@bli-cockpit/cli 0.2.150 → 0.2.155

package/dist/commands/clean.js

@@ -1,16 +1,19 @@
 /**
  * `cockpit clean` — what this machine is holding, why, and what goes.
  *
- * BLI-3619. The tick prunes on its own once a day; this is the door a person
- * opens when a laptop is full now. It prints the same buckets the retention
- * rule reasons in, one line each with its reason, and only then deletes:
+ * BLI-3619 / BLI-11106. The sync tick prunes on its own, every tick, and a
+ * staged copy goes the tick its commit is acknowledged; nobody should need
+ * this door. It is here for "show me" and for a machine that has been off.
+ * It prints the same buckets the retention rule reasons in, one line each with
+ * its reason, and only then deletes:
  *
- *   committed, past the 48 h retry window   goes
- *   committed, still inside the window      kept — unless the cap needs it
+ *   committed on the server                 goes
+ *   committed, inside an opted-in window    kept — unless the cap needs it
+ *                                           (only when COCKPIT_STAGING_RETENTION_HOURS is set)
  *   uncommitted                             kept, always, and named
  *   the ledger cannot say                   kept, always, and named apart
  *
- * `--dry-run` stops after the printing. `--all-committed` drops the retry
+ * `--dry-run` stops after the printing. `--all-committed` drops any opted-in
  * window — every committed spare goes now — and is also the only thing that
  * removes a `manual-study-evidence-vault-*` directory, and then only when every
  * object inside it is committed. Nothing here can delete evidence the upload
@@ -31,12 +34,13 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { writeLine } from "./cli-io.js";
+import { footprintLine } from "./doctor-disk-words.js";
 import { planFromDisk, runStagingPrune } from "../disk-prune.js";
 import { MANUAL_VAULT_PREFIX, readDiskFootprint, } from "../disk-usage.js";
 import { readRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
 import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
-import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { DEFAULT_LOG_ROTATION_KEEP, orphanedLogArchives, rotateCollectorLogsBestEffort, } from "../log-rotation.js";
 export async function runClean(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
     const now = new Date();
@@ -53,8 +57,9 @@ export async function runClean(command, io) {
     const vaults = command.allCommitted
         ? await vaultsSafeToRemove(paths, footprint.vaults)
         : [];
+    const logArchives = await orphanedLogArchives(paths);
     if (!command.json) {
-        for (const line of cleanLines(footprint, plan, vaults, command)) {
+        for (const line of cleanLines(footprint, plan, vaults, command, logArchives)) {
             writeLine(io.stdout, line);
         }
     }
@@ -67,7 +72,6 @@ export async function runClean(command, io) {
     const pruned = await runStagingPrune(paths, {
         env,
         now,
-        force: true,
         allCommitted: command.allCommitted,
         reclaimTerminal: true,
     });
@@ -86,20 +90,32 @@ export async function runClean(command, io) {
     return pruned.status === "fail" ? 1 : 0;
 }
 /** The bucket table a person reads before anything is deleted. */
-export function cleanLines(footprint, plan, vaults, command) {
+export function cleanLines(footprint, plan, vaults, command, logArchives = []) {
     const staging = footprint.staging;
     const lines = [
         command.dryRun ? "Tower clean (dry run)" : "Tower clean",
         `  staging          ${mb(staging.total_bytes)} MB across ${staging.pack_count} pack(s), ${staging.object_count} file(s)`,
         `  going            ${mb(plan.deleted_bytes + plan.empty_pack_manifest_bytes)} MB, ${plan.delete.length} file(s) — ${command.allCommitted
             ? "every committed copy (--all-committed)"
-            : `committed and past the ${Math.round(plan.retention_ms / 3_600_000)} h retry window`}`,
-        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, still inside the retry window`,
+            : plan.retention_ms > 0
+                ? `committed and past the opted-in ${Math.round(plan.retention_ms / 3_600_000)} h window`
+                : "committed on the server; the source file is still on disk for any retry"}`,
+        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, inside an opted-in retry window (none by default)`,
         `  kept uncommitted ${mb(plan.kept_uncommitted.bytes)} MB, ${plan.kept_uncommitted.count} file(s) — never delivered; retention will never delete these`,
         `  kept unknown     ${mb(plan.kept_unknown.bytes)} MB, ${plan.kept_unknown.count} file(s) — the upload ledger no longer reaches back this far and cannot say`,
-        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))`,
+        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))${logArchives.length > 0
+            ? `; ${logArchives.length} archive(s), ${mb(logArchives.reduce((sum, archive) => sum + archive.byte_size, 0))} MB, sit outside the ${DEFAULT_LOG_ROTATION_KEEP}-archive keep window and go`
+            : ""}`,
         `  spool            ${mb(footprint.spool_bytes)} MB`,
+        `  state files      ${mb(footprint.state.state_bytes)} MB — cursors, indexes and receipts, each bounded`,
     ];
+    if (footprint.state.other_bytes > 0) {
+        lines.push(`  unrecognised     ${mb(footprint.state.other_bytes)} MB across ${footprint.state.other_entries} entr(ies) — counted, never deleted by clean`);
+    }
+    if (footprint.state.study_entries > 0) {
+        lines.push(`  studies          ${footprint.state.study_entries} folder(s) an agent left here — not the collector's, not counted, never touched; new ones go in bli-cockpit-studies`);
+    }
+    lines.push(`  ${footprintLine(footprint)}`);
     for (const vault of footprint.vaults) {
         const removable = vaults.some((entry) => entry.name === vault.name);
         lines.push(`  ${vault.name} ${mb(vault.byte_size)} MB, ${vault.file_count} file(s) — ${removable
@@ -158,6 +174,8 @@ function cleanJson(footprint, plan, vaults, pruned, reconciled = null) {
         },
         rotated_log_bytes: footprint.logs.total_bytes,
         spool_bytes: footprint.spool_bytes,
+        state: footprint.state,
+        last_prune: footprint.last_prune,
         vaults: footprint.vaults,
         plan: {
             delete_count: plan.delete.length,

