@primitive.ai/prim 0.1.0-alpha.92 → 0.1.0-alpha.94

package/dist/index.js

@@ -2,57 +2,76 @@
 import {
   bindRepository,
   bindRepositoryWithClient,
-  ensureEffectivePostCommitHook,
-  ensureEffectivePostRewriteHook,
-  ensurePostCommitHookAtPath,
-  ensurePostRewriteHookAtPath,
-  inspectEffectivePostCommitHook,
-  inspectEffectivePostRewriteHook,
-  postCommitHookBlock,
-  postRewriteHookBlock,
+  ensureEffectiveGitHook,
+  ensureGitHookAtPath,
+  externalHookRemedy,
+  gitHooksMode,
+  hasCurrentHookBlock,
+  inspectEffectiveGitHook,
+  isLegacyOwnedGlobalHook,
+  isOwnedStandalonePreCommit,
+  kickDaemonEnsure,
   printJson,
+  projectGitHookTarget,
+  projectHooksDir,
   registerSkillCommands,
+  resolveEffectiveGitHook,
   resolveRepositoryBinding,
-  uninstallPostCommitHookAtPath,
-  uninstallPostRewriteHookAtPath,
-  uninstallProjectPostCommitHook,
-  uninstallProjectPostRewriteHook
-} from "./chunk-LGGMJYY4.js";
+  uninstallGitHookAtPath,
+  uninstallProjectGitHook
+} from "./chunk-WUXFLE7X.js";
+import {
+  POST_COMMIT_GRACE_MS,
+  clearHooksWired,
+  inspectPostCommitFiring,
+  recordHooksWired
+} from "./chunk-FXF4JWK2.js";
 import {
   requireDurableIngestAcknowledgement
-} from "./chunk-FKXFUUWJ.js";
+} from "./chunk-TYAHC25F.js";
 import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-5GYQ4J3D.js";
+} from "./chunk-UKUAAAXE.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-5AFRMOPX.js";
+} from "./chunk-OH3EZXYX.js";
+import {
+  isUnattended,
+  unattendedEnv
+} from "./chunk-OYHYCK4K.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
   bucketStats,
+  drainResumeOffset,
+  envSlug,
   listBuckets,
   listFlushing,
   pendingJournalStats,
-  readMovesFromPath
-} from "./chunk-FBAYCS3X.js";
+  readMovesFromPath,
+  removeDrainCheckpoint,
+  rotationIdentity,
+  sweepOrphanedDrainProgress,
+  writeDrainCheckpoint
+} from "./chunk-DXJQR4QI.js";
 import {
+  MS_PER_SECOND,
+  deliveryBacklogState,
+  deliveryBacklogSummary,
+  formatPendingBacklog,
   formatStatusline,
   formatTeammates,
   repositoryBindingDiagnosticLabel
-} from "./chunk-WX52U7Z2.js";
+} from "./chunk-ZU563PQI.js";
 import {
   bold,
   boundedHealthError,
   color,
   colorForArea,
-  dim,
-  stripAnsi
-} from "./chunk-BTNNEH2W.js";
-import {
   decisionIngestionStatus,
+  dim,
   fetchAndCacheCollectScope,
   isCliErrorResponse,
   isDecisionIdRequest,
@@ -66,10 +85,12 @@ import {
   isMoveIngestRequest,
   isRepoActiveForCapture,
   isValidRepoSyncId,
+  repoActiveFlag,
   repoSyncId,
   repositoryBindingState,
-  setRepoActive
-} from "./chunk-M6RIJVRE.js";
+  setRepoActive,
+  stripAnsi
+} from "./chunk-DSWT6BCC.js";
 import {
   CliManagementResponseError,
   HttpError,
@@ -79,14 +100,16 @@ import {
   getPinnedClient,
   getPinnedManagementClient,
   getSiteUrl,
+  getSiteUrlForEnvironment,
   getTokenExpiresAt,
   isSessionEnded,
   refreshToken,
   setStoredToken,
   stripControlChars,
   terminalSafeLine
-} from "./chunk-PCVGBE5B.js";
+} from "./chunk-G2VMA2QO.js";
 import {
+  MANAGED_GIT_HOOK_NAMES,
   assertOwnedHookRuntime,
   atomicWrite,
   binFile,
@@ -96,14 +119,16 @@ import {
   entryHasCommand,
   hookCommandResolutions,
   hookRuntimePaths,
+  inspectGitHookEntrypoint,
   inspectHookRuntime,
   inspectHookRuntimeResolutions,
   inspectHookRuntimeResolutions2,
   makeRegistration,
+  managedHookBlock,
+  packageRoot,
   packageVersion,
   performStatus,
   performStatus2,
-  pinnedHookCommand,
   pinnedNpxArgs,
   projectRoot,
   readSettings,
@@ -111,9 +136,10 @@ import {
   registerCursorCommands,
   removeHookRuntime,
   stableHookCommand,
+  stableNodePath,
   stageHookRuntime,
   stripCommand
-} from "./chunk-26P57LAR.js";
+} from "./chunk-AXQQMX2U.js";
 import {
   canonicalGitRoot,
   canonicalRepositoryPath,
@@ -122,7 +148,7 @@ import {
 import {
   daemonIsLive,
   daemonRequest
-} from "./chunk-KFXF2V5G.js";
+} from "./chunk-OTHKG76J.js";
 import {
   REFRESH_TOKEN_PATH,
   TOKEN_FILE_PATH,
@@ -135,11 +161,12 @@ import {
   requestWorkosDeviceAuthorization,
   resolveAuthCredential,
   syncDirectory,
-  withFileLock
-} from "./chunk-67VNLLBN.js";
+  withFileLock,
+  withFileLockSync
+} from "./chunk-2GP5UFV7.js";
 
