@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.830

package/dist/heart/daemon/doctor.js

@@ -0,0 +1,1755 @@
+"use strict";
+/**
+ * System health check ("ouro doctor") — runs all diagnostic categories
+ * and aggregates results into a structured DoctorResult.
+ *
+ * Each category checker is isolated: if one throws, it produces a single
+ * "fail" check and the remaining categories still run.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_DOCTOR_CATEGORIES = exports.DEFAULT_SENSE_DELIVERY_THRESHOLDS = exports.DEFAULT_MAIL_INGEST_THRESHOLDS = void 0;
+exports.checkCliPath = checkCliPath;
+exports.checkDaemon = checkDaemon;
+exports.senseInboundDeliveryCheck = senseInboundDeliveryCheck;
+exports.checkAgents = checkAgents;
+exports.checkSenses = checkSenses;
+exports.checkHabits = checkHabits;
+exports.checkRsvp = checkRsvp;
+exports.checkSecurity = checkSecurity;
+exports.checkTrips = checkTrips;
+exports.checkMailroom = checkMailroom;
+exports.checkFriends = checkFriends;
+exports.checkDisk = checkDisk;
+exports.checkLifecycle = checkLifecycle;
+exports.runDoctorChecks = runDoctorChecks;
+const runtime_1 = require("../../nerves/runtime");
+const bluebubbles_health_diagnostics_1 = require("./bluebubbles-health-diagnostics");
+const webhook_registration_1 = require("../../senses/bluebubbles/webhook-registration");
+const freshness_1 = require("./freshness");
+const ouro_path_installer_1 = require("../versioning/ouro-path-installer");
+const runtime_credentials_1 = require("../runtime-credentials");
+const machine_identity_1 = require("../machine-identity");
+const habit_parser_1 = require("../habits/habit-parser");
+const cadence_1 = require("./cadence");
+const nerves_1 = require("../../nerves");
+const config_1 = require("../../rsvp/config");
+const cutover_1 = require("../../rsvp/cutover");
+const diagnostics_1 = require("../../rsvp/diagnostics");
+const blob_store_1 = require("../../mailroom/blob-store");
+const hosted_cache_sync_1 = require("../../mailroom/hosted-cache-sync");
+const search_cache_1 = require("../../mailroom/search-cache");
+const prunable_bundle_1 = require("./prunable-bundle");
+const DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_BLUEBUBBLES_PORT = 18_790;
+const DEFAULT_BLUEBUBBLES_WEBHOOK_PATH = "/bluebubbles-webhook";
+// ── Category checkers ──
+function checkCliPath(deps) {
+    const resolution = (0, ouro_path_installer_1.diagnoseOuroPath)({
+        homeDir: deps.homedir,
+        envPath: deps.envPath ?? "",
+        existsSync: deps.existsSync,
+        readFileSync: (p) => deps.readFileSync(p),
+    });
+    const status = resolution.status === "ok"
+        ? "pass"
+        : resolution.status === "shadowed"
+            ? "fail"
+            : "warn";
+    return {
+        name: "CLI",
+        checks: [{
+                label: "ouro PATH resolution",
+                status,
+                detail: resolution.remediation
+                    ? `${resolution.detail}; fix: ${resolution.remediation}`
+                    : resolution.detail,
+            }],
+    };
+}
+async function checkDaemon(deps) {
+    const checks = [];
+    const socketExists = deps.existsSync(deps.socketPath);
+    checks.push({
+        label: "daemon socket exists",
+        status: socketExists ? "pass" : "fail",
+        detail: socketExists ? deps.socketPath : `not found at ${deps.socketPath}`,
+    });
+    if (socketExists) {
+        const alive = await deps.checkSocketAlive(deps.socketPath);
+        checks.push({
+            label: "daemon is responsive",
+            status: alive ? "pass" : "fail",
+            detail: alive ? "socket responded" : "socket exists but daemon unresponsive",
+        });
+    }
+    else {
+        checks.push({
+            label: "daemon is responsive",
+            status: "fail",
+            detail: "skipped — socket missing",
+        });
+    }
+    return { name: "Daemon", checks };
+}
+/** Discover doctor candidates: *.ouro directories with a present agent.json. */
+function discoverAgents(deps) {
+    if (!deps.existsSync(deps.bundlesRoot))
+        return [];
+    return deps.readdirSync(deps.bundlesRoot).filter((name) => name.endsWith(".ouro") && deps.existsSync(`${deps.bundlesRoot}/${name}/agent.json`));
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function textField(record, key) {
+    const value = record?.[key];
+    return typeof value === "string" ? value.trim() : "";
+}
+function stringArrayField(record, key) {
+    const value = record?.[key];
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function numberField(record, key, fallback) {
+    const value = record?.[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function hasStringRecordValue(value) {
+    const record = asRecord(value);
+    return !!record && Object.values(record).some((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
+function mailAutonomyDetail(mailroom) {
+    const policy = asRecord(mailroom?.autonomousSendPolicy);
+    const autonomy = policy?.enabled === true ? "autonomy enabled" : "autonomy disabled";
+    const killSwitch = policy?.killSwitch === true ? "kill switch on" : "kill switch off";
+    return `${autonomy}; ${killSwitch}`;
+}
+const SENSITIVE_CONFIG_KEYS = ["apiKey", "token", "secret", "password"];
+function credentialKeyLeaks(raw) {
+    return SENSITIVE_CONFIG_KEYS.filter((key) => raw.includes(`"${key}"`));
+}
+// ── Pipeline liveness (dead-pipe detection) ──
+//
+// Configuration checks answer "is this wired up?". These answer "is anything
+// actually flowing?". Both are needed: the 77-day mail outage and the
+// multi-day BlueBubbles inbound outage were both invisible to configuration
+// and connection checks that stayed green throughout.
+/**
+ * Mail ingest thresholds.
+ *
+ * A delegated mailbox forwards a human's real inbox, so a full calendar day
+ * with zero inbound mail is already anomalous — that is the warn line. Fail
+ * waits until 72h so a genuinely quiet weekend on a low-traffic mailbox does
+ * not hard-fail doctor; the 2026-05-10 outage would have failed on day four
+ * instead of going unnoticed for seventy-seven. Override per agent with
+ * `senses.mail.freshness.{warnAfterHours,failAfterHours}` in `agent.json`.
+ */
+exports.DEFAULT_MAIL_INGEST_THRESHOLDS = {
+    warnAfterMs: 24 * freshness_1.FRESHNESS_HOUR_MS,
+    failAfterMs: 72 * freshness_1.FRESHNESS_HOUR_MS,
+};
+/**
+ * Inbound sense-delivery thresholds.
+ *
+ * Human-driven chat surfaces are bursty — nobody texts an agent every day —
+ * so the warn line sits at 72h and failure waits a full week. Seven days
+ * without a single inbound message on an attached chat sense is not plausible
+ * quiet; it is a dead pipe. Override per agent with
+ * `senses.<sense>.freshness.{warnAfterHours,failAfterHours}` in `agent.json`.
+ */
+exports.DEFAULT_SENSE_DELIVERY_THRESHOLDS = {
+    warnAfterMs: 72 * freshness_1.FRESHNESS_HOUR_MS,
+    failAfterMs: 7 * freshness_1.FRESHNESS_DAY_MS,
+};
+/** Hard bound on how many per-conversation inbound logs a sense probe stats. */
+const SENSE_DELIVERY_MAX_LOG_SCAN = 500;
+function pipelineLivenessCheck(input) {
+    const result = (0, freshness_1.evaluateFreshness)({
+        activity: input.activity,
+        unit: input.unit,
+        observation: input.probe.observation,
+        provenance: input.probe.provenance,
+        nowMs: input.nowMs,
+        thresholds: input.thresholds,
+        remediation: input.remediation,
+        configuredSinceMs: input.configuredSinceMs,
+        context: input.context,
+    });
+    return { id: input.id, label: input.label, status: result.status, detail: result.detail };
+}
+/** Best-effort mtime used as a "this pipe has been wired up since" floor. */
+function pathMtimeMs(deps, filePath) {
+    if (!deps.existsSync(filePath))
+        return null;
+    try {
+        return deps.statSync(filePath).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read `senses.<sense>.freshness` from `agent.json`, if present. */
+function senseFreshnessOverride(deps, agentDir, sense) {
+    const configPath = `${deps.bundlesRoot}/${agentDir}/agent.json`;
+    if (!deps.existsSync(configPath))
+        return null;
+    try {
+        const config = JSON.parse(deps.readFileSync(configPath));
+        return asRecord(asRecord(config.senses)?.[sense])?.freshness ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Inbound-delivery liveness for a sense that records what it received.
+ *
+ * This asserts on the *inbound* log, deliberately not on the upstream health
+ * probe: BlueBubbles reported `upstreamStatus: ok` for days while inbound
+ * delivery was dead because the server was POSTing to a stale webhook port.
+ * A sense opts in by calling this with its inbound log directory.