package/dist/commands/doctor-budget.js

@@ -0,0 +1,69 @@
+/**
+ * BLI-11101: `cockpit doctor --json` answers within one bounded budget.
+ *
+ * A person at a terminal gets the long defaults (a 900-second catch-up and a
+ * 600-second wait for the collection lock) with progress every 30 seconds. An
+ * agent or script calling `--json` gets one answer: on Edward's Mac the long
+ * defaults ran past 9.5 minutes behind the 15-minute scheduled sync, and a
+ * caller that times out learns nothing. So `--json` without `--lock-wait` or
+ * `--backfill-budget` runs every repair under one deadline measured from the
+ * start of the run, and a repair that does not fit says so by name instead of
+ * queueing. Passing either flag opts back into the long run.
+ */
+export const DOCTOR_JSON_BUDGET_SECONDS = 45;
+export const DEFAULT_LOCK_WAIT_SECONDS = 600;
+export const DEFAULT_BACKFILL_BUDGET_SECONDS = 900;
+/** A repair that execs a whole sync or catch-up chunk is not started with less than this left. */
+export const SLOW_FIX_MIN_SECONDS = {
+    "backfill-complete": 10,
+    "sync-fresh": 15,
+};
+/** The run deadline in epoch ms, or `null` when the caller gets the long defaults. */
+export function doctorRunDeadline(command, startedMs) {
+    if (!command.json)
+        return null;
+    if (command.lockWaitSeconds !== undefined || command.backfillBudgetSeconds !== undefined)
+        return null;
+    return startedMs + DOCTOR_JSON_BUDGET_SECONDS * 1000;
+}
+function remainingSeconds(context, now) {
+    if (context.deadlineMs === undefined || context.deadlineMs === null)
+        return null;
+    return Math.max(0, (context.deadlineMs - now) / 1000);
+}
+/** How long a repair may wait for the collection lock. */
+export function doctorLockWaitSeconds(context, now = Date.now()) {
+    if (context.command.lockWaitSeconds !== undefined)
+        return context.command.lockWaitSeconds;
+    const remaining = remainingSeconds(context, now);
+    return remaining === null ? DEFAULT_LOCK_WAIT_SECONDS : Math.min(DEFAULT_LOCK_WAIT_SECONDS, remaining);
+}
+/** How long the catch-up repair may run, lock waiting included. */
+export function doctorBackfillBudgetSeconds(context, now = Date.now()) {
+    if (context.command.backfillBudgetSeconds !== undefined)
+        return context.command.backfillBudgetSeconds;
+    const remaining = remainingSeconds(context, now);
+    return remaining === null ? DEFAULT_BACKFILL_BUDGET_SECONDS : Math.min(DEFAULT_BACKFILL_BUDGET_SECONDS, remaining);
+}
+/**
+ * The row a slow repair returns instead of starting when the run budget cannot
+ * hold it; `null` means go ahead. Logged either way the budget decides.
+ */
+export function budgetSpentRow(context, row, now = Date.now()) {
+    const floor = SLOW_FIX_MIN_SECONDS[row.id];
+    const remaining = remainingSeconds(context, now);
+    if (floor === undefined || remaining === null)
+        return null;
+    if (remaining >= floor) {
+        console.error("[doctor] repair fits the json budget", JSON.stringify({ row: row.id, remaining_seconds: Math.floor(remaining), floor_seconds: floor }));
+        return null;
+    }
+    console.error("[doctor] repair skipped, json budget spent", JSON.stringify({ reason: "doctor_budget_spent", row: row.id, remaining_seconds: Math.floor(remaining), floor_seconds: floor, budget_seconds: DOCTOR_JSON_BUDGET_SECONDS }));
+    return {
+        ...row,
+        status: "needs_fix",
+        code: "doctor_budget_spent",
+        nextAction: "cockpit doctor",
+        message: `\`cockpit doctor --json\` answers within ${DOCTOR_JSON_BUDGET_SECONDS}s and this repair needs at least ${floor}s; ${Math.floor(remaining)}s were left (was: ${row.code}). Run \`cockpit doctor\` to let it finish.`,
+    };
+}

