@bli-cockpit/cli 0.2.157 → 0.2.159

package/dist/adapters/codex-attribution.js

@@ -167,6 +167,7 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
         file_path: file.file,
         file_name: fileName,
         codex_session_id: sessionIdFromFileName(fileName) ?? shortHash(file.file),
+        session_id_source: sessionIdFromFileName(fileName) ? "file_name" : "path_hash",
         cwd_basename: null,
         cwd_hash: null,
         session_file_mtime: new Date(file.mtimeMs).toISOString(),
@@ -197,6 +198,7 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
     if (metaSessionId) {
         base.codex_session_id = metaSessionId;
+        base.session_id_source = "session_meta";
     }
     const primaryCwd = signals.cwds[0] ?? null;
     if (primaryCwd) {

package/dist/commands/backfill-checkpoint.js

@@ -10,6 +10,7 @@
  */
 import { recordBackfillCursorObservations, } from "../cursors/backfill-cursor.js";
 import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { isRedactionStubObjectKey, markCursorEntryStubbed } from "../cursors/raw-evidence-stub-entry.js";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
 import { candidateCursorKey, compareBackfillCandidates, isAfterCursor, } from "./backfill-candidates.js";
 import { indexDurableMainObjectKeys } from "./backfill-evidence-outcomes.js";
@@ -34,10 +35,11 @@ export async function recordBackfillDurableSessionPointers(options) {
             // No pointer, no prior entry, or already pointed: nothing this pass owes.
             // BLI-11102: a pointer the server named a redaction stub is not a
             // delivery, so a real pointer replaces it and the mark clears.
-            const replacesStub = Boolean(prior?.stub_reoffer) && prior?.uploaded_object_key !== objectKey;
+            // BLI-11119: an entry the cursor itself knows is `stubbed` counts too.
+            const replacesStub = Boolean(prior?.stub_reoffer || prior?.stubbed) && prior?.uploaded_object_key !== objectKey;
             if (!objectKey || !prior || (prior.uploaded_object_key && !replacesStub))
                 continue;
-            if (replacesStub)
+            if (replacesStub && !isRedactionStubObjectKey(objectKey))
                 stubsReplaced += 1;
             cursor.sessions[candidate.session_id] = deliveredCursorEntry(prior, candidate, objectKey, options.now);
             changed = true;
@@ -71,8 +73,15 @@ function deliveredCursorEntry(prior, candidate, objectKey, now) {
         uploaded_byte_size: candidate.byte_size,
         last_seen_at: now.toISOString(),
     };
+    // BLI-11119: a re-offer that stubbed again earned another marker, not the
+    // transcript. The entry says so and keeps its mark for the next pass.
+    if (isRedactionStubObjectKey(objectKey)) {
+        markCursorEntryStubbed(entry);
+        return entry;
+    }
     // The mark says "this pointer is a stub"; the pointer written above is not.
     delete entry.stub_reoffer;
+    delete entry.stubbed;
     return entry;
 }
 export function advanceBackfillCursorThroughResolvedPrefix(options) {

package/dist/commands/backfill-scan.js

@@ -21,6 +21,7 @@ import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-o
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
 import { emptyStubReofferPlan, loadStubReofferPlan, reopenStubbedSessions, } from "./backfill-stub-reoffer.js";
+import { loadStubCursorHashes, locateStubbedSessions } from "./backfill-stub-locate.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
 import { stubSessionKey } from "../evidence-stubs-client.js";
 /**
@@ -64,6 +65,7 @@ export async function scanBackfillRun(command, io, now) {
                 fetchImpl: io.fetch,
             });
     reopenStubbedSessions(pointerlessTerminalSessions, stubReoffer);
+    const stubCursorHashes = await loadStubCursorHashes(paths, stubReoffer);
     const scan = await scanBackfillSessions({
         command,
         homeDir: command.homeDir ?? os.homedir(),
@@ -73,6 +75,8 @@ export async function scanBackfillRun(command, io, now) {
         window: scope.window,
         cursor,
         pointerlessTerminalSessions,
+        stubReoffer,
+        stubCursorHashes,
         now,
     });
     const reasonCounts = await auditScannedCandidates(scan, worktreeDiscovery.incomplete_reasons);
@@ -129,9 +133,19 @@ async function scanBackfillSessions(options) {
     const claudeAttribution = options.sources.includes("claude_code")
         ? await scanClaudeHistory(options, claudeProjectsDir, scanLimit)
         : null;
+    // BLI-11119: a stubbed session is found by the id in its content or by the
+    // file hash its cursor entry recorded, across every root the scan walked.
+    const scanned = locateStubbedSessions({
+        plan: options.stubReoffer,
+        candidates: [
+            ...(codexAttribution?.results.map(normalizeCodexCandidate) ?? []),
+            ...(claudeAttribution?.results.map(normalizeClaudeCandidate) ?? []),
+        ],
+        cursorHashes: options.stubCursorHashes,
+        sinceMinutes: options.window.since_minutes,
+    });
     const selection = selectBackfillCandidates({
-        codexAttribution,
-        claudeAttribution,
+        scanned,
         cursor: options.cursor,
         pointerlessTerminalSessions: options.pointerlessTerminalSessions,
         maxFiles: options.command.maxFiles,
@@ -201,10 +215,7 @@ async function scanClaudeHistory(request, projectsDir, scanLimit) {
  * so a `--max-files` cap spends its budget on them before newer history.
  */
 function selectBackfillCandidates(options) {
-    const allCandidates = [
-        ...(options.codexAttribution?.results.map(normalizeCodexCandidate) ?? []),
-        ...(options.claudeAttribution?.results.map(normalizeClaudeCandidate) ?? []),
-    ]
+    const allCandidates = options.scanned
         .filter((candidate) => !options.onlySessions ||
         options.onlySessions.has(stubSessionKey(candidate.source, candidate.session_id)))
         .filter((candidate) => isAfterCursor(candidate, options.cursor) ||
@@ -266,6 +277,7 @@ function normalizeCodexCandidate(result) {
     return {
         source: "codex",
         session_id: result.codex_session_id,
+        session_id_source: result.session_id_source,
         file_path: result.file_path,
         state: result.state,
         reason: result.reason,

