CLI reference

Generated from the live Click command tree at docs build time — every flag, default and choice below comes from the same metadata recon-gen --help reads. Change the CLI and this page changes with it on the next docs apply / Pages build (no hand-kept copy to drift).

This is the lookup-shaped reference: "what does --portable do?", "which extras does audit verify need?". For the spirit-of-the-tool walkthrough (when to use each verb, typical sequences) start with the For your role pages instead.

recon-gen

Independent reconciliation validation from one L2 YAML — self-hosted dashboards + regulator-ready audit PDF.

Usage:

recon-gen [OPTIONS] COMMAND [ARGS]...

Options:

Name	Type	Description	Default
--version	boolean	Show the version and exit.	False
--help	boolean	Show this message and exit.	False

recon-gen audit

Per-instance PDF reconciliation report (cover, summary, exceptions).

Usage:

recon-gen audit [OPTIONS] COMMAND [ARGS]...

Options:

Name	Type	Description	Default
--help	boolean	Show this message and exit.	False

recon-gen audit apply

Emit the audit report's Markdown source (or --execute to write a PDF).

Default: print the Markdown rendering of the report (cover + section outline) to stdout. Pass -o FILE to write to a file. Useful for review before committing to a PDF.

Pass --execute to render the report as a PDF via reportlab. Default destination is report.pdf in the current working directory; override with -o FILE.

Usage:

recon-gen audit apply [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
--period	date_interval	Report period. Accepted shapes: trailing:N (N days ending yesterday; e.g. trailing:7), today, yesterday, YYYY-MM-DD..YYYY-MM-DD (explicit closed-closed range) or single YYYY-MM-DD (one-day report). Default: trailing:7 (a 7-day window ending yesterday — the audit-window convention).	None
-o, --output	path	Output path. Without --execute: Markdown source destination (default: stdout). With --execute: PDF destination (default: report.pdf).	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen audit clean

Print or remove the generated report file.

Default: print the path that would be deleted (no side effect). Pass --execute to actually unlink it.

Usage:

recon-gen audit clean [OPTIONS]

Options:

Name	Type	Description	Default
-o, --output	path	PDF path to remove (default: report.pdf).	report.pdf
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen audit test

Run the audit test suite (pytest + pyright on the audit module).

Targets tests/audit/ for pytest — scenario expectations, PDF/dashboard extractors, PDF-matches-scenario, persona-clean and smoke. Defers the browser matrix (the per-renderer agreement producers + validators under tests/e2e/qs_browser/) to the e2e tier — not run here.

Pyright covers the audit package (cli/audit/).

Usage:

recon-gen audit test [OPTIONS]

Options:

Name	Type	Description	Default
--pytest-args	text	Extra args passed verbatim to pytest (e.g. '-k smoke').	``
--help	boolean	Show this message and exit.	False

recon-gen audit verify

Verify an audit PDF's embedded provenance fingerprint.

Extracts the ProvenanceFingerprint JSON embedded in the PDF's /Subject metadata, recomputes each input from current sources (DB rows up to the embedded high-water-mark, L2 yaml bytes on disk, current recon-gen code identity) and reports per-source matches/diffs.

Recomputes against the EMBEDDED hwm (not current MAX(entry)) so the verification reproduces the report's snapshot point — new rows added since report-generation time don't trigger a false diff. A diff fires only when bytes that the fingerprint actually covers have changed: a row at or below the embedded hwm was modified, the L2 yaml was edited or the code identity changed.

Exits 0 on full match, 1 with a per-source diff on mismatch.

Usage:

recon-gen audit verify [OPTIONS] PDF_PATH

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
--help	boolean	Show this message and exit.	False

recon-gen dashboards

Start the self-hosted HTMX/d3 dashboard server.