package/dist/commands/doctor-disk-words.js

@@ -28,9 +28,85 @@ export function redeliveryLine(result) {
     }
     return "the next `cockpit sync` re-offers them";
 }
+/**
+ * Over this, the whole collector footprint is a needs-fix row (BLI-11106).
+ * Delete-on-commit plus the 256 MiB staging cap and the log caps put a healthy
+ * machine far under it; crossing it means something is holding bytes, and the
+ * row names what.
+ */
+export const FOOTPRINT_NEEDS_FIX_BYTES = 512 * 1024 * 1024;
+/**
+ * Every bucket the collector owns, biggest first. Study folders an agent left
+ * under the state dir are not here: they are not the collector's, and no
+ * prune would ever explain them (they belong in `bli-cockpit-studies`).
+ */
+export function footprintBuckets(footprint) {
+    const staging = footprint.staging;
+    const buckets = [
+        { label: "staging, committed (goes on the next tick)", bytes: staging.committed_bytes },
+        {
+            label: "staging, uncommitted (evidence the server has not accepted yet)",
+            bytes: staging.uncommitted_bytes + staging.unknown_bytes,
+        },
+        { label: "staging, refused by the server", bytes: staging.terminal_bytes ?? 0 },
+        { label: "staging, pack manifests", bytes: stagingOverheadBytes(footprint) },
+        { label: "sync logs", bytes: footprint.logs.total_bytes },
+        { label: "collector state files", bytes: footprint.state.state_bytes },
+        { label: "upload spool", bytes: footprint.spool_bytes },
+        { label: "unrecognised files in the state dir", bytes: footprint.state.other_bytes },
+    ];
+    return buckets.filter((bucket) => bucket.bytes > 0).sort((a, b) => b.bytes - a.bytes);
+}
+export function footprintTotalBytes(footprint) {
+    return footprintBuckets(footprint).reduce((sum, bucket) => sum + bucket.bytes, 0);
+}
+/**
+ * The one footprint line doctor and status both print: staging committed /
+ * uncommitted, logs, state, and when the prune last ran and what it freed.
+ */
+export function footprintLine(footprint) {
+    const staging = footprint.staging;
+    const parts = [
+        `footprint ${mib(footprintTotalBytes(footprint))} MB`,
+        `staging ${mib(staging.committed_bytes)} MB committed / ${mib(staging.uncommitted_bytes + staging.unknown_bytes)} MB uncommitted`,
+        `logs ${mib(footprint.logs.total_bytes)} MB`,
+        `state ${mib(footprint.state.state_bytes + footprint.spool_bytes)} MB`,
+    ];
+    if (footprint.state.other_bytes > 0) {
+        parts.push(`unrecognised ${mib(footprint.state.other_bytes)} MB`);
+    }
+    parts.push(lastPrunePhrase(footprint));
+    return parts.join(", ");
+}
+/** `last prune: <when>, freed <n> MB`, plus the last time it freed anything. */
+export function lastPrunePhrase(footprint) {
+    const last = footprint.last_prune;
+    if (!last)
+        return "last prune: never";
+    const base = `last prune: ${minute(last.at)}, freed ${mib(last.freed_bytes)} MB`;
+    if (last.freed_bytes > 0 || !last.last_freed_at)
+        return base;
+    return `${base} (last freed ${mib(last.last_freed_bytes)} MB at ${minute(last.last_freed_at)})`;
+}
+/** The biggest bucket, named, for the needs-fix sentence; null when empty. */
+export function footprintHolder(footprint) {
+    return footprintBuckets(footprint)[0] ?? null;
+}
+function stagingOverheadBytes(footprint) {
+    const staging = footprint.staging;
+    const payload = staging.committed_bytes +
+        staging.uncommitted_bytes +
+        staging.unknown_bytes +
+        (staging.terminal_bytes ?? 0);
+    return Math.max(0, staging.total_bytes - payload);
+}
+function minute(iso) {
+    return iso.length >= 16 ? `${iso.slice(0, 16)}Z` : iso;
+}
 export function diskRowMessage(footprint, capBytes) {
