@bli-cockpit/cli 0.2.104 → 0.2.108

package/dist/commands/backfill-upload.js

@@ -18,7 +18,14 @@ const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
  */
 export async function uploadBackfillBatches(command, io, lock, ctx) {
     const uploadable = uploadableCandidates(ctx.scan.candidates);
-    const batches = buildBackfillBatches(uploadable);
+    // Doctor needs a boundary after each session. Ordinary backfill retains
+    // its existing batching, and scheduled sync does not use this command.
+    const plannedBatches = buildBackfillBatches(uploadable);
+    const batches = command.deadlineMs !== undefined || command.onProgress
+        ? plannedBatches.flatMap((batch) => batch.candidates.map((candidate) => ({
+            worktree: batch.worktree, candidates: [candidate],
+        })))
+        : plannedBatches;
     const rawEvidenceBudget = {
         remainingBytes: RAW_EVIDENCE_DEFAULT_BYTE_BUDGET,
         remainingObjects: RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET,
@@ -34,10 +41,33 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
         done: tally.done,
         total: uploadable.length,
     });
+    const reportProgress = () => {
+        if (!command.onProgress)
+            return;
+        const unresolved = new Set([
+            ...uploadable.map(candidateCursorKey).filter((key) => !tally.durableCandidateKeys.has(key)),
+            ...ctx.scan.retryable_candidate_keys,
+        ]);
+        command.onProgress({
+            processed: tally.done,
+            uploaded: tally.backfilledSessions,
+            remaining: unresolved.size + ctx.scan.omitted_candidate_count + ctx.scan.issues
+                .filter((issue) => issue.scope === "global")
+                .reduce((total, issue) => total + issue.count, 0),
+            elapsedMs: Date.now() - ctx.now.getTime(),
+        });
+    };
+    reportProgress();
     for (const [index, batch] of batches.entries()) {
         await lock.handle.heartbeat();
+        if (command.deadlineMs !== undefined && Date.now() >= command.deadlineMs) {
+            blockedAt = stoppedAt("backfill time budget reached", index);
+            failureReason = "deferred_budget_exhausted";
+            break;
+        }
         const outcome = await uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget);
         foldBatchIntoTally(tally, batch, outcome);
+        reportProgress();
         consecutiveFailures = outcome.failed ? consecutiveFailures + 1 : 0;
         if (!command.json) {
             writeLine(io.stdout, `Uploaded ${tally.done}/${uploadable.length} (batch ${index + 1}/${batches.length})`);

package/dist/commands/clean.js

@@ -49,7 +49,7 @@ export async function runClean(command, io) {
             writeLine(io.stdout, line);
     }
     const footprint = await readDiskFootprint(paths, now);
-    const plan = await planFromDisk(paths, env, { allCommitted: command.allCommitted }, now);
+    const plan = await planFromDisk(paths, env, { allCommitted: command.allCommitted, reclaimTerminal: true }, now);
     const vaults = command.allCommitted
         ? await vaultsSafeToRemove(paths, footprint.vaults)
         : [];
@@ -69,6 +69,7 @@ export async function runClean(command, io) {
         now,
         force: true,
         allCommitted: command.allCommitted,
+        reclaimTerminal: true,
     });
     // The two smaller footprints go with it: a rotation pass sweeps the archives
     // outside the keep window, and each removed vault is named on its own line.

package/dist/commands/collection-report.js

@@ -84,7 +84,7 @@ export function rawEvidenceSyncLine(sync) {
     const stuck = sync.raw_evidence_stuck_object_count > 0
         ? `, ${sync.raw_evidence_stuck_object_count} stuck (${sync.raw_evidence_max_delivery_attempts} tries since ${sync.raw_evidence_oldest_delivery_failure_at ?? "unknown"})`
         : "";
-    return `Files: ${sync.raw_evidence_uploaded_object_count} uploaded, ${sync.raw_evidence_reused_count} already there, ${sync.raw_evidence_failed_count} failed${held}${stuck}${failures}${retries}`;
+    return `Files: ${sync.raw_evidence_uploaded_object_count} uploaded, ${sync.raw_evidence_reused_count} already there, ${sync.raw_evidence_failed_count} failed, reconciled_committed_by_409=${sync.reconciled_committed_by_409 ?? 0}${held}${stuck}${failures}${retries}`;
 }
 export function cursorStatusLine(sync) {
     return `Tracked so far: ${sync.cursor_tracked_object_count} uploaded item(s)`;
@@ -118,6 +118,7 @@ export function worktreeSyncRow(outcome, run) {
         raw_evidence_uploaded_object_count: sync.raw_evidence_uploaded_object_count,
         raw_evidence_uploaded_chunk_count: sync.raw_evidence_uploaded_chunk_count,
         raw_evidence_reused_count: sync.raw_evidence_reused_count,
+        reconciled_committed_by_409: sync.reconciled_committed_by_409 ?? 0,
         raw_evidence_failed_count: sync.raw_evidence_failed_count,
         raw_evidence_failure_reasons: sync.raw_evidence_failure_reasons,
         raw_evidence_retry_required: sync.raw_evidence_retry_required,

package/dist/commands/doctor-disk-words.js

@@ -38,6 +38,9 @@ export function diskRowMessage(footprint, capBytes) {
     // have been here — on the reference Mac the answer was
     // `reconciled_unknown_to_server` on 234 objects whose oldest was 45 days old,
     // which is a different problem from a delivery that failed this morning.
+    if (staging.terminal_count) {
+        parts.push(`${staging.terminal_count} terminal object(s), ${mib(staging.terminal_bytes ?? 0)} MB excluded from cap; reclaimable with \`cockpit clean\`: ${Object.keys(staging.terminal_reasons ?? {}).join(", ")}`);
+    }
     const dominant = staging.dominant_uncommitted_reason;
     if (dominant) {
         parts.push(`oldest undelivered ${days(dominant.oldest_disk_age_ms)}d; biggest reason ${dominant.reason} on ${dominant.count} object(s), ${mib(dominant.bytes)} MB`);

package/dist/commands/doctor-pipeline-verdicts.js

@@ -235,4 +235,14 @@ function positiveNumberOrZero(value) {
     return typeof value === "number" && Number.isFinite(value) && value > 0
         ? value
         : 0;
+}
+/** Names only the sync receipt's recorded causes. Missing evidence names itself. */
+export function syncFailureMessage(parsed) {
+    const reasons = typeof parsed?.failure_reason === "string"
+        ? [parsed.failure_reason]
+        : Array.isArray(parsed?.failure_reasons)
+            ? parsed.failure_reasons.filter((value) => typeof value === "string" && value.length > 0)
+            : [];
+    const reason = reasons.join("; ") || "sync_failure_receipt_missing";
+    return /staging_cap/u.test(reason) ? `${reason}; see disk-bounded and run \`cockpit clean --dry-run\`` : reason;
 }

