@primitive.ai/prim 0.1.0-alpha.91 → 0.1.0-alpha.93

package/dist/index.js

@@ -8,6 +8,7 @@ import {
   ensurePostRewriteHookAtPath,
   inspectEffectivePostCommitHook,
   inspectEffectivePostRewriteHook,
+  kickDaemonEnsure,
   postCommitHookBlock,
   postRewriteHookBlock,
   printJson,
@@ -17,42 +18,53 @@ import {
   uninstallPostRewriteHookAtPath,
   uninstallProjectPostCommitHook,
   uninstallProjectPostRewriteHook
-} from "./chunk-FOLKHXLJ.js";
+} from "./chunk-DCJN6LZH.js";
 import {
   requireDurableIngestAcknowledgement
-} from "./chunk-FKXFUUWJ.js";
+} from "./chunk-TYAHC25F.js";
 import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-5GYQ4J3D.js";
+} from "./chunk-UKUAAAXE.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-5AFRMOPX.js";
+} from "./chunk-OH3EZXYX.js";
+import {
+  isUnattended,
+  unattendedEnv
+} from "./chunk-OYHYCK4K.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
   bucketStats,
+  drainResumeOffset,
+  envSlug,
   listBuckets,
   listFlushing,
   pendingJournalStats,
-  readMovesFromPath
-} from "./chunk-FBAYCS3X.js";
+  readMovesFromPath,
+  removeDrainCheckpoint,
+  rotationIdentity,
+  sweepOrphanedDrainProgress,
+  writeDrainCheckpoint
+} from "./chunk-DXJQR4QI.js";
 import {
+  MS_PER_SECOND,
+  deliveryBacklogState,
+  deliveryBacklogSummary,
+  formatPendingBacklog,
   formatStatusline,
   formatTeammates,
   repositoryBindingDiagnosticLabel
-} from "./chunk-WX52U7Z2.js";
+} from "./chunk-ZU563PQI.js";
 import {
   bold,
   boundedHealthError,
   color,
   colorForArea,
-  dim,
-  stripAnsi
-} from "./chunk-BTNNEH2W.js";
-import {
   decisionIngestionStatus,
+  dim,
   fetchAndCacheCollectScope,
   isCliErrorResponse,
   isDecisionIdRequest,
@@ -68,8 +80,9 @@ import {
   isValidRepoSyncId,
   repoSyncId,
   repositoryBindingState,
-  setRepoActive
-} from "./chunk-M6RIJVRE.js";
+  setRepoActive,
+  stripAnsi
+} from "./chunk-DSWT6BCC.js";
 import {
   CliManagementResponseError,
   HttpError,
@@ -79,13 +92,14 @@ import {
   getPinnedClient,
   getPinnedManagementClient,
   getSiteUrl,
+  getSiteUrlForEnvironment,
   getTokenExpiresAt,
   isSessionEnded,
   refreshToken,
   setStoredToken,
   stripControlChars,
   terminalSafeLine
-} from "./chunk-PCVGBE5B.js";
+} from "./chunk-G2VMA2QO.js";
 import {
   assertOwnedHookRuntime,
   atomicWrite,
@@ -100,6 +114,7 @@ import {
   inspectHookRuntimeResolutions,
   inspectHookRuntimeResolutions2,
   makeRegistration,
+  packageRoot,
   packageVersion,
   performStatus,
   performStatus2,
@@ -111,9 +126,10 @@ import {
   registerCursorCommands,
   removeHookRuntime,
   stableHookCommand,
+  stableNodePath,
   stageHookRuntime,
   stripCommand
-} from "./chunk-EWZMDD44.js";
+} from "./chunk-X64HTHUF.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
@@ -122,7 +138,7 @@ import {
 import {
   daemonIsLive,
   daemonRequest
-} from "./chunk-KFXF2V5G.js";
+} from "./chunk-OTHKG76J.js";
 import {
   REFRESH_TOKEN_PATH,
   TOKEN_FILE_PATH,
@@ -135,12 +151,13 @@ import {
   requestWorkosDeviceAuthorization,
   resolveAuthCredential,
   syncDirectory,
-  withFileLock
-} from "./chunk-67VNLLBN.js";
+  withFileLock,
+  withFileLockSync
+} from "./chunk-2GP5UFV7.js";
 
 // src/index.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname6, resolve as resolve4 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname7, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
@@ -749,18 +766,18 @@ function parseAuthBrokerConfig(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("broker config must be an object");
   }
-  const record2 = value;
-  if (typeof record2.authorization_server !== "string" || !record2.authorization_server.trim()) {
+  const record3 = value;
+  if (typeof record3.authorization_server !== "string" || !record3.authorization_server.trim()) {
     throw new Error("authorization_server is required");
   }
-  if (typeof record2.client_id !== "string" || !record2.client_id.trim()) {
+  if (typeof record3.client_id !== "string" || !record3.client_id.trim()) {
     throw new Error("client_id is required");
   }
-  if (!Array.isArray(record2.default_scopes) || !record2.default_scopes.every((scope) => typeof scope === "string" && scope.length > 0)) {
+  if (!Array.isArray(record3.default_scopes) || !record3.default_scopes.every((scope) => typeof scope === "string" && scope.length > 0)) {
     throw new Error("default_scopes must be a string array");
   }
-  const authorizationServer = parseHttpUrl(record2.authorization_server, "authorization_server");
-  const rawEndpoint = record2.authorization_endpoint === void 0 ? DEFAULT_WORKOS_AUTHORIZE_URL : record2.authorization_endpoint;
+  const authorizationServer = parseHttpUrl(record3.authorization_server, "authorization_server");
+  const rawEndpoint = record3.authorization_endpoint === void 0 ? DEFAULT_WORKOS_AUTHORIZE_URL : record3.authorization_endpoint;
   if (typeof rawEndpoint !== "string" || !rawEndpoint.trim()) {
     throw new Error("authorization_endpoint must be a URL");
   }
@@ -771,8 +788,8 @@ function parseAuthBrokerConfig(value) {
   return {
     authorization_server: authorizationServer.toString(),
     authorization_endpoint: authorizationEndpoint.toString(),
-    client_id: record2.client_id.trim(),
-    default_scopes: [...record2.default_scopes]
+    client_id: record3.client_id.trim(),
+    default_scopes: [...record3.default_scopes]
   };
 }
 async function fetchAuthBrokerConfig(siteUrl, fetchImpl = fetch) {
@@ -2177,7 +2194,7 @@ ${line("project", result.project)}`);
 
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
 import { join as join5 } from "path";
 import { Option as Option2 } from "commander";
 
@@ -2250,12 +2267,12 @@ async function runLatestDaemonBootstrap(ensureCurrent, options = {}) {
 import { spawnSync } from "child_process";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 import {
-  constants,
+  constants as constants2,
   accessSync,
   chmodSync,
   copyFileSync,
   existsSync as existsSync3,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   mkdtempSync,
   readFileSync as readFileSync3,
@@ -2264,16 +2281,53 @@ import {
   realpathSync,
   renameSync,
   rmSync,
+  statSync,
   symlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename, dirname as dirname2, isAbsolute, join as join4, resolve as resolve2 } from "path";
 
+// src/lib/bounded-file.ts
+import { constants, closeSync, fstatSync, lstatSync as lstatSync2, openSync, readSync } from "fs";
+function readBoundedRegularFile(path, maxBytes) {
+  let fd;
+  try {
+    const linked = lstatSync2(path);
+    if (!linked.isFile() || linked.size > maxBytes) return void 0;
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.dev !== linked.dev || opened.ino !== linked.ino || opened.size > maxBytes) {
+      return void 0;
+    }
+    const buffer = Buffer.allocUnsafe(opened.size + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const count = readSync(fd, buffer, length, buffer.length - length, length);
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > opened.size) return void 0;
+    return { text: buffer.subarray(0, length).toString("utf8"), ownerUid: opened.uid };
+  } catch {
+    return void 0;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+
 // src/daemon/env-binding.ts
 function normalizeApiUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
+function apiUrlsMatch(a, b) {
+  return normalizeApiUrl(a) === normalizeApiUrl(b);
+}
 
