@bli-cockpit/cli 0.2.168 → 0.2.173

package/dist/adapters/raw-evidence-collection-state.js

@@ -26,7 +26,8 @@ import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core"
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, } from "../raw-evidence-staging.js";
+import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, terminalDeliveryReason, } from "../raw-evidence-staging.js";
+import { admitToStaging, openStagingAllowance, } from "../staging-gate.js";
 import { chmodPrivate } from "./raw-evidence-pack-store.js";
 import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, } from "./raw-evidence-git-diff.js";
 export const DEFAULT_SINCE_MINUTES = 24 * 60;
@@ -54,6 +55,11 @@ export async function openCollection(context, options, places) {
     const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
     const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
     const staging = await readRawEvidenceStagingState(options.stateDir);
+    const budget = options.budget ?? {
+        remainingBytes: byteBudget,
+        remainingObjects: objectBudget,
+    };
+    const stagingAllowance = (budget.staging ??= await openStagingAllowance(options.stateDir, options.env ?? process.env, { statfs: options.statfs }));
     return {
         context,
         filesDir: path.join(places.stagingDir, "files"),
@@ -71,14 +77,16 @@ export async function openCollection(context, options, places) {
         redacted: [],
         reused: [],
         scanned: new Map(),
-        caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
+        caps: startingCaps({
+            byteBudget,
+            objectBudget,
+            budget: options.budget,
+            stagingCapBytes: stagingAllowance.snapshot.cap_bytes,
+        }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
         priorSnapshots: options.priorSnapshots ?? new Map(),
         stubReoffers: options.stubReoffers ?? new Map(),
-        budget: options.budget ?? {
-            remainingBytes: byteBudget,
-            remainingObjects: objectBudget,
-        },
+        budget,
         index: { value: 0 },
     };
 }
@@ -118,6 +126,12 @@ function startingCaps(options) {
             observed: options.budget?.remainingObjects ?? options.objectBudget,
             applied: false,
         },
+        {
+            source: "raw_evidence",
+            cap_type: "staging_gate",
+            limit: options.stagingCapBytes,
+            applied: false,
+        },
         {
             source: "git_diff",
             cap_type: "max_bytes_per_diff",
@@ -185,6 +199,38 @@ export async function stageEvidenceBytes(collection, options) {
     collection.stagedNewCount += 1;
     return { local_path: destination, staged_in_pack: true };
 }
+/**
+ * The one door a file passes before its bytes may be copied: the per-sync
+ * budget below, then the disk (BLI-12832). A refusal from the disk hands the
+ * budget back, because nothing was staged and the next tick re-reads the source.
+ * A copy already staged costs the disk nothing and is never refused by it.
+ */
+export function admitEvidence(collection, byteLength, file) {
+    const budgetReason = admitToBudget(collection.budget, byteLength);
+    if (budgetReason)
+        return budgetReason;
+    const allowance = collection.budget.staging;
+    if (!allowance)
+        return null;
+    // BLI-12832: bytes the server refused for good are reclaimed by the prune
+    // (the refusal stays as a receipt), so copying them again would be churn.
+    if (collection.staging.staged[file.contentHash] === undefined &&
+        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
+        collection.budget.remainingObjects += 1;
+        collection.budget.remainingBytes += byteLength;
+        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
+        return "delivery_terminal_refused";
+    }
+    const diskReason = admitToStaging(allowance, byteLength, {
+        alreadyStaged: collection.staging.staged[file.contentHash] !== undefined,
+        kind: file.kind,
+    });
+    if (!diskReason)
+        return null;
+    collection.budget.remainingObjects += 1;
+    collection.budget.remainingBytes += byteLength;
+    return `staging_deferred:${diskReason}`;
+}
 /**
  * Decrements the per-sync budget when a file fits, or returns a deferred-skip
  * reason when it does not. The object budget bounds request count; the byte

