Usage: stratum watchdog <action> [arguments]

status [--json] | state       Scheduler, configuration and latest completed round
                              --json: the same as data for the interface
start | stop                  Start / stop scheduled checks; boot setting unchanged
enable | disable              Enable at boot and start / disable and stop
restart | apply               Apply interval and systemd restart policies
run [--json] [check...]       Check and repair now (still honors pause and APT);
                              --json: per check the result, repair and reason
                              (network includes DNS; "dns" is accepted for it)
check [check...]              Check without repair, notifications or state writes
timer                         Scheduled round; persistent problems need two fresh rounds
events [--json] [hours]       Recent events (default 24 hours)
events-count [hours]          Problems / repaired / attention, machine-readable
problems                      Unresolved problems from the last completed round
pending                       Nothing waits for confirmation (exit 1 when idle)
pause [minutes] | resume      Pause repairs (1-1440, default 60); checks continue
settings | options            Settings / computer profiles
configure <profile>           workstation | server | hypervisor | vm-guest
setting <key> <value> [--json]
                              type, interval, restart-limit, disk-warn, disk-crit,
                              cleanup, systemd-restart, notify, webhook, hwwatchdog, motd;
                              --json: accepted value, effective value and what changed
setting-choices <key>         Values offered in the Stratum menu
lists | toggles checks        Available checks and their state
set checks [check...]         Select built-in checks; custom checks are independent
dialog <problems|events|pause>  Control Desk view
motd                          Short status for the message of the day
--version | help              Version / this help

JSON actions write one object and no other text; they need no network access.
"status --json" has state, profile, interval, paused until, checks (id, name,
enabled, last result, last time, restarts this hour), targets with their
state, disk warning/critical, notify mode and the next round. "run --json"
adds the result (ok/warn/crit), the repair attempted and the reason for every
check of the round. "events --json" lists time, check, target, severity,
action and message.

Safety: disabled and cleanly stopped services are never started. One-time tasks
and protected network services are not restarted. Repairs are serialized, limited
per target per hour, revalidated before execution and suppressed during package
operations or a pause. A changed boot or stale previous round cannot authorize
an automatic repair. Arbitrary module start hooks never bypass network confirmations.
Hardware reset and a destructive disk cleanup require explicit confirmation with
STRATUM_FORCE=1; package upgrade does not arm hardware. No automatic reboot or
network configuration changes.

Custom checks: root-owned, executable, non-group/world-writable *.check files in
/etc/stratum/watchdog.d. Exit 0 is healthy, 1 warning, 2 critical. First output line
is the message; # restart: name.service requests a guarded repair. Checks have
deadlines and bounded output. A custom check remains administrator-controlled code.

Files: /etc/stratum/watchdog.conf, /var/lib/stratum/watchdog,
/var/log/stratum-watchdog/events.log, /run/stratum/watchdog.pause.