 // src/daemon/launchd.ts
 var LAUNCHD_LABEL = "ai.getprimitive.prim-daemon";
@@ -2292,6 +2346,11 @@ var SERVICE_NOT_FOUND = 113;
 var TRANSITION_IN_PROGRESS = 5;
 var OUTPUT_LIMIT = 4096;
 var DAEMON_DISABLED_CONTENT = "disabled by `prim daemon stop`\n";
+var LAUNCHER_MAX_BYTES = 64 * 1024;
+var PLIST_MAX_BYTES = 64 * 1024;
+var DRIFT_HEAL_MARKER = "daemon-drift-heal.json";
+var DRIFT_HEAL_MARKER_TEMPORARY_RE = /^daemon-drift-heal\.json\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.tmp$/u;
+var DRIFT_HEAL_CLAIM_OWNER = "owner.json";
 var LaunchctlError = class extends Error {
   status;
   timedOut;
@@ -2331,6 +2390,8 @@ function daemonControlPaths(options = {}) {
   return {
     launcher: join4(configDir, `prim-daemon-launcher-v${LAUNCHER_SCHEMA_VERSION}`),
     disabledMarker: join4(configDir, "daemon.disabled"),
+    driftHealMarker: join4(configDir, DRIFT_HEAL_MARKER),
+    driftHealClaim: join4(configDir, "daemon-drift-heal.lock"),
     lifecycleLockDir: join4(configDir, "daemon.lifecycle.lock"),
     legacyDisabledMarker: legacy.disabledMarker,
     legacyLifecycleLockDir: legacy.lifecycleLockDir
@@ -2391,7 +2452,7 @@ function readOwnedRuntimeManifest(releaseDir) {
     }
     const manifest = parsed;
     if (manifest.schemaVersion !== RUNTIME_SCHEMA_VERSION || compareSemver(manifest.version, manifest.version) !== 0 || !isAbsolute(manifest.nodePath) || /[\r\n]/u.test(manifest.nodePath) || manifest.daemonFile !== "prim-daemon-server" || !/^[0-9a-f]{64}$/u.test(manifest.daemonSha256) || new Date(manifest.stagedAt).toISOString() !== manifest.stagedAt || raw !== `${JSON.stringify(manifest, null, 2)}
-` || !lstatSync2(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
+` || !lstatSync3(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
       return null;
     }
     const entries = readdirSync2(releaseDir).sort();
@@ -2400,8 +2461,17 @@ function readOwnedRuntimeManifest(releaseDir) {
     return null;
   }
 }
+function sameNode(recorded, desired) {
+  if (recorded === desired) return true;
+  try {
+    const target = realpathSync(desired);
+    return recorded !== target && realpathSync(recorded) === target;
+  } catch {
+    return false;
+  }
+}
 function sameRuntime(current, desired, daemonPath) {
-  if (!current || current.version !== desired.version || current.nodePath !== desired.nodePath || current.daemonSha256 !== desired.daemonSha256) {
+  if (!current || current.version !== desired.version || !sameNode(current.nodePath, desired.nodePath) || current.daemonSha256 !== desired.daemonSha256) {
     return false;
   }
   try {
@@ -2429,7 +2499,7 @@ function stageRuntime(options = {}) {
   if (!daemonSource || !existsSync3(daemonSource)) {
     throw new Error("cannot stage runtime: prim-daemon-server bundle is unavailable");
   }
-  const nodePath = resolve2(options.nodePath ?? process.execPath);
+  const nodePath = resolve2(options.nodePath ?? stableNodePath());
   const version = options.version ?? findPackageVersion(daemonSource);
   const desired = {
     schemaVersion: RUNTIME_SCHEMA_VERSION,
@@ -2528,13 +2598,30 @@ function assertRegularFile(path, label) {
 }
 function lstatIfPresent2(path) {
   try {
-    return lstatSync2(path);
+    return lstatSync3(path);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR") return void 0;
     throw error;
   }
 }
+function driftHealMarkerTemporaries(configDir) {
+  try {
+    return readdirSync2(configDir).filter((entry) => DRIFT_HEAL_MARKER_TEMPORARY_RE.test(entry)).map((entry) => join4(configDir, entry));
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return [];
+    throw error;
+  }
+}
+function assertDriftHealClaim(path) {
+  const claim = lstatIfPresent2(path);
+  if (!claim) return;
+  if (!claim.isDirectory() || readdirSync2(path).some((entry) => entry !== DRIFT_HEAL_CLAIM_OWNER)) {
+    throw new Error(`refusing to remove unrecognized daemon drift-heal claim at ${path}`);
+  }
+  assertRegularFile(join4(path, DRIFT_HEAL_CLAIM_OWNER), "daemon drift-heal claim owner");
+}
 function assertExactFile(path, expected, label) {
   if (!lstatIfPresent2(path)) return;
   assertRegularFile(path, label);
@@ -2573,17 +2660,16 @@ function assertOwnedDaemonRuntime(options) {
     );
   }
   assertRegularFile(logPath, "daemon log");
+  assertRegularFile(control.driftHealMarker, "daemon drift-heal marker");
+  for (const temporary of driftHealMarkerTemporaries(configDir)) {
+    assertRegularFile(temporary, "daemon drift-heal marker temporary");
+  }
+  assertDriftHealClaim(control.driftHealClaim);
   assertRegularFile(join4(configDir, "daemon-health.json"), "daemon health snapshot");
   assertRegularFile(join4(configDir, "client_instance_id"), "daemon client instance id");
   if (service && lstatIfPresent2(service.plistPath)) {
     assertRegularFile(service.plistPath, "launchd property list");
-    const expected = generateLaunchAgentPlist({
-      launcherPath: control.launcher,
-      logPath,
-      workingDirectory: options.homeDir ?? homedir3(),
-      label: options.label
-    });
-    if (readFileSync3(service.plistPath, "utf8") !== expected) {
+    if (readFileSync3(service.plistPath, "utf8") !== ownedLaunchAgentPlist(options, logPath)) {
       throw new Error(
         `refusing to remove unrecognized launchd property list at ${service.plistPath}`
       );
@@ -2660,6 +2746,9 @@ async function removeDaemonRuntime(options = {}) {
     control.launcher,
     control.disabledMarker,
     control.legacyDisabledMarker,
+    control.driftHealMarker,
+    ...driftHealMarkerTemporaries(configDir),
+    control.driftHealClaim,
     ...service ? [service.plistPath] : [],
     logPath,
     join4(configDir, "daemon-health.json"),
@@ -2671,7 +2760,7 @@ async function removeDaemonRuntime(options = {}) {
   return withDaemonLifecycleLock(async () => {
     assertOwnedDaemonRuntime(options);
     for (const path of ownedArtifacts.filter((candidate) => candidate !== runtime.runtimeDir)) {
-      rmSync(path, { force: true });
+      rmSync(path, { force: true, recursive: path === control.driftHealClaim });
     }
     if (lstatIfPresent2(runtime.runtimeDir)) {
       const quarantined = `${runtime.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes3(8).toString("hex")}`;
@@ -2705,9 +2794,22 @@ ${config.configDir ? `export PRIM_CONFIG_DIR=${shellQuote(config.configDir)}
 `
   };
 }
+function ownedLaunchAgentPlist(options, logPath) {
+  return generateLaunchAgentPlist({
+    launcherPath: daemonControlPaths(options).launcher,
+    logPath,
+    workingDirectory: options.homeDir ?? homedir3(),
+    label: options.label
+  });
+}
 function readDaemonLauncher(path) {
+  return readDaemonLauncherFile(path)?.config ?? null;
+}
+function readDaemonLauncherFile(path) {
   try {
-    const content = readFileSync3(path, "utf8");
+    const file = readBoundedRegularFile(path, LAUNCHER_MAX_BYTES);
+    if (!file) return null;
+    const content = file.text;
     const encoded = /^# prim-daemon-launcher: ([A-Za-z0-9_-]+)$/mu.exec(content)?.[1];
     if (!encoded) return null;
     const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
@@ -2722,7 +2824,7 @@ function readDaemonLauncher(path) {
       ...typeof value.configDir === "string" ? { configDir: value.configDir } : {}
     };
     const expected = generateDaemonLauncher(config);
-    return expected.revision === value.revision && expected.content === content ? config : null;
+    return expected.revision === value.revision && expected.content === content ? { config, ownerUid: file.ownerUid } : null;
   } catch {
     return null;
   }
@@ -2732,7 +2834,7 @@ function readUsableDaemonConfig(path) {
   if (!config) return null;
   const manifest = readRuntimeManifest(join4(dirname2(config.daemonPath), "manifest.json"));
   try {
-    accessSync(config.nodePath, constants.X_OK);
+    accessSync(config.nodePath, constants2.X_OK);
     return manifest?.version === config.runtimeVersion && manifest.nodePath === config.nodePath && manifest.daemonSha256 === sha256File(config.daemonPath) ? config : null;
   } catch {
     return null;
@@ -3076,6 +3178,68 @@ function setDaemonExplicitlyDisabled(disabled, options = {}) {
   }
   atomicWrite2(paths.disabledMarker, content, RUNTIME_FILE_MODE);
 }
+function launcherRunnable(config) {
+  try {
+    accessSync(config.nodePath, constants2.X_OK);
+    return statSync(config.daemonPath).isFile();
+  } catch {
+    return false;
+  }
+}
+function selectedDaemonLauncher(options = {}) {
+  const file = readDaemonLauncherFile(daemonControlPaths(options).launcher);
+  if (!file) return null;
+  const { config, ownerUid } = file;
+  return {
+    runtimeVersion: config.runtimeVersion,
+    ...config.apiUrl ? { apiUrl: config.apiUrl } : {},
+    ownerUid,
+    runnable: launcherRunnable(config)
+  };
+}
+var XML_ENTITIES = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&apos;": "'"
+};
+var XML_ENTITY_RE = /&(?:amp|lt|gt|quot|apos);/gu;
+var PLIST_LABEL_KEY = "<key>Label</key>";
+var PLIST_PROGRAM_KEY = "<key>ProgramArguments</key>";
+var PLIST_LABEL_RE = /<key>Label<\/key>\s*<string>([^<]*)<\/string>/u;
+var PLIST_PROGRAM_RE = /<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/u;
+function xmlUnescape(value) {
+  if (value.replace(XML_ENTITY_RE, "").includes("&")) return void 0;
+  return value.replace(XML_ENTITY_RE, (entity) => XML_ENTITIES[entity] ?? entity);
+}
+function launchAgentProgram(plist) {
+  if (plist.split(PLIST_LABEL_KEY).length !== 2 || plist.split(PLIST_PROGRAM_KEY).length !== 2) {
+    return void 0;
+  }
+  const label = PLIST_LABEL_RE.exec(plist)?.[1];
+  const program2 = PLIST_PROGRAM_RE.exec(plist)?.[1];
+  if (label === void 0 || program2 === void 0) return void 0;
+  const decodedLabel = xmlUnescape(label);
+  const decodedProgram = xmlUnescape(program2);
+  return decodedLabel === void 0 || decodedProgram === void 0 ? void 0 : { label: decodedLabel, program: decodedProgram };
+}
+function launchAgentRunsConfigRoot(options = {}) {
+  try {
+    const service = launchdPaths(options);
+    const plist = readBoundedRegularFile(service.plistPath, PLIST_MAX_BYTES);
+    const agent = plist ? launchAgentProgram(plist.text) : void 0;
+    return agent?.label === (options.label ?? LAUNCHD_LABEL) && agent.program === daemonControlPaths(options).launcher;
+  } catch {
+    return false;
+  }
+}
+function daemonDriftHealMarkerPath(options = {}) {
+  return daemonControlPaths(options).driftHealMarker;
+}
+function daemonDriftHealClaimPath(options = {}) {
+  return daemonControlPaths(options).driftHealClaim;
+}
 async function ensureMacDaemon(options = {}) {
   return withDaemonLifecycleLock(() => ensureMacDaemonLocked(options), options);
 }
@@ -3277,16 +3441,20 @@ var STATUS_PROBE_TIMEOUT_MS = 500;
 var READY_TIMEOUT_MS = 5e3;
 var READY_POLL_MS2 = 100;
 var READY_PROBE_TIMEOUT_MS2 = 250;
-var HEALTHY_TIMEOUT_MS = 3e4;
-var HEALTHY_POLL_MS = 250;
+var READY_SNAPSHOT_TIMEOUT_MS = 3e4;
+var READY_SNAPSHOT_POLL_MS = 250;
 var EXIT_OK3 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
-function formatDaemonLifecycleMessage(message, decisionIngestion) {
-  return `${message} \xB7 Decision ingestion ${decisionIngestion}`;
+var VERIFIED_PREFIX = "[prim] \u2713 ";
+function formatDaemonLifecycleMessage(message, decisionIngestion, snapshot, now = Date.now()) {
+  const backlog = deliveryBacklogSummary(snapshot?.ingestion, now);
+  const state = deliveryBacklogState(snapshot?.ingestion);
+  const verdict = (state === "failing" || state === "retained") && message.startsWith(VERIFIED_PREFIX) ? `[prim] \u26A0 ${message.slice(VERIFIED_PREFIX.length)}` : message;
+  return `${verdict} \xB7 Decision ingestion ${decisionIngestion}${backlog ? ` \xB7 ${backlog}` : ""}`;
 }
-function formatCurrentDaemonLifecycleMessage(message) {
-  return formatDaemonLifecycleMessage(message, decisionIngestionStatus(process.cwd()));
+function formatCurrentDaemonLifecycleMessage(message, snapshot) {
+  return formatDaemonLifecycleMessage(message, decisionIngestionStatus(process.cwd()), snapshot);
 }
 function daemonDegradedReason(snapshot) {
   if (!snapshot || snapshot.healthy !== false) return void 0;
@@ -3337,7 +3505,7 @@ function openDaemonLog(configDir = CONFIG_DIR) {
   if (!existsSync4(configDir)) {
     mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
-  return openSync(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
+  return openSync2(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
 async function waitForReady() {
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -3349,17 +3517,23 @@ async function waitForReady() {
   }
   return daemonIsLive(READY_PROBE_TIMEOUT_MS2);
 }
-async function waitForHealthySnapshot(expectedVersion) {
-  const deadline = Date.now() + HEALTHY_TIMEOUT_MS;
+function requestStatusSnapshot() {
+  return daemonRequest(
+    "status_snapshot",
+    {},
+    { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
+  );
+}
+async function waitForReadySnapshot(expectedVersion, options = {}) {
+  const request = options.requestSnapshot ?? requestStatusSnapshot;
+  const wait = options.sleep ?? sleep;
+  const nowMs = options.nowMs ?? Date.now;
+  const deadline = nowMs() + READY_SNAPSHOT_TIMEOUT_MS;
   let snapshot = null;
-  while (Date.now() < deadline) {
-    snapshot = await daemonRequest(
-      "status_snapshot",
-      {},
-      { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
-    );
-    if (snapshot?.healthy === true && snapshot.version === expectedVersion) return snapshot;
-    await sleep(HEALTHY_POLL_MS);
+  while (nowMs() < deadline) {
+    snapshot = await request();
+    if (daemonStartIsReady(true, snapshot, expectedVersion)) return snapshot;
+    await wait(READY_SNAPSHOT_POLL_MS);
   }
   return snapshot;
 }
@@ -3372,11 +3546,20 @@ async function verifiedPid(existing) {
   );
   return snapshot?.pid === existing.pid ? snapshot : null;
 }
-function daemonStartIsHealthy(serviceReady, snapshot, expectedVersion) {
-  return serviceReady && snapshot?.healthy === true && expectedVersion !== void 0 && snapshot.version === expectedVersion;
+function daemonStartIsReady(serviceReady, snapshot, expectedVersion) {
+  if (!serviceReady || !snapshot || expectedVersion === void 0) return false;
+  if (snapshot.version !== expectedVersion || snapshot.needsReauth === true) return false;
+  if (snapshot.healthy === true) return true;
+  return snapshot.heartbeat?.healthy === true && snapshot.ingestion?.healthy === false;
+}
+function daemonBacklogFields(snapshot) {
+  const state = deliveryBacklogState(snapshot?.ingestion);
+  if (!state) return {};
+  if (state === "draining") return { draining: true, ingestion: snapshot?.ingestion };
+  return state === "retained" ? { draining: false, deliveryRetained: true, ingestion: snapshot?.ingestion } : { draining: false, deliveryFailing: true, ingestion: snapshot?.ingestion };
 }
-function daemonStartHealthFields(healthy, snapshot) {
-  if (healthy) return {};
+function daemonStartHealthFields(ready, snapshot) {
+  if (ready) return daemonBacklogFields(snapshot);
   return {
     state: "degraded",
     needsReauth: snapshot?.needsReauth === true,
@@ -3384,16 +3567,28 @@ function daemonStartHealthFields(healthy, snapshot) {
     ingestion: snapshot?.ingestion ?? null
   };
 }
+function daemonStartFailureReason(snapshot, expectedVersion) {
+  if (snapshot && !snapshot.needsReauth && expectedVersion !== void 0 && snapshot.version !== expectedVersion) {
+    return `daemon reports ${snapshot.version ? `v${snapshot.version}` : "no version"}, expected v${expectedVersion}`;
+  }
+  return daemonDegradedReason(snapshot);
+}
 async function detachedDaemonStart(opts) {
   const existing = readPidfile();
   if (existing?.alive) {
     const snapshot = await verifiedPid(existing);
     if (snapshot) {
       process.stderr.write(
-        `${formatCurrentDaemonLifecycleMessage(`[prim] daemon already running (pid=${existing.pid})`)}
+        `${formatCurrentDaemonLifecycleMessage(`[prim] daemon already running (pid=${existing.pid})`, snapshot)}
 `
       );
-      console.log(JSON.stringify({ started: false, pid: existing.pid }, null, 2));
+      console.log(
+        JSON.stringify(
+          { started: false, pid: existing.pid, ...daemonBacklogFields(snapshot) },
+          null,
+          2
+        )
+      );
