@tekmidian/pai 1.0.0 → 1.0.3

package/dist/cli/index.mjs

@@ -1,75 +1,79 @@
 #!/usr/bin/env node
 import { _ as warn$1, a as fmtDate, c as ok$1, d as scaffoldProjectDirs, f as shortenPath, g as stripAnsi, h as smartDecodeDir, i as err, l as renderTable$1, m as slugify, n as dim$1, o as header, r as encodeDir, s as now, t as bold$1, u as resolvePath } from "../utils-J2b9y8PC.mjs";
 import { _ as resolvePaiFile, a as paiCacheDir, c as PaiFileMigrationError, d as defaultPaiHomeDir, f as legacyConfigDir, g as paiHomePath, h as paiHomeDir, l as claudeHomeDir, m as migratePaiFile, o as paiSocketPath, p as migratePaiDir, r as daemonLogPath, s as schedulerLogPath, u as claudeProjectsDir } from "../runtime-paths-WsO9sJFc.mjs";
-import { a as slugify$1, i as parseSessionFilename } from "../migrate-BUJHadA8.mjs";
-import { I as LOOPBACK_HOST, Q as relocateWorkersYaml, _t as contextWindowFromModelId, c as WorkersConfigError, f as escalationCloud, ht as DEFAULT_CONTEXT_WINDOW, j as readWorkersSection, m as isLocalProvider, p as getProviderOrNative, t as ANTHROPIC_NATIVE, tt as workersYamlPath, v as nativeAnthropicModels, vt as stripModelVariant, wt as appendLedger } from "../config-D5chi2LO.mjs";
-import { A as postgresConnectionString, C as migrateMainConfigToYaml, D as readJsonStrict, O as writeJsonAtomic, S as MainConfigError, c as loadConfig, d as paiConfigYamlFilePath, f as readMainConfigRaw, k as DEFAULT_PG_CONNECTION_TIMEOUT_MS, l as migrateConfigFile, n as CONFIG_FILE$2, o as expandHome, p as writeMainConfigRaw, t as CONFIG_DIR, u as paiConfigFilePath, w as resolvedMainConfigPath } from "../config-BSXKyeJ1.mjs";
-import { i as ledgerPath, n as ensureNoMcpConfig, u as workersLogDir } from "../paths-DoIyRnhx.mjs";
-import "../worktree-zmRf556h.mjs";
-import { B as loadStatusConfig, G as writeSectionToForge, L as formatStale, U as upsertSection, b as loadStatusesCached, g as isLive, h as isChatPane, y as loadStatuses } from "../status-CvVi9cDf.mjs";
-import { S as inputSideTokens, h as poolSettings, i as bundleBuildStamp, j as writeClaudeJson, k as readClaudeJson, v as readPoolState, w as expandMcpNames } from "../pool-CZ5MZaXg.mjs";
-import { a as unregistrableReason, s as worktreeReason } from "../registrable-LrRIVYQc.mjs";
-import "../pai-marker-kIYuNt3c.mjs";
-import "../helpers-CJpb_MNB.mjs";
-import { t as applyRecencyBoost } from "../search-CPoE0830.mjs";
-import { t as dropItermBundleId } from "../env-DArqGq-Z.mjs";
-import { a as ownerSessionName, d as terminalHasName } from "../scope-D5VSQxe4.mjs";
-import { $n as parseSince, Cn as allSetups, Dn as loadSaved, E as budgetCache, Et as routerPort, F as LimitsCache, Gn as recordDuration, Hn as parkConfigFrom, Jn as appendUsage, Kn as aggregate, Mn as setupsPath, Tt as routerHandler, U as computeInventory, Un as setParkConfigSource, Ut as sessionStartTarget, W as currentInventory, Wn as sharedParker, Xn as formatStats, Y as inventoryText, Yn as formatSessionStats, at as readInventoryInput, bt as routeVerdictLine, er as readUsage, kn as saveSetup, ln as readProfiles, m as readRoutingState, mn as localProviderForDelegation, on as SESSION_NAME_ENV, pt as isLoopbackProvider, qn as aggregateBySession, vn as providerHostPort, wn as downLocalProviders, x as SESSION_WORKER_PROVIDER_ENV } from "../routing-CUyiglfu.mjs";
-import "../tool-errors-AeRQuG3Y.mjs";
-import "../wait-BMUR-U-U.mjs";
-import "../local-tiers-DPZYqv9m.mjs";
-import { _ as poolSlots, a as enqueue, d as removeTicket, f as renderBuildQueue, i as buildsDir, l as patchTicket, m as tryStart, n as buildLogPath, o as getTicket, r as buildNext, s as listBuilds, v as slotsFor } from "../caller-identity-CVTuiLSs.mjs";
-import { c as mirrorTo, d as schedConfigFrom, g as sharedScheduler, h as setSchedConfigSource, n as tierProviderNames, t as isLocalCandidate } from "../local-candidate-jOjTNlOL.mjs";
-import { i as effectiveCap, o as providerCap, r as capacityOf } from "../capacity-DaXrVj3J.mjs";
-import { n as TAILSCALE_STATUS_TIMEOUT_MS } from "../timeouts-OwEONmc8.mjs";
-import { n as OPT, t as CliError } from "../define-DGFu-sCf.mjs";
-import { a as getStorageBackend, c as MergeError, f as humanDuration, i as getRegistryBackend, l as federationDbPath, o as oldRegistryPath, r as createStorageBackend, s as registryDbPath, u as oldFederationPath } from "../factory-BtjbQ0np.mjs";
-import { c as resolveFromModule, i as retryTransient, n as embedChunksWithBackend, r as indexProjectWithBackend, s as packageRoot } from "../postgres-CDnd_k5f.mjs";
-import { d as OLLAMA_ID, f as ollamaDefaultUrl, i as measureThroughput, l as provisionOllama, o as createBackend, s as detectBackends, u as OLLAMA_DEFAULT_MODEL } from "../embedding-gate-BHuBsgHD.mjs";
-import "../embeddings-D4t6L-EH.mjs";
-import "../router-L8Nu-OHF.mjs";
-import { t as detectProject } from "../detect-C1d5cUkT.mjs";
-import { n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier } from "../helpers-DFmYRCOa.mjs";
-import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-B7I0gPe-.mjs";
-import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-CNXF6DLP.mjs";
-import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-DgqQdAjI.mjs";
-import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-C6jZWvRG.mjs";
-import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-CLp0OJxV.mjs";
-import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-BMeJuHOb.mjs";
-import { n as fetchLiveSessions, r as sendToSession, t as callAiBroker } from "../aibroker-client-CXEYBzbf.mjs";
-import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-BDLEc4w1.mjs";
-import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-ulAi5dFD.mjs";
-import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, jt as runPaneExec, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage, yt as psTable } from "../controls-BGkK_Bdi.mjs";
-import "../endreason-x1KOSrcO.mjs";
-import { N as endBuildWait, j as beginBuildWait } from "../render-BDbb4CF-.mjs";
-import "../operator-DZxcP-g8.mjs";
-import "../kill-tree-BjYz5BxK.mjs";
-import { s as poolReloadLive } from "../pool-cli-BxNSPzzY.mjs";
-import "../chain-BcQlIlEd.mjs";
-import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-DM4npnL3.mjs";
-import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-OGYrOAik.mjs";
-import "../viewer-DtWj5Vti.mjs";
-import { g as setWorkersEnabled, s as describeProviders } from "../providers-UsKtLcUR.mjs";
-import { $ as createEndpointHealth, G as cachedSessionMap, J as setActionHooks, K as cachedWorkerWindows, Q as exportDefaultLayout, R as installWorkers, U as SystemMonitor, W as cachedRows, X as setRuntimeSampler, Y as setEndpointHealth, Z as warmCockpit, et as loadSessionMap, n as WORKER_CONFIG_COMMANDS, nt as sessionDisplayName, q as handleCockpit, rt as withWorkerAttribution, st as providersCommand, t as PROVIDER_EDIT_COMMANDS, tt as loadWorkerWindows, z as mergeSettings } from "../worker-config-BLqa1yiD.mjs";
-import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-C0SflOWk.mjs";
-import { I as cockpitProbeSettings, L as acquireRun, R as readRun, w as readRuntimeCommands } from "../cockpit-actions-ODmt8yF9.mjs";
-import { n as PaiClient } from "../ipc-client-BMqWw_gv.mjs";
-import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-CeQD8kRE.mjs";
-import "../fallback-BIyEpPsQ.mjs";
-import { At as readQuiet, Bt as appendCheckpointToNote, C as migrateSummaryCooldowns, Et as totalUsageTokens, Gt as restartRouter, Ht as findLatestNote, It as resolveDaemonPid, Nt as writeQuiet, Ot as describeQuiet, Pt as LAUNCHD_LABEL, Rt as readContextHandoverCache, St as loadSessionKeepaliveState, Tt as parseSessionUsage, Ut as findNotesDir$1, Vt as applyContinue, Wt as readBodyFile, bt as reapJob, ht as obsidianEnabled, i as reexecBackground, kt as nextOccurrence, mt as OBSIDIAN_DISABLED_MESSAGE, o as backfillKgFromNotes, s as migrateKgBackfillState, v as migrateWorkQueue, vt as migrateIdentityFile, wt as sessionKeepaliveLedgerSummary, yt as jobPaths } from "../indexer-backend-BM2CUSu8.mjs";
-import { n as queriesDirPath, t as migrateQueriesDir } from "../query-feedback-I-txSnld.mjs";
-import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { a as slugify$1, i as parseSessionFilename } from "../migrate-DrA_OwlZ.mjs";
+import { I as LOOPBACK_HOST, Q as relocateWorkersYaml, _t as contextWindowFromModelId, c as WorkersConfigError, f as escalationCloud, ht as DEFAULT_CONTEXT_WINDOW, j as readWorkersSection, m as isLocalProvider, p as getProviderOrNative, t as ANTHROPIC_NATIVE, tt as workersYamlPath, v as nativeAnthropicModels, vt as stripModelVariant, wt as appendLedger } from "../config-XpZWOYOG.mjs";
+import { A as assertPgName, C as migrateMainConfigToYaml, D as readJsonStrict, M as postgresConnectionString, N as postgresFullTarget, O as writeJsonAtomic, P as quoteIdent, S as MainConfigError, c as loadConfig, d as paiConfigYamlFilePath, f as readMainConfigRaw, j as isContainerTarget, k as DEFAULT_PG_CONNECTION_TIMEOUT_MS, l as migrateConfigFile, n as CONFIG_FILE$2, o as expandHome, p as writeMainConfigRaw, t as CONFIG_DIR, u as paiConfigFilePath, w as resolvedMainConfigPath } from "../config-Bu1_vbY8.mjs";
+import { i as ledgerPath, n as ensureNoMcpConfig, u as workersLogDir } from "../paths-CHifubDh.mjs";
+import "../worktree-CRs2gyg0.mjs";
+import { B as loadStatusConfig, G as writeSectionToForge, L as formatStale, U as upsertSection, b as loadStatusesCached, g as isLive, h as isChatPane, y as loadStatuses } from "../status-ggJ7lgVg.mjs";
+import { A as readClaudeJson, N as writeClaudeJson, S as inputSideTokens, h as poolSettings, i as bundleBuildStamp, j as registerMcpScript, k as mcpEntryRunsScript, v as readPoolState, w as expandMcpNames } from "../pool-Dh-q3iJi.mjs";
+import { a as unregistrableReason, s as worktreeReason } from "../registrable-DpyTtajg.mjs";
+import "../pai-marker-BcZyJguM.mjs";
+import "../helpers-CRuBUas3.mjs";
+import { t as applyRecencyBoost } from "../search-RSyeQqj1.mjs";
+import { t as dropItermBundleId } from "../env-BE8mrsxr.mjs";
+import { a as ownerSessionName, d as terminalHasName } from "../scope-D-h6F6DN.mjs";
+import { An as saveSetup, Bn as aggregate, Dt as routerPort, E as budgetCache, Et as routerHandler, F as LimitsCache, Hn as appendUsage, In as parkConfigFrom, Jn as readUsage, Ln as setParkConfigSource, Nn as setupsPath, On as loadSaved, Rn as sharedParker, Tn as downLocalProviders, U as computeInventory, Un as formatSessionStats, Vn as aggregateBySession, W as currentInventory, Wn as formatStats, Wt as sessionStartTarget, Y as inventoryText, at as readInventoryInput, hn as localProviderForDelegation, m as readRoutingState, pt as isLoopbackProvider, qn as parseSince, sn as SESSION_NAME_ENV, un as readProfiles, wn as allSetups, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine, yn as providerHostPort, zn as recordDuration } from "../routing-BAAST9vT.mjs";
+import { n as minOf } from "../min-max-DrSRUaWQ.mjs";
+import "../tool-errors-7E13StWd.mjs";
+import "../wait-ByV0OyMZ.mjs";
+import "../local-tiers-BE4jGaMa.mjs";
+import { a as buildsDir, c as listBuilds, f as removeTicket, h as tryStart, i as buildNext, o as enqueue, p as renderBuildQueue, r as buildLogPath, s as getTicket, u as patchTicket, v as poolSlots, y as slotsFor } from "../caller-identity-yLFb7CKq.mjs";
+import { d as setSchedConfigSource, f as sharedScheduler, i as mirrorTo, s as schedConfigFrom } from "../scheduler-CtUyWJ3O.mjs";
+import { i as effectiveCap, o as providerCap, r as capacityOf } from "../capacity-DEveQdFV.mjs";
+import "../local-instances-DOxSgT_L.mjs";
+import { n as tierProviderNames, t as isLocalCandidate } from "../local-candidate-DLdwQt0s.mjs";
+import { n as TAILSCALE_STATUS_TIMEOUT_MS } from "../timeouts-1MLooEBB.mjs";
+import { n as OPT, t as CliError } from "../define-CjJsmq-6.mjs";
+import { a as getStorageBackend, c as MergeError, f as humanDuration, i as getRegistryBackend, l as federationDbPath, o as oldRegistryPath, r as createStorageBackend, s as registryDbPath, u as oldFederationPath } from "../factory-DjAAsqr_.mjs";
+import { c as resolveFromModule, i as retryTransient, n as embedChunksWithBackend, r as indexProjectWithBackend, s as packageRoot } from "../postgres-C6ti4haA.mjs";
+import { d as OLLAMA_ID, f as ollamaDefaultUrl, i as measureThroughput, l as provisionOllama, o as createBackend, s as detectBackends, u as OLLAMA_DEFAULT_MODEL } from "../embedding-gate-6rZrWRXa.mjs";
+import "../embeddings-BVq3esBF.mjs";
+import "../router-CQSc3lk3.mjs";
+import { t as detectProject } from "../detect-9CZNO0yf.mjs";
+import { n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier } from "../helpers-BD6V-p9w.mjs";
+import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-C_Y5W9py.mjs";
+import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-8iqQDkqb.mjs";
+import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-Jh5NVeNe.mjs";
+import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-Dnym-qcT.mjs";
+import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-CXVlZjHt.mjs";
+import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-Xglu0OPD.mjs";
+import { n as fetchLiveSessions, r as sendToSession, t as callAiBroker } from "../aibroker-client-CQPGqLxL.mjs";
+import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-W-gbwJHM.mjs";
+import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-CSC7mgPf.mjs";
+import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, jt as runPaneExec, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage, yt as psTable } from "../controls-CPoeudou.mjs";
+import "../endreason-C577xIQz.mjs";
+import { N as endBuildWait, j as beginBuildWait } from "../render-BYmQkuLd.mjs";
+import "../operator-CyuB3aVw.mjs";
+import "../kill-tree-EWYaEk5v.mjs";
+import { s as poolReloadLive } from "../pool-cli-BggU8GRp.mjs";
+import "../chain-7n9Gx56r.mjs";
+import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-jvfONJTQ.mjs";
+import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-DKQt71s4.mjs";
+import "../viewer-mDXUNHNy.mjs";
+import { g as setWorkersEnabled, s as describeProviders } from "../providers-CblTFrhz.mjs";
+import { $ as exportDefaultLayout, B as mergeSettings, G as cachedRows, J as handleCockpit, K as cachedSessionMap, Q as warmCockpit, W as SystemMonitor, X as setEndpointHealth, Y as setActionHooks, Z as setRuntimeSampler, ct as providersCommand, et as createEndpointHealth, it as withWorkerAttribution, n as WORKER_CONFIG_COMMANDS, nt as loadWorkerWindows, q as cachedWorkerWindows, rt as sessionDisplayName, t as PROVIDER_EDIT_COMMANDS, tt as loadSessionMap, z as installWorkers } from "../worker-config-CJhEMk19.mjs";
+import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-BEMpuhDz.mjs";
+import { H as acquireRun, U as readRun, V as cockpitProbeSettings, k as readRuntimeCommands } from "../cockpit-actions-BBHeyEZI.mjs";
+import { n as PaiClient } from "../ipc-client-CaiGJnSM.mjs";
+import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-DIWjA68P.mjs";
+import "../fallback-DFlItw1Z.mjs";