package/dist/commands/backfill-stub-locate.js

@@ -0,0 +1,104 @@
+/**
+ * Where on this machine is the transcript behind a stub? (BLI-11119)
+ *
+ * The stubs door names a session by the id inside its object key, and the
+ * collector wrote that key with the id it read from the transcript's CONTENT
+ * (`session_meta.id` for Codex). A rollout's file name does not always carry
+ * that id: a resumed or forked session is filed as
+ * `rollout-<time>-<parent>_<child>.jsonl` while its first line names another
+ * id, and Codex moves files from `sessions/` into `archived_sessions/`. So a
+ * stubbed session is located the way it was keyed, across every root the scan
+ * walked, never by file name alone:
+ *
+ * 1. a scanned session whose id matches (`found_by: session_meta`, or
+ *    `file_name` when the file's first line gave no id and the scan fell back
+ *    to the name, which is then the id the key used too);
+ * 2. otherwise a scanned file whose sha256 equals the cursor entry's
+ *    `file_hash_sha256` for that session (`found_by: file_hash`); it is offered
+ *    under the STUBBED session's id, because the server retires a stub only for
+ *    a successor that names the same session;
+ * 3. otherwise `not_found`, recorded on the cursor so the scheduled sync stops
+ *    rescanning history for it every tick (see `sync-stub-heal.ts`).
+ */
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { stubSessionKey } from "../evidence-stubs-client.js";
+/** How many per-session lines the locate log carries; the counts cover the rest. */
+const LOGGED_SESSION_LIMIT = 25;
+/** `codex:<id>` -> the file hash the cursor last recorded for that stubbed session. */
+export async function loadStubCursorHashes(paths, plan) {
+    const hashes = new Map();
+    if (plan.sessions.size === 0)
+        return hashes;
+    for (const source of ["codex", "claude_code"]) {
+        const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
+        const cursor = await readRawEvidenceCursor(paths, { filename }).catch(() => null);
+        if (!cursor)
+            continue;
+        for (const key of plan.sessions.keys()) {
+            if (!key.startsWith(`${source}:`))
+                continue;
+            const hash = cursor.sessions[key.slice(source.length + 1)]?.file_hash_sha256;
+            if (hash)
+                hashes.set(key, hash);
+        }
+    }
+    return hashes;
+}
+/**
+ * Match every stubbed session to a scanned file, record how on `plan.found_by`,
+ * and return the scanned candidates plus one candidate per hash match, carrying
+ * the stubbed session's id. Logs the outcome, found or not.
+ */
+export function locateStubbedSessions(options) {
+    const { plan } = options;
+    if (plan.sessions.size === 0)
+        return options.candidates;
+    const byKey = new Map();
+    const byHash = new Map();
+    for (const candidate of options.candidates) {
+        byKey.set(stubSessionKey(candidate.source, candidate.session_id), candidate);
+        if (candidate.content_hash_sha256) {
+            const hashKey = `${candidate.source}:${candidate.content_hash_sha256}`;
+            if (!byHash.has(hashKey))
+                byHash.set(hashKey, candidate);
+        }
+    }
+    const extra = [];
+    const sessions = [];
+    for (const key of plan.sessions.keys()) {
+        const found = locateOne(key, byKey, byHash, options.cursorHashes);
+        plan.found_by.set(key, found.foundBy);
+        if (found.candidate)
+            extra.push(found.candidate);
+        sessions.push({ session: key, found_by: found.foundBy });
+    }
+    const counts = { session_meta: 0, file_name: 0, file_hash: 0, not_found: 0 };
+    for (const session of sessions)
+        counts[session.found_by] += 1;
+    console.error("[backfill] stubbed sessions located", JSON.stringify({
+        reason: counts.not_found === sessions.length ? "stub_sessions_not_found" : "stub_sessions_located",
+        sessions: sessions.length,
+        ...counts,
+        scanned_candidates: options.candidates.length,
+        since_minutes: options.sinceMinutes,
+        found_by: sessions.slice(0, LOGGED_SESSION_LIMIT),
+    }));
+    return extra.length > 0 ? [...options.candidates, ...extra] : options.candidates;
+}
+function locateOne(key, byKey, byHash, cursorHashes) {
+    const byId = byKey.get(key);
+    if (byId) {
+        const fromContent = byId.source === "codex" && byId.session_id_source === "session_meta";
+        return { foundBy: fromContent ? "session_meta" : "file_name" };
+    }
+    const at = key.indexOf(":");
+    const source = key.slice(0, at);
+    const hash = cursorHashes.get(key);
+    const byContent = hash ? byHash.get(`${source}:${hash}`) : undefined;
+    if (!byContent)
+        return { foundBy: "not_found" };
+    return {
+        foundBy: "file_hash",
+        candidate: { ...byContent, session_id: key.slice(at + 1), session_id_source: undefined },
+    };
+}

package/dist/commands/backfill-stub-reoffer.js

@@ -1,10 +1,18 @@
 import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { markCursorEntryStubbed } from "../cursors/raw-evidence-stub-entry.js";
 import { fetchStubbedSessions, stubSessionKey } from "../evidence-stubs-client.js";
 import { describeError } from "../health-detail.js";
 import { readLocalCollectorSessionFile } from "../local-state.js";
 import { candidateCursorKey } from "./backfill-candidates.js";
 export function emptyStubReofferPlan(reason) {
-    return { status: "skipped", reason, sessions: new Map(), stub_count: 0, marked_local_sessions: 0 };
+    return {
+        status: "skipped",
+        reason,
+        sessions: new Map(),
+        stub_count: 0,
+        marked_local_sessions: 0,
+        found_by: new Map(),
+    };
 }
 /** Ask the server which of this operator's pointers are stubs. Never throws; writes nothing. */
 export async function loadStubReofferPlan(options) {
@@ -25,6 +33,7 @@ export async function loadStubReofferPlan(options) {
         sessions,
         stub_count: answer.unique_stub_count,
         marked_local_sessions: 0,
+        found_by: new Map(),
     };
 }
 /**
@@ -34,7 +43,7 @@ export async function loadStubReofferPlan(options) {
 export async function markStubReoffers(paths, plan, now) {
     if (plan.sessions.size === 0)
         return;
-    plan.marked_local_sessions = await markStubbedSessions(paths, plan.sessions, now);
+    plan.marked_local_sessions = await markStubbedSessions(paths, plan, now);
 }
 /** Reopen stubbed sessions exactly like pointer-less ones: selected past the cursor, sorted first. */
 export function reopenStubbedSessions(reopen, plan) {
@@ -67,6 +76,7 @@ export function summarizeStubReoffer(plan, candidates, durableCandidateKeys = ne
         reoffered_sessions: reoffered,
         reoffered_stubs: stubsOf(offered.filter((candidate) => attempted.includes(candidate))),
         replaced_stubs: stubsOf(offered.filter((candidate) => durableCandidateKeys.has(candidateCursorKey(candidate)))),
+        found_by: countFoundBy(plan),
     };
     if (plan.sessions.size > 0) {
         console.error("[backfill] redaction-stubbed sessions re-offered", JSON.stringify({
@@ -79,20 +89,43 @@ export function summarizeStubReoffer(plan, candidates, durableCandidateKeys = ne
     }
     return summary;
 }
-async function markStubbedSessions(paths, sessions, now) {
+function countFoundBy(plan) {
+    const counts = { session_meta: 0, file_name: 0, file_hash: 0, not_found: 0 };
+    for (const method of plan.found_by.values())
+        counts[method] += 1;
+    return counts;
+}
+/**
+ * Mark every door-named session this cursor tracks, and make its entry tell
+ * the truth (BLI-11119): an entry written before the stub rule existed claimed
+ * the full file as uploaded. The door is the source of truth, so each such
+ * entry is reconciled to `stubbed: true` with the marker's bytes, counted and
+ * logged as `stub_cursor_reconciled`. A session the scan could not find in any
+ * root keeps `not_found_at`, so the scheduled sync waits before looking again.
+ */
+async function markStubbedSessions(paths, plan, now) {
     let marked = 0;
+    let reconciled = 0;
     for (const source of ["codex", "claude_code"]) {
         const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
         try {
             const cursor = await readRawEvidenceCursor(paths, { filename });
             let changed = false;
-            for (const [key, pointerIds] of sessions) {
+            for (const [key, pointerIds] of plan.sessions) {
                 if (!key.startsWith(`${source}:`))
                     continue;
                 const entry = cursor.sessions[key.slice(source.length + 1)];
                 if (!entry)
                     continue;
-                entry.stub_reoffer = { reason: "stub_reoffered", stub_pointer_ids: pointerIds, marked_at: now.toISOString() };
+                const notFound = plan.found_by.get(key) === "not_found";
+                entry.stub_reoffer = {
+                    reason: "stub_reoffered",
+                    stub_pointer_ids: pointerIds,
+                    marked_at: now.toISOString(),
+                    ...(notFound ? { not_found_at: now.toISOString() } : {}),
+                };
+                if (markCursorEntryStubbed(entry))
+                    reconciled += 1;
                 changed = true;
                 marked += 1;
             }
@@ -105,5 +138,6 @@ async function markStubbedSessions(paths, sessions, now) {
             console.error("[backfill] stub mark not written to the cursor", JSON.stringify({ reason: "stub_mark_write_failed", source, ...describeError(error) }));
         }
     }
+    console.error("[backfill] stubbed sessions' cursor entries reconciled with the stubs door", JSON.stringify({ reason: "stub_cursor_reconciled", count: reconciled, marked_local_sessions: marked }));
     return marked;
 }

