@bli-cockpit/cli 0.2.12 → 0.2.14

package/dist/autostart.js

@@ -270,6 +270,13 @@ async function windowsTaskStatus(options) {
         const queryMessage = `${query.stderr}\n${query.stdout}`;
         const taskIsKnownAbsent = query.code === 1 &&
             /cannot find|not found|does not exist/iu.test(queryMessage);
+        // Metadata only: schtasks stderr can carry the state directory, so the exit
+        // code and the classification travel, never the text.
+        console.error("[autostart] windows task query failed", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            exit_code: query.code,
+            status: taskIsKnownAbsent ? "absent" : "not_loaded",
+        }));
         return {
             status: taskIsKnownAbsent ? "absent" : "not_loaded",
             label: AUTOSTART_LABEL,
@@ -305,6 +312,23 @@ async function windowsTaskStatus(options) {
             registrationProblems.push("sync script does not match the current roots or Cockpit runtime");
         }
     }
+    // Both branches log. A line that only fires on failure cannot answer "did
+    // background collection validate at all today?", which is the question that
+    // would have caught a validator rejecting every healthy Windows task.
+    // Problem labels carry no paths, so they are safe to emit verbatim.
+    if (registrationProblems.length > 0) {
+        console.error("[autostart] windows task needs repair", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            problem_count: registrationProblems.length,
+            problems: registrationProblems,
+        }));
+    }
+    else {
+        console.error("[autostart] windows task validated", JSON.stringify({
+            task_name: WINDOWS_AUTOSTART_TASK_NAME,
+            interval_minutes: intervalMinutes,
+        }));
+    }
     return {
         status: registrationProblems.length > 0 ? "not_loaded" : "loaded",
         label: AUTOSTART_LABEL,
@@ -415,7 +439,7 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     const actionArguments = exactExecBlock
         .match(/<Arguments>\s*([^<]*?)\s*<\/Arguments>/iu)?.[1]
         ?.trim() ?? "";
-    const expectedActionArguments = `-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${expected.scriptPath}"`;
+    const expectedArgumentFlags = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File";
     const requirements = [
         [
             /<DisallowStartIfOnBatteries>\s*false\s*<\/DisallowStartIfOnBatteries>/iu,
@@ -444,8 +468,18 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
         if (!/<LogonType>\s*InteractiveToken\s*<\/LogonType>/iu.test(exactPrincipalBlock)) {
             problems.push("logon type is not InteractiveToken");
         }
-        if (!/<RunLevel>\s*LeastPrivilege\s*<\/RunLevel>/iu.test(exactPrincipalBlock)) {
-            problems.push("task does not run with limited privileges");
+        // Windows omits <RunLevel> entirely when a task runs at the default
+        // LeastPrivilege, so `schtasks /Create ... /RL LIMITED` stores a principal
+        // block with no RunLevel element at all. Demanding the element asks Windows
+        // to state a default it never states, which is why this check failed on
+        // every Windows machine in the fleet and passed on none (0 of 4
+        // autostart-alive events ok, 2026-08-12). Absent means LeastPrivilege; only
+        // an explicit elevated value is a real problem.
+        const runLevel = exactPrincipalBlock
+            .match(/<RunLevel>\s*([^<]*?)\s*<\/RunLevel>/iu)?.[1]
+            ?.trim() || "LeastPrivilege";
+        if (!/^LeastPrivilege$/iu.test(runLevel)) {
+            problems.push(`task does not run with limited privileges (RunLevel=${runLevel})`);
         }
     }
     if (actionContext && actionContext !== principalId) {
@@ -477,8 +511,9 @@ function windowsTaskRegistrationProblems(taskXml, expected) {
     if (!sameWindowsPath(command, expected.powershellPath)) {
         problems.push("task action does not run the expected Windows PowerShell");
     }
-    if (actionArguments !== expectedActionArguments) {
-        problems.push("task action arguments do not exactly run the Cockpit sync script");
+    const actionArgumentProblem = windowsActionArgumentProblem(actionArguments, expectedArgumentFlags, expected.scriptPath);
+    if (actionArgumentProblem) {
+        problems.push(actionArgumentProblem);
     }
     if (/<Duration>/iu.test(repetition)) {
         problems.push("repetition has a finite duration");
@@ -489,6 +524,38 @@ function windowsPowerShellPath(env = process.env) {
     const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
     return path.win32.join(windowsRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
+/**
+ * Task Scheduler stores a normalized form of the action it was given, not the
+ * string we passed: `schtasks /Create /TR "<powershell> <args>"` is split into
+ * <Command> plus <Arguments>, and the quotes around a space-free script path
+ * are dropped. Comparing <Arguments> against the exact string we built
+ * therefore fails on a task that is registered perfectly — observed on
+ * DESKTOP-G2UO1GK (CLI 0.2.13, 2026-08-12), where the stored value differed
+ * from the expected one only by those quotes.
+ *
+ * Compare the flags exactly, because those are ours, and compare the script as
+ * a path, because that is what Windows normalizes. Each failure returns its own
+ * reason so a repair message says which half is wrong rather than "arguments
+ * differ".
+ */
+function windowsActionArgumentProblem(actionArguments, expectedFlags, expectedScriptPath) {
+    if (!actionArguments.startsWith(expectedFlags)) {
+        return "task action does not run PowerShell with the expected Cockpit sync flags";
+    }
+    const scriptArgument = unquoteWindowsArgument(actionArguments.slice(expectedFlags.length));
+    if (!scriptArgument) {
+        return "task action names no sync script to run";
+    }
+    if (!sameWindowsPath(scriptArgument, expectedScriptPath)) {
+        return "task action runs a script other than the Cockpit sync script";
+    }
+    return null;
+}
+function unquoteWindowsArgument(value) {
+    const trimmed = value.trim();
+    const quoted = trimmed.match(/^"([\s\S]*)"$/u) ?? trimmed.match(/^'([\s\S]*)'$/u);
+    return (quoted?.[1] ?? trimmed).trim();
+}
 function sameWindowsPath(left, right) {
     if (!left || !right)
         return false;