     const staging = footprint.staging;
     const parts = [
+        footprintLine(footprint),
         `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
     ];
     // BLI-3797: "1,916.9 uncommitted" is a number, not a finding. The row now
@@ -51,9 +127,11 @@ export function diskRowMessage(footprint, capBytes) {
     if (staging.unknown_count > 0) {
         parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
     }
-    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
-    for (const vault of footprint.vaults) {
-        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
+    // BLI-11106: study folders an agent left under the state dir are named as a
+    // count, never sized or added to the footprint. They are not the
+    // collector's, and new ones belong in the sibling `bli-cockpit-studies`.
+    if (footprint.state.study_entries > 0) {
+        parts.push(`${footprint.state.study_entries} study folder(s) under the state dir are not counted (new studies go in bli-cockpit-studies beside it)`);
     }
     return parts.join("; ");
 }

package/dist/commands/doctor-lock-wait.js

@@ -1,12 +1,13 @@
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { inspectSyncLock } from "../sync-lock.js";
-const BUSY = new Set(["sync_already_running", "backfill_already_running", "live_sync_paused_during_backfill"]);
+import { doctorLockWaitSeconds } from "./doctor-budget.js";
+const BUSY = new Set(["sync_already_running", "sync_lock_held", "backfill_already_running", "live_sync_paused_during_backfill"]);
 /** Retry the operation itself: its existing exclusive lock acquisition owns the
  * handoff. Merely observing a free lock never grants permission to collect. */
 export async function withDoctorLockWait(context, run, timing = { now: () => Date.now(), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) }) {
     const started = timing.now();
-    const limit = (context.command.lockWaitSeconds ?? 600) * 1000;
+    const limit = doctorLockWaitSeconds(context) * 1000;
     let nextProgress = 0;
     let row = await run();
     while (BUSY.has(row.code)) {
@@ -27,7 +28,15 @@ export async function withDoctorLockWait(context, run, timing = { now: () => Dat
                 if (result.code === 0 && result.stdout.trim())
                     name = result.stdout.trim().split("\n")[0] ?? name;
             }
-            return { ...row, status: "needs_fix", code: "lock_wait_timeout", nextAction: "cockpit doctor --lock-wait 600", message: `Waited ${Math.round(elapsed / 1000)}s for the collection lock; owner pid ${pid ?? "unknown"}, ${name}. Run \`cockpit doctor --lock-wait 600\`.` };
+            // BLI-11101: the scheduled sync holding the lock is not a fault; it is
+            // doing the upload this row would prove. Say so by name.
+            const syncOwns = !backfill.held && Boolean(sync?.held);
+            const code = syncOwns ? "sync_running" : "lock_wait_timeout";
+            console.error(`[doctor] ${row.id} lock wait ended`, JSON.stringify({ reason: code, owner_pid: pid ?? null, waited_seconds: Math.round(elapsed / 1000), limit_seconds: Math.round(limit / 1000) }));
+            const message = syncOwns
+                ? `The background sync (pid ${pid ?? "unknown"}, ${name}) is running and holds the collection lock; waited ${Math.round(elapsed / 1000)}s. Run \`cockpit doctor\` after it finishes, or \`cockpit doctor --lock-wait 600\` to wait for it.`
+                : `Waited ${Math.round(elapsed / 1000)}s for the collection lock; owner pid ${pid ?? "unknown"}, ${name}. Run \`cockpit doctor --lock-wait 600\`.`;
+            return { ...row, status: "needs_fix", code, nextAction: "cockpit doctor --lock-wait 600", message };
         }
         if (elapsed >= nextProgress) {
             const seconds = Math.floor(elapsed / 1000);