package/dist/commands/local-args-collector-sources.js

@@ -0,0 +1,27 @@
+/**
+ * `cockpit sources check [--older-than <days>] [--json]` (BLI-11122).
+ *
+ * One verb, read-only. There is deliberately no `sources clean` and no
+ * `--apply`: Tower never deletes a person's raw transcripts; deleting one is
+ * the person's own act, outside Tower. A path is never accepted: the roots are
+ * the ones the collector reads (`sources-discovery.ts`).
+ */
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
+export function parseSourcesArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: ["--older-than", "--home", "--dashboard-url", "--json"],
+        valueFlags: ["--older-than", "--home", "--dashboard-url"],
+    });
+    const action = values.positionals[0] ?? "check";
+    if (action !== "check" || values.positionals.length > 1) {
+        throw new Error("sources has one verb: `cockpit sources check [--older-than <days>] [--json]`.");
+    }
+    return {
+        kind: "sources",
+        action: "check",
+        olderThanDays: optionalPositiveInteger(values.flags.get("--older-than"), "--older-than") ?? null,
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/local-args-collector.js

@@ -26,4 +26,5 @@
  */
 export { parseOnboardArgs, parseUpdateArgs, parseDoctorArgs, parseInstallArgs, parseReleaseArgs, parseLoginArgs, parseLogoutArgs, } from "./local-args-collector-setup.js";
 export { parseStartArgs, parseSyncArgs, parseAnalyzeArgs, parseBackfillArgs, } from "./local-args-collector-work.js";
-export { parseStatusArgs, parseSessionsArgs, parseServeArgs, parseAutostartArgs, parseAgentRulesArgs, parseMemoryArgs, parseCleanArgs, } from "./local-args-collector-status.js";
+export { parseStatusArgs, parseSessionsArgs, parseServeArgs, parseAutostartArgs, parseAgentRulesArgs, parseMemoryArgs, parseCleanArgs, } from "./local-args-collector-status.js";
+export { parseSourcesArgs } from "./local-args-collector-sources.js";

package/dist/commands/local-args.js

@@ -17,7 +17,7 @@
  */
 import { parseRootsArgs } from "./roots.js";
 import { SURFACE_ALIASES } from "./local-help.js";
-import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
+import { parseAgentRulesArgs, parseAnalyzeArgs, parseAutostartArgs, parseBackfillArgs, parseCleanArgs, parseDoctorArgs, parseInstallArgs, parseLoginArgs, parseMemoryArgs, parseLogoutArgs, parseOnboardArgs, parseReleaseArgs, parseServeArgs, parseSessionsArgs, parseSourcesArgs, parseStartArgs, parseStatusArgs, parseSyncArgs, parseUpdateArgs, } from "./local-args-collector.js";
 import { parseBriefArgs, parseCorrectArgs, parseDocsArgs, parseIssueArgs, parseJarvisArgs, parseMailArgs, parseCalArgs, parseModelArgs, parseMsgArgs, parseNotesArgs, parseOpsArgs, parseProjectArgs, parseModelsArgs, parseScoutArgs, parseSearchArgs, parseSettingsArgs, parseSlackArgs, parseTeamArgs, parseWorkbookArgs, parseUsageArgs, parseCareersArgs, } from "./local-args-tower.js";
 // `normalizeUrl` has always been part of this module's surface — `local.ts` and
 // `local-auth.ts` import it from here — so it stays exported from this address
@@ -107,6 +107,8 @@ export function parseLocalArgs(argv) {
             return parseMemoryArgs(argv.slice(1));
         case "clean":
             return parseCleanArgs(argv.slice(1));
+        case "sources":
+            return parseSourcesArgs(argv.slice(1));
         case "docs":
             return parseDocsArgs(argv.slice(1));
         case "msg":

package/dist/commands/local-help-commands.js

@@ -366,6 +366,20 @@ export function localSubcommandHelp(command) {
                 "laptop that has been off.",
             ],
         ],
+        [
+            "sources",
+            [
+                "Usage: cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
+                "",
+                "Answers, for every Codex and Claude transcript on this machine, whether Tower",
+                "holds it: stored in full, stored in part, or not stored, with the reason.",
+                "--older-than <days> checks only files not modified in that many days.",
+                "--json lists every file with its path, verdict and reason.",
+                "Read-only. Tower never deletes these files; deleting one is your own act.",
+                "Before deleting any transcript by hand, run this and delete only files it",
+                "answers \"stored in full\". See docs/runbooks/freeing-disk-on-a-collector-machine.md.",
+            ],
+        ],
         [
             "release",
             [

package/dist/commands/local-help.js

@@ -65,6 +65,7 @@ export const rootCommandNames = new Set([
     "agent-rules",
     "memory",
     "clean",
+    "sources",
     "docs",
     "msg",
     "issue",
@@ -117,6 +118,7 @@ export function localCommandHelp(command) {
         "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
         "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
         "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
+        "  cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
         "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
         "  cockpit msg [channels|create <name>|dm <email>|read <channel>|send <channel>|thread <id> --channel <channel>] [--private] [--members a@x,b@y] [--description <text>] [--thread <id>] [--limit <n>] [--dashboard-url <url>] [--json]",
         "  cockpit issue [list|show <BLI-id>|create --title <t>|update <BLI-id>|move <BLI-id> <state>|comment <BLI-id>|history <BLI-id>] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] [--priority 0-4] [--size S|M|L] [--parent <BLI-id>] [--file <path>|--body-stdin] [--dashboard-url <url>] [--json]",