package/dist/commands/doctor-pipeline.js

@@ -13,7 +13,7 @@ import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.
 import { runBackfillCommand } from "./backfill.js";
 import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
-import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
+import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
 /**
  * The `backfill-complete`, `gc-checked`, `disk-bounded`, and `sync-fresh`
@@ -50,15 +50,29 @@ export async function fixBackfillState(context) {
     const started = Date.now();
     const deadline = started + (context.command.backfillBudgetSeconds ?? 900) * 1000;
     let caughtUp = 0;
+    let chunks = 0;
+    let live = null;
+    const elapsed = () => {
+        const seconds = Math.floor((Date.now() - started) / 1000);
+        return `${Math.floor(seconds / 60)}m${String(seconds % 60).padStart(2, "0")}s`;
+    };
+    const receipt = () => `caught up on ${caughtUp} old sessions in ${chunks} chunk${chunks === 1 ? "" : "s"} over ${elapsed()}`;
     let remaining = null;
     const unfinished = (code, reason) => ({
-        ...needsFix("backfill-complete", code, `caught up on ${caughtUp} old sessions this run, ${remaining ?? "unknown"} still to go; ${reason}; run \`cockpit doctor\` again to continue`),
+        ...needsFix("backfill-complete", code, `${receipt()}, ${remaining ?? "unknown"} still to go; ${reason}; run \`cockpit doctor\` again to continue`),
         nextAction: "cockpit doctor",
     });
     const progress = setInterval(() => {
         const seconds = Math.floor((Date.now() - started) / 1000);
-        context.io.stderr.write(`backfill: ${caughtUp} caught up, ${remaining ?? "unknown"} to go, ${Math.floor(seconds / 60)}m${seconds % 60}s\n`);
-        console.error("[doctor] backfill-complete progress", JSON.stringify({ caught_up: caughtUp, remaining, elapsed_seconds: seconds }));
+        const uploaded = live === null ? null : caughtUp + live.uploaded;
+        context.io.stderr.write(live === null
+            ? `backfill: starting, ${elapsed()}\n`
+            : `backfill: ${uploaded} caught up, ${live.processed} processed in this chunk, ${live.remaining} to go, ${elapsed()}\n`);
+        console.error("[doctor] backfill-complete progress", JSON.stringify({
+            status: live === null ? "starting" : "running", processed: live?.processed ?? null,
+            uploaded, caught_up: uploaded, remaining: live?.remaining ?? null,
+            chunks, elapsed_seconds: seconds,
+        }));
     }, 30_000);
     try {
         while (Date.now() < deadline) {
@@ -71,20 +85,25 @@ export async function fixBackfillState(context) {
                 if (Date.now() >= deadline)
                     return unfinished("backfill_budget_timeout", "backfill time budget reached");
                 const capture = capturedIo(context.io, false);
+                live = null;
+                chunks += 1;
                 const code = await runBackfillCommand({
                     homeDir: context.command.homeDir, repoRoot: context.command.repoRoot,
                     all: true, dryRun: false, yes: true, json: true,
+                    deadlineMs: deadline,
+                    onProgress: (progress) => { live = progress; },
                 }, capture.io);
                 const parsed = parseDoctorBackfillJson(capture.stdout());
                 const counts = asRecord(parsed?.counts);
                 const count = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
                 caughtUp += count(counts?.["backfilled"]) ?? 0;
                 remaining = count(counts?.["remaining"]) ?? remaining;
+                live = null;
                 if (code === 0 && parsed?.status === "complete") {
                     // Reporting totals include permanent caps. Preserve their marker
                     // note instead of retrying history the collector says is complete.
                     const checked = await checkBackfillState(context);
-                    return ok("backfill-complete", checked.status === "ok" ? checked.code : "complete", `caught up on ${caughtUp} old sessions this run` + (checked.status === "ok" ? `; ${checked.message}` : ""));
+                    return ok("backfill-complete", checked.status === "ok" ? checked.code : "complete", receipt() + (checked.status === "ok" ? `; ${checked.message}` : ""));
                 }
                 const verdict = backfillFixVerdict(parsed, jsonField(capture.stderr(), "failure_reason"));
                 if (parsed?.status === "partial" &&
@@ -94,7 +113,7 @@ export async function fixBackfillState(context) {
                 return { ...verdict, message: typeof parsed?.failure_reason === "string" ? parsed.failure_reason : "backfill failed without a valid completion receipt" };
             });
             if (row.status === "ok") {
-                console.error("[doctor] backfill-complete finished", JSON.stringify({ caught_up: caughtUp, remaining, elapsed_seconds: Math.floor((Date.now() - started) / 1000) }));
+                console.error("[doctor] backfill-complete finished", JSON.stringify({ caught_up: caughtUp, remaining, chunks, elapsed_seconds: Math.floor((Date.now() - started) / 1000) }));
                 return row;
             }
             if (row.code !== "backfill_chunk_pending") {
@@ -146,7 +165,7 @@ export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
-    return footprint.staging.total_bytes > capBytes
+    return footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes
         ? needsFix("disk-bounded", "over_staging_cap", message)
         : ok("disk-bounded", "within_staging_cap", message);
 }
@@ -179,10 +198,8 @@ export async function fixDiskState(context) {
     if (!pruned.cap_blocked_by_uncommitted) {
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }
-    // Deliberately still `ok`: staging over the cap because evidence has not been
-    // accepted yet is the collector working, not a machine to repair. The row
-    // names the blockage and the one command that goes further.
-    return ok("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest — ${redelivered} — or \`cockpit clean --all-committed\` to drop every accepted copy now`);
+    // Unaccepted evidence still occupies the cap. Keep the disk row actionable.
+    return needsFix("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest; ${redelivered}; or \`cockpit clean --all-committed\` to drop every accepted copy now`);
 }
 function capturedIo(io, forward) {
     const stdoutChunks = [];
@@ -278,7 +295,11 @@ async function runSyncRepair(context) {
                     `file${draining.remainingObjects === 1 ? "" : "s"} left for later this run); ` +
                     "rerun `cockpit sync` to continue");
             }
-            return fail("sync-fresh", status ?? "sync_failed", `sync failed for ${repoRoot}`);
+            return fail("sync-fresh", status ?? "sync_failed", `${repoRoot}: ${syncFailureMessage(parsed)}`);
+        }
+        if (parsed?.collection_complete === false && typeof parsed.discovery_notice === "string") {
+            console.error("[doctor] partial discovery", JSON.stringify({ reason: "discovery_partial" }));
+            return needsFix("sync-fresh", "discovery_partial", parsed.discovery_notice);
         }
         if (status !== "uploaded") {
             return fail("sync-fresh", status ?? "sync_unverified", `sync did not return an uploaded receipt for ${repoRoot}`);

package/dist/commands/local-args-tower-usage.js

@@ -1,8 +1,13 @@
 import { optionalNonEmpty, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
 export function parseUsageArgs(args) {
-    const values = parseNamedArgs(args, { allowedFlags: ["--by-repo", "--person", "--all", "--since", "--until", "--include-automated", "--detail", "--home", "--dashboard-url", "--json"], valueFlags: ["--person", "--since", "--until", "--home", "--dashboard-url"] });
+    const values = parseNamedArgs(args, { allowedFlags: ["--min-confidence", "--by-topic", "--by-repo", "--person", "--all", "--since", "--until", "--include-automated", "--detail", "--home", "--dashboard-url", "--json"], valueFlags: ["--min-confidence", "--person", "--since", "--until", "--home", "--dashboard-url"] });
+    if (values.booleans.has("--by-repo") && values.booleans.has("--by-topic"))
+        throw new Error("--by-repo and --by-topic cannot be used together.");
+    const minConfidence = values.flags.get("--min-confidence");
+    if (minConfidence !== undefined && !["high", "medium", "low"].includes(minConfidence))
+        throw new Error("--min-confidence accepts high, medium or low.");
     const action = values.positionals[0] ?? "people";
     if (action !== "people" || values.positionals.length > 1)
         throw new Error("usage takes one verb: people.");
-    return { kind: "usage", byRepo: values.booleans.has("--by-repo"), person: optionalNonEmpty(values.flags.get("--person")), all: values.booleans.has("--all"), action: "people", since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), detail: values.booleans.has("--detail"), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
+    return { kind: "usage", ...(minConfidence ? { minConfidence: minConfidence } : {}), byTopic: values.booleans.has("--by-topic"), byRepo: values.booleans.has("--by-repo"), person: optionalNonEmpty(values.flags.get("--person")), all: values.booleans.has("--all"), action: "people", since: optionalNonEmpty(values.flags.get("--since")) ?? "30d", until: optionalNonEmpty(values.flags.get("--until")), detail: values.booleans.has("--detail"), includeAutomated: values.booleans.has("--include-automated"), homeDir: optionalNonEmpty(values.flags.get("--home")), dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")), json: values.booleans.has("--json") };
 }