package/dist/commands/doctor-pipeline-verdicts.js

@@ -43,6 +43,8 @@ const COLLECTION_BUSY_REASONS = new Set([
     "live_sync_paused_during_backfill",
     // `cockpit backfill` stood aside for another backfill.
     "backfill_already_running",
+    // `cockpit backfill` waited for the collection lock and gave up (BLI-11091).
+    "sync_lock_held",
 ]);
 export function isCollectionBusyReason(reason) {
     return typeof reason === "string" && COLLECTION_BUSY_REASONS.has(reason);

package/dist/commands/doctor-pipeline.js

@@ -1,6 +1,5 @@
 import { withDoctorLockWait } from "./doctor-lock-wait.js";
-import fs from "node:fs/promises";
-import path from "node:path";
+import { doctorBackfillBudgetSeconds, doctorLockWaitSeconds } from "./doctor-budget.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
@@ -11,7 +10,7 @@ import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
-import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
+import { FOOTPRINT_NEEDS_FIX_BYTES, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
@@ -31,7 +30,6 @@ import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
  * `doctor-pipeline-verdicts.ts`, and every one of them is re-exported from
  * here so callers keep one address.
  */
-const GC_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export async function checkBackfillState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
     const roots = await doctorRoots(context);
@@ -48,7 +46,7 @@ export async function checkBackfillState(context) {
 }
 export async function fixBackfillState(context) {
     const started = Date.now();
-    const deadline = started + (context.command.backfillBudgetSeconds ?? 900) * 1000;
+    const deadline = started + doctorBackfillBudgetSeconds(context, started) * 1000;
     let caughtUp = 0;
     let chunks = 0;
     let live = null;
@@ -79,7 +77,7 @@ export async function fixBackfillState(context) {
             // Every chunk reacquires the collector's locks. Bound lock waiting by
             // the overall budget too; never abandon an in-flight cursor write.
             const chunkContext = { ...context, command: { ...context.command,
-                    lockWaitSeconds: Math.min(context.command.lockWaitSeconds ?? 600, (deadline - Date.now()) / 1000),
+                    lockWaitSeconds: Math.min(doctorLockWaitSeconds(context), (deadline - Date.now()) / 1000),
                 } };
             const row = await withDoctorLockWait(chunkContext, async () => {
                 if (Date.now() >= deadline)
@@ -91,6 +89,8 @@ export async function fixBackfillState(context) {
                     homeDir: context.command.homeDir, repoRoot: context.command.repoRoot,
                     all: true, dryRun: false, yes: true, json: true,
                     deadlineMs: deadline,
+                    // Doctor's own `withDoctorLockWait` owns the waiting (BLI-11091).
+                    syncLockWaitMs: 0,
                     onProgress: (progress) => { live = progress; },
                 }, capture.io);
                 const parsed = parseDoctorBackfillJson(capture.stdout());
@@ -134,18 +134,14 @@ export async function checkGcState(context) {
     if (context.io.env["COCKPIT_DISABLE_GC"] === "1") {
         return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
-    const paths = getCollectorRuntimePaths(context.command.homeDir);
-    const marker = path.join(paths.state_dir, ".last-raw-evidence-gc");
-    const info = await fs.stat(marker).catch(() => null);
-    if (info && Date.now() - info.mtimeMs < GC_MIN_INTERVAL_MS) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
-    }
-    return needsFix("gc-checked", "due", "cleanup is due");
+    // BLI-11106: the GC runs on every sync tick and costs one manifest read per
+    // old pack, so there is no "already ran today" to report; doctor runs it too.
+    return needsFix("gc-checked", "due", "cleanup runs on every sync; running it now");
 }
 export async function fixGcState(context) {