package/dist/commands/backfill.js

@@ -1,4 +1,4 @@
-import { containsSecretLikeContent, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
+import { containsSecretLikeContent, NO_UPLOAD_ATTEMPT_RECORDED, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
@@ -1081,11 +1081,14 @@ async function syncBackfillBatch(options) {
 }
 function buildBackfillSessionReport(options) {
     const uploadByKey = new Map();
+    // BLI-2107: an outcome that names a failure but has no pointer used to be
+    // dropped on the floor here, taking its reason with it.
+    const noUploadReasonBySessionId = new Map();
     for (const sync of options.syncResults) {
         if (sync.status !== "uploaded")
             continue;
         for (const outcome of sync.raw_evidence_outcomes) {
-            if (!outcome.codex_session_id || !outcome.raw_evidence_pointer_id)
+            if (!outcome.codex_session_id)
                 continue;
             const source = outcome.kind === "claude_jsonl"
                 ? "claude_code"
@@ -1094,9 +1097,16 @@ function buildBackfillSessionReport(options) {
                     : null;
             if (!source)
                 continue;
+            if (!outcome.raw_evidence_pointer_id) {
+                if (outcome.reason) {
+                    noUploadReasonBySessionId.set(outcome.codex_session_id, outcome.reason);
+                }
+                continue;
+            }
             uploadByKey.set(`${source}:${outcome.codex_session_id}`, {
                 upload_state: outcome.upload_state,
                 raw_evidence_pointer_id: outcome.raw_evidence_pointer_id,
+                reason: outcome.reason,
             });
         }
     }
@@ -1143,9 +1153,19 @@ function buildBackfillSessionReport(options) {
                 ? {
                     raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
                     upload_state: upload.upload_state,
+                    ...(upload.upload_state === "upload_failed"
+                        ? { upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED }
+                        : {}),
                 }
                 : isRawEvidenceUploadableAttributionState(candidate.state)
-                    ? { upload_state: "not_uploaded" }
+                    ? {
+                        upload_state: "not_uploaded",
+                        // BLI-2107: same rule as live sync — an attributed session with
+                        // no pointer always says why, even when the answer is that this
+                        // path never recorded one.
+                        upload_reason: noUploadReasonBySessionId.get(candidate.session_id) ??
+                            NO_UPLOAD_ATTEMPT_RECORDED,
+                    }
                     : {}),
         };
     });