 // src/index.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { dirname as dirname6, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
@@ -749,18 +776,18 @@ function parseAuthBrokerConfig(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("broker config must be an object");
   }
-  const record2 = value;
-  if (typeof record2.authorization_server !== "string" || !record2.authorization_server.trim()) {
+  const record3 = value;
+  if (typeof record3.authorization_server !== "string" || !record3.authorization_server.trim()) {
     throw new Error("authorization_server is required");
   }
-  if (typeof record2.client_id !== "string" || !record2.client_id.trim()) {
+  if (typeof record3.client_id !== "string" || !record3.client_id.trim()) {
     throw new Error("client_id is required");
   }
-  if (!Array.isArray(record2.default_scopes) || !record2.default_scopes.every((scope) => typeof scope === "string" && scope.length > 0)) {
+  if (!Array.isArray(record3.default_scopes) || !record3.default_scopes.every((scope) => typeof scope === "string" && scope.length > 0)) {
     throw new Error("default_scopes must be a string array");
   }
-  const authorizationServer = parseHttpUrl(record2.authorization_server, "authorization_server");
-  const rawEndpoint = record2.authorization_endpoint === void 0 ? DEFAULT_WORKOS_AUTHORIZE_URL : record2.authorization_endpoint;
+  const authorizationServer = parseHttpUrl(record3.authorization_server, "authorization_server");
+  const rawEndpoint = record3.authorization_endpoint === void 0 ? DEFAULT_WORKOS_AUTHORIZE_URL : record3.authorization_endpoint;
   if (typeof rawEndpoint !== "string" || !rawEndpoint.trim()) {
     throw new Error("authorization_endpoint must be a URL");
   }
@@ -771,8 +798,8 @@ function parseAuthBrokerConfig(value) {
   return {
     authorization_server: authorizationServer.toString(),
     authorization_endpoint: authorizationEndpoint.toString(),
-    client_id: record2.client_id.trim(),
-    default_scopes: [...record2.default_scopes]
+    client_id: record3.client_id.trim(),
+    default_scopes: [...record3.default_scopes]
   };
 }
 async function fetchAuthBrokerConfig(siteUrl, fetchImpl = fetch) {
@@ -1335,8 +1362,8 @@ import {
   writeFileSync
 } from "fs";
 import { homedir } from "os";
-import { dirname, join, resolve } from "path";
-import { Option } from "commander";
+import { join, resolve } from "path";
+import { Argument, Option } from "commander";
 var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
 var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
 var POST_REWRITE = { hookName: "post-rewrite", binName: "prim-post-rewrite" };
@@ -1352,84 +1379,15 @@ var PRIM_BLOCK_START = blockMarkers(PRE_COMMIT).start;
 var PRIM_BLOCK_END = blockMarkers(PRE_COMMIT).end;
 var PRIM_MANAGED_MARK = "prim-managed-hook";
 var PRIM_CREATED_MARK = "prim-created-hook";
-function hookShim(binName) {
-  return `{ ${pinnedHookCommand(binName)}; } || true`;
-}
-function gatedShim(binName) {
-  return `if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
-${hookShim(binName)}
-fi`;
-}
-function dotGitScript(spec) {
-  return `#!/bin/sh
-# prim ${spec.hookName} hook \u2014 installed by: prim hooks install (${PRIM_MANAGED_MARK})
-
-${hookShim(spec.binName)}
-`;
-}
-function isOwnedStandalonePreCommit(content) {
-  if (content === "#!/bin/sh\nprim-pre-commit\n") return true;
-  const prefix = `#!/bin/sh
-# prim pre-commit hook \u2014 installed by: prim hooks install (${PRIM_MANAGED_MARK})
-
-`;
-  const suffix = "; } || true\n";
-  if (!content.startsWith(prefix) || !content.endsWith(suffix)) return false;
-  const body = content.slice(prefix.length, -suffix.length);
-  if (!body.startsWith("{ ") || /[\r\n]/u.test(body)) return false;
-  return commandMatchesBin(body.slice(2), PRE_COMMIT.binName);
-}
-function huskyBlock(spec) {
-  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
-  if (spec.hookName === POST_REWRITE.hookName) return postRewriteHookBlock();
-  const { start, end } = blockMarkers(spec);
-  return `${start}
-${hookShim(spec.binName)}
-${end}`;
-}
-function gatedBlock(spec) {
-  if (spec.hookName === POST_COMMIT.hookName) return postCommitHookBlock();
-  if (spec.hookName === POST_REWRITE.hookName) return postRewriteHookBlock();
-  const { start, end } = blockMarkers(spec);
-  return `${start}
-${gatedShim(spec.binName)}
-${end}`;
-}
-function primBlockRange(existing, spec) {
-  const { start, end } = blockMarkers(spec);
-  const starts = existing.split(start).length - 1;
-  const ends = existing.split(end).length - 1;
-  if (starts === 0 && ends === 0) return null;
-  const from = existing.indexOf(start);
-  const endAt = existing.indexOf(end);
-  if (starts !== 1 || ends !== 1 || endAt < from) {
-    throw new Error(`malformed Prim hook markers for ${spec.hookName}`);
-  }
-  return { start: from, through: endAt + end.length };
-}
-function mergePrimBlock(hookPath, block, spec) {
-  if (existsSync2(hookPath)) {
-    const existing = readFileSync2(hookPath, "utf-8");
-    const range = primBlockRange(existing, spec);
-    if (range) {
-      const refreshed = existing.slice(0, range.start) + block + existing.slice(range.through);
-      if (refreshed === existing) return false;
-      writeFileSync(hookPath, refreshed, { mode: 493 });
-      return true;
-    }
-    if (containsPrimHook(existing, spec.binName)) return false;
-    const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    writeFileSync(hookPath, `${existing}${separator}${block}
-`, { mode: 493 });
+function stageGitHookRuntime() {
+  try {
+    stageHookRuntime();
     return true;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    console.error(`[prim] git hooks stay inert until the hook runtime is staged: ${detail}`);
+    return false;
   }
-  mkdirSync(dirname(hookPath), { recursive: true });
-  writeFileSync(hookPath, `#!/bin/sh
-# ${PRIM_CREATED_MARK}
-
-${block}
-`, { mode: 493 });
-  return true;
 }
 function getGitRoot() {
   const root = gitToplevel();
@@ -1456,52 +1414,6 @@ function detectHusky(gitRoot) {
   }
   return false;
 }
-function containsPrimHook(content, binName = PRE_COMMIT.binName) {
-  return content.includes(binName);
-}
-function installToHusky(gitRoot, spec = PRE_COMMIT) {
-  const hookPath = resolve(gitRoot, ".husky", spec.hookName);
-  const existed = existsSync2(hookPath);
-  const wrote = mergePrimBlock(hookPath, huskyBlock(spec), spec);
-  if (!wrote) {
-    console.log(`Prim ${spec.hookName} hook is already installed in .husky/${spec.hookName}.`);
-  } else if (existed) {
-    console.log(`Appended prim hook block to .husky/${spec.hookName}.`);
-  } else {
-    console.log(`Created .husky/${spec.hookName} with prim hook block.`);
-  }
-}
-function installToDotGit(gitRoot, spec = PRE_COMMIT) {
-  const hooksDir = projectHooksDir(gitRoot);
-  const hookPath = resolve(hooksDir, spec.hookName);
-  if (!existsSync2(hooksDir)) {
-    mkdirSync(hooksDir, { recursive: true });
-  }
-  if (existsSync2(hookPath)) {
-    const existing = readFileSync2(hookPath, "utf-8");
-    if (containsPrimHook(existing, spec.binName)) {
-      console.log(`Prim ${spec.hookName} hook is already installed at ${hookPath}.`);
-      return;
-    }
-    console.log(`A ${spec.hookName} hook already exists at ${hookPath}.`);
-    console.log("To replace it, run: prim hooks uninstall && prim hooks install");
-    return;
-  }
-  writeFileSync(hookPath, dotGitScript(spec), { mode: 493 });
-  console.log(`Installed ${spec.hookName} hook at ${hookPath}`);
-}
-function projectHooksDir(gitRoot) {
-  const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
-    cwd: gitRoot,
-    encoding: "utf-8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: GIT_TIMEOUT_MS
-  }).trim();
-  if (commonDir === "") {
-    throw new Error("git returned an empty common directory");
-  }
-  return resolve(gitRoot, commonDir, "hooks");
-}
 var PRIM_GIT_HOOKS_DIR = join(primConfigDirectory(), "git-hooks");
 function expandTilde(p) {
   return p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
@@ -1540,21 +1452,17 @@ var PASSTHROUGH_HOOKS = [
   //  with a query protocol, not a lifecycle event, so a bare exec stub is wrong.)
 ];
 function globalHookScript(spec) {
-  const chainExit = spec.hookName === PRE_COMMIT.hookName ? "|| exit $?" : "|| true";
-  const managedBlock = spec.hookName === POST_COMMIT.hookName ? postCommitHookBlock() : spec.hookName === POST_REWRITE.hookName ? postRewriteHookBlock() : void 0;
-  const invocation = managedBlock ?? gatedShim(spec.binName);
-  const managedRepoGuard = managedBlock ? ` && ! grep -Fq '${blockMarkers(spec).start.slice(0, -3)}'">>>" "$repo_hook" 2>/dev/null` : "";
-  const beforeComments = managedBlock ? `${invocation}
-` : "";
-  const afterComments = managedBlock ? "" : `${invocation}
-`;
+  const preCommit = spec.hookName === PRE_COMMIT.hookName;
+  const chainExit = preCommit ? "|| exit $?" : "|| true";
+  const managedRepoGuard = preCommit ? "" : ` && ! grep -Fq '${blockMarkers(spec).start.slice(0, -3)}'">>>" "$repo_hook" 2>/dev/null`;
   return `#!/bin/sh
-${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+${managedHookBlock(spec.hookName)}
+# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
 # Install/uninstall: prim hooks install|uninstall --scope user
 # Runs prim only where activated \u2014 'prim enable' (this repo) or
 # 'git config --global prim.active true' (every repo). Chains to the repo's own
 # hook regardless, so inactive repos are unaffected.
-${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
 repo_hook="$common_dir/hooks/${spec.hookName}"
 if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null${managedRepoGuard}; then
   "$repo_hook" "$@" ${chainExit}
@@ -1579,30 +1487,12 @@ function expectedOwnedHookContent(hookName) {
   }
   return null;
 }
-var PINNED_PACKAGE_VERSION_RE = /@primitive\.ai\/prim@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?/gu;
-function normalizeOwnedGlobalHook(content, hookName) {
-  if (hookName === PRE_COMMIT.hookName) {
-    const lines = content.split("\n");
-    const invocationIndexes = lines.flatMap(
-      (line2, index) => line2.startsWith("{ ") && line2.endsWith("; } || true") ? [index] : []
-    );
-    if (invocationIndexes.length !== 1) return null;
-    const invocationIndex = invocationIndexes[0];
-    const line = lines[invocationIndex];
-    const command = line.slice(2, -"; } || true".length);
-    if (!commandMatchesBin(command, PRE_COMMIT.binName)) return null;
-    lines[invocationIndex] = "{ <recognized Prim pre-commit invocation>; } || true";
-    return lines.join("\n");
-  }
-  return content.replace(PINNED_PACKAGE_VERSION_RE, "@primitive.ai/prim@<version>");
-}
 function isExpectedOwnedGlobalHook(content, hookName) {
   const expected = expectedOwnedHookContent(hookName);
   if (expected === null) return false;
   if (content === expected) return true;
-  const normalized = normalizeOwnedGlobalHook(content, hookName);
-  const normalizedExpected = normalizeOwnedGlobalHook(expected, hookName);
-  return normalized !== null && normalized === normalizedExpected;
+  const managed = HOOKS.find((spec) => spec.hookName === hookName);
+  return managed !== void 0 && isLegacyOwnedGlobalHook(content, managed.hookName);
 }
 function lstatIfPresent(path) {
   try {
@@ -1637,6 +1527,12 @@ function assertOwnedHooksDirectorySafeToRemove() {
   return entries;
 }
 function writeOwnHooks() {
+  if (inspectGitHookEntrypoint() !== "ready") {
+    console.error(
+      `[prim] did not write prim's global hooks in ${PRIM_GIT_HOOKS_DIR}: the hook runtime they run is not staged yet. Run \`prim setup\` (or an agent install such as \`prim claude install\`) first, then retry.`
+    );
+    return false;
+  }
   if (!existsSync2(PRIM_GIT_HOOKS_DIR)) {
     mkdirSync(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
@@ -1648,47 +1544,17 @@ function writeOwnHooks() {
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync(resolve(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
   }
+  return true;
 }
 function refreshOwnedGlobalHooks() {
   if (!isOurHooksDir(gitConfigGet("--global"))) return false;
-  writeOwnHooks();
-  return true;
+  return writeOwnHooks();
 }
 function appendPrimBlock(hookPath, spec) {
-  if (spec.hookName === POST_COMMIT.hookName) {
-    ensurePostCommitHookAtPath(hookPath);
-    return;
-  }
-  if (spec.hookName === POST_REWRITE.hookName) {
-    ensurePostRewriteHookAtPath(hookPath);
-    return;
-  }
-  mergePrimBlock(hookPath, gatedBlock(spec), spec);
+  ensureGitHookAtPath(spec.hookName, hookPath);
 }
 function stripPrimBlock(hookPath, spec) {
-  if (spec.hookName === POST_COMMIT.hookName) {
-    uninstallPostCommitHookAtPath(hookPath);
-    return;
-  }
-  if (spec.hookName === POST_REWRITE.hookName) {
-    uninstallPostRewriteHookAtPath(hookPath);
-    return;
-  }
-  if (!existsSync2(hookPath)) return;
-  const existing = readFileSync2(hookPath, "utf-8");
-  const primCreated = existing.includes(PRIM_CREATED_MARK);
-  const range = primBlockRange(existing, spec);
-  if (!range) return;
-  const out = (existing.slice(0, range.start) + existing.slice(range.through)).replace(
-    /\n{2,}$/,
-    "\n"
-  );
-  const remainder = out.replaceAll("#!/bin/sh", "").replaceAll(`# ${PRIM_CREATED_MARK}`, "").trim();
-  if (primCreated && remainder === "") {
-    unlinkSync(hookPath);
-    return;
-  }
-  writeFileSync(hookPath, out, { mode: 493 });
+  uninstallGitHookAtPath(spec.hookName, hookPath);
 }
 function planPreCommitRemoval(hookPath, options) {
   if (!existsSync2(hookPath)) return { path: hookPath, action: "missing" };
@@ -1696,7 +1562,8 @@ function planPreCommitRemoval(hookPath, options) {
   if (options.allowOwnedStandalone && isOwnedStandalonePreCommit(existing)) {
     return { path: hookPath, action: "remove-owned-file" };
   }
-  if (primBlockRange(existing, PRE_COMMIT)) {
+  const { start, end } = blockMarkers(PRE_COMMIT);
+  if (existing.includes(start) || existing.includes(end)) {
     return { path: hookPath, action: "strip-block" };
   }
   if (existing.includes(PRE_COMMIT.binName) || existing.includes(PRIM_MANAGED_MARK) || existing.includes(PRIM_CREATED_MARK)) {
@@ -1706,79 +1573,172 @@ function planPreCommitRemoval(hookPath, options) {
   }
   return { path: hookPath, action: "leave-foreign" };
 }
-function applyPreCommitRemoval(plan) {
-  if (plan.action === "remove-owned-file") {
-    unlinkSync(plan.path);
-    console.log(`Removed pre-commit hook at ${plan.path}`);
-  } else if (plan.action === "strip-block") {
-    stripPrimBlock(plan.path, PRE_COMMIT);
-    console.log(`Removed the Prim pre-commit block from ${plan.path}.`);
-  } else if (plan.action === "leave-foreign") {
+function applyPreCommitRemoval(plan, husky) {
+  if (plan.action === "missing") return;
+  if (plan.action === "leave-foreign") {
     console.log(`Left pre-commit hook at ${plan.path} untouched (not a Prim hook).`);
+    return;
   }
+  const result = uninstallGitHookAtPath(PRE_COMMIT.hookName, plan.path, { husky });
+  console.log(
+    result.removedFile ? `Removed pre-commit hook at ${plan.path}` : `Removed the Prim pre-commit block from ${plan.path}.`
+  );
 }
 function uninstallProjectHooks(gitRoot) {
-  const plans = [
-    planPreCommitRemoval(resolve(projectHooksDir(gitRoot), PRE_COMMIT.hookName), {
+  const configured = projectGitHookTarget(PRE_COMMIT.hookName, gitRoot);
+  const destinations = [
+    {
+      path: resolve(projectHooksDir(gitRoot), PRE_COMMIT.hookName),
+      husky: false,
       allowOwnedStandalone: true
-    }),
-    planPreCommitRemoval(resolve(gitRoot, ".husky", PRE_COMMIT.hookName), {
+    },
+    {
+      path: resolve(gitRoot, ".husky", PRE_COMMIT.hookName),
+      husky: true,
       allowOwnedStandalone: false
-    })
-  ];
-  for (const plan of plans) applyPreCommitRemoval(plan);
-  for (const [hookName, uninstall] of [
-    [POST_COMMIT.hookName, uninstallProjectPostCommitHook],
-    [POST_REWRITE.hookName, uninstallProjectPostRewriteHook]
-  ]) {
-    const result = uninstall(gitRoot);
-    if (!result.changed) {
-      console.log(`No Prim ${hookName} block found at ${result.path}.`);
+    },
+    // A shared hooks dir is never stripped on this repository's behalf.
+    ...configured.location === "external" ? [] : [
+      {
+        path: configured.hookPath,
+        husky: configured.kind === "husky_v9",
+        allowOwnedStandalone: false
+      }
+    ]
+  ].filter(
+    (destination, index, all) => all.findIndex((other) => other.path === destination.path) === index
+  );
+  const plans = destinations.map(({ path, husky, allowOwnedStandalone }) => ({
+    plan: planPreCommitRemoval(path, { allowOwnedStandalone }),
+    husky
+  }));
+  for (const { plan, husky } of plans) applyPreCommitRemoval(plan, husky);
+  for (const spec of [POST_COMMIT, POST_REWRITE]) {
+    const result = uninstallProjectGitHook(spec.hookName, gitRoot);
+    if (result.skipped === "external") {
+      console.log(
+        `Left ${result.path} alone: it is outside this repository, and other repositories may run it.`
+      );
+    } else if (!result.changed) {
+      console.log(`No Prim ${spec.hookName} block found at ${result.path}.`);
     } else if (result.removedFile) {
-      console.log(`Removed Prim-created ${hookName} hook at ${result.path}.`);
+      console.log(`Removed Prim-created ${spec.hookName} hook at ${result.path}.`);
     } else {
-      console.log(`Removed the Prim ${hookName} block from ${result.path}.`);
+      console.log(`Removed the Prim ${spec.hookName} block from ${result.path}.`);
     }
   }
 }
-function installGlobalHooks(opts = {}) {
+function globalHooksPathIsPrims() {
+  return isOurHooksDir(gitConfigGet("--global"));
+}
+var EXIT_GLOBAL_HOOKS_NOT_INSTALLED = 3;
+var INSTALLED_OUTCOMES = /* @__PURE__ */ new Set([
+  "installed",
+  "refreshed",
+  "added",
+  "present"
+]);
+function planGlobalHooks(opts = {}) {
   const global = gitConfigGet("--global");
-  if (global === "") {
-    const system = gitConfigGet("--system");
-    if (system !== "" && !isOurHooksDir(system)) {
-      if (!opts.force) {
+  if (gitHooksMode({ global: true }) === "manual") return { action: "manual", global };
+  if (isOurHooksDir(global)) return { action: "refresh" };
+  if (global !== "") {
+    const dir = expandTilde(global);
+    return HOOKS.every((spec) => hasCurrentHookBlock(spec.hookName, resolve(dir, spec.hookName))) ? { action: "present_in_dir", global } : { action: "add_to_dir", global };
+  }
+  const system = gitConfigGet("--system");
+  if (system !== "" && !isOurHooksDir(system)) {
+    return opts.force ? { action: "set_pointer", overridesSystem: system } : { action: "system_declined", system };
+  }
+  return { action: "set_pointer" };
+}
+function planIsMachineWide(plan) {
+  return plan.action === "set_pointer" || plan.action === "add_to_dir";
+}
+function installGlobalHooks(opts = {}) {
+  const plan = planGlobalHooks(opts);
+  switch (plan.action) {
+    case "manual":
+      console.error(
+        isOurHooksDir(plan.global) ? `[prim] prim.gitHooks=manual: left hook files alone, but prim's global hooks in ${PRIM_GIT_HOOKS_DIR} are still active. Run \`prim hooks uninstall --scope user\` to stop them.` : "[prim] prim.gitHooks=manual: left hook files and core.hooksPath untouched. Wire prim yourself with `prim hooks snippet <hook>`."
+      );
+      return "manual";
+    case "system_declined":
+      console.error(
+        `[prim] system core.hooksPath is set to ${plan.system}; a --global set would override it, and prim chains only to .git/hooks (not a system dir), so those hooks would stop firing. Skipped. Either place \`prim hooks snippet <hook>\` in ${plan.system} yourself, or override it with \`prim hooks install --scope user --global-hooks-path --force\`. It changes every repository's hooks: an agent must ask the user before running it.`
+      );
+      return "system_declined";
+    case "refresh":
+      stageGitHookRuntime();
+      if (!writeOwnHooks()) return "runtime_missing";
+      console.log(
+        `Prim global git hooks already active (${PRIM_GIT_HOOKS_DIR}); refreshed scripts.`
+      );
+      return "refreshed";
+    case "present_in_dir":
+      if (!hookRuntimeReady()) {
         console.error(
-          `[prim] system core.hooksPath is set to ${system}; a --global set would override it, and prim chains only to .git/hooks (not a system dir), so those hooks would stop firing. Skipping \u2014 re-run with --force to override, or run per-repo \`prim hooks install\`.`
+          `[prim] prim's hooks are in ${plan.global}, but the hook runtime they run is not staged, so they do nothing yet. Run \`prim setup\` (or an agent install such as \`prim claude install\`), then retry.`
         );
-        return false;
+        return "runtime_missing";
       }
-      console.error(
-        `[prim] --force: overriding system core.hooksPath ${system}; its hooks will no longer fire (prim chains only to .git/hooks).`
-      );
+      console.log(`Prim hooks already present in core.hooksPath dir ${plan.global}.`);
+      return "present";
+    case "set_pointer":
+    case "add_to_dir":
+      break;
+  }
+  if (!hookRuntimeReady()) {
+    console.error(
+      `[prim] did not install prim's global hooks: the hook runtime they run is not staged yet. Run \`prim setup\` (or an agent install such as \`prim claude install\`) first, then retry.`
+    );
+    return "runtime_missing";
+  }
+  if (!opts.machineWide) {
+    console.error(
+      plan.action === "set_pointer" ? plan.overridesSystem !== void 0 ? `[prim] Left git's global hooks alone: setting core.hooksPath would override the system core.hooksPath ${plan.overridesSystem} (its hooks stop firing) and route every repository's hooks through prim. To do that, run \`prim hooks install --scope user --global-hooks-path --force\`. It changes every repository's hooks: an agent must ask the user before running it.` : "[prim] Left git's global hooks alone: setting core.hooksPath would route every repository's hooks through prim. `prim enable` wires each repository you activate. To route every repository through prim instead, run `prim hooks install --scope user --global-hooks-path`. It changes every repository's hooks: an agent must ask the user before running it." : `[prim] Left the hooks in ${plan.global} alone: every repository runs them, so prim edits them only with consent. Repositories that run hooks from there lack prim's hooks until you run \`prim hooks install --scope user --global-hooks-path\`. It changes every repository's hooks: an agent must ask the user before running it.`
+    );
+    return "not_requested";
+  }
+  stageGitHookRuntime();
+  if (plan.action === "add_to_dir") {
+    const dir = expandTilde(plan.global);
+    for (const spec of HOOKS) {
+      appendPrimBlock(resolve(dir, spec.hookName), spec);
     }
-    writeOwnHooks();
-    execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR], {
-      stdio: ["ignore", "ignore", "pipe"],
-      timeout: GIT_TIMEOUT_MS
-    });
     console.log(
-      `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
+      `Added prim hooks into existing core.hooksPath dir ${plan.global} (pointer unchanged).`
     );
-    return true;
+    return "added";
   }
-  if (isOurHooksDir(global)) {
-    writeOwnHooks();
-    console.log(`Prim global git hooks already active (${PRIM_GIT_HOOKS_DIR}); refreshed scripts.`);
-    return true;
-  }
-  const dir = expandTilde(global);
-  for (const spec of HOOKS) {
-    appendPrimBlock(resolve(dir, spec.hookName), spec);
+  if (plan.overridesSystem !== void 0) {
+    console.error(
+      `[prim] --force: overriding system core.hooksPath ${plan.overridesSystem}; its hooks will no longer fire (prim chains only to .git/hooks).`
+    );
   }
+  if (!writeOwnHooks()) return "runtime_missing";
+  execFileSync("git", ["config", "--global", "core.hooksPath", PRIM_GIT_HOOKS_DIR], {
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS
+  });
   console.log(
-    `Appended prim hooks into existing core.hooksPath dir ${global} (pointer unchanged).`
+    `Installed prim global git hooks; set core.hooksPath to ${PRIM_GIT_HOOKS_DIR}. Repos are opt-in: run \`prim enable\` in each repo to capture, or \`git config --global prim.active true\` for all.`
+  );
+  return "installed";
+}
+function hookRuntimeReady() {
+  if (inspectGitHookEntrypoint() === "ready") return true;
+  stageGitHookRuntime();
+  return inspectGitHookEntrypoint() === "ready";
+}
+async function consentToMachineWideHooks(plan, flag, nonInteractive) {
+  if (!planIsMachineWide(plan) || !hookRuntimeReady()) return false;
+  if (flag) return true;
+  if (nonInteractive || !process.stdin.isTTY) return false;
+  return askConfirmation(
+    plan.action === "set_pointer" ? plan.overridesSystem !== void 0 ? `Set git's global core.hooksPath so every repository's hooks run through prim? This overrides the system core.hooksPath ${plan.overridesSystem}, whose hooks stop firing.` : "Set git's global core.hooksPath so every repository's hooks run through prim?" : `Add prim's hooks to ${plan.action === "add_to_dir" ? plan.global : "the global hooks dir"}, which every repository runs?`,
+    process.stderr
   );
-  return true;
 }
 function uninstallGlobalHooks() {
   const global = gitConfigGet("--global");
@@ -1802,26 +1762,75 @@ function uninstallGlobalHooks() {
   }
   console.log("No prim global git hooks found.");
 }
+function reportInstall(result, gitRoot) {
+  const { hookName, path } = result;
+  switch (result.outcome) {
+    case "created":
+      console.log(`Installed prim ${hookName} hook at ${path}.`);
+      return;
+    case "updated":
+      console.log(`Updated prim ${hookName} hook at ${path}.`);
+      return;
+    case "unchanged":
+      console.log(`Already current: prim ${hookName} hook at ${path}.`);
+      return;
+    case "external":
+      console.error(
+        `[prim] ${hookName}: Git runs this repository's hooks from ${path}, outside the repository, so prim left it alone. ${externalHookRemedy(hookName, gitRoot)}.`
+      );
+      return;
+    case "kept":
+      console.error(
+        `[prim] ${hookName}: kept the working pre-v1 prim block at ${path}, outside the repository; it still captures. To upgrade it, ${externalHookRemedy(hookName, gitRoot)}.`
+      );
+      return;
+    case "runtime_missing":
+      console.error(
+        `[prim] ${hookName}: kept the existing prim hook at ${path}; it still works, and its replacement would stay inert until the hook runtime is staged.`
+      );
+      return;
+    default:
+      console.error(`[prim] ${hookName}: left ${path} as it was (${result.outcome}).`);
+  }
+}
 function installHooks(gitRoot, target) {
-  if (target === "husky") {
-    installToHusky(gitRoot, PRE_COMMIT);
-  } else {
-    installToDotGit(gitRoot, PRE_COMMIT);
+  let changed = false;
+  if (target !== "effective") {
+    const effectiveDir = resolveEffectiveGitHook(PRE_COMMIT.hookName, gitRoot).hooksDir;
+    const chosenDir = target === "husky" ? resolve(gitRoot, ".husky") : projectHooksDir(gitRoot);
+    if (resolve(effectiveDir) !== chosenDir && resolve(effectiveDir, "..") !== chosenDir) {
+      console.error(
+        `[prim] note: Git runs this repository's hooks from ${effectiveDir}; hooks in ${chosenDir} will not fire unless that directory chains to them.`
+      );
+    }
   }
-  const postCommit = ensureEffectivePostCommitHook(gitRoot);
-  console.log(
-    `${postCommit.changed ? "Installed" : "Refreshed"} effective post-commit hook at ${postCommit.path}.`
-  );
-  try {
-    const postRewrite = ensureEffectivePostRewriteHook(gitRoot);
-    console.log(
-      `${postRewrite.changed ? "Installed" : "Refreshed"} effective post-rewrite hook at ${postRewrite.path}.`
-    );
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    console.error(`[prim] post-rewrite hook coverage is degraded: ${detail}`);
+  for (const spec of HOOKS) {
+    try {
+      const result = target === "effective" ? ensureEffectiveGitHook(spec.hookName, gitRoot, { context: "explicit" }) : ensureGitHookAtPath(
+        spec.hookName,
+        target === "husky" ? resolve(gitRoot, ".husky", spec.hookName) : resolve(projectHooksDir(gitRoot), spec.hookName),
+        { husky: target === "husky" }
+      );
+      reportInstall(result, gitRoot);
+      if (spec === POST_COMMIT) changed ||= result.changed;
+      if (spec === POST_COMMIT && result.outcome === "external") process.exitCode = 1;
+    } catch (error) {
+      if (spec === POST_COMMIT) throw error;
+      const detail = error instanceof Error ? error.message : String(error);
+      console.error(
+        `[prim] ${spec.hookName} hook coverage is degraded: ${detail}. To wire it by hand, run \`prim hooks snippet ${spec.hookName}\`.`
+      );
+    }
+  }
+  if (repoActiveFlag(gitRoot) === "true") {
+    recordHooksWired(gitRoot, { onlyIfAbsent: !changed });
   }
 }
+function printManualNote(gitRoot) {
+  console.error(
+    `[prim] prim.gitHooks=manual: left the hook files in ${gitRoot} untouched. Wire each hook with \`prim hooks snippet <hook>\`; \`prim doctor\` reports what it finds.`
+  );
+}
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage git hooks");
   hooks.command("install").description(
@@ -1834,20 +1843,47 @@ function registerHooksCommands(program2) {
   ).addOption(
     new Option(
       "--scope <scope>",
-      "project (default, this repo) or user (a global core.hooksPath capturing every repo)"
+      "project (default, this repo) or user (prim's global hooks; needs --global-hooks-path or a yes at a terminal to change git's global config)"
     ).choices(["project", "user"])
-  ).option("--force", "with --scope user, override a system-level core.hooksPath").action(
+  ).option("--force", "with --scope user, override a system-level core.hooksPath").option(
+    "--global-hooks-path",
+    "with --scope user, change git's global hooks so every repository runs prim's hooks"
+  ).action(
     async (opts, command) => {
+      const globals = command.optsWithGlobals();
+      const nonInteractive = isNonInteractive(globals);
       if (opts.scope === "user") {
-        installGlobalHooks({ force: opts.force });
+        const plan = planGlobalHooks({ force: opts.force });
+        const outcome = installGlobalHooks({
+          force: opts.force,
+          machineWide: await consentToMachineWideHooks(
+            plan,
+            opts.globalHooksPath,
+            nonInteractive
+          )
+        });
+        if (outcome === "runtime_missing") {
+          process.exitCode = 1;
+        } else if (opts.globalHooksPath && !INSTALLED_OUTCOMES.has(outcome)) {
+          process.exitCode = EXIT_GLOBAL_HOOKS_NOT_INSTALLED;
+        }
+        return;
+      }
+      if (opts.globalHooksPath) {
+        console.error("[prim] --global-hooks-path applies only with --scope user");
+        process.exitCode = 2;
         return;
       }
-      const globals = command.optsWithGlobals();
-      const nonInteractive = isNonInteractive(globals);
       const gitRoot = getGitRoot();
+      if (gitHooksMode({ cwd: gitRoot }) === "manual") {
+        printManualNote(gitRoot);
+        return;
+      }
+      stageGitHookRuntime();
       if (opts.target === "husky") return installHooks(gitRoot, "husky");
       if (opts.target === "git-hooks") return installHooks(gitRoot, "git-hooks");
-      if (detectHusky(gitRoot)) {
+      const effectiveDir = resolveEffectiveGitHook(PRE_COMMIT.hookName, gitRoot).hooksDir;
+      if (resolve(effectiveDir) === projectHooksDir(gitRoot) && detectHusky(gitRoot)) {
         if (globals.yes) return installHooks(gitRoot, "husky");
         if (nonInteractive) {
           throw new Error(
@@ -1865,10 +1901,25 @@ function registerHooksCommands(program2) {
         } else {
           console.log("Falling back to .git/hooks install.");
         }
+        return installHooks(gitRoot, "git-hooks");
       }
-      installHooks(gitRoot, "git-hooks");
+      installHooks(gitRoot, "effective");
     }
   );
+  hooks.command("snippet").description("Print the block that wires one prim git hook (STDOUT), to place by hand").addArgument(new Argument("<hook>", "git hook").choices(MANAGED_GIT_HOOK_NAMES)).action((hook) => {
+    process.stdout.write(`${managedHookBlock(hook)}
+`);
+    let entrypoint = "<prim config>/prim-git-hook-v1";
+    try {
+      entrypoint = hookRuntimePaths().gitHookEntrypoint;
+    } catch {
+    }
+    process.stderr.write(
+      `[prim] Place this block right after the shebang of your ${hook} hook (in a Husky v8 hook, right after the husky.sh line), before any exit or exec. It runs prim's ${hook} step where prim is installed and enabled, and does nothing elsewhere.${hook === "post-rewrite" ? " It re-arms stdin, so commands after it still read Git's rewrite pairs." : ""}
+[prim] From a hook manager, run \`${entrypoint} ${hook} "$@"\`${hook === "post-rewrite" ? " with Git's stdin" : ""} instead. Set \`git config prim.gitHooks manual\` so prim leaves your hook files alone.
+`
+    );
+  });
   hooks.command("uninstall").description(
     "Remove the prim git hooks (.git/hooks, or the global core.hooksPath with --scope user)"
   ).addOption(
@@ -1888,6 +1939,49 @@ function registerHooksCommands(program2) {
 // src/commands/activation.ts
 var CONNECT_PROMPT = "[prim] GitHub repo connection is required to enable repository-specific file attribution, Conflict Gate verification, and commit correlation. Start the GitHub App connection now?";
 var GITHUB_CONNECTION_REQUIRED = "GitHub repo connection is required before using Primitive in this repository. It enables repository-specific file attribution, Conflict Gate verification, and commit correlation. Run `prim github connect` to complete it.";
+function wireRepositoryHooks(root) {
+  stageGitHookRuntime();
+  refreshOwnedGlobalHooks();
+  const paths = {};
+  let manual = false;
+  let changed = false;
+  for (const hookName of MANAGED_GIT_HOOK_NAMES) {
+    try {
+      const result = ensureEffectiveGitHook(hookName, root, { context: "explicit" });
+      if (result.outcome === "external") {
+        throw new Error(
+          `Git runs this repository's ${hookName} hook from ${result.path}, outside the repository; ${externalHookRemedy(hookName, root)}`
+        );
+      }
+      if (result.outcome === "kept") {
+        process.stderr.write(
+          `[prim] kept the working pre-v1 ${hookName} hook at ${result.path}, outside the repository; to upgrade it, ${externalHookRemedy(hookName, root)}
+`
+        );
+      }
+      if (result.outcome === "runtime_missing") {
+        process.stderr.write(
+          `[prim] kept the working pre-v1 ${hookName} hook at ${result.path}; it is replaced once the hook runtime is staged
+`
+        );
+      }
+      paths[hookName] = result.path;
+      manual ||= result.outcome === "manual";
+      if (hookName === "post-commit") changed ||= result.changed;
+    } catch (error) {
+      if (hookName === "post-commit") throw error;
+      const detail = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[prim] ${hookName} hook coverage is degraded: ${detail}
+`);
+    }
+  }
+  if (manual) {
+    process.stderr.write(
+      "[prim] prim.gitHooks=manual: left hook files untouched; wire them with `prim hooks snippet <hook>`\n"
+    );
+  }
+  return { paths, changed };
+}
 async function maybeConnectRepository(root, globals) {
   if (isNonInteractive(globals)) return void 0;
   const approved = Boolean(globals.yes) || await askConfirmation(CONNECT_PROMPT, process.stderr);
@@ -1907,6 +2001,13 @@ async function maybeConnectRepository(root, globals) {
   }
   return void 0;
 }
+function hookPathFields(paths) {
+  return {
+    ...paths["pre-commit"] ? { preCommitHook: paths["pre-commit"] } : {},
+    ...paths["post-commit"] ? { postCommitHook: paths["post-commit"] } : {},
+    ...paths["post-rewrite"] ? { postRewriteHook: paths["post-rewrite"] } : {}
+  };
+}
 async function applyActivation(active, globals = {}) {
   const root = gitToplevel();
   if (!root) {
@@ -1919,18 +2020,11 @@ async function applyActivation(active, globals = {}) {
   let phase = active ? "post-commit hook coverage" : "local deactivation";
   try {
     let binding;
-    let postCommitHook;
-    let postRewriteHook;
+    let hookPaths = {};
+    let hooksChanged = false;
+    const wasActive = repoActiveFlag(root) === "true";
     if (active) {
-      refreshOwnedGlobalHooks();
-      postCommitHook = ensureEffectivePostCommitHook(root).path;
-      try {
-        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
-`);
-      }
+      ({ paths: hookPaths, changed: hooksChanged } = wireRepositoryHooks(root));
       phase = "GitHub repo connection";
       binding = await bindRepository(root);
     }
@@ -1944,8 +2038,7 @@ async function applyActivation(active, globals = {}) {
           repo: root,
           bindingStatus: binding.status,
           repositoryFullName: binding.repositoryFullName,
-          ...postCommitHook ? { postCommitHook } : {},
-          ...postRewriteHook ? { postRewriteHook } : {}
+          ...hookPathFields(hookPaths)
         });
         process.exitCode = 1;
         return;
@@ -1960,6 +2053,10 @@ async function applyActivation(active, globals = {}) {
     }
     phase = "local activation";
     setRepoActive(root, active);
+    if (!active) clearHooksWired(root);
+    if (active) {
+      recordHooksWired(root, { onlyIfAbsent: wasActive && !hooksChanged });
+    }
     await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
     process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
 `);
@@ -1971,8 +2068,7 @@ async function applyActivation(active, globals = {}) {
         repositoryFullName: binding.repositoryFullName,
         ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
       } : {},
-      ...postCommitHook ? { postCommitHook } : {},
-      ...postRewriteHook ? { postRewriteHook } : {}
+      ...hookPathFields(hookPaths)
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -2177,7 +2273,7 @@ ${line("project", result.project)}`);
 