package/dist/adapters/raw-evidence-completeness.js

@@ -21,6 +21,12 @@ export function markCapApplied(ledger, source, capType) {
         cap.applied = true;
 }
 export function markBudgetCapApplied(ledger, reason) {
+    if (reason === "delivery_terminal_refused")
+        return;
+    if (reason.startsWith("staging_deferred:")) {
+        markCapApplied(ledger, "raw_evidence", "staging_gate");
+        return;
+    }
     markCapApplied(ledger, "raw_evidence", reason === "deferred_object_budget" ? "object_budget" : "byte_budget");
 }
 // ---------------------------------------------------------------------------

package/dist/adapters/raw-evidence-git-diff-reader.js

@@ -19,7 +19,7 @@ import { sha256 } from "./raw-evidence-keys.js";
 import { maskSecretsInGitDiff, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 import { MAX_GIT_DIFF_BYTES, REPO_ROOT_MISSING_REASON, RepoRootMissingError, repoRootExists, runGitDiff, } from "./raw-evidence-git-diff.js";
 const GIT_DIFF_TARGETS = [
     { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
@@ -130,7 +130,7 @@ async function stageOneGitDiff(collection, target) {
         });
         return;
     }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
+    const deferReason = admitEvidence(collection, sanitized.bytes.byteLength, { contentHash, kind: "git_diff" });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({

package/dist/adapters/raw-evidence-image-reader.js

@@ -13,7 +13,7 @@ import { evidenceSourceKey } from "../raw-evidence-staging.js";
 import { sha256 } from "./raw-evidence-keys.js";
 import { markBudgetCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 export async function collectAgentImagesFromTranscript(collection, options) {
     const result = await collectAgentImageEvidenceFromJsonlFile({
         filePath: options.filePath,
@@ -56,7 +56,10 @@ async function collectOneAgentImageFile(collection, options) {
         });
         return;
     }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    const deferReason = admitEvidence(collection, raw.byteLength, {
+        contentHash,
+        kind: options.kind,
+    });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         collection.skipped.push({

package/dist/adapters/raw-evidence-transcript-file.js

@@ -20,7 +20,7 @@ import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
 import { describeSnapshot, stubReplacementClaim, supersedeClaimFor, } from "./raw-evidence-snapshot-supersede.js";
-import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
  * attributed transcript into the pack.
@@ -82,7 +82,7 @@ export async function collectOneEvidenceFile(collection, options) {
         });
         return true;
     }
-    const deferReason = admitToBudget(collection.budget, sanitized.bytes.byteLength);
+    const deferReason = admitEvidence(collection, sanitized.bytes.byteLength, { contentHash, kind: options.kind });
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
         return skip(deferReason);

package/dist/autostart-opt-out.js

@@ -0,0 +1,43 @@
+import { AUTOSTART_OPT_OUT_MARKER_FILE_NAME } from "@bli-cockpit/telemetry-core";
+import fs from "node:fs/promises";
+import path from "node:path";
+/**
+ * BLI-12828. The tick now CREATES a missing scheduler registration (an absent
+ * LaunchAgent / Scheduled Task is how a Mac goes quiet after a reboot), so
+ * "absent" can no longer double as "the operator removed it on purpose". This
+ * marker is that deliberate act: `cockpit autostart uninstall` writes it,
+ * `cockpit autostart install` and `cockpit doctor` clear it, and the tick's
+ * create-when-absent repair refuses while it stands.
+ *
+ * One small file under the state dir; it holds a timestamp, never a path.
+ */
+export const AUTOSTART_OPT_OUT_MARKER = AUTOSTART_OPT_OUT_MARKER_FILE_NAME;
+function markerPath(paths) {
+    return path.join(paths.state_dir, AUTOSTART_OPT_OUT_MARKER);
+}
+export async function isAutostartOptedOut(paths) {
+    return fs
+        .stat(markerPath(paths))
+        .then(() => true)
+        .catch(() => false);
+}
+export async function markAutostartOptedOut(paths, now = new Date()) {
+    try {
+        await fs.mkdir(paths.state_dir, { recursive: true, mode: 0o700 });
+        await fs.writeFile(markerPath(paths), now.toISOString());
+        console.error("[autostart] opt-out recorded; the sync tick will not re-create the scheduler until `cockpit autostart install`", JSON.stringify({ reason: "operator_uninstalled" }));
+    }
+    catch (error) {
+        console.error("[autostart] opt-out could not be recorded; the tick may re-create the scheduler", JSON.stringify({
+            reason: "opt_out_write_failed",
+            error_name: error instanceof Error ? error.name : typeof error,
+        }));
+    }
+}
+export async function clearAutostartOptOut(paths) {
+    const had = await isAutostartOptedOut(paths);
+    await fs.rm(markerPath(paths), { force: true }).catch(() => undefined);
+    if (had) {
+        console.error("[autostart] opt-out cleared; background sync is wanted again", JSON.stringify({ reason: "operator_installed" }));
+    }
+}