package/dist/commands/local-discovery.js

@@ -20,12 +20,6 @@ export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
     }
     const worktrees = result.worktrees;
     if (!result.complete) {
-        // Sync fails closed here ON PURPOSE, and that is not the bug. Advancing a
-        // cursor after a partial scan would mark the run as covering repos it
-        // never saw, permanently skipping their sessions — backfill can tolerate
-        // partial only because it keeps per-scope completion markers, and sync
-        // does not. The bug (BLI-2362) was that the refusal named no roots and
-        // gave no runnable command, so a big workspace just stayed red forever.
         const message = incompleteDiscoveryMessage({
             result,
             roots,
@@ -35,9 +29,10 @@ export async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
         });
         if (io)
             writeLine(io.stderr, message);
-        throw new Error(message);
+        discovery.onPartial?.(message);
+        console.error("[local-discovery] partial collection", JSON.stringify({ reason: result.incomplete_reasons.join(","), roots: roots.length, incomplete_roots: result.incomplete_roots.length, max_depth: limits.maxDepth, found: worktrees.length }));
     }
-    if (worktrees.length === 0 && !discovery.allowEmpty) {
+    if (worktrees.length === 0 && result.complete && !discovery.allowEmpty) {
         // "No git repos found" is only true when the scan could actually SEE
         // everywhere it looked. With unreadable folders in hand, the sentence sent
         // the operator to the wrong repair — "run from a git repo", when the repos
@@ -104,17 +99,17 @@ function incompleteDiscoveryMessage(input) {
         `--max-repos ${nextRepos}`,
     ].join(" ");
     return [
-        `Tower could not finish scanning for repos, so it stopped instead of collecting a partial picture (${result.incomplete_reasons.join(", ")}).`,
-        "It stops rather than continuing because a partial scan would mark these repos as already checked and skip them from now on.",
+        `TOWER collection continued with partial repo discovery (${result.incomplete_reasons.join(", ")}).`,
+        `Fully scanned ${roots.length - blocked.length} of ${roots.length} roots to depth ${maxDepth}. Sessions under all approved roots remain eligible for collection.`,
         "",
         "Could not fully scan:",
         ...blocked.map((root) => `  ${root}`),
         "",
-        `Found ${found} repo(s) before stopping, with --max-depth ${maxDepth} and --max-repos ${maxRepos}.`,
+        `Found ${found} repo(s) before the cap, with --max-depth ${maxDepth} and --max-repos ${maxRepos}.`,
         "",
         "Run this to raise the limits and try again:",
         `  ${retry}`,
         "",
-        "If that still stops, the folder is deeper or larger than expected — raise the numbers again, or point --workspace at the specific project folders instead of a parent.",
+        "If the scan is still partial, raise the numbers again, or point --workspace at the specific project folders instead of a parent.",
     ].join("\n");
 }

package/dist/commands/local-help-commands-tower.js

@@ -143,9 +143,9 @@ export const TOWER_COMMAND_HELP = [
     [
         "usage",
         [
-            "Usage: cockpit usage people [--by-repo] [--person <email|me>] [--all] [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
+            "Usage: cockpit usage people [--by-repo | --by-topic] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--since <n>d|<n>h|<iso>] [--detail] [--until <iso>] [--include-automated] [--json]",
             "",
-            "--by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
+            "--by-topic adds topic rows, including (unlabelled). Choose only one grouping. --by-repo adds project rows under each person (top 10; --all shows every repo). --person me uses your signed-in email.",
             "Claude Code and Codex usage per person: sessions observed and extracted, tokens (total, output,",
             "and the input / cache split when the row carries it), and an API list-price equivalent that is",
             "labelled as such and is never actual spend. A super_admin sees everyone; a member sees their own row.",

package/dist/commands/local-help.js

@@ -102,7 +102,7 @@ export function localCommandHelp(command) {
         `  cockpit search "<words>" [--kind ${SEARCH_KINDS.join(",")}] [--limit <n>] [--dashboard-url <url>] [--json]`,
         "  cockpit release [--dry-run] [--skip-checks] [--no-floor] [--tag <tag>] [--access <public|restricted>] [--otp <code>]",
         "  cockpit careers [list|show <id>|rescreen <id>] [--role <slug>] [--min-score <n>] [--since <date>] [--json]",
-        "  cockpit usage people [--by-repo] [--person <email|me>] [--all] [--detail] [--since <n>d|<n>h|<iso>] [--until <iso>] [--include-automated] [--dashboard-url <url>] [--json]",
+        "  cockpit usage people [--by-repo | --by-topic] [--min-confidence high|medium|low] [--person <email|me>] [--all] [--detail] [--since <n>d|<n>h|<iso>] [--until <iso>] [--include-automated] [--dashboard-url <url>] [--json]",
         "",
         `Default dashboard: ${DEFAULT_DASHBOARD_URL}. Omit --dashboard-url for normal production use; pass it only for staging/custom dashboards or to force a different pairing.`,
     ].join("\n");

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.104");
+    writeLine(io?.stdout ?? process.stdout, "0.2.108");
     return 0;
   }
 

package/dist/commands/sync-followups-self-update.js

@@ -5,17 +5,20 @@ import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-
 /**
  * BLI-2601: the fleet keeps itself current on npm `latest` without anyone
  * re-running `npm i -g @bli-cockpit/cli && cockpit doctor` by hand after day 0. This always
- * runs AFTER `runSync` has already decided and reported collection's own
- * outcome above — a stuck or failing self-update can never block or delay
- * collection, and a collection failure never blocks the chance to
- * self-update. Every error path here is swallowed on purpose: a failure is
+ * runs before collection, so a failing or slow scan cannot delay the floor pull.
+ * The replacement process skips this check and continues the same tick. Every error path here is swallowed on purpose: a failure is
  * reported as its own named `update` receipt, never surfaced as a `sync`
  * failure or thrown from this function.
  */
 export async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion) {
+    if (io.env?.COCKPIT_SYNC_REEXEC === "1")
+        return false;
+    let updated = false;
     let event;
     try {
-        event = await runScheduledSelfUpdateForSync(command, io, minCliVersion);
+        const result = await runScheduledSelfUpdateForSync(command, io, minCliVersion);
+        updated = result?.reason === "updated";
+        event = result ? scheduledSelfUpdateInstallEvent(result) : null;
     }
     catch (error) {
         // The throttle/probe/install machinery below is defensive already; this
@@ -29,7 +32,7 @@ export async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl,
         };
     }
     if (!event)
-        return;
+        return false;
     await reportInstallEventsBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
@@ -38,6 +41,7 @@ export async function runScheduledSelfUpdateAfterSync(command, io, dashboardUrl,
         json: command.json,
         io,
     });
+    return updated;
 }
 async function runScheduledSelfUpdateForSync(command, io, minCliVersion) {
     const rawExec = io.exec;
@@ -60,7 +64,7 @@ async function runScheduledSelfUpdateForSync(command, io, minCliVersion) {
         currentVersion: LOCAL_COLLECTOR_VERSION,
         install: (tag) => attemptScheduledSelfUpdateInstall(scheduledIo, tag),
     }, { env: io.env, minVersion: minCliVersion });
-    return scheduledSelfUpdateInstallEvent(result);
+    return result;
 }
 async function attemptScheduledSelfUpdateInstall(io, tag) {
     try {

