omp-conductor 0.14.0 → 0.15.1

package/src/cli.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env bun
 /**
- * Standalone entry point. Everything here is argument handling and printing —
- * the loop, the caps and the state all live in ./daemon.ts and the background
- * process lifecycle in ./lifecycle.ts, so the CLI and the `/conductor` plugin
- * cannot drift apart.
+ * Standalone entry point — the only operator surface after #309. Everything here
+ * is argument handling and printing: the loop, the caps and the state live in
+ * ./daemon.ts and the background process lifecycle in ./lifecycle.ts.
  */
 import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
@@ -28,14 +27,15 @@ import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
 import { isPaused, pausedAt, runDaemon, setPaused } from "./daemon.ts";
 import {
   armTicks,
-  clearPaneHalt,
+  clearPaneHaltIfResolvable,
   disarmTicks,
-  halt,
-  haltWithPane,
   hold,
+  pinPaneHalt,
   releaseHold,
   renderStatus,
   startHerdrFleet,
+  stopConductorPane,
+  telegramStateDir,
 } from "./fleet.ts";
 import { formatGraphSetup, graphRepos, writeGraphSetup, type GraphSetupWrite } from "./graph.ts";
 import { readBaseChain } from "./gitops.ts";
@@ -53,12 +53,17 @@ import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { digestDedupeKey } from "./reports.ts";
 import { digestDue } from "./digest-schedule.ts";
 import {
+  AMEND_AREA_IDS,
   briefPathForProject,
   policyPathForProject,
   renderBriefForProject,
   renderFloorForProject,
   shippedBriefTemplate,
+  type AmendAreaId,
 } from "./setup.ts";
+import { runGraphInstall, runHostInstall } from "./setup-install.ts";
+import { DEFAULT_PROBES, NO_PROBES, setup } from "./setup-wizard.ts";
+import { terminalUi } from "./wizard-ui.ts";
 import { dbPath, LIVE_STATES, openStore } from "./store.ts";
 import { formatTranscriptLine } from "./transcript.ts";
 import { formatVerbLedgerEntry } from "./verbs/ledger.ts";
@@ -91,19 +96,18 @@ function packageVersion(): string {
 const USAGE = `omp-conductor — dispatch ready issues to omp coding sessions
 
 usage:
+  omp-conductor setup [area] [--no-ai] [--project NAME]
   omp-conductor start [--port N] [--project NAME]
   omp-conductor --version
-  omp-conductor stop
+  omp-conductor stop [--pane] [--project NAME | --all]
   omp-conductor restart [--now] [--timeout SECONDS] [--port N] [--project NAME]
   omp-conductor upgrade [--to VERSION] [--project NAME]
   omp-conductor board [--project NAME] [--json]
   omp-conductor status [--project NAME]
   omp-conductor ledger [--issue N] [--limit N] [--project NAME]
-  omp-conductor hold [--project NAME]
-  omp-conductor halt [--pane] [--project NAME]
-  omp-conductor arm [--project NAME]
-  omp-conductor disarm [--project NAME]
-  omp-conductor release-pane [--project NAME]
+  omp-conductor hold [--project NAME | --all]
+  omp-conductor arm [--project NAME | --all]
+  omp-conductor disarm [--project NAME | --all]
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor worker pause <issue> [--project NAME]
@@ -112,9 +116,7 @@ usage:
   omp-conductor unblock <issue> [--force] [--no-requeue] [--project NAME]
   omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
   omp-conductor daemon [--once] [--port N] [--project NAME]
-  omp-conductor pause [--reason TEXT]
-  omp-conductor resume
-  omp-conductor graph-setup [--project NAME] [--write]
+  omp-conductor resume [--project NAME | --all]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
   omp-conductor event record --category NAME --summary TEXT --evidence REF [--occurred-at ISO] [--project NAME]
@@ -125,6 +127,11 @@ usage:
   omp-conductor decision list [--project NAME]
   omp-conductor help
 
