@bli-cockpit/cli 0.2.154 → 0.2.156

package/dist/adapters/local-sources.js

@@ -35,6 +35,7 @@ export async function runLocalSourceCollectors(options) {
             claudeAttributionScan: options.rawEvidenceClaudeAttributionScan,
             skipContentHashes: options.rawEvidenceSkipContentHashes,
             priorSnapshots: options.rawEvidencePriorSnapshots,
+            stubReoffers: options.rawEvidenceStubReoffers,
             byteBudget: options.rawEvidenceByteBudget,
             objectBudget: options.rawEvidenceObjectBudget,
             budget: options.rawEvidenceBudget,

package/dist/adapters/raw-evidence-collection-state.js

@@ -74,6 +74,7 @@ export async function openCollection(context, options, places) {
         caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
         priorSnapshots: options.priorSnapshots ?? new Map(),
+        stubReoffers: options.stubReoffers ?? new Map(),
         budget: options.budget ?? {
             remainingBytes: byteBudget,
             remainingObjects: objectBudget,

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -20,6 +20,7 @@
  * says so: `snapshot_rewritten`, both sizes, and the byte range the first
  * difference falls in. Never content.
  */
+import { REDACTION_STUB_LABEL } from "@bli-cockpit/telemetry-core";
 import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
 /**
  * The newest committed snapshot per source key, from the cursor's objects map,
@@ -79,4 +80,32 @@ export function supersedeClaimFor(options) {
         first_differing_offset_below: range.below,
     }));
     return null;
+}
+/**
+ * BLI-11102: the claim a re-offered transcript makes when the server named its
+ * stored copy a redaction-crash stub. Only a main transcript that redacted
+ * cleanly this time claims; one that stubbed again claims nothing and keeps
+ * the ordinary path. Logs the decision either way.
+ */
+export function stubReplacementClaim(options) {
+    if (!options.stubPointerId || (options.kind !== "codex_jsonl" && options.kind !== "claude_jsonl"))
+        return null;
+    if (options.completenessLabel === REDACTION_STUB_LABEL) {
+        console.error("[evidence-upload] stubbed session re-offered but it stubbed again; no claim", JSON.stringify({
+            reason: "stub_reoffer_still_stubbed",
+            kind: options.kind,
+            byte_size: options.byteSize,
+        }));
+        return null;
+    }
+    console.error("[evidence-upload] stubbed session re-offered; claiming to replace the stub", JSON.stringify({
+        reason: "stub_reoffered",
+        rule: "stub_replaced",
+        kind: options.kind,
+        byte_size: options.byteSize,
+        // The same bytes may already be durable (a later sync healed it without
+        // knowing about the stub); they are staged anyway so the claim has a carrier.
+        already_durable: options.alreadyDurable,
+    }));
+    return { pointer_id: options.stubPointerId, rule: "stub_replaced" };
 }

package/dist/adapters/raw-evidence-transcript-file.js

@@ -19,7 +19,7 @@ import { isSecretLikePath, sha256, shortHash, } from "./raw-evidence-keys.js";
 import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { describeSnapshot, supersedeClaimFor } from "./raw-evidence-snapshot-supersede.js";
+import { describeSnapshot, stubReplacementClaim, supersedeClaimFor, } from "./raw-evidence-snapshot-supersede.js";
 import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
@@ -64,7 +64,16 @@ export async function collectOneEvidenceFile(collection, options) {
         secretLikeFileName: names.secretLikeFileName,
     });
     const contentHash = sha256(sanitized.bytes);
-    if (collection.skipContentHashes.has(contentHash)) {
+    // BLI-11102: a session the server named a redaction stub is re-offered even
+    // when these bytes are already durable, because the stub is not a delivery.
+    const stubClaim = stubReplacementClaim({
+        kind: options.kind,
+        stubPointerId: collection.stubReoffers.get(options.sessionId),
+        completenessLabel: sanitized.completenessLabel,
+        byteSize: sanitized.bytes.byteLength,
+        alreadyDurable: collection.skipContentHashes.has(contentHash),
+    });
+    if (collection.skipContentHashes.has(contentHash) && !stubClaim) {
         collection.reused.push({
             kind: options.kind,
             label: names.evidenceLabel,
@@ -83,6 +92,7 @@ export async function collectOneEvidenceFile(collection, options) {
         names,
         sanitized,
         contentHash,
+        stubClaim,
     });
     return true;
 }
@@ -139,7 +149,7 @@ async function stageOneTranscript(collection, file) {
         // BLI-11088: remember this snapshot's shape, and claim the last one when
         // these bytes rebuild it.
         snapshot: describeSnapshot(file.sanitized.bytes),
-        supersedes: supersedeClaimFor({
+        supersedes: file.stubClaim ?? supersedeClaimFor({
             bytes: file.sanitized.bytes,
             contentHash: file.contentHash,
             kind: file.kind,