package/dist/commands/local.js

@@ -2215,13 +2215,25 @@ async function runSyncWithHealthReceipt(command, io) {
         };
     }
     try {
-        const exitCode = await runSyncLocked(command, io);
+        const { exitCode, failureReasons } = await runSyncLocked(command, io);
+        if (exitCode === 0) {
+            return {
+                exitCode,
+                completion: { step: "sync_complete", status: "ok" },
+            };
+        }
+        // A sync that fails by exit code says exactly as much as one that throws.
+        // It used to say `sync_failed` and nothing else, so 100% of recorded
+        // failure rows carried a null detail and the real reason was reachable only
+        // by running `cockpit status` on the machine itself (BLI-2526).
+        const reasonText = failureReasons.join("; ");
         return {
             exitCode,
             completion: {
                 step: "sync_complete",
-                status: exitCode === 0 ? "ok" : "fail",
-                ...(exitCode === 0 ? {} : { error_code: "sync_failed" }),
+                status: "fail",
+                error_code: classifySyncHealthError(reasonText),
+                error_detail: redactedSyncErrorDetail(reasonText),
             },
         };
     }
@@ -2264,6 +2276,19 @@ export function redactedSyncErrorDetail(error) {
         ? `${text.slice(0, SYNC_ERROR_DETAIL_MAX_CHARS - 1)}…`
         : text;
 }
+/**
+ * Turn a finished run into an exit code and the reasons behind it.
+ *
+ * One place, so a future return path cannot reintroduce a code with no reason.
+ * The reasons come from the run itself — the code that decided `ok` is false is
+ * the only code that knows why.
+ */
+function syncResult(run) {
+    return {
+        exitCode: run.ok ? 0 : 1,
+        failureReasons: run.ok ? [] : run.failure_reasons,
+    };
+}
 async function runSyncLocked(command, io) {
     const collectionRoots = await resolveSyncCollectionRoots(command);
     const worktrees = await discoverCommandWorktrees(collectionRoots, {
@@ -2294,7 +2319,7 @@ async function runSyncLocked(command, io) {
                 codex_sessions: run.summary,
                 raw_evidence_gc: gc,
             }, null, 2));
-            return run.ok ? 0 : 1;
+            return syncResult(run);
         }
         writeLine(run.ok ? io.stdout : io.stderr, `Cockpit parent sync ${runStatus} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
         for (const outcome of run.outcomes) {
@@ -2306,7 +2331,7 @@ async function runSyncLocked(command, io) {
         writeAgentSessionSummary(io, run.summary);
         if (gc && !gc.skipped)
             writeLine(io.stdout, rawEvidenceGcSummary(gc));
-        return run.ok ? 0 : 1;
+        return syncResult(run);
     }
     const result = run.outcomes[0]?.sync;
     if (!result) {
@@ -2322,7 +2347,7 @@ async function runSyncLocked(command, io) {
             codex_sessions: run.summary,
             raw_evidence_gc: gc,
         }, null, 2));
-        return run.ok ? 0 : 1;
+        return syncResult(run);
     }
     if (run.ok) {
         writeLine(io.stdout, "Cockpit ambient envelope uploaded.");
@@ -2337,18 +2362,18 @@ async function runSyncLocked(command, io) {
         writeLine(io.stdout, cursorStatusLine(result));
         if (gc && !gc.skipped)
             writeLine(io.stdout, rawEvidenceGcSummary(gc));
-        return 0;
+        return syncResult(run);
     }
     if (result.status === "uploaded") {
         writeLine(io.stderr, "Cockpit ambient upload was accepted, but session collection is partial; retry `cockpit sync`.");
         writeAgentSessionSummary(io, run.summary);
-        return 1;
+        return syncResult(run);
     }
     writeLine(io.stderr, "Cockpit ambient upload failed; safe retry metadata was spooled.");
     writeLine(io.stderr, `Ticket: ${displayTicketId(result.ticket_id)}`);
     writeLine(io.stderr, `Failure: ${result.failure_reason}`);
     writeLine(io.stderr, `Retry: ${result.retry_command}`);
-    return 1;
+    return syncResult(run);
 }
 async function resolveSyncCollectionRoots(command) {
     const explicitRoots = normalizeCollectionRoots(command.repoRoot ? [command.repoRoot] : []);