       return;
     }
     process.stderr.write(
@@ -3442,16 +3637,19 @@ async function detachedDaemonStart(opts) {
   });
   child.unref();
   if (logFd !== void 0) {
-    closeSync(logFd);
+    closeSync2(logFd);
   }
   const live = await waitForReady();
   if (live) {
     const after = readPidfile();
+    const snapshot = await requestStatusSnapshot();
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon started (pid=${after?.pid ?? "?"}, socket=${SOCK_PATH})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon started (pid=${after?.pid ?? "?"}, socket=${SOCK_PATH})`, snapshot)}
 `
     );
-    console.log(JSON.stringify({ started: true, pid: after?.pid }, null, 2));
+    console.log(
+      JSON.stringify({ started: true, pid: after?.pid, ...daemonBacklogFields(snapshot) }, null, 2)
+    );
     return;
   }
   process.stderr.write(
@@ -3574,19 +3772,25 @@ async function macDaemonStart(forceRestart = false) {
   const result = await ensureMacDaemon({ explicitlyStarted: true, forceRestart });
   const serviceReady = result.state === "running";
   const expectedVersion = result.runtime?.manifest.version;
-  const snapshot = serviceReady && expectedVersion ? await waitForHealthySnapshot(expectedVersion) : null;
-  const healthy = daemonStartIsHealthy(serviceReady, snapshot, expectedVersion);
-  if (healthy) {
+  const snapshot = serviceReady && expectedVersion ? await waitForReadySnapshot(expectedVersion) : null;
+  const ready = daemonStartIsReady(serviceReady, snapshot, expectedVersion);
+  if (ready) {
     const verb = result.action === "none" ? "already running" : "started";
     const servicePid = result.service.loaded ? result.service.pid : void 0;
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? servicePid ?? "?"})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? servicePid ?? "?"})`, snapshot)}
 `
     );
+  } else if (!(serviceReady && expectedVersion)) {
+    process.stderr.write(
+      `[prim] \u2717 launchd did not converge on the desired daemon (${result.action}) (see ${LOG_PATH})
+`
+    );
+    if (!process.exitCode) process.exitCode = EXIT_NOT_RUNNING;
   } else {
-    const reason = daemonDegradedReason(snapshot);
+    const reason = daemonStartFailureReason(snapshot, expectedVersion);
     process.stderr.write(
-      `[prim] \u2717 launchd daemon did not reach healthy heartbeat + ingestion state${reason ? ` \xB7 ${reason}` : ""} (see ${LOG_PATH})
+      `[prim] \u2717 launchd daemon did not reach a healthy heartbeat on the expected version${reason ? ` \xB7 ${reason}` : ""} (see ${LOG_PATH})
 `
     );
     if (!process.exitCode) process.exitCode = EXIT_NOT_RUNNING;
@@ -3594,14 +3798,20 @@ async function macDaemonStart(forceRestart = false) {
   console.log(
     JSON.stringify(
       {
-        started: healthy,
+        started: ready,
         supervised: true,
         action: result.action,
         pid: snapshot?.pid ?? (result.service.loaded ? result.service.pid : void 0),
         loaded: result.service.loaded,
         responding: result.responding,
-        healthy,
-        ...daemonStartHealthFields(healthy, snapshot),
+        // `healthy` keeps meaning "start succeeded" (always equal to `started`
+        // and the exit code) so existing consumers stay correct. It is not the
+        // daemon's own health: `daemon status --json` stays degraded while a
+        // backlog drains, is held back, or fails to deliver, which start
+        // reports additively via `draining`, `deliveryRetained`,
+        // `deliveryFailing`, and `ingestion`.
+        healthy: ready,
+        ...daemonStartHealthFields(ready, snapshot),
         version: snapshot?.version,
         expectedVersion
       },
@@ -3905,11 +4115,12 @@ async function daemonEnsure() {
     return { disabled };
   }
   const result = await ensureMacDaemon();
+  const snapshot = result.state === "running" ? await requestStatusSnapshot() : null;
   if (result.state === "disabled") {
     process.stderr.write("[prim] daemon remains explicitly disabled\n");
   } else if (result.state === "running") {
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ensured under launchd (${result.action})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ensured under launchd (${result.action})`, snapshot)}
 `
     );
   } else {
@@ -3923,7 +4134,8 @@ async function daemonEnsure() {
         ensured: result.state === "running",
         disabled: result.state === "disabled",
         supervised: true,
-        action: result.action
+        action: result.action,
+        ...daemonBacklogFields(snapshot)
       },
       null,
       2
@@ -4958,11 +5170,11 @@ function asRecord(value, path) {
   }
   return value;
 }
-function assertKeys(record2, path, required, optional = []) {
+function assertKeys(record3, path, required, optional = []) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
-  const missing = required.find((key) => !Object.hasOwn(record2, key));
+  const missing = required.find((key) => !Object.hasOwn(record3, key));
   if (missing !== void 0) contractError(path, `is missing ${missing}`);
-  const extra = Object.keys(record2).find((key) => !allowed.has(key));
+  const extra = Object.keys(record3).find((key) => !allowed.has(key));
   if (extra !== void 0) contractError(path, `contains unexpected field ${extra}`);
 }
 function asString(value, path, options) {
@@ -4992,97 +5204,97 @@ function asSha(value, path) {
   if (!SHA_RE.test(sha)) contractError(path, "must be a canonical lowercase Git commit SHA");
   return sha;
 }
-function optionalString(record2, key, path, max) {
-  if (!Object.hasOwn(record2, key)) return void 0;
-  return asString(record2[key], `${path}.${key}`, { max, nonempty: true });
+function optionalString(record3, key, path, max) {
+  if (!Object.hasOwn(record3, key)) return void 0;
+  return asString(record3[key], `${path}.${key}`, { max, nonempty: true });
 }
 function parseProposal(value, path) {
-  const record2 = asRecord(value, path);
+  const record3 = asRecord(value, path);
   assertKeys(
-    record2,
+    record3,
     path,
     ["_id", "repoFullName", "deadCommitSha", "status", "signals", "lastEvaluatedAt"],
     ["proposedSha", "proposedTier", "nextEvaluateAt"]
   );
-  const repoFullName = asString(record2.repoFullName, `${path}.repoFullName`, {
+  const repoFullName = asString(record3.repoFullName, `${path}.repoFullName`, {
     max: 200,
     nonempty: true
   });
   if (!REPO_FULL_NAME_RE.test(repoFullName)) {
     contractError(`${path}.repoFullName`, "must be canonical owner/repository syntax");
   }
-  const status = record2.status;
+  const status = record3.status;
   if (status !== "proposed" && status !== "confirmed" && status !== "verification_failed") {
     contractError(`${path}.status`, "is not a review-visible proposal status");
   }
-  if (!Array.isArray(record2.signals) || record2.signals.length > MAX_SIGNALS) {
+  if (!Array.isArray(record3.signals) || record3.signals.length > MAX_SIGNALS) {
     contractError(`${path}.signals`, "must be a bounded array");
   }
-  const signals = record2.signals.map(
+  const signals = record3.signals.map(
     (signal, index) => asString(signal, `${path}.signals[${String(index)}]`, {
       max: MAX_SIGNAL_LENGTH,
       nonempty: true
     })
   );
-  const proposedSha = Object.hasOwn(record2, "proposedSha") ? asSha(record2.proposedSha, `${path}.proposedSha`) : void 0;
+  const proposedSha = Object.hasOwn(record3, "proposedSha") ? asSha(record3.proposedSha, `${path}.proposedSha`) : void 0;
   let proposedTier;
-  if (Object.hasOwn(record2, "proposedTier")) {
-    if (record2.proposedTier !== "exact_patch_body" && record2.proposedTier !== "exact_file_set") {
+  if (Object.hasOwn(record3, "proposedTier")) {
+    if (record3.proposedTier !== "exact_patch_body" && record3.proposedTier !== "exact_file_set") {
       contractError(`${path}.proposedTier`, "is not a supported match tier");
     }
-    proposedTier = record2.proposedTier;
+    proposedTier = record3.proposedTier;
   }
-  const nextEvaluateAt = Object.hasOwn(record2, "nextEvaluateAt") ? asTimestamp(record2.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
+  const nextEvaluateAt = Object.hasOwn(record3, "nextEvaluateAt") ? asTimestamp(record3.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
   return {
-    _id: asString(record2._id, `${path}._id`, { max: 256, nonempty: true }),
+    _id: asString(record3._id, `${path}._id`, { max: 256, nonempty: true }),
     repoFullName,
-    deadCommitSha: asSha(record2.deadCommitSha, `${path}.deadCommitSha`),
+    deadCommitSha: asSha(record3.deadCommitSha, `${path}.deadCommitSha`),
     status,
     proposedSha,
     proposedTier,
     signals,
-    lastEvaluatedAt: asTimestamp(record2.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
+    lastEvaluatedAt: asTimestamp(record3.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
     nextEvaluateAt
   };
 }
 function parseDecision(value, path) {
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
-  const status = record2.status;
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
+  const status = record3.status;
   if (status !== "provisional" && status !== "abandoned") {
     contractError(`${path}.status`, "is not a repairable decision status");
   }
   return {
-    _id: asString(record2._id, `${path}._id`, { max: 256, nonempty: true }),
-    shortId: optionalString(record2, "shortId", path, 128),
-    intent: asString(record2.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
+    _id: asString(record3._id, `${path}._id`, { max: 256, nonempty: true }),
+    shortId: optionalString(record3, "shortId", path, 128),
+    intent: asString(record3.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
     status,
-    intentTruncated: asBoolean(record2.intentTruncated, `${path}.intentTruncated`)
+    intentTruncated: asBoolean(record3.intentTruncated, `${path}.intentTruncated`)
   };
 }
 function parseListItem(value, path) {
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, [
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, [
     "proposal",
     "decisions",
     "affectedDecisionCount",
     "decisionsTruncated",
     "reviewToken"
   ]);
-  if (!Array.isArray(record2.decisions) || record2.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+  if (!Array.isArray(record3.decisions) || record3.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
     contractError(`${path}.decisions`, "must be a bounded array");
   }
-  const decisions = record2.decisions.map(
+  const decisions = record3.decisions.map(
     (decision, index) => parseDecision(decision, `${path}.decisions[${String(index)}]`)
   );
-  const proposal = parseProposal(record2.proposal, `${path}.proposal`);
-  const decisionsTruncated = asBoolean(record2.decisionsTruncated, `${path}.decisionsTruncated`);
-  const affectedDecisionCount = record2.affectedDecisionCount === null ? null : asCount(record2.affectedDecisionCount, `${path}.affectedDecisionCount`);
+  const proposal = parseProposal(record3.proposal, `${path}.proposal`);
+  const decisionsTruncated = asBoolean(record3.decisionsTruncated, `${path}.decisionsTruncated`);
+  const affectedDecisionCount = record3.affectedDecisionCount === null ? null : asCount(record3.affectedDecisionCount, `${path}.affectedDecisionCount`);
   let reviewToken;
-  if (record2.reviewToken === null) {
+  if (record3.reviewToken === null) {
     reviewToken = null;
   } else {
-    reviewToken = asString(record2.reviewToken, `${path}.reviewToken`, {
+    reviewToken = asString(record3.reviewToken, `${path}.reviewToken`, {
       max: 64,
       nonempty: true
     });
@@ -5115,19 +5327,19 @@ function parseListItem(value, path) {
 }
 function parseListPage(value, pageNumber) {
   const path = `page ${String(pageNumber)}`;
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, ["repairs", "isDone", "nextCursor", "truncated"]);
-  if (!Array.isArray(record2.repairs) || record2.repairs.length > MAX_REPAIRS_PER_PAGE) {
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, ["repairs", "isDone", "nextCursor", "truncated"]);
+  if (!Array.isArray(record3.repairs) || record3.repairs.length > MAX_REPAIRS_PER_PAGE) {
     contractError(`${path}.repairs`, "must be a bounded array");
   }
-  const isDone = asBoolean(record2.isDone, `${path}.isDone`);
-  const truncated = asBoolean(record2.truncated, `${path}.truncated`);
+  const isDone = asBoolean(record3.isDone, `${path}.isDone`);
+  const truncated = asBoolean(record3.truncated, `${path}.truncated`);
   if (truncated === isDone) contractError(path, "has inconsistent isDone/truncated flags");
   let nextCursor;
-  if (record2.nextCursor === null) {
+  if (record3.nextCursor === null) {
     nextCursor = null;
   } else {
-    nextCursor = asString(record2.nextCursor, `${path}.nextCursor`, {
+    nextCursor = asString(record3.nextCursor, `${path}.nextCursor`, {
       max: MAX_CURSOR_LENGTH,
       nonempty: true
     });
@@ -5135,7 +5347,7 @@ function parseListPage(value, pageNumber) {
   if (isDone && nextCursor !== null) contractError(path, "is done but includes a next cursor");
   if (!isDone && nextCursor === null) contractError(path, "is incomplete without a next cursor");
   return {
-    repairs: record2.repairs.map(
+    repairs: record3.repairs.map(
       (item, index) => parseListItem(item, `${path}.repairs[${String(index)}]`)
     ),
     isDone,
@@ -5213,23 +5425,23 @@ function normalizedResolutionInput(proposalId, expectedProposedSha) {
   return { proposalId, expectedProposedSha: expectedProposedSha.toLowerCase() };
 }
 function parseResolutionOutcome(value, action) {
-  const record2 = asRecord(value, "resolution response");
+  const record3 = asRecord(value, "resolution response");
   const allowed = action === "confirm" ? ["confirmed", "already_applied", "disabled", "no_op", "stale"] : ["rejected", "already_applied", "no_op", "stale"];
-  if (record2.status === "backoff") {
-    assertKeys(record2, "resolution response", ["status", "retryAt"]);
+  if (record3.status === "backoff") {
+    assertKeys(record3, "resolution response", ["status", "retryAt"]);
     if (action !== "confirm") {
       contractError("resolution response.status", "backoff is impossible for reject");
     }
     return {
       status: "backoff",
-      retryAt: asTimestamp(record2.retryAt, "resolution response.retryAt")
+      retryAt: asTimestamp(record3.retryAt, "resolution response.retryAt")
     };
   }
-  assertKeys(record2, "resolution response", ["status"]);
-  if (typeof record2.status !== "string" || !allowed.includes(record2.status)) {
+  assertKeys(record3, "resolution response", ["status"]);
+  if (typeof record3.status !== "string" || !allowed.includes(record3.status)) {
     contractError("resolution response.status", "is not a supported outcome");
   }
-  return { status: record2.status };
+  return { status: record3.status };
 }
 function normalizedReviewToken(value) {
   if (value === void 0 || !REVIEW_TOKEN_INPUT_RE.test(value)) {
@@ -5240,18 +5452,18 @@ function normalizedReviewToken(value) {
   return value.toLowerCase();
 }
 function parseConflictOutcome(value, action) {
-  const record2 = asRecord(value, "resolution conflict response");
-  assertKeys(record2, "resolution conflict response", ["status"]);
+  const record3 = asRecord(value, "resolution conflict response");
+  assertKeys(record3, "resolution conflict response", ["status"]);
   if (action !== "confirm") {
     contractError(
       "resolution conflict response.status",
       "a review conflict is impossible for reject"
     );
   }
-  if (record2.status !== "review_too_large" && record2.status !== "stale_review") {
+  if (record3.status !== "review_too_large" && record3.status !== "stale_review") {
     contractError("resolution conflict response.status", "is not a supported 409 outcome");
   }
-  return { status: record2.status };
+  return { status: record3.status };
 }
 async function resolveRepair(proposalId, expectedProposedSha, action, expectedReviewToken, deps = defaultDeps6) {
   const normalized = normalizedResolutionInput(proposalId, expectedProposedSha);
@@ -6306,6 +6518,7 @@ function registerDecisionsCommands(program2) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync6 } from "fs";
+import { Option as Option4 } from "commander";
 