+import { At as readQuiet, Bt as appendCheckpointToNote, C as migrateSummaryCooldowns, Et as totalUsageTokens, Gt as restartRouter, Ht as findLatestNote, It as resolveDaemonPid, Nt as writeQuiet, Ot as describeQuiet, Pt as LAUNCHD_LABEL, Rt as readContextHandoverCache, St as loadSessionKeepaliveState, Tt as parseSessionUsage, Ut as findNotesDir$1, Vt as applyContinue, Wt as readBodyFile, bt as reapJob, ht as obsidianEnabled, i as reexecBackground, kt as nextOccurrence, mt as OBSIDIAN_DISABLED_MESSAGE, o as backfillKgFromNotes, s as migrateKgBackfillState, v as migrateWorkQueue, vt as migrateIdentityFile, wt as sessionKeepaliveLedgerSummary, yt as jobPaths } from "../indexer-backend-Cll7le4P.mjs";
+import { n as queriesDirPath, t as migrateQueriesDir } from "../query-feedback-BRfPtqki.mjs";
+import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import chalk from "chalk";
 import { cpus, homedir, networkInterfaces, platform, userInfo } from "node:os";
 import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
 import http from "node:http";
+import { createServer } from "node:net";
 import pg from "pg";
 import BetterSqlite3 from "better-sqlite3";
 import { createInterface } from "node:readline";
-import net, { createConnection } from "net";
+import net$1, { createConnection as createConnection$1 } from "net";
 import { promisify } from "node:util";
 import { getEncoding } from "js-tiktoken";
 
@@ -897,7 +901,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 	});
 	return {
 		inventory: async () => {
-			const { currentInventory } = await import("../model-inventory-Dasber3S.mjs");
+			const { currentInventory } = await import("../model-inventory-BFVSNFT3.mjs");
 			return currentInventory();
 		},
 		sched,
@@ -912,7 +916,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 			}
 		},
 		async rssMb(port) {
-			const { processTreeRssMb } = await import("../model-inventory-Dasber3S.mjs");
+			const { processTreeRssMb } = await import("../model-inventory-BFVSNFT3.mjs");
 			const pid = (await exec("lsof", [
 				"-ti",
 				`tcp:${port}`,
@@ -1103,7 +1107,7 @@ function drainServers(servers, opts) {
 	for (const server of servers) if (server.listening) {
 		closingServers.add(server);
 		const closePromise = new Promise((resolve) => {
-			net.Server.prototype.close.call(server, (err) => {
+			net$1.Server.prototype.close.call(server, (err) => {
 				if (err && err.code === "ERR_SERVER_NOT_RUNNING") {
 					handleServerClose(server);
 					resolve();
@@ -1275,9 +1279,9 @@ const runCommand = {
 		sampler.start();
 		setRuntimeSampler(sampler);
 		setActionHooks({ runLocalJob: async (kind, tier) => {
-			const { startTier, stopAll } = await import("../worker-config-D8tRuvo7.mjs");
-			const { readLocalConfig } = await import("../local-tiers-DnBIAkbK.mjs");
-			const { workersYamlPath } = await import("../workers-config-DEI9lrV4.mjs");
+			const { startTier, stopAll } = await import("../worker-config-DESkIjMF.mjs");
+			const { readLocalConfig } = await import("../local-tiers-DNMI5W86.mjs");
+			const { workersYamlPath } = await import("../workers-config-f8KrkY4L.mjs");
 			const cfg = readLocalConfig(workersYamlPath());
 			if (kind === "off") return void await stopAll(cfg);
 			const t = cfg.tiers[tier];
@@ -1653,7 +1657,7 @@ const modelsCommand = {
 		if (words[0] === "add") {
 			const source = words[1];
 			if (!source) throw new Error("usage: pai models add <hf-id|path> [--name n] [--download] [--try]");
-			const { addModel } = await import("../models-add-Bt7aUHDs.mjs");
+			const { addModel } = await import("../models-add-C1QIc1DA.mjs");
 			const r = await addModel({
 				source,
 				name: typeof ctx.opts.name === "string" ? ctx.opts.name : void 0,
@@ -1668,7 +1672,7 @@ const modelsCommand = {
 		if (op) {
 			const runtime = words[1];
 			if (!runtime) throw new Error(`usage: pai models ${op} <runtime> (configured: ${Object.keys(readRuntimeCommands()).join(", ") || "none"})`);
-			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-DcQ-ucU8.mjs");
+			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-DR9X514g.mjs");
 			const r = await runtimeStartStop(runtime, op, defaultDeps(), { model: typeof ctx.opts.model === "string" ? ctx.opts.model : void 0 });
 			process.stdout.write(r.message + "\n");
 			if (!r.ok) process.exitCode = 1;
@@ -2513,7 +2517,7 @@ function measureCompactionTrigger(cwd, projectsDir = CLAUDE_PROJECTS_DIR, config
 		if (discarded > 0) console.error(`[context-fill] discarded ${discarded} compaction sample(s) as other-regime for ${cwd} (preTokens below ${Math.round(floor)}, half of configured=${configuredTriggerTokens}): ` + samples.filter((s) => s.preTokens < floor).map((s) => `${s.preTokens}@${s.timestamp}`).join(", "));
 		if (admissible.length === 0) return null;
 	}
-	const trigger = Math.min(...admissible.map((s) => s.preTokens));
+	const trigger = minOf(admissible.map((s) => s.preTokens));
 	console.error(`[context-fill] measured trigger for ${cwd}: ${trigger} (minimum of ` + admissible.map((s) => `${s.preTokens}@${s.timestamp}`).join(", ") + ")");
 	return trigger;
 }
@@ -2983,7 +2987,7 @@ async function cmdPause(opts) {
 		process.exitCode = 1;
 		return;
 	}
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const cwd = process.cwd();
 	const project = await resolveProjectByCwd(registryBackend, cwd);
@@ -3083,7 +3087,7 @@ function touchSentinel(rootPath) {
 async function cmdAutosave(opts) {
 	const minGap = parseInt(opts.minGap ?? String(DEFAULT_MIN_GAP), 10);
 	const cwd = process.cwd();
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await resolveProjectByCwd(registryBackend, cwd);
 	if (!project) return;
@@ -3309,7 +3313,7 @@ function finalizeNote(notePath) {
 }
 async function cmdEnd(opts) {
 	await cmdPause(opts);
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const cwd = process.cwd();
 	const project = await registryBackend.findProjectByCwdPrefix(cwd);
@@ -3490,7 +3494,7 @@ function buildStopBody(project, sessionId) {
 	}
 }
 async function cmdHandover(projectSlug, numberOrLatest, sessionId) {
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	let project;
 	if (projectSlug) {
@@ -4436,8 +4440,8 @@ async function analyzeProject(registryBackend, project) {
 async function countVectorDbPaths(oldPaths) {
 	if (oldPaths.length === 0) return 0;
 	try {
-		const { loadConfig } = await import("../config-TaWmdTLx.mjs");
-		const { createStorageBackend } = await import("../factory-DAGG9_n8.mjs");
+		const { loadConfig } = await import("../config-DtENJ6cL.mjs");
+		const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
 		const backend = await createStorageBackend(config);
@@ -4454,8 +4458,8 @@ async function countVectorDbPaths(oldPaths) {
 async function updateVectorDbPaths(moves) {
 	if (moves.length === 0) return 0;
 	try {
-		const { loadConfig } = await import("../config-TaWmdTLx.mjs");
-		const { createStorageBackend } = await import("../factory-DAGG9_n8.mjs");
+		const { loadConfig } = await import("../config-DtENJ6cL.mjs");
+		const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
 		const backend = await createStorageBackend(config);
@@ -4542,7 +4546,7 @@ async function displayDryRun(plans) {
 	console.log();
 }
 async function executeCleanup(plans, skipReindex) {
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	let deleted = 0;
 	let renamed = 0;
@@ -4742,7 +4746,7 @@ async function executeCleanup(plans, skipReindex) {
 * them into YYYY/MM/ folders and renumber. Dry run unless `execute` is set.
 */
 async function runCleanup(projectSlug, opts) {
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const dryRun = !opts.execute;
 	const skipReindex = opts.reindex === false;
@@ -5405,11 +5409,65 @@ function migrateOrphanFederationDb(opts = {}) {
 //#region src/storage/backup.ts
 /**
 * storage/backup.ts — the only place `pai backup`/`pai restore` touch the
-* *.db filenames. SQLite backend: byte-copy registry.db (+ federation.db,
+* *.db filenames. SQLite backend: snapshot registry.db (VACUUM INTO) (+ federation.db,
 * if present) into/from the backup dir. Postgres backend: the file-copy
 * step is a no-op — pg_dump/pg_restore (still in cli/commands/backup.ts and
 * restore.ts, via docker exec) is the real backup for that backend.
 */
+const SQLITE_MAGIC = "SQLite format 3\0";
+function isSqliteFile(path) {
+	if (statSync(path).size < 16) return false;
+	const fd = openSync(path, "r");
+	try {
+		const buf = Buffer.alloc(16);
+		readSync(fd, buf, 0, 16, 0);
+		return buf.toString("latin1") === SQLITE_MAGIC;
+	} finally {
+		closeSync(fd);
+	}
+}
+/**
+* Consistent copy of a possibly live WAL-mode database: VACUUM INTO goes
+* through SQLite, so committed rows still sitting in the -wal are included
+* and no sidecars are needed. Non-SQLite files fall back to a byte copy.
+*/
+function copyDb(src, dest) {
+	if (!isSqliteFile(src)) {
+		copyFileSync(src, dest);
+		return;
+	}
+	rmSync(dest, { force: true });
+	const db = new BetterSqlite3(src, { readonly: true });
+	try {
+		db.prepare("VACUUM INTO ?").run(dest);
+	} finally {
+		db.close();
+	}
+}
+/** True when another process holds the file open (the daemon). Undetectable (no lsof) counts as not held. */
+function heldOpen(path) {
+	if (!existsSync(path)) return false;
+	try {
+		execFileSync("lsof", ["-t", path], { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Restores one db file: refuses while held open, drops stale -wal/-shm, then copies. */
+function restoreDb(src, dest) {
+	if (heldOpen(dest)) throw new Error(`${dest} is held open by another process (the daemon?) — stop it first (pai daemon stop), then restore`);
+	mkdirSync(dirname(dest), { recursive: true });
+	if (existsSync(dest)) {
+		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+		let safety = `${dest}.pre-restore-${stamp}`;
+		for (let i = 1; existsSync(safety); i++) safety = `${dest}.pre-restore-${stamp}-${i}`;
+		copyDb(dest, safety);
+		chmodSync(safety, 384);
+	}
+	for (const suffix of ["-wal", "-shm"]) rmSync(`${dest}${suffix}`, { force: true });
+	copyFileSync(src, dest);
+}
 /** Copies registry.db (and federation.db, if present) into destDir. No-op on the postgres backend. */
 function backupStorageFiles(config, destDir) {
 	if (config.storageBackend === "postgres") return [];
@@ -5418,7 +5476,7 @@ function backupStorageFiles(config, destDir) {
 	if (existsSync(registrySrc)) {
 		const dest = join(destDir, "registry.db");
 		try {
-			copyFileSync(registrySrc, dest);
+			copyDb(registrySrc, dest);
 			results.push({
 				label: "Registry DB",
 				path: dest,
@@ -5442,7 +5500,7 @@ function backupStorageFiles(config, destDir) {
 	if (existsSync(fedSrc)) {
 		const dest = join(destDir, "federation.db");
 		try {
-			copyFileSync(fedSrc, dest);
+			copyDb(fedSrc, dest);
 			results.push({
 				label: "Federation DB (legacy)",
 				path: dest,
@@ -5474,8 +5532,7 @@ function restoreStorageFiles(config, srcDir) {
 	if (inv.hasRegistry) {
 		const dest = registryDbPath();
 		try {
-			mkdirSync(dirname(dest), { recursive: true });
-			copyFileSync(join(srcDir, "registry.db"), dest);
+			restoreDb(join(srcDir, "registry.db"), dest);
 			results.push({
 				label: "Registry DB",
 				path: dest,
@@ -5498,8 +5555,7 @@ function restoreStorageFiles(config, srcDir) {
 	if (inv.hasFederation) {
 		const dest = federationDbPath();
 		try {
-			mkdirSync(dirname(dest), { recursive: true });
-			copyFileSync(join(srcDir, "federation.db"), dest);
+			restoreDb(join(srcDir, "federation.db"), dest);
 			results.push({
 				label: "Federation DB (legacy)",
 				path: dest,
@@ -5517,6 +5573,200 @@ function restoreStorageFiles(config, srcDir) {
 	return results;
 }
 
+//#endregion
+//#region src/storage/postgres/snapshot.ts
+/**
+* One REPEATABLE READ transaction that exports its snapshot and counts rows in it, so a
+* pg_dump --snapshot run while it is open sees exactly the counted state.
+*/
+/**
+* Opens the transaction, counts `tables` (null when a table does not exist), calls `dump(snapshotId)`
+* while the transaction is still open, and returns the counts.
+*/
+async function countInExportedSnapshot(connectionString, tables, dump) {
+	const client = new pg.Client({ connectionString });
+	await client.connect();
+	try {
+		await client.query("BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY");
+		const snap = (await client.query("SELECT pg_export_snapshot() AS s")).rows[0].s;
+		const counts = {};
+		for (const table of tables) counts[table] = (await client.query("SELECT to_regclass($1) IS NOT NULL AS e", [table])).rows[0].e ? Number((await client.query(`SELECT count(*) AS n FROM "${table.replace(/"/g, "\"\"")}"`)).rows[0].n) : null;
+		await dump(snap);
+		await client.query("COMMIT");
+		return counts;
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
+/** The statement `psql -tAc` runs to count a table's rows. */
+function countSql(table) {
+	return `SELECT count(*) FROM "${table.replace(/"/g, "\"\"")}"`;
+}
+
+//#endregion
+//#region src/cli/commands/lifecycle/backup-postgres.ts
+/**
+* Postgres part of `pai backup`: pick the database the running storage uses,
+* dump it, and check the dump against the live row counts.
+*/
+const BACKUP_TABLES = [
+	"pai_files",
+	"pai_chunks",
+	"pai_observations",
+	"sessions"
+];
+/** The server, database and role to dump: resolved by the same function the storage backend connects with. */
+function resolveBackupTarget(pg) {
+	return postgresFullTarget(pg ?? {});
+}
+/** A plain pg_dump ends with this marker; a truncated dump does not. */
+function validatePgDump(dump) {
+	if (dump.trim().length === 0) return "dump is empty";
+	if (!dump.slice(-2048).includes("PostgreSQL database dump complete")) return "dump is truncated (no pg_dump completion marker)";
+	return null;
+}
+/** Accumulates per-table row counts from the lines of a plain-format pg_dump, one line at a time. */
+var DumpRowCounter = class {
+	counts = /* @__PURE__ */ new Map();
+	current = null;
+	push(line) {
+		if (this.current === null) {
+			const m = /^COPY (?:\S+\.)?"?(\w+)"? .* FROM stdin;/.exec(line);
+			if (m) {
+				this.current = m[1];
+				this.counts.set(this.current, 0);
+			}
+		} else if (line === "\\.") this.current = null;
+		else this.counts.set(this.current, this.counts.get(this.current) + 1);
+	}
+};
+/** Last `n` bytes of a file, without reading the rest. */
+function readFileTail(path, n = 2048) {
+	const fd = openSync(path, "r");
+	try {
+		const size = fstatSync(fd).size;
+		const len = Math.min(n, size);
+		const buf = Buffer.alloc(len);
+		readSync(fd, buf, 0, len, size - len);
+		return buf.toString("utf8");
+	} finally {
+		closeSync(fd);
+	}
+}
+/** Streams a dump file line by line (bounded memory): row counts per table, plus the completion-marker check. */
+async function scanDumpFile(path) {
+	const counter = new DumpRowCounter();
+	const rl = createInterface({
+		input: createReadStream(path, {
+			encoding: "utf8",
+			highWaterMark: 1 << 20
+		}),
+		crlfDelay: Infinity
+	});
+	for await (const line of rl) counter.push(line);
+	return {
+		counts: counter.counts,
+		invalid: validatePgDump(readFileTail(path))
+	};
+}
+/**
+* Dump the target and verify it against the counts taken in the dump's own snapshot.
+* A table with no COPY block counts as 0 rows (pg_dump emits none for empty tables), so a fresh
+* install verifies. On any failure the dump file is removed so it cannot be mistaken for a backup.