package/dist/commands/local.js

@@ -37,6 +37,7 @@ import { runMemoryLog } from "./memory-log.js";
 import { runMemoryInstall } from "./memory-install.js";
 import { runMemoryStore, runMemoryVerbList } from "./memory-store.js";
 import { runClean } from "./clean.js";
+import { runSourcesCheck } from "./sources-check.js";
 import { runDocs } from "./docs.js";
 import { runMsg } from "./msg.js";
 import { runIssue } from "./issue.js";
@@ -213,6 +214,8 @@ export async function runLocalCockpitCli(argv, io = defaultIo()) {
                 return await runMemoryStore(command, io);
             case "clean":
                 return await runClean(command, io);
+            case "sources":
+                return await runSourcesCheck(command, io);
             case "docs":
                 return await runDocs(command, io);
             case "msg":

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.157");
+    writeLine(io?.stdout ?? process.stdout, "0.2.159");
     return 0;
   }
 

package/dist/commands/session-sync-record.js

@@ -11,6 +11,7 @@ import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConf
 import { normalizeDashboardUrl } from "../upload-http.js";
 import { flushPendingCodexSessionReports, queueCodexSessionReport, } from "../upload.js";
 import { CLAUDE_CURSOR_FILENAME, countStaleSessions, readRawEvidenceCursor, recordSessionObservation, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { isRedactionStubObjectKey, markCursorEntryStubbed } from "../cursors/raw-evidence-stub-entry.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
 import { liveSyncCursorEntryRequiresRetry } from "./session-sync-attribution.js";
 /**
@@ -331,5 +332,16 @@ function recordSourceObservation(options, result) {
         uploaded_byte_size: uploadedByteSize,
         last_seen_at: options.now.toISOString(),
     };
+    // BLI-11119: a pointer that is the redaction-crash marker is not a delivery.
+    // The entry records the marker's bytes, and keeps the re-offer mark while
+    // the stub still stands.
+    if (isRedactionStubObjectKey(uploadedObjectKey)) {
+        markCursorEntryStubbed(entry);
+        if (prior?.stub_reoffer)
+            entry.stub_reoffer = prior.stub_reoffer;
+        if (uploadedThisSync) {
+            console.error("[collector sync] session delivered only as a redaction-crash stub", JSON.stringify({ reason: "stub_cursor_recorded", source: options.source, byte_size: result.byte_size }));
+        }
+    }
     recordSessionObservation(options.cursor, sessionId, entry);
 }

package/dist/commands/sources-check.js

@@ -0,0 +1,135 @@
+import { writeLine } from "./cli-io.js";
+import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
+import { fetchTranscriptObjects } from "../evidence-transcripts-client.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
+import { discoverLocalTranscripts } from "./sources-discovery.js";
+import { fileFacts, judgeSource } from "./sources-verdict.js";
+const VERDICTS = ["stored_full", "stored_partial", "not_stored"];
+const DAY_MS = 24 * 60 * 60 * 1000;
+export async function runSourcesCheck(command, io, now = new Date()) {
+    const startedAt = Date.now();
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
+    const session = await readLocalCollectorSessionFile(paths).catch(() => null);
+    if (!session || session.session_state !== "valid" || typeof session.device_token !== "string" || !session.device_token) {
+        console.error("[collector sources] check not run", JSON.stringify({ reason: "collector_not_paired" }));
+        return fail(io, command, "collector_not_paired", "This machine is not signed in to Tower, so Tower cannot be asked. Run `cockpit doctor`.");
+    }
+    const remote = await fetchTranscriptObjects({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
+    if (remote.status === "unavailable") {
+        console.error("[collector sources] check not answered", JSON.stringify({ reason: `transcript_door_unavailable:${remote.reason}` }));
+        return fail(io, command, `transcript_door_unavailable:${remote.reason}`, `Tower could not be asked which transcripts it holds (${remote.reason}). No file is answered; nothing here means "not stored".`);
+    }
+    const homeDir = command.homeDir ?? paths.home_dir;
+    const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs });
+    const cursors = {
+        codex: await readRawEvidenceCursor(paths),
+        claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
+    };
+    const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
+    for (const file of local.files) {
+        const judged = await judgeSource({
+            file,
+            remotes: remote.files.get(file.key) ?? [],
+            cursorEntry: file.kind === "claude_subagent" ? null : (cursors[file.source].sessions[file.session_id] ?? null),
+            facts: fileFacts(file),
+        }).catch((error) => {
+            report.local.unreadable += 1;
+            console.error("[collector sources] a transcript could not be judged; left out of the answer", JSON.stringify({ reason: "file_unreadable", kind: file.kind, byte_size: file.byte_size, error_name: error?.name ?? "Error" }));
+            return null;
+        });
+        if (!judged)
+            continue;
+        report.local.examined += 1;
+        report.counts[judged.verdict].files += 1;
+        report.counts[judged.verdict].bytes += file.byte_size;
+        report.reasons[judged.reason] = (report.reasons[judged.reason] ?? 0) + 1;
+        report.files.push({
+            path: file.file_path,
+            source: file.source,
+            kind: file.kind,
+            session_id: file.session_id,
+            byte_size: file.byte_size,
+            modified_at: new Date(file.mtime_ms).toISOString(),
+            verdict: judged.verdict,
+            reason: judged.reason,
+            remote_byte_size: judged.remote_byte_size,
+        });
+    }
+    report.files.sort((a, b) => VERDICTS.indexOf(a.verdict) - VERDICTS.indexOf(b.verdict) || a.path.localeCompare(b.path));
+    // Counts and bytes only: never a path, a session id or a byte of content.
+    console.error("[collector sources] check", JSON.stringify({
+        reason: `sources_check_${report.status}`,
+        older_than_days: report.older_than_days,
+        remote_status: remote.status,
+        remote_unique: remote.unique,
+        examined: report.local.examined,
+        newer_skipped: report.local.newer_skipped,
+        unreadable: report.local.unreadable,
+        stored_full: report.counts.stored_full,
+        stored_partial: report.counts.stored_partial,
+        not_stored: report.counts.not_stored,
+        reasons: report.reasons,
+        elapsed_ms: Date.now() - startedAt,
+    }));
+    if (command.json)
+        writeLine(io.stdout, JSON.stringify(report, null, 2));
+    else
+        for (const line of sourcesCheckLines(report))
+            writeLine(io.stdout, line);
+    return 0;
+}
+function emptyReport(command, remote, newerSkipped, unreadable) {
+    const { files, ...remoteCounts } = remote;
+    return {
+        status: remote.status === "exhausted" ? "complete" : "incomplete",
+        reason: remote.status === "exhausted" ? "ok" : `transcript_list_${remote.status}${remote.reason === "ok" ? "" : `:${remote.reason}`}`,
+        older_than_days: command.olderThanDays,
+        remote: { ...remoteCounts, file_count: files.size },
+        local: { examined: 0, newer_skipped: newerSkipped, unreadable },
+        counts: {
+            stored_full: { files: 0, bytes: 0 },
+            stored_partial: { files: 0, bytes: 0 },
+            not_stored: { files: 0, bytes: 0 },
+        },
+        reasons: {},
+        files: [],
+    };
+}
+function fail(io, command, reason, sentence) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ status: "unavailable", reason, older_than_days: command.olderThanDays }, null, 2));
+    }
+    else {
+        writeLine(io.stderr, sentence);
+    }
+    return 1;
+}
+/** What a person reads: counts and bytes per verdict, then why. Paths only with --json. */
+export function sourcesCheckLines(report) {
+    const scope = report.older_than_days === null ? "every transcript" : `transcripts not modified in ${report.older_than_days} days`;
+    const lines = [
+        `Tower sources check: ${scope} on this machine`,
+        `  stored in full   ${report.counts.stored_full.files} file(s), ${mb(report.counts.stored_full.bytes)} MB`,
+        `  stored in part   ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
+        `  not stored       ${report.counts.not_stored.files} file(s), ${mb(report.counts.not_stored.bytes)} MB`,
+    ];
+    const reasons = Object.entries(report.reasons).sort((a, b) => b[1] - a[1]);
+    if (reasons.length > 0)
+        lines.push(`  why              ${reasons.map(([reason, count]) => `${reason} ${count}`).join(", ")}`);
+    if (report.local.newer_skipped > 0)
+        lines.push(`  newer            ${report.local.newer_skipped} file(s) modified inside the window, not checked`);
+    if (report.local.unreadable > 0)
+        lines.push(`  unreadable       ${report.local.unreadable} file(s) could not be read and are not answered`);
+    lines.push(`  Tower's list     ${report.remote.status}: ${report.remote.unique} current transcript object(s) over ${report.remote.pages} page(s)`);
+    if (report.status === "incomplete") {
+        lines.push(`  INCOMPLETE       Tower's list was cut short (${report.reason}); "not stored" and "stored in part" may be understated. Run it again.`);
+    }
+    lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand; see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
+    return lines;
+}
+function mb(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}