 // src/protocol/decision-lifecycle.ts
 var DECISION_LIFECYCLE_PROTOCOL_VERSION = 2;
@@ -6330,28 +6543,35 @@ function parseOrganizationBinding(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { state: "server_contract_unavailable" };
   }
-  const record2 = value;
-  if (record2.authenticated !== true || record2.organizationBindingVersion !== ORGANIZATION_BINDING_VERSION || !isCaptureAuthorityKind(record2.captureAuthorityKind)) {
+  const record3 = value;
+  if (record3.authenticated !== true || record3.organizationBindingVersion !== ORGANIZATION_BINDING_VERSION || !isCaptureAuthorityKind(record3.captureAuthorityKind)) {
     return { state: "server_contract_unavailable" };
   }
-  if (record2.organizationId === null && record2.workosOrganizationId === null) {
+  if (record3.organizationId === null && record3.workosOrganizationId === null) {
     return { state: "no_current_organization" };
   }
-  if (safeOrganizationId(record2.organizationId) && record2.workosOrganizationId === null) {
+  if (safeOrganizationId(record3.organizationId) && record3.workosOrganizationId === null) {
     return { state: "organization_identity_unreconciled" };
   }
-  if (!safeOrganizationId(record2.organizationId) || !safeOrganizationId(record2.workosOrganizationId)) {
+  if (!safeOrganizationId(record3.organizationId) || !safeOrganizationId(record3.workosOrganizationId)) {
     return { state: "server_contract_unavailable" };
   }
   return {
     state: "current",
     binding: {
-      captureAuthorityKind: record2.captureAuthorityKind,
-      organizationId: record2.organizationId,
-      workosOrganizationId: record2.workosOrganizationId
+      captureAuthorityKind: record3.captureAuthorityKind,
+      organizationId: record3.organizationId,
+      workosOrganizationId: record3.workosOrganizationId
     }
   };
 }
+function summarizeRetainedBuckets(retained) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const item of retained) {
+    counts.set(item.reason, (counts.get(item.reason) ?? 0) + 1);
+  }
+  return [...counts].sort(([left], [right]) => left.localeCompare(right)).map(([reason, count]) => `${reason}:${String(count)}`).join(", ");
+}
 function classifyJournalBuckets(buckets, binding) {
   const deliverableBuckets = /* @__PURE__ */ new Set();
   const retainedBuckets = [];
@@ -6423,7 +6643,7 @@ async function inspectJournalDelivery(buckets, options = {}) {
 }
 