package/dist/commands/sync-receipt.js

@@ -125,7 +125,7 @@ export function failedReceipt(run) {
     // an operator reading a red row still has to be able to see what is merely
     // waiting — otherwise the held objects become invisible the moment anything
     // else goes wrong, which is the opposite of the fix.
-    const reasonText = [run.holdNotice, ...run.failureReasons]
+    const reasonText = [run.notice, run.holdNotice, ...run.failureReasons]
         .filter(Boolean)
         .join("; ");
     // The bucket comes from the records the deciding branches wrote, not from

package/dist/commands/sync-report.js

@@ -16,7 +16,10 @@ export async function reportMultiRepoSync(command, io, run, dedup) {
         writeLine(io.stdout, JSON.stringify({
             mode: "multi_repo",
             status: collectionRunStatus,
-            collection_complete: run.ok,
+            collection_complete: run.ok && !run.discovery_partial,
+            discovery_notice: run.notice,
+            failure_reasons: run.failure_reasons,
+            failure_records: run.failure_records,
             results: run.outcomes.map((outcome) => outcome.sync),
             repos: rows,
             codex_sessions: run.summary,
@@ -45,7 +48,10 @@ export async function reportNoWorktreeSync(command, io, run, dedup) {
         writeLine(io.stdout, JSON.stringify({
             mode: "no_worktrees",
             status: collectionRunStatus,
-            collection_complete: run.ok,
+            collection_complete: run.ok && !run.discovery_partial,
+            discovery_notice: run.notice,
+            failure_reasons: run.failure_reasons,
+            failure_records: run.failure_records,
             ...(run.notice ? { notice: run.notice } : {}),
             codex_sessions: run.summary,
             raw_evidence_gc: gc,
@@ -54,7 +60,7 @@ export async function reportNoWorktreeSync(command, io, run, dedup) {
         return syncResult(run);
     }
     writeLine(run.ok ? io.stdout : io.stderr, `Tower sync ${collectionRunStatus}: no git worktrees under this root; session scan ran.`);
-    if (run.notice) {
+    if (run.notice?.startsWith("nothing_in_root")) {
         // Says out loud what the receipt now says to the dashboard: the sessions
         // this machine ran were all outside the folders it is allowed to look at.
         writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). Nothing was collected, and nothing is broken.`);
@@ -82,7 +88,10 @@ export async function reportSingleRepoSync(command, io, run, dedup) {
         writeLine(io.stdout, JSON.stringify({
             ...result,
             status: collectionRunStatus,
-            collection_complete: run.ok,
+            collection_complete: run.ok && !run.discovery_partial,
+            discovery_notice: run.notice,
+            failure_reasons: run.failure_reasons,
+            failure_records: run.failure_records,
             codex_sessions: run.summary,
             raw_evidence_gc: gc,
             raw_evidence_dedup: dedup,

package/dist/commands/sync-run.js

@@ -22,11 +22,13 @@ export async function runSyncLocked(command, io) {
     if (!dedup.skipped && dedup.removed_dirs > 0) {
         writeLine(io.stdout, rawEvidenceDedupSummary(dedup));
     }
+    let discoveryNotice = null;
     const worktrees = await discoverCommandWorktrees(collectionRoots, {
         maxDepth: command.maxDepth,
         maxRepos: command.maxRepos,
         homeDir: command.homeDir,
         allowEmpty: true,
+        onPartial: (notice) => { discoveryNotice = notice; },
     }, io);
     const run = await runAttributedWorktreeSync({
         homeDir: command.homeDir,
@@ -36,6 +38,10 @@ export async function runSyncLocked(command, io) {
         worktrees,
         fetchImpl: io.fetch,
     });
+    if (discoveryNotice) {
+        run.discovery_partial = true;
+        run.notice = [discoveryNotice, run.notice].filter(Boolean).join("; ");
+    }
     if (run.outcomes.length > 1) {
         return reportMultiRepoSync(command, io, run, dedup);
     }

package/dist/commands/sync.js

@@ -7,6 +7,7 @@
  *
  *   rotate the scheduler's own logs   ../log-rotation.ts
  *   say the tick started              reportTickStarted, below
+ *   update and re-exec if needed      sync-followups-self-update.ts
  *   collect behind both locks         sync-receipt.ts
  *   check in with the heartbeat door  sync-heartbeat.ts
  *   say how the tick went             reportTickOutcome / reportTickThrew
@@ -32,6 +33,8 @@
  * `scripts/build-public-cli.mjs` `runtimeFiles`, or the repo tests stay green
  * while the packed CLI breaks.
  */
+import { createInteractiveExecRunner } from "../process-runner.js";
+import { envWithNodeRuntimeOnPath } from "../scheduled-self-update.js";
 import { runMemoryExperienceAfterSync } from "./memory-log.js";
 import { classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
 import { sendSyncHeartbeat } from "./sync-heartbeat.js";
@@ -48,14 +51,33 @@ export async function runSync(command, io) {
     await rotateCollectorLogsBestEffort(paths);
     const dashboardUrl = await tickDashboardUrl(command, paths);
     const minCliVersionAtStart = await reportTickStarted(command, io, dashboardUrl);
+    const updated = await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersionAtStart);
+    if (updated && io.exec) {
+        const args = ["sync"];
+        if (command.homeDir)
+            args.push("--home", command.homeDir);
+        if (command.repoRoot)
+            args.push("--workspace", command.repoRoot);
+        if (command.dashboardUrl)
+            args.push("--dashboard-url", command.dashboardUrl);
+        if (command.maxDepth)
+            args.push("--max-depth", String(command.maxDepth));
+        if (command.maxRepos)
+            args.push("--max-repos", String(command.maxRepos));
+        if (command.json)
+            args.push("--json");
+        const exec = io.interactiveExec ?? createInteractiveExecRunner();
+        const result = await exec("cockpit", args, { env: envWithNodeRuntimeOnPath({ ...process.env, ...io.env, COCKPIT_SYNC_REEXEC: "1" }) });
+        return result.code;
+    }
     try {
         const result = await runSyncWithHealthReceipt(command, io);
         // BLI-3551: every tick checks in, including one that collected nothing.
         // This is the only writer of `last_seen_at` that does not need an envelope,
         // so it is what separates a quiet machine from a dead one.
         await sendSyncHeartbeat(command, io, dashboardUrl, result.heartbeat);
-        const minCliVersion = await reportTickOutcome(command, io, dashboardUrl, result.completion);
-        await convergeAfterTick(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
+        await reportTickOutcome(command, io, dashboardUrl, result.completion);
+        await convergeAfterTick(command, io, dashboardUrl);
         // BLI-3619: and the disk stops growing without bound — same daily cadence,
         // same rule that a follow-up never blocks or fails collection.
         await runStagingPruneAfterSync(command, io, dashboardUrl);
@@ -70,8 +92,8 @@ export async function runSync(command, io) {
             status: "fail",
             reason: errorCode,
         });
-        const minCliVersion = await reportTickThrew(command, io, dashboardUrl, error, errorCode);
-        await convergeAfterTick(command, io, dashboardUrl, minCliVersion ?? minCliVersionAtStart);
+        await reportTickThrew(command, io, dashboardUrl, error, errorCode);
+        await convergeAfterTick(command, io, dashboardUrl);
         throw error;
     }
 }
@@ -137,8 +159,7 @@ async function reportTickThrew(command, io, dashboardUrl, error, errorCode) {
  * Memory's registration — each at most once a day, each with its own receipt,
  * and none of them able to block or fail collection (BLI-3580).
  */
-async function convergeAfterTick(command, io, dashboardUrl, minCliVersion) {
-    await runScheduledSelfUpdateAfterSync(command, io, dashboardUrl, minCliVersion);
+async function convergeAfterTick(command, io, dashboardUrl) {
     await runAutostartSelfHealAfterSync(command, io, dashboardUrl);
     await runMemoryInstallAfterSync(command, io, dashboardUrl);
     await runMemoryExperienceAfterSync({ ...command, dashboardUrl }, io);