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.12");
+    writeLine(io?.stdout ?? process.stdout, "0.2.14");
     return 0;
   }
 

package/dist/commands/session-sync.js

@@ -6,7 +6,7 @@
 import os from "node:os";
 import path from "node:path";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, startLocalWorkContext, startLocalWorkContextForAttributedTarget, } from "../local-state.js";
-import { CODEX_SESSION_ATTRIBUTION_STATE_RANK, } from "@bli-cockpit/telemetry-core";
+import { CODEX_SESSION_ATTRIBUTION_STATE_RANK, NO_UPLOAD_ATTEMPT_RECORDED, } from "@bli-cockpit/telemetry-core";
 import { flushPendingCodexSessionReports, LocalUploadBlockedError, queueCodexSessionReport, syncLocalAmbientEnvelope, } from "../upload.js";
 import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
@@ -15,6 +15,14 @@ import { CLAUDE_CURSOR_FILENAME, countStaleSessions, emptyRawEvidenceCursorState
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { clearSourceRetryFailure, readLocalUploadSpoolState, recordSourceRetryFailure, } from "../spool/local-spool.js";
 import { isLiveRawEvidenceSyncAttribution, } from "../raw-evidence-attribution-policy.js";
+/**
+ * The label used when a sync fails and nothing on the way there said why.
+ *
+ * A deliberate sentinel rather than a fallback to `sync_failed`: it means the
+ * gate is real but its reason is unrecorded, which is a bug in this file, and
+ * it should be visible as one instead of blending into the generic bucket.
+ */
+export const SYNC_FAILED_WITHOUT_REASON = "sync_failed_reason_not_recorded";
 const CLAUDE_FIRST_RUN_BACKFILL_MINUTES = 14 * 24 * 60;
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
@@ -414,20 +422,56 @@ export async function runAttributedWorktreeSync(options) {
         growthDamped: dampedClaudePointers.size,
         report,
     });
-    ok =
-        ok &&
-            !codexAttribution.session_limit_applied &&
-            !claudeAttribution.session_limit_applied &&
-            outcomes.every(({ sync }) => sync.raw_evidence_failed_count === 0 &&
-                !sync.raw_evidence_retry_required &&
-                sync.raw_evidence_deferred_byte_budget === 0 &&
-                sync.raw_evidence_deferred_object_budget === 0) &&
-            codexAttributionReadFailureCount(codexAttribution) === 0 &&
-            claudeAttributionReadFailureCount(claudeAttribution) === 0 &&
-            sourceScanRetryReason("codex", codexAttribution) === null &&
-            sourceScanRetryReason("claude_code", claudeAttribution) === null &&
-            (!reportRequired || report.posted);
-    return { ok, outcomes, codexAttribution, claudeAttribution, summary };
+    // Same conditions as before, one per line, each writing down its own reason.
+    // The old version was a single boolean chain: correct, and completely mute.
+    const failureReasons = new Set();
+    const fail = (condition, reason) => {
+        if (condition)
+            failureReasons.add(reason);
+    };
+    for (const { worktree, sync } of outcomes) {
+        if (sync.status !== "uploaded") {
+            // The spooled reason is the most specific thing anyone has, so lead with
+            // it and name the worktree it belongs to — a fleet failure is usually one
+            // repo, and "which one" is the first question asked.
+            failureReasons.add(sync.status === "spooled" && sync.failure_reason
+                ? `${worktree.worktree_label}:${sync.failure_reason}`
+                : `${worktree.worktree_label}:upload_${sync.status}`);
+        }
+        for (const reason of sync.raw_evidence_failure_reasons ?? []) {
+            failureReasons.add(`raw_evidence:${reason}`);
+        }
+        for (const reason of sync.raw_evidence_retry_reasons ?? []) {
+            failureReasons.add(`raw_evidence_retry:${reason}`);
+        }
+        fail(sync.raw_evidence_deferred_byte_budget > 0, "deferred_byte_budget");
+        fail(sync.raw_evidence_deferred_object_budget > 0, "deferred_object_budget");
+    }
+    fail(codexAttribution.session_limit_applied, "codex_session_limit_applied");
+    fail(claudeAttribution.session_limit_applied, "claude_session_limit_applied");
+    fail(codexAttributionReadFailureCount(codexAttribution) > 0, "codex_session_read_failed");
+    fail(claudeAttributionReadFailureCount(claudeAttribution) > 0, "claude_session_read_failed");
+    const codexScanRetry = sourceScanRetryReason("codex", codexAttribution);
+    if (codexScanRetry)
+        failureReasons.add(`codex_scan:${codexScanRetry}`);
+    const claudeScanRetry = sourceScanRetryReason("claude_code", claudeAttribution);
+    if (claudeScanRetry)
+        failureReasons.add(`claude_scan:${claudeScanRetry}`);
+    fail(reportRequired && !report.posted, `session_report_unposted:${report.reason ?? "unknown"}`);
+    // `ok` may already be false from the per-worktree loop above; the outcome
+    // scan re-derives that, so the two agree by construction.