 // src/commands/hermes-install.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 import { Document, isMap, isSeq, parseAllDocuments, stringify, visit } from "yaml";
@@ -6831,7 +7051,7 @@ function readConfigSnapshot(path) {
   if (!existsSync5(path)) return { exists: false, mode: CONFIG_MODE, raw: "" };
   return {
     exists: true,
-    mode: statSync(path).mode & 511,
+    mode: statSync2(path).mode & 511,
     raw: readFileSync5(path, "utf8")
   };
 }
@@ -6973,7 +7193,6 @@ function registerHermesCommands(program2) {
 // src/commands/doctor.ts
 var DAEMON_PROBE_TIMEOUT_MS = 500;
 var CONNECTIVITY_TIMEOUT_MS = 3e3;
-var MS_PER_SECOND = 1e3;
 var STALE_PENDING_MS = 3e4;
 var EXIT_UNHEALTHY = 1;
 function classifyDoctor(checks) {
@@ -7095,8 +7314,19 @@ function classifyDaemonHealth(snapshot, options = {}) {
     };
   }
   if (!snapshot.ingestion?.healthy) {
-    const pending = snapshot.ingestion?.pendingCount ?? 0;
-    const pendingLabel = snapshot.ingestion?.pendingSampled ? `at least ${String(pending)}` : String(pending);
+    if (options.backlogExpected && deliveryBacklogState(snapshot.ingestion) === "draining") {
+      const ingestionStatus2 = options.ingestionStatus ?? decisionIngestionStatus(process.cwd());
+      const live = options.backlog;
+      const progress = live && live.pendingCount === 0 && live.pendingSampled !== true ? "backlog drained; daemon health refreshes on its next sweep" : deliveryBacklogSummary(snapshot.ingestion, options.now, live);
+      return {
+        name: "daemon",
+        status: "warn",
+        detail: `supervised and live${snapshot.version ? ` \xB7 v${snapshot.version}` : ""} \xB7 Decision ingestion ${ingestionStatus2} \xB7 ${progress}`
+      };
+    }
+    const counts = options.backlog ?? snapshot.ingestion;
+    const pending = counts?.pendingCount ?? 0;
+    const pendingLabel = counts?.pendingSampled ? `at least ${String(pending)}` : String(pending);
     return {
       name: "daemon",
       status: "fail",
@@ -7113,17 +7343,23 @@ function classifyDaemonHealth(snapshot, options = {}) {
     detail: `supervised and healthy${snapshot.version ? ` \xB7 v${snapshot.version}` : ""} \xB7 Decision ingestion ${ingestionStatus}`
   };
 }
-async function checkDaemon() {
+async function probeDelivery() {
+  const stats = pendingJournalStats();
+  const now = Date.now();
+  const disabled = daemonExplicitlyDisabled();
+  const expectedVersion = packageVersion();
   let service;
   if (process.platform === "darwin") {
     try {
       service = getLaunchdService();
     } catch (error) {
-      const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
       return {
-        name: "daemon",
-        status: "fail",
-        detail: `launchd status unavailable${detail ? `: ${detail}` : ""}`
+        snapshot: null,
+        launchdError: error instanceof Error ? error.message : String(error),
+        disabled,
+        expectedVersion,
+        stats,
+        now
       };
     }
   }
@@ -7132,53 +7368,74 @@ async function checkDaemon() {
     { callerEnv: getSiteUrl() },
     { timeoutMs: DAEMON_PROBE_TIMEOUT_MS }
   );
-  return classifyDaemonHealth(snapshot, {
-    disabled: daemonExplicitlyDisabled(),
-    service,
-    expectedVersion: packageVersion()
+  return { snapshot, service, disabled, expectedVersion, stats, now };
+}
+function daemonCheckVouchesForDrain(check) {
+  return check.name === "daemon" && check.status !== "fail";
+}
+function classifyDelivery(probe, options = {}) {
+  const { stats, now } = probe;
+  const launchdDetail = probe.launchdError === void 0 ? void 0 : boundedHealthError(probe.launchdError);
+  const daemon = probe.launchdError === void 0 ? classifyDaemonHealth(probe.snapshot, {
+    disabled: probe.disabled,
+    service: probe.service,
+    ingestionStatus: probe.ingestionStatus,
+    expectedVersion: probe.expectedVersion,
+    backlogExpected: options.backlogExpected,
+    backlog: {
+      pendingCount: stats.pendingCount,
+      pendingSampled: stats.sampled,
+      oldestPendingAt: stats.oldestPendingAt
+    },
+    now
+  }) : {
+    name: "daemon",
+    status: "fail",
+    detail: `launchd status unavailable${launchdDetail ? `: ${launchdDetail}` : ""}`
+  };
+  const journal = classifyJournal(stats, now, {
+    backlogExpected: options.backlogExpected === true && daemonCheckVouchesForDrain(daemon)
   });
+  return [daemon, journal, classifyStranded(stats)];
 }
-function checkJournal() {
-  const stats = pendingJournalStats();
+function classifyJournal(stats, now, options = {}) {
   const pending = stats.pendingCount;
   const pendingLabel = stats.sampled ? `at least ${String(pending)}` : String(pending);
+  const backlog = (detail) => options.backlogExpected ? {
+    name: "journal",
+    status: "warn",
+    detail: `${formatPendingBacklog(
+      {
+        pendingCount: pending,
+        pendingSampled: stats.sampled,
+        oldestPendingAt: stats.oldestPendingAt
+      },
+      now
+    )} \u2014 draining in the background`
+  } : { name: "journal", status: "fail", detail };
   if (pending === 0) {
     if (stats.sampled) {
-      return {
-        name: "journal",
-        status: "fail",
-        detail: "bounded journal sample could not prove the queue is empty"
-      };
+      return backlog("bounded journal sample could not prove the queue is empty");
     }
     return { name: "journal", status: "ok", detail: "no pending moves" };
   }
   if (stats.oldestPendingAt === void 0) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending with no readable capture timestamp`
-    };
+    const detail = `${pendingLabel} pending with no readable capture timestamp`;
+    return stats.sampled ? backlog(detail) : { name: "journal", status: "fail", detail };
   }
-  const oldestMs = Date.now() - stats.oldestPendingAt;
+  const oldestMs = now - stats.oldestPendingAt;
   const oldestS = Math.round(oldestMs / MS_PER_SECOND);
   if (oldestMs > STALE_PENDING_MS) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending, oldest observed ${String(oldestS)}s \u2014 30s delivery SLA missed`
-    };
+    return backlog(
+      `${pendingLabel} pending, oldest observed ${String(oldestS)}s \u2014 30s delivery SLA missed`
+    );
   }
   if (stats.sampled) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending in bounded sample; 30s delivery SLA cannot be proven`
-    };
+    return backlog(`${pendingLabel} pending in bounded sample; 30s delivery SLA cannot be proven`);
   }
   return { name: "journal", status: "ok", detail: `${String(pending)} pending, draining` };
 }
-function checkStranded() {
-  const stats = pendingJournalStats();
+function classifyStranded(stats) {
   if (stats.strandedFileCount === 0 && !stats.strandedSampled) {
     return { name: "stranded", status: "ok", detail: "none" };
   }
@@ -7204,15 +7461,10 @@ function classifyJournalOrganization(bucketCount, retainedBuckets) {
       detail: "all pending buckets match the active credential"
     };
   }
-  const reasonCounts = /* @__PURE__ */ new Map();
-  for (const item of retainedBuckets) {
-    reasonCounts.set(item.reason, (reasonCounts.get(item.reason) ?? 0) + 1);
-  }
-  const reasons = [...reasonCounts].sort(([left], [right]) => left.localeCompare(right)).map(([reason, count]) => `${reason}:${String(count)}`).join(", ");
   return {
     name: "journal-org",
     status: "fail",
-    detail: `${String(retainedBuckets.length)} bucket(s) retained (${reasons})`
+    detail: `${String(retainedBuckets.length)} bucket(s) retained (${summarizeRetainedBuckets(retainedBuckets)})`
   };
 }
 async function checkJournalOrganization() {
@@ -7623,30 +7875,37 @@ function refreshOwnedGlobalHooksForHealth() {
   } catch {
   }
 }
-async function collectChecks() {
+async function independentChecks() {
   refreshOwnedGlobalHooksForHealth();
   const backend = await checkBackend();
-  return [
-    checkAuth(),
-    await checkDaemon(),
-    checkJournal(),
-    checkStranded(),
-    await checkJournalOrganization(),
-    checkFeedbackHooks(),
-    ...checkAgentHooks(),
-    checkHookRuntime(),
-    await checkRepositoryBinding(),
-    checkManagedHook("post-commit", inspectEffectivePostCommitHook),
-    checkManagedHook("post-rewrite", inspectEffectivePostRewriteHook),
-    ...backend,
-    await checkFeedbackCapability()
-  ];
+  return {
+    before: [checkAuth()],
+    after: [
+      await checkJournalOrganization(),
+      checkFeedbackHooks(),
+      ...checkAgentHooks(),
+      checkHookRuntime(),
+      await checkRepositoryBinding(),
+      checkManagedHook("post-commit", inspectEffectivePostCommitHook),
+      checkManagedHook("post-rewrite", inspectEffectivePostRewriteHook),
+      ...backend,
+      await checkFeedbackCapability()
+    ]
+  };
+}
+var DEFAULT_DOCTOR_PROBES = {
+  delivery: probeDelivery,
+  independent: independentChecks
+};
+async function collectChecks(options, probes) {
+  const { before, after } = await probes.independent();
+  return [...before, ...classifyDelivery(await probes.delivery(), options), ...after];
 }
 function icon(status) {
   return status === "ok" ? "\u2713" : status === "warn" ? "\u26A0" : "\u2717";
 }
-async function runDoctor() {
-  const checks = await collectChecks();
+async function runDoctor(options, probes) {
+  const checks = await collectChecks(options, probes);
   const { json, exitCode } = classifyDoctor(checks);
   const headline = json.status === "ok" ? "\u2713 healthy" : json.status === "warn" ? "\u26A0 degraded" : "\u2717 unhealthy";
   process.stderr.write(`[prim] doctor: ${headline}
@@ -7660,11 +7919,14 @@ async function runDoctor() {
     process.exitCode = exitCode;
   }
 }
-function registerDoctorCommands(program2) {
+function registerDoctorCommands(program2, dependencies = {}) {
   program2.command("doctor").description(
     "Check capture and feedback health end to end (auth, supervisor, delivery, server)"
-  ).action(async () => {
-    await runDoctor();
+  ).addOption(new Option4("--expect-backlog").hideHelp()).action(async (opts) => {
+    await runDoctor(
+      { backlogExpected: opts.expectBacklog === true },
+      dependencies.probes ?? DEFAULT_DOCTOR_PROBES
+    );
   });
 }
 