With no --app (the default all), builds the four real apps (l1_dashboard / l2_flow_tracing / investigation / executives) into one server — /dashboards lists them and you switch between them in-process; same "no-arg = all" shape as json apply. --app <one> narrows to a single app (faster startup when iterating). --app smoke is the DB-free spike fixture (the only one --stub applies to). Config + L2 instance are loaded the same way the json / data / audit groups do; visual data comes from the configured DB; one shared connection pool serves every app. The mkdocs handbook (same --l2) is built on startup and embedded at /docs when the [docs] extra is installed — --no-docs skips it.

Studio (recon-gen studio) mounts everything dashboards mounts plus the editor + diagram + data-shaping surface; reach for that command when the integrator / trainer / ETL-engineer loops matter. dashboards is the lean read-only mount.

Usage:

recon-gen dashboards [OPTIONS]

Options:

Name	Type	Description	Default
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--host	text	Bind address. Use 0.0.0.0 to expose on the network.	127.0.0.1
--port	integer	TCP port to listen on.	8765
--dev-log / --no-dev-log	boolean	Forward HTMX + d3 click events to stderr for live debugging. Default off so production deploys stay silent.	False
--stub / --no-stub	boolean	Use the deterministic stub fetcher instead of querying the configured DB. Useful for iterating on the JS / page shell without a populated database.	False
--app	choice (all | smoke | l1_dashboard | l2_flow_tracing | investigation | executives)	Which dashboard surface(s) to serve. all (default) builds the four real apps into one server — /dashboards lists them and you switch between them in-process, same as json apply with no --app. Pass a single app name to narrow to one (faster startup when iterating). smoke is the DB-free spike fixture (the only one that works without a configured database, and the only one --stub applies to).	all
--docs / --no-docs	boolean	Build the mkdocs handbook (against the same --l2) on startup and serve it at /docs (X.2.i). Best-effort: silently skipped when mkdocs isn't installed (pip install recon-gen[docs]). --no-docs skips the build for a faster startup. The standalone docs apply / docs serve / docs export CLI is unaffected either way.	True
--docs-dir	text	Path to a PRE-BUILT mkdocs site dir to serve at /docs — skips the on-launch build entirely (DZ.5). Use when the site is built once out-of-band (e.g. the demo refresh job) so the heavy build stays off the launch path. Overrides --no-docs. Env fallback: RECON_GEN_DOCS_SITE_DIR (validated must_be_dir).	None
--tls-cert	text	Path to a PEM-encoded TLS cert. When set together with --tls-key the server listens HTTPS via uvicorn's ssl_certfile. Half-set raises UsageError. Env fallback: RECON_GEN_TLS_CERT (validated via env_keys registry — must_be_file). DC.1; cfg fallback (cfg.app2.tls.cert_path) wires in DE.2.	None
--tls-key	text	Path to a PEM-encoded TLS private key (paired with --tls-cert). Env fallback: RECON_GEN_TLS_KEY.	None
--help	boolean	Show this message and exit.	False

recon-gen data

Per-prefix seed data: 90-day baseline + plant overlays.

Usage:

recon-gen data [OPTIONS] COMMAND [ARGS]...

Options:

Name	Type	Description	Default
--help	boolean	Show this message and exit.	False

recon-gen data apply

Emit the demo seed SQL (or --execute to insert against the demo DB).

The composition: 90-day baseline → densify per-kind plants ×5 → add 15 broken-rail stuck_pending plants → boost inv_fanout amounts ×5 → emit_full_seed. --seed-density=N scales the three knobs.

Default: print every INSERT to stdout (or to -o FILE). Pass --execute to connect + insert.

Assumes the schema is already applied (schema apply --execute or a prior schema). After data apply --execute you'll likely want data refresh --execute so the matviews see the new rows.

Usage:

recon-gen data apply [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
-o, --output	path	Write the script to FILE instead of stdout.	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--seed-density	float	Scalar multiplier on plant density (densify factor / broken-rail count / fanout multiplier). 1.0 = byte-identical to pre-c.13 behavior; 2.0 = double the plants; 0.5 = halve. Operator opt-in for heavier nightly scenarios; default keeps locked SQL files valid.	1.0
--help	boolean	Show this message and exit.	False

recon-gen data clean

Emit TRUNCATE statements (or --execute to wipe seeded rows).