+ */
+function senseInboundDeliveryCheck(input) {
+    const result = senseInboundDeliveryResult(input);
+    return { id: `senses.${input.sense}.inbound_liveness`, label: `${input.agentDir} ${input.sense} inbound delivery`, status: result.status, detail: result.detail };
+}
+function senseInboundDeliveryResult(input) {
+    const suffix = input.logSuffix ?? ".ndjson";
+    const probe = (0, freshness_1.observeAppendPerEventStore)(input.inboundDir, input.deps, { suffix, maxEntries: SENSE_DELIVERY_MAX_LOG_SCAN });
+    return (0, freshness_1.evaluateFreshness)({
+        activity: `${input.sense} inbound delivery`,
+        unit: "inbound message",
+        observation: probe.observation,
+        provenance: probe.provenance,
+        thresholds: (0, freshness_1.resolveFreshnessThresholds)(exports.DEFAULT_SENSE_DELIVERY_THRESHOLDS, senseFreshnessOverride(input.deps, input.agentDir, input.sense)),
+        remediation: input.remediation,
+        configuredSinceMs: input.configuredSincePath ? pathMtimeMs(input.deps, input.configuredSincePath) : null,
+        context: input.context,
+        nowMs: input.nowMs,
+    });
+}
+const DEFINITIVE_BLUEBUBBLES_FAILURES = new Set([
+    "auth-failure",
+    "rate-limit",
+    "server-error",
+    "usage-limit",
+]);
+const DEFINITIVE_BLUEBUBBLES_WEBHOOK_STATES = new Set([
+    "missing",
+    "drifted",
+    "auth-failed",
+    "malformed",
+    "listener-not-ready",
+]);
+function blueBubblesUpstreamEvidence(probe) {
+    if (probe.ok)
+        return "healthy";
+    if (DEFINITIVE_BLUEBUBBLES_FAILURES.has(probe.classification)) {
+        return "definitive-fault";
+    }
+    return "unavailable";
+}
+function blueBubblesInboundDeliveryCheck(input, evidence) {
+    const result = senseInboundDeliveryResult(input);
+    const base = {
+        id: "senses.bluebubbles.inbound_liveness",
+        label: `${input.agentDir} bluebubbles inbound delivery`,
+    };
+    if (result.state !== "stale" && result.state !== "never") {
+        return { ...base, status: result.status, detail: result.detail };
+    }
+    const webhookDefinitive = DEFINITIVE_BLUEBUBBLES_WEBHOOK_STATES.has(evidence.webhook);
+    if (evidence.upstream === "definitive-fault" || webhookDefinitive) {
+        const corroboration = evidence.webhook === "missing"
+            ? "missing owned webhook corroborates the silence"
+            : webhookDefinitive
+                ? `${evidence.webhook} owned-webhook evidence corroborates the silence`
+                : "a definitive upstream fault corroborates the silence";
+        return { ...base, status: "fail", detail: `${corroboration}; ${result.detail}` };
+    }
+    const orientation = evidence.upstream === "healthy" && evidence.webhook === "exact"
+        ? "no recent inbound was observed; upstream and exact owned webhook are healthy"
+        : evidence.upstream === "not-run"
+            ? "no recent inbound was observed; infrastructure probes were not run, so delivery is unverified"
+            : "no recent inbound was observed; infrastructure probes were unavailable, so delivery is unverified";
+    const observed = result.detail.replace(/; fix: .*$/u, "");
+    return {
+        ...base,
+        status: "warn",
+        detail: `${orientation}; quiet and delivery failure are indistinguishable without a new message; doctor did not send a test message; ${observed}`,
+    };
+}
+function checkAgents(deps) {
+    const checks = [];
+    if (!deps.existsSync(deps.bundlesRoot)) {
+        checks.push({ label: "bundles directory", status: "fail", detail: `${deps.bundlesRoot} not found` });
+        return { name: "Agents", checks };
+    }
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "agent bundles", status: "warn", detail: "no agent bundles found" });
+        return { name: "Agents", checks };
+    }
+    for (const agentDir of agents) {
+        const agentPath = `${deps.bundlesRoot}/${agentDir}`;
+        const configPath = `${agentPath}/agent.json`;
+        let config;
+        try {
+            config = JSON.parse(deps.readFileSync(configPath));
+        }
+        catch {
+            checks.push({ label: `${agentDir}/agent.json`, status: "fail", detail: "unparseable JSON" });
+            continue;
+        }
+        const missing = [];
+        if (!config.version)
+            missing.push("version");
+        if (!config.humanFacing || typeof config.humanFacing !== "object") {
+            missing.push("humanFacing");
+        }
+        else {
+            const hf = config.humanFacing;
+            if (!hf.provider)
+                missing.push("humanFacing.provider");
+            if (!hf.model)
+                missing.push("humanFacing.model");
+        }
+        if (!config.agentFacing || typeof config.agentFacing !== "object") {
+            missing.push("agentFacing");
+        }
+        else {
+            const af = config.agentFacing;
+            if (!af.provider)
+                missing.push("agentFacing.provider");
+            if (!af.model)
+                missing.push("agentFacing.model");
+        }
+        if (missing.length > 0) {
+            checks.push({ label: `${agentDir}/agent.json`, status: "warn", detail: `missing fields: ${missing.join(", ")}` });
+        }
+        else {
+            checks.push({ label: `${agentDir}/agent.json`, status: "pass", detail: "valid" });
+        }
+    }
+    return { name: "Agents", checks };
+}
+/**
+ * Mail key coverage, as recorded by the mail sense.
+ *
+ * Doctor reads the sense's own per-cycle verdict rather than re-deriving it:
+ * a health check must need neither network access nor Azure credentials, and
+ * the registry that declares the key ids lives in a Blob container in hosted
+ * mode. The mail sense already fetches it every cycle, so its record is both
+ * the cheapest and the only honest source here.
+ *
+ * Absent is a `fail` because mail encrypted to a key with no private half is
+ * permanently unreadable — unlike an API key, ciphertext cannot be reissued.
+ * Anything the sense could not verify is a `warn`, never a `fail`: a locked or
+ * unavailable vault must not read as key loss.
+ */
+function mailKeyCoverageCheck(deps, agentDir) {
+    const id = "mail.key_coverage";
+    const label = `${agentDir} mail key coverage`;
+    const statePath = `${deps.bundlesRoot}/${agentDir}/state/senses/mail/runtime.json`;
+    const unverified = (detail) => ({ id, label, status: "warn", detail });
+    if (!deps.existsSync(statePath)) {
+        return unverified(`no mail sense runtime state at ${statePath} — coverage is unverified until the mail sense runs a scan`);
+    }
+    let coverage;
+    try {
+        coverage = asRecord(JSON.parse(deps.readFileSync(statePath)).keyCoverage) ?? {};
+    }
+    catch {
+        return unverified(`mail sense runtime state at ${statePath} could not be read`);
+    }
+    const declaredKeyIds = stringArrayField(coverage, "declaredKeyIds");
+    const absentKeyIds = stringArrayField(coverage, "absentKeyIds");
+    const checkedAt = textField(coverage, "checkedAt");
+    const provenance = checkedAt ? ` (recorded ${checkedAt})` : "";
+    if (coverage.status === "covered") {
+        return {
+            id,
+            label,
+            status: "pass",
+            detail: declaredKeyIds.length === 1
+                ? `the 1 registry-declared mail key has a private half in the vault${provenance}`
+                : `all ${declaredKeyIds.length} registry-declared mail keys have a private half in the vault${provenance}`,
+        };
+    }
+    if (coverage.status === "absent") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: `the mailroom registry declares mail key${absentKeyIds.length === 1 ? "" : "s"} with no private half in this agent's vault — mail encrypted to ${absentKeyIds.join(", ")} cannot be decrypted and cannot be recovered${provenance}; run \`ouro connect mail --agent ${agentDir.replace(/\.ouro$/, "")}\` and, if Mail Control no longer holds the one-time key, rerun it with --rotate-missing-mail-keys to mint a replacement for future mail`,
+        };
+    }
+    return unverified(`mail sense could not verify key coverage${provenance}: ${textField(coverage, "reason") || "no reason recorded"}`);
+}
+async function checkSenses(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const configPath = `${deps.bundlesRoot}/${agentDir}/agent.json`;
+        if (!deps.existsSync(configPath))
+            continue;
+        let config;
+        try {
+            config = JSON.parse(deps.readFileSync(configPath));
+        }
+        catch {
+            checks.push({ label: `${agentDir} senses`, status: "fail", detail: "agent.json unparseable" });
+            continue;
+        }
+        if (!config.senses || typeof config.senses !== "object") {
+            checks.push({ label: `${agentDir} senses`, status: "warn", detail: "no senses config block" });
+            continue;
+        }
+        const senses = config.senses;
+        const senseNames = ["cli", "teams", "bluebubbles", "mail"];
+        for (const sense of senseNames) {
+            if (!(sense in senses))
+                continue;
+            const entry = senses[sense];
+            if (!entry || typeof entry !== "object") {
+                checks.push({ label: `${agentDir} ${sense}`, status: "fail", detail: "malformed sense entry" });
+                continue;
+            }
+            const senseObj = entry;
+            if (typeof senseObj.enabled !== "boolean") {
+                checks.push({ label: `${agentDir} ${sense}`, status: "warn", detail: "missing enabled boolean" });
+            }
+            else {
+                checks.push({
+                    label: `${agentDir} ${sense}`,
+                    status: "pass",
+                    detail: senseObj.enabled ? "enabled" : "disabled",
+                });
+            }
+            if (sense === "bluebubbles" && senseObj.enabled === true) {
+                const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: deps.homedir }).machineId;
+                const runtimeConfig = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agentName, machineId, { preserveCachedOnFailure: true });
+                if (!runtimeConfig.ok) {