@@ -7673,20 +7935,20 @@ import { existsSync as existsSync8, mkdirSync as mkdirSync5, unlinkSync as unlin
 import { join as join9 } from "path";
 
 // src/flusher.ts
-import { createReadStream, renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
+import { createReadStream, renameSync as renameSync3, statSync as statSync3, unlinkSync as unlinkSync3 } from "fs";
 import { dirname as dirname4, join as join8 } from "path";
 
 // src/dead-letter.ts
 import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 import {
-  constants as constants2,
+  constants as constants3,
   chmodSync as chmodSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   existsSync as existsSync7,
   fchmodSync,
   fsyncSync,
   mkdirSync as mkdirSync4,
-  openSync as openSync2,
+  openSync as openSync3,
   renameSync as renameSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync3
@@ -7709,7 +7971,7 @@ function ensureDeadLetterDirectory(flushingPath, persistDirectory) {
   persistDirectory(dirname3(directory));
   return directory;
 }
-function persistDeadLetter(directory, path, quarantineId, record2, persistDirectory) {
+function persistDeadLetter(directory, path, quarantineId, record3, persistDirectory) {
   if (existsSync7(path)) {
     persistDirectory(directory);
     return;
@@ -7718,16 +7980,16 @@ function persistDeadLetter(directory, path, quarantineId, record2, persistDirect
     directory,
     `.${quarantineId}.${String(process.pid)}.${randomBytes4(8).toString("hex")}.tmp`
   );
-  const flags = constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | constants2.O_NOFOLLOW;
+  const flags = constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | constants3.O_NOFOLLOW;
   try {
-    const fd = openSync2(temporaryPath, flags, FILE_MODE);
+    const fd = openSync3(temporaryPath, flags, FILE_MODE);
     try {
       fchmodSync(fd, FILE_MODE);
-      writeFileSync3(fd, `${JSON.stringify(record2)}
+      writeFileSync3(fd, `${JSON.stringify(record3)}
 `, "utf8");
       fsyncSync(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
     renameSync2(temporaryPath, path);
     persistDirectory(directory);
@@ -7739,22 +8001,22 @@ function quarantineMove(flushingPath, move, reason, now = Date.now, options = {}
   const persistDirectory = options.syncDirectory ?? syncDirectory;
   const directory = ensureDeadLetterDirectory(flushingPath, persistDirectory);
   const serializedMove = JSON.stringify(move);
-  const record2 = {
+  const record3 = {
     version: 1,
     quarantineId: createHash3("sha256").update(serializedMove).digest("hex"),
     quarantinedAt: now(),
     reason,
     move
   };
-  const path = join7(directory, `${record2.quarantineId}.json`);
-  persistDeadLetter(directory, path, record2.quarantineId, record2, persistDirectory);
-  return record2;
+  const path = join7(directory, `${record3.quarantineId}.json`);
+  persistDeadLetter(directory, path, record3.quarantineId, record3, persistDirectory);
+  return record3;
 }
 function quarantineRawLine(flushingPath, rawLine, now = Date.now, options = {}) {
   const persistDirectory = options.syncDirectory ?? syncDirectory;
   const directory = ensureDeadLetterDirectory(flushingPath, persistDirectory);
   const bytes = Buffer.from(rawLine);
-  const record2 = {
+  const record3 = {
     version: 1,
     recordKind: "raw_line_v1",
     quarantineId: createHash3("sha256").update(bytes).digest("hex"),
@@ -7767,18 +8029,22 @@ function quarantineRawLine(flushingPath, rawLine, now = Date.now, options = {})
   persistDeadLetter(
     directory,
     deadLetterPathForRawLine(flushingPath, bytes),
-    record2.quarantineId,
-    record2,
+    record3.quarantineId,
+    record3,
     persistDirectory
   );
-  return record2;
+  return record3;
 }
 
