[aaltshuler]

What & why

Cluster deployment, stored-query inspection, policy tools and graph discovery still run through the large CLI dispatcher and process output. Move their existing arguments and handlers into commands/cluster and commands/control, and pass fallible writers through direct and served control paths. Broken pipes return errors instead of panicking, including after completed deployment work.

Keep command syntax, normal output, scope selection and managed dispatch precedence unchanged. Applied query/policy tooling retains its captured serving snapshot and ledger CAS; the cluster crate retains publication, admission and recovery authority. No new flags, dependencies, retries or target-selection rules.

Backing issue / RFC

• Implements the existing accepted RFC 0009 access-path boundary and RFC 0011 CLI addressing contract.

Draft RFC #675 supplies refactor sequencing; its proposed targeting grammar is not introduced here.

Checklist

• One cluster/control execution and delivery boundary
• Existing application, renderer and CLI integration test owners extended
• User/developer guides and permanent release note updated
• Invariants reviewed; deployment, admission, snapshot and recovery owners preserved

Local verification

• Clean baseline: env CARGO_TARGET_DIR=/Users/andrew/code/omnigraph/target CARGO_BIN_EXE_omnigraph-server=/Users/andrew/code/omnigraph/target/debug/omnigraph-server cargo test -p omnigraph-cli --locked — 532 passed, 19 ignored.
• Same full CLI command after refactor — 541 passed, 19 ignored, including real-server integration and deployment delivery-loss tests.
• env CARGO_TARGET_DIR=/Users/andrew/code/omnigraph/target cargo clippy -p omnigraph-cli --all-targets --locked -- -D warnings -W clippy::dbg_macro — passed.
• cargo fmt --all --check, documentation checker (318 Markdown files), targeted typos, and git diff --check — passed.
• Baseline/current executables: all 106 help/argument cases match exactly. Of 27 ordinary control-command cases, 26 match exit/stdout/stderr byte-for-byte; cluster observe JSON matches after excluding only its live observed_at clock value. Raw output is retained in the local characterization report.
• All 26 closed-stdout cases change from panic/exit 101 to ordinary error/exit 1, with durable state matching ordinary equivalents. Two schema-changing apply cases (closed stdout/stderr) each complete exactly one publication/result and preserve the original receipt/lock; repeated original-ID status reads leave state unchanged.
• Checked-in tests cover supplied write/flush failures, exact-ID resubmission without replay, root-only reconciliation, root/config unlock, diagnostic custody, served pre-POST identity delivery and post-POST receipt/timeout output.
• Historical storage-upgrade journeys remain unavailable locally and are skipped by their existing predecessor-binary availability checks. Whole-workspace, GQT and cloud suites were not run for this CLI boundary change.

Notes for reviewers

Depends on #1045 at f438d197eb1e769f840b879ce312bcf793715be0, still open. Predecessor commits remain in the PR until the stack lands; this slice is the final commit.

Served apply must deliver and flush its ID before the single POST. Its receipt/timeout write failures never enter polling retries; timeout exit 5 requires delivered diagnostics. Direct apply's existing core identity callback is infallible: a failed identity report is retained while that one call finishes, then returned with the original ID, redacted root and lock. This deliberately replaces the old stderr panic/abort with an ordinary error and a settled-or-original recovery identity; it does not roll back or replay work. Exact-ID resubmission continues to observe an existing result. Upgrade, reconciliation and unlock retain their recovery details on partial-write or flush failure, and a failed diagnostic retains the underlying core refusal.

Managed provisioning/authentication keep their current owners. Engine/storage code, data-write outcome classification and query semantics are unchanged.

[aaltshuler]

Superseded by #1047, which merged the complete CLI refactor, its delivery and configuration fixes, and the latest main integrations as 02026b5. Closing this incremental slice because its implementation is now on main.