Default: print TRUNCATEs for <prefix>_transactions and <prefix>_daily_balances to stdout (or to -o FILE). The schema stays — only the rows go.

Pass --execute to actually run them.

To wipe schema + rows together, run data clean --execute followed by schema clean --execute.

Usage:

recon-gen data clean [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
-o, --output	path	Write the script to FILE instead of stdout.	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen data etl-example

Emit canonical INSERT-pattern examples for ETL authors.

Output is exemplary, not executable against the real demo seed — every pattern uses fixed sentinel IDs (xxx-EXAMPLE-001) so the statements are self-contained. Each block carries a -- WHY: header naming the business invariant and a -- Consumed by: header naming the dashboard view that reads the resulting rows.

See src/recon_gen/docs/handbook/etl.md for the walkthroughs that reference this output.

Usage:

recon-gen data etl-example [OPTIONS]

Options:

Name	Type	Description	Default
-o, --output	path	Output path for the ETL examples SQL file.	demo/etl-examples.sql
--help	boolean	Show this message and exit.	False

recon-gen data refresh

Emit the REFRESH MATERIALIZED VIEW SQL (or --execute to refresh).

Default: print every REFRESH MATERIALIZED VIEW (in dependency order: leaves → helpers → invariants → rollups) to stdout (or to -o FILE). Pass --execute to run against the demo DB.

Run after every ETL load that mutates <prefix>_transactions or <prefix>_daily_balances — the L1 invariant matviews + Investigation matviews don't auto-refresh.

Usage:

recon-gen data refresh [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
-o, --output	path	Write the script to FILE instead of stdout.	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen data semantic-lock

Write or verify the canonical-anchor semantic lock.

Gates on the VIOLATION SET rather than SQL bytes. The locked file lives at tests/data/_semantic_locks/<instance>.duckdb.json and is the record of what semantic_lock(conn, ALL_INVARIANTS) returns post-emit at canonical anchor (2030-01-01).

Default: refresh the lock file (overwrites with a fresh emit). Pass --check to verify-only — exit non-zero on drift, with a unified diff to stderr showing the first ~50 changed lines.

DuckDB-only. The matview SQL differs per dialect so PG / Oracle locks need real deployed DBs (the deploy_pipeline path).

Usage:

recon-gen data semantic-lock [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--check	boolean	Exit non-zero if the on-disk semantic lock doesn't match a fresh emit. Use in CI to guard against unreviewed violation set drift.	False
--help	boolean	Show this message and exit.	False

recon-gen data test

Run the data test suite (pytest + pyright on the seed pipeline).

Usage:

recon-gen data test [OPTIONS]

Options:

Name	Type	Description	Default
--pytest-args	text	Extra args passed verbatim to pytest (e.g. '-k hash_lock').	``
--help	boolean	Show this message and exit.	False

recon-gen docs

mkdocs handbook site (build, serve, test, export, screenshot).

Usage:

recon-gen docs [OPTIONS] COMMAND [ARGS]...

Options:

Name	Type	Description	Default
--help	boolean	Show this message and exit.	False

recon-gen docs apply

Build the docs site to site/ (or -o DIR).

Wraps mkdocs build. The L2 instance bound via --l2 (or falling back to the bundled spec_example) drives every {{ vocab.* }} substitution in the rendered prose.

With --portable, emits a static-site that opens via file:// — handy for shipping the rendered handbook on a USB stick, in a zip attachment or to a wiki that doesn't run a web server.

No --execute: building a static site IS the operation.

Usage:

recon-gen docs apply [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
-o, --output	path	Output directory for the built site (default: site/).	site
--strict / --no-strict	boolean	Pass --strict to mkdocs (default on; treats warnings as errors).	True
--portable	boolean	Build with use_directory_urls: false so the rendered site opens via file:// without a web server (every page emits as /index.html with relative links). The default build uses pretty URLs (/scenario/) which require an HTTP server to map the slug to its index.html.	False
--help	boolean	Show this message and exit.	False

recon-gen docs clean

Remove the built site directory.