package/dist/commands/usage.js

@@ -5,6 +5,10 @@ import { writeLine } from "./cli-io.js";
 export async function runUsage(command, io) {
     const door = await openAgentDoor("usage", command, io);
     const query = new URLSearchParams({ since: command.since });
+    if (command.minConfidence)
+        query.set("minConfidence", command.minConfidence);
+    if (command.byTopic)
+        query.set("groupBy", "task_type");
     if (command.byRepo)
         query.set("groupBy", "repo");
     if (command.until)
@@ -20,17 +24,19 @@ export async function runUsage(command, io) {
         if (!email)
             return failAgentDoor(door, "[usage]", "caller_email_unavailable", "The paired session has no email. Sign in again or pass --person <email>.");
         body.people = (body.people ?? []).filter((person) => person.email?.toLowerCase() === email.toLowerCase());
-        body.coverage = { sessions_extracted: body.people.reduce((total, person) => total + person.sessions_extracted, 0), sessions_observed: body.people.reduce((total, person) => total + person.sessions_observed, 0) };
+        body.coverage = { sessions_labelled: body.people.reduce((total, person) => total + (person.sessions_labelled ?? 0), 0), sessions_extracted: body.people.reduce((total, person) => total + person.sessions_extracted, 0), sessions_observed: body.people.reduce((total, person) => total + person.sessions_observed, 0) };
     }
     if (command.byRepo && body.people?.some((person) => !Array.isArray(person.repos))) {
         return failAgentDoor(door, "[usage]", "repo_grouping_unavailable", "The dashboard returned person totals without project rows. Deploy the dashboard project split before using --by-repo.");
     }
+    if (command.byTopic && body.people?.some((person) => !Array.isArray(person.task_types)))
+        return failAgentDoor(door, "[usage]", "topic_grouping_unavailable", "The dashboard returned person totals without topic rows. Deploy the dashboard topic split before using --by-topic.");
     if (door.json)
         return emitAgentDoor(door, body);
     let nameWidth = 20;
-    if (command.byRepo) {
+    if (command.byRepo || command.byTopic) {
         for (const person of body.people ?? []) {
-            const repos = person.repos ?? [];
+            const repos = (command.byTopic ? person.task_types : person.repos) ?? [];
             for (const repo of command.all ? repos : repos.slice(0, 10))
                 nameWidth = Math.max(nameWidth, repo.repo_label.length + 2);
         }
@@ -46,17 +52,21 @@ export async function runUsage(command, io) {
             `${row.sessions_extracted}/${row.sessions_observed}`,
             ...(command.detail ? [row.output_tokens, row.input_tokens, row.cache_read_input_tokens, row.cache_creation_input_tokens].map(formatCount) : []),
         ]);
-        if (command.byRepo) {
-            const repos = row.repos ?? [];
+        if (command.byRepo || command.byTopic) {
+            const repos = (command.byTopic ? row.task_types : row.repos) ?? [];
             for (const repo of command.all ? repos : repos.slice(0, 10)) {
+                if (command.byTopic && repo.confidence)
+                    writeLine(io.stdout, `  Confidence: ${repo.confidence.high} high, ${repo.confidence.medium} medium, ${repo.confidence.low} low`);
                 printRow([`  ${repo.repo_label}`, formatCount(repo.tokens), formatUsageDollars(repo.api_list_price_equivalent_usd), `${repo.extracted_sessions}/${repo.sessions}`, ...(command.detail ? [repo.output, repo.input, repo.cache_read, repo.cache_creation].map(formatCount) : [])]);
             }
             if (!command.all && repos.length > 10)
-                writeLine(io.stdout, `  and ${repos.length - 10} more repos`);
+                writeLine(io.stdout, `  and ${repos.length - 10} more ${command.byTopic ? "topics" : "repos"}`);
         }
     }
     writeLine(io.stdout, "");
     writeLine(io.stdout, body.api_list_price_equivalent_label ?? "API list-price equivalent (not actual spend)");
     writeLine(io.stdout, `${body.coverage?.sessions_extracted ?? 0} of ${body.coverage?.sessions_observed ?? 0} sessions extracted`);
+    if (command.byTopic)
+        writeLine(io.stdout, `${body.coverage?.sessions_labelled ?? 0} of ${body.coverage?.sessions_observed ?? 0} sessions labelled by topic`);
     return 0;
 }

package/dist/disk-prune.js

@@ -63,6 +63,7 @@ export async function planFromDisk(paths, env, options, now) {
         retentionMs: options.retentionMs ?? fromEnv.retentionMs,
         capBytes: options.capBytes ?? fromEnv.capBytes,
         allCommitted: options.allCommitted,
+        reclaimTerminal: options.reclaimTerminal,
     });
 }
 async function applyPlan(paths, plan) {

package/dist/disk-retention.js

@@ -23,6 +23,11 @@ export function planStagingRetention(inventory, options = {}) {
     const committedInWindow = [];
     for (const pack of inventory.packs) {
         for (const object of pack.objects) {
+            if (object.state === "terminal") {
+                if (options.reclaimTerminal)
+                    pushDeletion(plan, object, `terminal:${object.reason}`);
+                continue;
+            }
             if (object.state !== "committed") {
                 keepUnvouched(plan, object);
                 continue;
@@ -35,7 +40,8 @@ export function planStagingRetention(inventory, options = {}) {
             addToBucket(plan.kept_in_window, object);
         }
     }
-    applyByteCap(plan, committedInWindow, capBytes, inventory);
+    const retainedTerminalBytes = options.reclaimTerminal ? 0 : (inventory.terminal_bytes ?? 0);
+    applyByteCap(plan, committedInWindow, capBytes + retainedTerminalBytes, inventory);
     markEmptyPacks(plan, inventory.packs);
     plan.bytes_after =
         inventory.total_bytes - plan.deleted_bytes - plan.empty_pack_manifest_bytes;
@@ -44,7 +50,7 @@ export function planStagingRetention(inventory, options = {}) {
     // sentence — the remaining manifests alone exceed it — and saying the wrong
     // one would send an operator hunting evidence that is not missing.
     const unvouched = plan.kept_uncommitted.count + plan.kept_unknown.count;
-    plan.cap_blocked_by_uncommitted = plan.bytes_after > capBytes && unvouched > 0;
+    plan.cap_blocked_by_uncommitted = plan.bytes_after - retainedTerminalBytes > capBytes && unvouched > 0;
     plan.cap_blocked_count = plan.cap_blocked_by_uncommitted ? unvouched : 0;
     return plan;
 }
@@ -84,7 +90,7 @@ function applyByteCap(plan, committedInWindow, capBytes, inventory) {
 function unremovableFloor(inventory) {
     let floor = 0;
     for (const pack of inventory.packs) {
-        const unvouched = pack.objects.filter((object) => object.state !== "committed");
+        const unvouched = pack.objects.filter((object) => object.state !== "committed" && object.state !== "terminal");
         if (unvouched.length === 0)
             continue;
         floor += pack.manifest_bytes;