+  setup    interview, then write config.json, the labels, the briefs and the
+           staged host files behind one confirm. Bare is a full run — or, when
+           the project already exists, a chooser of which area to amend. Naming
+           an area positionally skips that chooser and amends only that area:
+           ${AMEND_AREA_IDS.join(", ")}.
   upgrade  update the Bun-global CLI, omp plugin, Herdr recovery plugin, and
            brief as one pinned release. Pauses only new claims, drains live
            workers, reloads, verifies twice, and restores the prior dispatch
@@ -132,9 +139,14 @@ usage:
   start    start the installed herdr-fleet.service when present, then run the
            dispatch loop in the background and wait until it answers GET
            /healthz on :8787 (override with --port). Refuses if one is running.
-  stop     stop the running daemon. Uses systemctl when the omp-conductor
-           unit owns the process (so Restart=on-failure cannot bring it back);
-           otherwise SIGTERM then SIGKILL.
+  stop     stop the conductor: pause claiming, disarm ticks, then stop the
+           dispatch daemon (systemctl-aware, so Restart=on-failure cannot bring
+           it back). Pane stays up unless --pane is passed. To bounce the daemon
+           without stopping the fleet, use restart.
+  stop --pane
+           also stop the conductor agent's pane and pin herdr-conductor recovery
+           off for that agent only — it does NOT stop herdr-fleet.service or any
+           other herdr session. resume clears the pin.
   restart  drain the fleet by default: pause new claims, wait until live workers
            reach 0/N (bounded by --timeout SECONDS, default 1800), restart keeping
            the running daemon's port and project unless a flag overrides them,
@@ -159,18 +171,12 @@ usage:
            as well as what they did. --issue narrows it to one issue's run.
   hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
            This is "stop the conductor overnight" without killing processes.
-  halt     hold, then stop the dispatch daemon (systemctl-aware). Pane stays up
-           unless --pane is passed.
-  halt --pane
-           halt, then pin herdr-conductor recovery off for the conductor agent
-           only — does NOT stop herdr-fleet.service or any other herdr session.
-           Clear the pin with release-pane when you want recovery again.
+           Use --all to target every configured project.
   arm      proof-gated: send a Telegram challenge and write the arm marker only
            after your reply appears as a user turn in the orchestrator transcript.
-           Never auto-armed by resume/hold.
-  disarm   remove the arm marker so ticks skip. Processes untouched.
-  release-pane
-           clear the halt --pane recovery pin so herdr-conductor may resume again.
+           Never auto-armed by resume/hold. Use --all for every project.
+  disarm   remove the arm marker so ticks skip. Processes untouched. Use --all
+           to target every configured project.
   tail     follow the newest run for <issue>: the worker's assistant text and
            the tools it calls, printed as they land. Workers are sessions inside
            the daemon rather than terminals, so this is the only way to watch
@@ -228,16 +234,16 @@ usage:
            loop; recording one never edits policy by itself.
   daemon   run the dispatch loop in the foreground; --once runs a single tick
            and exits. This is what \`start\` launches.
-  pause    stop claiming new work only (ticks keep firing if armed). Prefer hold.
-           --reason TEXT is recorded in the pause sentinel (\`status\` shows it).
-  resume   clear pause only — does NOT re-arm. Prefer hold's inverse: resume + arm.
-  graph-setup
-           print how to set up the code-graph indexes workers query instead of
-           grepping: the clone commands for any missing index-only clone, the
-           index command per repo, and a systemd service+timer that keeps them
-           current. --write writes the two units and the script they run, and
-           prints the systemctl line to run — it never runs systemctl itself.
-           Exits 1 when no repo in the project has graphProject configured.
+  resume   clear pause and any pane-recovery pin. Does NOT re-arm: run arm after
+           an inbound Telegram proof to bring ticks back. Use --all for every project.
+  setup host
+           re-stage the systemd unit and run the install behind one confirm.
+  setup graph
+           set up the code-graph indexes workers query instead of grepping, end
+           to end: check prerequisites, clone any missing index-only clone as
+           you, install and enable the reindex timer as root, then seed one
+           indexing run and verify it. --no-seed enables without seeding;
+           --print changes nothing. Exits 1 when no repo has graphProject.
   brief-upgrade
            inspect the brief overlay (package floor + POLICY.md). Reports by
            default. --migrate lifts a bannered ORCHESTRATOR.md owned half into
@@ -251,19 +257,20 @@ usage:
   --version
            print the installed omp-conductor package version (also -V, version).
 