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
 import { join as join5 } from "path";
 import { Option as Option2 } from "commander";
 
@@ -2250,12 +2346,12 @@ async function runLatestDaemonBootstrap(ensureCurrent, options = {}) {
 import { spawnSync } from "child_process";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 import {
-  constants,
+  constants as constants2,
   accessSync,
   chmodSync,
   copyFileSync,
   existsSync as existsSync3,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   mkdtempSync,
   readFileSync as readFileSync3,
@@ -2264,16 +2360,53 @@ import {
   realpathSync,
   renameSync,
   rmSync,
+  statSync,
   symlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, dirname as dirname2, isAbsolute, join as join4, resolve as resolve2 } from "path";
+import { basename, dirname, isAbsolute, join as join4, resolve as resolve2 } from "path";
+
+// src/lib/bounded-file.ts
+import { constants, closeSync, fstatSync, lstatSync as lstatSync2, openSync, readSync } from "fs";
+function readBoundedRegularFile(path, maxBytes) {
+  let fd;
+  try {
+    const linked = lstatSync2(path);
+    if (!linked.isFile() || linked.size > maxBytes) return void 0;
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.dev !== linked.dev || opened.ino !== linked.ino || opened.size > maxBytes) {
+      return void 0;
+    }
+    const buffer = Buffer.allocUnsafe(opened.size + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const count = readSync(fd, buffer, length, buffer.length - length, length);
+      if (count === 0) break;
+      length += count;
+    }
+    if (length > opened.size) return void 0;
+    return { text: buffer.subarray(0, length).toString("utf8"), ownerUid: opened.uid };
+  } catch {
+    return void 0;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
 
 // src/daemon/env-binding.ts
 function normalizeApiUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
+function apiUrlsMatch(a, b) {
+  return normalizeApiUrl(a) === normalizeApiUrl(b);
+}
 