+                    if (runtimeConfig.reason === "missing") {
+                        checks.push({
+                            label: `${agentDir} bluebubbles config`,
+                            status: "pass",
+                            detail: "not attached on this machine",
+                        });
+                        continue;
+                    }
+                    checks.push({
+                        label: `${agentDir} bluebubbles config`,
+                        status: "fail",
+                        detail: `machine runtime config unavailable: ${runtimeConfig.error}`,
+                    });
+                    continue;
+                }
+                const bluebubbles = asRecord(runtimeConfig.config.bluebubbles);
+                const bluebubblesChannel = asRecord(runtimeConfig.config.bluebubblesChannel);
+                const serverUrl = textField(bluebubbles, "serverUrl");
+                const password = textField(bluebubbles, "password");
+                const missing = [];
+                if (!serverUrl)
+                    missing.push("bluebubbles.serverUrl");
+                if (!password)
+                    missing.push("bluebubbles.password");
+                if (missing.length > 0) {
+                    checks.push({
+                        label: `${agentDir} bluebubbles config`,
+                        status: "fail",
+                        detail: `missing ${missing.join("/")}`,
+                    });
+                    continue;
+                }
+                checks.push({
+                    label: `${agentDir} bluebubbles config`,
+                    status: "pass",
+                    detail: serverUrl,
+                });
+                let upstreamContext = "upstream probe not run in this pass";
+                let infrastructure = { upstream: "not-run", webhook: null };
+                if (deps.fetchImpl) {
+                    const requestTimeoutMs = numberField(bluebubblesChannel, "requestTimeoutMs", DEFAULT_BLUEBUBBLES_REQUEST_TIMEOUT_MS);
+                    const probe = await (0, bluebubbles_health_diagnostics_1.probeBlueBubblesHealth)({
+                        serverUrl,
+                        password,
+                        requestTimeoutMs,
+                        fetchImpl: deps.fetchImpl,
+                    });
+                    checks.push({
+                        label: `${agentDir} bluebubbles upstream`,
+                        status: probe.ok ? "pass" : "fail",
+                        detail: probe.detail,
+                    });
+                    upstreamContext = probe.ok
+                        ? "upstream probe reachable — which does not prove inbound delivery"
+                        : "upstream probe failing";
+                    infrastructure = { ...infrastructure, upstream: blueBubblesUpstreamEvidence(probe) };
+                    const webhook = await (0, webhook_registration_1.inspectBlueBubblesWebhookRegistration)({
+                        serverUrl,
+                        password,
+                        callbackPort: numberField(bluebubblesChannel, "port", DEFAULT_BLUEBUBBLES_PORT),
+                        callbackPath: textField(bluebubblesChannel, "webhookPath") || DEFAULT_BLUEBUBBLES_WEBHOOK_PATH,
+                        agentName,
+                        machineId,
+                        requestTimeoutMs,
+                        listenerReady: true,
+                    }, { fetchImpl: deps.fetchImpl });
+                    checks.push({
+                        id: "senses.bluebubbles.webhook",
+                        label: `${agentDir} bluebubbles webhook`,
+                        status: webhook.ok ? "pass" : "fail",
+                        detail: webhook.detail,
+                    });
+                    infrastructure = { ...infrastructure, webhook: webhook.state };
+                }
+                const bluebubblesStateRoot = `${deps.bundlesRoot}/${agentDir}/state/senses/bluebubbles`;
+                checks.push(blueBubblesInboundDeliveryCheck({
+                    deps,
+                    agentDir,
+                    sense: "bluebubbles",
+                    inboundDir: `${bluebubblesStateRoot}/inbound`,
+                    configuredSincePath: bluebubblesStateRoot,
+                    context: upstreamContext,
+                    remediation: "no iMessage is reaching this agent — confirm the BlueBubbles server's configured webhook URL/port matches the port this daemon is listening on (a stale webhook port is the known cause), then re-attach with `ouro connect bluebubbles --agent <agent>`",
+                    nowMs: Date.now(),
+                }, infrastructure));
+            }
+            if (sense === "mail" && senseObj.enabled === true) {
+                const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agentName, { preserveCachedOnFailure: true });
+                if (!runtimeConfig.ok) {
+                    checks.push({
+                        label: `${agentDir} mail config`,
+                        status: "fail",
+                        detail: `runtime config unavailable: ${runtimeConfig.error}`,
+                    });
+                    continue;
+                }
+                const mailroom = asRecord(runtimeConfig.config.mailroom);
+                const workSubstrate = asRecord(runtimeConfig.config.workSubstrate);
+                const mailboxAddress = textField(mailroom, "mailboxAddress");
+                const hosted = textField(workSubstrate, "mode") === "hosted";
+                const azureAccountUrl = textField(mailroom, "azureAccountUrl");
+                const azureContainer = textField(mailroom, "azureContainer") || "mailroom";
+                const missing = [];
+                if (!mailboxAddress)
+                    missing.push("mailroom.mailboxAddress");
+                if (!hasStringRecordValue(mailroom?.privateKeys))
+                    missing.push("mailroom.privateKeys");
+                if (hosted && !azureAccountUrl)
+                    missing.push("mailroom.azureAccountUrl for hosted Blob reader");
+                if (missing.length > 0) {
+                    checks.push({
+                        label: `${agentDir} mail config`,
+                        status: "fail",
+                        detail: `missing ${missing.join("/")}`,
+                    });
+                    continue;
+                }
+                checks.push({
+                    label: `${agentDir} mail config`,
+                    status: "pass",
+                    detail: [
+                        mailboxAddress,
+                        hosted ? `hosted azure-blob ${azureAccountUrl}/${azureContainer}` : "local file Mailroom",
+                        mailAutonomyDetail(mailroom),
+                    ].join("; "),
+                });
+                // Config being well-formed says nothing about whether the vault can
+                // still decrypt what the registry points mail at — the 2026-07-24 gap
+                // sat behind a passing mail config check for 23 hours.
+                checks.push(mailKeyCoverageCheck(deps, agentDir));
+            }
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "senses", status: "warn", detail: "no agents with senses config found" });
+    }
+    return { name: "Senses", checks };
+}
+function checkHabits(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const habitsDir = `${deps.bundlesRoot}/${agentDir}/habits`;
+        if (!deps.existsSync(habitsDir)) {
+            checks.push({ label: `${agentDir} habits dir`, status: "warn", detail: "no habits directory" });
+            continue;
+        }
+        checks.push({ label: `${agentDir} habits dir`, status: "pass", detail: habitsDir });
+        const activeScheduledHabits = [];
+        const habitLifecycleRows = [];
+        let unreadableHabits = 0;
+        for (const file of deps.readdirSync(habitsDir).filter((entry) => entry.endsWith(".md") && entry !== "README.md").sort()) {
+            const filePath = `${habitsDir}/${file}`;
+            let habit;
+            try {
+                habit = (0, habit_parser_1.parseHabitFile)(deps.readFileSync(filePath), filePath);
+            }
+            catch (error) {
+                unreadableHabits += 1;
+                habit = (0, habit_parser_1.createDegradedHabitFile)(filePath, "read_error", "", error instanceof Error ? error.message : String(error));
+            }
+            habitLifecycleRows.push(habit);
+            if (habit.status === "active" && habit.cadence && (0, cadence_1.parseCadenceToCron)(habit.cadence) !== null) {
+                activeScheduledHabits.push(habit.name);
+            }
+        }
+        if (habitLifecycleRows.length > 0) {
+            const hasDegradedHabit = habitLifecycleRows.some((habit) => habit.status === "degraded");
+            checks.push({
+                id: "habits.lifecycle",
+                label: `${agentDir} habit lifecycle`,
+                status: hasDegradedHabit ? "fail" : "pass",
+                detail: habitLifecycleRows.map((habit) => habit.status === "degraded"
+                    ? `${habit.name}=degraded(${habit.degradedReason})`
+                    : `${habit.name}=${habit.status}`).join(", "),
+            });
+        }
+        if (unreadableHabits > 0) {
+            checks.push({
+                label: `${agentDir} habit files`,
+                status: "warn",
+                detail: `${unreadableHabits} unreadable habit file(s)`,
+            });
+        }
+        if (activeScheduledHabits.length === 0) {
+            checks.push({
+                label: `${agentDir} launchd plists`,
+                status: "pass",
+                detail: "no active scheduled habits require launchd",
+            });
+            continue;
+        }
+        // Check for launchd plists on macOS
+        const platform = deps.platform;
+        if (platform !== "darwin") {
+            checks.push({
+                label: `${agentDir} launchd plists`,
+                status: "pass",
+                detail: `launchd not applicable on ${platform}; scheduled habits use the platform cron manager`,