 // src/flusher.ts
 var BATCH_SIZE = 500;
+var BATCH_MAX_BYTES = 1048576;
 var HTTP_TIMEOUT_MS = 1e4;
 var OPPORTUNISTIC_FLUSH_AFTER_MS = 6e4;
 var ORPHAN_QUARANTINE_MS = 6e4;
+function exceedsBatchBytes(count, bytes, nextBytes, maxBytes) {
+  return count > 0 && bytes + nextBytes > maxBytes;
+}
 function addDrainCounts(left, right) {
   return {
     flushed: left.flushed + right.flushed,
@@ -7789,8 +8055,8 @@ function collectionScopeRoots(batch) {
   return batch.flatMap((move) => {
     const env = move.env;
     if (typeof env !== "object" || env === null || Array.isArray(env)) return [];
-    const record2 = env;
-    const root = typeof record2.gitRoot === "string" ? record2.gitRoot : record2.cwd;
+    const record3 = env;
+    const root = typeof record3.gitRoot === "string" ? record3.gitRoot : record3.cwd;
     return typeof root === "string" && root.length > 0 ? [root] : [];
   });
 }
@@ -7798,8 +8064,8 @@ function isVersionedInvalidMoveDisposition(body) {
   if (typeof body !== "object" || body === null || Array.isArray(body)) {
     return false;
   }
-  const record2 = body;
-  return Object.keys(record2).length === 2 && record2.error === "invalid_move" && record2.errorVersion === 1;
+  const record3 = body;
+  return Object.keys(record3).length === 2 && record3.error === "invalid_move" && record3.errorVersion === 1;
 }
 function deadLetterReason(error) {
   if (error instanceof InvalidJournalEnvelopeError) {
@@ -7822,23 +8088,31 @@ function deadLetterReason(error) {
   }
   return void 0;
 }
-async function* rawJournalLines(input) {
+function mayBeBatchSizeFailure(error) {
+  if (error instanceof HttpError) {
+    return error.status >= 500 && error.status !== 503;
+  }
+  return error instanceof Error && error.name === "TimeoutError";
+}
+async function* rawJournalLines(input, offset) {
   let pending = [];
   let pendingBytes = 0;
+  let end = offset;
   for await (const value of input) {
     const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
     let start = 0;
     let newline = chunk.indexOf(10, start);
     while (newline !== -1) {
       const tail = chunk.subarray(start, newline + 1);
-      if (pending.length === 0) {
-        yield tail;
-      } else {
+      let line = tail;
+      if (pending.length > 0) {
         pending.push(tail);
-        yield Buffer.concat(pending, pendingBytes + tail.length);
+        line = Buffer.concat(pending, pendingBytes + tail.length);
         pending = [];
         pendingBytes = 0;
       }
+      end += line.length;
+      yield { bytes: line, end };
       start = newline + 1;
       newline = chunk.indexOf(10, start);
     }
@@ -7849,21 +8123,46 @@ async function* rawJournalLines(input) {
     }
   }
   if (pendingBytes > 0) {
-    yield pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingBytes);
+    const bytes = pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingBytes);
+    yield { bytes, end: end + pendingBytes };
   }
 }
+var drainProgressWarned = false;
 async function drainFlushingPath(flushingPath, client, binding, options = {}) {
+  const rotation = rotationIdentity(statSync3(flushingPath));
+  const resumeAt = drainResumeOffset(flushingPath, rotation);
+  const recordProgress = (end) => {
+    if (end === void 0 || end >= rotation.size) {
+      return;
+    }
+    try {
+      writeDrainCheckpoint(flushingPath, { v: 2, offset: end, ...rotation });
+      drainProgressWarned = false;
+    } catch (error) {
+      if (!drainProgressWarned) {
+        drainProgressWarned = true;
+        process.stderr.write(
+          `[prim] could not record drain progress: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    }
+  };
+  const reportProgress = (delta) => {
+    options.onProgress?.(delta);
+    return delta;
+  };
   const postBatch = async (batch2) => {
+    const moves = batch2.map((entry) => entry.move);
     try {
-      const request = buildOrganizationBoundMoveRequest(batch2, binding);
+      const request = buildOrganizationBoundMoveRequest(moves, binding);
       const response = await client.post("/api/cli/moves/ingest", request, {
         signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
       });
-      requireDurableIngestAcknowledgement(response, batch2.length, collectionScopeRoots(batch2));
-      return { flushed: batch2.length, quarantined: 0 };
+      requireDurableIngestAcknowledgement(response, moves.length, collectionScopeRoots(moves));
     } catch (error) {
       const reason = deadLetterReason(error);
-      if (!reason) {
+      if (!(reason || mayBeBatchSizeFailure(error))) {
         throw error;
       }
       if (batch2.length > 1) {
@@ -7872,33 +8171,46 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
         const right = await postBatch(batch2.slice(midpoint));
         return addDrainCounts(left, right);
       }
-      const [move] = batch2;
+      if (!reason) {
+        throw error;
+      }
+      const [entry] = batch2;
       const quarantined = quarantineMove(
         flushingPath,
-        move,
+        entry.move,
         reason,
         Date.now,
         options.deadLetterPersistence
       );
+      recordProgress(entry.end);
       process.stderr.write(
         `[prim] quarantined rejected move ${quarantined.quarantineId.slice(0, 12)} (${reason})
 `
       );
-      return { flushed: 0, quarantined: 1 };
+      return reportProgress({ flushed: 0, quarantined: 1 });
     }
+    recordProgress(batch2.at(-1)?.end);
+    return reportProgress({ flushed: batch2.length, quarantined: 0 });
   };
-  const input = createReadStream(flushingPath);
+  const input = createReadStream(flushingPath, { start: resumeAt });
   const decoder = new TextDecoder("utf-8", { fatal: true });
   let batch = [];
+  let batchBytes = 0;
   let counts = { flushed: 0, quarantined: 0 };
+  const postPending = async () => {
+    counts = addDrainCounts(counts, await postBatch(batch));
+    batch = [];
+    batchBytes = 0;
+  };
   try {
-    for await (const rawLine of rawJournalLines(input)) {
+    for await (const { bytes: rawLine, end } of rawJournalLines(input, resumeAt)) {
       if (rawLine.length === 1 && rawLine[0] === 10 || rawLine.length === 2 && rawLine[0] === 13 && rawLine[1] === 10) {
         continue;
       }
+      let move;
       try {
         const line = decoder.decode(rawLine);
-        batch.push(JSON.parse(line));
+        move = JSON.parse(line);
       } catch {
         const quarantined = quarantineRawLine(
           flushingPath,
@@ -7910,24 +8222,35 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
           `[prim] quarantined invalid journal line ${quarantined.quarantineId.slice(0, 12)} (invalid_move)
 `
         );
-        counts.quarantined += 1;
+        counts = addDrainCounts(counts, reportProgress({ flushed: 0, quarantined: 1 }));
+        if (batch.length === 0) {
+          recordProgress(end);
+        }
         continue;
       }
-      if (batch.length === BATCH_SIZE) {
-        counts = addDrainCounts(counts, await postBatch(batch));
-        batch = [];
+      if (exceedsBatchBytes(batch.length, batchBytes, rawLine.length, BATCH_MAX_BYTES)) {
+        await postPending();
+      }
+      batch.push({ move, end });
+      batchBytes += rawLine.length;
+      if (batch.length >= BATCH_SIZE) {
+        await postPending();
       }
     }
     if (batch.length > 0) {
-      counts = addDrainCounts(counts, await postBatch(batch));
+      await postPending();
     }
   } finally {
     input.destroy();
   }
   unlinkSync3(flushingPath);
+  try {
+    removeDrainCheckpoint(flushingPath);
+  } catch {
+  }
   return counts;
 }
-async function drainPath(path, client, binding) {
+async function drainPath(path, client, binding, onProgress) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
     renameSync3(path, tmpPath);
@@ -7937,7 +8260,19 @@ async function drainPath(path, client, binding) {
     }
     throw err;
   }
-  return drainFlushingPath(tmpPath, client, binding);
+  return drainFlushingPath(tmpPath, client, binding, { onProgress });
+}
+async function settleDrain(drain) {
+  let progress = { flushed: 0, quarantined: 0 };
+  try {
+    return {
+      counts: await drain((delta) => {
+        progress = addDrainCounts(progress, delta);
+      })
+    };
+  } catch (error) {
+    return { counts: progress, failure: { error } };
+  }
 }
 function selectRecoverable(files, now, opts = {}) {
   const quarantineMs = opts.quarantineMs ?? ORPHAN_QUARANTINE_MS;
@@ -7954,7 +8289,8 @@ async function recoverOrphans(candidates, options) {
     flushed: 0,
     quarantined: 0,
     errors: [],
-    failedBuckets: /* @__PURE__ */ new Set()
+    failedBuckets: /* @__PURE__ */ new Set(),
+    failedDrainFlushed: 0
   };
   const recoverable = selectRecoverable(candidates, options.now ?? Date.now(), {
     ownerPid: options.ownerPid ?? process.pid,
@@ -7965,28 +8301,41 @@ async function recoverOrphans(candidates, options) {
     if (summary.failedBuckets.has(file.bucket)) {
       continue;
     }
-    try {
-      const counts = await drain(file.path);
-      summary.flushed += counts.flushed;
-      summary.quarantined += counts.quarantined;
-    } catch (err) {
-      summary.errors.push(err);
+    const { counts, failure: failure4 } = await settleDrain((onProgress) => drain(file.path, onProgress));
+    summary.flushed += counts.flushed;
+    summary.quarantined += counts.quarantined;
+    if (failure4) {
+      summary.failedDrainFlushed += counts.flushed;
+      summary.errors.push(failure4.error);
       summary.failedBuckets.add(file.bucket);
     }
   }
   return summary;
 }
 var FlushError = class extends Error {
+  /** Moves the whole sweep acknowledged, across every drain it ran. */
   flushed;
   quarantined;
-  constructor(cause, flushed, quarantined) {
+  /** Buckets the failed sweep held back without sending, as on success. */
+  retained;
+  /**
+   * Of `flushed`, the Moves acknowledged by the drains that failed, before
+   * they failed. Only this shows the failure itself is advancing: `flushed`
+   * also counts other buckets' drains, so a bucket whose drain fails every
+   * time would read as progress while a sibling bucket kept delivering.
+   */
+  failedDrainFlushed;
+  constructor(cause, flushed, quarantined, retained = [], failedDrainFlushed = 0) {
     super(cause instanceof Error ? cause.message : String(cause), { cause });
     this.name = "FlushError";
     this.flushed = flushed;
     this.quarantined = quarantined;
+    this.retained = retained;
+    this.failedDrainFlushed = failedDrainFlushed;
   }
 };
 async function flushOnce() {
+  sweepOrphanedDrainProgress();
   const orphanCandidates = listFlushing({ sampleBytes: 0 });
   const liveBuckets = listBuckets();
   if (orphanCandidates.length === 0 && liveBuckets.length === 0) {
@@ -8003,10 +8352,11 @@ async function flushOnce() {
   const binding = inspection.binding;
   const recovered = await recoverOrphans(
     orphanCandidates.filter((file) => inspection.deliverableBuckets.has(file.bucket)),
-    { drain: (path) => drainFlushingPath(path, client, binding) }
+    { drain: (path, onProgress) => drainFlushingPath(path, client, binding, { onProgress }) }
   );
   let total = recovered.flushed;
   let quarantined = recovered.quarantined;
+  let failedDrainFlushed = recovered.failedDrainFlushed;
   const errors = recovered.errors;
   for (const { bucket, path } of liveBuckets) {
     if (!inspection.deliverableBuckets.has(bucket)) {
@@ -8015,16 +8365,24 @@ async function flushOnce() {
     if (recovered.failedBuckets.has(bucket)) {
       continue;
     }
-    try {
-      const counts = await drainPath(path, client, binding);
-      total += counts.flushed;
-      quarantined += counts.quarantined;
-    } catch (err) {
-      errors.push(err);
+    const { counts, failure: failure4 } = await settleDrain(
+      (onProgress) => drainPath(path, client, binding, onProgress)
+    );
+    total += counts.flushed;
+    quarantined += counts.quarantined;
+    if (failure4) {
+      failedDrainFlushed += counts.flushed;
+      errors.push(failure4.error);
     }
   }
   if (errors.length > 0) {
-    throw new FlushError(errors[0], total, quarantined);
+    throw new FlushError(
+      errors[0],
+      total,
+      quarantined,
+      inspection.retainedBuckets,
+      failedDrainFlushed
+    );
   }
   return inspection.retainedBuckets.length > 0 ? { flushed: total, quarantined, retained: inspection.retainedBuckets } : { flushed: total, quarantined };
 }
@@ -8054,18 +8412,16 @@ function flush() {
   return attempt;
 }
 function shouldFlushPending(stats, now, thresholdMs = OPPORTUNISTIC_FLUSH_AFTER_MS) {
-  if (stats.sampled) {
+  if (stats.sampled || stats.strandedFileCount > 0 && stats.strandedCount === 0) {
     return true;
   }
   return stats.pendingCount > 0 && (stats.oldestPendingAt === void 0 || now - stats.oldestPendingAt > thresholdMs);
 }
-async function flushIfNeeded() {
+function journalNeedsFlush(now = Date.now()) {
   try {
-    const stats = pendingJournalStats();
-    if (shouldFlushPending(stats, Date.now())) {
-      await flush();
-    }
+    return shouldFlushPending(pendingJournalStats(), now);
   } catch {
+    return false;
   }
 }
 
@@ -8124,7 +8480,7 @@ function registerMovesCommands(program2) {
     }
     if (stranded.length > 0) {
       const moveCount = stranded.reduce((n, f) => n + f.lineCount, 0);
-      const byteCount = stranded.reduce((n, f) => n + f.sizeBytes, 0);
+      const byteCount = stranded.reduce((n, f) => n + f.pendingBytes, 0);
       const sampled = stranded.some((file) => file.sampled);
       const qualifier = sampled ? "at least " : "";
       console.log(
@@ -8135,7 +8491,7 @@ function registerMovesCommands(program2) {
         const owner = f.pid === void 0 ? "no pid" : `pid ${String(f.pid)}`;
         const count = `${String(f.lineCount)}${f.sampled ? "+" : ""}`;
         console.log(
-          `  ${f.bucket.padEnd(BUCKET_COL_WIDTH)} ${count.padStart(5)} stranded, ${String(f.sizeBytes).padStart(8)} bytes, ${String(ageS)}s ago (${owner})`
+          `  ${f.bucket.padEnd(BUCKET_COL_WIDTH)} ${count.padStart(5)} stranded, ${String(f.pendingBytes).padStart(8)} bytes, ${String(ageS)}s ago (${owner})`
         );
       }
     }
@@ -8333,6 +8689,20 @@ import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
 import { join as join11 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
+var SETUP_ORCHESTRATOR_ENV = "PRIM_SETUP_ORCHESTRATOR";
+var SETUP_DAEMON_DRAINS_ENV = "PRIM_SETUP_DAEMON_DRAINS";
+function setupStepSpawnOptions(capture, env = process.env, options = {}) {
+  return {
+    env: {
+      ...env,
+      [SETUP_ORCHESTRATOR_ENV]: "1",
+      // Unset rather than inherited when this setup starts no daemon.
+      [SETUP_DAEMON_DRAINS_ENV]: options.startsDaemon === true ? "1" : void 0
+    },
+    stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
+    encoding: "utf-8"
+  };
+}
 var SESSION_LABELS = {
   claude: "Claude Code integration",
   codex: "Codex integration",
@@ -8383,7 +8753,7 @@ function planSetupSteps(opts) {
     steps.push({
       key: "health",
       label: "Capture health",
-      args: ["doctor"],
+      args: ["doctor", "--expect-backlog"],
       required: true
     });
   }
@@ -8483,10 +8853,11 @@ function registerSetupCommand(program2, dependencies = {}) {
     const self = process.argv[1];
     const globals = program2.optsWithGlobals();
     const run = dependencies.run ?? ((args, capture = false) => {
-      const r = spawnSync2(process.execPath, [self, ...args], {
-        stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
-        encoding: "utf-8"
-      });
+      const r = spawnSync2(
+        process.execPath,
+        [self, ...args],
+        setupStepSpawnOptions(capture, process.env, { startsDaemon: opts.daemon })
+      );
       return { code: r.status ?? 1, stdout: capture ? r.stdout ?? "" : "" };
     });
     const results = {};
@@ -9007,28 +9378,233 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
   });
 }
 