 // src/daemon/launchd.ts
 var LAUNCHD_LABEL = "ai.getprimitive.prim-daemon";
@@ -2292,6 +2425,11 @@ var SERVICE_NOT_FOUND = 113;
 var TRANSITION_IN_PROGRESS = 5;
 var OUTPUT_LIMIT = 4096;
 var DAEMON_DISABLED_CONTENT = "disabled by `prim daemon stop`\n";
+var LAUNCHER_MAX_BYTES = 64 * 1024;
+var PLIST_MAX_BYTES = 64 * 1024;
+var DRIFT_HEAL_MARKER = "daemon-drift-heal.json";
+var DRIFT_HEAL_MARKER_TEMPORARY_RE = /^daemon-drift-heal\.json\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.tmp$/u;
+var DRIFT_HEAL_CLAIM_OWNER = "owner.json";
 var LaunchctlError = class extends Error {
   status;
   timedOut;
@@ -2331,13 +2469,15 @@ function daemonControlPaths(options = {}) {
   return {
     launcher: join4(configDir, `prim-daemon-launcher-v${LAUNCHER_SCHEMA_VERSION}`),
     disabledMarker: join4(configDir, "daemon.disabled"),
+    driftHealMarker: join4(configDir, DRIFT_HEAL_MARKER),
+    driftHealClaim: join4(configDir, "daemon-drift-heal.lock"),
     lifecycleLockDir: join4(configDir, "daemon.lifecycle.lock"),
     legacyDisabledMarker: legacy.disabledMarker,
     legacyLifecycleLockDir: legacy.lifecycleLockDir
   };
 }
 function findPackageVersion(entryFile) {
-  let dir = dirname2(resolve2(entryFile));
+  let dir = dirname(resolve2(entryFile));
   for (let depth = 0; depth < 6; depth++) {
     const packagePath = join4(dir, "package.json");
     if (existsSync3(packagePath)) {
@@ -2349,7 +2489,7 @@ function findPackageVersion(entryFile) {
       } catch {
       }
     }
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -2391,7 +2531,7 @@ function readOwnedRuntimeManifest(releaseDir) {
     }
     const manifest = parsed;
     if (manifest.schemaVersion !== RUNTIME_SCHEMA_VERSION || compareSemver(manifest.version, manifest.version) !== 0 || !isAbsolute(manifest.nodePath) || /[\r\n]/u.test(manifest.nodePath) || manifest.daemonFile !== "prim-daemon-server" || !/^[0-9a-f]{64}$/u.test(manifest.daemonSha256) || new Date(manifest.stagedAt).toISOString() !== manifest.stagedAt || raw !== `${JSON.stringify(manifest, null, 2)}
-` || !lstatSync2(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
+` || !lstatSync3(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
       return null;
     }
     const entries = readdirSync2(releaseDir).sort();
@@ -2400,8 +2540,17 @@ function readOwnedRuntimeManifest(releaseDir) {
     return null;
   }
 }
+function sameNode(recorded, desired) {
+  if (recorded === desired) return true;
+  try {
+    const target = realpathSync(desired);
+    return recorded !== target && realpathSync(recorded) === target;
+  } catch {
+    return false;
+  }
+}
 function sameRuntime(current, desired, daemonPath) {
-  if (!current || current.version !== desired.version || current.nodePath !== desired.nodePath || current.daemonSha256 !== desired.daemonSha256) {
+  if (!current || current.version !== desired.version || !sameNode(current.nodePath, desired.nodePath) || current.daemonSha256 !== desired.daemonSha256) {
     return false;
   }
   try {
@@ -2429,7 +2578,7 @@ function stageRuntime(options = {}) {
   if (!daemonSource || !existsSync3(daemonSource)) {
     throw new Error("cannot stage runtime: prim-daemon-server bundle is unavailable");
   }
-  const nodePath = resolve2(options.nodePath ?? process.execPath);
+  const nodePath = resolve2(options.nodePath ?? stableNodePath());
   const version = options.version ?? findPackageVersion(daemonSource);
   const desired = {
     schemaVersion: RUNTIME_SCHEMA_VERSION,
@@ -2528,13 +2677,30 @@ function assertRegularFile(path, label) {
 }
 function lstatIfPresent2(path) {
   try {
-    return lstatSync2(path);
+    return lstatSync3(path);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR") return void 0;
     throw error;
   }
 }
+function driftHealMarkerTemporaries(configDir) {
+  try {
+    return readdirSync2(configDir).filter((entry) => DRIFT_HEAL_MARKER_TEMPORARY_RE.test(entry)).map((entry) => join4(configDir, entry));
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return [];
+    throw error;
+  }
+}
+function assertDriftHealClaim(path) {
+  const claim = lstatIfPresent2(path);
+  if (!claim) return;
+  if (!claim.isDirectory() || readdirSync2(path).some((entry) => entry !== DRIFT_HEAL_CLAIM_OWNER)) {
+    throw new Error(`refusing to remove unrecognized daemon drift-heal claim at ${path}`);
+  }
+  assertRegularFile(join4(path, DRIFT_HEAL_CLAIM_OWNER), "daemon drift-heal claim owner");
+}
 function assertExactFile(path, expected, label) {
   if (!lstatIfPresent2(path)) return;
   assertRegularFile(path, label);
@@ -2573,17 +2739,16 @@ function assertOwnedDaemonRuntime(options) {
     );
   }
   assertRegularFile(logPath, "daemon log");
+  assertRegularFile(control.driftHealMarker, "daemon drift-heal marker");
+  for (const temporary of driftHealMarkerTemporaries(configDir)) {
+    assertRegularFile(temporary, "daemon drift-heal marker temporary");
+  }
+  assertDriftHealClaim(control.driftHealClaim);
   assertRegularFile(join4(configDir, "daemon-health.json"), "daemon health snapshot");
   assertRegularFile(join4(configDir, "client_instance_id"), "daemon client instance id");
   if (service && lstatIfPresent2(service.plistPath)) {
     assertRegularFile(service.plistPath, "launchd property list");
-    const expected = generateLaunchAgentPlist({
-      launcherPath: control.launcher,
-      logPath,
-      workingDirectory: options.homeDir ?? homedir3(),
-      label: options.label
-    });
-    if (readFileSync3(service.plistPath, "utf8") !== expected) {
+    if (readFileSync3(service.plistPath, "utf8") !== ownedLaunchAgentPlist(options, logPath)) {
       throw new Error(
         `refusing to remove unrecognized launchd property list at ${service.plistPath}`
       );
@@ -2660,6 +2825,9 @@ async function removeDaemonRuntime(options = {}) {
     control.launcher,
     control.disabledMarker,
     control.legacyDisabledMarker,
+    control.driftHealMarker,
+    ...driftHealMarkerTemporaries(configDir),
+    control.driftHealClaim,
     ...service ? [service.plistPath] : [],
     logPath,
     join4(configDir, "daemon-health.json"),
@@ -2671,7 +2839,7 @@ async function removeDaemonRuntime(options = {}) {
   return withDaemonLifecycleLock(async () => {
     assertOwnedDaemonRuntime(options);
     for (const path of ownedArtifacts.filter((candidate) => candidate !== runtime.runtimeDir)) {
-      rmSync(path, { force: true });
+      rmSync(path, { force: true, recursive: path === control.driftHealClaim });
     }
     if (lstatIfPresent2(runtime.runtimeDir)) {
       const quarantined = `${runtime.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes3(8).toString("hex")}`;
@@ -2705,9 +2873,22 @@ ${config.configDir ? `export PRIM_CONFIG_DIR=${shellQuote(config.configDir)}
 `
   };
 }
+function ownedLaunchAgentPlist(options, logPath) {
+  return generateLaunchAgentPlist({
+    launcherPath: daemonControlPaths(options).launcher,
+    logPath,
+    workingDirectory: options.homeDir ?? homedir3(),
+    label: options.label
+  });
+}
 function readDaemonLauncher(path) {
+  return readDaemonLauncherFile(path)?.config ?? null;
+}
+function readDaemonLauncherFile(path) {
   try {
-    const content = readFileSync3(path, "utf8");
+    const file = readBoundedRegularFile(path, LAUNCHER_MAX_BYTES);
+    if (!file) return null;
+    const content = file.text;
     const encoded = /^# prim-daemon-launcher: ([A-Za-z0-9_-]+)$/mu.exec(content)?.[1];
     if (!encoded) return null;
     const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
@@ -2722,7 +2903,7 @@ function readDaemonLauncher(path) {
       ...typeof value.configDir === "string" ? { configDir: value.configDir } : {}
     };
     const expected = generateDaemonLauncher(config);
-    return expected.revision === value.revision && expected.content === content ? config : null;
+    return expected.revision === value.revision && expected.content === content ? { config, ownerUid: file.ownerUid } : null;
   } catch {
     return null;
   }
@@ -2730,9 +2911,9 @@ function readDaemonLauncher(path) {
 function readUsableDaemonConfig(path) {
   const config = readDaemonLauncher(path);
   if (!config) return null;
-  const manifest = readRuntimeManifest(join4(dirname2(config.daemonPath), "manifest.json"));
+  const manifest = readRuntimeManifest(join4(dirname(config.daemonPath), "manifest.json"));
   try {
-    accessSync(config.nodePath, constants.X_OK);
+    accessSync(config.nodePath, constants2.X_OK);
     return manifest?.version === config.runtimeVersion && manifest.nodePath === config.nodePath && manifest.daemonSha256 === sha256File(config.daemonPath) ? config : null;
   } catch {
     return null;
@@ -2824,7 +3005,7 @@ function atomicWrite2(path, content, mode, validate) {
     }
   } catch {
   }
-  mkdirSync2(dirname2(path), { recursive: true, mode: RUNTIME_DIR_MODE });
+  mkdirSync2(dirname(path), { recursive: true, mode: RUNTIME_DIR_MODE });
   const temp = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync2(temp, content, { encoding: "utf8", mode, flag: "wx" });
   try {
@@ -2860,7 +3041,7 @@ function canonicalProspectivePath(path) {
   const suffix = [];
   let ancestor = resolve2(path);
   while (!existsSync3(ancestor)) {
-    const parent = dirname2(ancestor);
+    const parent = dirname(ancestor);
     if (parent === ancestor) return resolve2(path);
     suffix.unshift(basename(ancestor));
     ancestor = parent;
@@ -3076,6 +3257,68 @@ function setDaemonExplicitlyDisabled(disabled, options = {}) {
   }
   atomicWrite2(paths.disabledMarker, content, RUNTIME_FILE_MODE);
 }
+function launcherRunnable(config) {
+  try {
+    accessSync(config.nodePath, constants2.X_OK);
+    return statSync(config.daemonPath).isFile();
+  } catch {
+    return false;
+  }
+}
+function selectedDaemonLauncher(options = {}) {
+  const file = readDaemonLauncherFile(daemonControlPaths(options).launcher);
+  if (!file) return null;
+  const { config, ownerUid } = file;
+  return {
+    runtimeVersion: config.runtimeVersion,
+    ...config.apiUrl ? { apiUrl: config.apiUrl } : {},
+    ownerUid,
+    runnable: launcherRunnable(config)
+  };
+}
+var XML_ENTITIES = {
+  "&amp;": "&",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&quot;": '"',
+  "&apos;": "'"
+};
+var XML_ENTITY_RE = /&(?:amp|lt|gt|quot|apos);/gu;
+var PLIST_LABEL_KEY = "<key>Label</key>";
+var PLIST_PROGRAM_KEY = "<key>ProgramArguments</key>";
+var PLIST_LABEL_RE = /<key>Label<\/key>\s*<string>([^<]*)<\/string>/u;
+var PLIST_PROGRAM_RE = /<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]*)<\/string>/u;
+function xmlUnescape(value) {
+  if (value.replace(XML_ENTITY_RE, "").includes("&")) return void 0;
+  return value.replace(XML_ENTITY_RE, (entity) => XML_ENTITIES[entity] ?? entity);
+}
+function launchAgentProgram(plist) {
+  if (plist.split(PLIST_LABEL_KEY).length !== 2 || plist.split(PLIST_PROGRAM_KEY).length !== 2) {
+    return void 0;
+  }
+  const label = PLIST_LABEL_RE.exec(plist)?.[1];
+  const program2 = PLIST_PROGRAM_RE.exec(plist)?.[1];
+  if (label === void 0 || program2 === void 0) return void 0;
+  const decodedLabel = xmlUnescape(label);
+  const decodedProgram = xmlUnescape(program2);
+  return decodedLabel === void 0 || decodedProgram === void 0 ? void 0 : { label: decodedLabel, program: decodedProgram };
+}
+function launchAgentRunsConfigRoot(options = {}) {
+  try {
+    const service = launchdPaths(options);
+    const plist = readBoundedRegularFile(service.plistPath, PLIST_MAX_BYTES);
+    const agent = plist ? launchAgentProgram(plist.text) : void 0;
+    return agent?.label === (options.label ?? LAUNCHD_LABEL) && agent.program === daemonControlPaths(options).launcher;
+  } catch {
+    return false;
+  }
+}
+function daemonDriftHealMarkerPath(options = {}) {
+  return daemonControlPaths(options).driftHealMarker;
+}
+function daemonDriftHealClaimPath(options = {}) {
+  return daemonControlPaths(options).driftHealClaim;
+}
 async function ensureMacDaemon(options = {}) {
   return withDaemonLifecycleLock(() => ensureMacDaemonLocked(options), options);
 }
@@ -3138,7 +3381,7 @@ async function ensureMacDaemonLocked(options) {
     };
   }
   const servicePaths = launchdPaths(options);
-  mkdirSync2(dirname2(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
+  mkdirSync2(dirname(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
   writeFileSync2(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
   chmodSync(servicePaths.logPath, RUNTIME_FILE_MODE);
   const launcher = generateDaemonLauncher(daemonConfig);
@@ -3277,16 +3520,20 @@ var STATUS_PROBE_TIMEOUT_MS = 500;
 var READY_TIMEOUT_MS = 5e3;
 var READY_POLL_MS2 = 100;
 var READY_PROBE_TIMEOUT_MS2 = 250;
-var HEALTHY_TIMEOUT_MS = 3e4;
-var HEALTHY_POLL_MS = 250;
+var READY_SNAPSHOT_TIMEOUT_MS = 3e4;
+var READY_SNAPSHOT_POLL_MS = 250;
 var EXIT_OK3 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
-function formatDaemonLifecycleMessage(message, decisionIngestion) {
-  return `${message} \xB7 Decision ingestion ${decisionIngestion}`;
+var VERIFIED_PREFIX = "[prim] \u2713 ";
+function formatDaemonLifecycleMessage(message, decisionIngestion, snapshot, now = Date.now()) {
+  const backlog = deliveryBacklogSummary(snapshot?.ingestion, now);
+  const state = deliveryBacklogState(snapshot?.ingestion);
+  const verdict = (state === "failing" || state === "retained") && message.startsWith(VERIFIED_PREFIX) ? `[prim] \u26A0 ${message.slice(VERIFIED_PREFIX.length)}` : message;
+  return `${verdict} \xB7 Decision ingestion ${decisionIngestion}${backlog ? ` \xB7 ${backlog}` : ""}`;
 }
-function formatCurrentDaemonLifecycleMessage(message) {
-  return formatDaemonLifecycleMessage(message, decisionIngestionStatus(process.cwd()));
+function formatCurrentDaemonLifecycleMessage(message, snapshot) {
+  return formatDaemonLifecycleMessage(message, decisionIngestionStatus(process.cwd()), snapshot);
 }
 function daemonDegradedReason(snapshot) {
   if (!snapshot || snapshot.healthy !== false) return void 0;
@@ -3337,7 +3584,7 @@ function openDaemonLog(configDir = CONFIG_DIR) {
   if (!existsSync4(configDir)) {
     mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
-  return openSync(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
+  return openSync2(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
 async function waitForReady() {
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -3349,17 +3596,23 @@ async function waitForReady() {
   }
   return daemonIsLive(READY_PROBE_TIMEOUT_MS2);
 }
-async function waitForHealthySnapshot(expectedVersion) {
-  const deadline = Date.now() + HEALTHY_TIMEOUT_MS;
+function requestStatusSnapshot() {
+  return daemonRequest(
+    "status_snapshot",
+    {},
+    { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
+  );
+}
+async function waitForReadySnapshot(expectedVersion, options = {}) {
+  const request = options.requestSnapshot ?? requestStatusSnapshot;
+  const wait = options.sleep ?? sleep;
+  const nowMs = options.nowMs ?? Date.now;
+  const deadline = nowMs() + READY_SNAPSHOT_TIMEOUT_MS;
   let snapshot = null;
-  while (Date.now() < deadline) {
-    snapshot = await daemonRequest(
-      "status_snapshot",
-      {},
-      { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
-    );
-    if (snapshot?.healthy === true && snapshot.version === expectedVersion) return snapshot;
-    await sleep(HEALTHY_POLL_MS);
+  while (nowMs() < deadline) {
+    snapshot = await request();
+    if (daemonStartIsReady(true, snapshot, expectedVersion)) return snapshot;
+    await wait(READY_SNAPSHOT_POLL_MS);
   }
   return snapshot;
 }
@@ -3372,11 +3625,20 @@ async function verifiedPid(existing) {
   );
   return snapshot?.pid === existing.pid ? snapshot : null;
 }
-function daemonStartIsHealthy(serviceReady, snapshot, expectedVersion) {
-  return serviceReady && snapshot?.healthy === true && expectedVersion !== void 0 && snapshot.version === expectedVersion;
+function daemonStartIsReady(serviceReady, snapshot, expectedVersion) {
+  if (!serviceReady || !snapshot || expectedVersion === void 0) return false;
+  if (snapshot.version !== expectedVersion || snapshot.needsReauth === true) return false;
+  if (snapshot.healthy === true) return true;
+  return snapshot.heartbeat?.healthy === true && snapshot.ingestion?.healthy === false;
+}
+function daemonBacklogFields(snapshot) {
+  const state = deliveryBacklogState(snapshot?.ingestion);
+  if (!state) return {};
+  if (state === "draining") return { draining: true, ingestion: snapshot?.ingestion };
+  return state === "retained" ? { draining: false, deliveryRetained: true, ingestion: snapshot?.ingestion } : { draining: false, deliveryFailing: true, ingestion: snapshot?.ingestion };
 }
-function daemonStartHealthFields(healthy, snapshot) {
-  if (healthy) return {};
+function daemonStartHealthFields(ready, snapshot) {
+  if (ready) return daemonBacklogFields(snapshot);
   return {
     state: "degraded",
     needsReauth: snapshot?.needsReauth === true,
@@ -3384,16 +3646,28 @@ function daemonStartHealthFields(healthy, snapshot) {
     ingestion: snapshot?.ingestion ?? null
   };
 }
+function daemonStartFailureReason(snapshot, expectedVersion) {
+  if (snapshot && !snapshot.needsReauth && expectedVersion !== void 0 && snapshot.version !== expectedVersion) {
+    return `daemon reports ${snapshot.version ? `v${snapshot.version}` : "no version"}, expected v${expectedVersion}`;
+  }
+  return daemonDegradedReason(snapshot);
+}
 async function detachedDaemonStart(opts) {
   const existing = readPidfile();
   if (existing?.alive) {
     const snapshot = await verifiedPid(existing);
     if (snapshot) {
       process.stderr.write(
-        `${formatCurrentDaemonLifecycleMessage(`[prim] daemon already running (pid=${existing.pid})`)}
+        `${formatCurrentDaemonLifecycleMessage(`[prim] daemon already running (pid=${existing.pid})`, snapshot)}
 `
       );
-      console.log(JSON.stringify({ started: false, pid: existing.pid }, null, 2));
+      console.log(
+        JSON.stringify(
+          { started: false, pid: existing.pid, ...daemonBacklogFields(snapshot) },
+          null,
+          2
+        )
+      );
       return;
     }
     process.stderr.write(
@@ -3442,16 +3716,19 @@ async function detachedDaemonStart(opts) {
   });
   child.unref();
   if (logFd !== void 0) {
-    closeSync(logFd);
+    closeSync2(logFd);
   }
   const live = await waitForReady();
   if (live) {
     const after = readPidfile();
+    const snapshot = await requestStatusSnapshot();
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon started (pid=${after?.pid ?? "?"}, socket=${SOCK_PATH})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon started (pid=${after?.pid ?? "?"}, socket=${SOCK_PATH})`, snapshot)}
 `
     );
-    console.log(JSON.stringify({ started: true, pid: after?.pid }, null, 2));
+    console.log(
+      JSON.stringify({ started: true, pid: after?.pid, ...daemonBacklogFields(snapshot) }, null, 2)
+    );
     return;
   }
   process.stderr.write(
@@ -3574,19 +3851,25 @@ async function macDaemonStart(forceRestart = false) {
   const result = await ensureMacDaemon({ explicitlyStarted: true, forceRestart });
   const serviceReady = result.state === "running";
   const expectedVersion = result.runtime?.manifest.version;
-  const snapshot = serviceReady && expectedVersion ? await waitForHealthySnapshot(expectedVersion) : null;
-  const healthy = daemonStartIsHealthy(serviceReady, snapshot, expectedVersion);
-  if (healthy) {
+  const snapshot = serviceReady && expectedVersion ? await waitForReadySnapshot(expectedVersion) : null;
+  const ready = daemonStartIsReady(serviceReady, snapshot, expectedVersion);
+  if (ready) {
     const verb = result.action === "none" ? "already running" : "started";
     const servicePid = result.service.loaded ? result.service.pid : void 0;
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? servicePid ?? "?"})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ${verb} under launchd (pid=${snapshot?.pid ?? servicePid ?? "?"})`, snapshot)}
 `
     );
+  } else if (!(serviceReady && expectedVersion)) {
+    process.stderr.write(
+      `[prim] \u2717 launchd did not converge on the desired daemon (${result.action}) (see ${LOG_PATH})
+`
+    );
+    if (!process.exitCode) process.exitCode = EXIT_NOT_RUNNING;
   } else {
-    const reason = daemonDegradedReason(snapshot);
+    const reason = daemonStartFailureReason(snapshot, expectedVersion);
     process.stderr.write(
-      `[prim] \u2717 launchd daemon did not reach healthy heartbeat + ingestion state${reason ? ` \xB7 ${reason}` : ""} (see ${LOG_PATH})
+      `[prim] \u2717 launchd daemon did not reach a healthy heartbeat on the expected version${reason ? ` \xB7 ${reason}` : ""} (see ${LOG_PATH})
 `
     );
     if (!process.exitCode) process.exitCode = EXIT_NOT_RUNNING;
@@ -3594,14 +3877,20 @@ async function macDaemonStart(forceRestart = false) {
   console.log(
     JSON.stringify(
       {
-        started: healthy,
+        started: ready,
         supervised: true,
         action: result.action,
         pid: snapshot?.pid ?? (result.service.loaded ? result.service.pid : void 0),
         loaded: result.service.loaded,
         responding: result.responding,
-        healthy,
-        ...daemonStartHealthFields(healthy, snapshot),
+        // `healthy` keeps meaning "start succeeded" (always equal to `started`
+        // and the exit code) so existing consumers stay correct. It is not the
+        // daemon's own health: `daemon status --json` stays degraded while a
+        // backlog drains, is held back, or fails to deliver, which start
+        // reports additively via `draining`, `deliveryRetained`,
+        // `deliveryFailing`, and `ingestion`.
+        healthy: ready,
+        ...daemonStartHealthFields(ready, snapshot),
         version: snapshot?.version,
         expectedVersion
       },
@@ -3905,11 +4194,12 @@ async function daemonEnsure() {
     return { disabled };
   }
   const result = await ensureMacDaemon();
+  const snapshot = result.state === "running" ? await requestStatusSnapshot() : null;
   if (result.state === "disabled") {
     process.stderr.write("[prim] daemon remains explicitly disabled\n");
   } else if (result.state === "running") {
     process.stderr.write(
-      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ensured under launchd (${result.action})`)}
+      `${formatCurrentDaemonLifecycleMessage(`[prim] \u2713 daemon ensured under launchd (${result.action})`, snapshot)}
 `
     );
   } else {
@@ -3923,7 +4213,8 @@ async function daemonEnsure() {
         ensured: result.state === "running",
         disabled: result.state === "disabled",
         supervised: true,
-        action: result.action
+        action: result.action,
+        ...daemonBacklogFields(snapshot)
       },
       null,
       2
@@ -4958,11 +5249,11 @@ function asRecord(value, path) {
   }
   return value;
 }
-function assertKeys(record2, path, required, optional = []) {
+function assertKeys(record3, path, required, optional = []) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
-  const missing = required.find((key) => !Object.hasOwn(record2, key));
+  const missing = required.find((key) => !Object.hasOwn(record3, key));
   if (missing !== void 0) contractError(path, `is missing ${missing}`);
-  const extra = Object.keys(record2).find((key) => !allowed.has(key));
+  const extra = Object.keys(record3).find((key) => !allowed.has(key));
   if (extra !== void 0) contractError(path, `contains unexpected field ${extra}`);
 }
 function asString(value, path, options) {
@@ -4992,97 +5283,97 @@ function asSha(value, path) {
   if (!SHA_RE.test(sha)) contractError(path, "must be a canonical lowercase Git commit SHA");
   return sha;
 }
-function optionalString(record2, key, path, max) {
-  if (!Object.hasOwn(record2, key)) return void 0;
-  return asString(record2[key], `${path}.${key}`, { max, nonempty: true });
+function optionalString(record3, key, path, max) {
+  if (!Object.hasOwn(record3, key)) return void 0;
+  return asString(record3[key], `${path}.${key}`, { max, nonempty: true });
 }
 function parseProposal(value, path) {
-  const record2 = asRecord(value, path);
+  const record3 = asRecord(value, path);
   assertKeys(
-    record2,
+    record3,
     path,
     ["_id", "repoFullName", "deadCommitSha", "status", "signals", "lastEvaluatedAt"],
     ["proposedSha", "proposedTier", "nextEvaluateAt"]
   );
-  const repoFullName = asString(record2.repoFullName, `${path}.repoFullName`, {
+  const repoFullName = asString(record3.repoFullName, `${path}.repoFullName`, {
     max: 200,
     nonempty: true
   });
   if (!REPO_FULL_NAME_RE.test(repoFullName)) {
     contractError(`${path}.repoFullName`, "must be canonical owner/repository syntax");
   }
-  const status = record2.status;
+  const status = record3.status;
   if (status !== "proposed" && status !== "confirmed" && status !== "verification_failed") {
     contractError(`${path}.status`, "is not a review-visible proposal status");
   }
-  if (!Array.isArray(record2.signals) || record2.signals.length > MAX_SIGNALS) {
+  if (!Array.isArray(record3.signals) || record3.signals.length > MAX_SIGNALS) {
     contractError(`${path}.signals`, "must be a bounded array");
   }
-  const signals = record2.signals.map(
+  const signals = record3.signals.map(
     (signal, index) => asString(signal, `${path}.signals[${String(index)}]`, {
       max: MAX_SIGNAL_LENGTH,
       nonempty: true
     })
   );
-  const proposedSha = Object.hasOwn(record2, "proposedSha") ? asSha(record2.proposedSha, `${path}.proposedSha`) : void 0;
+  const proposedSha = Object.hasOwn(record3, "proposedSha") ? asSha(record3.proposedSha, `${path}.proposedSha`) : void 0;
   let proposedTier;
-  if (Object.hasOwn(record2, "proposedTier")) {
-    if (record2.proposedTier !== "exact_patch_body" && record2.proposedTier !== "exact_file_set") {
+  if (Object.hasOwn(record3, "proposedTier")) {
+    if (record3.proposedTier !== "exact_patch_body" && record3.proposedTier !== "exact_file_set") {
       contractError(`${path}.proposedTier`, "is not a supported match tier");
     }
-    proposedTier = record2.proposedTier;
+    proposedTier = record3.proposedTier;
   }
-  const nextEvaluateAt = Object.hasOwn(record2, "nextEvaluateAt") ? asTimestamp(record2.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
+  const nextEvaluateAt = Object.hasOwn(record3, "nextEvaluateAt") ? asTimestamp(record3.nextEvaluateAt, `${path}.nextEvaluateAt`) : void 0;
   return {
-    _id: asString(record2._id, `${path}._id`, { max: 256, nonempty: true }),
+    _id: asString(record3._id, `${path}._id`, { max: 256, nonempty: true }),
     repoFullName,
-    deadCommitSha: asSha(record2.deadCommitSha, `${path}.deadCommitSha`),
+    deadCommitSha: asSha(record3.deadCommitSha, `${path}.deadCommitSha`),
     status,
     proposedSha,
     proposedTier,
     signals,
-    lastEvaluatedAt: asTimestamp(record2.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
+    lastEvaluatedAt: asTimestamp(record3.lastEvaluatedAt, `${path}.lastEvaluatedAt`),
     nextEvaluateAt
   };
 }
 function parseDecision(value, path) {
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
-  const status = record2.status;
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, ["_id", "intent", "status", "intentTruncated"], ["shortId"]);
+  const status = record3.status;
   if (status !== "provisional" && status !== "abandoned") {
     contractError(`${path}.status`, "is not a repairable decision status");
   }
   return {
-    _id: asString(record2._id, `${path}._id`, { max: 256, nonempty: true }),
-    shortId: optionalString(record2, "shortId", path, 128),
-    intent: asString(record2.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
+    _id: asString(record3._id, `${path}._id`, { max: 256, nonempty: true }),
+    shortId: optionalString(record3, "shortId", path, 128),
+    intent: asString(record3.intent, `${path}.intent`, { max: MAX_INTENT_LENGTH }),
     status,
-    intentTruncated: asBoolean(record2.intentTruncated, `${path}.intentTruncated`)
+    intentTruncated: asBoolean(record3.intentTruncated, `${path}.intentTruncated`)
   };
 }
 function parseListItem(value, path) {
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, [
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, [
     "proposal",
     "decisions",
     "affectedDecisionCount",
     "decisionsTruncated",
     "reviewToken"
   ]);
-  if (!Array.isArray(record2.decisions) || record2.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
+  if (!Array.isArray(record3.decisions) || record3.decisions.length > MAX_REPAIR_DECISIONS_FOR_CONFIRM) {
     contractError(`${path}.decisions`, "must be a bounded array");
   }
-  const decisions = record2.decisions.map(
+  const decisions = record3.decisions.map(
     (decision, index) => parseDecision(decision, `${path}.decisions[${String(index)}]`)
   );
-  const proposal = parseProposal(record2.proposal, `${path}.proposal`);
-  const decisionsTruncated = asBoolean(record2.decisionsTruncated, `${path}.decisionsTruncated`);
-  const affectedDecisionCount = record2.affectedDecisionCount === null ? null : asCount(record2.affectedDecisionCount, `${path}.affectedDecisionCount`);
+  const proposal = parseProposal(record3.proposal, `${path}.proposal`);
+  const decisionsTruncated = asBoolean(record3.decisionsTruncated, `${path}.decisionsTruncated`);
+  const affectedDecisionCount = record3.affectedDecisionCount === null ? null : asCount(record3.affectedDecisionCount, `${path}.affectedDecisionCount`);
   let reviewToken;
-  if (record2.reviewToken === null) {
+  if (record3.reviewToken === null) {
     reviewToken = null;
   } else {
-    reviewToken = asString(record2.reviewToken, `${path}.reviewToken`, {
+    reviewToken = asString(record3.reviewToken, `${path}.reviewToken`, {
       max: 64,
       nonempty: true
     });
@@ -5115,19 +5406,19 @@ function parseListItem(value, path) {
 }
 function parseListPage(value, pageNumber) {
   const path = `page ${String(pageNumber)}`;
-  const record2 = asRecord(value, path);
-  assertKeys(record2, path, ["repairs", "isDone", "nextCursor", "truncated"]);
-  if (!Array.isArray(record2.repairs) || record2.repairs.length > MAX_REPAIRS_PER_PAGE) {
+  const record3 = asRecord(value, path);
+  assertKeys(record3, path, ["repairs", "isDone", "nextCursor", "truncated"]);
+  if (!Array.isArray(record3.repairs) || record3.repairs.length > MAX_REPAIRS_PER_PAGE) {
     contractError(`${path}.repairs`, "must be a bounded array");
   }
-  const isDone = asBoolean(record2.isDone, `${path}.isDone`);
-  const truncated = asBoolean(record2.truncated, `${path}.truncated`);
+  const isDone = asBoolean(record3.isDone, `${path}.isDone`);
+  const truncated = asBoolean(record3.truncated, `${path}.truncated`);
   if (truncated === isDone) contractError(path, "has inconsistent isDone/truncated flags");
   let nextCursor;
-  if (record2.nextCursor === null) {
+  if (record3.nextCursor === null) {
     nextCursor = null;
   } else {
-    nextCursor = asString(record2.nextCursor, `${path}.nextCursor`, {
+    nextCursor = asString(record3.nextCursor, `${path}.nextCursor`, {
       max: MAX_CURSOR_LENGTH,
       nonempty: true
     });
@@ -5135,7 +5426,7 @@ function parseListPage(value, pageNumber) {
   if (isDone && nextCursor !== null) contractError(path, "is done but includes a next cursor");
   if (!isDone && nextCursor === null) contractError(path, "is incomplete without a next cursor");
   return {
-    repairs: record2.repairs.map(
+    repairs: record3.repairs.map(
       (item, index) => parseListItem(item, `${path}.repairs[${String(index)}]`)
     ),
     isDone,
@@ -5213,23 +5504,23 @@ function normalizedResolutionInput(proposalId, expectedProposedSha) {
   return { proposalId, expectedProposedSha: expectedProposedSha.toLowerCase() };
 }
 function parseResolutionOutcome(value, action) {
-  const record2 = asRecord(value, "resolution response");
+  const record3 = asRecord(value, "resolution response");
   const allowed = action === "confirm" ? ["confirmed", "already_applied", "disabled", "no_op", "stale"] : ["rejected", "already_applied", "no_op", "stale"];
-  if (record2.status === "backoff") {
-    assertKeys(record2, "resolution response", ["status", "retryAt"]);
+  if (record3.status === "backoff") {
+    assertKeys(record3, "resolution response", ["status", "retryAt"]);
     if (action !== "confirm") {
       contractError("resolution response.status", "backoff is impossible for reject");
     }
     return {
       status: "backoff",
-      retryAt: asTimestamp(record2.retryAt, "resolution response.retryAt")
+      retryAt: asTimestamp(record3.retryAt, "resolution response.retryAt")
     };
   }
-  assertKeys(record2, "resolution response", ["status"]);
-  if (typeof record2.status !== "string" || !allowed.includes(record2.status)) {
+  assertKeys(record3, "resolution response", ["status"]);
+  if (typeof record3.status !== "string" || !allowed.includes(record3.status)) {
     contractError("resolution response.status", "is not a supported outcome");
   }
-  return { status: record2.status };
+  return { status: record3.status };
 }
 function normalizedReviewToken(value) {
   if (value === void 0 || !REVIEW_TOKEN_INPUT_RE.test(value)) {
@@ -5240,18 +5531,18 @@ function normalizedReviewToken(value) {
   return value.toLowerCase();
 }
 function parseConflictOutcome(value, action) {
-  const record2 = asRecord(value, "resolution conflict response");
-  assertKeys(record2, "resolution conflict response", ["status"]);
+  const record3 = asRecord(value, "resolution conflict response");
+  assertKeys(record3, "resolution conflict response", ["status"]);
   if (action !== "confirm") {
     contractError(
       "resolution conflict response.status",
       "a review conflict is impossible for reject"
     );
   }
-  if (record2.status !== "review_too_large" && record2.status !== "stale_review") {
+  if (record3.status !== "review_too_large" && record3.status !== "stale_review") {
     contractError("resolution conflict response.status", "is not a supported 409 outcome");
   }
-  return { status: record2.status };
+  return { status: record3.status };
 }
 async function resolveRepair(proposalId, expectedProposedSha, action, expectedReviewToken, deps = defaultDeps6) {
   const normalized = normalizedResolutionInput(proposalId, expectedProposedSha);
@@ -6306,6 +6597,7 @@ function registerDecisionsCommands(program2) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync6 } from "fs";
+import { Option as Option4 } from "commander";
 