+*/
+async function backupPostgres(target, destPath, runner) {
+	try {
+		const live = await runner.dump(target, destPath);
+		const { counts: dumped, invalid } = await scanDumpFile(destPath);
+		if (invalid) throw new Error(`database "${target.database}" backup failed verification (${invalid})`);
+		const counts = {};
+		const problems = [];
+		for (const table of BACKUP_TABLES) {
+			const liveCount = live[table];
+			if (liveCount === null || liveCount === void 0) continue;
+			const got = dumped.get(table) ?? 0;
+			counts[table] = got;
+			if (got !== liveCount) problems.push(`${table}: dump ${got}, live ${liveCount}`);
+		}
+		if (problems.length > 0) throw new Error(`database "${target.database}" backup failed verification (${problems.join("; ")})`);
+		if (Object.keys(counts).length === 0) throw new Error(`database "${target.database}" has none of the main tables (${BACKUP_TABLES.join(", ")})`);
+		return {
+			database: target.database,
+			counts
+		};
+	} catch (e) {
+		try {
+			unlinkSync(destPath);
+		} catch {}
+		throw e;
+	}
+}
+const BACKUP_META_FILE = "postgres-meta.json";
+/** Records the source database and dumped row counts next to the dump. */
+function writeBackupMeta(backupDir, meta) {
+	writeFileSync(join(backupDir, BACKUP_META_FILE), JSON.stringify(meta, null, 2) + "\n", { mode: 384 });
+}
+/** Reads the metadata of a backup; null when absent or unreadable (backups made before it existed). */
+function readBackupMeta(backupDir) {
+	try {
+		const m = JSON.parse(readFileSync(join(backupDir, BACKUP_META_FILE), "utf8"));
+		if (typeof m.database !== "string" || m.database === "") return null;
+		return {
+			database: m.database,
+			counts: m.counts ?? {}
+		};
+	} catch {
+		return null;
+	}
+}
+/** Target = the daemon's database unless `into` overrides it; refuses when the dump came from another database (or an unknown one) and `into` is not given. */
+function planPostgresRestore(pg, meta, into) {
+	const daemon = resolveBackupTarget(pg);
+	const source = meta?.database ?? null;
+	const target = {
+		...daemon,
+		database: into ?? daemon.database
+	};
+	try {
+		assertPgName(target.database, "database", RESTORE_DB_MAX_BYTES);
+	} catch (e) {
+		return {
+			target,
+			source,
+			refusal: e instanceof Error ? e.message : String(e)
+		};
+	}
+	if (into !== void 0) return {
+		target,
+		source
+	};
+	if (source === null) return {
+		target,
+		source,
+		refusal: `backup does not record its source database (made before 1.0.2); pass --into <db> to restore into a database explicitly, usually --into ${daemon.database} (daemon database)`
+	};
+	if (source !== target.database) return {
+		target,
+		source,
+		refusal: `backup was taken from database "${source}" but the daemon uses "${target.database}"; pass --into <db> to restore anyway`
+	};
+	return {
+		target,
+		source
+	};
+}
+/** Restore derives `<db>_prerestore_<19-char stamp>` names; keep them inside Postgres' 63 bytes so they are never truncated onto another name. */
+const RESTORE_DB_MAX_BYTES = 32;
+/** Warning when the config.json inside the backup names a different database than the restore target; null when equal or unreadable. */
+function configDatabaseMismatch(backupConfigPath, target) {
+	try {
+		const db = resolveBackupTarget(JSON.parse(readFileSync(backupConfigPath, "utf8")).postgres).database;
+		return db === target.database ? null : `config.json from the backup names database "${db}" but the dump was restored into "${target.database}"; the daemon will use "${db}"`;
+	} catch {
+		return null;
+	}
+}
+
 //#endregion
 //#region src/cli/commands/lifecycle/backup.ts
 /**
@@ -5528,7 +5778,7 @@ function restoreStorageFiles(config, srcDir) {
 * Contents:
 *   registry file        — SQLite registry database (sqlite backend only)
 *   config.json          — PAI daemon config
-*   postgres-pai.sql     — pg_dump of the Postgres "pai" database (via docker exec)
+*   postgres-pai.sql     — pg_dump of the daemon's Postgres database (via docker exec), row counts verified
 */
 const CONFIG_FILE$1 = paiConfigFilePath();
 /** Old backups dir, inside ~/.pai/ (pre-2026-09-19). */
@@ -5542,8 +5792,6 @@ function backupsDirPath() {
 }
 const BACKUPS_DIR$1 = backupsDirPath();
 const DOCKER_CONTAINER$1 = "pai-pgvector";
-const PG_DATABASE$1 = "pai";
-const PG_USER$1 = "pai";
 function timestamp() {
 	const now = /* @__PURE__ */ new Date();
 	return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}-${String(now.getHours()).padStart(2, "0")}${String(now.getMinutes()).padStart(2, "0")}${String(now.getSeconds()).padStart(2, "0")}`;
@@ -5560,7 +5808,68 @@ function fileSize(path) {
 		return "unknown";
 	}
 }
+/**
+* Dumps the server the connection string names (the PAI container when that is the local server,
+* else the host's pg_dump against the external server). Counts are read in the REPEATABLE READ
+* transaction whose exported snapshot pg_dump then uses, so they match the dump exactly.
+*/
+const snapshotRunner = { async dump(target, destPath) {
+	const container = isContainerTarget(target);
+	if (container) execFileSync("docker", [
+		"inspect",
+		DOCKER_CONTAINER$1,
+		"--format={{.State.Status}}"
+	], { stdio: "pipe" });
+	return countInExportedSnapshot(target.connectionString ?? postgresConnectionString(loadConfig().postgres ?? {}), BACKUP_TABLES, (snap) => {
+		const sqlFd = openSync(destPath, "w");
+		try {
+			const common = [
+				`--snapshot=${snap}`,
+				"-U",
+				target.user
+			];
+			const dump = container ? spawnSync("docker", [
+				"exec",
+				DOCKER_CONTAINER$1,
+				"pg_dump",
+				...common,
+				target.database
+			], { stdio: [
+				"pipe",
+				sqlFd,
+				"pipe"
+			] }) : spawnSync("pg_dump", [
+				"-h",
+				target.host,
+				"-p",
+				String(target.port),
+				...common,
+				"-d",
+				target.database
+			], {
+				stdio: [
+					"pipe",
+					sqlFd,
+					"pipe"
+				],
+				env: target.password !== void 0 ? {
+					...process.env,
+					PGPASSWORD: target.password
+				} : process.env
+			});
+			if (dump.error) throw dump.error;
+			if (dump.status !== 0) throw new Error(dump.stderr?.toString().trim() || `pg_dump exited with code ${dump.status}`);
+		} finally {
+			closeSync(sqlFd);
+		}
+	});
+} };
 async function runBackup(opts) {
+	if (opts.dryRun) {
+		const t = resolveBackupTarget(loadConfig().postgres);
+		console.log(`Would dump Postgres database "${t.database}" (user ${t.user}) from ${isContainerTarget(t) ? `container ${DOCKER_CONTAINER$1}` : `${t.host}:${t.port}`}`);
+		return;
+	}
 	const backupDir = join(BACKUPS_DIR$1, timestamp());
 	console.log(dim$1(`Creating backup: ${backupDir}`));
 	mkdirSync(backupDir, { recursive: true });
@@ -5570,7 +5879,8 @@ async function runBackup(opts) {
 		label: r.label,
 		path: r.path,
 		size: r.status === "ok" ? fileSize(r.path) : "-",
-		status: r.status === "ok" ? ok$1("ok") : r.status === "skipped" ? warn$1("not found — skipped") : err(`failed: ${r.error}`)
+		status: r.status === "ok" ? ok$1("ok") : r.status === "skipped" ? warn$1("not found — skipped") : err(`failed: ${r.error}`),
+		failed: r.status !== "ok" && r.status !== "skipped"
 	});
 	if (existsSync(CONFIG_FILE$1)) {
 		const dest = join(backupDir, "config.json");
@@ -5588,7 +5898,8 @@ async function runBackup(opts) {
 				label: "Config",
 				path: dest,
 				size: "-",
-				status: err(`failed: ${e}`)
+				status: err(`failed: ${e}`),
+				failed: true
 			});
 		}
 	} else results.push({
@@ -5599,36 +5910,16 @@ async function runBackup(opts) {
 	});
 	if (opts.postgres) {
 		const sqlDest = join(backupDir, "postgres-pai.sql");
-		console.log(dim$1(`  Running pg_dump on ${DOCKER_CONTAINER$1} (this may take a moment)...`));
+		console.log(dim$1("  Running pg_dump (this may take a moment)..."));
 		try {
-			execFileSync("docker", [
-				"inspect",
-				DOCKER_CONTAINER$1,
-				"--format={{.State.Status}}"
-			], { stdio: "pipe" });
-			const sqlFd = openSync(sqlDest, "w");
-			try {
-				const dump = spawnSync("docker", [
-					"exec",
-					DOCKER_CONTAINER$1,
-					"pg_dump",
-					"-U",
-					PG_USER$1,
-					PG_DATABASE$1
-				], { stdio: [
-					"pipe",
-					sqlFd,
-					"pipe"
-				] });
-				if (dump.status !== 0) throw new Error(dump.stderr?.toString().trim() || `pg_dump exited with code ${dump.status}`);
-			} finally {
-				closeSync(sqlFd);
-			}
+			const target = resolveBackupTarget(config.postgres);
+			console.log(dim$1(`  Database: ${target.database}`));
+			writeBackupMeta(backupDir, await backupPostgres(target, sqlDest, snapshotRunner));
 			results.push({
 				label: "Postgres DB",
 				path: sqlDest,
 				size: fileSize(sqlDest),
-				status: ok$1("ok")
+				status: ok$1("ok (verified)")
 			});
 		} catch (e) {
 			const msg = e instanceof Error ? e.message.split("\n")[0] : String(e);
@@ -5636,9 +5927,10 @@ async function runBackup(opts) {
 				label: "Postgres DB",
 				path: sqlDest,
 				size: "-",
-				status: err(`failed: ${msg}`)
+				status: err(`failed: ${msg}`),
+				failed: true
 			});
-			console.log(warn$1(`  Postgres backup failed. Is Docker running with container '${DOCKER_CONTAINER$1}'?`));
+			console.log(warn$1(`  Postgres backup failed; no dump was kept. Is the server reachable (Docker container '${DOCKER_CONTAINER$1}' for a local database, pg_dump on PATH for an external one)?`));
 		}
 	} else results.push({
 		label: "Postgres DB",
@@ -5646,13 +5938,19 @@ async function runBackup(opts) {
 		size: "-",
 		status: dim$1("skipped (--no-postgres)")
 	});
-	console.log(`\n${bold$1("Backup complete:")} ${backupDir}\n`);
+	const failed = results.filter((r) => r.failed);
+	console.log(`\n${failed.length === 0 ? bold$1("Backup complete:") : bold$1(err("Backup INCOMPLETE:"))} ${backupDir}\n`);
 	const labelWidth = Math.max(...results.map((r) => r.label.length)) + 2;
 	for (const r of results) {
 		const label = r.label.padEnd(labelWidth);
 		console.log(`  ${bold$1(label)} ${r.status}  ${dim$1(r.size)}`);
 	}
 	console.log(`\n  ${dim$1("Path:")} ${backupDir}`);
+	if (failed.length > 0) {
+		console.error(err(`Backup failed: ${failed.map((r) => r.label).join(", ")}`));
+		process.exitCode = 1;
+		return;
+	}
 	console.log(`  ${dim$1("To restore:")} pai restore ${backupDir}\n`);
 }
 
@@ -6014,8 +6312,249 @@ async function runLaunch(args, opts) {
 const CONFIG_FILE = paiConfigFilePath();
 const BACKUPS_DIR = backupsDirPath();
 const DOCKER_CONTAINER = "pai-pgvector";
-const PG_DATABASE = "pai";
-const PG_USER = "pai";
+function stampNow() {
+	return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+/** Copies the current config to a timestamped 0600 file next to it, then installs src. Returns the safety path (null when there was no current config). */
+function restoreConfigWithSafety(src, dest) {
+	mkdirSync(dirname(dest), { recursive: true });
+	let safety = null;
+	if (existsSync(dest)) {
+		safety = `${dest}.pre-restore-${stampNow()}`;
+		for (let i = 1; existsSync(safety); i++) safety = `${dest}.pre-restore-${stampNow()}-${i}`;
+		copyFileSync(dest, safety);
+		chmodSync(safety, 384);
+	}
+	copyFileSync(src, dest);
+	chmodSync(dest, 384);
+	return safety;
+}
+/**
+* Runner for a target: inside the PAI container when the target is the local PAI server,
+* otherwise the host's psql/pg_dump pointed at the server the connection string names.
+*/
+function makePgRunner(target) {
+	return (args, input, output) => {
+		const inContainer = isContainerTarget(target);
+		const [prog, ...rest] = args;
+		const cmd = inContainer ? "docker" : prog;
+		const argv = inContainer ? [
+			"exec",
+			...input !== void 0 ? ["-i"] : [],
+			DOCKER_CONTAINER,
+			...args
+		] : [
+			...target.host ? ["-h", target.host] : [],
+			...target.port ? ["-p", String(target.port)] : [],
+			...rest
+		];
+		const fd = typeof input === "object" ? openSync(input.file, "r") : void 0;
+		const outFd = output ? openSync(output.file, "w", 384) : void 0;
+		try {
+			const r = spawnSync(cmd, argv, {
+				input: typeof input === "string" ? input : void 0,
+				encoding: "utf8",
+				stdio: [
+					fd ?? "pipe",
+					outFd ?? "pipe",
+					"pipe"
+				],
+				maxBuffer: 1024 * 1024 * 1024,
+				env: target.password !== void 0 ? {
+					...process.env,
+					PGPASSWORD: target.password
+				} : process.env
+			});
+			return {
+				status: r.status,
+				stdout: r.stdout ?? "",
+				stderr: r.stderr ?? ""
+			};
+		} finally {
+			if (fd !== void 0) closeSync(fd);
+			if (outFd !== void 0) closeSync(outFd);
+		}
+	};
+}
+/**
+* Restores a dump without destroying the live database first:
+* validate -> pre-restore dump of live DB -> restore into a NEW database -> swap by rename.
+* Any failure before the swap leaves the live database untouched.