+            });
+            continue;
+        }
+        const launchAgentsDir = `${deps.homedir}/Library/LaunchAgents`;
+        if (deps.existsSync(launchAgentsDir)) {
+            const plists = new Set(deps.readdirSync(launchAgentsDir));
+            const missing = activeScheduledHabits
+                .map((habitName) => `bot.ouro.${agentName}.${habitName}.plist`)
+                .filter((plistName) => !plists.has(plistName));
+            if (missing.length === 0) {
+                checks.push({
+                    label: `${agentDir} launchd plists`,
+                    status: "pass",
+                    detail: `${activeScheduledHabits.length} active scheduled habit(s) registered`,
+                });
+            }
+            else {
+                checks.push({
+                    label: `${agentDir} launchd plists`,
+                    status: "fail",
+                    detail: `missing ${missing.join(", ")}`,
+                });
+            }
+        }
+        else {
+            checks.push({
+                label: `${agentDir} launchd plists`,
+                status: "fail",
+                detail: `${launchAgentsDir} not found for ${activeScheduledHabits.length} active scheduled habit(s)`,
+            });
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "habits", status: "warn", detail: "no agents found" });
+    }
+    return { name: "Habits", checks };
+}
+function hasRsvpHabitSignal(deps, agentPath) {
+    const habitsDir = `${agentPath}/habits`;
+    if (!deps.existsSync(habitsDir))
+        return false;
+    try {
+        return deps.readdirSync(habitsDir).some((name) => name.toLowerCase().includes("rsvp") && name.endsWith(".md"));
+    }
+    catch {
+        return false;
+    }
+}
+function rsvpDoctorLabel(agentDir, checkId) {
+    const suffix = {
+        "rsvp.native_config": "RSVP native config",
+        "rsvp.aisleplanner_source": "RSVP AislePlanner source",
+        "rsvp.aisleplanner_credentials": "RSVP AislePlanner credentials",
+        "rsvp.bluebubbles_route": "RSVP BlueBubbles route",
+        "rsvp.bluebubbles_attachment": "RSVP BlueBubbles attachment",
+    };
+    return `${agentDir} ${suffix[checkId]}`;
+}
+function rsvpDoctorId(checkId) {
+    const ids = {
+        "rsvp.native_config": "rsvp.native_config",
+        "rsvp.aisleplanner_source": "rsvp.aisleplanner.source",
+        "rsvp.aisleplanner_credentials": "rsvp.aisleplanner.credentials",
+        "rsvp.bluebubbles_route": "rsvp.bluebubbles.route",
+        "rsvp.bluebubbles_attachment": "rsvp.bluebubbles.attachment",
+    };
+    return ids[checkId];
+}
+function rsvpDoctorDetail(readinessCheck) {
+    return readinessCheck.id === "rsvp.bluebubbles_route" && readinessCheck.status === "pass"
+        ? "configured"
+        : readinessCheck.detail;
+}
+function doctorStatus(status) {
+    return status;
+}
+function discoverRsvpCutoverLegacyRoot(deps, config) {
+    const configured = typeof config?.cutover?.legacyRoot === "string" ? config.cutover.legacyRoot.trim() : "";
+    if (configured)
+        return configured;
+    if (deps.rsvpCutoverLegacyRoot)
+        return deps.rsvpCutoverLegacyRoot;
+    const candidate = `${deps.homedir}/Projects/rsvp-tracker`;
+    return deps.existsSync(`${candidate}/config.json`) ? candidate : null;
+}
+function rsvpCutoverDetail(checks, sendAllowed, denialCount) {
+    return [
+        `sendAllowed=${sendAllowed}`,
+        `launchAgentInactive=${checks.launchAgentInactive}`,
+        `legacyProcessInactive=${checks.legacyProcessInactive}`,
+        `legacyConfigSendInactive=${checks.legacyConfigSendInactive}`,
+        `legacyLiveSendInactive=${checks.legacyLiveSendInactive}`,
+        `nativeBlueBubblesCredentialHealthy=${checks.nativeBlueBubblesCredentialHealthy}`,
+        `denialCount=${denialCount}`,
+    ].join("; ");
+}
+async function checkRsvp(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "RSVP", status: "warn", detail: "no agent bundles found" });
+        return { name: "RSVP", checks };
+    }
+    for (const agentDir of agents) {
+        const agentName = agentDir.replace(/\.ouro$/, "");
+        const agentPath = `${deps.bundlesRoot}/${agentDir}`;
+        const config = (0, config_1.readRsvpConfig)(agentPath);
+        const hasRsvpSignal = config.ok || hasRsvpHabitSignal(deps, agentPath);
+        if (!hasRsvpSignal) {
+            checks.push({ label: `${agentDir} RSVP`, status: "pass", detail: "not configured" });
+            continue;
+        }
+        const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)({ homeDir: deps.homedir }).machineId;
+        const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agentName, { preserveCachedOnFailure: true });
+        const machineRuntimeConfig = await (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agentName, machineId, { preserveCachedOnFailure: true });
+        const readiness = (0, config_1.validateRsvpReadiness)({
+            agent: agentName,
+            agentRoot: agentPath,
+            runtimeConfig,
+            machineRuntimeConfig,
+            config,
+        });
+        for (const readinessCheck of readiness.checks) {
+            checks.push({
+                id: rsvpDoctorId(readinessCheck.id),
+                label: rsvpDoctorLabel(agentDir, readinessCheck.id),
+                status: readinessCheck.status === "pass" ? "pass" : "fail",
+                detail: rsvpDoctorDetail(readinessCheck),
+            });
+        }
+        const attachment = readiness.checks.find((check) => check.id === "rsvp.bluebubbles_attachment");
+        if (attachment) {
+            checks.push({
+                id: "rsvp.bluebubbles.attachment_identity",
+                label: `${agentDir} RSVP BlueBubbles attachment identity`,
+                status: attachment.status === "pass" ? "pass" : "fail",
+                detail: attachment.status === "pass" ? "machine attachment credential present" : attachment.detail,
+            });
+        }
+        const diagnostics = (0, diagnostics_1.collectRsvpDiagnostics)(agentPath, deps);
+        checks.push({
+            id: "rsvp.context_packet_ledger",
+            label: `${agentDir} RSVP context packet ledger`,
+            status: doctorStatus(diagnostics.contextPacketLedger.status),
+            detail: diagnostics.contextPacketLedger.detail,
+        }, {
+            id: "rsvp.habit.schedule",
+            label: `${agentDir} RSVP habit schedule`,
+            status: doctorStatus(diagnostics.habitSchedule.status),
+            detail: diagnostics.habitSchedule.detail,
+        }, {
+            id: "rsvp.latest_fetch",
+            label: `${agentDir} RSVP latest fetch`,
+            status: doctorStatus(diagnostics.latestFetch.status),
+            detail: diagnostics.latestFetch.detail,
+        }, {
+            id: "rsvp.delivery.reconciliation",
+            label: `${agentDir} RSVP delivery reconciliation`,
+            status: doctorStatus(diagnostics.deliveryReconciliation.status),
+            detail: diagnostics.deliveryReconciliation.detail,
+        }, {
+            id: "rsvp.spend_timeline",
+            label: `${agentDir} RSVP spend timeline`,
+            status: doctorStatus(diagnostics.spendTimeline.status),
+            detail: diagnostics.spendTimeline.detail,
+        });
+        const legacyRoot = discoverRsvpCutoverLegacyRoot(deps, config.ok ? config.config : undefined);
+        if (config.ok && legacyRoot) {
+            const cutover = await (0, cutover_1.checkRsvpCutover)({
+                agent: agentName,
+                legacyRoot,
+                ...(deps.rsvpCutoverDeps ? { deps: deps.rsvpCutoverDeps } : {}),
+            });
+            checks.push({
+                id: "rsvp.cutover.live_send_preflight",
+                label: `${agentDir} RSVP legacy live-send preflight`,
+                status: cutover.sendAllowed ? "pass" : "fail",
+                detail: rsvpCutoverDetail(cutover.checks, cutover.sendAllowed, cutover.denialReasons.length),
+            });
+        }
+    }
+    return { name: "RSVP", checks };
+}
+function checkSecurity(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        // Check agent.json for leaked credential keys
+        const configPath = `${deps.bundlesRoot}/${agentDir}/agent.json`;
+        if (deps.existsSync(configPath)) {
+            try {
+                const raw = deps.readFileSync(configPath);
+                const found = credentialKeyLeaks(raw);
+                if (found.length > 0) {
+                    checks.push({ label: `${agentDir} credential leak`, status: "warn", detail: `agent.json contains keys: ${found.join(", ")}` });
+                }
+                else {
+                    checks.push({ label: `${agentDir} credential leak`, status: "pass", detail: "no credential keys in agent.json" });
+                }
+            }
+            catch {
+                checks.push({ label: `${agentDir} credential leak`, status: "fail", detail: "could not read agent.json" });
+            }
+        }
+    }
+    if (checks.length === 0) {
+        checks.push({ label: "security", status: "warn", detail: "no agents found" });
+    }
+    return { name: "Security", checks };
+}
+function checkTrips(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "trip ledger", status: "warn", detail: "no agent bundles found" });
+        return { name: "Trips", checks };
+    }
+    for (const agentDir of agents) {
+        const durableTripsRoot = `${deps.bundlesRoot}/${agentDir}/trips`;
+        const legacyTripsRoot = `${deps.bundlesRoot}/${agentDir}/state/trips`;
+        const hasDurableTrips = deps.existsSync(durableTripsRoot);
+        const hasLegacyTrips = deps.existsSync(legacyTripsRoot);
+        if (!hasDurableTrips) {
+            if (hasLegacyTrips) {
+                checks.push({
+                    label: `${agentDir} trip ledger`,
+                    status: "warn",
+                    detail: "legacy state/trips exists but durable trips/ missing — run any trip tool to copy legacy storage into trips/",
+                });
+            }
+            else {
+                // Trip ledger is optional; absence is fine. Pass with a hint.