-Pause is a flag file under the state directory, so it applies to every project
-and survives a daemon restart. Hold also removes the arm marker the heartbeat
-reads, so both brains go quiet without killing processes. A running daemon is
-tracked by a pidfile under $OMP_CONDUCTOR_RUNTIME_DIR (default
+Pause is a flag file under the state directory, so it applies to the selected
+project (or every configured project with --all) and survives a daemon restart.
+Hold also removes the arm marker the heartbeat reads, so both brains go quiet
+without killing processes. A running daemon is tracked by a pidfile under
+$OMP_CONDUCTOR_RUNTIME_DIR (default
 ~/.omp/run/daemons/omp-conductor), written whether it was started in the
 background or in the foreground, and probed for liveness on every read — a
 stale one never blocks a start.
 
 Stop the conductor:
   hold              no claims, no tick sends (inspectable)
-  halt              hold + stop dispatch daemon
-  halt --pane       halt + pin conductor-pane recovery off
-  resume && arm     clear pause, then prove inbound Telegram before ticks resume`;
+  stop              hold + stop dispatch daemon
+  stop --pane       stop + pin conductor-pane recovery off
+  resume && arm     clear pause and any pane pin, then prove inbound Telegram`;
 
 /** Accepts both `--port 9000` and `--port=9000`; returns undefined when absent. */
 function flag(argv: string[], name: string): string | undefined {
@@ -474,6 +481,24 @@ async function tailRun(project: string, issue: number): Promise<void> {
 
 const argv = process.argv.slice(2);
 const cmd = argv[0];
+/**
+ * Parsed once, because nearly every verb takes it and a per-case
+ * `projectFlag` is a line each of them can forget. Named `projectFlag`
+ * rather than `project` because many cases bind their own resolved
+ * `ProjectConfig` under that name.
+ */
+const projectFlag = flag(argv, "project");
+
+function targetProjects(): ProjectConfig[] {
+  const cfg = loadConfig();
+  if (argv.includes("--all")) return cfg.projects;
+  if (projectFlag === undefined && cfg.projects.length > 1) {
+    throw new Error(
+      `config has ${cfg.projects.length} projects; use --project NAME or --all`,
+    );
+  }
+  return [findProject(cfg, projectFlag)];
+}
 
 try {
   switch (cmd) {
@@ -482,10 +507,57 @@ try {
     case "version":
       process.stdout.write(`${packageVersion()}\n`);
       break;
+    case "setup": {
+      const sub = argv[1];
+      const positional = sub !== undefined && !sub.startsWith("--") ? sub : undefined;
+      // The terminal surface owns stdin for whichever path runs, and is released
+      // in a finally: a throw with readline still attached leaves the operator's
+      // shell without an echo.
+      const ui = terminalUi();
+      try {
+        // `host` and `graph` are install subcommands, checked BEFORE the amend
+        // areas. They are not areas — routing them through the area validation
+        // is how `setup host` came to exit 2 as an "unknown setup area".
+        if (positional === "host" || positional === "graph") {
+          const cfg = loadConfig();
+          const project = findProject(cfg, projectFlag);
+          const outcome =
+            positional === "host"
+              ? await runHostInstall(project, resolveCaps(project, cfg.defaults), telegramStateDir(), ui)
+              : await runGraphInstall(project, ui, {
+                  noSeed: argv.includes("--no-seed"),
+                  print: argv.includes("--print"),
+                });
+          // `staged` is a success on a host that has no systemd: the files are
+          // real, only the enable step is impossible.
+          if (outcome.kind === "refused" || outcome.kind === "failed") process.exit(1);
+          break;
+        }
+        let area: AmendAreaId | undefined;
+        if (positional !== undefined) {
+          if (!(AMEND_AREA_IDS as readonly string[]).includes(positional)) {
+            process.stderr.write(
+              `omp-conductor: unknown setup argument "${positional}" — ` +
+                `install subcommands are host, graph; amend areas are ${AMEND_AREA_IDS.join(", ")}\n`,
+            );
+            process.exit(2);
+          }
+          area = positional as AmendAreaId;
+        }
+        // `--no-ai` is the interview with its reading half removed: every question
+        // is still asked, nothing is proposed. For a host with no omp peer, a
+        // private repo no probe can clone, or an operator who would rather type the
+        // gates than review a model's reading of their CI.
+        await setup(ui, projectFlag, area, argv.includes("--no-ai") ? NO_PROBES : DEFAULT_PROBES);
+      } finally {
+        ui.close();
+      }
+      break;
+    }
     case "upgrade": {
       const result = await upgradeConductor({
         version: flag(argv, "to"),
-        project: flag(argv, "project"),
+        project: projectFlag,
       });
       process.stdout.write(
         `${result.alreadyCurrent ? "already current" : "upgrade complete"}:\n` +
@@ -507,7 +579,7 @@ try {
       // record here closes both holes.
       const once = argv.includes("--once");
       const port = portFlag(argv);
-      const project = flag(argv, "project");
+      const project = projectFlag;
 
