a separate daemon entrypoint (even if we fork+exec'd it) would be easier