feat: add emergency cleanup command

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

src/tamq/cli.py

@@ -25,6 +25,7 @@ from .broker import BrokerIdentity, InputBroker
 from .ptytap import PtyTap
 from .control import ControlModeClient
 from .composer import ComposerError, compose_message, recipient_order
+from .cleanup import cleanup_runtime
 from .diagnostics import configure
 from .policy import load_profile
 from .registry import RegistryError, validate_targets
@@ -32,7 +33,7 @@ from .terminal import format_comment
 
 
 SUBCOMMANDS = frozenset(
-    "start attach serve stop status ping inbox history inspect ack send reply export replay purge completion db-version config tap".split()
+    "start attach serve stop cleanup status ping inbox history inspect ack send reply export replay purge completion db-version config tap".split()
 )
 START_OPTIONS = frozenset({"--command", "--cmd", "--tap", "--detach", "--no-service", "--no-display", "--mode"})
 GLOBAL_FLAGS = frozenset({"--orwell", "--verbose"})
@@ -194,6 +195,16 @@ manual messaging from a managed shell:
 
     subparsers.add_parser("serve", help="run the local service in the foreground")
     subparsers.add_parser("stop", help="stop the local service")
+    cleanup = subparsers.add_parser(
+        "cleanup",
+        help="dry-run emergency shutdown and tamq-owned runtime cleanup",
+    )
+    cleanup.add_argument(
+        "--yes",
+        action="store_true",
+        help="stop the broker, close the managed session, and apply cleanup",
+    )
+    cleanup.add_argument("--session", default="tamq", help="managed tmux session")
     subparsers.add_parser("status", help="show endpoint health")
     subparsers.add_parser("ping", help="check local service liveness")
     history = subparsers.add_parser("history", help="inspect local message history")
@@ -229,6 +240,11 @@ manual messaging from a managed shell:
     purge = subparsers.add_parser("purge", help="dry-run or remove history")
     purge.add_argument("--before", default=None)
     purge.add_argument("--max-size", default=None)
+    purge.add_argument(
+        "--feedback-chain",
+        metavar="MESSAGE_ID",
+        help="select one reflected-delivery chain by its durable root message",
+    )
     purge.add_argument("--yes", action="store_true")
     purge.add_argument("--orwell", action="store_true")
     completion = subparsers.add_parser("completion", help="emit shell completion script")
@@ -290,6 +306,14 @@ def main(argv: list[str] | None = None) -> int:
             return 0
         print("tamq service is not running", file=sys.stderr)
         return 1
+    if args.command == "cleanup":
+        report = cleanup_runtime(
+            apply=args.yes,
+            session=args.session,
+            stop_service=stop_service_process,
+        )
+        print(json.dumps(report, sort_keys=True))
+        return 1 if report["errors"] else 0
     if args.command == "serve":
         try: asyncio.run(Service().run())
         except KeyboardInterrupt: return 0
@@ -561,6 +585,27 @@ def main(argv: list[str] | None = None) -> int:
                 return 2
             print(json.dumps({"batch_id": batch_id, "count": count})); return 0
         if args.command == "purge":
+            if args.feedback_chain:
+                if args.before or args.max_size:
+                    print(
+                        "tamq: --feedback-chain cannot be combined with --before or --max-size",
+                        file=sys.stderr,
+                    )
+                    return 2
+                matching = store.feedback_chain(args.feedback_chain)
+                if not matching:
+                    print("tamq: feedback-chain root not found", file=sys.stderr)
+                    return 1
+                if not args.yes:
+                    print(
+                        f"Dry run: {len(matching)} message(s) match feedback chain rooted at {args.feedback_chain}; re-run with --yes to purge."
+                    )
+                    return 0
+                count = store.delete_messages(
+                    row["message_id"] for row in matching
+                )
+                print(f"Purged {count} feedback-chain message(s).")
+                return 0
             before_text = args.before or setting("purge_before", "365d")
             max_size_text = args.max_size or setting("purge_max_size", "100MB")
             before = time.time() - int(before_text[:-1]) * 86400 if before_text.endswith("d") else None