package/dist/commands/backfill-checkpoint.js

@@ -21,6 +21,7 @@ import { indexDurableMainObjectKeys } from "./backfill-evidence-outcomes.js";
 export async function recordBackfillDurableSessionPointers(options) {
     const durableObjectBySession = indexDurableMainObjectKeys(options.syncResults);
     let recordedCount = 0;
+    let stubsReplaced = 0;
     for (const source of ["codex", "claude_code"]) {
         const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
         const cursor = await readRawEvidenceCursor(options.paths, { filename });
@@ -31,8 +32,13 @@ export async function recordBackfillDurableSessionPointers(options) {
             const objectKey = durableObjectBySession.get(`${source}:${candidate.session_id}`);
             const prior = cursor.sessions[candidate.session_id];
             // No pointer, no prior entry, or already pointed: nothing this pass owes.
-            if (!objectKey || !prior || prior.uploaded_object_key)
+            // BLI-11102: a pointer the server named a redaction stub is not a
+            // delivery, so a real pointer replaces it and the mark clears.
+            const replacesStub = Boolean(prior?.stub_reoffer) && prior?.uploaded_object_key !== objectKey;
+            if (!objectKey || !prior || (prior.uploaded_object_key && !replacesStub))
                 continue;
+            if (replacesStub)
+                stubsReplaced += 1;
             cursor.sessions[candidate.session_id] = deliveredCursorEntry(prior, candidate, objectKey, options.now);
             changed = true;
             recordedCount += 1;
@@ -45,12 +51,12 @@ export async function recordBackfillDurableSessionPointers(options) {
         }
     }
     if (recordedCount > 0) {
-        console.error("[backfill] terminal session pointers recorded", JSON.stringify({ count: recordedCount }));
+        console.error("[backfill] terminal session pointers recorded", JSON.stringify({ count: recordedCount, stub_pointers_replaced: stubsReplaced }));
     }
 }
 /** The cursor entry for a session backfill has just delivered in full. */
 function deliveredCursorEntry(prior, candidate, objectKey, now) {
-    return {
+    const entry = {
         ...prior,
         file_hash_sha256: candidate.content_hash_sha256,
         file_mtime_ms: candidate.session_file_mtime_ms,
@@ -65,6 +71,9 @@ function deliveredCursorEntry(prior, candidate, objectKey, now) {
         uploaded_byte_size: candidate.byte_size,
         last_seen_at: now.toISOString(),
     };
+    // The mark says "this pointer is a stub"; the pointer written above is not.
+    delete entry.stub_reoffer;
+    return entry;
 }
 export function advanceBackfillCursorThroughResolvedPrefix(options) {
     if (!options.discoveryComplete)

package/dist/commands/backfill-report.js

@@ -7,6 +7,7 @@ import { advanceBackfillCursorThroughResolvedPrefix, recordBackfillDurableSessio
 import { blockingScanIssues, cappedSidecarCount } from "./backfill-issues.js";
 import { backfillResultBaseArgs, baseBackfillResult, emptyReport, } from "./backfill-result.js";
 import { buildBackfillSessionReport } from "./backfill-session-report.js";
+import { summarizeStubReoffer } from "./backfill-stub-reoffer.js";
 /**
  * REPORT: post the session report, record durable pointers, advance the
  * cursor through the resolved contiguous prefix, decide completion, write the
@@ -37,14 +38,17 @@ export async function reportBackfillOutcome(command, io, ctx, upload) {
     if (completion.status === "complete" && command.all) {
         await writeAllHistoryCompletionMarker(ctx);
     }
-    return assembleBackfillResult({
-        command,
-        ctx,
-        upload,
-        posted,
-        completion,
-        blockedAt,
-    });
+    return {
+        ...assembleBackfillResult({
+            command,
+            ctx,
+            upload,
+            posted,
+            completion,
+            blockedAt,
+        }),
+        stub_reoffer: summarizeStubReoffer(ctx.stubReoffer, upload.uploadable),
+    };
 }
 /**
  * Tells the server what this run observed about every session, uploaded or