       // `--once` registers nothing, on purpose. It is precisely the single-tick
       // drill the orphan guard exists to protect, so a drill that announced
@@ -548,7 +620,7 @@ try {
     }
 
     case "start": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       const herdr = startHerdrFleet(project);
       const rec = await startDaemon({ port: portFlag(argv), project });
       process.stdout.write(
@@ -560,14 +632,40 @@ try {
       break;
     }
 
+    // `stop` absorbs the old `halt`: one word for "stop the conductor", instead of
+    // an operator holding in their head that `halt` was `hold` plus stopping the
+    // daemon while `stop` killed only the process. Bouncing the daemon is
+    // `restart`, which is what the removed kill-only `stop` was reached for.
     case "stop": {
-      const result = await stopDaemon();
-      if (result.kind === "not-running") {
-        process.stdout.write("not running\n");
-      } else {
-        process.stdout.write(
-          `stopped — pid ${result.pid}${result.via === "systemctl" ? " (via systemctl)" : ""}\n`,
-        );
+      const withPane = argv.includes("--pane");
+      const targets = targetProjects().map((project) => ({
+        project,
+        hold: hold(project.name, "halt"),
+        pin: withPane ? pinPaneHalt(project.name).path : undefined,
+      }));
+      const stop = await stopDaemon();
+      const stopLine =
+        stop.kind === "not-running"
+          ? "daemon was not running"
+          : `daemon stopped — pid ${stop.pid}${stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+      for (const target of targets) {
+        if (target.pin !== undefined) {
+          const pane = await stopConductorPane(target.project.name);
+          process.stdout.write(
+            `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+              `${stopLine}\n` +
+              `pane recovery pinned at ${target.pin}\n` +
+              `pane stop: ${pane.stopped} — ${pane.detail}\n` +
+              `  (conductor agent "${pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
+              `   resume clears the pin when you want recovery again)\n`,
+          );
+        } else {
+          process.stdout.write(
+            `stopped — claiming paused; ticks disarmed at ${target.hold.disarmed.path}\n` +
+              `${stopLine}\n` +
+              `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+          );
+        }
       }
       break;
     }
@@ -580,7 +678,7 @@ try {
         // goes through systemctl so the replacement stays supervised.
         const { previous, record, via } = await restartDaemon({
           port: portFlag(argv),
-          project: flag(argv, "project"),
+          project: projectFlag,
         });
         if (previous !== undefined) {
           process.stdout.write(
@@ -606,16 +704,17 @@ try {
       let result!: RestartResult;
       const deps: UpgradeDeps = {
         ...DEFAULT_DEPS,
-        setPaused: (v) => setPaused(v, { source: "restart", reason: "restart, draining" }),
+        setPaused: (v, project) =>
+          setPaused(v, { source: "restart", reason: "restart, draining" }, project),
         restartDaemon: async () => {
           result = await restartDaemon({
             port: portFlag(argv),
-            project: flag(argv, "project"),
+            project: projectFlag,
           });
         },
       };
       try {
-        await drainAndRestart(deps, { project: flag(argv, "project"), timeoutMs });
+        await drainAndRestart(deps, { project: projectFlag, timeoutMs });
       } catch (err) {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
         process.exit(1);
@@ -634,7 +733,7 @@ try {
     }
 