package/dist/disk-usage-classify.js

@@ -2,14 +2,13 @@
  * The three-state question, asked once per staged file: committed, uncommitted,
  * or unknown — and the reason label that says which record answered.
  *
- * The order of the answers is the whole safety property. This machine's commit
- * ledger wins first; a server answer an earlier `cockpit clean --reconcile`
- * recorded wins next, because the server was actually asked; and only when
- * neither can speak does the object fall to `unknown` with the reason its
- * silence has. Everything downstream — what may be deleted, what is offered
+ * A local commit wins unless a newer server reconciliation disputes it.
+ * Explicit object refusals remain terminal until a later successful delivery.
+ * When neither ledger can speak, the object is unknown and stays on disk. Everything downstream — what may be deleted, what is offered
  * again, what an operator reads — is this label.
  */
 import path from "node:path";
+import { terminalDeliveryReason } from "./raw-evidence-staging.js";
 import { hashUnnamedFile } from "./disk-usage-files.js";
 export async function classifyObject(dir, packId, relative, size, manifest, options) {
     const hash = manifest?.get(relative) ??
@@ -23,21 +22,28 @@ export async function classifyObject(dir, packId, relative, size, manifest, opti
         staged_on_disk_at: options.stagedOnDiskAt,
         disk_age_ms: ageMs(options.stagedOnDiskAt, options.now),
     };
-    if (committedAt) {
+    const reconciled = hash ? options.reconciled.get(hash) : undefined;
+    const serverDisputesCommit = reconciled && committedAt &&
+        Date.parse(reconciled.checked_at) > Date.parse(committedAt) &&
+        reconciled.verdict !== "committed";
+    if (committedAt && !serverDisputesCommit) {
         return {
-            ...base,
-            content_hash: hash ?? null,
-            state: "committed",
-            reason: "committed_in_ledger",
-            decided_at: committedAt,
+            ...base, content_hash: hash ?? null, state: "committed",
+            reason: "committed_in_ledger", decided_at: committedAt,
             age_ms: ageMs(committedAt, options.now),
         };
     }
-    if (hash) {
-        const reconciled = options.reconciled.get(hash);
-        if (reconciled) {
-            return classifyFromReconcileAnswer(base, hash, reconciled, options.now);
-        }
+    const attempt = hash ? options.deliveryAttempts?.[hash] : undefined;
+    const serverConfirmedAfterRefusal = reconciled?.verdict === "committed" &&
+        attempt && Date.parse(reconciled.checked_at) >= Date.parse(attempt.last_attempt_at);
+    if (attempt && terminalDeliveryReason(attempt.last_reason) && !serverConfirmedAfterRefusal) {
+        return {
+            ...base, content_hash: hash ?? null, state: "terminal", reason: attempt.last_reason,
+            decided_at: attempt.last_attempt_at, age_ms: ageMs(attempt.last_attempt_at, options.now),
+        };
+    }
+    if (hash && reconciled) {
+        return classifyFromReconcileAnswer(base, hash, reconciled, options.now);
     }
     const unknownReason = unknownStateReason(hash, manifest, stagedAt, options);
     return {

package/dist/disk-usage-scan.js

@@ -8,6 +8,7 @@
  * each pack's own manifest, and a single byte budget shared across the run.
  */
 import fs from "node:fs/promises";
+import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
 import path from "node:path";
 import { classifyObject, } from "./disk-usage-classify.js";
 import { RAW_EVIDENCE_DIR, } from "./disk-usage-facts.js";
@@ -19,6 +20,7 @@ export async function readStagingInventory(paths, now = new Date()) {
     const ledger = await readCommitLedger(paths);
     const reconciled = await readReconcileLedger(paths);
     const stagedAt = await readStagedAtIndex(paths);
+    const { delivery_attempts: deliveryAttempts } = await readRawEvidenceStagingState(paths.state_dir);
     const entries = await fs
         .readdir(root, { withFileTypes: true })
         .catch(() => []);
@@ -36,6 +38,7 @@ export async function readStagingInventory(paths, now = new Date()) {
         if (!entry.name.startsWith("work-"))
             continue;
         const pack = await readPack(dir, entry.name, {
+            deliveryAttempts,
             ledger,
             reconciled,
             stagedAt,

package/dist/disk-usage-totals.js

@@ -26,6 +26,13 @@ export function accumulatePack(inventory, pack) {
     for (const object of pack.objects) {
         inventory.object_count += 1;
         inventory.total_bytes += object.byte_size;
+        if (object.state === "terminal") {
+            inventory.terminal_count = (inventory.terminal_count ?? 0) + 1;
+            inventory.terminal_bytes = (inventory.terminal_bytes ?? 0) + object.byte_size;
+            const reasons = inventory.terminal_reasons ??= {};
+            reasons[object.reason] = (reasons[object.reason] ?? 0) + 1;
+            continue;
+        }
         if (object.state === "committed") {
             inventory.committed_count += 1;
             inventory.committed_bytes += object.byte_size;

package/dist/evidence-redelivery.js

@@ -28,7 +28,7 @@ import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } f
 import { readStagingInventory } from "./disk-usage.js";
 import { describeError } from "./health-detail.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "./local-state.js";
-import { clearDeliveryAttempt, readRawEvidenceStagingState, recordDeliveryFailure, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
+import { clearDeliveryAttempt, readRawEvidenceStagingState, recordDeliveryFailure, terminalDeliveryReason, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
 /**
  * The drain the sync tick runs and `cockpit doctor`'s disk fix reuses.
  * Never throws.
@@ -46,7 +46,7 @@ export async function runEvidenceRedelivery(options) {
             // The steady state, 96 ticks a day. Saying so every time would bury the
             // ticks that matter; `cockpit doctor`'s disk row still says it out loud
             // to a person who asks.
-            return emptyResult("nothing_uncommitted", "ok");
+            return { ...emptyResult("nothing_uncommitted", "ok"), terminal: inventory.terminal_count ?? 0, terminal_bytes: inventory.terminal_bytes ?? 0 };
         }
         const staging = await readRawEvidenceStagingState(paths.state_dir);
         const plan = await planEvidenceRedelivery({
@@ -58,7 +58,7 @@ export async function runEvidenceRedelivery(options) {
             ...(options.maxObjects != null ? { maxObjects: options.maxObjects } : {}),
         });
         if (plan.object_count === 0) {
-            const result = emptyPlanResult(plan);
+            const result = { ...emptyPlanResult(plan), terminal: inventory.terminal_count ?? 0, terminal_bytes: inventory.terminal_bytes ?? 0 };
             reportRedelivery(result, plan);
             return result;
         }
@@ -86,14 +86,18 @@ export async function runEvidenceRedelivery(options) {
             now,
         });
         await recordOutcomes(paths, staging, outcome.outcomes, now);
+        const terminalOutcomes = outcome.outcomes.filter(entry => entry.upload_state === "upload_failed" && terminalDeliveryReason(entry.reason));
         const result = {
             status: outcome.failed > 0 && outcome.uploaded === 0 ? "fail" : "ok",
             reason: "redelivered",
+            terminal: (inventory.terminal_count ?? 0) + terminalOutcomes.length,
+            terminal_bytes: (inventory.terminal_bytes ?? 0) + terminalOutcomes.reduce((bytes, entry) => bytes + (entry.pointer.byte_size ?? 0), 0),
             offered: plan.object_count,
             offered_bytes: plan.bytes,
             uploaded: outcome.uploaded,
             uploaded_bytes: outcome.uploadedBytes,
             reused: outcome.reused,
+            reconciled_committed_by_409: outcome.outcomes.filter(entry => entry.reason === "reconciled_committed_by_409").length,
             failed: outcome.failed,
             held: plan.held_count,
             deferred: plan.deferred_count,
@@ -229,11 +233,14 @@ function reportRedelivery(result, plan) {
     const fields = {
         reason: result.reason,
         status: result.status,
+        terminal: result.terminal ?? 0,
+        terminal_bytes: result.terminal_bytes ?? 0,
         offered: result.offered,
         offered_bytes: result.offered_bytes,
         uploaded: result.uploaded,
         uploaded_bytes: result.uploaded_bytes,
         reused: result.reused,
+        reconciled_committed_by_409: result.reconciled_committed_by_409 ?? 0,
         failed: result.failed,
         held_by_backoff: result.held,
         deferred_to_next_tick: result.deferred,
@@ -243,7 +250,7 @@ function reportRedelivery(result, plan) {
         failure_reasons: result.failure_reasons,
     };
     if (result.status === "fail") {
-        console.error("[evidence-redelivery] every re-offered object was refused", JSON.stringify(fields));
+        console.error("[evidence-redelivery] staged evidence could not be delivered", JSON.stringify(fields));
         return;
     }
     console.error(result.uploaded > 0
@@ -251,11 +258,11 @@ function reportRedelivery(result, plan) {
         : "[evidence-redelivery] undelivered staged evidence was not re-offered this tick", JSON.stringify(fields));
 }
 function emptyPlanResult(plan) {
-    const nothingPlannable = plan.held_count > 0 && plan.deferred_count === 0
+    const nothingPlannable = plan.held_count > 0 && plan.deferred_count === 0 && Object.keys(plan.unplannable).length === 0
         ? "all_held_by_backoff"
         : "nothing_plannable";
     return {
-        ...emptyResult(nothingPlannable, "ok"),
+        ...emptyResult(nothingPlannable, Object.keys(plan.unplannable).length ? "fail" : "ok"),
         held: plan.held_count,
         deferred: plan.deferred_count,
         deferred_bytes: plan.deferred_bytes,