package/dist/commands/backfill-scan.js

@@ -20,6 +20,7 @@ import { addReadOnlyGuardIssues, addRepoDiscoveryIssues, backfillScanIssues, cou
 import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
+import { emptyStubReofferPlan, loadStubReofferPlan, reopenStubbedSessions, } from "./backfill-stub-reoffer.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
 /**
  * SCAN: is this machine paired, what roots/sources/window apply, and what did
@@ -47,6 +48,18 @@ export async function scanBackfillRun(command, io, now) {
     const scopedCursor = prepareBackfillCursorForScope(storedCursor, collectionRoots, sources);
     const cursor = scopedCursor.cursor;
     const pointerlessTerminalSessions = await loadPointerlessTerminalSessions(paths, sources);
+    // BLI-11102: a redaction-crash stub is not a delivery. The server names
+    // them; those sessions reopen exactly like pointer-less ones. A dry run
+    // keeps its one-request contract (the reachability probe) and does not ask.
+    const stubReoffer = command.dryRun
+        ? emptyStubReofferPlan("dry_run")
+        : await loadStubReofferPlan({
+            paths,
+            dashboardUrl: scope.dashboardUrl,
+            sources,
+            fetchImpl: io.fetch,
+        });
+    reopenStubbedSessions(pointerlessTerminalSessions, stubReoffer);
     const scan = await scanBackfillSessions({
         command,
         homeDir: command.homeDir ?? os.homedir(),
@@ -73,6 +86,7 @@ export async function scanBackfillRun(command, io, now) {
         cursor,
         scan,
         reasonCounts,
+        stubReoffer,
         oversizedCandidateKeys: oversizedBackfillCandidateKeys(scan.candidates),
         deterministicSkipCandidateKeys: deterministicSkipCandidateKeys(scan.candidates),
     };