package/dist/autostart-self-heal.js

@@ -3,8 +3,12 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { autostartStatus, installAutostartAgent, registeredRuntimePathProblems, } from "./autostart.js";
 import { detectSecondCockpitInstall, secondInstallReason, } from "./second-install.js";
+import { isAutostartOptedOut } from "./autostart-opt-out.js";
 export const AUTOSTART_REPAIR_THROTTLE_MARKER = ".last-autostart-repair";
-const AUTOSTART_REPAIR_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// BLI-12828: the FIRST repair of a break never waits. The marker only spaces
+// out RETRIES of a repair that keeps failing, and a healthy reading clears it,
+// so the next break is repaired on the next tick, not a day later.
+const AUTOSTART_REPAIR_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1000;
 const DETAIL_MAX_CHARS = 300;
 export async function runAutostartSelfHeal(paths, options) {
     const platform = options.platform ?? process.platform;
@@ -20,9 +24,12 @@ export async function runAutostartSelfHeal(paths, options) {
         exec: options.exec,
         platform,
     });
-    // Absent means the operator (or onboarding) owns the decision, not this tick.
-    if (status.status === "absent")
+    const absent = status.status === "absent";
+    if (absent && (await isAutostartOptedOut(paths))) {
+        // Said on the tick's own log so "why is this Mac not ticking" is answerable.
+        console.error("[autostart-self-heal] scheduler absent; not re-creating it, the operator uninstalled it on purpose", JSON.stringify({ reason: "autostart_uninstalled_by_operator", platform }));
         return null;
+    }
     // A registration can read as "loaded" and still name a binary that no longer
     // exists — that is precisely what `brew upgrade node` leaves behind. Ask the
     // filesystem about the paths the SCHEDULER holds, not the ones this process
@@ -34,11 +41,16 @@ export async function runAutostartSelfHeal(paths, options) {
             platform,
         })
         : [];
-    if (status.status !== "not_loaded" && runtimeProblems.length === 0) {
-        // Healthy is the steady state and stays silent.
+    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
+    if (!absent && status.status !== "not_loaded" && runtimeProblems.length === 0) {
+        // Healthy is the steady state and stays silent. A marker left by an
+        // earlier attempt is spent: that repair worked, so the next break starts
+        // fresh instead of waiting out a retry window.
+        await fs.rm(marker, { force: true }).catch(() => undefined);
         return null;
     }
     const problem = [
+        ...(absent ? ["registration absent"] : []),
         ...(status.message ? [status.message] : []),
         ...runtimeProblems,
     ]
@@ -59,15 +71,16 @@ export async function runAutostartSelfHeal(paths, options) {
             step: platform === "darwin" ? "autostart_heal" : "autostart_repair",
         };
     }
-    // Attempts are throttled (marker mtime, written for the attempt not the
-    // outcome) so a persistently failing repair cannot run every 15 minutes. The
+    // Only a RETRY waits (marker mtime, written for the attempt not the
+    // outcome, cleared by the next healthy reading): a repair that keeps failing
+    // is retried hourly instead of churning the scheduler every 15 minutes. The
     // status probe above still runs every tick — it is one launchctl/schtasks
     // query.
     const now = options.now ?? new Date();
-    const marker = path.join(paths.state_dir, AUTOSTART_REPAIR_THROTTLE_MARKER);
     const lastAttempt = await fs.stat(marker).catch(() => null);
     if (lastAttempt &&
-        now.getTime() - lastAttempt.mtimeMs < AUTOSTART_REPAIR_MIN_INTERVAL_MS) {
+        now.getTime() - lastAttempt.mtimeMs < AUTOSTART_REPAIR_RETRY_AFTER_FAILURE_MS) {
+        console.error("[autostart-self-heal] scheduler still broken; the last repair attempt was under an hour ago, retrying after that", JSON.stringify({ reason: "repair_retry_waiting", platform }));
         return { status: "skipped", reason: "repair_throttled_recent_attempt" };
     }
     await fs.mkdir(paths.state_dir, { recursive: true }).catch(() => undefined);
@@ -85,7 +98,7 @@ export async function runAutostartSelfHeal(paths, options) {
     if (repaired.loaded) {
         return {
             status: "ok",
-            reason: "autostart_repaired",
+            reason: absent ? "autostart_created" : "autostart_repaired",
             detail: problem,
             step: "autostart_repair",
         };