 // src/protocol/decision-lifecycle.ts
 var DECISION_LIFECYCLE_PROTOCOL_VERSION = 2;
@@ -6330,28 +6622,35 @@ function parseOrganizationBinding(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { state: "server_contract_unavailable" };
   }
-  const record2 = value;
-  if (record2.authenticated !== true || record2.organizationBindingVersion !== ORGANIZATION_BINDING_VERSION || !isCaptureAuthorityKind(record2.captureAuthorityKind)) {
+  const record3 = value;
+  if (record3.authenticated !== true || record3.organizationBindingVersion !== ORGANIZATION_BINDING_VERSION || !isCaptureAuthorityKind(record3.captureAuthorityKind)) {
     return { state: "server_contract_unavailable" };
   }
-  if (record2.organizationId === null && record2.workosOrganizationId === null) {
+  if (record3.organizationId === null && record3.workosOrganizationId === null) {
     return { state: "no_current_organization" };
   }
-  if (safeOrganizationId(record2.organizationId) && record2.workosOrganizationId === null) {
+  if (safeOrganizationId(record3.organizationId) && record3.workosOrganizationId === null) {
     return { state: "organization_identity_unreconciled" };
   }
-  if (!safeOrganizationId(record2.organizationId) || !safeOrganizationId(record2.workosOrganizationId)) {
+  if (!safeOrganizationId(record3.organizationId) || !safeOrganizationId(record3.workosOrganizationId)) {
     return { state: "server_contract_unavailable" };
   }
   return {
     state: "current",
     binding: {
-      captureAuthorityKind: record2.captureAuthorityKind,
-      organizationId: record2.organizationId,
-      workosOrganizationId: record2.workosOrganizationId
+      captureAuthorityKind: record3.captureAuthorityKind,
+      organizationId: record3.organizationId,
+      workosOrganizationId: record3.workosOrganizationId
     }
   };
 }
+function summarizeRetainedBuckets(retained) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const item of retained) {
+    counts.set(item.reason, (counts.get(item.reason) ?? 0) + 1);
+  }
+  return [...counts].sort(([left], [right]) => left.localeCompare(right)).map(([reason, count]) => `${reason}:${String(count)}`).join(", ");
+}
 function classifyJournalBuckets(buckets, binding) {
   const deliverableBuckets = /* @__PURE__ */ new Set();
   const retainedBuckets = [];
@@ -6423,7 +6722,7 @@ async function inspectJournalDelivery(buckets, options = {}) {
 }
 