package/dist/commands/backfill-stub-reoffer.js

@@ -0,0 +1,104 @@
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { fetchStubbedSessions, stubSessionKey } from "../evidence-stubs-client.js";
+import { describeError } from "../health-detail.js";
+import { readLocalCollectorSessionFile } from "../local-state.js";
+export function emptyStubReofferPlan(reason) {
+    return { status: "skipped", reason, sessions: new Map(), stub_count: 0, marked_local_sessions: 0 };
+}
+/** Ask the server which of this operator's pointers are stubs. Never throws; writes nothing. */
+export async function loadStubReofferPlan(options) {
+    const session = await readLocalCollectorSessionFile(options.paths).catch(() => null);
+    if (!session || session.session_state !== "valid" || typeof session.device_token !== "string" || !session.device_token) {
+        console.error("[backfill] redaction stubs not asked", JSON.stringify({ reason: "no_device_session" }));
+        return emptyStubReofferPlan("no_device_session");
+    }
+    const answer = await fetchStubbedSessions({
+        dashboardUrl: options.dashboardUrl,
+        deviceToken: session.device_token,
+        fetchImpl: options.fetchImpl,
+    });
+    const sessions = new Map([...answer.sessions].filter(([key]) => options.sources.some((source) => key.startsWith(`${source}:`))));
+    return {
+        status: answer.status,
+        reason: answer.reason,
+        sessions,
+        stub_count: answer.unique_stub_count,
+        marked_local_sessions: 0,
+    };
+}
+/**
+ * Mark every stubbed session this machine tracks as not delivered. The caller
+ * holds the collection lock: sync writes the same cursor files.
+ */
+export async function markStubReoffers(paths, plan, now) {
+    if (plan.sessions.size === 0)
+        return;
+    plan.marked_local_sessions = await markStubbedSessions(paths, plan.sessions, now);
+}
+/** Reopen stubbed sessions exactly like pointer-less ones: selected past the cursor, sorted first. */
+export function reopenStubbedSessions(reopen, plan) {
+    for (const key of plan.sessions.keys()) {
+        const at = key.indexOf(":");
+        const source = key.slice(0, at);
+        reopen[source]?.add(key.slice(at + 1));
+    }
+}
+/** Session id -> the stub pointer the new upload claims to replace (the server retires the rest). */
+export function stubClaimsForCandidates(candidates, plan) {
+    const claims = new Map();
+    for (const candidate of candidates) {
+        const pointer = plan.sessions.get(stubSessionKey(candidate.source, candidate.session_id))?.[0];
+        if (pointer)
+            claims.set(candidate.session_id, pointer);
+    }
+    return claims;
+}
+export function summarizeStubReoffer(plan, candidates) {
+    const reoffered = candidates.filter((candidate) => plan.sessions.has(stubSessionKey(candidate.source, candidate.session_id))).length;
+    const summary = {
+        status: plan.status,
+        reason: plan.reason,
+        stubs: plan.stub_count,
+        sessions: plan.sessions.size,
+        marked_local_sessions: plan.marked_local_sessions,
+        reoffered_sessions: reoffered,
+    };
+    if (plan.sessions.size > 0) {
+        console.error("[backfill] redaction-stubbed sessions re-offered", JSON.stringify({
+            ...summary,
+            reason: "stub_reoffered",
+            stub_door: `${summary.status}:${summary.reason}`,
+            // Stubbed on the server, but no file for it in this run's scan window.
+            not_found_locally: plan.sessions.size - reoffered,
+        }));
+    }
+    return summary;
+}
+async function markStubbedSessions(paths, sessions, now) {
+    let marked = 0;
+    for (const source of ["codex", "claude_code"]) {
+        const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
+        try {
+            const cursor = await readRawEvidenceCursor(paths, { filename });
+            let changed = false;
+            for (const [key, pointerIds] of sessions) {
+                if (!key.startsWith(`${source}:`))
+                    continue;
+                const entry = cursor.sessions[key.slice(source.length + 1)];
+                if (!entry)
+                    continue;
+                entry.stub_reoffer = { reason: "stub_reoffered", stub_pointer_ids: pointerIds, marked_at: now.toISOString() };
+                changed = true;
+                marked += 1;
+            }
+            if (changed) {
+                await writeRawEvidenceCursor(paths, cursor, { filename, sessionsOnly: source === "claude_code" });
+            }
+        }
+        catch (error) {
+            // The mark is bookkeeping; the server's answer still drives this run.
+            console.error("[backfill] stub mark not written to the cursor", JSON.stringify({ reason: "stub_mark_write_failed", source, ...describeError(error) }));
+        }
+    }
+    return marked;
+}

package/dist/commands/backfill-upload.js

@@ -7,6 +7,7 @@ import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandi
 import { blockingScanIssues } from "./backfill-issues.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
+import { stubClaimsForCandidates } from "./backfill-stub-reoffer.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
  * UPLOAD: sync every uploadable candidate in fixed-size batches, heartbeating
@@ -101,6 +102,7 @@ async function uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget
         codexAttribution: ctx.scan.codexAttribution,
         claudeAttribution: ctx.scan.claudeAttribution,
         rawEvidenceBudget,
+        stubClaims: stubClaimsForCandidates(batch.candidates, ctx.stubReoffer),
         fetchImpl: io.fetch,
     });
     const durableInBatch = durableBackfillCandidateKeys(batch, sync);
@@ -216,6 +218,8 @@ function backfillBatchSyncOptions(options) {
         })),
         claudeAttributionScan: options.claudeAttribution ?? undefined,
         rawEvidenceBudget: options.rawEvidenceBudget,
+        // BLI-11102: session id -> the redaction stub this upload replaces.
+        rawEvidenceStubReoffers: options.stubClaims,
         // `cockpit backfill` is only ever an operator asking — by hand, through
         // onboarding, through doctor, or by running the retry command Cockpit
         // printed. The delivery-backoff window is the scheduler's cadence, so it