package/dist/commands/sources-discovery.js

@@ -0,0 +1,232 @@
+/**
+ * Every agent transcript on this machine, named the way the collector names
+ * its upload (BLI-11122).
+ *
+ * `cockpit sources check` has to pair each local file with the object Tower
+ * holds for it, and an object key carries the session id the collector read
+ * from the transcript's CONTENT, not its file name (a resumed or forked Codex
+ * rollout is filed under one id and names another; see
+ * `backfill-stub-locate.ts`). So each file is named by the same rules the
+ * readers use, kept here as pure functions so both path layouts (macOS and
+ * Windows) are testable without either file system:
+ *
+ * - Codex (`~/.codex/sessions/**`, `~/.codex/archived_sessions/**`): the first
+ *   `session_meta` record's `payload.id`, else the uuid in the file name, else
+ *   a hash of the path (`codex-attribution.ts`).
+ * - Claude main (`~/.claude/projects/<project>/<uuid>.jsonl`): the first
+ *   record's `sessionId`, else the file name's uuid (`claude-attribution-score.ts`).
+ * - Claude subagent (`<project>/<uuid>/subagents/agent-*.jsonl`): the main's
+ *   session id plus the file stem (`raw-evidence-claude-reader.ts`).
+ *
+ * This module reads files and never writes, moves or deletes one.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createReadStream } from "node:fs";
+import readline from "node:readline";
+import { transcriptFileKey } from "@bli-cockpit/telemetry-core";
+import { SESSION_FILE_UUID_PATTERN, sanitizeSessionId, sessionIdFromFileName, shortHash, } from "../adapters/attribution-core.js";
+import { isSecretLikePath, safeKeySegment } from "../adapters/raw-evidence-keys.js";
+import { describeError } from "../health-detail.js";
+export function sourcesRoots(homeDir, pathApi = path) {
+    return {
+        codex: [
+            pathApi.join(homeDir, ".codex", "sessions"),
+            pathApi.join(homeDir, ".codex", "archived_sessions"),
+        ],
+        claudeProjects: pathApi.join(homeDir, ".claude", "projects"),
+    };
+}
+/** Which kind of transcript a path is, or null for anything the collector does not upload as one. */
+export function classifyTranscriptPath(filePath, roots, pathApi = path) {
+    if (!filePath.toLowerCase().endsWith(".jsonl"))
+        return null;
+    for (const root of roots.codex) {
+        const rel = pathApi.relative(root, filePath);
+        if (rel && !rel.startsWith("..") && !pathApi.isAbsolute(rel))
+            return { kind: "codex_rollout" };
+    }
+    const rel = pathApi.relative(roots.claudeProjects, filePath);
+    if (!rel || rel.startsWith("..") || pathApi.isAbsolute(rel))
+        return null;
+    const parts = rel.split(pathApi.sep);
+    if (parts.length === 2 && SESSION_FILE_UUID_PATTERN.test(parts[1]))
+        return { kind: "claude_main" };
+    if (parts.length === 4 && parts[2] === "subagents" && parts[3].startsWith("agent-")) {
+        return {
+            kind: "claude_subagent",
+            main_session_dir: parts[1],
+            sidecar_stem: parts[3].replace(/\.jsonl$/i, ""),
+        };
+    }
+    return null;
+}
+/** The session id a reader would key this file's session by, from its content id when it has one. */
+export function sessionIdFor(filePath, contentId, pathApi = path) {
+    const fromContent = sanitizeSessionId(contentId ?? undefined);
+    if (fromContent)
+        return { session_id: fromContent, session_id_source: "content" };
+    const fromName = sessionIdFromFileName(pathApi.basename(filePath));
+    if (fromName)
+        return { session_id: fromName, session_id_source: "file_name" };
+    return { session_id: shortHash(filePath), session_id_source: "path_hash" };
+}
+/** The key of the object a file would be uploaded as; see `raw-evidence-*-reader.ts`. */
+export function transcriptKeyFor(source, sessionId, sidecarStem) {
+    const identity = {
+        source,
+        session_id: safeKeySegment(sessionId),
+        sidecar: sidecarStem === null ? null : isSecretLikePath(sidecarStem) ? "redacted-file-name" : safeKeySegment(sidecarStem),
+    };
+    return transcriptFileKey(identity);
+}
+/**
+ * The first content id in a transcript: Codex's first `session_meta`
+ * `payload.id`, Claude's first `sessionId`. Streams line by line and stops at
+ * the first hit; a line that does not parse is skipped, as the readers do.
+ */
+export async function readContentSessionId(filePath, source) {
+    const stream = createReadStream(filePath, { encoding: "utf8" });
+    const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of lines) {
+            const id = contentIdFromLine(line, source);
+            if (id)
+                return id;
+        }
+        return null;
+    }
+    finally {
+        lines.close();
+        stream.destroy();
+    }
+}
+export function contentIdFromLine(line, source) {
+    if (!line.trim())
+        return null;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        return null;
+    const entry = record;
+    if (source === "claude_code")
+        return trimmed(entry["sessionId"]);
+    if (entry["type"] !== "session_meta")
+        return null;
+    const payload = entry["payload"];
+    if (!payload || typeof payload !== "object")
+        return null;
+    return trimmed(payload["id"]);
+}
+function trimmed(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+/**
+ * Walk every root, name every transcript. `olderThanMs` keeps only files whose
+ * mtime is before it; the rest are counted, never read.
+ */
+export async function discoverLocalTranscripts(options) {
+    const roots = sourcesRoots(options.homeDir);
+    const result = { files: [], newer_count: 0, directory_read_failed: 0, file_read_failed: 0 };
+    const found = [];
+    let firstFailure = null;
+    const stack = [...roots.codex, roots.claudeProjects];
+    const seen = new Set();
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT") {
+                result.directory_read_failed += 1;
+                firstFailure ??= describeError(error);
+            }
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const shape = classifyTranscriptPath(full, roots);
+            if (!shape || seen.has(full))
+                continue;
+            seen.add(full);
+            const stat = await fs.stat(full).catch((error) => {
+                result.file_read_failed += 1;
+                firstFailure ??= describeError(error);
+                return null;
+            });
+            if (!stat)
+                continue;
+            if (options.olderThanMs !== null && stat.mtimeMs >= options.olderThanMs) {
+                result.newer_count += 1;
+                continue;
+            }
+            found.push({ file: full, size: stat.size, mtimeMs: stat.mtimeMs, shape });
+        }
+    }
+    // Claude mains first, so a subagent file can take its main's content id.
+    const claudeMainIds = new Map();
+    found.sort((a, b) => shapeOrder(a.shape) - shapeOrder(b.shape) || a.file.localeCompare(b.file));
+    for (const item of found) {
+        const source = item.shape.kind === "codex_rollout" ? "codex" : "claude_code";
+        let contentId = null;
+        if (item.shape.kind !== "claude_subagent") {
+            const read = await readContentSessionId(item.file, source).then((id) => ({ ok: true, id }), (error) => {
+                result.file_read_failed += 1;
+                firstFailure ??= describeError(error);
+                return { ok: false, id: null };
+            });
+            if (!read.ok)
+                continue;
+            contentId = read.id;
+        }
+        let named;
+        if (item.shape.kind === "claude_subagent") {
+            // The reader keys a subagent file under its MAIN session's id.
+            const mainPath = path.join(path.dirname(path.dirname(path.dirname(item.file))), `${item.shape.main_session_dir}.jsonl`);
+            const known = claudeMainIds.get(mainPath);
+            named = known
+                ? { session_id: known, session_id_source: "content" }
+                : sessionIdFor(mainPath, await readContentSessionId(mainPath, "claude_code").catch(() => null));
+        }
+        else {
+            named = sessionIdFor(item.file, contentId);
+            if (item.shape.kind === "claude_main")
+                claudeMainIds.set(item.file, named.session_id);
+        }
+        result.files.push({
+            source,
+            kind: item.shape.kind,
+            file_path: item.file,
+            byte_size: item.size,
+            mtime_ms: item.mtimeMs,
+            ...named,
+            key: transcriptKeyFor(source, named.session_id, item.shape.kind === "claude_subagent" ? item.shape.sidecar_stem : null),
+        });
+    }
+    if (result.directory_read_failed > 0 || result.file_read_failed > 0) {
+        console.error("[collector sources] some transcripts could not be read; they are left out of the answer", JSON.stringify({
+            reason: "sources_discovery_incomplete",
+            directory_read_failed: result.directory_read_failed,
+            file_read_failed: result.file_read_failed,
+            found_count: result.files.length,
+            ...(firstFailure ? { first_failure: firstFailure } : {}),
+        }));
+    }
+    return result;
+}
+function shapeOrder(shape) {
+    return shape.kind === "claude_main" ? 0 : shape.kind === "codex_rollout" ? 1 : 2;
+}