+*/
+async function restorePostgres(dumpFile, safetyDir, target, run = makePgRunner(target), recordedCounts, opts = {}) {
+	const PG_DATABASE = target.database;
+	const PG_USER = target.user;
+	try {
+		assertPgName(PG_DATABASE, "database", RESTORE_DB_MAX_BYTES);
+		assertPgName(PG_USER, "user");
+	} catch (e) {
+		return {
+			ok: false,
+			message: `${e instanceof Error ? e.message : String(e)}; live database untouched`
+		};
+	}
+	const { counts: dumpCounts, invalid } = await scanDumpFile(dumpFile);
+	if (invalid) return {
+		ok: false,
+		message: `${invalid}; live database untouched`
+	};
+	const stamp = stampNow().replace(/[^0-9A-Za-z]/g, "").toLowerCase();
+	const newDb = `${PG_DATABASE}_restore_${stamp}`;
+	const oldDb = `${PG_DATABASE}_prerestore_${stamp}`;
+	const qNew = quoteIdent(newDb);
+	const qOld = quoteIdent(oldDb);
+	const qLive = quoteIdent(PG_DATABASE);
+	const qUser = quoteIdent(PG_USER);
+	const firstLine = (r) => r.stderr.split("\n")[0] || "unknown error";
+	let safetyDump;
+	if (!opts.noSafetyDump) {
+		const path = join(safetyDir, `postgres-pai.pre-restore-${stampNow()}.sql`);
+		mkdirSync(safetyDir, { recursive: true });
+		const live = run([
+			"pg_dump",
+			"-U",
+			PG_USER,
+			PG_DATABASE
+		], void 0, { file: path });
+		if (live.status === 0) {
+			const { invalid: safetyInvalid } = await scanDumpFile(path);
+			if (safetyInvalid) {
+				rmSync(path, { force: true });
+				return {
+					ok: false,
+					message: `pre-restore dump of live database is incomplete (${safetyInvalid}); live database untouched (use --no-safety-dump to skip it)`
+				};
+			}
+			safetyDump = path;
+		} else {
+			rmSync(path, { force: true });
+			if (!/does not exist/.test(live.stderr)) return {
+				ok: false,
+				message: `pre-restore dump failed: ${firstLine(live)}; live database untouched (use --no-safety-dump to skip it)`
+			};
+		}
+	}
+	const cleanup = () => run([
+		"psql",
+		"-U",
+		PG_USER,
+		"-d",
+		"postgres",
+		"-c",
+		`DROP DATABASE IF EXISTS ${qNew};`
+	]);
+	const created = run([
+		"psql",
+		"-U",
+		PG_USER,
+		"-d",
+		"postgres",
+		"-c",
+		`CREATE DATABASE ${qNew} OWNER ${qUser};`
+	]);
+	if (created.status !== 0) return {
+		ok: false,
+		message: `could not create staging database: ${firstLine(created)}; live database untouched`,
+		safetyDump
+	};
+	const loaded = run([
+		"psql",
+		"-U",
+		PG_USER,
+		"-v",
+		"ON_ERROR_STOP=1",
+		"-d",
+		newDb
+	], { file: dumpFile });
+	if (loaded.status !== 0) {
+		cleanup();
+		return {
+			ok: false,
+			message: `psql failed: ${firstLine(loaded)}; live database untouched`,
+			safetyDump
+		};
+	}
+	const swap1 = run([
+		"psql",
+		"-U",
+		PG_USER,
+		"-d",
+		"postgres",
+		"-c",
+		`ALTER DATABASE ${qLive} RENAME TO ${qOld};`
+	]);
+	const liveExisted = swap1.status === 0;
+	if (!liveExisted && !/does not exist/.test(swap1.stderr)) {
+		cleanup();
+		return {
+			ok: false,
+			message: `could not rename live database (active connections? stop the daemon): ${firstLine(swap1)}; live database untouched`,
+			safetyDump
+		};
+	}
+	const swap2 = run([
+		"psql",
+		"-U",
+		PG_USER,
+		"-d",
+		"postgres",
+		"-c",
+		`ALTER DATABASE ${qNew} RENAME TO ${qLive};`
+	]);
+	if (swap2.status !== 0) {
+		if (liveExisted) run([
+			"psql",
+			"-U",
+			PG_USER,
+			"-d",
+			"postgres",
+			"-c",
+			`ALTER DATABASE ${qOld} RENAME TO ${qLive};`
+		]);
+		cleanup();
+		return {
+			ok: false,
+			message: `swap failed: ${firstLine(swap2)}; live database restored`,
+			safetyDump
+		};
+	}
+	const oldDbKept = liveExisted ? oldDb : void 0;
+	const expected = recordedCounts ?? Object.fromEntries(dumpCounts);
+	const counts = {};
+	const bad = [];
+	for (const table of BACKUP_TABLES) {
+		if (!(table in expected)) continue;
+		const r = run([
+			"psql",
+			"-U",
+			PG_USER,
+			"-d",
+			PG_DATABASE,
+			"-tAc",
+			countSql(table)
+		]);
+		const actual = r.status === 0 ? Number(r.stdout.trim()) : null;
+		counts[table] = {
+			expected: expected[table],
+			actual
+		};
+		if (actual !== expected[table]) bad.push(`${table}: expected ${expected[table]}, got ${actual ?? "n/a"}`);
+	}
+	if (bad.length > 0) return {
+		ok: false,
+		message: `restored into "${PG_DATABASE}" but row counts differ (${bad.join("; ")})`,
+		safetyDump,
+		oldDb: oldDbKept,
+		counts
+	};
+	return {
+		ok: true,
+		message: "restored",
+		safetyDump,
+		oldDb: oldDbKept,
+		counts
+	};
+}
 function confirm(question) {
 	return new Promise((resolve) => {
 		const rl = createInterface({
@@ -6084,6 +6623,24 @@ async function runRestore(backupPath, opts) {
 	console.log(`  config.json          ${hasConfig ? ok$1("present") : warn$1("missing")}`);
 	console.log(`  postgres-pai.sql     ${hasSql && opts.postgres ? ok$1("present") : hasSql ? warn$1("present (skipped via --no-postgres)") : warn$1("missing")}`);
 	if (inventory.hasFederation) console.log(`  Federation DB        ${ok$1("present")} ${dim$1("(legacy)")}`);
+	const meta = readBackupMeta(resolvedDir);
+	const plan = planPostgresRestore(loadConfig().postgres, meta, opts.into);
+	if (hasSql && opts.postgres) {
+		console.log(`\n${bold$1("Postgres:")}`);
+		console.log(`  Target database      ${plan.target.database} (user ${plan.target.user})`);
+		console.log(`  Dump source database ${plan.source ?? "unknown"}`);
+		if (plan.refusal) {
+			console.error(err(`Refusing to restore: ${plan.refusal}`));
+			if (!opts.dryRun) {
+				process.exitCode = 1;
+				return;
+			}
+		}
+	}
+	if (opts.dryRun) {
+		console.log(dim$1("\nDry run: nothing was changed."));
+		return;
+	}
 	console.log(`\n${warn$1("WARNING:")} This will OVERWRITE your current PAI data.`);
 	if (hasSql && opts.postgres) console.log(warn$1("  Postgres database will be dropped and recreated from the backup."));
 	if (!(opts.yes || await confirm("Proceed with restore?"))) {
@@ -6097,13 +6654,16 @@ async function runRestore(backupPath, opts) {
 		status: r.status === "ok" ? ok$1("restored") : r.status === "skipped" ? warn$1("missing in backup — skipped") : err(`failed: ${r.error}`)
 	});
 	if (hasConfig) try {
-		mkdirSync(dirname(CONFIG_FILE), { recursive: true });
-		copyFileSync(join(resolvedDir, "config.json"), CONFIG_FILE);
-		chmodSync(CONFIG_FILE, 384);
+		const safety = restoreConfigWithSafety(join(resolvedDir, "config.json"), CONFIG_FILE);
+		if (safety) console.log(dim$1(`  Previous config.json saved to ${safety}`));
 		results.push({
 			label: "Config",
 			status: ok$1("restored")
 		});
+		if (hasSql && opts.postgres) {
+			const mismatch = configDatabaseMismatch(join(resolvedDir, "config.json"), plan.target);
+			if (mismatch) console.log(warn$1(`  ${mismatch}`));
+		}
 	} catch (e) {
 		results.push({
 			label: "Config",
@@ -6117,47 +6677,18 @@ async function runRestore(backupPath, opts) {
 	if (hasSql && opts.postgres) {
 		console.log(dim$1("  Restoring Postgres database (this may take a while)..."));
 		try {
-			execFileSync("docker", [
+			if (isContainerTarget(plan.target)) execFileSync("docker", [
 				"inspect",
 				DOCKER_CONTAINER,
 				"--format={{.State.Status}}"
 			], { stdio: "pipe" });
-			execFileSync("docker", [
-				"exec",
-				DOCKER_CONTAINER,
-				"psql",
-				"-U",
-				PG_USER,
-				"-c",
-				`DROP DATABASE IF EXISTS ${PG_DATABASE}; CREATE DATABASE ${PG_DATABASE} OWNER ${PG_USER};`
-			], { stdio: "pipe" });
-			const sqlContent = readFileSync(join(resolvedDir, "postgres-pai.sql"), "utf8");
-			const psqlResult = spawnSync("docker", [
-				"exec",
-				"-i",
-				DOCKER_CONTAINER,
-				"psql",
-				"-U",
-				PG_USER,
-				PG_DATABASE
-			], {
-				input: sqlContent,
-				encoding: "utf8",
-				stdio: [
-					"pipe",
-					"pipe",
-					"pipe"
-				]
-			});
-			if (psqlResult.status !== 0) {
-				const errMsg = psqlResult.stderr?.split("\n")[0] ?? "unknown error";
-				results.push({
-					label: "Postgres DB",
-					status: err(`failed: ${errMsg}`)
-				});
-			} else results.push({
+			const pg = await restorePostgres(join(resolvedDir, "postgres-pai.sql"), dirname(CONFIG_FILE), plan.target, void 0, meta?.counts, { noSafetyDump: opts.noSafetyDump });
+			if (pg.safetyDump) console.log(dim$1(`  Pre-restore dump of live database: ${pg.safetyDump}`));
+			if (pg.oldDb) console.log(dim$1(`  Previous database kept as '${pg.oldDb}' (drop it when satisfied)`));
+			for (const [t, c] of Object.entries(pg.counts ?? {})) console.log(dim$1(`  ${t}: expected ${c.expected}, restored ${c.actual ?? "n/a"}`));
+			results.push({
 				label: "Postgres DB",
-				status: ok$1("restored")
+				status: pg.ok ? ok$1("restored") : err(`failed: ${pg.message}`)
 			});
 		} catch (e) {
 			const msg = e instanceof Error ? e.message.split("\n")[0] : String(e);
@@ -6165,7 +6696,7 @@ async function runRestore(backupPath, opts) {
 				label: "Postgres DB",
 				status: err(`failed: ${msg}`)
 			});
-			console.log(warn$1(`  Is Docker running with container '${DOCKER_CONTAINER}'?`));
+			if (isContainerTarget(plan.target)) console.log(warn$1(`  Is Docker running with container '${DOCKER_CONTAINER}'?`));
 		}
 	} else if (!hasSql || !opts.postgres) {
 		const reason = !hasSql ? "no SQL dump in backup" : "--no-postgres";
@@ -6796,10 +7327,20 @@ const backupTop = {
 		type: "boolean",
 		default: false,
 		summary: "Skip the Postgres dump (faster; registry and config only)"
+	}, {
+		...OPT.dryRun,
+		summary: "Print the database that would be dumped, write nothing"
 	}],
-	examples: ["pai backup", "pai backup --no-postgres"],
+	examples: [
+		"pai backup",
+		"pai backup --no-postgres",
+		"pai backup --dry-run"
+	],
 	seeAlso: ["pai restore"],
-	run: (c) => legacy(() => runBackup({ postgres: c.opts["no-postgres"] !== true }))
+	run: (c) => legacy(() => runBackup({
+		postgres: c.opts["no-postgres"] !== true,
+		dryRun: c.dryRun
+	}))
 };
 const restoreTop = {
 	name: "restore",
@@ -6809,22 +7350,48 @@ const restoreTop = {
 		name: "BACKUP",
 		summary: "Backup folder (default: the newest one)"
 	}],
-	options: [{
-		name: "no-postgres",
-		type: "boolean",
-		default: false,
-		summary: "Do not restore the Postgres database"
-	}, {
-		name: "yes",
-		type: "boolean",
-		default: false,
-		summary: "Do not ask for confirmation"
-	}],
-	examples: ["pai restore", "pai restore ~/.pai/backups/20260101-120000 --no-postgres --yes"],
+	options: [
+		{
+			name: "no-postgres",
+			type: "boolean",
+			default: false,
+			summary: "Do not restore the Postgres database"
+		},
+		{
+			name: "yes",
+			type: "boolean",
+			default: false,
+			summary: "Do not ask for confirmation"
+		},
+		{
+			name: "into",
+			type: "string",
+			value: "DB",
+			summary: "Restore into this Postgres database instead of the daemon's (required when the backup came from another database)"
+		},
+		{
+			name: "no-safety-dump",
+			type: "boolean",
+			default: false,
+			summary: "Do not dump the live database before replacing it (a failed safety dump otherwise aborts the restore)"
+		},
+		{
+			...OPT.dryRun,
+			summary: "Print the target and source databases, change nothing"
+		}
+	],
+	examples: [
+		"pai restore",
+		"pai restore --dry-run",
+		"pai restore ~/.pai/backups/20260101-120000 --no-postgres --yes"
+	],
 	seeAlso: ["pai backup"],
 	run: (c) => legacy(() => runRestore(c.args.BACKUP, {
 		postgres: c.opts["no-postgres"] !== true,
-		yes: c.opts.yes === true
+		yes: c.opts.yes === true,
+		dryRun: c.dryRun,
+		into: c.opts.into,
+		noSafetyDump: c.opts["no-safety-dump"] === true
 	}))
 };
 const updateTop = {
@@ -6955,8 +7522,12 @@ function createRl() {
 	});
 	return rl;
 }
-/** Unattended-mode switches (`pai setup --yes --storage …`), set once by the command. */
-const setupOptions = { yes: false };
+const setupOptions = {
+	yes: false,
+	answers: {}
+};
+/** Non-fatal step failures (e.g. a busy router port); setup finishes and the summary lists them. */
+const setupFailures = [];
 /**
 * The one place every wizard question passes through. Under --yes it answers
 * `defaultValue` without touching stdin; a question with no default cannot be
@@ -6993,7 +7564,12 @@ async function promptMenu(rl, options, defaultIdx = 0) {
 	}
 }
 /** Prompt for a yes/no answer. Returns true for yes. */
-async function promptYesNo(rl, question, defaultYes = true) {
+async function promptYesNo(rl, question, defaultYes = true, key) {
+	const forced = key === void 0 ? void 0 : setupOptions.answers[key];
+	if (forced !== void 0) {
+		console.log(chalk.dim(`  ${question.trim()} -> ${forced ? "yes" : "no"} (flag)`));
+		return forced;
+	}
 	const hint = defaultYes ? "[Y/n]" : "[y/N]";
 	const answer = await prompt(rl, `  ${question} ${chalk.dim(hint)}: `, "");
 	if (answer === "") return defaultYes;
@@ -7149,7 +7725,7 @@ async function stepStorage(rl) {
 	line();
 	line("  Choose how PAI stores your indexed knowledge:");
 	line();
-	const forced = setupOptions.storage ?? (setupOptions.yes ? await testPostgresConnection(postgresConnectionString({})) ? "postgres" : "sqlite" : void 0);
+	const forced = setupOptions.storage ?? (setupOptions.pgUrl ? "postgres" : void 0) ?? (setupOptions.yes ? await testPostgresConnection(postgresConnectionString({})) ? "postgres" : "sqlite" : void 0);
 	if ((forced ? forced === "sqlite" ? 1 : 0 : await promptMenu(rl, [{
 		label: "PostgreSQL with pgvector",
 		description: "Best for large collections, semantic search, and production use. Requires Docker or a Postgres server."
@@ -7161,6 +7737,15 @@ async function stepStorage(rl) {
 		console.log(c.ok("SQLite selected. No additional setup needed."));
 		return { storageBackend: "sqlite" };
 	}
+	if (setupOptions.pgUrl) {
+		const connStr = setupOptions.pgUrl;
+		const connected = await testPostgresConnection(connStr);
+		console.log(connected ? c.ok("Connection successful!") : c.warn("Connection test failed — check --pg-url and try again later."));
+		return {
+			storageBackend: "postgres",
+			postgres: { connectionString: connStr }
+		};
+	}
 	line();
 	line("  PostgreSQL requires a running Postgres server with the pgvector extension.");
 	line();
@@ -7227,23 +7812,33 @@ async function stepBackend(rl, fresh) {
 	const { results, recommended } = await detectBackends();
 	line();
 	for (const r of results) console.log(`  ${r.ok ? c.ok(r.id) : c.dim(r.id)}: ${r.reason}`);
+	if (fresh && setupOptions.embedding === "ollama" && recommended !== OLLAMA_ID) console.log(c.warn("  --embedding ollama: Ollama was not detected, so the local Arctic model is used. Start Ollama and run `pai memory backend use ollama`."));
 	if (!recommended) return {};
 	if (!fresh) {
 		console.log(c.dim(`  Recommended: ${recommended}. Switch with \`pai memory backend use ${recommended}\` + \`pai memory reembed\`.`));
 		return {};
 	}
-	if (recommended === OLLAMA_ID && await promptYesNo(rl, "Use Ollama (GPU, several times faster)?", true)) return { embedding: {
+	if (recommended === OLLAMA_ID && await promptYesNo(rl, "Use Ollama (GPU, several times faster)?", true, "ollama")) return { embedding: {
 		backend: OLLAMA_ID,
 		model: OLLAMA_DEFAULT_MODEL,
 		ollama: { baseUrl: ollamaDefaultUrl() }
 	} };
 	return {};
 }
+/** `--embedding` value to menu index (ollama = Arctic through the Ollama backend). */
+const EMBEDDING_FLAG_CHOICE = {
+	ollama: 0,
+	snowflake: 0,
+	bge: 1,
+	nomic: 2,
+	none: 3
+};
 async function stepEmbedding(rl) {
 	section("Step 3: Embedding Model");
 	const existing = readConfigRaw();
 	if (existing.embeddingModel) {
 		console.log(c.ok(`Embedding model: ${existing.embeddingModel}. Skipping.`));
+		if (setupOptions.embedding !== void 0) console.log(c.warn(`  --embedding ${setupOptions.embedding} ignored: a model is already set. Change it with \`pai memory backend use\` or by editing embeddingModel in ${CONFIG_FILE$2}.`));
 		return {
 			embeddingModel: existing.embeddingModel,
 			...await stepBackend(rl, false)
@@ -7253,7 +7848,9 @@ async function stepEmbedding(rl) {
 	line("  An embedding model converts your text into vectors for semantic search.");
 	line("  Models are downloaded from HuggingFace on first use.");
 	line();
-	const choice = await promptMenu(rl, [
+	const flagged = setupOptions.embedding === void 0 ? void 0 : EMBEDDING_FLAG_CHOICE[setupOptions.embedding];
+	if (setupOptions.embedding === "ollama") setupOptions.answers.ollama = true;
+	const choice = flagged ?? await promptMenu(rl, [
 		{
 			label: "Snowflake Arctic Embed m v1.5",
 			description: "768 dims, ~118MB download. Best retrieval quality per MB (MTEB score 55.14). Asymmetric retrieval — different handling for queries vs documents. Best for most users."