+// src/daemon/drift-heal.ts
+var ATTEMPT_MARKER_MODE = 384;
+var ATTEMPT_MARKER_MAX_BYTES = 1024;
+var PATH_SEPARATORS = /[\\/]/u;
+var DAEMON_DRIFT_HEAL_ENV = "PRIM_DAEMON_DRIFT_HEAL";
+var DAEMON_DRIFT_HEAL_RETRY_MS = 60 * 60 * 1e3;
+function readAttempt(path) {
+  const file = readBoundedRegularFile(path, ATTEMPT_MARKER_MAX_BYTES);
+  if (!file) return null;
+  try {
+    const value = JSON.parse(file.text);
+    if (typeof value !== "object" || value === null) return null;
+    const attempt = value;
+    return typeof attempt.attemptedAt === "number" && Number.isFinite(attempt.attemptedAt) && typeof attempt.fromVersion === "string" && typeof attempt.toVersion === "string" ? attempt : null;
+  } catch {
+    return null;
+  }
+}
+function claimHeld() {
+  throw new Error("another command holds the daemon drift-heal claim");
+}
+function claimAttempt(markerPath2, attempt) {
+  const previous = readAttempt(markerPath2);
+  const elapsed = previous ? attempt.attemptedAt - previous.attemptedAt : Number.POSITIVE_INFINITY;
+  if (elapsed >= 0 && elapsed < DAEMON_DRIFT_HEAL_RETRY_MS) return false;
+  atomicWriteFile(markerPath2, `${JSON.stringify(attempt)}
+`, { mode: ATTEMPT_MARKER_MODE });
+  return true;
+}
+function isInstalledPackage(root) {
+  return root?.split(PATH_SEPARATORS).includes("node_modules") === true;
+}
+function needsHeal(launcher, toVersion) {
+  const order = compareSemver(launcher.runtimeVersion, toVersion);
+  return order === -1 || order === 0 && !launcher.runnable;
+}
+function startDriftHeal(options) {
+  if ((options.platform ?? process.platform) !== "darwin") return false;
+  const env = options.env ?? process.env;
+  if (env[DAEMON_DRIFT_HEAL_ENV] === "0") return false;
+  const root = options.packageRoot === void 0 ? packageRoot() : options.packageRoot;
+  if (!isInstalledPackage(root)) return false;
+  const euid = options.euid ?? process.geteuid?.();
+  if (euid === void 0 || euid === 0) return false;
+  const paths = { env, homeDir: options.homeDir };
+  if (daemonExplicitlyDisabled(paths)) return false;
+  const launcher = (options.selectedLauncher ?? (() => selectedDaemonLauncher(paths)))();
+  if (!launcher || launcher.ownerUid !== euid) return false;
+  const toVersion = options.cliVersion === void 0 ? packageVersion() : options.cliVersion;
+  if (!(toVersion && needsHeal(launcher, toVersion))) return false;
+  if (!apiUrlsMatch(
+    getSiteUrlForEnvironment(launcher.apiUrl),
+    getSiteUrlForEnvironment(env.PRIM_API_URL)
+  )) {
+    return false;
+  }
+  const runsConfigRoot = options.launchAgentRunsConfigRoot ?? (() => launchAgentRunsConfigRoot(paths));
+  if (!runsConfigRoot()) return false;
+  const primEntry = options.primEntry === void 0 ? binFile("prim") : options.primEntry;
+  if (!primEntry) return false;
+  const attempt = {
+    attemptedAt: (options.nowMs ?? Date.now)(),
+    fromVersion: launcher.runtimeVersion,
+    toVersion
+  };
+  const claimed = withFileLockSync(
+    daemonDriftHealClaimPath(paths),
+    () => claimAttempt(daemonDriftHealMarkerPath(paths), attempt),
+    { timeoutMs: 0, sleep: claimHeld }
+  );
+  if (!claimed) return false;
+  return kickDaemonEnsure({
+    primEntry,
+    nodeEntry: options.nodeEntry,
+    spawnProcess: options.spawnProcess,
+    latestBootstrap: false
+  });
+}
+function healDaemonDrift(options = {}) {
+  try {
+    return startDriftHeal(options);
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/background-flush.ts
+import { spawn as spawn3 } from "child_process";
+import { readFileSync as readFileSync9 } from "fs";
+
+// src/daemon/health.ts
+import { chmodSync as chmodSync3, existsSync as existsSync11, mkdirSync as mkdirSync7, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+var HEARTBEAT_FRESH_MS = 9e4;
+var DAEMON_HEALTH_PATH = join12(primConfigDirectory(), "daemon-health.json");
+
+// src/lib/background-flush.ts
+function record2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function daemonOwnsDrain(options = {}) {
+  try {
+    const expectedVersion = options.expectedVersion === void 0 ? packageVersion() : options.expectedVersion;
+    if (!expectedVersion) return false;
+    const health = record2(
+      JSON.parse(readFileSync9(options.healthPath ?? DAEMON_HEALTH_PATH, "utf8"))
+    );
+    const heartbeat = record2(health?.heartbeat);
+    const ingestion = record2(health?.ingestion);
+    if (!(health && heartbeat && ingestion)) return false;
+    if (health.schemaVersion !== 1 || health.version !== expectedVersion) return false;
+    const daemonSiteUrl = health.siteUrl;
+    if (typeof daemonSiteUrl !== "string" || envSlug(daemonSiteUrl) !== envSlug(options.siteUrl ?? getSiteUrl())) {
+      return false;
+    }
+    if (health.needsReauth === true) return false;
+    const pid = health.pid;
+    if (typeof pid !== "number" || !(options.isAlive ?? processIsAlive)(pid)) return false;
+    const lastSuccessAt = heartbeat.lastSuccessAt;
+    const now = options.now ?? Date.now();
+    return heartbeat.consecutiveFailures === 0 && typeof lastSuccessAt === "number" && lastSuccessAt <= now && now - lastSuccessAt < HEARTBEAT_FRESH_MS && ingestion.consecutiveFailures === 0;
+  } catch {
+    return false;
+  }
+}
+function startBackgroundFlush(options = {}) {
+  try {
+    if ((options.daemonOwnsDrain ?? daemonOwnsDrain)()) return false;
+    if (!(options.needsFlush ?? journalNeedsFlush)()) return false;
+    const primEntry = options.primEntry === void 0 ? binFile("prim") : options.primEntry;
+    if (!primEntry) return false;
+    const child = (options.spawnProcess ?? spawn3)(
+      options.nodeEntry ?? process.execPath,
+      [primEntry, "moves", "flush"],
+      // Ignored stdio matters as much as detaching: a child holding inherited
+      // pipes would keep a caller that captures them (spawnSync) waiting.
+      // windowsHide keeps the detached child from opening a console window.
+      // The child is unattended even when its parent is not: `doctor` or
+      // `statusline` must not reach the daemon drift heal through its drain.
+      { detached: true, stdio: "ignore", windowsHide: true, env: unattendedEnv() }
+    );
+    child.once("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/startup-background.ts
 var ROOT_OPTIONS = /* @__PURE__ */ new Set(["-y", "--yes", "--non-interactive"]);
+var HELP_OPTIONS = /* @__PURE__ */ new Set(["-h", "--help"]);
+var DAEMON_HEAL_COMMANDS = /* @__PURE__ */ new Map([
+  // Credentials; `auth login` is how a person returns to a daemon held for re-auth.
+  ["auth", /* @__PURE__ */ new Set(["api-keys", "login", "set-token", "status"])],
+  // Reading and curating the decision graph: the everyday attended surface.
+  [
+    "decisions",
+    /* @__PURE__ */ new Set([
+      "cascade",
+      "check",
+      "confirm",
+      "create",
+      "demote",
+      "link",
+      "promote",
+      "publish",
+      "ratify",
+      "recent",
+      "repairs",
+      "rescope",
+      "restore",
+      "show",
+      "supersede",
+      "unlink",
+      "withdraw"
+    ])
+  ],
+  ["reconcile", "any"],
+  // Repository connection, activation, and journal plumbing a person steers.
+  // Hook-side `moves flush` drains are unattended and never reach this table.
+  ["github", /* @__PURE__ */ new Set(["connect"])],
+  ["enable", "any"],
+  ["moves", /* @__PURE__ */ new Set(["bind", "drop", "flush", "status", "tail"])],
+  ["session", /* @__PURE__ */ new Set(["drop", "list", "start"])],
+  // Installing or inspecting an integration, never removing one.
+  ["claude", /* @__PURE__ */ new Set(["install", "preauth", "status"])],
+  ["codex", /* @__PURE__ */ new Set(["install", "status"])],
+  ["cursor", /* @__PURE__ */ new Set(["install", "status"])],
+  ["hermes", /* @__PURE__ */ new Set(["install", "status"])],
+  ["hooks", /* @__PURE__ */ new Set(["install"])],
+  ["skill", /* @__PURE__ */ new Set(["install", "status"])],
+  ["welcome", "any"]
+]);
 function commandArguments(argv) {
   let index = 0;
   while (ROOT_OPTIONS.has(argv[index] ?? "")) index += 1;
   return argv.slice(index);
 }
+function mayHealDaemon(argv, env) {
+  if (isUnattended(env) || env[SETUP_ORCHESTRATOR_ENV] === "1") return false;
+  const args = commandArguments(argv);
+  if (args.some((arg) => HELP_OPTIONS.has(arg))) return false;
+  const [command, subcommand] = args;
+  const allowed = command === void 0 ? void 0 : DAEMON_HEAL_COMMANDS.get(command);
+  if (allowed === void 0) return false;
+  return allowed === "any" || subcommand !== void 0 && allowed.has(subcommand);
+}
 function runStartupBackgroundWork(argv, env, work) {
-  const [command, subcommand] = commandArguments(argv);
+  const args = commandArguments(argv);
+  const [command, subcommand] = args;
   const uninstall = command === "uninstall" || env[UNINSTALL_ORCHESTRATOR_ENV] === "1";
   if (uninstall) return;
   work.notify();
-  if (command !== "moves" || subcommand !== "flush") work.flush().catch(() => {
-  });
+  const setupDaemonDrains = command === "setup" && !args.includes("--no-daemon") || env[SETUP_DAEMON_DRAINS_ENV] === "1";
+  if (!setupDaemonDrains && (command !== "moves" || subcommand !== "flush")) work.flush();
+  if (mayHealDaemon(argv, env)) work.healDaemon();
 }
 
 // src/index.ts
-var __dirname = dirname6(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync9(resolve4(__dirname, "../package.json"), "utf-8"));
+var __dirname = dirname7(fileURLToPath2(import.meta.url));
+var pkg = JSON.parse(readFileSync10(resolve4(__dirname, "../package.json"), "utf-8"));
 runStartupBackgroundWork(process.argv.slice(2), process.env, {
   notify: () => updateNotifier({ pkg }).notify(),
-  flush: () => flushIfNeeded()
+  flush: () => startBackgroundFlush(),
+  healDaemon: () => healDaemonDrift()
 });
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(