+    ok = ok && failureReasons.size === 0;
+    if (!ok && failureReasons.size === 0) {
+        failureReasons.add(SYNC_FAILED_WITHOUT_REASON);
+    }
+    return {
+        ok,
+        failure_reasons: [...failureReasons].sort(),
+        outcomes,
+        codexAttribution,
+        claudeAttribution,
+        summary,
+    };
 }
 export const ATTRIBUTION_STATE_RANK = CODEX_SESSION_ATTRIBUTION_STATE_RANK;
 function normalizeCodexResult(result) {
@@ -474,7 +518,7 @@ function normalizeClaudeResult(result) {
  * session's upload state (D3). Damped Claude sessions report `reused_existing`
  * carrying their prior durable pointer.
  */
-function buildAgentSessionReport(options) {
+export function buildAgentSessionReport(options) {
     const normalized = [
         ...options.codexResults.map(normalizeCodexResult),
         ...options.claudeResults.map(normalizeClaudeResult),
@@ -495,11 +539,23 @@ function buildAgentSessionReport(options) {
     // Main-file outcomes only (D3): a sidecar making it must never mark a session
     // uploaded when the main did not.
     const uploadByKey = new Map();
+    // BLI-2107: why a session got no pointer, keyed the same way. The reasons
+    // already existed — file_too_large, deferred_byte_budget, the redaction
+    // guards — but only as aggregate skip counts in the health report, so no
+    // individual session could say what happened to it.
+    const noUploadReasonByKey = new Map();
+    // A worktree sync that did not finish carries no per-session outcomes, and
+    // WorktreeSyncOutcome does not record which sessions it was going to cover.
+    // So this pass knows only that it was degraded, not which session each
+    // failure belonged to — and says exactly that rather than picking one.
+    let anySyncIncomplete = false;
     for (const outcome of options.outcomes) {
-        if (outcome.sync.status !== "uploaded")
+        if (outcome.sync.status !== "uploaded") {
+            anySyncIncomplete = true;
             continue;
+        }
         for (const upload of outcome.sync.raw_evidence_outcomes) {
-            if (!upload.codex_session_id || !upload.raw_evidence_pointer_id)
+            if (!upload.codex_session_id)
                 continue;
             const source = upload.kind === "claude_jsonl"
                 ? "claude_code"
@@ -508,7 +564,15 @@ function buildAgentSessionReport(options) {
                     : null;
             if (!source)
                 continue; // sidecars and other kinds do not set session state
-            uploadByKey.set(`${source}:${upload.codex_session_id}`, upload);
+            const key = `${source}:${upload.codex_session_id}`;
+            if (!upload.raw_evidence_pointer_id) {
+                // An outcome with no pointer is a failure that named itself. Keep the
+                // reason even though there is nothing to point at.
+                if (upload.reason)
+                    noUploadReasonByKey.set(key, upload.reason);
+                continue;
+            }
+            uploadByKey.set(key, upload);
         }
     }
     return [...bestByKey.values()].map((result) => {
@@ -548,6 +612,13 @@ function buildAgentSessionReport(options) {
                 ? {
                     raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
                     upload_state: upload.upload_state,
+                    // A failed upload names itself; a successful one has nothing to
+                    // explain.
+                    ...(upload.upload_state === "upload_failed"
+                        ? {
+                            upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED,
+                        }
+                        : {}),
                 }
                 : priorDurablePointer
                     ? {
@@ -556,7 +627,19 @@ function buildAgentSessionReport(options) {
                     }
                     : result.state === "attributed" ||
                         result.state === "attributed_fallback"
-                        ? { upload_state: "not_uploaded" }
+                        ? {
+                            upload_state: "not_uploaded",
+                            // BLI-2107: `not_uploaded` used to be the branch of last
+                            // resort, recording that nothing happened and never why. It
+                            // now always carries a cause, even when the cause is that we
+                            // have none — a session labelled NO_UPLOAD_ATTEMPT_RECORDED
+                            // is a path that still needs instrumenting, and saying so is
+                            // the point.
+                            upload_reason: noUploadReasonByKey.get(key) ??
+                                (anySyncIncomplete
+                                    ? "sync_incomplete_this_pass"
+                                    : NO_UPLOAD_ATTEMPT_RECORDED),
+                        }
                         : {}),
         };
     });