@@ -7321,7 +7918,7 @@ async function stepClaudeMd(rl) {
 			console.log(c.dim("  A backup will be created before overwriting."));
 		}
 		line();
-		if (!await promptYesNo(rl, "Update ~/.claude/CLAUDE.md with the latest PAI template?", isGenerated)) {
+		if (!await promptYesNo(rl, "Update ~/.claude/CLAUDE.md with the latest PAI template?", isGenerated, "claude-md")) {
 			console.log(c.dim("  Keeping existing CLAUDE.md unchanged."));
 			return false;
 		}
@@ -7362,6 +7959,13 @@ async function stepClaudeMd(rl) {
 //#endregion
 //#region src/cli/commands/setup/steps/05-pai-skill.ts
 /** Step 5: PAI SKILL.md installation to ~/.claude/skills/PAI/. */
+/** `<file>.backup-<timestamp>`; never reuses an existing name, so earlier backups survive. */
+function timestampedBackupPath(file) {
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+	let p = `${file}.backup-${stamp}`;
+	for (let i = 1; existsSync(p); i++) p = `${file}.backup-${stamp}-${i}`;
+	return p;
+}
 async function stepPaiSkill(rl) {
 	section("Step 5: PAI Skill Installation");
 	line();
@@ -7384,12 +7988,12 @@ async function stepPaiSkill(rl) {
 			console.log(c.dim("  A backup will be created before overwriting."));
 		}
 		line();
-		if (!await promptYesNo(rl, "Update ~/.claude/skills/PAI/SKILL.md with the latest PAI skill?", isGenerated)) {
+		if (!await promptYesNo(rl, "Update ~/.claude/skills/PAI/SKILL.md with the latest PAI skill?", isGenerated, "skill")) {
 			console.log(c.dim("  Keeping existing SKILL.md unchanged."));
 			return false;
 		}
 		if (!isGenerated) {
-			const backupPath = skillFile + ".backup";
+			const backupPath = timestampedBackupPath(skillFile);
 			writeFileSync(backupPath, content, "utf-8");
 			console.log(c.ok(`Backed up existing SKILL.md to ${backupPath}`));
 		}
@@ -7433,12 +8037,12 @@ async function stepAiSteeringRules(rl) {
 			console.log(c.dim("  A backup will be created before overwriting."));
 		}
 		line();
-		if (!await promptYesNo(rl, "Update ~/.claude/skills/PAI/AI-STEERING-RULES.md with the latest rules?", isGenerated)) {
+		if (!await promptYesNo(rl, "Update ~/.claude/skills/PAI/AI-STEERING-RULES.md with the latest rules?", isGenerated, "steering-rules")) {
 			console.log(c.dim("  Keeping existing AI-STEERING-RULES.md unchanged."));
 			return false;
 		}
 		if (!isGenerated) {
-			const backupPath = skillFile + ".backup";
+			const backupPath = timestampedBackupPath(skillFile);
 			writeFileSync(backupPath, content, "utf-8");
 			console.log(c.ok(`Backed up existing AI-STEERING-RULES.md to ${backupPath}`));
 		}
@@ -7489,7 +8093,7 @@ async function stepSkillStubs(rl) {
 	}
 	console.log(c.dim(`  Found ${skillNames.length} skill stubs to install.`));
 	line();
-	if (!await promptYesNo(rl, `Symlink ${skillNames.length} PAI skill stubs to ~/.claude/skills/?`, true)) {
+	if (!await promptYesNo(rl, `Symlink ${skillNames.length} PAI skill stubs to ~/.claude/skills/?`, true, "skill-stubs")) {
 		console.log(c.dim("  Skipping skill stub installation."));
 		return false;
 	}
@@ -7549,7 +8153,7 @@ async function stepHooks(rl) {
 	if (useSymlinks$1) line("  Files are symlinked so they auto-update when PAI is rebuilt.");
 	else line("  Files are copied (Windows — re-run setup after PAI updates).");
 	line();
-	if (!await promptYesNo(rl, "Install PAI lifecycle hooks (session stop, pre-compact, statusline)?", true)) {
+	if (!await promptYesNo(rl, "Install PAI lifecycle hooks (session stop, pre-compact, statusline)?", true, "hooks")) {
 		console.log(c.dim("  Skipping hook installation."));
 		return false;
 	}
@@ -7610,7 +8214,7 @@ async function stepTsHooks(rl) {
 	if (useSymlinks) line("  Files are symlinked so they auto-update when PAI is rebuilt.");
 	else line("  Files are copied (Windows — re-run setup after PAI updates).");
 	line();
-	if (!await promptYesNo(rl, "Install PAI TypeScript hooks to ~/.claude/Hooks/?", true)) {
+	if (!await promptYesNo(rl, "Install PAI TypeScript hooks to ~/.claude/Hooks/?", true, "ts-hooks")) {
 		console.log(c.dim("  Skipping TypeScript hooks installation."));
 		return false;
 	}
@@ -7835,7 +8439,7 @@ async function stepDaName(rl) {
 	line("  Choose a name for your AI assistant. This name appears in tab titles");
 	line("  and session notes when hooks are active.");
 	line();
-	const daName = await prompt(rl, chalk.bold("  Assistant name [PAI]: "), "") || "PAI";
+	const daName = (setupOptions.daName ?? await prompt(rl, chalk.bold("  Assistant name [PAI]: "), "")) || "PAI";
 	line();
 	console.log(c.ok(`Assistant name set to: ${daName}`));
 	return daName;
@@ -7846,7 +8450,7 @@ async function stepSettings(rl, daName) {
 	line("  PAI will add env vars, all hook registrations, permissions, and flags");
 	line("  to ~/.claude/settings.json. Existing values are never overwritten.");
 	line();
-	if (!await promptYesNo(rl, "Patch ~/.claude/settings.json with PAI hooks, env vars, and settings?", true)) {
+	if (!await promptYesNo(rl, "Patch ~/.claude/settings.json with PAI hooks, env vars, and settings?", true, "settings")) {
 		console.log(c.dim("  Skipping settings patch."));
 		return false;
 	}
@@ -8255,24 +8859,17 @@ function cmdInstall() {
 	const config = readClaudeJson();
 	if (typeof config.mcpServers !== "object" || config.mcpServers === null) config.mcpServers = {};
 	const servers = config.mcpServers;
-	const existing = servers["pai"];
-	if ((existing?.args)?.includes(shimBin)) console.log(ok$1("  ~/.claude.json already points to the shim."));
-	else {
-		if (existing) {
-			servers["pai-legacy"] = existing;
-			console.log(dim$1("  Backed up existing 'pai' entry as 'pai-legacy'."));
-		}
-		servers["pai"] = {
-			command: "node",
-			args: [shimBin]
-		};
+	const outcome = registerMcpScript(servers, "pai", shimBin);
+	if (outcome === "unchanged") console.log(ok$1("  ~/.claude.json already points to the shim."));
+	else {
 		try {
 			writeClaudeJson(config);
-			console.log(ok$1("  Updated ~/.claude.json to use daemon shim."));
 		} catch (e) {
 			console.error(err(`  Failed to write ~/.claude.json: ${e}`));
 			return 1;
 		}
+		if (outcome === "legacy-kept") console.log(dim$1("  Existing 'pai' entry runs a different server; kept as 'pai-legacy'."));
+		console.log(ok$1("  Updated ~/.claude.json to use daemon shim."));
 	}
 	console.log();
 	if (!existsSync(daemonBin)) {
@@ -8432,8 +9029,8 @@ function cmdLogs(opts) {
 	return 0;
 }
 async function daemonServeCmd() {
-	const { serve } = await import("../daemon-C7yt_ptC.mjs");
-	const { loadConfig: lc, ensureConfigDir } = await import("../config-TaWmdTLx.mjs");
+	const { serve } = await import("../daemon-DKdBNKfa.mjs");
+	const { loadConfig: lc, ensureConfigDir } = await import("../config-DtENJ6cL.mjs");
 	ensureConfigDir();
 	await serve(lc());
 	return 0;
@@ -8591,11 +9188,11 @@ async function stepDaemon(rl) {
 	if (existsSync(plistPath)) {
 		console.log(c.dim(`  PAI daemon ${unit} already installed.`));
 		line();
-		if (!await promptYesNo(rl, `Reinstall the PAI daemon ${unit}?`, false)) {
+		if (!await promptYesNo(rl, `Reinstall the PAI daemon ${unit}?`, false, "daemon")) {
 			console.log(c.dim("  Keeping existing daemon installation."));
 			return false;
 		}
-	} else if (!await promptYesNo(rl, "Install the PAI daemon to run automatically at login?", true)) {
+	} else if (!await promptYesNo(rl, "Install the PAI daemon to run automatically at login?", true, "daemon")) {
 		console.log(c.dim("  Skipping daemon install. Run manually: pai daemon install"));
 		return false;
 	}
@@ -8627,7 +9224,7 @@ async function stepMcp(rl) {
 			return false;
 		}
 	} catch {}
-	if (!await promptYesNo(rl, "Register the PAI MCP server (pai) in ~/.claude.json?", true)) {
+	if (!await promptYesNo(rl, "Register the PAI MCP server (pai) in ~/.claude.json?", true, "mcp")) {
 		console.log(c.dim("  Skipping MCP registration. Run manually: pai mcp install"));
 		return false;
 	}
@@ -8660,7 +9257,7 @@ async function stepDirectories(rl) {
 		for (const d of defaults) console.log(chalk.dim(`    ${d}`));
 		line();
 	}
-	const runScan = await promptYesNo(rl, "Run `pai registry scan` to auto-detect projects after setup?", false);
+	const runScan = await promptYesNo(rl, "Run `pai registry scan` to auto-detect projects after setup?", false, "registry-scan");
 	if (runScan) {
 		line();
 		console.log(chalk.dim("  Registry scan will run after setup completes."));
@@ -8720,7 +9317,7 @@ async function stepInitialIndex(rl) {
 //#endregion
 //#region src/cli/commands/setup/steps/15-verify.ts
 /** Step 18: Setup summary — displays all configuration choices made during setup. */
-function stepSummary(configUpdates, claudeMdGenerated, paiSkillInstalled, aiSteeringRulesInstalled, skillStubsInstalled, hooksInstalled, tsHooksInstalled, settingsPatched, daName, daemonInstalled, mcpRegistered, plat = process.platform) {
+function stepSummary(configUpdates, claudeMdGenerated, paiSkillInstalled, aiSteeringRulesInstalled, skillStubsInstalled, hooksInstalled, tsHooksInstalled, settingsPatched, daName, daemonInstalled, mcpRegistered, plat = process.platform, aibroker, failures = []) {
 	section("Setup Complete");
 	line();
 	console.log(chalk.green("  PAI Knowledge OS is configured!"));
@@ -8741,6 +9338,16 @@ function stepSummary(configUpdates, claudeMdGenerated, paiSkillInstalled, aiStee
 	console.log(chalk.dim("  Settings:         ") + chalk.cyan(settingsPatched ? "env vars, hooks, permissions, flags (patched)" : "(unchanged)"));
 	console.log(chalk.dim("  Daemon:           ") + chalk.cyan(daemonInstalled ? `${daemonServiceName(plat)} (installed)` : "(not installed by setup)"));
 	console.log(chalk.dim("  MCP:              ") + chalk.cyan(mcpRegistered ? "registered in ~/.claude.json" : "(unchanged)"));
+	if (aibroker) {
+		const label = {
+			ok: "installed and healthy",
+			installed: "installed",
+			skipped: "skipped",
+			failed: "FAILED — retry: npm install -g aibroker@^0.62.4 && aibroker setup && aibroker doctor"
+		}[aibroker];
+		console.log(chalk.dim("  AIBroker:         ") + (aibroker === "failed" ? chalk.red(label) : chalk.cyan(label)));
+	}
+	for (const f of failures) console.log(chalk.red(`  ${f}`));
 	line();
 	console.log(chalk.bold.yellow("  → RESTART Claude Code to activate all changes."));
 	line();
@@ -9395,7 +10002,7 @@ async function stepTaskBus(rl) {
 	line();
 	line("  PAI works fully without this. Skip it unless you want cross-session tasks.");
 	line();
-	if (!await promptYesNo(rl, "Enable the task bus (requires a Todoist account)?", false)) {
+	if (!await promptYesNo(rl, "Enable the task bus (requires a Todoist account)?", false, "task-bus")) {
 		line();
 		console.log(c.ok("Skipping the task bus."));
 		console.log(c.dim("  Add later by re-running `pai setup`."));
@@ -9482,7 +10089,7 @@ async function stepWorkers(rl) {
 	line("  `pai worker run` is the runner; ps / follow / replay watch the runs;");
 	line("  the Agent tool is denied and rewritten to it while workers are on.");
 	line();
-	if (!await promptYesNo(rl, "Turn workers on now with the built-in anthropic provider?", true)) {
+	if (!await promptYesNo(rl, "Turn workers on now with the built-in anthropic provider?", true, "workers")) {
 		line();
 		console.log(c.ok("Skipping workers."));
 		console.log(c.dim("  Later: pai worker on   (other providers: pai worker providers add <name> … — see docs/worker.md)"));
@@ -9501,6 +10108,209 @@ async function stepWorkers(rl) {
 	return {};
 }
 
+//#endregion
+//#region src/cli/commands/setup/steps/18-aibroker.ts
+/** Step 18: AIBroker, PAI's messaging layer (session messages, worker reports, tab names, WhatsApp/Telegram). */
+/** Longest any one AIBroker command may run before it counts as failed. */
+const COMMAND_TIMEOUT_MS = 5 * 6e4;
+/** `aibroker setup` may ask questions: give it the terminal when there is one and --yes is off. */
+const defaultRunner = (cmd, args) => {
+	const r = spawnSync(cmd, args, {
+		encoding: "utf8",
+		timeout: COMMAND_TIMEOUT_MS,
+		...cmd === "aibroker" && args[0] === "setup" && !setupOptions.yes && !!process.stdin.isTTY ? { stdio: "inherit" } : {}
+	});
+	return {
+		status: r.error ? null : r.status,
+		output: `${r.stdout ?? ""}${r.stderr ?? ""}${r.error ? String(r.error.message) : ""}`.trim()
+	};
+};
+/** The package the step installs; the range keeps a breaking major from arriving unannounced. */
+const AIBROKER_PACKAGE = "aibroker@^0.62.4";
+/** `aibroker` is not on PATH: spawn error (null) or the shell's "not found". */
+const isMissing = (r) => r.status === null || r.status === 127;
+/** The commands the step runs when AIBroker is missing or unhealthy, in order. */
+const AIBROKER_COMMANDS = [
+	["npm", [
+		"install",
+		"-g",
+		AIBROKER_PACKAGE
+	]],
+	["aibroker", ["setup"]],
+	["aibroker", ["doctor"]]
+];
+const show = ([cmd, args]) => [cmd, ...args].join(" ");
+function aibrokerPlan() {
+	return AIBROKER_COMMANDS.map(show);
+}
+function stepAibroker(run = defaultRunner, opts = {
+	skip: setupOptions.noAibroker,
+	dryRun: setupOptions.dryRun
+}) {
+	section("Step 18: AIBroker (Messaging)");
+	line();
+	line("  AIBroker is PAI's messaging layer: session-to-session messages, worker reports,");
+	line("  terminal tab names, WhatsApp/Telegram/PAILot. PAI works without it, minus messaging.");
+	line();
+	if (opts.skip) {
+		console.log(c.dim("  Skipped (--no-aibroker). Install later: npm install -g aibroker@^0.62.4 && aibroker setup"));
+		return "skipped";
+	}
+	if (opts.dryRun) {
+		line("  Would run (if AIBroker is missing or `aibroker doctor` fails):");
+		for (const p of aibrokerPlan()) line(`    ${p}`);
+		return "skipped";
+	}
+	const present = run("aibroker", ["doctor"]);
+	if (present.status === 0) {
+		console.log(c.ok("AIBroker already installed and healthy."));
+		return "ok";
+	}
+	const steps = isMissing(present) ? AIBROKER_COMMANDS : AIBROKER_COMMANDS.slice(1);
+	for (const step of steps) {
+		const r = run(step[0], step[1]);
+		if (r.status !== 0) {
+			console.log(c.warn(`  \`${show(step)}\` failed (exit ${r.status ?? "n/a"}).`));
+			if (r.output) line(`    ${r.output.split("\n").join("\n    ")}`);
+			console.log(c.warn(`  Retry with: ${aibrokerPlan().slice(AIBROKER_COMMANDS.indexOf(step)).join(" && ")}`));
+			return "failed";
+		}
+		console.log(c.ok(`${show(step)}: ok`));
+	}
+	console.log(c.ok("AIBroker installed."));
+	return "installed";
+}
+
+//#endregion
+//#region src/cli/commands/setup/steps/19-router.ts
+/** Step 19: the model router and its cockpit (enabled, port, reach). Answers go to config.yaml as router.enabled / router.port / router.bind. */
+/** Tries to listen on `host` (loopback by default); when taken, asks lsof who holds it. */
+const defaultPortProbe = (port, host = "127.0.0.1") => new Promise((resolve) => {
+	const srv = createServer();
+	srv.once("error", () => {
+		resolve({
+			free: false,
+			holder: (spawnSync("lsof", [
+				"-nP",
+				`-iTCP:${port}`,
+				"-sTCP:LISTEN"
+			], { encoding: "utf8" }).stdout ?? "").split("\n")[1]?.trim().split(/\s+/).slice(0, 2).join(" pid ") || void 0
+		});
+	});
+	srv.listen(port, host, () => srv.close(() => resolve({ free: true })));
+});
+function validPort(v) {
+	const n = typeof v === "number" ? v : /^\d+$/.test(String(v).trim()) ? Number(v) : NaN;
+	return Number.isInteger(n) && n >= 1024 && n <= 65535 ? n : null;
+}
+/** `loopback`, `tailscale` or a dotted IPv4 (never 0.0.0.0); returns the normalised value or null. */
+function validBind(v) {
+	const b = v.trim().toLowerCase();
+	return resolveBindAddress(b) === null && b !== "tailscale" ? null : b || "loopback";
+}
+async function stepRouter(rl, probe = defaultPortProbe, runningPid = routerRunningPid) {
+	section("Step 19: Router and Cockpit (Optional)");
+	line();
+	line("  The router accounts model usage, schedules local models and serves the cockpit page.");
+	line("  The daemon keeps it running when enabled.");
+	line();
+	const cfg = loadConfig().router;
+	const raw = readConfigRaw().router ?? {};
+	const flags = setupOptions.router ?? {};
+	if (!(flags.enabled ?? await promptYesNo(rl, "Enable the router and cockpit?", typeof raw.enabled === "boolean" ? raw.enabled : true))) {
+		console.log(c.ok("Router disabled. Enable later: pai config set router.enabled true"));
+		return { router: {
+			...raw,
+			enabled: false
+		} };
+	}
+	const routerUp = runningPid() !== null;
+	const check = async (port, host) => {
+		if (routerUp && port === cfg.port) return null;
+		const p = await probe(port, host);
+		return p.free ? null : `Port ${port} is in use${p.holder ? ` by ${p.holder}` : ""}.`;
+	};
+	const unavailable = (why) => {
+		console.log(c.warn(`  ${why}`));
+		setupFailures.push(`Router not configured: ${why} Retry: pai setup --router-port <free port>`);
+		return {};
+	};
+	let port;
+	if (flags.port !== void 0) {
+		const v = validPort(flags.port);
+		if (v === null) throw new Error(`--router-port must be a number from 1024 to 65535, got "${flags.port}"`);
+		const taken = await check(v);
+		if (taken) return unavailable(taken);
+		port = v;
+	} else {
+		port = cfg.port;
+		for (;;) {
+			const answer = await prompt(rl, chalk.bold(`  Cockpit port [${cfg.port}]: `), "");
+			const v = answer === "" ? cfg.port : validPort(answer);
+			if (v === null) {
+				console.log(c.warn("Enter a port from 1024 to 65535."));
+				continue;
+			}
+			const taken = await check(v);
+			if (!taken) {
+				port = v;
+				break;
+			}
+			if (setupOptions.yes) return unavailable(taken);
+			console.log(c.warn(taken));
+		}
+	}
+	let bind;
+	if (flags.bind !== void 0) {
+		const v = validBind(flags.bind);
+		if (v === null) throw new Error(`--router-bind must be loopback, tailscale or an IPv4 address (not 0.0.0.0), got "${flags.bind}"`);
+		bind = v;
+	} else {
+		const current = String(raw.bind ?? "loopback");
+		const explicit = current !== "loopback" && current !== "tailscale" && validBind(current) !== null ? current : void 0;
+		line();
+		line("  Who can reach the cockpit? Beyond loopback it is reachable from other devices (behind a token).");
+		line();
+		const idx = await promptMenu(rl, [
+			{
+				label: "loopback",
+				description: "This machine only (127.0.0.1)."