package/dist/commands/autostart-command.js

@@ -1,6 +1,7 @@
 import { defaultExec, writeLine } from "./cli-io.js";
 import { runAutostartHealDetached } from "./autostart-heal.js";
 import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from "../autostart.js";
+import { clearAutostartOptOut, markAutostartOptedOut, } from "../autostart-opt-out.js";
 import { getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 export async function runAutostart(command, io) {
     if (command.action === "heal-detached") {
@@ -37,6 +38,15 @@ export async function runAutostart(command, io) {
                 intervalSeconds: command.intervalSeconds,
                 exec,
             });
+    // BLI-12828: the tick re-creates an absent scheduler, so a deliberate
+    // uninstall has to leave a mark the tick can read.
+    const optOutPaths = getCollectorRuntimePaths(command.homeDir);
+    if (command.action === "uninstall" && result.status !== "unsupported") {
+        await markAutostartOptedOut(optOutPaths);
+    }
+    else if (command.action === "install" && result.loaded !== false) {
+        await clearAutostartOptOut(optOutPaths);
+    }
     if (command.json) {
         writeLine(io.stdout, JSON.stringify(result, null, 2));
         return autostartExitCode(command.action, result);

package/dist/commands/autostart-heal.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { appendFile } from "node:fs/promises";
 import { AUTOSTART_LABEL, autostartStatus, reregisterDarwinAgent, writeDarwinAutostartPlist, } from "../autostart.js";
+import { isAutostartOptedOut } from "../autostart-opt-out.js";
 import { redactedHealthDetail } from "../health-detail.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, } from "../local-state.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -72,9 +73,10 @@ async function healDetached(command, io, deps) {
         exec,
         platform,
     });
-    if (before.status === "absent") {
-        // Repair what exists, never create.
-        return { status: "skipped", reason: "autostart_absent" };
+    if (before.status === "absent" &&
+        (await isAutostartOptedOut(getCollectorRuntimePaths(command.homeDir)))) {
+        // BLI-12828: absent is created now; only a deliberate uninstall stops it.
+        return { status: "skipped", reason: "autostart_uninstalled_by_operator" };
     }
     let written;
     try {
@@ -125,7 +127,7 @@ async function healDetached(command, io, deps) {
     }
     return {
         status: "ok",
-        reason: "autostart_healed",
+        reason: before.status === "absent" ? "autostart_created" : "autostart_healed",
         detail: `node_path_reason=${written.node_path_reason}`,
     };
 }