package/dist/evidence-upload-client.js

@@ -1,4 +1,4 @@
-import { RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, } from "@bli-cockpit/telemetry-core";
+import { RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 const DEFAULT_MAX_ATTEMPTS = 3;
@@ -214,6 +214,14 @@ async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
         object_key: objectKey,
     });
     if (!commit.ok) {
+        // The server can tell us this object will be refused again. Take its reason
+        // verbatim so the label names the cause ("storage rejected 116 MB") instead
+        // of the transport ("commit_failed_http_500"), which is all the fleet could
+        // say for the 57 days of BLI-2528.
+        const permanent = permanentCommitRejection(commit.body);
+        if (permanent) {
+            return failedOutcome(entry.file, permanent, uploadedChunks);
+        }
         const detail = safeFailureDetail(commit.body);
         return failedOutcome(entry.file, `commit_failed_http_${commit.status}${detail ? `_${detail}` : ""}`, uploadedChunks);
     }
@@ -376,6 +384,24 @@ function failedOutcome(file, reason, uploadedChunks = 0) {
         uploaded_chunk_count: uploadedChunks,
     };
 }
+/**
+ * The server's verdict that repeating this commit is pointless, or null.
+ *
+ * Two conditions, both required: the response says `retryable: false`, and the
+ * reason is one this collector has classified as permanent. The second check is
+ * the important one. A newer dashboard could declare a reason this CLI has never
+ * heard of, and quietly abandoning an object on a word we cannot interpret is
+ * exactly the silent drop the fleet contract forbids — so an unclassified reason
+ * falls through to the ordinary retry path and stays visible.
+ */
+function permanentCommitRejection(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    if (body.retryable !== false)
+        return null;
+    const reason = safeFailureDetail(body);
+    return reason && isPermanentUploadFailure(reason) ? reason : null;
+}
 function safeFailureDetail(body) {
     if (!body || typeof body !== "object")
         return null;