package/dist/commands/backfill.js

@@ -25,6 +25,7 @@
  *   backfill-evidence-outcomes.ts  what one upload achieved per session
  *   backfill-session-report.ts     one attribution row per session seen
  *   backfill-checkpoint.ts         the durable cursor and pointer writes
+ *   backfill-stub-reoffer.ts       redaction-crash stubs: re-offered, not delivered
  *   backfill-result.ts             the `--json` payload
  *   backfill-output.ts             every line and prompt a person sees
  *
@@ -45,6 +46,7 @@ import { planBackfillRun } from "./backfill-plan.js";
 import { reportBackfillOutcome } from "./backfill-report.js";
 import { lockHeldResult } from "./backfill-result.js";
 import { scanBackfillRun } from "./backfill-scan.js";
+import { markStubReoffers } from "./backfill-stub-reoffer.js";
 import { uploadBackfillBatches } from "./backfill-upload.js";
 // The command's public surface. Callers (doctor, onboard, local, the CLI
 // router, the BLI-3272 regression test) import these from `./backfill.js`;
@@ -135,6 +137,9 @@ export async function runBackfill(command, io) {
         if (scanned.scopedCursor.reset) {
             await writeBackfillCursor(paths, scanned.cursor);
         }
+        // BLI-11102: mark server-named stubs as not delivered, under the lock
+        // because sync writes the same cursor files.
+        await markStubReoffers(paths, scanned.stubReoffer, now);
         const upload = await uploadBackfillBatches(command, io, lock, scanned);
         return await reportBackfillOutcome(command, io, scanned, upload);
     }