package/dist/commands/backfill-upload.js

@@ -7,6 +7,7 @@ import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandi
 import { blockingScanIssues } from "./backfill-issues.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
+import { stagingDeferredFiles } from "../staging-gate.js";
 import { stubClaimsForCandidates } from "./backfill-stub-reoffer.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
@@ -92,6 +93,17 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
             failureReason = "deferred_budget_exhausted";
             break;
         }
+        // BLI-12832: the disk gate refused a copy. Every later batch would be
+        // refused the same way, so stop here; the cursor only advanced through
+        // sessions that earned a durable pointer, and the next run starts from
+        // the same place once room returns.
+        const stagingDeferred = stagingDeferredFiles(rawEvidenceBudget.staging);
+        if (stagingDeferred > 0) {
+            blockedAt = stoppedAt("staging paused: not enough room to copy more evidence", index);
+            failureReason = "deferred_budget_exhausted";
+            console.error("[backfill] stopped, the staging gate is holding new copies", JSON.stringify({ reason: "staging_deferred", files_deferred: stagingDeferred, batch_index: index + 1 }));
+            break;
+        }
         if (consecutiveFailures >= BACKFILL_MAX_CONSECUTIVE_FAILURES) {
             blockedAt = stoppedAt("consecutive upload failures", index);
             failureReason = failedBatchReason(outcome.sync, outcome.missingDurableMain);

package/dist/commands/doctor-access.js

@@ -8,6 +8,7 @@ import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConf
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { detectSecondCockpitInstall } from "../second-install.js";
 import { hardStop, needsFix, ok, skipped } from "./doctor-report.js";
+import { SIGN_IN_ACTION } from "../sign-in-action.js";
 /**
  * The `authed`, `roots-ok`, and `single-install` check family: who is this
  * machine and where does it collect. Auth and roots are hard stops with no
@@ -31,7 +32,7 @@ export async function fixAuthState(context, state) {
             return checked;
     }
     if (!isInteractiveDoctorFix(context))
-        return { ...state, nextAction: "cockpit login" };
+        return { ...state, nextAction: SIGN_IN_ACTION };
     const code = await context.deps.runLogin(context).catch((error) => {
         // Exit code 1 with no reason at all is what an operator saw when doctor
         // tried and failed to repair their auth — the same output as a login that
@@ -73,13 +74,10 @@ export async function readAuthState(context) {
         }
         return ok("authed", "device_token_present", "this machine is signed in");
     }
-    return hardStop("authed", "pairing_required", [
-        "device is not signed in.",
-        "What you can do:",
-        "  1) Run `cockpit login` and complete the email/device approval.",
-        `  2) If this is a reused machine, run \`${onboardOneLiner(context.command)}\` to refresh onboarding.`,
-        "  3) Send this output to Edward if approval is blocked.",
-    ].join("\n"));
+    return {
+        ...hardStop("authed", "pairing_required", `this machine is signed out. ${SIGN_IN_ACTION}`),
+        nextAction: SIGN_IN_ACTION,
+    };
 }
 export async function readRootState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -92,13 +90,11 @@ export async function readRootState(context) {
             roots,
         };
     }
-    return hardStop("roots-ok", "no_roots", [
-        "no saved collection roots were found.",
-        "What you can do:",
-        `  1) Run \`${onboardOneLiner(context.command)}\` to save the workspace roots again.`,
-        "  2) If this is the wrong folder, rerun from the BLI workspace or pass `--workspace <path>`.",
-        "  3) Run `cockpit doctor` interactively to choose approved roots.",
-    ].join("\n"));
+    const action = `Run \`${onboardOneLiner(context.command)}\` in a terminal from the folder where you work.`;
+    return {
+        ...hardStop("roots-ok", "no_roots", `no collection folders are saved yet. ${action}`),
+        nextAction: action,
+    };
 }
 /**
  * BLI-3218/BLI-3553. Two Tower installs on one machine make each one's tick
@@ -164,10 +160,10 @@ function shellQuote(value) {
  * a gate on it, so a session sitting outside one is not a defect doctor found
  * and cannot repair. This row is therefore always informational (`ok`): it
  * reports how many of this scan's sessions were inside vs. outside, never
- * asks for approval, and attempts no fix. Widening the boundary still buys
- * the redacted transcript BYTES for those outside directories (those stay
- * root-gated), so the message still names `cockpit roots add` as something an
- * operator can choose to do, never something doctor is stuck waiting on. The
+ * asks for approval, and attempts no fix. Widening a root only adds the redacted transcript BYTES for those
+ * directories, so the message names `cockpit roots add` as an OPTIONAL step an
+ * operator can choose, never something doctor, or any person, is waiting on to
+ * approve. The
  * row only turns red the ordinary way every other doctor check does: the scan
  * itself throwing (`work_directory_scan_incomplete` from unreadable session
  * folders), which `runDoctorWithDeps`'s existing `check_threw` handling
@@ -182,9 +178,9 @@ export async function readRootsCoverWork(context) {
     const outsideCount = outside.reduce((sum, entry) => sum + entry.count, 0);
     const insideCount = scan.observed - outsideCount;
     if (!outsideCount)
-        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no known working directories outside approved roots. ${sessionCoverageLine(scan, outsideCount)}`);
+        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no working folders outside your saved roots. ${sessionCoverageLine(scan, outsideCount)}`);
     return {
-        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside approved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label. Their redacted transcript content stays unuploaded until a root widens (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
+        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside your saved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label. Nothing needs approving. Optional: add a folder as a root to also upload its redacted transcript text (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
         nextAction: rootsAddCommand(outside[0].directory, process.platform, homeDir),
     };
 }