     case "status": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       const text = await renderStatus(project);
       const stalled = stallLine();
       process.stdout.write(`${text}${stalled === undefined ? "\n" : `\n\n${stalled}\n`}`);
@@ -650,7 +749,7 @@ try {
      */
     case "ledger": {
       const cfg = loadConfig();
-      const p = findProject(cfg, flag(argv, "project"));
+      const p = findProject(cfg, projectFlag);
       const issueFlag = flag(argv, "issue");
       const issue = issueFlag === undefined ? undefined : issueArg("ledger", issueFlag);
       const limitFlag = flag(argv, "limit");
@@ -707,7 +806,7 @@ try {
     }
 
     case "board": {
-      const project = flag(argv, "project");
+      const project = projectFlag;
       // Headless one-shot mode: `--json` asks for it explicitly, and a
       // non-interactive stdin or stdout (pipe, redirect, cron, script) cannot
       // host the key-driven board anyway. The TTY throw inside runBoard stays
@@ -721,89 +820,78 @@ try {
     }
 
     case "hold": {
-      const r = hold(flag(argv, "project"));
-      process.stdout.write(
-        `held — claiming paused` +
-          `${r.wasPaused ? " (already paused)" : ""}` +
-          `; ticks disarmed at ${r.disarmed.path}` +
-          `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
-          `daemon and pane left running; halt to stop the daemon\n`,
-      );
-      break;
-    }
-
-    case "halt": {
-      const project = flag(argv, "project");
-      const withPane = argv.includes("--pane");
-      if (withPane) {
-        const r = await haltWithPane(project);
-        const stopLine =
-          r.stop.kind === "not-running"
-            ? "daemon was not running"
-            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
+      for (const project of targetProjects()) {
+        const r = hold(project.name);
         process.stdout.write(
-          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
-            `${stopLine}\n` +
-            `pane recovery pinned at ${r.pane.pinPath}\n` +
-            `pane stop: ${r.pane.stopped} — ${r.pane.detail}\n` +
-            `  (conductor agent "${r.pane.agentName}" only — herdr-fleet.service was NOT stopped;\n` +
-            `   release-pane clears the pin when you want recovery again)\n`,
-        );
-      } else {
-        const r = await halt(project);
-        const stopLine =
-          r.stop.kind === "not-running"
-            ? "daemon was not running"
-            : `daemon stopped — pid ${r.stop.pid}${r.stop.via === "systemctl" ? " (via systemctl)" : ""}`;
-        process.stdout.write(
-          `halted — claiming paused; ticks disarmed at ${r.hold.disarmed.path}\n` +
-            `${stopLine}\n` +
-            `pane left running (pass --pane to stop the conductor agent and pin recovery)\n`,
+          `held — claiming paused` +
+            `${r.wasPaused ? " (already paused)" : ""}` +
+            `; ticks disarmed at ${r.disarmed.path}` +
+            `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
+            `daemon and pane left running; stop to stop the daemon too\n`,
         );
       }
       break;
     }
 
-    case "arm": {
-      process.stdout.write("arm: sending inbound Telegram challenge…\n");
-      const r = await armTicks(flag(argv, "project"));
-      process.stdout.write(
-        `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
-          `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
-      );
+    // Removed verbs keep a case rather than falling through to usage: an operator
+    // who typed the old word gets the new one, not a wall of help text. Exit 2 is
+    // the same code an unknown verb uses.
+    case "halt":
+      process.stderr.write('omp-conductor: "halt" is now "stop" — see help\n');
+      process.exit(2);
       break;
-    }
 
-    case "disarm": {
-      const r = disarmTicks(flag(argv, "project"));
-      process.stdout.write(
-        `disarmed — ticks will be skipped` +
-          `${r.wasArmed ? "" : " (was already disarmed)"}\n` +
-          `marker ${r.path}\n`,
+    case "pause":
+      process.stderr.write(
+        'omp-conductor: "pause" is gone — "hold" pauses claiming AND disarms ticks; see help\n',
       );
+      process.exit(2);
+      break;
+
+    case "release-pane":
+      process.stderr.write('omp-conductor: "release-pane" is now part of "resume" — see help\n');
+      process.exit(2);
+      break;
+
+    case "graph-setup":
+      process.stderr.write('omp-conductor: "graph-setup" is now "setup graph" — see help\n');
+      process.exit(2);
+      break;
+
+    case "arm": {
+      for (const project of targetProjects()) {
+        process.stdout.write("arm: sending inbound Telegram challenge…\n");
+        const r = await armTicks(project.name);
+        process.stdout.write(
+          `ARMED — inbound round-trip proved with owner ${r.owner}; ticks are now live.\n` +
+            `marker ${r.path}${r.alreadyArmed ? " (replaced previous marker)" : ""}\n`,
+        );
+      }
       break;
     }
 