Usage:

recon-gen docs clean [OPTIONS]

Options:

Name	Type	Description	Default
-o, --output	path	Directory to remove (default: site/).	site
--help	boolean	Show this message and exit.	False

recon-gen docs export

Export bundled mkdocs source OR a generated docs artifact.

Default (--surface=tree): copy the bundled mkdocs source to --output DIR so an integrator can use their own mkdocs config / theme / build pipeline. Different from docs apply: apply builds the site INTO a directory; export tree copies the SOURCE.

--surface=matrix (BV.7): walk PLANT_REGISTRY + the typed section catalogues and emit the §0.5 coverage matrix as Markdown. Default to stdout; --output PATH writes to a file. The committed reference artifact at tests/data/_handbook_artifacts/coverage_matrix.md is the byte-identity anti-drift gate — refresh it after a registry edit.

--surface=trainer-cards (BV.7): walk PLANT_REGISTRY through resolve_section and emit one ## {kind} block per entry carrying the canonical short_statement + what_to_do strings the Trainer's /training/ v3 cards render. Default to stdout; --output PATH writes to a file. Reference artifact at tests/data/_handbook_artifacts/trainer_cards.md.

--surface=violations (BV.7 Surface 2): walk PLANT_REGISTRY through resolve_section and emit a single-bundle Markdown handbook — one ## {title} {#slug} block per kind with deep-linkable anchors derived from the canonical machine kind (lowercased, underscores → hyphens). Default to stdout; --output PATH writes to a file. Reference artifact at tests/data/_handbook_artifacts/violations.md.

Usage:

recon-gen docs export [OPTIONS]

Options:

Name	Type	Description	Default
-o, --output	path	Target directory (default mode) OR file path (--surface=matrix). Required for the default tree-copy mode; optional for --surface=matrix (defaults to stdout).	None
--l2	path	Optional path to an L2 institution YAML to bind the rendered docs against. Validated here; binding happens at mkdocs build time via RECON_GEN_DOCS_L2_INSTANCE env var.	Sentinel.UNSET
--surface	choice (tree | matrix | trainer-cards | violations | plant-banner-snippets)	Which docs surface to export. tree (default) copies the bundled mkdocs source for hand-build (legacy behavior). matrix emits the BU.0.5 §0.5 violation coverage matrix generated from PLANT_REGISTRY + the three typed section catalogues — BV.7 anti-drift artifact (Lock 11). trainer-cards emits one ## block per registry kind carrying the canonical short_statement + what_to_do strings (resolve_section dispatch) — BV.7 byte-identity verifier for the Trainer's /training/ v3 cards. violations emits a single-bundle Markdown handbook with deep-linkable slug anchors per kind — BV.7 Surface 2, consumed by the BTa.1 / BX.12 side-panel system. plant-banner-snippets emits a Markdown reference table of the per-kind copy strings the /etl/triage dynamic plant banner renders — BV.7 Surface 4 (BU.0 Lock 11.4); the runtime banner reads <v>_config_kv so this CLI export is L2-independent reference material, not a deployable artifact.	tree
--help	boolean	Show this message and exit.	False

recon-gen docs screenshot

Capture per-sheet PNG screenshots of the dashboards.

Walks the requested app's tree via WebKit and writes one full-page PNG per sheet to <output>/<app-slug>/<sheet_id>.png. Single CLI surface for every app (replaces the per-app capture scripts that used to live under scripts/).

DY.9 — the capture engine is the self-hosted App2 path (common/browser/screenshot.py::capture_app_dashboards): each app's tree is built via _html_serve.build_real_app, served on an ephemeral localhost port by the same Starlette stack recon-gen dashboards runs, and walked sheet-by-sheet in WebKit. (The pre-DW QS embed-URL path was removed with QuickSight.) The handbook + walkthrough pages embed these screenshots by relative path under docs/walkthroughs/screenshots/<app>/.