package/dist/commands/doctor-disk-words.js

@@ -57,6 +57,26 @@ export function footprintBuckets(footprint) {
     ];
     return buckets.filter((bucket) => bucket.bytes > 0).sort((a, b) => b.bytes - a.bytes);
 }
+/**
+ * BLI-12832: the sentence for a paused staging gate, in plain words. Every
+ * variant says the same two true things: nothing is lost (the source file is
+ * still on disk), and copying resumes by itself.
+ */
+export function stagingPausedWords(gate, holder) {
+    if (gate.reason === "low_disk") {
+        return `Tower paused copying new evidence: the disk has ${gib(gate.free_bytes ?? 0)} GB free. Nothing is lost; it resumes when space returns.`;
+    }
+    if (gate.reason === "state_over_ceiling") {
+        return `Tower paused copying new evidence: everything it keeps here is ${mib(gate.collector_bytes)} MB, over its ${mib(gate.ceiling_bytes)} MB ceiling${holder ? `, mostly ${holder.label} (${mib(holder.bytes)} MB)` : ""}. Nothing is lost; it resumes when that shrinks.`;
+    }
+    if (gate.reason === "staging_at_cap") {
+        return `Tower paused copying new evidence: its staging folder is full (${mib(gate.staging_bytes)} MB of a ${mib(gate.cap_bytes)} MB cap) with evidence the server has not accepted yet. Nothing is lost; the sources stay on disk and copying resumes once uploads succeed.`;
+    }
+    return null;
+}
+export function gib(bytes) {
+    return (bytes / (1024 * 1024 * 1024)).toFixed(1);
+}
 export function footprintTotalBytes(footprint) {
     return footprintBuckets(footprint).reduce((sum, bucket) => sum + bucket.bytes, 0);
 }