package/dist/commands/sources-verdict.js

@@ -0,0 +1,128 @@
+/**
+ * Does Tower hold this transcript, in full, in part, or not at all?
+ * (BLI-11122)
+ *
+ * One file, the current objects Tower lists for it, and this machine's cursor
+ * entry for its session. The rules, cheapest first; every answer names why:
+ *
+ *   not_stored      no current object for the file (`no_object`), or only the
+ *                   redaction-crash stub (`stub_only`): a stub holds no byte.
+ *   stored_full     the cursor's uploaded object is still current, the file
+ *                   is the size it was when uploaded and its hash is the one the
+ *                   cursor last recorded (`unchanged_since_upload`); or the
+ *                   file, redacted exactly as the upload redacts it, has the
+ *                   hash of a current object (`content_hash_match`) or is no
+ *                   larger than one (`remote_at_least_sanitized_size`).
+ *   stored_partial  a current object exists but is smaller than the redacted
+ *                   file (`changed_since_upload` when the cursor saw the file
+ *                   grow after its upload, else `remote_smaller`), or its size
+ *                   is not recorded (`remote_size_unknown`).
+ *
+ * A file too large to redact in memory is compared by its raw size
+ * (`remote_at_least_file_size`). A file whose redaction would crash to the stub
+ * is compared the same way, never by the stub's 42 bytes.
+ *
+ * Read-only: this module reads the file and never writes, moves or deletes it.
+ */
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
+import { sanitizeTextEvidenceForUpload } from "../adapters/raw-evidence-sanitize.js";
+import { isSecretLikePath } from "../adapters/raw-evidence-keys.js";
+export async function judgeSource(input) {
+    const { file, remotes, cursorEntry } = input;
+    if (remotes.length === 0)
+        return { verdict: "not_stored", reason: "no_object", remote_byte_size: null };
+    const held = remotes.filter((remote) => !remote.stub);
+    if (held.length === 0)
+        return { verdict: "not_stored", reason: "stub_only", remote_byte_size: null };
+    const sizes = held.map((remote) => remote.byte_size).filter((size) => size !== null);
+    const best = sizes.length > 0 ? Math.max(...sizes) : null;
+    const full = (reason) => ({ verdict: "stored_full", reason, remote_byte_size: best });
+    const partial = (reason) => ({
+        verdict: "stored_partial",
+        reason,
+        remote_byte_size: best,
+    });
+    if (cursorEntry &&
+        !cursorEntry.stubbed &&
+        cursorEntry.uploaded_object_key &&
+        held.some((remote) => remote.object_key === cursorEntry.uploaded_object_key) &&
+        cursorEntry.uploaded_byte_size === file.byte_size &&
+        cursorEntry.file_hash_sha256 &&
+        cursorEntry.file_hash_sha256 === (await input.facts.rawSha256())) {
+        return full("unchanged_since_upload");
+    }
+    const sanitized = await input.facts.sanitized();
+    if (sanitized) {
+        if (held.some((remote) => remote.content_hash_sha256 === sanitized.sha256))
+            return full("content_hash_match");
+        if (best === null)
+            return partial("remote_size_unknown");
+        if (best >= sanitized.byte_size)
+            return full("remote_at_least_sanitized_size");
+    }
+    else {
+        if (best === null)
+            return partial("remote_size_unknown");
+        if (best >= file.byte_size)
+            return full("remote_at_least_file_size");
+    }
+    const grewAfterUpload = cursorEntry?.uploaded_object_key != null &&
+        cursorEntry.uploaded_byte_size != null &&
+        cursorEntry.uploaded_byte_size < file.byte_size;
+    return partial(grewAfterUpload ? "changed_since_upload" : "remote_smaller");
+}
+/**
+ * Reads the file at most once, on first ask, and redacts it exactly as the
+ * upload does (`raw-evidence-transcript-file.ts`): same sanitizer, same
+ * secret-like-name rule, same byte cap.
+ */
+export function fileFacts(file, maxBytes = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
+    let bytes = null;
+    const read = () => {
+        bytes ??= file.byte_size > maxBytes ? Promise.resolve(null) : fs.readFile(file.file_path);
+        return bytes;
+    };
+    let rawHash = null;
+    let sanitized = null;
+    return {
+        rawSha256() {
+            rawHash ??= read().then(async (buffer) => (buffer ? sha256(buffer) : await streamSha256(file.file_path)));
+            return rawHash;
+        },
+        sanitized() {
+            sanitized ??= read().then((buffer) => {
+                if (!buffer)
+                    return null;
+                const result = sanitizeTextEvidenceForUpload({
+                    text: buffer.toString("utf8"),
+                    originalBytes: buffer,
+                    redactedFields: [`${file.kind === "codex_rollout" ? "codex_jsonl" : file.kind === "claude_main" ? "claude_jsonl" : "claude_jsonl_sidecar"}.body`],
+                    secretLikeFileName: isSecretLikePath(path.basename(file.file_path)),
+                });
+                const hash = sha256(result.bytes);
+                if (hash === REDACTION_STUB_SHA256)
+                    return null;
+                return { sha256: hash, byte_size: result.bytes.byteLength };
+            });
+            return sanitized;
+        },
+    };
+}
+function sha256(buffer) {
+    return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+async function streamSha256(filePath) {
+    const hash = crypto.createHash("sha256");
+    const handle = await fs.open(filePath, "r");
+    try {
+        for await (const chunk of handle.createReadStream())
+            hash.update(chunk);
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+    return hash.digest("hex");
+}