+                checks.push({ label: `${agentDir} trip ledger`, status: "pass", detail: "no ledger directory (no trips ensured yet)" });
+            }
+            continue;
+        }
+        const ledgerPath = `${durableTripsRoot}/ledger.json`;
+        if (!deps.existsSync(ledgerPath)) {
+            checks.push({ label: `${agentDir} trip ledger`, status: "warn", detail: "trips/ exists but ledger.json missing — run trip_ensure_ledger" });
+            continue;
+        }
+        let raw;
+        /* v8 ignore start -- defensive: readFileSync failure after existsSync passes is a race-condition fallback @preserve */
+        try {
+            raw = deps.readFileSync(ledgerPath);
+        }
+        catch {
+            checks.push({ label: `${agentDir} trip ledger`, status: "fail", detail: "ledger.json could not be read" });
+            continue;
+        }
+        /* v8 ignore stop */
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            checks.push({ label: `${agentDir} trip ledger`, status: "fail", detail: "ledger.json is not valid JSON" });
+            continue;
+        }
+        const nestedLedger = parsed.ledger && typeof parsed.ledger === "object"
+            ? parsed.ledger
+            : null;
+        const ledgerId = typeof parsed.ledgerId === "string"
+            ? parsed.ledgerId
+            : typeof nestedLedger?.ledgerId === "string"
+                ? nestedLedger.ledgerId
+                : null;
+        const hasPrivateKey = typeof parsed.privateKeyPem === "string" && parsed.privateKeyPem.includes("BEGIN");
+        if (!ledgerId) {
+            checks.push({ label: `${agentDir} trip ledger`, status: "warn", detail: "ledger.json missing ledgerId field" });
+            continue;
+        }
+        if (!hasPrivateKey) {
+            checks.push({ label: `${agentDir} trip ledger`, status: "fail", detail: `${ledgerId}: privateKeyPem missing — encrypted trip records cannot be read` });
+            continue;
+        }
+        let recordCount = 0;
+        const recordsDir = `${durableTripsRoot}/records`;
+        /* v8 ignore start -- defensive: records dir presence and readdir error are filesystem-state branches not all exercised by tests; pluralization branch likewise depends on record count fixtures @preserve */
+        if (deps.existsSync(recordsDir)) {
+            try {
+                recordCount = deps.readdirSync(recordsDir).filter((name) => name.endsWith(".json")).length;
+            }
+            catch {
+                // ignore — the warn detail will still report 0 records
+            }
+        }
+        const legacyDiverges = hasLegacyTrips && tripStoresDiffer(deps, durableTripsRoot, legacyTripsRoot);
+        checks.push({
+            label: `${agentDir} trip ledger`,
+            status: legacyDiverges ? "warn" : "pass",
+            detail: `${ledgerId} (${recordCount} record${recordCount === 1 ? "" : "s"})${legacyDiverges ? "; legacy state/trips differs from durable trips/ — durable trips/ is authoritative" : ""}`,
+        });
+        /* v8 ignore stop */
+    }
+    return { name: "Trips", checks };
+}
+function listTripStoreFiles(deps, root) {
+    const files = [];
+    if (deps.existsSync(`${root}/ledger.json`)) {
+        files.push("ledger.json");
+    }
+    const recordsDir = `${root}/records`;
+    if (deps.existsSync(recordsDir)) {
+        for (const name of deps.readdirSync(recordsDir)) {
+            if (name.endsWith(".json")) {
+                files.push(`records/${name}`);
+            }
+        }
+    }
+    return files.sort();
+}
+function tripStoresDiffer(deps, durableRoot, legacyRoot) {
+    const relativePaths = new Set([
+        ...listTripStoreFiles(deps, durableRoot),
+        ...listTripStoreFiles(deps, legacyRoot),
+    ]);
+    for (const relativePath of relativePaths) {
+        const durablePath = `${durableRoot}/${relativePath}`;
+        const legacyPath = `${legacyRoot}/${relativePath}`;
+        const durableExists = deps.existsSync(durablePath);
+        const legacyExists = deps.existsSync(legacyPath);
+        if (durableExists !== legacyExists) {
+            return true;
+        }
+        if (durableExists && deps.readFileSync(durablePath) !== deps.readFileSync(legacyPath)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function checkMailroom(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "mailroom", status: "warn", detail: "no agent bundles found" });
+        return { name: "Mailroom", checks };
+    }
+    for (const agentDir of agents) {
+        const mailroomRoot = `${deps.bundlesRoot}/${agentDir}/state/mailroom`;
+        if (!deps.existsSync(mailroomRoot)) {
+            checks.push({ label: `${agentDir} mailroom`, status: "pass", detail: "no mailroom directory (mail not connected)" });
+            continue;
+        }
+        const registryPath = `${mailroomRoot}/registry.json`;
+        if (!deps.existsSync(registryPath)) {
+            checks.push({ label: `${agentDir} mailroom`, status: "warn", detail: "state/mailroom/ exists but registry.json missing" });
+            continue;
+        }
+        let raw;
+        /* v8 ignore start -- defensive: readFileSync failure after existsSync passes is a race-condition fallback @preserve */
+        try {
+            raw = deps.readFileSync(registryPath);
+        }
+        catch {
+            checks.push({ label: `${agentDir} mailroom`, status: "fail", detail: "registry.json could not be read" });
+            continue;
+        }
+        /* v8 ignore stop */
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            checks.push({ label: `${agentDir} mailroom`, status: "fail", detail: "registry.json is not valid JSON" });
+            continue;
+        }
+        /* v8 ignore start -- defensive: registry shape is validated by mailroom code; non-array fallbacks are belt-and-suspenders @preserve */
+        const mailboxes = Array.isArray(parsed.mailboxes) ? parsed.mailboxes : null;
+        const sourceGrants = Array.isArray(parsed.sourceGrants) ? parsed.sourceGrants : [];
+        /* v8 ignore stop */
+        if (!mailboxes || mailboxes.length === 0) {
+            checks.push({ label: `${agentDir} mailroom`, status: "warn", detail: "registry.json has no mailboxes — provision via `ouro connect mail`" });
+            continue;
+        }
+        const messagesDir = `${mailroomRoot}/messages`;
+        const listing = listJsonDocuments(deps, messagesDir);
+        /* v8 ignore start -- defensive: pluralization branches depend on filesystem-state fixtures not exhaustively covered @preserve */
+        checks.push({
+            label: `${agentDir} mailroom`,
+            status: "pass",
+            detail: `${mailboxes.length} mailbox${mailboxes.length === 1 ? "" : "es"}, ${sourceGrants.length} source grant${sourceGrants.length === 1 ? "" : "s"}, ${listing.count} message${listing.count === 1 ? "" : "s"} stored (cumulative — not a liveness signal)`,
+        });
+        /* v8 ignore stop */
+        const store = await resolveMailStore(agentDir);
+        if (store.hosted === null) {
+            checks.push({
+                id: "mail.ingest_liveness",
+                label: `${agentDir} mail ingest liveness`,
+                status: store.status,
+                detail: `mail store mode is unverified because fresh runtime credentials are unavailable: ${store.detail}; local-file and hosted liveness were not inferred from stale cached configuration`,
+            });
+            checks.push({
+                id: "mail.cache_authority",
+                label: `${agentDir} hosted mail cache authority`,
+                status: store.status,
+                detail: `fresh runtime credentials are unavailable: ${store.detail}; hosted authority was not probed from stale cached coordinates`,
+            });
+            continue;
+        }
+        const authorityCheck = store.hosted && deps.observeHostedMailAuthority
+            ? await hostedMailCacheAuthorityCheck(deps, agentDir, store)
+            : undefined;
+        checks.push(mailIngestLivenessCheck(deps, agentDir, mailroomRoot, messagesDir, listing, store, authorityCheck));
+        if (authorityCheck) {
+            checks.push(authorityCheck);
+        }
+    }
+    return { name: "Mailroom", checks };
+}
+function listJsonDocuments(deps, dir) {
+    if (!deps.existsSync(dir))
+        return { count: 0, readable: true };
+    try {
+        return { count: deps.readdirSync(dir).filter((name) => name.endsWith(".json")).length, readable: true };
+    }
+    catch {
+        return { count: 0, readable: false };
+    }
+}
+async function resolveMailStore(agentDir) {
+    const agentName = agentDir.replace(/\.ouro$/, "");
+    const runtimeConfig = await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agentName, { preserveCachedOnFailure: false });
+    if (!runtimeConfig.ok) {
+        return {
+            hosted: null,
+            status: runtimeConfig.reason === "unavailable" ? "warn" : "fail",
+            detail: `${runtimeConfig.error} (${runtimeConfig.itemPath})`,
+        };
+    }
+    const mailroom = asRecord(runtimeConfig.config.mailroom);
+    const azureAccountUrl = textField(mailroom, "azureAccountUrl");
+    if (!azureAccountUrl)
+        return { hosted: false };
+    const azureContainer = textField(mailroom, "azureContainer") || "mailroom";
+    const privateKeys = asRecord(mailroom?.privateKeys);
+    return {
+        hosted: true,
+        label: `hosted azure-blob ${azureAccountUrl}/${azureContainer}`,
+        privateKeyIds: new Set(Object.entries(privateKeys ?? {})
+            .filter(([, value]) => typeof value === "string" && value.trim().length > 0)
+            .map(([keyId]) => keyId)),
+    };
+}
+function parseCacheDocument(deps, filePath) {
+    try {
+        const parsed = JSON.parse(deps.readFileSync(filePath));
+        return asRecord(parsed);
+    }
+    catch {
+        return null;
+    }
+}
+async function hostedMailCacheAuthorityCheck(deps, agentDir, store) {
+    const agentName = agentDir.replace(/\.ouro$/, "");
+    const base = { id: "mail.cache_authority", label: `${agentDir} hosted mail cache authority` };
+    let probe;
+    try {
+        probe = await deps.observeHostedMailAuthority(agentName);
+    }
+    catch (error) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is temporarily unverified: ${error instanceof Error ? error.message : String(error)}; no local cache mutation was attempted`,
+        };
+    }
+    if (!probe.ok) {
+        return {
+            ...base,
+            status: probe.definitive ? "fail" : "warn",
+            detail: `hosted authority unavailable: ${probe.detail}; no local cache mutation was attempted`,
+        };
+    }
+    const { observation } = probe;
+    if (observation.parseFailureCount > 0 || observation.duplicateIds.length > 0) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is ambiguous (${observation.parseFailureCount} malformed index name(s), ${observation.duplicateIds.length} duplicate id(s)); no local cache mutation was attempted`,
+        };
+    }
+    if (observation.records.length === 0) {
+        return {
+            ...base,
+            status: "warn",
+            detail: "hosted authority is empty and remains unverified because an empty index namespace cannot prove the mailbox is empty; no local cache mutation was attempted",
+        };
+    }
+    const cacheDir = `${deps.bundlesRoot}/${agentDir}/state/mail-search`;
+    let fileNames = [];
+    if (deps.existsSync(cacheDir)) {
+        try {
+            fileNames = deps.readdirSync(cacheDir).filter((name) => name.endsWith(".json"));
+        }
+        catch (error) {
+            return {
+                ...base,
+                status: "warn",
+                detail: `hosted authority is sound but local cache is unreadable: ${error instanceof Error ? error.message : String(error)}; run \`ouro mail sync-cache --agent ${agentName}\``,
+            };
+        }
+    }
+    const recordsById = new Map(observation.records.map((record) => [record.id, record]));
+    const documentsById = new Map();
+    let malformedOrNoncanonical = 0;
+    for (const fileName of fileNames) {
+        const filePath = `${cacheDir}/${fileName}`;
+        let regularFile = false;
+        try {
+            const fileStat = deps.lstatSync?.(filePath);
+            regularFile = fileStat?.isFile?.() === true && !fileStat.isSymbolicLink();
+        }
+        catch {
+            // A disappearing or unreadable entry is not usable cache evidence.