     const result = await runRawEvidenceLocalGc(getCollectorRuntimePaths(context.command.homeDir), context.io.env);
     if (result.skipped) {
-        return skipped("gc-checked", "skipped_throttled", "cleanup already ran today");
+        return skipped("gc-checked", "skipped_disabled", "cleanup is switched off");
     }
     if (result.removed_dirs === 0) {
         return ok("gc-checked", "nothing_eligible", rawEvidenceGcSummary(result));
@@ -153,21 +149,47 @@ export async function fixGcState(context) {
     return ok("gc-checked", `removed_${result.removed_dirs}`, rawEvidenceGcSummary(result));
 }
 /**
- * BLI-3619: what Cockpit is holding on this machine, in one line.
+ * BLI-3619 / BLI-11106: what Tower is holding on this machine, in one line.
  *
- * Green means the staging tree fits under the cap. Over the cap is `needs_fix`
- * and the fix is the same prune the tick runs, forced past its daily throttle;
- * if it is still over afterwards, the message names the one command that goes
- * further. Every number here is metadata — byte counts and file counts, never
- * a path.
+ * Green means the staging tree fits under the cap AND the whole collector
+ * footprint (staging, logs, state, spool) is under 512 MB. Either one crossed
+ * is `needs_fix`, and the message names the bucket holding the bytes. The fix
+ * is the same prune the tick runs; if it is still over afterwards, the message
+ * names the one command that goes further. Every number here is metadata —
+ * byte counts and file counts, never a path.
  */
 export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
-    return footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes
-        ? needsFix("disk-bounded", "over_staging_cap", message)
-        : ok("disk-bounded", "within_staging_cap", message);
+    if (footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes) {
+        return needsFix("disk-bounded", "over_staging_cap", message);
+    }
+    const over = footprintOverSentence(footprint);
+    if (over)
+        return needsFix("disk-bounded", "footprint_over_512mb", `${over}; ${message}`);
+    return ok("disk-bounded", "within_staging_cap", message);
+}
+/**
+ * "812.0 MB held, over the 512 MB line; most of it is sync logs (600.0 MB)",
+ * or null when the footprint is under the line. Logged either way, because a
+ * row that only speaks when it is red cannot say the check ran.
+ */
+export function footprintOverSentence(footprint) {
+    const total = footprintTotalBytes(footprint);
+    const holder = footprintHolder(footprint);
+    const over = total > FOOTPRINT_NEEDS_FIX_BYTES;
+    console.error("[cockpit-doctor] collector footprint", JSON.stringify({
+        reason: over ? "footprint_over_512mb" : "footprint_within_512mb",
+        total_bytes: total,
+        limit_bytes: FOOTPRINT_NEEDS_FIX_BYTES,
+        holder: holder?.label ?? null,
+        holder_bytes: holder?.bytes ?? 0,
+        study_entries_not_counted: footprint.state.study_entries,
+    }));
+    if (!over)
+        return null;
+    return `${mib(total)} MB held, over the ${mib(FOOTPRINT_NEEDS_FIX_BYTES)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -185,7 +207,6 @@ export async function fixDiskState(context) {
     const redelivered = redeliveryLine(redelivery);
     const pruned = await runStagingPrune(paths, {
         env: context.io.env,
-        force: true,
     });
     if (pruned.status === "fail") {
         return fail("disk-bounded", pruned.reason, "the prune could not run; nothing was deleted");
@@ -195,6 +216,10 @@ export async function fixDiskState(context) {
     }
     const footprint = await readDiskFootprint(paths);
     const message = diskRowMessage(footprint, pruned.cap_bytes);
+    const over = pruned.cap_blocked_by_uncommitted ? null : footprintOverSentence(footprint);
+    if (over) {
+        return needsFix("disk-bounded", "footprint_over_512mb", `freed ${mib(pruned.deleted_bytes)} MB; ${over}; ${message}`);
+    }
     if (!pruned.cap_blocked_by_uncommitted) {
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }

package/dist/commands/doctor.js

@@ -5,6 +5,7 @@ import { withStage } from "../crash-guard.js";
 import { checkSingleInstallState, readRootsCoverWork, fixAuthState, fixRootState, readAuthState, readRootState, } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline.js";
 import { checkMcpAnswersState } from "./doctor-mcp.js";
+import { budgetSpentRow, doctorRunDeadline, DOCTOR_JSON_BUDGET_SECONDS } from "./doctor-budget.js";
 import { checkMemoryDaemonState } from "./doctor-memory-daemon.js";
 import { checkDoctorAgentRules, fixDoctorAgentRules, checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
 import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, } from "./doctor-report.js";
@@ -15,12 +16,19 @@ export async function runDoctor(command, io, hooks, overrides = {}) {
     return runDoctorWithDeps(command, io, deps);
 }
 export async function runDoctorWithDeps(command, io, deps) {
-    const context = { command, io, deps };
+    const runStarted = Date.now();
+    const deadlineMs = doctorRunDeadline(command, runStarted);
+    const context = { command, io, deps, deadlineMs };
+    console.error("[doctor] run started", JSON.stringify({ json: command.json, check_only: Boolean(command.dryRun || command.checkOnly), budget_seconds: deadlineMs === null ? null : DOCTOR_JSON_BUDGET_SECONDS }));
     const rows = [];
     const repairs = [];
     const diagnoseOnly = command.dryRun || command.checkOnly;
     const diagnosed = new Map();
+    // BLI-11101: every row says how long it took, so the next slow run names
+    // the row without a profiler. A killed run still leaves every finished row.
+    const checkMs = new Map();
     for (const invariant of doctorInvariants()) {
+        const started = Date.now();
         try {
             diagnosed.set(invariant.id, await withStage(`doctor:check:${invariant.id}`, () => invariant.check(context)));
         }
@@ -28,16 +36,24 @@ export async function runDoctorWithDeps(command, io, deps) {
             console.error(`[doctor] ${invariant.id} diagnosis_failed`, JSON.stringify({ reason: "check_threw", ...describeError(error) }));
             diagnosed.set(invariant.id, { id: invariant.id, status: "fail", code: "check_threw", message: "Run `cockpit doctor` to retry this check." });
         }
+        checkMs.set(invariant.id, Date.now() - started);
+        console.error("[doctor] row checked", JSON.stringify({ row: invariant.id, elapsed_ms: checkMs.get(invariant.id), verdict: diagnosed.get(invariant.id)?.status, reason: diagnosed.get(invariant.id)?.code }));
     }
     for (const invariant of doctorInvariants()) {
         let row;
+        const fixStarted = Date.now();
         try {
             row = diagnosed.get(invariant.id);
             const needsCollection = ["backfill-complete", "sync-fresh"].includes(invariant.id);
             const prerequisitesReady = !needsCollection || rows.filter((prior) => prior.id === "authed" || prior.id === "roots-ok").every((prior) => prior.status === "ok");
             const canFix = !diagnoseOnly && prerequisitesReady && invariant.fix &&
                 (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context) || Boolean(command.collectionRoots?.length));
-            if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
+            const spent = row.status !== "ok" && row.status !== "skipped" && canFix ? budgetSpentRow(context, row) : null;
+            if (spent) {
+                row = spent;
+                repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
+            }
+            else if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
                 row = await withStage(`doctor:fix:${invariant.id}`, () => invariant.fix(context, row));
                 repairs.push({ step: invariant.id, outcome: row.status === "ok" ? "repaired" : "needs_person", reason: row.code });
                 // The replacement process owns the one final receipt, including JSON.
@@ -57,6 +73,9 @@ export async function runDoctorWithDeps(command, io, deps) {
             repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
         }
         console.error(`[doctor] ${invariant.id} ${row.status}`, JSON.stringify({ reason: row.code, repaired: row.fixed ?? false }));
+        const fixMs = Date.now() - fixStarted;
+        const rowCheckMs = checkMs.get(invariant.id) ?? 0;
+        console.error("[doctor] row done", JSON.stringify({ row: invariant.id, elapsed_ms: rowCheckMs + fixMs, check_ms: rowCheckMs, fix_ms: fixMs, verdict: row.status, reason: row.code }));
         rows.push(row);
     }
     // Re-read host state after repairs. Sync is proven by its upload receipts;
@@ -68,10 +87,11 @@ export async function runDoctorWithDeps(command, io, deps) {
             const index = rows.findIndex((row) => row.id === invariant.id);
             if (rows[index]?.status === "fail")
                 continue;
+            const verifyStarted = Date.now();
             try {
                 const checked = await invariant.check(context);
                 rows[index] = { ...checked, fixed: rows[index]?.fixed && checked.status === "ok" };
-                console.error(`[doctor] ${invariant.id} verified`, JSON.stringify({ reason: checked.code, status: checked.status }));
+                console.error(`[doctor] ${invariant.id} verified`, JSON.stringify({ reason: checked.code, status: checked.status, elapsed_ms: Date.now() - verifyStarted }));
                 if (checked.status === "needs_fix" || checked.status === "fail") {
                     const repair = repairs.find((entry) => entry.step === invariant.id);
                     if (repair) {
@@ -102,8 +122,10 @@ export async function runDoctorWithDeps(command, io, deps) {
             rows.push({ id: "memory-registered", status: "needs_fix", code: "receipt_read_threw", message: "Run `cockpit doctor` to read the final setup receipt." });
         }
     }
+    const needsPerson = doctorNeedsPerson(rows, receipt).length;
+    console.error("[doctor] run done", JSON.stringify({ elapsed_ms: Date.now() - runStarted, rows: rows.length, needs_person: needsPerson, check_only: Boolean(diagnoseOnly) }));
     writeDoctorOutput(command, io, rows, receipt, repairs);
-    return doctorNeedsPerson(rows, receipt).length === 0 ? 0 : 1;
+    return needsPerson === 0 ? 0 : 1;
 }
 function doctorInvariants() {
     return [

