pub const USAGE: &str = "usage:
haematite serve --config <file.json> [--create] (Unix; manual foreground service)
haematite call (--socket <path> | --config <file.json>) [--timeout-ms N]
<method> [<params> | -] (Unix)
haematite install --bundle <new directory> --config <service.json>
[--lys-issuer <origin> --lys-credential-file <absolute path>] (Unix)
haematite mcp-http --config <absolute service.json> (Unix; HTTP /mcp, Lys sign-in)
haematite door --config <absolute door.json> (Unix; Studio's origin, Lys sign-in)
haematite lys-schema --issuer <origin> --credential-file <absolute path> (--check | --register)
haematite release date --config <file.json> --branch <name> --generation <created>
--at <nanoseconds> (Unix; offline)
haematite branch-rename --config <file.json> --from <name> --to <name> (--check | --apply)
[--long-wait-interval <duration>] (Unix; offline; fork, then discard; example: 30s)
haematite mcp (--socket <path> | --config <file.json>) [--timeout-ms N]
[--pass-file <path> | --lys-agent <issuer origin> <agent id>
(--credential-file | --key-file) <absolute path>]
(Unix; MCP stdio; a Lys pass is presented on every call: read from the
pass file, or asked of Lys's agent pass route with the grant credential
or a request signed with the agent key, whenever none is held or the
held one expires within 60 s)
haematite write (--socket <path> | --config <file.json>) [--timeout-ms N] --branch <name>
[--expected <generation>.<sequence>] [--request-id <text>] <kind> <value | -> (Unix)
haematite query (--socket <path> | --config <file.json>) [--timeout-ms N] --branch <name>
<text | -> (Unix)
haematite stats <data_dir> [--refs-dir PATH]... [--snapshot-file PATH]... [--json]
haematite vacuum <data_dir> (--dry-run | --sweep) [--refs-dir PATH]...
[--snapshot-file PATH]... [--attest-metadata-complete] [--json]
haematite migrate-chunking <data_dir> (--migrate | --abort) [--json]
haematite history-check <data_dir> [--json] [--show N]
haematite observe-get <data_dir> (--key <text> | --key-hex <hex>) [--hex]
stats — report-only storage inventory: full strict enumeration, verified
reachability walk from every durable pin source, zero deletions.
vacuum — the sweep. --dry-run runs the full pass, evaluates every refusal,
and reports the deletion set WITHOUT removing anything; --sweep
additionally unlinks exactly the unreachable nodes. Any blocker
refuses the whole run (zero deletions anywhere).
call — one request to a running service, after its hello. <params> is one
JSON value, - reads it from standard input; --timeout-ms bounds the
connect, the write and the read (default 30000). Exit 0 answered,
result on standard output; 1 could not ask, nothing was sent; 2
refused, its code and message on standard error; 3 the outcome is
not known to the caller.
mcp — MCP stdio child process. One JSON-RPC message per line, responses
only on standard output; diagnostics on standard error. End of
standard input exits 0; a transport write or read error exits 1.
write — one change to a branch through mutation.apply, under a request id
(made and printed when not given). Without --expected the change is
applied to the branch as it stands when the command runs; a caller
who read a record and is changing it gives --expected. When the
outcome is not known the receipt is asked for; exit 3 when there is
none, naming the request id that is safe to repeat. A usage error
prints its full usage text.
query — a query's rows at the branch's head, one per line as the service
sent them, every page followed until the answer is complete, each
page sized from the service's hello. Stopped part-way (exit 2 or 3),
standard error says how many rows were printed and that the answer
is not complete.
migrate-chunking — the offline, whole-directory byte-aware (v2) migration
(CHUNKING-POLICY.md §4.2). --migrate converts a v1 directory to v2 (or
resumes an interrupted run); --abort runs the durable reverse to v1.
OFFLINE ONLY: no live database or vacuum may touch the directory. A
crash leaves the directory fenced; rerun to resume idempotently.
ADVISORY: run `haematite vacuum --sweep` first on a garbage-heavy store
(§7.2), and TAKE A BACKUP before migrating — the run has an abort path
but no other way back.
history-check — read-only: each legacy history file's heads against its
service row, by the importer's rule. Refuses a store with a live
writer; run it on a copy. One summary line, then at most --show
(default 50) mismatch lines. Exit 0 every file equal, 1 any
mismatch, 2 refused.
observe-get — read-only, beside a live writer: the committed value at one
key, through the observer (no lock taken, nothing written). The
value goes to standard output as stored, or as hex with --hex.
Exit 0 found, 1 no committed value at the key, 2 refused.
--attest-metadata-complete (sweep only): the operator asserts the canonical
plus supplied paths are ALL metadata for this data dir, and that its
metadata history was written entirely under the supported durability
contract. A considered, data-loss-weighted responsibility.
`haematite manifest …` (reservation-ledger operations) is not yet available.";