package/dist/upload.js

@@ -1,4 +1,4 @@
-import { AgentImageArtifactReportRequestSchema, CODEX_SESSION_REPORT_MAX_SESSIONS, CodexSessionAttributionReportResponseSchema, EvidenceCompletenessPayloadSchema, TelemetryIngestEnvelopeSchema, TelemetryIngestEventDtoSchema, } from "@bli-cockpit/telemetry-core";
+import { AgentImageArtifactReportRequestSchema, CODEX_SESSION_REPORT_MAX_SESSIONS, CodexSessionAttributionReportResponseSchema, EvidenceCompletenessPayloadSchema, TelemetryIngestEnvelopeSchema, TelemetryIngestEventDtoSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import path from "node:path";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
 import { runLocalSourceCollectors } from "./adapters/local-sources.js";
@@ -236,6 +236,27 @@ export async function syncLocalAmbientEnvelope(options = {}) {
                 retry_command: "cockpit sync",
             });
         }
+        else {
+            // No retry to queue, but a permanently rejected object still has to say
+            // so. `recordUploadBlocked` names the reason without spooling a retry —
+            // the machine reports the failure instead of promising a fix it cannot
+            // deliver, and `cockpit status` stops reading clean.
+            const permanentReason = permanentEvidenceFailureReason(uploadOutcomes);
+            if (permanentReason) {
+                await recordUploadBlocked(paths, {
+                    attemptedAt,
+                    reason: permanentReason,
+                });
+                // stderr, which launchd captures to `sync.err.log`, so an unattended
+                // machine leaves a dated record of the objects it gave up on. Reason
+                // labels and counts only — never a path or a byte of content.
+                console.error("[cockpit-sync] raw evidence permanently rejected", JSON.stringify({
+                    attempted_at: attemptedAt,
+                    reason: permanentReason,
+                    object_count: permanentFailedOutcomes(uploadOutcomes).length,
+                }));
+            }
+        }
         return {
             status: "uploaded",
             dashboard_url: built.dashboard_url,
@@ -307,8 +328,37 @@ function retrySourcesForFailedSync(options, facts) {
     }
     return [...sources];
 }
+/**
+ * The failed uploads a later attempt could still rescue.
+ *
+ * An object storage has already refused on its own terms is not one of them,
+ * and counting it as one is what kept Edward's Mac in `retry_pending` through
+ * 13 consecutive syncs that were never going to end differently (BLI-2528).
+ */
+function retryableFailedOutcomes(outcomes) {
+    return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
+        !isPermanentUploadFailure(outcome.reason));
+}
+/** Failed uploads that no retry can rescue, kept so they can still be named. */
+function permanentFailedOutcomes(outcomes) {
+    return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
+        isPermanentUploadFailure(outcome.reason));
+}
+/**
+ * The reason to show for objects that failed for good.
+ *
+ * Returns null when there are none. These never queue a retry, but they must
+ * never disappear either: a machine with a permanently rejected object has
+ * missing collection, and a status that reads clean would hide it.
+ */
+function permanentEvidenceFailureReason(outcomes) {
+    const reasons = new Set(permanentFailedOutcomes(outcomes).map((outcome) => outcome.reason ?? "unknown"));
+    if (reasons.size === 0)
+        return null;
+    return `raw_evidence_permanently_rejected:${[...reasons].sort().join(",")}`;
+}
 function hasRetryableEvidenceGap(facts, outcomes) {
-    if (outcomes.some((outcome) => outcome.upload_state === "upload_failed")) {
+    if (retryableFailedOutcomes(outcomes).length > 0) {
         return true;
     }
     if (!facts)
@@ -326,10 +376,8 @@ function hasRetryableEvidenceGap(facts, outcomes) {
 }
 function retryableEvidenceGapReason(facts, outcomes) {
     const reasons = new Set();
-    for (const outcome of outcomes) {
-        if (outcome.upload_state === "upload_failed") {
-            reasons.add(outcome.reason ?? "upload_failed");
-        }
+    for (const outcome of retryableFailedOutcomes(outcomes)) {
+        reasons.add(outcome.reason ?? "upload_failed");
     }
     if (facts) {
         if (facts.deferred_byte_budget_count > 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "private": false,
   "type": "module",
   "bin": {
@@ -26,6 +26,6 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/telemetry-core": "0.1.16"
+    "@bli-cockpit/telemetry-core": "0.1.17"
   }
 }