Usage:

recon-gen docs screenshot [OPTIONS]

Options:

Name	Type	Description	Default
--app	choice (executives | investigation | l1-dashboard | l2-flow-tracing)	Single app to capture. Mutually exclusive with --all.	None
--all	boolean	Capture all 4 apps. Output goes to //.	False
-o, --output	path	Target directory; per-app subdirs created under it.	Sentinel.UNSET
-c, --config	path	Config YAML (default: env vars).	None
--l2	path	L2 institution YAML override. Defaults to each app's built-in default (spec_example for most). Pass when capturing a deploy against a non-default L2 (e.g. your own institution's YAML).	None
--viewport	text	Browser viewport WxH (default 1280x900).	1280x900
--skip-warmup	boolean	Skip the F12 SELECT 1 cluster warmup (use when DB is hot).	False
--headless / --no-headless	boolean	Run browser headless (default) or visible (debug).	True
--initial-settle-ms	integer	Settle delay after dashboard chrome appears, before first capture.	10000
--per-sheet-settle-ms	integer	Settle delay after each sheet-tab click, before capture.	8000
--date-from	text	YYYY-MM-DD override for each app's *DateStart parameter(s). Use to span the seed's anchor date when the dashboard's default rolling-window control doesn't reach it.	None
--date-to	text	YYYY-MM-DD override for each app's *DateEnd parameter(s) (L1 also applies it to the Daily Statement single-day picker).	None
--help	boolean	Show this message and exit.	False

recon-gen docs serve

Live-reload preview at http://localhost:PORT (default 8000).

Wraps mkdocs serve. Edit any docs source file and the browser refreshes automatically. Useful for iterating on persona-block YAML edits or new walkthrough drafts.

Usage:

recon-gen docs serve [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--port, -p	integer	Port to bind for live-reload preview.	8000
--help	boolean	Show this message and exit.	False

recon-gen docs test

Run the docs gates (link sweep + persona-neutral check).

Usage:

recon-gen docs test [OPTIONS]

Options:

Name	Type	Description	Default
--pytest-args	text	Extra args passed verbatim to pytest (e.g. '-k links -v').	``
--help	boolean	Show this message and exit.	False

recon-gen schema

Per-prefix schema DDL: tables, views, materialized views.

Usage:

recon-gen schema [OPTIONS] COMMAND [ARGS]...

Options:

Name	Type	Description	Default
--help	boolean	Show this message and exit.	False

recon-gen schema apply

Emit the schema DDL (or --execute to apply against the demo DB).

Default behavior: print every CREATE statement for the L2 instance's per-prefix tables, views and materialized views to stdout (or to -o FILE). Pipe it to your DB tool: recon-gen schema apply | psql ....

Pass --execute to connect to the demo DB named in the config and actually run every CREATE.

Usage:

recon-gen schema apply [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
-o, --output	path	Write the script to FILE instead of stdout.	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen schema clean

Emit DROP statements (or --execute to drop against the demo DB).

Default: print every DROP for the L2 instance's per-prefix matviews / views / tables (in dependency order) to stdout (or -o FILE).

Pass --execute to connect and actually drop them.

Schema-only cleanup. To wipe seeded rows without dropping the schema, run data clean instead.

Usage:

recon-gen schema clean [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
-o, --output	path	Write the script to FILE instead of stdout.	None
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen schema migrate-mark

CZ.6 — stamp metadata.source on every pre-CZ row.

Phase CZ's standalone-mode cleanup gate (cfg.app2.etl_hook is None ⇒ DELETE-only-synthetic on Trainer reset / Studio Deploy-changes) keys on JSON_VALUE(metadata, '$.source') = 'training' as the synthetic-row predicate. CZ.2 stamps new writes; CZ.6 fills in pre- CZ rows already sitting in the DB at upgrade time.