package/dist/commands/sync-stub-heal.js

@@ -8,6 +8,13 @@ import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConf
 /** At most this many stubbed sessions are re-offered per tick (one backfill batch). */
 export const SYNC_STUB_SESSIONS_PER_TICK = 25;
 const DAY_MS = 24 * 60 * 60_000;
+/**
+ * BLI-11119: a stubbed session a re-offer could not find in any root, by
+ * content id or file hash, is looked for again after this long. Without it
+ * every tick rescanned (and hashed) every transcript back to the session's
+ * date for a file that is gone.
+ */
+export const STUB_NOT_FOUND_RETRY_MS = DAY_MS;
 const DEFAULT_DEPS = { runBackfill, loadPlan: loadStubReofferPlan };
 export async function healStubsDuringTick(command, io, deps = DEFAULT_DEPS, now = new Date()) {
     const summary = {
@@ -17,6 +24,7 @@ export async function healStubsDuringTick(command, io, deps = DEFAULT_DEPS, now
         stubs_remaining: 0,
         sessions_local: 0,
         sessions_selected: 0,
+        sessions_not_found_recently: 0,
     };
     try {
         summary.reason = await runStubPass(command, io, deps, now, summary);
@@ -54,13 +62,18 @@ async function runStubPass(command, io, deps, now, summary) {
     summary.sessions_local = local.length;
     if (local.length === 0)
         return "stubs_not_on_this_machine";
-    const selected = local.slice(0, SYNC_STUB_SESSIONS_PER_TICK);
+    const lookable = local.filter((session) => !notFoundRecently(session.notFoundAt, now));
+    summary.sessions_not_found_recently = local.length - lookable.length;
+    if (lookable.length === 0)
+        return "stubs_not_found_recently";
+    const selected = lookable.slice(0, SYNC_STUB_SESSIONS_PER_TICK);
     summary.sessions_selected = selected.length;
     const trimmed = {
         ...plan,
         sessions: new Map(selected.map((session) => [session.key, session.pointerIds])),
         stub_count: selected.reduce((total, session) => total + session.pointerIds.length, 0),
         marked_local_sessions: 0,
+        found_by: new Map(),
     };
     const window = stubWindow(selected, sessionFile.paired_at, now);
     const result = await deps.runBackfill({
@@ -90,11 +103,18 @@ async function locallyTrackedStubSessions(paths, plan) {
         const at = key.indexOf(":");
         const source = key.slice(0, at);
         const entry = cursors[source]?.sessions[key.slice(at + 1)];
-        if (entry)
-            local.push({ key, pointerIds, mtimeMs: entry.file_mtime_ms });
+        if (entry) {
+            local.push({ key, pointerIds, mtimeMs: entry.file_mtime_ms, notFoundAt: entry.stub_reoffer?.not_found_at ?? null });
+        }
     }
     return local;
 }
+function notFoundRecently(notFoundAt, now) {
+    if (!notFoundAt)
+        return false;
+    const at = Date.parse(notFoundAt);
+    return Number.isFinite(at) && now.getTime() - at < STUB_NOT_FOUND_RETRY_MS;
+}
 /**
  * The narrowest backfill window that still reaches every selected session:
  * back to the oldest one's file time plus a day. A backfill window never

package/dist/cursors/raw-evidence-cursor.js

@@ -196,6 +196,7 @@ function parseSessionEntry(value) {
         uploaded_byte_size: optionalNumberOrNull(record["uploaded_byte_size"]),
         last_seen_at: lastSeenAt,
         ...parseStubReoffer(record["stub_reoffer"]),
+        ...(record["stubbed"] === true ? { stubbed: true } : {}),
     };
 }
 function parseStubReoffer(value) {
@@ -208,7 +209,15 @@ function parseStubReoffer(value) {
         : [];
     if (record["reason"] !== "stub_reoffered" || !markedAt || ids.length === 0)
         return {};
-    return { stub_reoffer: { reason: "stub_reoffered", stub_pointer_ids: ids, marked_at: markedAt } };
+    const notFoundAt = optionalString(record["not_found_at"]);
+    return {
+        stub_reoffer: {
+            reason: "stub_reoffered",
+            stub_pointer_ids: ids,
+            marked_at: markedAt,
+            ...(notFoundAt ? { not_found_at: notFoundAt } : {}),
+        },
+    };
 }
 function parseCheckpoints(value) {
     if (!value || typeof value !== "object")