+			},
+			{
+				label: "tailscale",
+				description: "Your other Tailscale devices."
+			},
+			{
+				label: "explicit address",
+				description: "A specific IPv4 address of this machine."
+			}
+		], current === "tailscale" ? 1 : explicit ? 2 : 0);
+		bind = idx === 0 ? "loopback" : "tailscale";
+		if (idx === 2) for (;;) {
+			const a = validBind(await prompt(rl, chalk.bold(`  IPv4 address${explicit ? ` [${explicit}]` : ""}: `), explicit ?? ""));
+			if (a && a !== "tailscale") {
+				bind = a;
+				break;
+			}
+			console.log(c.warn("Enter a dotted IPv4 address (not 0.0.0.0)."));
+		}
+	}
+	const host = bind === "loopback" ? void 0 : resolveBindAddress(bind) ?? void 0;
+	if (host && !(routerUp && port === cfg.port)) {
+		const taken = await check(port, host);
+		if (taken) return unavailable(`${taken.slice(0, -1)} on ${host}.`);
+	}
+	if (bind !== "loopback") console.log(c.warn(`  The cockpit will be reachable from other devices via ${bind}; it asks for the token in ~/.pai/router-cockpit.token.`));
+	if (bind === "tailscale" && resolveBindAddress("tailscale") === null) console.log(c.warn("  Tailscale is not up here; the extra listener starts once it is."));
+	console.log(c.ok(`Router enabled on port ${port}, reach: ${bind}.`));
+	return { router: {
+		...raw,
+		enabled: true,
+		port,
+		bind
+	} };
+}
+
 //#endregion
 //#region src/cli/commands/setup/index.ts
 /**
@@ -9516,6 +10326,11 @@ async function step(name, fn) {
 	}
 }
 async function runSetup() {
+	setupFailures.length = 0;
+	if (setupOptions.dryRun) {
+		stepAibroker();
+		return;
+	}
 	const rl = createRl();
 	try {
 		if (existsSync(CONFIG_FILE$2)) {
@@ -9546,6 +10361,8 @@ async function runSetup() {
 		const daName = await step("stepDaName", () => stepDaName(rl));
 		const settingsPatched = await step("stepSettings", () => stepSettings(rl, daName));
 		const daemonInstalled = await step("stepDaemon", () => stepDaemon(rl));
+		const routerConfig = await step("stepRouter", () => stepRouter(rl));
+		const aibroker = await step("stepAibroker", () => stepAibroker());
 		const mcpRegistered = await step("stepMcp", () => stepMcp(rl));
 		await step("stepDirectories", () => stepDirectories(rl));
 		const taskConfig = await step("stepTaskBus", () => stepTaskBus(rl));
@@ -9554,50 +10371,338 @@ async function runSetup() {
 			...storageConfig,
 			...embeddingConfig,
 			...taskConfig,
-			...workersConfig
+			...workersConfig,
+			...routerConfig
 		};
 		mergeConfig(allUpdates);
 		line();
 		console.log(chalk.green("  Configuration saved."));
 		await step("stepInitialIndex", () => stepInitialIndex(rl));
-		stepSummary(allUpdates, claudeMdGenerated, paiSkillInstalled, aiSteeringRulesInstalled, skillStubsInstalled, hooksInstalled, tsHooksInstalled, settingsPatched, daName, daemonInstalled, mcpRegistered);
+		stepSummary(allUpdates, claudeMdGenerated, paiSkillInstalled, aiSteeringRulesInstalled, skillStubsInstalled, hooksInstalled, tsHooksInstalled, settingsPatched, daName, daemonInstalled, mcpRegistered, process.platform, aibroker, setupFailures);
 	} finally {
 		rl.close();
 	}
 }
 
+//#endregion
+//#region src/cli/commands/setup/questions.ts
+readConfigRaw();
+/** yes/no components: key = setupOptions.answers key, flag form depends on the default. */
+const COMPONENTS = [
+	{
+		key: "claude-md",
+		step: "Agent configuration",
+		question: "Write ~/.claude/CLAUDE.md from the PAI template?",
+		default: true
+	},
+	{
+		key: "skill",
+		step: "PAI skill",
+		question: "Install the PAI skill?",
+		default: true
+	},
+	{
+		key: "steering-rules",
+		step: "Steering rules",
+		question: "Install the AI steering rules?",
+		default: true
+	},
+	{
+		key: "skill-stubs",
+		step: "Skill stubs",
+		question: "Symlink the PAI skill stubs into ~/.claude/skills/?",
+		default: true
+	},
+	{
+		key: "hooks",
+		step: "Hooks",
+		question: "Install the lifecycle hooks (session stop, pre-compact, statusline)?",
+		default: true
+	},
+	{
+		key: "ts-hooks",
+		step: "TypeScript hooks",
+		question: "Install the TypeScript hooks to ~/.claude/Hooks/?",
+		default: true
+	},
+	{
+		key: "settings",
+		step: "Settings",
+		question: "Patch ~/.claude/settings.json with PAI hooks, env vars and settings?",
+		default: true
+	},
+	{
+		key: "daemon",
+		step: "Daemon",
+		question: "Install the daemon as a login service?",
+		default: true
+	},
+	{
+		key: "mcp",
+		step: "MCP",
+		question: "Register the PAI MCP server in ~/.claude.json?",
+		default: true
+	},
+	{
+		key: "registry-scan",
+		step: "Directories",
+		question: "Run `pai registry scan` after setup?",
+		default: false
+	},
+	{
+		key: "task-bus",
+		step: "Task bus",
+		question: "Enable the task bus (needs a Todoist account)?",
+		default: false
+	},
+	{
+		key: "workers",
+		step: "Workers",
+		question: "Turn workers on with the built-in anthropic provider?",
+		default: true
+	}
+];
+/** Components whose answer is not a plain default. */
+const COMPONENT_NOTES = {
+	"registry-scan": "Off by default: scanning walks your project directories.",
+	"task-bus": "Off by default. Needs a Todoist token in the config; with --yes the token cannot be asked, so set it first."
+};
+const componentFlag = (key, def) => def ? `--no-${key}` : `--${key}`;
+function setupQuestions() {
+	const raw = readConfigRaw();
+	const router = loadConfig().router;
+	const rawRouter = raw.router ?? {};
+	const q = [];
+	const cur = (v) => v === void 0 || v === null || v === "" ? {} : { current: v };
+	q.push({
+		id: "storage",
+		step: "Storage",
+		question: "Where should PAI store its data?",
+		type: "choice",
+		flag: "--storage",
+		default: "sqlite",
+		allowed: ["sqlite", "postgres"],
+		...cur(raw.storageBackend),
+		note: "With --yes and no --storage: postgres when a local PostgreSQL answers, else sqlite."
+	});
+	q.push({
+		id: "pg-url",
+		step: "Storage",
+		question: "PostgreSQL connection string (only when storage is postgres; default: the PAI Docker container)",
+		type: "string",
+		flag: "--pg-url",
+		default: null,
+		...cur((raw.postgres ?? {}).connectionString)
+	});
+	q.push({
+		id: "embedding",
+		step: "Embedding",
+		question: "Which embedding model for semantic search?",
+		type: "choice",
+		flag: "--embedding",
+		default: "snowflake",
+		allowed: [
+			"snowflake",
+			"bge",
+			"nomic",
+			"ollama",
+			"none"
+		],
+		...cur(raw.embeddingModel)
+	});
+	const component = (comp) => {
+		const note = COMPONENT_NOTES[comp.key];
+		q.push({
+			id: comp.key,
+			step: comp.step,
+			question: comp.question,
+			type: "bool",
+			flag: componentFlag(comp.key, comp.default),
+			default: comp.default,
+			...note ? { note } : {}
+		});
+	};
+	const routerQuestions = () => {
+		q.push({
+			id: "router",
+			step: "Router and cockpit",
+			question: "Enable the router and cockpit?",
+			type: "bool",
+			flag: "--router / --no-router",
+			default: true,
+			...cur(typeof rawRouter.enabled === "boolean" ? rawRouter.enabled : void 0),
+			note: "Setup defaults to on; the daemon's own default (key absent) is off. A re-run with router.enabled absent turns it on unless --no-router is given."