package/dist/commands/heartbeat.js

@@ -133,7 +133,7 @@ export function buildCollectorHeartbeat(options) {
  * that a green, syncing, up-to-date laptop was sitting on 1.8 GB of evidence the
  * server had never received, and a fleet-wide failure nobody can see is the
  * BLI-2528 shape exactly. The walk is bounded by the pack tree the prune keeps
- * under a 2 GB cap, and it is best-effort: a read that fails returns nulls and
+ * under a 256 MiB cap, and it is best-effort: a read that fails returns nulls and
  * says so, so the heartbeat omits both fields rather than claiming zero.
  */
 export async function readHeartbeatStagingFacts(options) {

package/dist/commands/local-arg-values.js

@@ -105,6 +105,15 @@ export function optionalPositiveInteger(value, flag) {
     }
     return parsed;
 }
+export function optionalNonNegativeInteger(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`${flag} must be a whole number of 0 or more.`);
+    }
+    return parsed;
+}
 export function optionalConfidence(value, flag) {
     if (value === undefined)
         return undefined;

package/dist/commands/local-args-collector-setup.js

@@ -142,8 +142,10 @@ export function parseDoctorArgs(alias, args) {
     return {
         kind: "doctor",
         checkOnly: values.booleans.has("--check") || values.booleans.has("--no-repair"),
-        backfillBudgetSeconds: optionalPositiveInteger(values.flags.get("--backfill-budget"), "--backfill-budget") ?? 900,
-        lockWaitSeconds: optionalPositiveInteger(values.flags.get("--lock-wait"), "--lock-wait") ?? 600,
+        // Absent stays absent (BLI-11101): `doctor-budget.ts` owns the defaults,
+        // and `--json` without either flag runs under one bounded budget.
+        backfillBudgetSeconds: optionalPositiveInteger(values.flags.get("--backfill-budget"), "--backfill-budget"),
+        lockWaitSeconds: optionalPositiveInteger(values.flags.get("--lock-wait"), "--lock-wait"),
         alias,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         repoRoot: optionalNonEmpty(workRootFlagValue(values)),