package/dist/commands/clean.js

@@ -1,16 +1,19 @@
 /**
  * `cockpit clean` — what this machine is holding, why, and what goes.
  *
- * BLI-3619. The tick prunes on its own once a day; this is the door a person
- * opens when a laptop is full now. It prints the same buckets the retention
- * rule reasons in, one line each with its reason, and only then deletes:
+ * BLI-3619 / BLI-11106. The sync tick prunes on its own, every tick, and a
+ * staged copy goes the tick its commit is acknowledged; nobody should need
+ * this door. It is here for "show me" and for a machine that has been off.
+ * It prints the same buckets the retention rule reasons in, one line each with
+ * its reason, and only then deletes:
  *
- *   committed, past the 48 h retry window   goes
- *   committed, still inside the window      kept — unless the cap needs it
+ *   committed on the server                 goes
+ *   committed, inside an opted-in window    kept — unless the cap needs it
+ *                                           (only when COCKPIT_STAGING_RETENTION_HOURS is set)
  *   uncommitted                             kept, always, and named
  *   the ledger cannot say                   kept, always, and named apart
  *
- * `--dry-run` stops after the printing. `--all-committed` drops the retry
+ * `--dry-run` stops after the printing. `--all-committed` drops any opted-in
  * window — every committed spare goes now — and is also the only thing that
  * removes a `manual-study-evidence-vault-*` directory, and then only when every
  * object inside it is committed. Nothing here can delete evidence the upload
@@ -31,12 +34,13 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { writeLine } from "./cli-io.js";
+import { footprintLine } from "./doctor-disk-words.js";
 import { planFromDisk, runStagingPrune } from "../disk-prune.js";
 import { MANUAL_VAULT_PREFIX, readDiskFootprint, } from "../disk-usage.js";
 import { readRawEvidenceCursor } from "../cursors/raw-evidence-cursor.js";
 import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
-import { rotateCollectorLogsBestEffort } from "../log-rotation.js";
+import { DEFAULT_LOG_ROTATION_KEEP, orphanedLogArchives, rotateCollectorLogsBestEffort, } from "../log-rotation.js";
 export async function runClean(command, io) {
     const paths = getCollectorRuntimePaths(command.homeDir);
     const now = new Date();
@@ -53,8 +57,9 @@ export async function runClean(command, io) {
     const vaults = command.allCommitted
         ? await vaultsSafeToRemove(paths, footprint.vaults)
         : [];
+    const logArchives = await orphanedLogArchives(paths);
     if (!command.json) {
-        for (const line of cleanLines(footprint, plan, vaults, command)) {
+        for (const line of cleanLines(footprint, plan, vaults, command, logArchives)) {
             writeLine(io.stdout, line);
         }
     }
@@ -67,7 +72,6 @@ export async function runClean(command, io) {
     const pruned = await runStagingPrune(paths, {
         env,
         now,
-        force: true,
         allCommitted: command.allCommitted,
         reclaimTerminal: true,
     });
@@ -86,20 +90,32 @@ export async function runClean(command, io) {
     return pruned.status === "fail" ? 1 : 0;
 }
 /** The bucket table a person reads before anything is deleted. */
-export function cleanLines(footprint, plan, vaults, command) {
+export function cleanLines(footprint, plan, vaults, command, logArchives = []) {
     const staging = footprint.staging;
     const lines = [
         command.dryRun ? "Tower clean (dry run)" : "Tower clean",
         `  staging          ${mb(staging.total_bytes)} MB across ${staging.pack_count} pack(s), ${staging.object_count} file(s)`,
         `  going            ${mb(plan.deleted_bytes + plan.empty_pack_manifest_bytes)} MB, ${plan.delete.length} file(s) — ${command.allCommitted
             ? "every committed copy (--all-committed)"
-            : `committed and past the ${Math.round(plan.retention_ms / 3_600_000)} h retry window`}`,
-        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, still inside the retry window`,
+            : plan.retention_ms > 0
+                ? `committed and past the opted-in ${Math.round(plan.retention_ms / 3_600_000)} h window`
+                : "committed on the server; the source file is still on disk for any retry"}`,
+        `  kept in window   ${mb(plan.kept_in_window.bytes)} MB, ${plan.kept_in_window.count} file(s) — committed, inside an opted-in retry window (none by default)`,
         `  kept uncommitted ${mb(plan.kept_uncommitted.bytes)} MB, ${plan.kept_uncommitted.count} file(s) — never delivered; retention will never delete these`,
         `  kept unknown     ${mb(plan.kept_unknown.bytes)} MB, ${plan.kept_unknown.count} file(s) — the upload ledger no longer reaches back this far and cannot say`,
-        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))`,
+        `  rotated logs     ${mb(footprint.logs.total_bytes)} MB (${footprint.logs.archive_count} archive(s))${logArchives.length > 0
+            ? `; ${logArchives.length} archive(s), ${mb(logArchives.reduce((sum, archive) => sum + archive.byte_size, 0))} MB, sit outside the ${DEFAULT_LOG_ROTATION_KEEP}-archive keep window and go`
+            : ""}`,
         `  spool            ${mb(footprint.spool_bytes)} MB`,
+        `  state files      ${mb(footprint.state.state_bytes)} MB — cursors, indexes and receipts, each bounded`,
     ];
+    if (footprint.state.other_bytes > 0) {
+        lines.push(`  unrecognised     ${mb(footprint.state.other_bytes)} MB across ${footprint.state.other_entries} entr(ies) — counted, never deleted by clean`);
+    }
+    if (footprint.state.study_entries > 0) {
+        lines.push(`  studies          ${footprint.state.study_entries} folder(s) an agent left here — not the collector's, not counted, never touched; new ones go in bli-cockpit-studies`);
+    }
+    lines.push(`  ${footprintLine(footprint)}`);
     for (const vault of footprint.vaults) {
         const removable = vaults.some((entry) => entry.name === vault.name);
         lines.push(`  ${vault.name} ${mb(vault.byte_size)} MB, ${vault.file_count} file(s) — ${removable
@@ -158,6 +174,8 @@ function cleanJson(footprint, plan, vaults, pruned, reconciled = null) {
         },
         rotated_log_bytes: footprint.logs.total_bytes,
         spool_bytes: footprint.spool_bytes,
+        state: footprint.state,
+        last_prune: footprint.last_prune,
         vaults: footprint.vaults,
         plan: {
             delete_count: plan.delete.length,