Default-emit shape: prints what would be done (row counts per base table). Pass --execute to actually run the UPDATE and commit.

Same auto-mark logic fires from data apply --execute's pre- flight check — this verb is the explicit form, primarily used when the operator wants --source=real (real ETL data loaded before CZ landed) or wants to re-run after seeding more pre-CZ rows.

Usage:

recon-gen schema migrate-mark [OPTIONS]

Options:

Name	Type	Description	Default
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--config, -c	path	Path to configuration file (DB connection + dialect).	config.yaml
--source	text	Value to write into metadata.source on every unstamped row. Default 'training' assumes pre-CZ rows came from the seed/training path (the common case — production-integrator etl_hook is brand-new in BS.4 and ships alongside CZ). Set --source=real on the rare DB that loaded real ETL data before CZ landed so those rows survive standalone-mode resets.	training
--execute	boolean	Actually run the script (connect to the DB / AWS and execute). Without this flag, the script is emitted to stdout (or to -o FILE) without any side effects.	False
--help	boolean	Show this message and exit.	False

recon-gen schema test

Run the schema test suite (pytest + pyright).

Usage:

recon-gen schema test [OPTIONS]

Options:

Name	Type	Description	Default
--pytest-args	text	Extra args passed verbatim to pytest (e.g. '-k drift -v').	``
--help	boolean	Show this message and exit.	False

recon-gen studio

Start Studio — the implementation-tools surface for the integrator, trainer and ETL engineer.

Studio is a Starlette process that mounts the Dashboards routes plus a Studio-side editor, unified diagram, data-shaping panel and Deploy-changes orchestration. One in-memory cache of the L2 YAML backs every Studio request; the YAML on disk stays the source of truth (every save is an atomic write through Studio).

X.4.a.4 ships only the landing placeholder; the unified diagram (X.4.c), editor (X.4.e) and Deploy pipeline (X.4.g) land in sub-phases. The CLI surface is stable from this commit forward.

Usage:

recon-gen studio [OPTIONS]

Options:

Name	Type	Description	Default
--config, -c	path	Path to configuration file (used for the dialect setting only).	config.yaml
--l2	file	Path to L2 instance YAML. Default: bundled spec_example.	None
--host	text	Bind address. Use 0.0.0.0 to expose on the network.	127.0.0.1
--port	integer	TCP port to listen on.	8765
--dev-log / --no-dev-log	boolean	Forward HTMX + d3 click events to stderr for live debugging. Default off so production deploys stay silent.	False
--app	choice (all | l1_dashboard | l2_flow_tracing | investigation | executives)	Which dashboard surface(s) Studio mounts under /dashboards. all (default) mounts the four real apps; pass a single name to narrow (faster startup when iterating on a single dashboard alongside Studio). Studio routes are unaffected by this knob.	all
--docs / --no-docs	boolean	Build the mkdocs handbook (against the same --l2) on startup and serve it at /docs (X.2.i). Best-effort: silently skipped when mkdocs isn't installed (pip install recon-gen[docs]).	True
--docs-dir	text	Path to a PRE-BUILT mkdocs site dir to serve at /docs — skips the on-launch build entirely (DZ.5). Use when the site is built once out-of-band so the heavy build stays off the launch path. Overrides --no-docs. Env fallback: RECON_GEN_DOCS_SITE_DIR.	None
--tls-cert	text	Path to a PEM-encoded TLS cert. When set together with --tls-key the server listens HTTPS via uvicorn's ssl_certfile. Half-set raises UsageError. Env fallback: RECON_GEN_TLS_CERT (validated via env_keys registry — must_be_file). DC.1; cfg fallback (cfg.app2.tls.cert_path) wires in DE.2.	None
--tls-key	text	Path to a PEM-encoded TLS private key (paired with --tls-cert). Env fallback: RECON_GEN_TLS_KEY.	None
--help	boolean	Show this message and exit.	False