 // src/commands/hermes-install.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync2 } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 import { Document, isMap, isSeq, parseAllDocuments, stringify, visit } from "yaml";
@@ -6831,7 +7130,7 @@ function readConfigSnapshot(path) {
   if (!existsSync5(path)) return { exists: false, mode: CONFIG_MODE, raw: "" };
   return {
     exists: true,
-    mode: statSync(path).mode & 511,
+    mode: statSync2(path).mode & 511,
     raw: readFileSync5(path, "utf8")
   };
 }
@@ -6973,7 +7272,6 @@ function registerHermesCommands(program2) {
 // src/commands/doctor.ts
 var DAEMON_PROBE_TIMEOUT_MS = 500;
 var CONNECTIVITY_TIMEOUT_MS = 3e3;
-var MS_PER_SECOND = 1e3;
 var STALE_PENDING_MS = 3e4;
 var EXIT_UNHEALTHY = 1;
 function classifyDoctor(checks) {
@@ -7095,8 +7393,19 @@ function classifyDaemonHealth(snapshot, options = {}) {
     };
   }
   if (!snapshot.ingestion?.healthy) {
-    const pending = snapshot.ingestion?.pendingCount ?? 0;
-    const pendingLabel = snapshot.ingestion?.pendingSampled ? `at least ${String(pending)}` : String(pending);
+    if (options.backlogExpected && deliveryBacklogState(snapshot.ingestion) === "draining") {
+      const ingestionStatus2 = options.ingestionStatus ?? decisionIngestionStatus(process.cwd());
+      const live = options.backlog;
+      const progress = live && live.pendingCount === 0 && live.pendingSampled !== true ? "backlog drained; daemon health refreshes on its next sweep" : deliveryBacklogSummary(snapshot.ingestion, options.now, live);
+      return {
+        name: "daemon",
+        status: "warn",
+        detail: `supervised and live${snapshot.version ? ` \xB7 v${snapshot.version}` : ""} \xB7 Decision ingestion ${ingestionStatus2} \xB7 ${progress}`
+      };
+    }
+    const counts = options.backlog ?? snapshot.ingestion;
+    const pending = counts?.pendingCount ?? 0;
+    const pendingLabel = counts?.pendingSampled ? `at least ${String(pending)}` : String(pending);
     return {
       name: "daemon",
       status: "fail",
@@ -7113,17 +7422,23 @@ function classifyDaemonHealth(snapshot, options = {}) {
     detail: `supervised and healthy${snapshot.version ? ` \xB7 v${snapshot.version}` : ""} \xB7 Decision ingestion ${ingestionStatus}`
   };
 }
-async function checkDaemon() {
+async function probeDelivery() {
+  const stats = pendingJournalStats();
+  const now = Date.now();
+  const disabled = daemonExplicitlyDisabled();
+  const expectedVersion = packageVersion();
   let service;
   if (process.platform === "darwin") {
     try {
       service = getLaunchdService();
     } catch (error) {
-      const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
       return {
-        name: "daemon",
-        status: "fail",
-        detail: `launchd status unavailable${detail ? `: ${detail}` : ""}`
+        snapshot: null,
+        launchdError: error instanceof Error ? error.message : String(error),
+        disabled,
+        expectedVersion,
+        stats,
+        now
       };
     }
   }
@@ -7132,53 +7447,74 @@ async function checkDaemon() {
     { callerEnv: getSiteUrl() },
     { timeoutMs: DAEMON_PROBE_TIMEOUT_MS }
   );
-  return classifyDaemonHealth(snapshot, {
-    disabled: daemonExplicitlyDisabled(),
-    service,
-    expectedVersion: packageVersion()
+  return { snapshot, service, disabled, expectedVersion, stats, now };
+}
+function daemonCheckVouchesForDrain(check) {
+  return check.name === "daemon" && check.status !== "fail";
+}
+function classifyDelivery(probe, options = {}) {
+  const { stats, now } = probe;
+  const launchdDetail = probe.launchdError === void 0 ? void 0 : boundedHealthError(probe.launchdError);
+  const daemon = probe.launchdError === void 0 ? classifyDaemonHealth(probe.snapshot, {
+    disabled: probe.disabled,
+    service: probe.service,
+    ingestionStatus: probe.ingestionStatus,
+    expectedVersion: probe.expectedVersion,
+    backlogExpected: options.backlogExpected,
+    backlog: {
+      pendingCount: stats.pendingCount,
+      pendingSampled: stats.sampled,
+      oldestPendingAt: stats.oldestPendingAt
+    },
+    now
+  }) : {
+    name: "daemon",
+    status: "fail",
+    detail: `launchd status unavailable${launchdDetail ? `: ${launchdDetail}` : ""}`
+  };
+  const journal = classifyJournal(stats, now, {
+    backlogExpected: options.backlogExpected === true && daemonCheckVouchesForDrain(daemon)
   });
+  return [daemon, journal, classifyStranded(stats)];
 }
-function checkJournal() {
-  const stats = pendingJournalStats();
+function classifyJournal(stats, now, options = {}) {
   const pending = stats.pendingCount;
   const pendingLabel = stats.sampled ? `at least ${String(pending)}` : String(pending);
+  const backlog = (detail) => options.backlogExpected ? {
+    name: "journal",
+    status: "warn",
+    detail: `${formatPendingBacklog(
+      {
+        pendingCount: pending,
+        pendingSampled: stats.sampled,
+        oldestPendingAt: stats.oldestPendingAt
+      },
+      now
+    )} \u2014 draining in the background`
+  } : { name: "journal", status: "fail", detail };
   if (pending === 0) {
     if (stats.sampled) {
-      return {
-        name: "journal",
-        status: "fail",
-        detail: "bounded journal sample could not prove the queue is empty"
-      };
+      return backlog("bounded journal sample could not prove the queue is empty");
     }
     return { name: "journal", status: "ok", detail: "no pending moves" };
   }
   if (stats.oldestPendingAt === void 0) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending with no readable capture timestamp`
-    };
+    const detail = `${pendingLabel} pending with no readable capture timestamp`;
+    return stats.sampled ? backlog(detail) : { name: "journal", status: "fail", detail };
   }
-  const oldestMs = Date.now() - stats.oldestPendingAt;
+  const oldestMs = now - stats.oldestPendingAt;
   const oldestS = Math.round(oldestMs / MS_PER_SECOND);
   if (oldestMs > STALE_PENDING_MS) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending, oldest observed ${String(oldestS)}s \u2014 30s delivery SLA missed`
-    };
+    return backlog(
+      `${pendingLabel} pending, oldest observed ${String(oldestS)}s \u2014 30s delivery SLA missed`
+    );
   }
   if (stats.sampled) {
-    return {
-      name: "journal",
-      status: "fail",
-      detail: `${pendingLabel} pending in bounded sample; 30s delivery SLA cannot be proven`
-    };
+    return backlog(`${pendingLabel} pending in bounded sample; 30s delivery SLA cannot be proven`);
   }
   return { name: "journal", status: "ok", detail: `${String(pending)} pending, draining` };
 }
-function checkStranded() {
-  const stats = pendingJournalStats();
+function classifyStranded(stats) {
   if (stats.strandedFileCount === 0 && !stats.strandedSampled) {
     return { name: "stranded", status: "ok", detail: "none" };
   }
@@ -7204,15 +7540,10 @@ function classifyJournalOrganization(bucketCount, retainedBuckets) {
       detail: "all pending buckets match the active credential"
     };
   }
-  const reasonCounts = /* @__PURE__ */ new Map();
-  for (const item of retainedBuckets) {
-    reasonCounts.set(item.reason, (reasonCounts.get(item.reason) ?? 0) + 1);
-  }
-  const reasons = [...reasonCounts].sort(([left], [right]) => left.localeCompare(right)).map(([reason, count]) => `${reason}:${String(count)}`).join(", ");
   return {
     name: "journal-org",
     status: "fail",
-    detail: `${String(retainedBuckets.length)} bucket(s) retained (${reasons})`
+    detail: `${String(retainedBuckets.length)} bucket(s) retained (${summarizeRetainedBuckets(retainedBuckets)})`
   };
 }
 async function checkJournalOrganization() {
@@ -7282,7 +7613,26 @@ async function checkRepositoryBinding() {
     };
   }
 }
-function classifyManagedHook(hookName, inspection) {
+function managedHookRemedy(inspection) {
+  switch (inspection.reason) {
+    case "missing":
+    case "missing_block":
+    case "stale_block":
+    case "legacy_block":
+    case "unreachable_block":
+    case "misplaced_block":
+      if (inspection.location === "prim") return "run `prim enable` to refresh prim's global hooks";
+      if (inspection.location === "external") {
+        return `outside this repository \u2014 ${externalHookRemedy(inspection.hookName, inspection.gitRoot)}`;
+      }
+      return "run `prim hooks install`";
+    case "entrypoint_missing":
+      return "run `prim enable` to stage the hook runtime";
+    default:
+      return void 0;
+  }
+}
+function classifyManagedHook(hookName, inspection, firing) {
   if (inspection.covered) {
     return {
       name: hookName,
@@ -7290,15 +7640,78 @@ function classifyManagedHook(hookName, inspection) {
       detail: `effective and executable \xB7 ${inspection.kind} \xB7 ${inspection.hookPath}`
     };
   }
+  const reason = inspection.reason ?? "uncovered";
+  if (inspection.mode === "manual") {
+    if (hookName === "post-commit" && firing?.state === "fired") {
+      return {
+        name: hookName,
+        status: "ok",
+        detail: `manual (prim.gitHooks=manual) \xB7 ran for the latest commit \xB7 ${inspection.hookPath}`
+      };
+    }
+    return {
+      name: hookName,
+      status: "warn",
+      detail: `manual (prim.gitHooks=manual) \xB7 ${reason} \xB7 wire with \`prim hooks snippet ${hookName}\` \xB7 ${inspection.hookPath}`
+    };
+  }
+  const remedy = managedHookRemedy(inspection);
+  const stillCaptures = reason === "legacy_block" || reason === "misplaced_block";
   return {
     name: hookName,
-    status: "fail",
-    detail: `${inspection.reason ?? "uncovered"} \xB7 ${inspection.hookPath}`
+    status: hookName === "pre-commit" || stillCaptures ? "warn" : "fail",
+    detail: `${reason}${remedy ? ` \xB7 ${remedy}` : ""} \xB7 ${inspection.hookPath}`
   };
 }
-function checkManagedHook(hookName, inspect) {
+function minutesAgo(at, now) {
+  const minutes = Math.max(0, Math.round((now - at) / 6e4));
+  return minutes === 0 ? "just now" : `${String(minutes)}m ago`;
+}
+function classifyHookFiring(firing, now = Date.now()) {
+  const name = "hook-fired";
+  switch (firing.state) {
+    case "inactive":
+      return { name, status: "ok", detail: "repository not active \u2014 no post-commit run expected" };
+    case "unverified":
+      return {
+        name,
+        status: "ok",
+        detail: "no local commit since the hooks were wired \u2014 the next commit is checked"
+      };
+    case "pending":
+      return {
+        name,
+        status: "ok",
+        detail: `latest commit is under ${String(POST_COMMIT_GRACE_MS / 1e3)}s old \u2014 capture may still be starting`
+      };
+    case "fired":
+      return {
+        name,
+        status: "ok",
+        detail: `post-commit reached prim for the latest commit (${minutesAgo(firing.firedAt, now)})`
+      };
+    case "not_firing":
+      return {
+        name,
+        status: "fail",
+        detail: `post-commit never reached prim for the commit made ${minutesAgo(firing.commitAt, now)}${firing.firedAt === void 0 ? "" : ` (last run ${minutesAgo(firing.firedAt, now)})`} \xB7 likely an exit/exec before prim's block, hooks turned off for that commit (HUSKY=0, a core.hooksPath override), or a git client without prim's environment \xB7 fix the cause, then commit to re-check \xB7 if prim was off for that commit (set with \`git config prim.active\` directly), run \`prim disable\` then \`prim enable\` to restart the check`
+      };
+  }
+}
+function inspectFiringHere() {
   try {
-    return classifyManagedHook(hookName, inspect());
+    const root = gitToplevel();
+    return root ? inspectPostCommitFiring(root) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function checkHookFiring(firing) {
+  return firing ? classifyHookFiring(firing) : { name: "hook-fired", status: "warn", detail: "not a git repository" };
+}
+function checkManagedHook(hookName, firing) {
+  try {
+    return classifyManagedHook(hookName, inspectEffectiveGitHook(hookName), firing);
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     return {
@@ -7617,36 +8030,39 @@ async function checkFeedbackCapability() {
     return { name: "feedback-api", status: "warn", detail: message.slice(0, 80) };
   }
 }
-function refreshOwnedGlobalHooksForHealth() {
-  try {
-    refreshOwnedGlobalHooks();
-  } catch {
-  }
-}
-async function collectChecks() {
-  refreshOwnedGlobalHooksForHealth();
+async function independentChecks() {
   const backend = await checkBackend();
-  return [
-    checkAuth(),
-    await checkDaemon(),
-    checkJournal(),
-    checkStranded(),
-    await checkJournalOrganization(),
-    checkFeedbackHooks(),
-    ...checkAgentHooks(),
-    checkHookRuntime(),
-    await checkRepositoryBinding(),
-    checkManagedHook("post-commit", inspectEffectivePostCommitHook),
-    checkManagedHook("post-rewrite", inspectEffectivePostRewriteHook),
-    ...backend,
-    await checkFeedbackCapability()
-  ];
+  const firing = inspectFiringHere();
+  return {
+    before: [checkAuth()],
+    after: [
+      await checkJournalOrganization(),
+      checkFeedbackHooks(),
+      ...checkAgentHooks(),
+      checkHookRuntime(),
+      await checkRepositoryBinding(),
+      checkManagedHook("pre-commit"),
+      checkManagedHook("post-commit", firing),
+      checkManagedHook("post-rewrite"),
+      checkHookFiring(firing),
+      ...backend,
+      await checkFeedbackCapability()
+    ]
+  };
+}
+var DEFAULT_DOCTOR_PROBES = {
+  delivery: probeDelivery,
+  independent: independentChecks
+};
+async function collectChecks(options, probes) {
+  const { before, after } = await probes.independent();
+  return [...before, ...classifyDelivery(await probes.delivery(), options), ...after];
 }
 function icon(status) {
   return status === "ok" ? "\u2713" : status === "warn" ? "\u26A0" : "\u2717";
 }
-async function runDoctor() {
-  const checks = await collectChecks();
+async function runDoctor(options, probes) {
+  const checks = await collectChecks(options, probes);
   const { json, exitCode } = classifyDoctor(checks);
   const headline = json.status === "ok" ? "\u2713 healthy" : json.status === "warn" ? "\u26A0 degraded" : "\u2717 unhealthy";
   process.stderr.write(`[prim] doctor: ${headline}
@@ -7660,11 +8076,14 @@ async function runDoctor() {
     process.exitCode = exitCode;
   }
 }
-function registerDoctorCommands(program2) {
+function registerDoctorCommands(program2, dependencies = {}) {
   program2.command("doctor").description(
     "Check capture and feedback health end to end (auth, supervisor, delivery, server)"
-  ).action(async () => {
-    await runDoctor();
+  ).addOption(new Option4("--expect-backlog").hideHelp()).action(async (opts) => {
+    await runDoctor(
+      { backlogExpected: opts.expectBacklog === true },
+      dependencies.probes ?? DEFAULT_DOCTOR_PROBES
+    );
   });
 }
 
@@ -7673,30 +8092,30 @@ import { existsSync as existsSync8, mkdirSync as mkdirSync5, unlinkSync as unlin
 import { join as join9 } from "path";
 
 // src/flusher.ts
-import { createReadStream, renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname4, join as join8 } from "path";
+import { createReadStream, renameSync as renameSync3, statSync as statSync3, unlinkSync as unlinkSync3 } from "fs";
+import { dirname as dirname3, join as join8 } from "path";
 
 // src/dead-letter.ts
 import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 import {
-  constants as constants2,
+  constants as constants3,
   chmodSync as chmodSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync3,
   existsSync as existsSync7,
   fchmodSync,
   fsyncSync,
   mkdirSync as mkdirSync4,
-  openSync as openSync2,
+  openSync as openSync3,
   renameSync as renameSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname3, join as join7 } from "path";
+import { dirname as dirname2, join as join7 } from "path";
 var DIRECTORY_MODE = 448;
 var FILE_MODE = 384;
 var DEAD_LETTER_DIRNAME = "dead-letter";
 function deadLetterDirectoryForRotation(flushingPath) {
-  return join7(dirname3(flushingPath), DEAD_LETTER_DIRNAME);
+  return join7(dirname2(flushingPath), DEAD_LETTER_DIRNAME);
 }
 function deadLetterPathForRawLine(flushingPath, rawLine) {
   const quarantineId = createHash3("sha256").update(rawLine).digest("hex");
@@ -7706,10 +8125,10 @@ function ensureDeadLetterDirectory(flushingPath, persistDirectory) {
   const directory = deadLetterDirectoryForRotation(flushingPath);
   mkdirSync4(directory, { recursive: true, mode: DIRECTORY_MODE });
   chmodSync2(directory, DIRECTORY_MODE);
-  persistDirectory(dirname3(directory));
+  persistDirectory(dirname2(directory));
   return directory;
 }
-function persistDeadLetter(directory, path, quarantineId, record2, persistDirectory) {
+function persistDeadLetter(directory, path, quarantineId, record3, persistDirectory) {
   if (existsSync7(path)) {
     persistDirectory(directory);
     return;
@@ -7718,16 +8137,16 @@ function persistDeadLetter(directory, path, quarantineId, record2, persistDirect
     directory,
     `.${quarantineId}.${String(process.pid)}.${randomBytes4(8).toString("hex")}.tmp`
   );
-  const flags = constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | constants2.O_NOFOLLOW;
+  const flags = constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | constants3.O_NOFOLLOW;
   try {
-    const fd = openSync2(temporaryPath, flags, FILE_MODE);
+    const fd = openSync3(temporaryPath, flags, FILE_MODE);
     try {
       fchmodSync(fd, FILE_MODE);
-      writeFileSync3(fd, `${JSON.stringify(record2)}
+      writeFileSync3(fd, `${JSON.stringify(record3)}
 `, "utf8");
       fsyncSync(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
     renameSync2(temporaryPath, path);
     persistDirectory(directory);
@@ -7739,22 +8158,22 @@ function quarantineMove(flushingPath, move, reason, now = Date.now, options = {}
   const persistDirectory = options.syncDirectory ?? syncDirectory;
   const directory = ensureDeadLetterDirectory(flushingPath, persistDirectory);
   const serializedMove = JSON.stringify(move);
-  const record2 = {
+  const record3 = {
     version: 1,
     quarantineId: createHash3("sha256").update(serializedMove).digest("hex"),
     quarantinedAt: now(),
     reason,
     move
   };
-  const path = join7(directory, `${record2.quarantineId}.json`);
-  persistDeadLetter(directory, path, record2.quarantineId, record2, persistDirectory);
-  return record2;
+  const path = join7(directory, `${record3.quarantineId}.json`);
+  persistDeadLetter(directory, path, record3.quarantineId, record3, persistDirectory);
+  return record3;
 }
 function quarantineRawLine(flushingPath, rawLine, now = Date.now, options = {}) {
   const persistDirectory = options.syncDirectory ?? syncDirectory;
   const directory = ensureDeadLetterDirectory(flushingPath, persistDirectory);
   const bytes = Buffer.from(rawLine);
-  const record2 = {
+  const record3 = {
     version: 1,
     recordKind: "raw_line_v1",
     quarantineId: createHash3("sha256").update(bytes).digest("hex"),
@@ -7767,18 +8186,22 @@ function quarantineRawLine(flushingPath, rawLine, now = Date.now, options = {})
   persistDeadLetter(
     directory,
     deadLetterPathForRawLine(flushingPath, bytes),
-    record2.quarantineId,
-    record2,
+    record3.quarantineId,
+    record3,
     persistDirectory
   );
-  return record2;
+  return record3;
 }
 