+		});
+		q.push({
+			id: "router-port",
+			step: "Router and cockpit",
+			question: "Port for the cockpit?",
+			type: "port",
+			flag: "--router-port",
+			default: router.port,
+			...cur(rawRouter.port)
+		});
+		q.push({
+			id: "router-bind",
+			step: "Router and cockpit",
+			question: "Who can reach the cockpit? Beyond loopback it is reachable from other devices.",
+			type: "choice",
+			flag: "--router-bind",
+			default: "loopback",
+			allowed: [
+				"loopback",
+				"tailscale",
+				"<ipv4 address>"
+			],
+			...cur(rawRouter.bind)
+		});
+	};
+	const daName = () => q.push({
+		id: "da-name",
+		step: "Settings",
+		question: "What should your assistant be called?",
+		type: "string",
+		flag: "--da-name",
+		default: "PAI"
+	});
+	const aibroker = () => q.push({
+		id: "aibroker",
+		step: "AIBroker",
+		question: "Install AIBroker (messaging)?",
+		type: "bool",
+		flag: "--no-aibroker",
+		default: true
+	});
+	for (const comp of COMPONENTS) {
+		if (comp.key === "settings") daName();
+		component(comp);
+		if (comp.key === "daemon") {
+			routerQuestions();
+			aibroker();
+		}
+	}
+	return q;
+}
+function renderQuestions(qs) {
+	return qs.map((x, i) => {
+		const parts = [`${i + 1}. [${x.step}] ${x.question}`, `   flag: ${x.flag}  default: ${x.default ?? "(none)"}`];
+		if (x.allowed) parts.push(`   allowed: ${x.allowed.join(" | ")}`);
+		if (x.current !== void 0) parts.push(`   current: ${x.current} (already set)`);
+		if (x.note) parts.push(`   note: ${x.note}`);
+		return parts.join("\n");
+	}).join("\n");
+}
+
 //#endregion
 //#region src/cli/commands/setup.ts
 /** `pai setup`: the first-time setup wizard (steps live in ./setup/). */
+/** One flag per yes/no component: --no-<name> for default-yes ones, --<name> for default-no ones. */
+const componentOptions = COMPONENTS.map((comp) => ({
+	name: componentFlag(comp.key, comp.default).slice(2),
+	type: "boolean",
+	default: false,
+	summary: `${comp.default ? "Skip" : "Do"}: ${comp.question}`
+}));
 const setupCommand = {
 	name: "setup",
-	summary: "First-time setup: storage, search, hooks, daemon",
-	description: "Walks through everything PAI needs: where data is stored, search embeddings, Claude Code hooks and settings, the background daemon and the first index.\nSafe to run again. With --yes it takes every default and asks nothing.",
-	options: [{
-		name: "yes",
-		short: "y",
-		type: "boolean",
-		default: false,
-		summary: "Take every default and read no input"
-	}, {
-		name: "storage",
-		type: "string",
-		value: "BACKEND",
-		summary: "Where to store data: sqlite or postgres (with --yes: sqlite unless a local Postgres answers)"
-	}],
-	examples: ["pai setup", "pai setup --yes --storage sqlite"],
+	summary: "First-time setup: storage, search, hooks, daemon, router",
+	description: "Walks through everything PAI needs: where data is stored, search embeddings, Claude Code hooks and settings, the background daemon, the router and cockpit (port, reach), AIBroker (messaging; installed automatically) and the first index.\nSafe to run again. With --yes it takes every default and asks nothing; every question has a flag, so `pai setup --yes <flags>` can express any answer. `pai setup --questions [--json]` lists the questions with their flags, defaults and current values (for callers without a terminal).",
+	options: [
+		{
+			name: "yes",
+			short: "y",
+			type: "boolean",
+			default: false,
+			summary: "Take every default (or the flag given) and read no input"
+		},
+		{
+			name: "questions",
+			type: "boolean",
+			default: false,
+			summary: "Print every question with its flag, default and allowed values; change nothing"
+		},
+		{
+			name: "json",
+			type: "boolean",
+			default: false,
+			summary: "With --questions: machine-readable JSON"
+		},
+		{
+			name: "storage",
+			type: "string",
+			value: "BACKEND",
+			summary: "Where to store data: sqlite or postgres (with --yes: sqlite unless a local Postgres answers)"
+		},
+		{
+			name: "pg-url",
+			type: "string",
+			value: "URL",
+			summary: "PostgreSQL connection string (implies --storage postgres)"
+		},
+		{
+			name: "embedding",
+			type: "string",
+			value: "MODEL",
+			summary: "Embeddings: snowflake, bge, nomic, ollama (Arctic on Ollama) or none"
+		},
+		{
+			name: "da-name",
+			type: "string",
+			value: "NAME",
+			summary: "What the assistant is called (default PAI)"
+		},
+		{
+			name: "router",
+			type: "boolean",
+			summary: "Enable the router and cockpit (default)"
+		},
+		{
+			name: "no-router",
+			type: "boolean",
+			summary: "Do not enable the router and cockpit"
+		},
+		{
+			name: "router-port",
+			type: "number",
+			value: "PORT",
+			summary: "Cockpit port (default: config router.port, 8790)"
+		},
+		{
+			name: "router-bind",
+			type: "string",
+			value: "SCOPE",
+			summary: "Who reaches the cockpit: loopback (default), tailscale or an IPv4 address"
+		},
+		{
+			name: "no-aibroker",
+			type: "boolean",
+			default: false,
+			summary: "Do not install AIBroker (the messaging layer)"
+		},
+		...componentOptions,
+		{
+			name: "dry-run",
+			type: "boolean",
+			default: false,
+			summary: "Validate the flags, print the AIBroker install commands and change nothing (other steps are not previewed)"
+		}
+	],
+	examples: [
+		"pai setup",
+		"pai setup --yes --storage sqlite",
+		"pai setup --questions --json",
+		"pai setup --yes --storage sqlite --embedding none --router-port 9000 --router-bind tailscale --no-hooks"
+	],
 	seeAlso: ["pai update", "pai daemon status"],
 	run(c) {
-		const storage = c.opts.storage;
 		return legacy(async () => {
-			if (storage && storage !== "sqlite" && storage !== "postgres") {
-				console.error(`pai setup: --storage must be sqlite or postgres, got "${storage}"`);
-				process.exitCode = 1;
+			if (c.opts.questions === true) {
+				const qs = setupQuestions();
+				console.log(c.opts.json === true ? JSON.stringify(qs, null, 2) : renderQuestions(qs));
 				return;
 			}
-			setupOptions.yes = c.opts.yes === true;
-			setupOptions.storage = storage;
 			try {
+				applySetupFlags(c.opts);
 				await runSetup();
 			} catch (e) {
 				console.error(chalk.red(`pai setup: ${e instanceof Error ? e.message : String(e)}`));
@@ -9606,6 +10711,39 @@ const setupCommand = {
 		});
 	}
 };
+/** Validates the flags and copies them into setupOptions (throws naming the flag). */
+function applySetupFlags(opts) {
+	const storage = opts.storage;
+	if (storage && storage !== "sqlite" && storage !== "postgres") throw new Error(`--storage must be sqlite or postgres, got "${storage}"`);
+	const embedding = opts.embedding;
+	if (embedding && ![
+		"snowflake",
+		"bge",
+		"nomic",
+		"ollama",
+		"none"
+	].includes(embedding)) throw new Error(`--embedding must be snowflake, bge, nomic, ollama or none, got "${embedding}"`);
+	const port = opts["router-port"];
+	if (port !== void 0 && validPort(port) === null) throw new Error(`--router-port must be a number from 1024 to 65535, got "${port}"`);
+	const bind = opts["router-bind"];
+	if (bind !== void 0 && validBind(String(bind)) === null) throw new Error(`--router-bind must be loopback, tailscale or an IPv4 address (not 0.0.0.0), got "${bind}"`);
+	if (opts.router === true && opts["no-router"] === true) throw new Error("--router and --no-router contradict each other");
+	const answers = {};
+	for (const comp of COMPONENTS) if (opts[componentFlag(comp.key, comp.default).slice(2)] === true) answers[comp.key] = !comp.default;
+	setupOptions.yes = opts.yes === true;
+	setupOptions.noAibroker = opts["no-aibroker"] === true;
+	setupOptions.dryRun = opts["dry-run"] === true;
+	setupOptions.storage = storage;
+	setupOptions.pgUrl = opts["pg-url"];
+	setupOptions.embedding = embedding;
+	setupOptions.daName = opts["da-name"];
+	setupOptions.router = {
+		enabled: opts["no-router"] === true ? false : opts.router === true ? true : void 0,
+		port: opts["router-port"],
+		bind: opts["router-bind"]
+	};
+	setupOptions.answers = answers;
+}
 const installAlias = {
 	...setupCommand,
 	name: "install",
@@ -10399,29 +11537,46 @@ function migrateFederationDbOrphan(dryRun) {
 	}
 	return migrateOrphanFederationDb({ dryRun });
 }
-function checkpointAndVerify(oldPath, newPath, label) {
-	let hasSqlite3 = true;
+/**
+* Flush the old DB's WAL into its main file (before the byte copy, so the copy
+* holds every committed row) and set the emptied sidecars aside. A non-empty
+* WAL is never moved away without a successful checkpoint.
+*/
+function checkpointWal(oldPath, label) {
+	let checkpointed = false;
 	try {
-		execFileSync("which", ["sqlite3"], { stdio: "pipe" });
-	} catch {
-		hasSqlite3 = false;
-	}
-	if (hasSqlite3) try {
-		execFileSync("sqlite3", [oldPath, "PRAGMA wal_checkpoint(TRUNCATE);"], { stdio: "pipe" });
+		const db = new BetterSqlite3(oldPath, { timeout: 500 });
+		try {
+			const [row] = db.pragma("wal_checkpoint(TRUNCATE)");
+			checkpointed = row?.busy === 0;
+		} finally {
+			db.close();
+		}
 	} catch {}
 	const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
 	for (const suffix of ["-wal", "-shm"]) {
 		const sidecar = `${oldPath}${suffix}`;
-		if (existsSync(sidecar)) try {
+		if (!existsSync(sidecar)) continue;
+		if (!checkpointed && statSync(sidecar).size > 0) throw new PaiFileMigrationError(`${label}: could not checkpoint ${sidecar} (non-empty WAL, committed rows may live only there) — left in place`);
+		try {
 			renameSync(sidecar, `${sidecar}.migrated-${stamp}`);
 		} catch {}
 	}
-	if (hasSqlite3) try {
-		const check = execFileSync("sqlite3", [newPath, "PRAGMA integrity_check;"], { stdio: "pipe" }).toString().trim();
-		if (check !== "ok") throw new PaiFileMigrationError(`${newPath}: PRAGMA integrity_check reported "${check}" — investigate before trusting this copy`);
+}
+/** PRAGMA integrity_check on the migrated copy, through the node driver. */
+function verifyIntegrity(newPath) {
+	let check;
+	try {
+		const db = new BetterSqlite3(newPath, { readonly: true });
+		try {
+			check = String(db.pragma("integrity_check", { simple: true }));
+		} finally {
+			db.close();
+		}
 	} catch (e) {
-		if (e instanceof PaiFileMigrationError) throw e;
+		throw new PaiFileMigrationError(`${newPath}: integrity_check could not run (${String(e)})`);
 	}
+	if (check !== "ok") throw new PaiFileMigrationError(`${newPath}: PRAGMA integrity_check reported "${check}" — investigate before trusting this copy`);
 }
 /**
 * ~/.pai/registry.db — a third per-user location, alongside PAI_HOME and the
@@ -10448,8 +11603,9 @@ function migrateRegistryDbFile(dryRun) {
 		execFileSync("pai", ["daemon", "restart"], { stdio: "inherit" });
 		execFileSync("sleep", ["2"]);
 	}
+	checkpointWal(oldPath, "registry database");
 	const result = migratePaiFile(newPath, [oldPath], { dryRun: false });
-	if (result.fromPath) checkpointAndVerify(oldPath, newPath, "registry database");
+	if (result.fromPath) verifyIntegrity(newPath);
 	return result;
 }
 /**
@@ -10477,8 +11633,9 @@ function migrateFederationDbFile(dryRun) {
 		execFileSync("pai", ["daemon", "restart"], { stdio: "inherit" });
 		execFileSync("sleep", ["2"]);
 	}
+	checkpointWal(oldPath, "federation database");
 	const result = migratePaiFile(newPath, [oldPath], { dryRun: false });
-	if (result.fromPath) checkpointAndVerify(oldPath, newPath, "federation database");
+	if (result.fromPath) verifyIntegrity(newPath);
 	return result;
 }
 
@@ -10952,8 +12109,8 @@ async function escalate(task, headline, detail, state, now, opts) {
 	state.alarmedAt[task.id] = now;
 	let delivered = false;
 	try {
-		const { routeNotification } = await import("../router-D6Ec6Fid.mjs");
-		const { loadConfig } = await import("../config-TaWmdTLx.mjs");
+		const { routeNotification } = await import("../router-DwHJRgG9.mjs");
+		const { loadConfig } = await import("../config-DtENJ6cL.mjs");
 		delivered = (await routeNotification({
 			event: "error",
 			title: `PAI: ${headline}`,
@@ -11059,7 +12216,7 @@ const GROSS_OVERRUN_FACTOR = 5;
 */
 function detectWebhook(bin = "aibroker") {
 	try {
-		const out = execFileSync(bin, ["todoist", "status"], {
+		return webhookFromStatus(execFileSync(bin, ["todoist", "status"], {
 			timeout: 1e4,
 			encoding: "utf-8",
 			stdio: [
@@ -11067,13 +12224,21 @@ function detectWebhook(bin = "aibroker") {
 				"pipe",
 				"pipe"
 			]
-		});
-		return /authoris|authoriz|token on file|grant/i.test(out) && !/no (token|grant)/i.test(out);
+		}));
 	} catch {
 		return false;
 	}
 }
 /**
+* Read `aibroker todoist status` output. Only an explicit positive line counts:
+* "Authorised <timestamp>" and no "FAILING" verdict. Negative texts ("No Todoist
+* authorisation on file", "Not authorized", "grant: missing") and a token that
+* is on file but rejected both read as no webhook.
+*/
+function webhookFromStatus(out) {
+	return /^Authori[sz]ed\s+\S/m.test(out) && !/^FAILING\b/m.test(out);
+}
+/**
 * Discard restore entries whose run is no longer in flight.
 *
 * `triggeredRestore` belongs to one run: it records the occurrence that run
@@ -11118,83 +12283,93 @@ async function tick(opts) {
 	const ordered = dispatchOrder(tasks);
 	if (!opts.dryRun) dropOrphanedRestores(tasks, state);
 	const webhookActive = opts.webhookActive ?? detectWebhook();
-	for (const task of ordered) {
-		const prevDue = state.lastSeenDue[task.id];
-		const d = decide(task, {
-			now,
-			state,
-			history: state.history,
-			lastSeenDue: state.lastSeenDue,
-			claimSeenAt: state.claimSeenAt,
-			webhookActive
-		});
-		let note = "";
-		if (!opts.dryRun && task.due) state.lastSeenDue[task.id] = task.due;
-		if (!opts.dryRun) if (isRunning(task)) {
-			if (state.claimSeenAt[task.id] === void 0 && task.recurrence && prevDue !== void 0) {
-				if (wasTicked(task, prevDue)) state.triggeredRestore[task.id] = restoreDueString(task.recurrence, prevDue);
-			}
-			state.claimSeenAt[task.id] ??= now;
-		} else delete state.claimSeenAt[task.id];
-		switch (d.action) {
-			case "wait": continue;
-			case "triggered": {
-				const r = await handleDispatch(task, 0, opts, state, now);
-				note = `ticked off by hand — ${r.note}`;
-				if (!opts.dryRun) {
-					if (!r.parked) report.dispatched++;
-					if (r.alarm) report.stuck++;
-					note += await restoreSchedule(task, d.restoreTo, opts, state);
-					if (d.restoreTo) state.triggeredRestore[task.id] = d.restoreTo;
-				}
-				break;
-			}
-			case "skip":
-				note = d.reason;
-				break;
-			case "running":
-				note = `${d.elapsedMinutes}m elapsed`;
-				break;
-			case "dispatch": {
-				const r = await handleDispatch(task, d.overdueMinutes, opts, state, now);
-				note = r.note;
-				if (!opts.dryRun) {
-					if (!r.parked) report.dispatched++;
-					if (r.alarm) report.stuck++;
-				}
-				break;
-			}
-			case "complete":
-				note = await handleComplete(task, d.durationMinutes, opts, state, now);
-				if (!opts.dryRun) report.completed++;
-				break;
-			case "abandoned":
-				note = `claimed ${d.elapsedMinutes}m ago, past the ${d.thresholdMinutes}m limit — releasing the claim`;
-				if (!opts.dryRun) {
-					await releaseClaim(task, opts.provider, state);
-					report.stuck++;
-				}
-				break;
-			case "probe":
-			case "orphaned": {
-				const result = await handleProbe(task, d.action === "probe" ? d.elapsedMinutes : null, opts, state, now);
-				note = result.note;
-				if (!opts.dryRun) {
-					report.probed++;
-					if (result.stuck) report.stuck++;
-					if (result.dispatched) report.dispatched++;
+	try {
+		for (const task of ordered) {
+			const prevDue = state.lastSeenDue[task.id];
+			const d = decide(task, {
+				now,
+				state,
+				history: state.history,
+				lastSeenDue: state.lastSeenDue,
+				claimSeenAt: state.claimSeenAt,
+				webhookActive
+			});
+			let note = "";
+			try {
+				if (!opts.dryRun && task.due) state.lastSeenDue[task.id] = task.due;
+				if (!opts.dryRun) if (isRunning(task)) {
+					if (state.claimSeenAt[task.id] === void 0 && task.recurrence && prevDue !== void 0) {
+						if (wasTicked(task, prevDue)) state.triggeredRestore[task.id] = restoreDueString(task.recurrence, prevDue);
+					}
+					state.claimSeenAt[task.id] ??= now;
+				} else delete state.claimSeenAt[task.id];
+				switch (d.action) {
+					case "wait": continue;
+					case "triggered": {
+						const r = await handleDispatch(task, 0, opts, state, now);
+						note = `ticked off by hand — ${r.note}`;
+						if (!opts.dryRun) {
+							if (!r.parked) report.dispatched++;
+							if (r.alarm) report.stuck++;
+							note += await restoreSchedule(task, d.restoreTo, opts, state);
+							if (d.restoreTo) state.triggeredRestore[task.id] = d.restoreTo;
+						}
+						break;
+					}
+					case "skip":
+						note = d.reason;
+						break;
+					case "running":
+						note = `${d.elapsedMinutes}m elapsed`;
+						break;
+					case "dispatch": {
+						const r = await handleDispatch(task, d.overdueMinutes, opts, state, now);
+						note = r.note;
+						if (!opts.dryRun) {
+							if (!r.parked) report.dispatched++;
+							if (r.alarm) report.stuck++;
+						}
+						break;
+					}
+					case "complete":
+						note = await handleComplete(task, d.durationMinutes, opts, state, now);
+						if (!opts.dryRun) report.completed++;
+						break;
+					case "abandoned":
+						note = `claimed ${d.elapsedMinutes}m ago, past the ${d.thresholdMinutes}m limit — releasing the claim`;
+						if (!opts.dryRun) {
+							await releaseClaim(task, opts.provider, state);
+							report.stuck++;
+						}
+						break;
+					case "probe":
+					case "orphaned": {
+						const result = await handleProbe(task, d.action === "probe" ? d.elapsedMinutes : null, opts, state, now);
+						note = result.note;
+						if (!opts.dryRun) {
+							report.probed++;
+							if (result.stuck) report.stuck++;
+							if (result.dispatched) report.dispatched++;
+						}
+						break;
+					}
 				}
-				break;
+				report.decisions.push({
+					decision: d,
+					note
+				});
+			} catch (err) {
+				report.decisions.push({
+					decision: d,
+					note: `error: ${err instanceof Error ? err.message : String(err)}`
+				});
 			}
 		}
-		report.decisions.push({
-			decision: d,
-			note
-		});
-	}
-	if (!opts.dryRun) {
-		reconcileWithDisk(state, stateFile);
-		saveState(state, stateFile);
+	} finally {
+		if (!opts.dryRun) {
+			reconcileWithDisk(state, stateFile);
+			saveState(state, stateFile);
+		}
 	}
 	return report;
 }
@@ -11611,7 +12786,7 @@ function cleanBrokenSymlinks(dir) {
 		const full = join(dir, entry);
 		try {
 			if (lstatSync(full).isSymbolicLink()) {
-				if (!existsSync(readlinkSync(full))) {
+				if (!existsSync(resolve(dir, readlinkSync(full)))) {
 					unlinkSync(full);
 					removed++;
 				}
@@ -12667,10 +13842,22 @@ function migrateWorkerLogs(oldPath, newPath, opts = {}) {
 	const active = activeSpawnedWorkerCount(oldPath);
 	if (active > 0) throw new WorkerLogsMigrationError(`${active} worker(s) other than the interactive session are RUNNING and writing into ${oldPath} — wait for them to finish (see \`pai worker ps\`), then retry`);
 	const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
-	cpSync(oldPath, newPath, { recursive: true });
+	const partial = `${newPath}.partial`;
+	rmSync(partial, {
+		recursive: true,
+		force: true
+	});
+	cpSync(oldPath, partial, { recursive: true });
 	const fromCount = totalFileCount(oldPath);
-	const toCount = totalFileCount(newPath);
-	if (fromCount !== toCount) throw new WorkerLogsMigrationError(`${newPath}: copy produced ${toCount} files, expected ${fromCount} from ${oldPath} — aborting, old directory left in place`);
+	const toCount = totalFileCount(partial);
+	if (fromCount !== toCount) {
+		rmSync(partial, {
+			recursive: true,
+			force: true
+		});
+		throw new WorkerLogsMigrationError(`${newPath}: copy produced ${toCount} files, expected ${fromCount} from ${oldPath} — aborting, old directory left in place`);
+	}
+	renameSync(partial, newPath);
 	renameSync(oldPath, `${oldPath}.migrated-${stamp}`);
 	return {
 		fromPath: oldPath,
@@ -13847,7 +15034,7 @@ async function migrateToPostgres(opts = {}) {
 		const dump = pgDump(container, pgConfig, dumpPath);
 		if (!dump.ok) return refused(dump.reason, dryRun);
 	}
-	const { PostgresBackend } = await import("../postgres-DgqWyqhN.mjs");
+	const { PostgresBackend } = await import("../postgres-BdBNkL_l.mjs");
 	await PostgresBackend.ensureDatabase(pgConfig);
 	const sqlite = new BetterSqlite3(sqliteFederationPath, { readonly: true });
 	const registrySqlite = sqliteRegistryPath === sqliteFederationPath ? sqlite : new BetterSqlite3(sqliteRegistryPath, { readonly: true });
@@ -14579,6 +15766,35 @@ const homeCommand = {
 * `firstlast@company.com`. Anything that should count gets listed.