-    case "release-pane": {
-      const r = clearPaneHalt(flag(argv, "project"));
-      process.stdout.write(
-        r.wasHalted
-          ? `pane recovery pin cleared — ${r.path}\nherdr-conductor may resume the fleet agent again\n`
-          : `no pane recovery pin at ${r.path}\n`,
-      );
+    case "disarm": {
+      for (const project of targetProjects()) {
+        const r = disarmTicks(project.name);
+        process.stdout.write(
+          `disarmed — ticks will be skipped` +
+            `${r.wasArmed ? "" : " (was already disarmed)"}\n` +
+            `marker ${r.path}\n`,
+        );
+      }
       break;
     }
 
     case "tail": {
       const issue = issueArg("tail", argv[1]);
-      await tailRun(findProject(loadConfig(), flag(argv, "project")).name, issue);
+      await tailRun(findProject(loadConfig(), projectFlag).name, issue);
       break;
     }
 
     case "extend": {
       const issue = issueArg("extend", argv[1]);
       const maxTurns = turnsFlag(argv);
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const daemon = livingDaemon();
       if (daemon === undefined) throw new Error("daemon is not running");
       if (daemon.project !== undefined && daemon.project !== project.name) {
@@ -871,7 +959,7 @@ try {
         );
         process.exit(2);
       }
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const daemon = livingDaemon();
       if (daemon === undefined) throw new Error("daemon is not running");
       if (daemon.project !== undefined && daemon.project !== project.name) {
@@ -947,7 +1035,7 @@ try {
     case "unblock": {
       const issue = issueArg("unblock", argv[1]);
       const cfg = loadConfig();
-      const project = findProject(cfg, flag(argv, "project"));
+      const project = findProject(cfg, projectFlag);
       const store = openStore(dbPath());
       try {
         const outcome = await unblockIssue(project, makeTracker(project), store, issue, {
@@ -989,7 +1077,7 @@ try {
         process.exit(2);
       }
       const cfg = loadConfig();
-      const project = findProject(cfg, flag(argv, "project"));
+      const project = findProject(cfg, projectFlag);
       const args: Record<string, string> = {};
       for (let i = 2; i < argv.length; i++) {
         const token = argv[i];
@@ -1003,7 +1091,7 @@ try {
           args[pair.slice(0, eq)] = pair.slice(eq + 1);
           i++;
         } else if (token === "--project" || token?.startsWith("--project=") === true) {
-          // Consumed by `flag(argv, "project")` above; both spellings skip here.
+          // Consumed by `projectFlag` above; both spellings skip here.
           if (token === "--project") i++;
         } else {
           process.stderr.write(
@@ -1027,10 +1115,10 @@ try {
             tracker: makeTracker(project),
             actions: githubVerbActions(project),
             fleetStop: () =>
-              isPaused()
-                ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+              isPaused(project.name)
+                ? "claiming is paused for this fleet (omp-conductor hold or stop)"
                 : undefined,
-            pausedAt,
+            pausedAt: () => pausedAt(project.name),
             log: (m) => process.stderr.write(`${m}\n`),
             now: () => Date.now(),
             chain: { readBaseChain },
@@ -1079,7 +1167,7 @@ try {
         process.stderr.write("omp-conductor: event record --occurred-at needs an ISO timestamp\n");
         process.exit(2);
       }
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         const event = store.recordMaterialEvent({
@@ -1129,7 +1217,7 @@ try {
         );
         process.exit(2);
       }
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         const at = Date.now();
@@ -1215,7 +1303,7 @@ try {
 
     case "decision": {
       const sub = argv[1];
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         if (sub === "open") {
@@ -1326,7 +1414,7 @@ try {
       }
       const issueText = flag(argv, "issue");
       const issue = issueText === undefined ? undefined : issueArg("friction --issue", issueText);
-      const project = findProject(loadConfig(), flag(argv, "project"));
+      const project = findProject(loadConfig(), projectFlag);
       const store = openStore(dbPath());
       try {
         store.recordFriction(project.name, {
@@ -1343,70 +1431,18 @@ try {
       break;
     }
 