 // src/flusher.ts
 var BATCH_SIZE = 500;
+var BATCH_MAX_BYTES = 1048576;
 var HTTP_TIMEOUT_MS = 1e4;
 var OPPORTUNISTIC_FLUSH_AFTER_MS = 6e4;
 var ORPHAN_QUARANTINE_MS = 6e4;
+function exceedsBatchBytes(count, bytes, nextBytes, maxBytes) {
+  return count > 0 && bytes + nextBytes > maxBytes;
+}
 function addDrainCounts(left, right) {
   return {
     flushed: left.flushed + right.flushed,
@@ -7789,8 +8212,8 @@ function collectionScopeRoots(batch) {
   return batch.flatMap((move) => {
     const env = move.env;
     if (typeof env !== "object" || env === null || Array.isArray(env)) return [];
-    const record2 = env;
-    const root = typeof record2.gitRoot === "string" ? record2.gitRoot : record2.cwd;
+    const record3 = env;
+    const root = typeof record3.gitRoot === "string" ? record3.gitRoot : record3.cwd;
     return typeof root === "string" && root.length > 0 ? [root] : [];
   });
 }
@@ -7798,8 +8221,8 @@ function isVersionedInvalidMoveDisposition(body) {
   if (typeof body !== "object" || body === null || Array.isArray(body)) {
     return false;
   }
-  const record2 = body;
-  return Object.keys(record2).length === 2 && record2.error === "invalid_move" && record2.errorVersion === 1;
+  const record3 = body;
+  return Object.keys(record3).length === 2 && record3.error === "invalid_move" && record3.errorVersion === 1;
 }
 function deadLetterReason(error) {
   if (error instanceof InvalidJournalEnvelopeError) {
@@ -7828,23 +8251,25 @@ function mayBeBatchSizeFailure(error) {
   }
   return error instanceof Error && error.name === "TimeoutError";
 }
-async function* rawJournalLines(input) {
+async function* rawJournalLines(input, offset) {
   let pending = [];
   let pendingBytes = 0;
+  let end = offset;
   for await (const value of input) {
     const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
     let start = 0;
     let newline = chunk.indexOf(10, start);
     while (newline !== -1) {
       const tail = chunk.subarray(start, newline + 1);
-      if (pending.length === 0) {
-        yield tail;
-      } else {
+      let line = tail;
+      if (pending.length > 0) {
         pending.push(tail);
-        yield Buffer.concat(pending, pendingBytes + tail.length);
+        line = Buffer.concat(pending, pendingBytes + tail.length);
         pending = [];
         pendingBytes = 0;
       }
+      end += line.length;
+      yield { bytes: line, end };
       start = newline + 1;
       newline = chunk.indexOf(10, start);
     }
@@ -7855,18 +8280,43 @@ async function* rawJournalLines(input) {
     }
   }
   if (pendingBytes > 0) {
-    yield pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingBytes);
+    const bytes = pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingBytes);
+    yield { bytes, end: end + pendingBytes };
   }
 }
+var drainProgressWarned = false;
 async function drainFlushingPath(flushingPath, client, binding, options = {}) {
+  const rotation = rotationIdentity(statSync3(flushingPath));
+  const resumeAt = drainResumeOffset(flushingPath, rotation);
+  const recordProgress = (end) => {
+    if (end === void 0 || end >= rotation.size) {
+      return;
+    }
+    try {
+      writeDrainCheckpoint(flushingPath, { v: 2, offset: end, ...rotation });
+      drainProgressWarned = false;
+    } catch (error) {
+      if (!drainProgressWarned) {
+        drainProgressWarned = true;
+        process.stderr.write(
+          `[prim] could not record drain progress: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+      }
+    }
+  };
+  const reportProgress = (delta) => {
+    options.onProgress?.(delta);
+    return delta;
+  };
   const postBatch = async (batch2) => {
+    const moves = batch2.map((entry) => entry.move);
     try {
-      const request = buildOrganizationBoundMoveRequest(batch2, binding);
+      const request = buildOrganizationBoundMoveRequest(moves, binding);
       const response = await client.post("/api/cli/moves/ingest", request, {
         signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
       });
-      requireDurableIngestAcknowledgement(response, batch2.length, collectionScopeRoots(batch2));
-      return { flushed: batch2.length, quarantined: 0 };
+      requireDurableIngestAcknowledgement(response, moves.length, collectionScopeRoots(moves));
     } catch (error) {
       const reason = deadLetterReason(error);
       if (!(reason || mayBeBatchSizeFailure(error))) {
@@ -7881,33 +8331,43 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
       if (!reason) {
         throw error;
       }
-      const [move] = batch2;
+      const [entry] = batch2;
       const quarantined = quarantineMove(
         flushingPath,
-        move,
+        entry.move,
         reason,
         Date.now,
         options.deadLetterPersistence
       );
+      recordProgress(entry.end);
       process.stderr.write(
         `[prim] quarantined rejected move ${quarantined.quarantineId.slice(0, 12)} (${reason})
 `
       );
-      return { flushed: 0, quarantined: 1 };
+      return reportProgress({ flushed: 0, quarantined: 1 });
     }
+    recordProgress(batch2.at(-1)?.end);
+    return reportProgress({ flushed: batch2.length, quarantined: 0 });
   };
-  const input = createReadStream(flushingPath);
+  const input = createReadStream(flushingPath, { start: resumeAt });
   const decoder = new TextDecoder("utf-8", { fatal: true });
   let batch = [];
+  let batchBytes = 0;
   let counts = { flushed: 0, quarantined: 0 };
+  const postPending = async () => {
+    counts = addDrainCounts(counts, await postBatch(batch));
+    batch = [];
+    batchBytes = 0;
+  };
   try {
-    for await (const rawLine of rawJournalLines(input)) {
+    for await (const { bytes: rawLine, end } of rawJournalLines(input, resumeAt)) {
       if (rawLine.length === 1 && rawLine[0] === 10 || rawLine.length === 2 && rawLine[0] === 13 && rawLine[1] === 10) {
         continue;
       }
+      let move;
       try {
         const line = decoder.decode(rawLine);
-        batch.push(JSON.parse(line));
+        move = JSON.parse(line);
       } catch {
         const quarantined = quarantineRawLine(
           flushingPath,
@@ -7919,24 +8379,35 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
           `[prim] quarantined invalid journal line ${quarantined.quarantineId.slice(0, 12)} (invalid_move)
 `
         );
-        counts.quarantined += 1;
+        counts = addDrainCounts(counts, reportProgress({ flushed: 0, quarantined: 1 }));
+        if (batch.length === 0) {
+          recordProgress(end);
+        }
         continue;
       }
-      if (batch.length === BATCH_SIZE) {
-        counts = addDrainCounts(counts, await postBatch(batch));
-        batch = [];
+      if (exceedsBatchBytes(batch.length, batchBytes, rawLine.length, BATCH_MAX_BYTES)) {
+        await postPending();
+      }
+      batch.push({ move, end });
+      batchBytes += rawLine.length;
+      if (batch.length >= BATCH_SIZE) {
+        await postPending();
       }
     }
     if (batch.length > 0) {
-      counts = addDrainCounts(counts, await postBatch(batch));
+      await postPending();
     }
   } finally {
     input.destroy();
   }
   unlinkSync3(flushingPath);
+  try {
+    removeDrainCheckpoint(flushingPath);
+  } catch {
+  }
   return counts;
 }
-async function drainPath(path, client, binding) {
+async function drainPath(path, client, binding, onProgress) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
     renameSync3(path, tmpPath);
@@ -7946,7 +8417,19 @@ async function drainPath(path, client, binding) {
     }
     throw err;
   }
-  return drainFlushingPath(tmpPath, client, binding);
+  return drainFlushingPath(tmpPath, client, binding, { onProgress });
+}
+async function settleDrain(drain) {
+  let progress = { flushed: 0, quarantined: 0 };
+  try {
+    return {
+      counts: await drain((delta) => {
+        progress = addDrainCounts(progress, delta);
+      })
+    };
+  } catch (error) {
+    return { counts: progress, failure: { error } };
+  }
 }
 function selectRecoverable(files, now, opts = {}) {
   const quarantineMs = opts.quarantineMs ?? ORPHAN_QUARANTINE_MS;
@@ -7963,7 +8446,8 @@ async function recoverOrphans(candidates, options) {
     flushed: 0,
     quarantined: 0,
     errors: [],
-    failedBuckets: /* @__PURE__ */ new Set()
+    failedBuckets: /* @__PURE__ */ new Set(),
+    failedDrainFlushed: 0
   };
   const recoverable = selectRecoverable(candidates, options.now ?? Date.now(), {
     ownerPid: options.ownerPid ?? process.pid,
@@ -7974,28 +8458,41 @@ async function recoverOrphans(candidates, options) {
     if (summary.failedBuckets.has(file.bucket)) {
       continue;
     }
-    try {
-      const counts = await drain(file.path);
-      summary.flushed += counts.flushed;
-      summary.quarantined += counts.quarantined;
-    } catch (err) {
-      summary.errors.push(err);
+    const { counts, failure: failure4 } = await settleDrain((onProgress) => drain(file.path, onProgress));
+    summary.flushed += counts.flushed;
+    summary.quarantined += counts.quarantined;
+    if (failure4) {
+      summary.failedDrainFlushed += counts.flushed;
+      summary.errors.push(failure4.error);
       summary.failedBuckets.add(file.bucket);
     }
   }
   return summary;
 }
 var FlushError = class extends Error {
+  /** Moves the whole sweep acknowledged, across every drain it ran. */
   flushed;
   quarantined;
-  constructor(cause, flushed, quarantined) {
+  /** Buckets the failed sweep held back without sending, as on success. */
+  retained;
+  /**
+   * Of `flushed`, the Moves acknowledged by the drains that failed, before
+   * they failed. Only this shows the failure itself is advancing: `flushed`
+   * also counts other buckets' drains, so a bucket whose drain fails every
+   * time would read as progress while a sibling bucket kept delivering.
+   */
+  failedDrainFlushed;
+  constructor(cause, flushed, quarantined, retained = [], failedDrainFlushed = 0) {
     super(cause instanceof Error ? cause.message : String(cause), { cause });
     this.name = "FlushError";
     this.flushed = flushed;
     this.quarantined = quarantined;
+    this.retained = retained;
+    this.failedDrainFlushed = failedDrainFlushed;
   }
 };
 async function flushOnce() {
+  sweepOrphanedDrainProgress();
   const orphanCandidates = listFlushing({ sampleBytes: 0 });
   const liveBuckets = listBuckets();
   if (orphanCandidates.length === 0 && liveBuckets.length === 0) {
@@ -8012,10 +8509,11 @@ async function flushOnce() {
   const binding = inspection.binding;
   const recovered = await recoverOrphans(
     orphanCandidates.filter((file) => inspection.deliverableBuckets.has(file.bucket)),
-    { drain: (path) => drainFlushingPath(path, client, binding) }
+    { drain: (path, onProgress) => drainFlushingPath(path, client, binding, { onProgress }) }
   );
   let total = recovered.flushed;
   let quarantined = recovered.quarantined;
+  let failedDrainFlushed = recovered.failedDrainFlushed;
   const errors = recovered.errors;
   for (const { bucket, path } of liveBuckets) {
     if (!inspection.deliverableBuckets.has(bucket)) {
@@ -8024,21 +8522,29 @@ async function flushOnce() {
     if (recovered.failedBuckets.has(bucket)) {
       continue;
     }
-    try {
-      const counts = await drainPath(path, client, binding);
-      total += counts.flushed;
-      quarantined += counts.quarantined;
-    } catch (err) {
-      errors.push(err);
+    const { counts, failure: failure4 } = await settleDrain(
+      (onProgress) => drainPath(path, client, binding, onProgress)
+    );
+    total += counts.flushed;
+    quarantined += counts.quarantined;
+    if (failure4) {
+      failedDrainFlushed += counts.flushed;
+      errors.push(failure4.error);
     }
   }
   if (errors.length > 0) {
-    throw new FlushError(errors[0], total, quarantined);
+    throw new FlushError(
+      errors[0],
+      total,
+      quarantined,
+      inspection.retainedBuckets,
+      failedDrainFlushed
+    );
   }
   return inspection.retainedBuckets.length > 0 ? { flushed: total, quarantined, retained: inspection.retainedBuckets } : { flushed: total, quarantined };
 }
 var flushInFlight;
-var FLUSH_LOCK_PATH = join8(dirname4(JOURNAL_DIR), ".flush.lock");
+var FLUSH_LOCK_PATH = join8(dirname3(JOURNAL_DIR), ".flush.lock");
 var FLUSH_LOCK_TIMEOUT_MS = 250;
 function isFlushLockContended(error) {
   return error instanceof Error && error.message.startsWith("timed out waiting for file lock");
@@ -8063,18 +8569,16 @@ function flush() {
   return attempt;
 }
 function shouldFlushPending(stats, now, thresholdMs = OPPORTUNISTIC_FLUSH_AFTER_MS) {
-  if (stats.sampled) {
+  if (stats.sampled || stats.strandedFileCount > 0 && stats.strandedCount === 0) {
     return true;
   }
   return stats.pendingCount > 0 && (stats.oldestPendingAt === void 0 || now - stats.oldestPendingAt > thresholdMs);
 }
-async function flushIfNeeded() {
+function journalNeedsFlush(now = Date.now()) {
   try {
-    const stats = pendingJournalStats();
-    if (shouldFlushPending(stats, Date.now())) {
-      await flush();
-    }
+    return shouldFlushPending(pendingJournalStats(), now);
   } catch {
+    return false;
   }
 }
 