+        }
+        if (!regularFile) {
+            malformedOrNoncanonical += 1;
+            continue;
+        }
+        const document = parseCacheDocument(deps, filePath);
+        if (!document || document.agentId !== agentName || fileName !== `${document.messageId}.json` || !recordsById.has(document.messageId)) {
+            malformedOrNoncanonical += 1;
+            continue;
+        }
+        documentsById.set(document.messageId, document);
+    }
+    const receiptsById = new Map();
+    let invalidReceipts = 0;
+    try {
+        for (const inspected of (0, search_cache_1.inspectMailSearchSkipReceipts)(agentName, { cacheDirForAgent: () => cacheDir })) {
+            const receipt = inspected.receipt;
+            const record = receipt ? recordsById.get(receipt.messageId) : undefined;
+            const currentFingerprint = record
+                ? (0, blob_store_1.canonicalMailIndexRecordSnapshot)([record]).messageIndexFingerprint
+                : null;
+            if (!receipt ||
+                !inspected.canonical ||
+                !record ||
+                documentsById.has(receipt.messageId) ||
+                receipt.recordFingerprint !== currentFingerprint ||
+                store.privateKeyIds.has(receipt.missingKeyId)) {
+                invalidReceipts += 1;
+                continue;
+            }
+            receiptsById.set(receipt.messageId, receipt.missingKeyId);
+        }
+    }
+    catch (error) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is sound but local skip receipts are unreadable: ${String(error)}; run \`ouro mail sync-cache --agent ${agentName}\``,
+        };
+    }
+    let missing = 0;
+    let receiptedMissing = 0;
+    let stale = 0;
+    let invalidKeyProvenance = 0;
+    for (const record of observation.records) {
+        const document = documentsById.get(record.id);
+        if (!document) {
+            if (receiptsById.has(record.id))
+                receiptedMissing += 1;
+            else
+                missing += 1;
+            continue;
+        }
+        if (!(0, hosted_cache_sync_1.mailSearchCacheDocumentMatchesRecord)(document, record, true)) {
+            stale += 1;
+            continue;
+        }
+        if (document.bodyForm === "encrypted" &&
+            (!document.decryptionKeyId || !store.privateKeyIds.has(document.decryptionKeyId))) {
+            invalidKeyProvenance += 1;
+        }
+    }
+    const coverage = (0, search_cache_1.readMailSearchCoverageRecord)({
+        agentId: agentName,
+        storeKind: "azure-blob",
+    }, { cacheDirForAgent: () => cacheDir });
+    const expectedCachedCount = documentsById.size;
+    const coverageMatches = coverage !== null
+        && coverage.textProjectionVersion === search_cache_1.MAIL_SEARCH_TEXT_PROJECTION_VERSION
+        && coverage.messageIndexFingerprint === observation.snapshot.messageIndexFingerprint
+        && coverage.visibleMessageCount === observation.snapshot.visibleMessageCount
+        && coverage.cachedMessageCount === expectedCachedCount
+        && coverage.decryptableMessageCount === expectedCachedCount
+        && coverage.skippedMessageCount === observation.snapshot.visibleMessageCount - expectedCachedCount;
+    if (coverageMatches
+        && coverage.skippedMessageCount > 0
+        && receiptedMissing === coverage.skippedMessageCount
+        && missing === 0
+        && stale === 0
+        && malformedOrNoncanonical === 0
+        && invalidReceipts === 0
+        && invalidKeyProvenance === 0) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is sound; the last completed sync skipped ${receiptedMissing} hosted message(s) with current per-message missing-key receipts, so local search remains incomplete; retry only if conditions have changed since that sync`,
+        };
+    }
+    if (malformedOrNoncanonical > 0 || missing > 0 || stale > 0 || invalidReceipts > 0 || invalidKeyProvenance > 0 || !coverageMatches) {
+        return {
+            ...base,
+            status: "warn",
+            detail: `hosted authority is sound but cache diverges: ${missing + stale} unreceipted-missing/stale canonical document(s), ${malformedOrNoncanonical} malformed/orphan/noncanonical/duplicate cache file(s), ${invalidReceipts} malformed/orphan/stale/recoverable skip receipt(s), ${invalidKeyProvenance} invalid key provenance document(s), all-scope coverage ${coverageMatches ? "matches" : "missing/malformed/stale"}; run \`ouro mail sync-cache --agent ${agentName}\``,
+        };
+    }
+    const count = observation.records.length;
+    return {
+        ...base,
+        status: "pass",
+        detail: `${count} authoritative hosted message${count === 1 ? "" : "s"}; local search cache converged with current metadata, projection, and key provenance`,
+    };
+}
+/**
+ * Local-file Mailroom liveness signal.
+ *
+ * The `messages/` directory mtime is both the cheapest and the most correct
+ * option. Cheapest: one stat regardless of store size, and the production store
+ * holds ~45k message files. Most correct: a message's `receivedAt` is when the
+ * mail was *sent* (an mbox backfill writes month-old values today), so parsing
+ * message bodies would answer a different question than "did this machine
+ * ingest anything recently?".
+ */
+function localMailStoreProbe(deps, messagesDir, listing) {
+    if (!listing.readable) {
+        return {
+            observation: { kind: "unknown", reason: `${messagesDir} exists but could not be listed` },
+            provenance: `attempted directory listing of ${messagesDir}`,
+        };
+    }
+    return (0, freshness_1.observeCreatePerEventStore)(messagesDir, deps, { hasEntries: listing.count > 0 });
+}
+/**
+ * Hosted Mailroom liveness signal.
+ *
+ * Once an agent is cut over to the hosted store, messages live in the Blob
+ * container and nothing writes to `state/mailroom/messages` any more, so its
+ * mtime freezes at the cutover. Reading it in hosted mode is how this check
+ * reported "no mail ingested in 77 days" on 2026-07-27 while the container was
+ * taking mail that same morning — a false failure, which trains operators to
+ * ignore the check and so undoes the reason it exists.
+ *
+ * The local artifact that does still move is the hosted reader's search cache:
+ * `AzureBlobMailroomStore` writes `state/mail-search/<messageId>.json` for
+ * every message it decrypts (see `mailroom/reader.ts`, which hands the hosted
+ * store that cache directory). Message ids are content hashes, so a *new* file
+ * appears exactly when this machine sees a message it has never seen before;
+ * re-reading old mail rewrites existing files and leaves the directory mtime
+ * untouched. Same create-per-event shape as the local store, same O(1) stat.
+ *
+ * It is deliberately one step downstream of ingest: it proves hosted mail
+ * reached this machine, which is the strongest claim available without network
+ * access or Azure credentials — a health check must need neither. The activity
+ * wording, provenance and remediation all say so rather than implying doctor
+ * measured the container itself, and an empty mirror reports `unknown` rather
+ * than the hosted store being empty.
+ */
+function hostedMailMirrorProbe(deps, agentDir, storeLabel) {
+    const mirrorDir = `${deps.bundlesRoot}/${agentDir}/state/mail-search`;
+    const listing = listJsonDocuments(deps, mirrorDir);
+    if (!listing.readable) {
+        return {
+            observation: { kind: "unknown", reason: `${mirrorDir} exists but could not be listed` },
+            provenance: `attempted directory listing of ${mirrorDir}`,
+        };
+    }
+    return (0, freshness_1.observeMirroredStore)(mirrorDir, deps, {
+        hasEntries: listing.count > 0,
+        remote: storeLabel,
+        authorityReadNote: "which the separate hosted cache authority check reads without mutation; this liveness check does not use remote data for recency",
+    });
+}
+/**
+ * Mail-ingest liveness — "is mail still arriving?", as opposed to the check
+ * above, which only says "is a mailbox configured?".