 */
 /**
+* Split a recipient field into its individual entries. Commas and semicolons
+* separate entries unless inside a quoted display name or an angle-bracket
+* address. Empty entries are dropped.
+*/
+function splitAddresses(raw) {
+	const out = [];
+	let cur = "";
+	let quoted = false;
+	let angled = false;
+	for (let i = 0; i < raw.length; i++) {
+		const c = raw[i];
+		if (quoted && c === "\\" && i + 1 < raw.length) {
+			cur += c + raw[++i];
+			continue;
+		}
+		if (c === "\"") quoted = !quoted;
+		else if (!quoted && c === "<") angled = true;
+		else if (!quoted && c === ">") angled = false;
+		if (!quoted && !angled && (c === "," || c === ";")) {
+			if (cur.trim()) out.push(cur.trim());
+			cur = "";
+			continue;
+		}
+		cur += c;
+	}
+	if (cur.trim()) out.push(cur.trim());
+	return out;
+}
+/**
 * Reduce an address to a comparable form: trimmed, unwrapped, lowercased.
 *
 * Handles `Display Name <addr@example.com>` because recipient fields carry that
@@ -14588,8 +15804,9 @@ const homeCommand = {
 */
 function normalizeEmail(raw) {
 	if (!raw) return null;
-	let value = raw.trim();
-	if (!value) return null;
+	const parts = splitAddresses(raw);
+	if (parts.length !== 1) return null;
+	let value = parts[0];
 	const angled = value.match(/<([^>]*)>/);
 	if (angled) value = angled[1].trim();
 	value = value.toLowerCase();
@@ -15204,7 +16421,7 @@ const out = (s) => process.stdout.write(s + "\n");
 async function repoOf(project) {
 	if (typeof project === "string" && project) {
 		if (existsSync(project)) return resolve(project);
-		const { getProject } = await import("../helpers-DPJEHPq6.mjs");
+		const { getProject } = await import("../helpers-CMGjy_0N.mjs");
 		const row = await getProject(project);
 		if (!row) throw new CliError(`no project ${project}`, "pai projects list");
 		return row.root_path;
@@ -15572,7 +16789,8 @@ function mcpInstallCmd() {
 	for (const spec of SERVERS) {
 		const bin = distEntry(spec.entry);
 		if (spec.name in servers) {
-			console.log(warn$1(`${spec.label} is already registered in ~/.claude.json as "${spec.name}".`));
+			const same = mcpEntryRunsScript(servers[spec.name], bin);
+			console.log(warn$1(`${spec.label} is already registered in ~/.claude.json as "${spec.name}"${same ? "" : " (different script)"}.`));
 			console.log(dim$1(`  Entry: ${JSON.stringify(servers[spec.name])}`));
 			continue;
 		}
@@ -16026,7 +17244,7 @@ async function cmdPromote(opts) {
 		console.error(dim$1(`  Pick a durable location for the new project.`));
 		process.exit(1);
 	}
-	const { getRegistryBackend } = await import("../factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const encodedDir = encodeDir(targetPath);
 	if (await registryBackend.getProjectBySlug(slug) ?? await registryBackend.getProjectByRootPath(targetPath) ?? await registryBackend.getProjectByEncodedDir(encodedDir)) {
@@ -17270,7 +18488,7 @@ async function cmdUnregister(slug, opts = {}) {
 * deprecated alias that forwards here with a stderr notice.
 */
 async function projectListCmd(opts) {
-	const { cmdMain } = await import("../main-resolver-DVPpSWVy.mjs");
+	const { cmdMain } = await import("../main-resolver-3Ns1HPmS.mjs");
 	await cmdMain(void 0, void 0, opts);
 	return 0;
 }
@@ -18693,7 +19911,7 @@ async function registryScanCmd(opts) {
 		return 0;
 	}
 	if (opts.filterReport) {
-		const { reportUnregistrable } = await import("../registrable-D9aNZOTh.mjs");
+		const { reportUnregistrable } = await import("../registrable-BzH4TObg.mjs");
 		const r = await reportUnregistrable(await getRegistryBackend());
 		console.log(`Registry rows: ${r.total}`);
 		console.log(`  matching the registration filter: ${r.matching} (${r.matchingMissing} with a missing path)`);
@@ -18899,7 +20117,7 @@ const VALID_OUTCOMES = new Set([
 */
 function run$1(bin, args, stdin, killAfterMs) {
 	return new Promise((resolve, reject) => {
-		execFile(bin, args, {
+		const child = execFile(bin, args, {
 			timeout: killAfterMs,
 			maxBuffer: 1024 * 1024
 		}, (error, stdout, stderr) => {
@@ -18908,15 +20126,26 @@ function run$1(bin, args, stdin, killAfterMs) {
 				return;
 			}
 			resolve(stdout);
-		}).stdin?.end(stdin);
+		});
+		child.stdin?.on("error", (e) => reject(e));
+		child.stdin?.end(stdin);
 	});
 }
+/** A leading dash would be parsed by the CLI as an option, not a project. */
+function validProject(project) {
+	return project.length > 0 && !project.startsWith("-");
+}
 var AiBrokerTransport = class {
 	constructor(bin = "aibroker", timeoutSecs = DEFAULT_DISPATCH_TIMEOUT_SECS) {
 		this.bin = bin;
 		this.timeoutSecs = timeoutSecs;
 	}
 	async dispatch(project, message, opts) {
+		if (!validProject(project)) return {
+			outcome: "unlaunchable",
+			session: project,
+			reason: `invalid project name: ${project}`
+		};
 		const args = [
 			"dispatch",
 			project,
@@ -18960,6 +20189,10 @@ var AiBrokerProber = class {
 		this.timeoutSecs = timeoutSecs;
 	}
 	async ask(project, question) {
+		if (!validProject(project)) return {
+			state: "silent",
+			reason: `invalid project name: ${project}`
+		};
 		let stdout;
 		try {
 			stdout = await run$1(this.bin, [
@@ -19083,33 +20316,36 @@ function cliPath() {
 	}
 	throw new Error("cannot locate the PAI CLI entrypoint (dist/cli/index.mjs) — refusing to install a scheduler that would silently do nothing");
 }
+function xmlEscape(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
 function generateSchedulePlist(intervalSecs, cli) {
 	return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${SCHEDULE_LABEL}</string>
+    <string>${xmlEscape(SCHEDULE_LABEL)}</string>
 
     <key>ProgramArguments</key>
     <array>
-        <string>/usr/local/bin/node</string>
-        <string>${cli}</string>
+        <string>${xmlEscape(process.execPath)}</string>
+        <string>${xmlEscape(cli)}</string>
         <string>task</string>
         <string>poll</string>
     </array>
 
     <key>StartInterval</key>
-    <integer>${intervalSecs}</integer>
+    <integer>${Math.trunc(intervalSecs)}</integer>
 
     <key>RunAtLoad</key>
     <true/>
 
     <key>StandardOutPath</key>
-    <string>${SCHEDULE_LOG}</string>
+    <string>${xmlEscape(SCHEDULE_LOG)}</string>
 
     <key>StandardErrorPath</key>
-    <string>${SCHEDULE_LOG}</string>
+    <string>${xmlEscape(SCHEDULE_LOG)}</string>
 
     <key>EnvironmentVariables</key>
     <dict>
@@ -20517,8 +21753,8 @@ function embedProgressLine(done, backlog) {
 async function runEmbed(backend, projectId, projectSlug, batchSize = 50, pageSize = DEFAULT_PAGE_SIZE, maxMillis, run, shouldStop) {
 	const label = projectSlug ? `project ${projectSlug}` : "all projects";
 	console.log(dim$1(`Generating embeddings for ${label} (this may take a while on first run)...`));
-	const { serializeEmbedding } = await import("../embeddings-OF9Pt4by.mjs");
-	const { gateBackend } = await import("../embedding-gate-Z7CJSOJk.mjs");
+	const { serializeEmbedding } = await import("../embeddings-CIkJBKd-.mjs");
+	const { gateBackend } = await import("../embedding-gate-Cnk4YCyX.mjs");
 	const gate = await gateBackend(backend, { record: true });
 	if (!gate.ok) {
 		console.error(err(gate.reason));
@@ -20847,7 +22083,7 @@ async function memorySearchCmd(query, opts) {
 	let results;
 	if (mode === "keyword") results = await backend.searchKeyword(query, searchOpts);
 	else {
-		const { embedQuery } = await import("../embedding-gate-Z7CJSOJk.mjs");
+		const { embedQuery } = await import("../embedding-gate-Cnk4YCyX.mjs");
 		console.log(dim$1("Generating query embedding..."));
 		const q = await embedQuery(backend, query);
 		const queryEmbedding = q.vec;
@@ -20897,7 +22133,7 @@ async function memorySearchCmd(query, opts) {
 		return 0;
 	}
 	if (opts.rerank !== false) {
-		const { rerankResults } = await import("../reranker-B4r4vykM.mjs");
+		const { rerankResults } = await import("../reranker-8g6xMwP7.mjs");
 		console.log(dim$1("Reranking with cross-encoder..."));
 		results = await rerankResults(query, results, { topK: maxResults });
 	}
@@ -20927,9 +22163,9 @@ async function memorySearchCmd(query, opts) {
 //#region src/cli/commands/memory/sources-cmd.ts
 /** `pai memory sources` — what the indexer has taken in. */
 async function memorySourcesCmd(opts) {
-	const { createStorageBackend } = await import("../factory-DAGG9_n8.mjs");
-	const { loadConfig } = await import("../config-TaWmdTLx.mjs");
-	const { cmdMemorySources } = await import("../sources-CjhUKKtO.mjs");
+	const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { loadConfig } = await import("../config-DtENJ6cL.mjs");
+	const { cmdMemorySources } = await import("../sources-ESUkZaWv.mjs");
 	let backend;
 	try {
 		backend = await createStorageBackend(loadConfig());
@@ -21688,7 +22924,7 @@ async function zettelExploreCmd(note, opts) {
 	const depth = opts.depth ?? 3;
 	const direction = opts.direction ?? "both";
 	const mode = opts.mode ?? "all";
-	const { zettelExplore } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelExplore } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const result = await zettelExplore(await getFedBackend(), {
 		startNote: note,
 		depth,
@@ -21744,7 +22980,7 @@ async function zettelHealthCmd(opts) {
 	const projectPath = opts.project;
 	const recentDays = opts.days ?? 30;
 	const includeTypes = opts.include ? opts.include.split(",").map((s) => s.trim()) : void 0;
-	const { zettelHealth } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelHealth } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const result = await zettelHealth(await getFedBackend(), {
 		scope,
 		projectPath,
@@ -21802,7 +23038,7 @@ async function zettelSurpriseCmd(note, opts) {
 	const limit = opts.limit ?? 10;
 	const minSimilarity = opts.minSimilarity ?? .3;
 	const minGraphDistance = opts.minDistance ?? 3;
-	const { zettelSurprise } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelSurprise } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Surprise"));
@@ -21844,7 +23080,7 @@ async function zettelConverseCmd(question, opts) {
 	const vaultProjectId = Number(opts.vaultProjectId);
 	const depth = opts.depth ?? 2;
 	const limit = opts.limit ?? 15;
-	const { zettelConverse } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelConverse } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Converse"));
@@ -21894,7 +23130,7 @@ async function zettelThemesCmd(opts) {
 	const minClusterSize = opts.minSize ?? 3;
 	const maxThemes = opts.maxThemes ?? 10;
 	const similarityThreshold = opts.threshold ?? .65;
-	const { zettelThemes } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelThemes } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Themes"));
@@ -21942,7 +23178,7 @@ async function zettelSuggestCmd(note, opts) {
 	const vaultProjectId = Number(opts.vaultProjectId);
 	const limit = opts.limit ?? 5;
 	const excludeLinked = opts.excludeLinked !== true;
-	const { zettelSuggest } = await import("../zettelkasten-nigq7fqs.mjs");
+	const { zettelSuggest } = await import("../zettelkasten-B_rRRRvD.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Suggest"));
@@ -22234,7 +23470,7 @@ function ipcCall$1(method, params) {
 				fn();
 			}
 		};
-		const client = createConnection(paiSocketPath(), () => {
+		const client = createConnection$1(paiSocketPath(), () => {
 			client.write(JSON.stringify({
 				id: 1,
 				method,
@@ -22624,7 +23860,7 @@ function ipcCall(method, params) {
 				fn();
 			}
 		};
-		const client = createConnection(paiSocketPath(), () => {
+		const client = createConnection$1(paiSocketPath(), () => {
 			client.write(JSON.stringify({
 				id: 1,
 				method,
@@ -24256,7 +25492,14 @@ function auditSchedule(ttlSeconds = DEFAULT_TTL_SECONDS) {
 * one of the two in whichever catalogue order Claude Code loads them.
 */
 /** Recursively collect every file under `dir` whose basename satisfies `matches`. */
-function findFilesRecursive(dir, matches) {
+function findFilesRecursive(dir, matches, seen = /* @__PURE__ */ new Set()) {
+	try {
+		const real = realpathSync(dir);
+		if (seen.has(real)) return [];
+		seen.add(real);
+	} catch {
+		return [];
+	}
 	let entries;
 	try {
 		entries = readdirSync(dir, { withFileTypes: true });
@@ -24266,8 +25509,17 @@ function findFilesRecursive(dir, matches) {
 	const found = [];
 	for (const entry of entries) {
 		const full = join(dir, entry.name);
-		if (entry.isDirectory()) found.push(...findFilesRecursive(full, matches));
-		else if (entry.isFile() && matches(entry.name)) found.push(full);
+		let isDir = entry.isDirectory();
+		let isFile = entry.isFile();
+		if (entry.isSymbolicLink()) try {
+			const st = statSync(full);
+			isDir = st.isDirectory();
+			isFile = st.isFile();
+		} catch {
+			continue;
+		}
+		if (isDir) found.push(...findFilesRecursive(full, matches, seen));
+		else if (isFile && matches(entry.name)) found.push(full);
 	}
 	return found;
 }
@@ -24750,11 +26002,17 @@ function newestMcpConfig(logDir) {
 		mtime: statSync(path).mtimeMs
 	})).sort((a, b) => b.mtime - a.mtime)[0].path;
 }
+/** Child env: not a worker, and no API key (same as run-env / daemon-llm). */
+function ladderChildEnv(base) {
+	const env = { ...base };
+	delete env.PAI_WORKER;
+	delete env.ANTHROPIC_API_KEY;
+	return env;
+}
 /** Spawn one rung of `claude -p ...` and read its usage-derived first-turn context. */
 function runRung(rung, cwd) {
 	return new Promise((resolvePromise) => {
-		const env = { ...process.env };
-		delete env.PAI_WORKER;
+		const env = ladderChildEnv(process.env);
 		const proc = spawn("claude", rung.args, {
 			cwd,
 			env,