package/dist/cursors/raw-evidence-stub-entry.js

@@ -0,0 +1,39 @@
+/**
+ * A redaction-crash stub is a promise to come back, not a delivery (BLI-11119).
+ *
+ * When the redactor crashed, the collector uploaded the 42-byte marker
+ * `REDACTION_STUB_TEXT` in place of the transcript, and the cursor entry then
+ * recorded the ORIGINAL file size as uploaded. Nothing local ever considered
+ * the session undelivered. This module is the one place a cursor entry is told
+ * the truth about a stub: `stubbed: true`, `uploaded_byte_size` the marker's
+ * 42 bytes, and `byte_offset` 0 because no session byte is durable.
+ *
+ * Two ways a stub is recognised, both deterministic:
+ * - at write time, by the object key: every transcript key's last segment
+ *   starts with the first 16 hex of its content hash (a re-keyed pointer keeps
+ *   that prefix), and the marker always hashes to `REDACTION_STUB_SHA256`;
+ * - after the fact, by the stubs door's answer, which is the source of truth
+ *   for every entry written before this rule existed.
+ */
+import { REDACTION_STUB_BYTE_SIZE, REDACTION_STUB_SHA256, } from "@bli-cockpit/telemetry-core";
+const STUB_KEY_PREFIX = REDACTION_STUB_SHA256.slice(0, 16);
+/** True when this object key names the redaction-crash marker, not a transcript. */
+export function isRedactionStubObjectKey(objectKey) {
+    if (!objectKey)
+        return false;
+    const segment = objectKey.slice(objectKey.lastIndexOf("/") + 1);
+    return segment.startsWith(STUB_KEY_PREFIX);
+}
+/**
+ * Make the entry say what the server holds: a stub. Returns whether anything
+ * changed, so a caller reconciling old entries can count what it corrected.
+ */
+export function markCursorEntryStubbed(entry) {
+    const changed = entry.stubbed !== true ||
+        entry.uploaded_byte_size !== REDACTION_STUB_BYTE_SIZE ||
+        entry.byte_offset !== 0;
+    entry.stubbed = true;
+    entry.uploaded_byte_size = REDACTION_STUB_BYTE_SIZE;
+    entry.byte_offset = 0;
+    return changed;
+}

package/dist/evidence-transcripts-client.js

@@ -0,0 +1,118 @@
+/**
+ * Asks `POST /api/ambient/evidence/transcripts` for every current transcript
+ * object this operator owns, and groups the answer by local transcript file
+ * (BLI-11122). `cockpit sources check` compares each group to the file on disk.
+ *
+ * Never throws. A door that cannot be asked (an older dashboard answers 404, a
+ * network error, a malformed page) returns `unavailable` with the reason and
+ * the check says so instead of guessing.
+ *
+ * Bounded pages of up to 500, walked by the server's keyset cursor, at most
+ * `maxPages` of them. The result says whether the list was exhausted, capped by
+ * `maxPages`, or cut short by a failed page after some landed, and carries the
+ * requested, returned and unique counts so completeness is a number, not a claim.
+ */
+import { EVIDENCE_TRANSCRIPTS_MAX_PAGE, EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION, EvidenceTranscriptsResponseSchema, transcriptFileFromObjectKey, transcriptFileKey, } from "@bli-cockpit/telemetry-core";
+import { describeError } from "./health-detail.js";
+const TRANSCRIPTS_PAGE_TIMEOUT_MS = 30_000;
+/** 400 pages of 500 is 200,000 current transcript objects: far past any operator today. */
+export const TRANSCRIPTS_DEFAULT_MAX_PAGES = 400;
+export async function fetchTranscriptObjects(options) {
+    const maxPages = options.maxPages ?? TRANSCRIPTS_DEFAULT_MAX_PAGES;
+    const pageSize = Math.min(options.pageSize ?? EVIDENCE_TRANSCRIPTS_MAX_PAGE, EVIDENCE_TRANSCRIPTS_MAX_PAGE);
+    const files = new Map();
+    const seen = new Set();
+    let returned = 0;
+    let unkeyed = 0;
+    let pages = 0;
+    let after = null;
+    for (;;) {
+        if (pages >= maxPages)
+            return finish("capped", "ok");
+        const page = await requestPage({ ...options, after, limit: pageSize });
+        if (!page.ok)
+            return finish(pages === 0 ? "unavailable" : "failed_partial", page.reason);
+        pages += 1;
+        for (const object of page.objects) {
+            returned += 1;
+            if (seen.has(object.ref_id))
+                continue;
+            seen.add(object.ref_id);
+            addObject(object);
+        }
+        // Advance by what the server returned; a page that names no cursor is the last.
+        if (!page.nextAfter)
+            return finish("exhausted", "ok");
+        after = page.nextAfter;
+    }
+    function addObject(object) {
+        const identity = transcriptFileFromObjectKey(object.object_key);
+        if (!identity) {
+            unkeyed += 1;
+            return;
+        }
+        const key = transcriptFileKey(identity);
+        const list = files.get(key) ?? [];
+        list.push({
+            object_key: object.object_key,
+            byte_size: object.byte_size,
+            content_hash_sha256: object.content_hash_sha256,
+            stub: object.stub,
+        });
+        files.set(key, list);
+    }
+    function finish(status, reason) {
+        const result = {
+            status,
+            reason,
+            pages,
+            requested: pages * pageSize,
+            returned,
+            unique: seen.size,
+            unkeyed,
+            files,
+        };
+        console.error("[collector sources] transcript objects listed", JSON.stringify({
+            reason: status === "unavailable" ? `transcript_door_unavailable:${reason}` : `transcripts_${status}`,
+            pages,
+            requested: result.requested,
+            returned,
+            unique: seen.size,
+            unkeyed,
+            file_count: files.size,
+            ...(status === "failed_partial" ? { failure: reason } : {}),
+        }));
+        return result;
+    }
+}
+async function requestPage(options) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), TRANSCRIPTS_PAGE_TIMEOUT_MS);
+    try {
+        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/transcripts`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${options.deviceToken}`,
+            },
+            body: JSON.stringify({
+                schema_version: EVIDENCE_TRANSCRIPTS_SCHEMA_VERSION,
+                after: options.after,
+                limit: options.limit,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return { ok: false, reason: `http_${response.status}` };
+        const parsed = EvidenceTranscriptsResponseSchema.safeParse(await response.json().catch(() => null));
+        if (!parsed.success)
+            return { ok: false, reason: "invalid_response" };
+        return { ok: true, objects: parsed.data.objects, nextAfter: parsed.data.next_after };
+    }
+    catch (error) {
+        return { ok: false, reason: describeError(error).error_name };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.157",
+  "version": "0.2.159",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.42",
-    "@bli-cockpit/mcp": "0.1.76",
-    "@bli-cockpit/telemetry-core": "0.1.54"
+    "@bli-cockpit/memory-mcp": "0.1.43",
+    "@bli-cockpit/mcp": "0.1.77",
+    "@bli-cockpit/telemetry-core": "0.1.55"
   }
 }