+ *
+ * This is the check that would have caught the 2026-05-10 outage: the mailbox,
+ * its config, and a cumulative count of 45,479 messages all reported ✔ for 77
+ * days while zero mail was ingested.
+ *
+ * Which signal is honest depends on where the store lives, so the probe, the
+ * activity wording and the remediation are all chosen per store kind. Reusing
+ * the local path in hosted mode measures a directory nothing writes to.
+ */
+function mailIngestLivenessCheck(deps, agentDir, mailroomRoot, messagesDir, listing, store, authorityCheck) {
+    const hosted = store.hosted ? store : null;
+    if (hosted && authorityCheck) {
+        if (authorityCheck.status === "pass") {
+            return {
+                id: "mail.ingest_liveness",
+                label: `${agentDir} mail ingest liveness`,
+                status: "pass",
+                detail: `hosted authority and local search cache are converged; this is healthy quiet even when the local mirror mtime is old or unchanged (${hosted.label}); mirror age is not treated as hosted-ingest authority`,
+            };
+        }
+        return {
+            id: "mail.ingest_liveness",
+            label: `${agentDir} mail ingest liveness`,
+            status: authorityCheck.status,
+            detail: `hosted ingest liveness follows the available authority result rather than local mirror age: ${authorityCheck.detail}`,
+        };
+    }
+    const probe = hosted
+        ? hostedMailMirrorProbe(deps, agentDir, hosted.label)
+        : localMailStoreProbe(deps, messagesDir, listing);
+    return pipelineLivenessCheck({
+        id: "mail.ingest_liveness",
+        label: `${agentDir} mail ingest liveness`,
+        activity: hosted ? "hosted mail observed locally" : "mail ingested",
+        unit: "message",
+        probe,
+        thresholds: (0, freshness_1.resolveFreshnessThresholds)(exports.DEFAULT_MAIL_INGEST_THRESHOLDS, senseFreshnessOverride(deps, agentDir, "mail")),
+        remediation: hosted
+            ? `this liveness check measures recency only through this machine's local mirror; the separate hosted cache authority check reads index names without mutation — if the mirror is empty or stale while authority is current, run \`ouro mail sync-cache --agent ${agentDir.replace(/\.ouro$/, "")}\` and verify the hosted reader on this machine`
+            : "mail is configured but nothing is arriving — re-check the mailbox grant and keyIds against the vault (a server-side key rotation silently orphans ingestion), run `ouro connect mail --agent <agent>`, and inspect the mailroom ingress logs",
+        configuredSinceMs: pathMtimeMs(deps, `${mailroomRoot}/registry.json`),
+        context: hosted ? `mailbox configured; ${hosted.label}` : "mailbox configured",
+        nowMs: Date.now(),
+    });
+}
+function checkFriends(deps) {
+    const checks = [];
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "friends", status: "warn", detail: "no agent bundles found" });
+        return { name: "Friends", checks };
+    }
+    for (const agentDir of agents) {
+        const friendsDir = `${deps.bundlesRoot}/${agentDir}/friends`;
+        if (!deps.existsSync(friendsDir)) {
+            checks.push({ label: `${agentDir} friends`, status: "pass", detail: "no friends directory (no friends recorded yet)" });
+            continue;
+        }
+        let entries;
+        /* v8 ignore start -- defensive: readdirSync failure after existsSync passes is a race-condition fallback @preserve */
+        try {
+            entries = deps.readdirSync(friendsDir).filter((name) => name.endsWith(".json"));
+        }
+        catch {
+            checks.push({ label: `${agentDir} friends`, status: "fail", detail: "friends directory could not be read" });
+            continue;
+        }
+        /* v8 ignore stop */
+        if (entries.length === 0) {
+            checks.push({ label: `${agentDir} friends`, status: "pass", detail: "0 friends recorded" });
+            continue;
+        }
+        let parseFailures = 0;
+        let trustFamily = 0;
+        let trustFriend = 0;
+        let trustStranger = 0;
+        let trustOther = 0;
+        /* v8 ignore start -- per-record trust-level tally branches: tests don't exhaustively combine all four trust buckets in one fixture @preserve */
+        for (const name of entries) {
+            const filePath = `${friendsDir}/${name}`;
+            let raw;
+            try {
+                raw = deps.readFileSync(filePath);
+            }
+            catch {
+                parseFailures += 1;
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                parseFailures += 1;
+                continue;
+            }
+            const trustLevel = typeof parsed.trustLevel === "string" ? parsed.trustLevel : "friend";
+            if (trustLevel === "family")
+                trustFamily += 1;
+            else if (trustLevel === "friend")
+                trustFriend += 1;
+            else if (trustLevel === "stranger")
+                trustStranger += 1;
+            else
+                trustOther += 1;
+        }
+        if (parseFailures > 0) {
+            checks.push({ label: `${agentDir} friends`, status: "warn", detail: `${entries.length} record${entries.length === 1 ? "" : "s"}, ${parseFailures} unparseable` });
+            continue;
+        }
+        const parts = [
+            `${entries.length} friend${entries.length === 1 ? "" : "s"}`,
+            `${trustFamily} family`,
+            `${trustFriend} friend`,
+            `${trustStranger} stranger`,
+        ];
+        if (trustOther > 0)
+            parts.push(`${trustOther} other`);
+        checks.push({ label: `${agentDir} friends`, status: "pass", detail: parts.join(", ") });
+        /* v8 ignore stop */
+    }
+    return { name: "Friends", checks };
+}
+function checkDisk(deps) {
+    const checks = [];
+    const isActiveLogStream = (name) => {
+        if (name.endsWith(".ndjson"))
+            return !/\.\d+\.ndjson$/.test(name);
+        if (name.endsWith(".log"))
+            return !/\.\d+\.log$/.test(name);
+        return false;
+    };
+    const addLogSizeCheck = (labelPrefix, logsDir, pruneCommand) => {
+        let totalSize = 0;
+        let activeSize = 0;
+        const oversizedActive = [];
+        try {
+            const files = deps.readdirSync(logsDir);
+            for (const file of files) {
+                try {
+                    const stat = deps.statSync(`${logsDir}/${file}`);
+                    totalSize += stat.size;
+                    if (isActiveLogStream(file)) {
+                        activeSize += stat.size;
+                        if (stat.size >= nerves_1.DEFAULT_MAX_LOG_SIZE_BYTES) {
+                            oversizedActive.push(file);
+                        }
+                    }
+                }
+                catch {
+                    // skip unreadable files
+                }
+            }
+        }
+        catch {
+            // readdirSync failure handled below
+        }
+        const sizeMB = totalSize / (1024 * 1024);
+        const activeSizeMB = activeSize / (1024 * 1024);
+        const repair = pruneCommand ? ` — run \`${pruneCommand}\`` : "";
+        if (activeSizeMB > 500) {
+            checks.push({ label: `${labelPrefix} daemon log size`, status: "fail", detail: `${activeSizeMB.toFixed(1)}MB active / ${sizeMB.toFixed(1)}MB total — active logs exceed 500MB limit${repair}` });
+        }
+        else if (oversizedActive.length > 0) {
+            checks.push({
+                label: `${labelPrefix} daemon log size`,
+                status: "warn",
+                detail: `${activeSizeMB.toFixed(1)}MB active / ${sizeMB.toFixed(1)}MB total; active stream(s) over ${Math.round(nerves_1.DEFAULT_MAX_LOG_SIZE_BYTES / (1024 * 1024))}MB: ${oversizedActive.join(", ")}${repair}`,
+            });
+        }
+        else {
+            checks.push({ label: `${labelPrefix} daemon log size`, status: "pass", detail: `${activeSizeMB.toFixed(1)}MB active / ${sizeMB.toFixed(1)}MB total` });
+        }
+    };
+    const agents = discoverAgents(deps);
+    if (agents.length === 0) {
+        checks.push({ label: "daemon logs dir", status: "warn", detail: "no agent bundles found for bundle-local logs" });
+    }
+    for (const agentDir of agents) {
+        const logsDir = `${deps.bundlesRoot}/${agentDir}/state/daemon/logs`;
+        let pruneCommand;
+        if (deps.lstatSync && deps.realpathSync) {
+            const io = {
+                existsSync: deps.existsSync,
+                lstatSync: deps.lstatSync,
+                readdirSync: deps.readdirSync,
+                realpathSync: deps.realpathSync,
+            };
+            try {
+                const agentName = agentDir.slice(0, -".ouro".length);
+                const target = (0, prunable_bundle_1.resolvePrunableAgentBundle)({ bundlesRoot: deps.bundlesRoot, agentName, fs: io });
+                if (!deps.existsSync(target.logsDir))
+                    throw new Error("logs directory does not exist");
+                const logsIo = {
+                    lstatSync: (filePath) => {
+                        const stat = deps.lstatSync(filePath);
+                        return {
+                            isDirectory: stat.isDirectory,
+                            isFile: stat.isFile ?? (() => false),
+                            isSymbolicLink: stat.isSymbolicLink,
+                        };
+                    },
+                    readdirSync: deps.readdirSync,
+                    realpathSync: deps.realpathSync,
+                };
+                (0, prunable_bundle_1.validatePrunableLogsTarget)(target, logsIo);
+                pruneCommand = `ouro logs prune --agent ${agentName}`;
+            }
+            catch {
+                // Doctor reports size but only offers repair for an exactly validated target.