package/dist/commands/doctor-disk-words.js

@@ -28,9 +28,85 @@ export function redeliveryLine(result) {
     }
     return "the next `cockpit sync` re-offers them";
 }
+/**
+ * Over this, the whole collector footprint is a needs-fix row (BLI-11106).
+ * Delete-on-commit plus the 256 MiB staging cap and the log caps put a healthy
+ * machine far under it; crossing it means something is holding bytes, and the
+ * row names what.
+ */
+export const FOOTPRINT_NEEDS_FIX_BYTES = 512 * 1024 * 1024;
+/**
+ * Every bucket the collector owns, biggest first. Study folders an agent left
+ * under the state dir are not here: they are not the collector's, and no
+ * prune would ever explain them (they belong in `bli-cockpit-studies`).
+ */
+export function footprintBuckets(footprint) {
+    const staging = footprint.staging;
+    const buckets = [
+        { label: "staging, committed (goes on the next tick)", bytes: staging.committed_bytes },
+        {
+            label: "staging, uncommitted (evidence the server has not accepted yet)",
+            bytes: staging.uncommitted_bytes + staging.unknown_bytes,
+        },
+        { label: "staging, refused by the server", bytes: staging.terminal_bytes ?? 0 },
+        { label: "staging, pack manifests", bytes: stagingOverheadBytes(footprint) },
+        { label: "sync logs", bytes: footprint.logs.total_bytes },
+        { label: "collector state files", bytes: footprint.state.state_bytes },
+        { label: "upload spool", bytes: footprint.spool_bytes },
+        { label: "unrecognised files in the state dir", bytes: footprint.state.other_bytes },
+    ];
+    return buckets.filter((bucket) => bucket.bytes > 0).sort((a, b) => b.bytes - a.bytes);
+}
+export function footprintTotalBytes(footprint) {
+    return footprintBuckets(footprint).reduce((sum, bucket) => sum + bucket.bytes, 0);
+}
+/**
+ * The one footprint line doctor and status both print: staging committed /
+ * uncommitted, logs, state, and when the prune last ran and what it freed.
+ */
+export function footprintLine(footprint) {
+    const staging = footprint.staging;
+    const parts = [
+        `footprint ${mib(footprintTotalBytes(footprint))} MB`,
+        `staging ${mib(staging.committed_bytes)} MB committed / ${mib(staging.uncommitted_bytes + staging.unknown_bytes)} MB uncommitted`,
+        `logs ${mib(footprint.logs.total_bytes)} MB`,
+        `state ${mib(footprint.state.state_bytes + footprint.spool_bytes)} MB`,
+    ];
+    if (footprint.state.other_bytes > 0) {
+        parts.push(`unrecognised ${mib(footprint.state.other_bytes)} MB`);
+    }
+    parts.push(lastPrunePhrase(footprint));
+    return parts.join(", ");
+}
+/** `last prune: <when>, freed <n> MB`, plus the last time it freed anything. */
+export function lastPrunePhrase(footprint) {
+    const last = footprint.last_prune;
+    if (!last)
+        return "last prune: never";
+    const base = `last prune: ${minute(last.at)}, freed ${mib(last.freed_bytes)} MB`;
+    if (last.freed_bytes > 0 || !last.last_freed_at)
+        return base;
+    return `${base} (last freed ${mib(last.last_freed_bytes)} MB at ${minute(last.last_freed_at)})`;
+}
+/** The biggest bucket, named, for the needs-fix sentence; null when empty. */
+export function footprintHolder(footprint) {
+    return footprintBuckets(footprint)[0] ?? null;
+}
+function stagingOverheadBytes(footprint) {
+    const staging = footprint.staging;
+    const payload = staging.committed_bytes +
+        staging.uncommitted_bytes +
+        staging.unknown_bytes +
+        (staging.terminal_bytes ?? 0);
+    return Math.max(0, staging.total_bytes - payload);
+}
+function minute(iso) {
+    return iso.length >= 16 ? `${iso.slice(0, 16)}Z` : iso;
+}
 export function diskRowMessage(footprint, capBytes) {
     const staging = footprint.staging;
     const parts = [
+        footprintLine(footprint),
         `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
     ];
     // BLI-3797: "1,916.9 uncommitted" is a number, not a finding. The row now
@@ -51,9 +127,11 @@ export function diskRowMessage(footprint, capBytes) {
     if (staging.unknown_count > 0) {
         parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
     }
-    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
-    for (const vault of footprint.vaults) {
-        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
+    // BLI-11106: study folders an agent left under the state dir are named as a
+    // count, never sized or added to the footprint. They are not the
+    // collector's, and new ones belong in the sibling `bli-cockpit-studies`.
+    if (footprint.state.study_entries > 0) {
+        parts.push(`${footprint.state.study_entries} study folder(s) under the state dir are not counted (new studies go in bli-cockpit-studies beside it)`);
     }
     return parts.join("; ");
 }