package/dist/evidence-upload-object.js

@@ -1,11 +1,12 @@
 import { COMMIT_CRASHED_PLATFORM, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
+import { beginOneObject } from "./evidence-upload-terminal.js";
 import { isNonJsonResponseBody, requestJson, safeFailureDetail, sha256, } from "./evidence-upload-transport.js";
 /**
  * The `chunk` and `commit` stages for one already-`begin`-accepted object:
  * send every chunk the server does not already have, then commit and turn
  * the receipt into a `ChunkedUploadFileOutcome`.
  */
-export async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
+export async function uploadOneObject(options, entry, disposition, chunkSizeBytes, restageAttempted = false) {
     const objectKey = entry.file.pointer.object_key ?? "";
     if (disposition.disposition === "already_committed") {
         if (!disposition.upload_id) {
@@ -18,7 +19,22 @@ export async function uploadOneObject(options, entry, disposition, chunkSizeByte
     const chunked = await uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey);
     if (!chunked.ok)
         return chunked.outcome;
-    return commitUploadedObject(options, entry, disposition, objectKey, chunked.uploadedChunks);
+    const committed = await commitUploadedObject(options, entry, disposition, objectKey, chunked.uploadedChunks);
+    if (committed.reason !== "commit_failed_http_409_staging_missing_between_passes")
+        return committed;
+    if (restageAttempted)
+        return { ...committed, reason: "staging_missing_after_restage" };
+    console.error("[evidence-upload] restaging missing chunks", JSON.stringify({
+        reason: "staging_missing_between_passes", upload_id: disposition.upload_id,
+    }));
+    const restarted = await beginOneObject(options, { ...entry, duplicates: [] }, chunkSizeBytes);
+    if (!restarted)
+        return failedOutcome(entry.file, "staging_restage_failed:begin_failed", chunked.uploadedChunks);
+    const retried = await uploadOneObject(options, entry, restarted, chunkSizeBytes, true);
+    if (retried.upload_state === "upload_failed" && retried.reason !== "staging_missing_after_restage") {
+        retried.reason = `staging_restage_failed:${retried.reason ?? "unknown"}`;
+    }
+    return retried;
 }
 async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, objectKey) {
     const received = new Set(disposition.received_chunk_indexes);
@@ -47,6 +63,15 @@ async function uploadObjectChunks(options, entry, disposition, chunkSizeBytes, o
             // `chunk_3_failed_http_413_object_too_large` and the ledger row names
             // the cause instead of the transport (BLI-3483).
             const chunkDetail = safeFailureDetail(chunkResponse.body);
+            if (chunkResponse.status === 409 && chunkDetail === "upload_not_pending:committed") {
+                console.error("[evidence-upload] committed receipt reconciled", JSON.stringify({
+                    reason: "reconciled_committed_by_409", upload_id: disposition.upload_id,
+                }));
+                return { ok: false, outcome: {
+                        ...failedOutcome(entry.file, "reconciled_committed_by_409", uploadedChunks),
+                        upload_state: "reused_existing",
+                    } };
+            }
             console.error("[evidence-upload] chunk rejected", JSON.stringify({
                 reason: "chunk_rejected",
                 upload_id: disposition.upload_id,

package/dist/evidence-upload-terminal.js

@@ -73,7 +73,7 @@ export async function rekeyConflictedEntry(options, entry, disposition, chunkSiz
  * pointer id that is not the one we sent — and the caller then keeps the
  * original conflict rather than acting on a guess.
  */
-async function beginOneObject(options, entry, chunkSizeBytes) {
+export async function beginOneObject(options, entry, chunkSizeBytes) {
     const objectKey = entry.file.pointer.object_key ?? "";
     const response = await requestJson(options, "/api/ambient/evidence/upload/begin", {
         schema_version: "ambient-raw-evidence-upload-begin.v1",

package/dist/raw-evidence-staging.js

@@ -160,6 +160,7 @@ export function recordDeliveryFailure(state, contentHash, options) {
     const attemptedAtIso = options.attemptedAt.toISOString();
     const entry = {
         attempts,
+        ...(terminalDeliveryReason(options.reason) ? { terminal_reason: options.reason } : {}),
         first_failed_at: previous?.first_failed_at ?? attemptedAtIso,
         last_attempt_at: attemptedAtIso,
         last_reason: options.reason,
@@ -177,13 +178,20 @@ export function clearDeliveryAttempt(state, contentHash) {
     delete state.delivery_attempts[contentHash];
     return true;
 }
+export function terminalDeliveryReason(reason) {
+    return Boolean(reason && (reason.startsWith("staging_restage_failed:") ||
+        ["staging_missing_after_restage", "secret_guard_rejected", "storage_rejected_object_too_large", "storage_rejected_media_type"].includes(reason) ||
+        /^(?:begin|commit|chunk_\d+)_failed_http_413(?:_|$)/u.test(reason)));
+}
 export function deliveryHold(state, contentHash, now) {
     if (!contentHash)
         return null;
     const entry = state.delivery_attempts[contentHash];
     if (!entry)
         return null;
-    return Date.parse(entry.next_attempt_at) > now.getTime() ? entry : null;
+    if (terminalDeliveryReason(entry.last_reason))
+        return entry;
+    return deliveryRetryAtMs(entry) > now.getTime() ? entry : null;
 }
 /**
  * Source keys currently held by backoff.
@@ -194,10 +202,10 @@ export function deliveryHold(state, contentHash, now) {
  */
 export function heldSourceKeys(state, now) {
     const held = new Set();
-    for (const entry of Object.values(state.delivery_attempts)) {
-        if (!entry.source_key)
+    for (const [hash, entry] of Object.entries(state.delivery_attempts)) {
+        if (!entry.source_key || terminalDeliveryReason(entry.last_reason))
             continue;
-        if (Date.parse(entry.next_attempt_at) > now.getTime()) {
+        if (deliveryHold(state, hash, now)) {
             held.add(entry.source_key);
         }
     }
@@ -286,6 +294,7 @@ function parseAttemptEntry(value) {
         return null;
     const attempts = optionalNumber(record["attempts"]);
     return {
+        ...(terminalDeliveryReason(optionalString(record["last_reason"])) ? { terminal_reason: String(record["last_reason"]) } : {}),
         attempts: attempts > 0 ? attempts : 1,
         first_failed_at: optionalString(record["first_failed_at"]) ?? lastAttemptAt,
         last_attempt_at: lastAttemptAt,
@@ -307,4 +316,8 @@ function shortHash(value) {
         .update(value, "utf8")
         .digest("hex")
         .slice(0, 12);
+}
+/** A persisted clock cannot extend a retry beyond the last attempt's ceiling. */
+export function deliveryRetryAtMs(entry) {
+    return Math.min(Date.parse(entry.next_attempt_at), Date.parse(entry.last_attempt_at) + EVIDENCE_DELIVERY_BACKOFF_MAX_MS);
 }