-    case "pause":
-      setPaused(true, { source: "pause", reason: flag(argv, "reason") });
-      process.stdout.write(
-        "paused — no new work will be claimed\n" +
-          "note: ticks keep firing if armed; use hold to silence both\n",
-      );
-      break;
-
-    case "resume":
-      releaseHold();
-      process.stdout.write(
-        "resumed — claiming allowed on the next tick\n" +
-          "note: did NOT re-arm; run arm after an inbound Telegram proof to resume ticks\n",
-      );
-      break;
-
-    case "graph-setup": {
-      // Refused rather than accommodated. Under sudo every path this command
-      // derives — the config it loads, the state directory it writes to, the
-      // HOME and User= it bakes into the unit — resolves as root instead of the
-      // fleet's account, and the result is a timer that goes green while
-      // building indexes in a store no worker session ever reads. Nothing about
-      // that announces itself, so the only safe answer is to stop.
-      if (process.env["SUDO_USER"] !== undefined) {
-        process.stderr.write(
-          "omp-conductor: run graph-setup as the account the fleet runs as, not under sudo.\n" +
-            `Under sudo the config, ~/.cache and the unit's User= all resolve as root, and the\n` +
-            `indexes land where no worker can read them. Only installing the units needs root,\n` +
-            "and this command prints those two lines for you at the end.\n",
-        );
-        process.exit(1);
-      }
-
-      const project = findProject(loadConfig(), flag(argv, "project"));
-      if (graphRepos(project).length === 0) {
-        // Not a warning: with nothing configured there is nothing to print, and
-        // the fix is a wizard answer rather than a flag on this command.
-        process.stderr.write(
-          `omp-conductor: no repo in project "${project.name}" has graphProject set — re-run\n` +
-            "/conductor setup and say yes to code-graph discovery.\n",
-        );
-        process.exit(1);
-      }
-
-      if (!argv.includes("--write")) {
-        process.stdout.write(`${formatGraphSetup(project)}\n`);
-        break;
-      }
-
-      let result: GraphSetupWrite;
-      try {
-        result = writeGraphSetup(project);
-      } catch (err) {
-        // No longer the permissions case — all three files go to this account's
-        // own state directory — so this is a full disk, a read-only mount or a
-        // state directory someone else owns. Say what failed and offer the
-        // printed plan, which is a complete substitute for the write.
-        process.stderr.write(
-          `omp-conductor: could not stage the files (${err instanceof Error ? err.message : String(err)}).\n` +
-            "Drop --write and copy the printed text yourself — it is the same content.\n",
+    case "resume": {
+      for (const project of targetProjects()) {
+        releaseHold(project.name);
+        const pin = clearPaneHaltIfResolvable(project.name);
+        process.stdout.write(
+          "resumed — claiming allowed on the next tick\n" +
+            (pin.wasHalted
+              ? `pane recovery pin cleared — ${pin.path}\n`
+              : "no pane recovery pin to clear\n") +
+            "ticks stay disarmed — run `omp-conductor arm`\n",
         );
-        process.exit(1);
       }
-      process.stdout.write(`wrote:\n${result.written.map((f) => `  ${f}`).join("\n")}\n\n${result.next}\n`);
       break;
     }
 
@@ -1415,12 +1451,12 @@ try {
       let project: ProjectConfig | undefined;
       let path: string;
       if (override === undefined) {
-        project = findProject(loadConfig(), flag(argv, "project"));
+        project = findProject(loadConfig(), projectFlag);
         path = briefPathForProject(project);
       } else {
         path = override;
         try {
-          project = findProject(loadConfig(), flag(argv, "project"));
+          project = findProject(loadConfig(), projectFlag);
         } catch {
           project = undefined;
         }
@@ -1545,7 +1581,7 @@ try {
         } catch {
           process.stderr.write(
             `omp-conductor: no brief at ${path}` +
-              `${override === undefined ? " — run /conductor setup and say yes to writing ORCHESTRATOR.md." : "."}\n`,
+              `${override === undefined ? " — run `omp-conductor setup brief` and say yes to writing ORCHESTRATOR.md." : "."}\n`,
           );
           process.exit(1);
         }