@@ -8133,7 +8637,7 @@ function registerMovesCommands(program2) {
     }
     if (stranded.length > 0) {
       const moveCount = stranded.reduce((n, f) => n + f.lineCount, 0);
-      const byteCount = stranded.reduce((n, f) => n + f.sizeBytes, 0);
+      const byteCount = stranded.reduce((n, f) => n + f.pendingBytes, 0);
       const sampled = stranded.some((file) => file.sampled);
       const qualifier = sampled ? "at least " : "";
       console.log(
@@ -8144,7 +8648,7 @@ function registerMovesCommands(program2) {
         const owner = f.pid === void 0 ? "no pid" : `pid ${String(f.pid)}`;
         const count = `${String(f.lineCount)}${f.sampled ? "+" : ""}`;
         console.log(
-          `  ${f.bucket.padEnd(BUCKET_COL_WIDTH)} ${count.padStart(5)} stranded, ${String(f.sizeBytes).padStart(8)} bytes, ${String(ageS)}s ago (${owner})`
+          `  ${f.bucket.padEnd(BUCKET_COL_WIDTH)} ${count.padStart(5)} stranded, ${String(f.pendingBytes).padStart(8)} bytes, ${String(ageS)}s ago (${owner})`
         );
       }
     }
@@ -8342,6 +8846,20 @@ import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
 import { join as join11 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
+var SETUP_ORCHESTRATOR_ENV = "PRIM_SETUP_ORCHESTRATOR";
+var SETUP_DAEMON_DRAINS_ENV = "PRIM_SETUP_DAEMON_DRAINS";
+function setupStepSpawnOptions(capture, env = process.env, options = {}) {
+  return {
+    env: {
+      ...env,
+      [SETUP_ORCHESTRATOR_ENV]: "1",
+      // Unset rather than inherited when this setup starts no daemon.
+      [SETUP_DAEMON_DRAINS_ENV]: options.startsDaemon === true ? "1" : void 0
+    },
+    stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
+    encoding: "utf-8"
+  };
+}
 var SESSION_LABELS = {
   claude: "Claude Code integration",
   codex: "Codex integration",
@@ -8374,12 +8892,16 @@ function planSetupSteps(opts) {
       required: true
     });
   }
-  steps.push({
-    key: "hooks",
-    label: "Git hooks",
-    args: ["hooks", "install", ...scopeArgs],
-    required: true
-  });
+  if (opts.scope === "project") {
+    steps.push({ key: "hooks", label: "Git hooks", args: ["hooks", "install"], required: true });
+  } else if (opts.globalHooksPath) {
+    steps.push({
+      key: "hooks",
+      label: "Git hooks (global)",
+      args: ["hooks", "install", "--scope", "user", "--global-hooks-path"],
+      required: true
+    });
+  }
   const skillArgs = ["skill", "install", "--agent", opts.agent, ...scopeArgs];
   steps.push({ key: "skill", label: "Agent skill", args: skillArgs, required: true });
   steps.push({
@@ -8392,7 +8914,7 @@ function planSetupSteps(opts) {
     steps.push({
       key: "health",
       label: "Capture health",
-      args: ["doctor"],
+      args: ["doctor", "--expect-backlog"],
       required: true
     });
   }
@@ -8410,7 +8932,44 @@ function planCleanupUninstalls(agent, conflicts) {
   if (conflicts.includes(CONFLICT_SKILL)) steps.push(["skill", "uninstall", "--agent", agent]);
   return steps;
 }
-function detectProjectConflicts(agent, run) {
+function preCommitRunsPrim(content) {
+  return content.includes("# >>> prim pre-commit hook >>>") || content.includes("prim-pre-commit");
+}
+function projectHooksConflict(globalHooksActive, preCommit) {
+  return globalHooksActive && preCommit !== void 0 && preCommitRunsPrim(preCommit);
+}
+function enableWiresRepository(root) {
+  if (!root) return void 0;
+  try {
+    if (gitHooksMode({ cwd: root }) === "manual") return void 0;
+    return resolveEffectiveGitHook("post-commit", root).location !== "external";
+  } catch {
+    return void 0;
+  }
+}
+function setupGitHooksNote(plan, wiresThisRepository) {
+  if (wiresThisRepository === true && plan.action === "add_to_dir") {
+    return `git hooks \xB7 Git runs this repository's hooks from inside it, so \`prim enable\` wires it; other repositories may run ${plan.global}, which prim edits only with --global-hooks-path, after asking the user`;
+  }
+  if (wiresThisRepository === true && plan.action === "system_declined") {
+    return `git hooks \xB7 Git runs this repository's hooks from inside it, so \`prim enable\` wires it; other repositories may run the system hooks dir ${plan.system}, which prim never edits`;
+  }
+  switch (plan.action) {
+    case "refresh":
+      return "git hooks \xB7 prim's global hooks stay active; `prim enable` refreshes them";
+    case "present_in_dir":
+      return `git hooks \xB7 prim's hooks are already in your global hooks dir ${plan.global}`;
+    case "add_to_dir":
+      return `git hooks \xB7 your global core.hooksPath (${plan.global}) runs every repository's hooks, so \`prim enable\` cannot wire this repository without it; add prim there with --global-hooks-path, after asking the user`;
+    case "system_declined":
+      return `git hooks \xB7 the system core.hooksPath (${plan.system}) runs every repository's hooks, so \`prim enable\` cannot wire this repository: place \`prim hooks snippet <hook>\` there, or, after asking the user, run \`prim hooks install --scope user --global-hooks-path --force\` (its hooks stop firing)`;
+    case "manual":
+      return "git hooks \xB7 prim.gitHooks=manual: prim writes no hook files; wire them with `prim hooks snippet <hook>`";
+    default:
+      return "git hooks \xB7 wired per repository by `prim enable`; git's global hooks are untouched (opt in with --global-hooks-path)";
+  }
+}
+function detectProjectConflicts(agent, run, globalHooksActive) {
   const conflicts = [];
   if (agent !== "hermes") {
     try {
@@ -8419,14 +8978,14 @@ function detectProjectConflicts(agent, run) {
     } catch {
     }
   }
+  let preCommit;
   try {
     const root = gitToplevel();
-    const preCommit = root && join11(root, ".git", "hooks", "pre-commit");
-    if (preCommit && existsSync10(preCommit) && readFileSync7(preCommit, "utf-8").includes("prim-pre-commit")) {
-      conflicts.push(CONFLICT_HOOKS);
-    }
+    const path = root && join11(root, ".git", "hooks", "pre-commit");
+    if (path && existsSync10(path)) preCommit = readFileSync7(path, "utf-8");
   } catch {
   }
+  if (projectHooksConflict(globalHooksActive, preCommit)) conflicts.push(CONFLICT_HOOKS);
   try {
     const parsed = JSON.parse(
       run(["skill", "status", "--agent", agent, "--json"], true).stdout || "{}"
@@ -8466,8 +9025,11 @@ function registerSetupCommand(program2, dependencies = {}) {
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
   ).option("--agent <agent>", "claude, codex, cursor, or hermes (auto-detected when omitted)").option(
     "--scope <scope>",
-    "user (default \u2014 install once for every repo) or project (this repo only)",
+    "user (default \u2014 agent integration and skill for every repo; git hooks per repo via enable) or project (this repo only)",
     "user"
+  ).option(
+    "--global-hooks-path",
+    "with the default user scope, also change git's global hooks so prim's hooks run in every repository"
   ).option(
     "--migrate",
     "with the default user scope, remove any project-scoped prim config in this repo (else just warn)"
@@ -8487,15 +9049,21 @@ function registerSetupCommand(program2, dependencies = {}) {
       (dependencies.exit ?? process.exit)(EXIT_USAGE3);
       return;
     }
+    if (opts.globalHooksPath && opts.scope !== "user") {
+      process.stderr.write("[prim] --global-hooks-path applies only with --scope user\n");
+      (dependencies.exit ?? process.exit)(EXIT_USAGE3);
+      return;
+    }
     const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
     const globals = program2.optsWithGlobals();
     const run = dependencies.run ?? ((args, capture = false) => {
-      const r = spawnSync2(process.execPath, [self, ...args], {
-        stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
-        encoding: "utf-8"
-      });
+      const r = spawnSync2(
+        process.execPath,
+        [self, ...args],
+        setupStepSpawnOptions(capture, process.env, { startsDaemon: opts.daemon })
+      );
       return { code: r.status ?? 1, stdout: capture ? r.stdout ?? "" : "" };
     });
     const results = {};
@@ -8537,16 +9105,24 @@ function registerSetupCommand(program2, dependencies = {}) {
       note("pre-authorize \xB7 writing prim allow-rule (user scope)\u2026");
       results.preauth = run(["claude", "preauth", "--scope", "user"]).code === 0 ? "ok" : "skipped";
     }
-    const setupSteps = planSetupSteps({ agent, daemon: opts.daemon, scope });
+    const setupSteps = planSetupSteps({
+      agent,
+      daemon: opts.daemon,
+      scope,
+      globalHooksPath: opts.globalHooksPath === true
+    });
     for (const step of setupSteps.filter(
       (candidate) => candidate.key !== "enable" && candidate.key !== "health"
     )) {
       note(`${step.label} \xB7 installing\u2026`);
       const { code } = run(step.args);
-      results[step.key] = code === 0 ? "ok" : step.required ? "failed" : "skipped";
+      results[step.key] = code === 0 ? "ok" : code === EXIT_GLOBAL_HOOKS_NOT_INSTALLED && step.key === "hooks" ? "skipped" : step.required ? "failed" : "skipped";
+    }
+    if (scope === "user" && !opts.globalHooksPath) {
+      note(setupGitHooksNote(planGlobalHooks(), enableWiresRepository(gitToplevel())));
     }
     if (scope === "user") {
-      const conflicts = detectProjectConflicts(agent, run);
+      const conflicts = detectProjectConflicts(agent, run, globalHooksPathIsPrims());
       if (conflicts.length > 0 && opts.migrate) {
         note(`migrate \xB7 removing project-scoped config (${conflicts.join(", ")})\u2026`);
         const ok = planCleanupUninstalls(agent, conflicts).map((args) => run(args).code === 0).every(Boolean);
@@ -8587,12 +9163,12 @@ function registerSetupCommand(program2, dependencies = {}) {
 
 // src/commands/statusline.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname5, resolve as resolve3 } from "path";
+import { dirname as dirname4, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 function readPackageVersion() {
   try {
-    const here = dirname5(fileURLToPath(import.meta.url));
+    const here = dirname4(fileURLToPath(import.meta.url));
     const candidates = [
       // Schema-v2 runtimes staged a manifest beside this standalone bundle.
       // Keep resolving it while those legacy launchers transition to schema v3.
@@ -9016,28 +9592,233 @@ function registerWelcomeCommand(program2, deps = { getClient }) {
   });
 }
 
+// src/daemon/drift-heal.ts
+var ATTEMPT_MARKER_MODE = 384;
+var ATTEMPT_MARKER_MAX_BYTES = 1024;
+var PATH_SEPARATORS = /[\\/]/u;
+var DAEMON_DRIFT_HEAL_ENV = "PRIM_DAEMON_DRIFT_HEAL";
+var DAEMON_DRIFT_HEAL_RETRY_MS = 60 * 60 * 1e3;
+function readAttempt(path) {
+  const file = readBoundedRegularFile(path, ATTEMPT_MARKER_MAX_BYTES);
+  if (!file) return null;
+  try {
+    const value = JSON.parse(file.text);
+    if (typeof value !== "object" || value === null) return null;
+    const attempt = value;
+    return typeof attempt.attemptedAt === "number" && Number.isFinite(attempt.attemptedAt) && typeof attempt.fromVersion === "string" && typeof attempt.toVersion === "string" ? attempt : null;
+  } catch {
+    return null;
+  }
+}
+function claimHeld() {
+  throw new Error("another command holds the daemon drift-heal claim");
+}
+function claimAttempt(markerPath2, attempt) {
+  const previous = readAttempt(markerPath2);
+  const elapsed = previous ? attempt.attemptedAt - previous.attemptedAt : Number.POSITIVE_INFINITY;
+  if (elapsed >= 0 && elapsed < DAEMON_DRIFT_HEAL_RETRY_MS) return false;
+  atomicWriteFile(markerPath2, `${JSON.stringify(attempt)}
+`, { mode: ATTEMPT_MARKER_MODE });
+  return true;
+}
+function isInstalledPackage(root) {
+  return root?.split(PATH_SEPARATORS).includes("node_modules") === true;
+}
+function needsHeal(launcher, toVersion) {
+  const order = compareSemver(launcher.runtimeVersion, toVersion);
+  return order === -1 || order === 0 && !launcher.runnable;
+}
+function startDriftHeal(options) {
+  if ((options.platform ?? process.platform) !== "darwin") return false;
+  const env = options.env ?? process.env;
+  if (env[DAEMON_DRIFT_HEAL_ENV] === "0") return false;
+  const root = options.packageRoot === void 0 ? packageRoot() : options.packageRoot;
+  if (!isInstalledPackage(root)) return false;
+  const euid = options.euid ?? process.geteuid?.();
+  if (euid === void 0 || euid === 0) return false;
+  const paths = { env, homeDir: options.homeDir };
+  if (daemonExplicitlyDisabled(paths)) return false;
+  const launcher = (options.selectedLauncher ?? (() => selectedDaemonLauncher(paths)))();
+  if (!launcher || launcher.ownerUid !== euid) return false;
+  const toVersion = options.cliVersion === void 0 ? packageVersion() : options.cliVersion;
+  if (!(toVersion && needsHeal(launcher, toVersion))) return false;
+  if (!apiUrlsMatch(
+    getSiteUrlForEnvironment(launcher.apiUrl),
+    getSiteUrlForEnvironment(env.PRIM_API_URL)
+  )) {
+    return false;
+  }
+  const runsConfigRoot = options.launchAgentRunsConfigRoot ?? (() => launchAgentRunsConfigRoot(paths));
+  if (!runsConfigRoot()) return false;
+  const primEntry = options.primEntry === void 0 ? binFile("prim") : options.primEntry;
+  if (!primEntry) return false;
+  const attempt = {
+    attemptedAt: (options.nowMs ?? Date.now)(),
+    fromVersion: launcher.runtimeVersion,
+    toVersion
+  };
+  const claimed = withFileLockSync(
+    daemonDriftHealClaimPath(paths),
+    () => claimAttempt(daemonDriftHealMarkerPath(paths), attempt),
+    { timeoutMs: 0, sleep: claimHeld }
+  );
+  if (!claimed) return false;
+  return kickDaemonEnsure({
+    primEntry,
+    nodeEntry: options.nodeEntry,
+    spawnProcess: options.spawnProcess,
+    latestBootstrap: false
+  });
+}
+function healDaemonDrift(options = {}) {
+  try {
+    return startDriftHeal(options);
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/background-flush.ts
+import { spawn as spawn3 } from "child_process";
+import { readFileSync as readFileSync9 } from "fs";
+
+// src/daemon/health.ts
+import { chmodSync as chmodSync3, existsSync as existsSync11, mkdirSync as mkdirSync7, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join12 } from "path";
+var HEARTBEAT_FRESH_MS = 9e4;
+var DAEMON_HEALTH_PATH = join12(primConfigDirectory(), "daemon-health.json");
+
+// src/lib/background-flush.ts
+function record2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function daemonOwnsDrain(options = {}) {
+  try {
+    const expectedVersion = options.expectedVersion === void 0 ? packageVersion() : options.expectedVersion;
+    if (!expectedVersion) return false;
+    const health = record2(
+      JSON.parse(readFileSync9(options.healthPath ?? DAEMON_HEALTH_PATH, "utf8"))
+    );
+    const heartbeat = record2(health?.heartbeat);
+    const ingestion = record2(health?.ingestion);
+    if (!(health && heartbeat && ingestion)) return false;
+    if (health.schemaVersion !== 1 || health.version !== expectedVersion) return false;
+    const daemonSiteUrl = health.siteUrl;
+    if (typeof daemonSiteUrl !== "string" || envSlug(daemonSiteUrl) !== envSlug(options.siteUrl ?? getSiteUrl())) {
+      return false;
+    }
+    if (health.needsReauth === true) return false;
+    const pid = health.pid;
+    if (typeof pid !== "number" || !(options.isAlive ?? processIsAlive)(pid)) return false;
+    const lastSuccessAt = heartbeat.lastSuccessAt;
+    const now = options.now ?? Date.now();
+    return heartbeat.consecutiveFailures === 0 && typeof lastSuccessAt === "number" && lastSuccessAt <= now && now - lastSuccessAt < HEARTBEAT_FRESH_MS && ingestion.consecutiveFailures === 0;
+  } catch {
+    return false;
+  }
+}
+function startBackgroundFlush(options = {}) {
+  try {
+    if ((options.daemonOwnsDrain ?? daemonOwnsDrain)()) return false;
+    if (!(options.needsFlush ?? journalNeedsFlush)()) return false;
+    const primEntry = options.primEntry === void 0 ? binFile("prim") : options.primEntry;
+    if (!primEntry) return false;
+    const child = (options.spawnProcess ?? spawn3)(
+      options.nodeEntry ?? process.execPath,
+      [primEntry, "moves", "flush"],
+      // Ignored stdio matters as much as detaching: a child holding inherited
+      // pipes would keep a caller that captures them (spawnSync) waiting.
+      // windowsHide keeps the detached child from opening a console window.
+      // The child is unattended even when its parent is not: `doctor` or
+      // `statusline` must not reach the daemon drift heal through its drain.
+      { detached: true, stdio: "ignore", windowsHide: true, env: unattendedEnv() }
+    );
+    child.once("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/lib/startup-background.ts
 var ROOT_OPTIONS = /* @__PURE__ */ new Set(["-y", "--yes", "--non-interactive"]);
+var HELP_OPTIONS = /* @__PURE__ */ new Set(["-h", "--help"]);
+var DAEMON_HEAL_COMMANDS = /* @__PURE__ */ new Map([
+  // Credentials; `auth login` is how a person returns to a daemon held for re-auth.
+  ["auth", /* @__PURE__ */ new Set(["api-keys", "login", "set-token", "status"])],
+  // Reading and curating the decision graph: the everyday attended surface.
+  [
+    "decisions",
+    /* @__PURE__ */ new Set([
+      "cascade",
+      "check",
+      "confirm",
+      "create",
+      "demote",
+      "link",
+      "promote",
+      "publish",
+      "ratify",
+      "recent",
+      "repairs",
+      "rescope",
+      "restore",
+      "show",
+      "supersede",
+      "unlink",
+      "withdraw"
+    ])
+  ],
+  ["reconcile", "any"],
+  // Repository connection, activation, and journal plumbing a person steers.
+  // Hook-side `moves flush` drains are unattended and never reach this table.
+  ["github", /* @__PURE__ */ new Set(["connect"])],
+  ["enable", "any"],
+  ["moves", /* @__PURE__ */ new Set(["bind", "drop", "flush", "status", "tail"])],
+  ["session", /* @__PURE__ */ new Set(["drop", "list", "start"])],
+  // Installing or inspecting an integration, never removing one.
+  ["claude", /* @__PURE__ */ new Set(["install", "preauth", "status"])],
+  ["codex", /* @__PURE__ */ new Set(["install", "status"])],
+  ["cursor", /* @__PURE__ */ new Set(["install", "status"])],
+  ["hermes", /* @__PURE__ */ new Set(["install", "status"])],
+  ["hooks", /* @__PURE__ */ new Set(["install"])],
+  ["skill", /* @__PURE__ */ new Set(["install", "status"])],
+  ["welcome", "any"]
+]);
 function commandArguments(argv) {
   let index = 0;
   while (ROOT_OPTIONS.has(argv[index] ?? "")) index += 1;
   return argv.slice(index);
 }
+function mayHealDaemon(argv, env) {
+  if (isUnattended(env) || env[SETUP_ORCHESTRATOR_ENV] === "1") return false;
+  const args = commandArguments(argv);
+  if (args.some((arg) => HELP_OPTIONS.has(arg))) return false;
+  const [command, subcommand] = args;
+  const allowed = command === void 0 ? void 0 : DAEMON_HEAL_COMMANDS.get(command);
+  if (allowed === void 0) return false;
+  return allowed === "any" || subcommand !== void 0 && allowed.has(subcommand);
+}
 function runStartupBackgroundWork(argv, env, work) {
-  const [command, subcommand] = commandArguments(argv);
+  const args = commandArguments(argv);
+  const [command, subcommand] = args;
   const uninstall = command === "uninstall" || env[UNINSTALL_ORCHESTRATOR_ENV] === "1";
   if (uninstall) return;
   work.notify();
-  if (command !== "moves" || subcommand !== "flush") work.flush().catch(() => {
-  });
+  const setupDaemonDrains = command === "setup" && !args.includes("--no-daemon") || env[SETUP_DAEMON_DRAINS_ENV] === "1";
+  if (!setupDaemonDrains && (command !== "moves" || subcommand !== "flush")) work.flush();
+  if (mayHealDaemon(argv, env)) work.healDaemon();
 }
 
 // src/index.ts
 var __dirname = dirname6(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync9(resolve4(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync10(resolve4(__dirname, "../package.json"), "utf-8"));
 runStartupBackgroundWork(process.argv.slice(2), process.env, {
   notify: () => updateNotifier({ pkg }).notify(),
-  flush: () => flushIfNeeded()
+  flush: () => startBackgroundFlush(),
+  healDaemon: () => healDaemonDrift()
 });
 var program = new Command();
 program.name("prim").description("CLI for Primitive's decision graph").version(pkg.version).option("-y, --yes", "auto-confirm prompts").option(