+            }
+        }
+        if (!deps.existsSync(logsDir)) {
+            checks.push({ label: `${agentDir} daemon logs dir`, status: "warn", detail: `${logsDir} not found` });
+        }
+        else {
+            addLogSizeCheck(agentDir, logsDir, pruneCommand);
+        }
+    }
+    // Check AgentBundles root
+    if (deps.existsSync(deps.bundlesRoot)) {
+        checks.push({ label: "bundles root", status: "pass", detail: deps.bundlesRoot });
+    }
+    else {
+        checks.push({ label: "bundles root", status: "warn", detail: `${deps.bundlesRoot} not found` });
+    }
+    return { name: "Disk", checks };
+}
+// ── Orchestrator ──
+function computeSummary(categories) {
+    let passed = 0;
+    let warnings = 0;
+    let failed = 0;
+    for (const cat of categories) {
+        for (const check of cat.checks) {
+            /* v8 ignore next 3 -- all three branches tested; v8 misreports compound if/else-if chain @preserve */
+            if (check.status === "pass")
+                passed++;
+            else if (check.status === "warn")
+                warnings++;
+            else
+                failed++;
+        }
+    }
+    return { passed, warnings, failed };
+}
+/**
+ * Recent daemon lifecycle: surfaces last activity timestamp, recent restarts,
+ * version-install events, and process errors from the last hour. Designed
+ * to answer the operator's question after the daemon has gone silent: "did
+ * it crash? when did it last do anything? did it just upgrade?"
+ *
+ * Reads the machine-local daemon.ndjson when available, plus any
+ * bundle-local copies left by older runtimes. The newest parseable event
+ * is the liveness signal; stale bundle logs cannot mask a live daemon.
+ */
+function checkLifecycle(deps) {
+    const checks = [];
+    const HOUR_MS = 60 * 60 * 1000;
+    const STALE_THRESHOLD_MS = 5 * 60 * 1000;
+    const now = Date.now();
+    const cutoff = now - HOUR_MS;
+    const logPaths = [];
+    const seenLogPaths = new Set();
+    const addLogPath = (candidate) => {
+        if (seenLogPaths.has(candidate) || !deps.existsSync(candidate))
+            return;
+        seenLogPaths.add(candidate);
+        logPaths.push(candidate);
+    };
+    if (deps.daemonLogsDir) {
+        addLogPath(`${deps.daemonLogsDir}/daemon.ndjson`);
+    }
+    const agents = discoverAgents(deps);
+    for (const agentDir of agents) {
+        addLogPath(`${deps.bundlesRoot}/${agentDir}/state/daemon/logs/daemon.ndjson`);
+    }
+    if (logPaths.length === 0) {
+        checks.push({ label: "daemon log readable", status: "warn", detail: "no daemon.ndjson found in daemon or agent bundle logs" });
+        return { name: "Lifecycle", checks };
+    }
+    let lastTs = null;
+    let lastEvent = null;
+    let lastEventTimeMs = Number.NEGATIVE_INFINITY;
+    let startCount = 0;
+    let installCount = 0;
+    let installVersions = [];
+    let processErrors = [];
+    let lastEntryAgeMs = Number.POSITIVE_INFINITY;
+    let readCount = 0;
+    const readErrors = [];
+    for (const logPath of logPaths) {
+        try {
+            // Read the whole log via deps.readFileSync, then take the tail. For a
+            // chatty daemon this can be a few MB; we only inspect the last 5000
+            // lines which is enough for the last hour of activity. If the file is
+            // small (typical case), reading it all is cheap.
+            const raw = deps.readFileSync(logPath);
+            readCount++;
+            const allLines = raw.split("\n").filter((l) => l.trim());
+            const usable = allLines.length > 5000 ? allLines.slice(-5000) : allLines;
+            for (const line of usable) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                const ts = typeof parsed.ts === "string" ? parsed.ts : null;
+                const event = typeof parsed.event === "string" ? parsed.event : null;
+                if (!ts || !event)
+                    continue;
+                const tsMs = Date.parse(ts);
+                if (Number.isNaN(tsMs))
+                    continue;
+                if (tsMs > lastEventTimeMs) {
+                    lastEventTimeMs = tsMs;
+                    lastTs = ts;
+                    lastEvent = event;
+                    lastEntryAgeMs = Math.max(0, now - tsMs);
+                }
+                if (tsMs < cutoff)
+                    continue;
+                if (event === "daemon.daemon_started")
+                    startCount++;
+                if (event === "daemon.cli_version_install_end") {
+                    installCount++;
+                    const meta = parsed.meta;
+                    const ver = typeof meta?.version === "string" ? meta.version : null;
+                    if (ver)
+                        installVersions.push(ver);
+                }
+                if (event === "daemon.agent_process_error") {
+                    const meta = parsed.meta;
+                    const reason = typeof meta?.reason === "string" ? meta.reason : "unknown";
+                    const agent = typeof meta?.agent === "string" ? meta.agent : "unknown";
+                    processErrors.push(`${agent}: ${reason}`);
+                }
+            }
+        }
+        catch (error) {
+            readErrors.push(`${logPath}: ${error instanceof Error ? error.message : /* v8 ignore next -- non-Error throw is unreachable from deps.readFileSync (always Error) @preserve */ String(error)}`);
+        }
+    }
+    if (readCount === 0) {
+        checks.push({ label: "daemon log readable", status: "fail", detail: `read failed: ${readErrors.join("; ")}` });
+        return { name: "Lifecycle", checks };
+    }
+    if (readErrors.length > 0) {
+        checks.push({ label: "daemon log readable", status: "warn", detail: `some daemon logs were unreadable: ${readErrors.join("; ")}` });
+    }
+    if (lastTs === null) {
+        checks.push({ label: "recent daemon activity", status: "warn", detail: "no parseable events in tail of daemon.ndjson" });
+    }
+    else {
+        const ageSec = Math.round(lastEntryAgeMs / 1000);
+        const ageDetail = ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
+        if (lastEntryAgeMs > STALE_THRESHOLD_MS) {
+            checks.push({
+                label: "recent daemon activity",
+                status: "warn",
+                detail: `last event ${ageDetail} (${lastEvent}) — daemon may be silent or stopped`,
+            });
+        }
+        else {
+            checks.push({
+                label: "recent daemon activity",
+                status: "pass",
+                detail: `last event ${ageDetail} (${lastEvent})`,
+            });
+        }
+    }
+    if (startCount > 0) {
+        checks.push({
+            label: "daemon restarts (last hour)",
+            status: startCount > 3 ? "warn" : "pass",
+            detail: `${startCount} restart${startCount === 1 ? "" : "s"}${startCount > 3 ? " — high churn, investigate" : ""}`,
+        });
+    }
+    if (installCount > 0) {
+        checks.push({
+            label: "version installs (last hour)",
+            status: "pass",
+            detail: `installed: ${installVersions.join(", ")}`,
+        });
+    }
+    if (processErrors.length > 0) {
+        checks.push({
+            label: "agent process errors (last hour)",
+            status: "warn",
+            detail: `${processErrors.length} error${processErrors.length === 1 ? "" : "s"}: ${processErrors.slice(0, 3).join("; ")}${processErrors.length > 3 ? "..." : ""}`,
+        });
+    }
+    return { name: "Lifecycle", checks };
+}
+const CATEGORY_CHECKERS = [
+    { name: "CLI", fn: checkCliPath },
+    { name: "Daemon", fn: checkDaemon },
+    { name: "Lifecycle", fn: checkLifecycle },
+    { name: "Agents", fn: checkAgents },
+    { name: "Senses", fn: checkSenses },
+    { name: "Habits", fn: checkHabits },
+    { name: "RSVP", fn: checkRsvp },
+    { name: "Security", fn: checkSecurity },
+    { name: "Trips", fn: checkTrips },
+    { name: "Mailroom", fn: checkMailroom },
+    { name: "Friends", fn: checkFriends },
+    { name: "Disk", fn: checkDisk },
+];
+exports.KNOWN_DOCTOR_CATEGORIES = CATEGORY_CHECKERS.map((c) => c.name);
+async function runDoctorChecks(deps, options = {}) {
+    const categories = [];
+    const filter = options.category?.toLowerCase();
+    /* v8 ignore next -- branch: filter present vs absent — covered separately by --category and plain doctor tests but the filter-array generation isn't double-counted by both code paths in the same suite @preserve */
+    const checkers = filter
+        ? CATEGORY_CHECKERS.filter((c) => c.name.toLowerCase() === filter)
+        : CATEGORY_CHECKERS;
+    for (const checker of checkers) {
+        try {
+            const category = await Promise.resolve(checker.fn(deps));
+            categories.push(category);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.doctor_check_error",
+                message: `doctor check ${checker.name} failed`,
+                meta: { category: checker.name, error: error instanceof Error ? error.message : String(error) },
+            });
+            categories.push({
+                name: checker.name,
+                checks: [{
+                        label: checker.name.toLowerCase(),
+                        status: "fail",
+                        detail: `check crashed: ${error instanceof Error ? error.message : String(error)}`,
+                    }],
+            });
+        }
+    }
+    return { categories, summary: computeSummary(categories) };
+}