package/dist/raw-evidence-stuck-summary.js

@@ -14,12 +14,13 @@
  * Metadata only, like the rest of this family: content hashes, byte sizes,
  * reason labels, timestamps. Never content, never an absolute path.
  */
+import { deliveryRetryAtMs, terminalDeliveryReason } from "./raw-evidence-staging.js";
 /**
  * What `cockpit status` and the health receipt need in order to be unable to
  * read green while an object has been failing for nine days.
  */
 export function summarizeStuckEvidence(state, now) {
-    const entries = Object.values(state.delivery_attempts);
+    const entries = Object.values(state.delivery_attempts).filter(entry => !terminalDeliveryReason(entry.last_reason));
     const reasons = new Set();
     let heldCount = 0;
     let maxAttempts = 0;
@@ -31,15 +32,16 @@ export function summarizeStuckEvidence(state, now) {
     let heldNextAttemptAt = null;
     for (const entry of entries) {
         reasons.add(entry.last_reason);
-        if (Date.parse(entry.next_attempt_at) > now.getTime()) {
+        const retryAt = deliveryRetryAtMs(entry);
+        if (retryAt > now.getTime()) {
             heldCount += 1;
             if (!heldOldest ||
                 entry.first_failed_at.localeCompare(heldOldest.first_failed_at) < 0) {
                 heldOldest = entry;
             }
             if (!heldNextAttemptAt ||
-                entry.next_attempt_at.localeCompare(heldNextAttemptAt) < 0) {
-                heldNextAttemptAt = entry.next_attempt_at;
+                retryAt < Date.parse(heldNextAttemptAt)) {
+                heldNextAttemptAt = new Date(retryAt).toISOString();
             }
         }
         maxAttempts = Math.max(maxAttempts, entry.attempts);

package/dist/scheduled-self-update.js

@@ -28,11 +28,9 @@ export function envWithNodeRuntimeOnPath(env, nodeExecutable = process.execPath)
  * post-collection tail, so the fleet converges on npm `latest` without
  * anyone re-running `npm i -g @bli-cockpit/cli && cockpit doctor` by hand after day 0.
  *
- * Deliberately does not re-exec: this process already has the OLD code
- * loaded in memory, so nothing in-process could prove a re-exec actually
- * picked up the new build. The next scheduled tick launches a fresh
- * `cockpit` process from disk and picks up whatever npm actually installed —
- * that is the verification, not a re-exec here.
+ * Installation is verified with npm's installed-version probe. The sync caller
+ * re-executes the tick on `updated`, carrying a guard that skips another update
+ * attempt in the replacement process.
  */
 export async function runScheduledSelfUpdate(paths, deps, options = {}) {
     const env = options.env ?? process.env;

package/dist/upload-evidence-delivery-offer.js

@@ -1,4 +1,4 @@
-import { clearDeliveryAttempt, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, deliveryHold, recordDeliveryFailure, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
+import { clearDeliveryAttempt, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, deliveryHold, recordDeliveryFailure, terminalDeliveryReason, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
 /**
  * 1. What may we offer this sync? 2. What just happened to each object?
  *
@@ -25,7 +25,7 @@ export function partitionHeldEvidenceFiles(files, staging, now, mode) {
     const backoffApplies = deliveryBackoffApplies(mode);
     for (const file of files) {
         const hold = deliveryHold(staging, file.pointer.content_hash_sha256, now);
-        if (hold && !backoffApplies) {
+        if (hold && !backoffApplies && !terminalDeliveryReason(hold.last_reason)) {
             // BLI-3118: a person asked for this one now. Offering it is the whole
             // point of the retry command Cockpit printed, and the bypass is logged
             // rather than assumed.
@@ -46,7 +46,8 @@ export function partitionHeldEvidenceFiles(files, staging, now, mode) {
                 ? { artifact_metadata: file.artifact_metadata }
                 : {}),
             upload_state: "upload_failed",
-            reason: DELIVERY_BACKOFF_HOLDING_REASON,
+            reason: terminalDeliveryReason(hold.last_reason) ? hold.last_reason : DELIVERY_BACKOFF_HOLDING_REASON,
+            delivery_attempted: false,
             uploaded_chunk_count: 0,
         });
     }
@@ -103,7 +104,7 @@ export async function persistDeliveryAttempts(stateDir, staging, outcomes, attem
         const contentHash = outcome.pointer.content_hash_sha256;
         if (!contentHash)
             continue;
-        if (outcome.reason === DELIVERY_BACKOFF_HOLDING_REASON)
+        if (outcome.reason === DELIVERY_BACKOFF_HOLDING_REASON || outcome.delivery_attempted === false)
             continue;
         if (outcome.upload_state === "upload_failed") {
             const entry = recordDeliveryFailure(staging, contentHash, {

package/dist/upload-evidence-delivery-summary.js

@@ -1,5 +1,5 @@
 import { isPermanentUploadFailure } from "@bli-cockpit/telemetry-core";
-import { DELIVERY_BACKOFF_HOLDING_REASON, summarizeStuckEvidence, } from "./raw-evidence-staging.js";
+import { DELIVERY_BACKOFF_HOLDING_REASON, summarizeStuckEvidence, terminalDeliveryReason, } from "./raw-evidence-staging.js";
 /**
  * Which adapters a queued retry has to re-run.
  *
@@ -36,12 +36,12 @@ export function retrySourcesForFailedSync(options, facts) {
  */
 function retryableFailedOutcomes(outcomes) {
     return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
-        !isPermanentUploadFailure(outcome.reason));
+        !isPermanentUploadFailure(outcome.reason) && !terminalDeliveryReason(outcome.reason));
 }
 /** Failed uploads that no retry can rescue, kept so they can still be named. */
 function permanentFailedOutcomes(outcomes) {
     return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
-        isPermanentUploadFailure(outcome.reason));
+        (isPermanentUploadFailure(outcome.reason) || terminalDeliveryReason(outcome.reason)));
 }
 /**
  * The reason to show for objects that failed for good.
@@ -174,6 +174,7 @@ export function summarizeRawEvidenceDelivery(built, outcomes, uploadedChunkCount
         raw_evidence_uploaded_object_count: outcomes.filter((outcome) => outcome.upload_state === "uploaded").length,
         raw_evidence_uploaded_chunk_count: uploadedChunkCount,
         raw_evidence_reused_count: cursorReused.length + serverReusedCount,
+        reconciled_committed_by_409: outcomes.filter((outcome) => outcome.reason === "reconciled_committed_by_409").length,
         raw_evidence_failed_count: failed.length,
         raw_evidence_sanitized_count: built.raw_evidence_facts?.sanitized_count ?? 0,
         raw_evidence_failure_reasons: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.104",
+  "version": "0.2.108",
   "private": false,
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@bli-cockpit/memory-mcp": "0.1.27",
-    "@bli-cockpit/mcp": "0.1.34",
+    "@bli-cockpit/mcp": "0.1.36",
     "@bli-cockpit/telemetry-core": "0.1.43"
   }
 }