",
-        );
-        process.exit(1);
-      }
-
-      if (!argv.includes("--write")) {
-        process.stdout.write(`${formatGraphSetup(project)}\n`);
-        break;
-      }
-
-      let result: GraphSetupWrite;
-      try {
-        result = writeGraphSetup(project);
-      } catch (err) {
-        // No longer the permissions case — all three files go to this account's
-        // own state directory — so this is a full disk, a read-only mount or a
-        // state directory someone else owns. Say what failed and offer the
-        // printed plan, which is a complete substitute for the write.
-        process.stderr.write(
-          `omp-conductor: could not stage the files (${err instanceof Error ? err.message : String(err)}).\n` +
-            "Drop --write and copy the printed text yourself — it is the same content.\n",
+    case "resume": {
+      for (const project of targetProjects()) {
+        releaseHold(project.name);
+        const pin = clearPaneHaltIfResolvable(project.name);
+        process.stdout.write(
+          "resumed — claiming allowed on the next tick\n" +
+            (pin.wasHalted
+              ? `pane recovery pin cleared — ${pin.path}\n`
+              : "no pane recovery pin to clear\n") +
+            "ticks stay disarmed — run `omp-conductor arm`\n",
         );
-        process.exit(1);
       }
-      process.stdout.write(`wrote:\n${result.written.map((f) => `  ${f}`).join("\n")}\n\n${result.next}\n`);
       break;
     }
 
@@ -1307,12 +1451,12 @@ try {
       let project: ProjectConfig | undefined;
       let path: string;
       if (override === undefined) {
-        project = findProject(loadConfig(), flag(argv, "project"));
+        project = findProject(loadConfig(), projectFlag);
         path = briefPathForProject(project);
       } else {
         path = override;
         try {
-          project = findProject(loadConfig(), flag(argv, "project"));
+          project = findProject(loadConfig(), projectFlag);
         } catch {
           project = undefined;
         }
@@ -1437,7 +1581,7 @@ try {
         } catch {
           process.stderr.write(
             `omp-conductor: no brief at ${path}` +
-              `${override === undefined ? " — run /conductor setup and say yes to writing ORCHESTRATOR.md." : "."}\n`,
+              `${override === undefined ? " — run `omp-conductor setup brief` and say yes to writing ORCHESTRATOR.md." : "."}\n`,
           );
           process.exit(1);
         }