package/dist/commands/doctor-mcp.js

@@ -30,6 +30,12 @@
  *             ledger with its reason label (`doctor-report.ts`'s `doctorEvent`
  *             maps every other status to `ok`).
  *
+ * BLI-12828: a `fail` (nothing answered) now has a repair. The server ships
+ * inside the CLI and is wired in by `memory install`, so the fix re-registers,
+ * takes the newest CLI if that alone did not wake it, and asks again; the row's
+ * receipt shows the before and after. A `needs_fix` (Tower refused) has none:
+ * the refusal is the sign-in's, and the `authed` row owns that.
+ *
  * `skipped` when the bin is not on this machine at all, for the same reason
  * `memory-registered` skips: nothing to probe is not a broken machine.
  */
@@ -95,4 +101,25 @@ function probeEnv(context) {
     if (context.command.dashboardUrl)
         base[TOWER_DASHBOARD_URL_ENV] = context.command.dashboardUrl;
     return base;
+}
+/**
+ * The `mcp-answers` repair (BLI-12828): re-register, then take the newest CLI,
+ * asking the server again after each. Heavy (it spawns the server and may run
+ * the updater), so doctor runs it only on a `fail` and the tick leaves it to
+ * the daily memory install and the CLI floor, which do the same two things.
+ */
+export async function fixMcpAnswersState(context, state) {
+    if (state.status !== "fail") {
+        console.error("[doctor] mcp-answers not repaired; Tower refused the call and the sign-in row owns that", JSON.stringify({ reason: state.code }));
+        return state;
+    }
+    await context.deps.fixMemory(context);
+    let checked = await context.deps.checkMcpAnswers(context);
+    console.error("[doctor] mcp-answers re-registered and asked again", JSON.stringify({ reason: checked.code, status: checked.status }));
+    if (checked.status === "fail") {
+        await context.deps.selfUpdate(context.io, { json: true, tag: context.command.updateTag });
+        checked = await context.deps.checkMcpAnswers(context);
+        console.error("[doctor] mcp-answers updated the CLI and asked again", JSON.stringify({ reason: checked.code, status: checked.status }));
+    }
+    return checked;
 }

package/dist/commands/doctor-pipeline.js

@@ -5,12 +5,13 @@ import { readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/ba
 import { savedDiscoveryLimitArgs } from "../discovery-limits.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { retentionOptionsFromEnv } from "../disk-retention.js";
+import { readStagingGate, stagingGateLimitsFromEnv } from "../staging-gate.js";
 import { readDiskFootprint } from "../disk-usage.js";
 import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
-import { FOOTPRINT_NEEDS_FIX_BYTES, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
+import { FOOTPRINT_NEEDS_FIX_BYTES, stagingPausedWords, diskRowMessage, footprintHolder, footprintTotalBytes, mib, redeliveryLine, } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, jsonField, parseDoctorBackfillJson, parseDoctorSyncJson, syncFailureMessage, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline-verdicts.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
@@ -162,34 +163,55 @@ export async function checkDiskState(context) {
     const footprint = await readDiskFootprint(getCollectorRuntimePaths(context.command.homeDir));
     const { capBytes } = retentionOptionsFromEnv(context.io.env);
     const message = diskRowMessage(footprint, capBytes);
+    const paused = await stagingPausedRow(context, footprint, message);
+    if (paused)
+        return paused;
     if (footprint.staging.total_bytes - (footprint.staging.terminal_bytes ?? 0) > capBytes) {
         return needsFix("disk-bounded", "over_staging_cap", message);
     }
-    const over = footprintOverSentence(footprint);
+    const over = footprintOverSentence(footprint, stagingGateLimitsFromEnv(context.io.env).ceilingBytes);
     if (over)
         return needsFix("disk-bounded", "footprint_over_512mb", `${over}; ${message}`);
     return ok("disk-bounded", "within_staging_cap", message);
 }
+/**
+ * BLI-12832: the row for a paused staging gate, or null when copying is open.
+ * Plain words first, then the numbers; logged either way so a green row can
+ * still say the gate was checked.
+ */
+async function stagingPausedRow(context, footprint, message) {
+    const gate = await readStagingGate(getCollectorRuntimePaths(context.command.homeDir).state_dir, context.io.env);
+    const words = stagingPausedWords(gate, footprintHolder(footprint));
+    console.error("[cockpit-doctor] staging gate", JSON.stringify({
+        reason: gate.reason ?? "open",
+        staging_bytes: gate.staging_bytes,
+        collector_bytes: gate.collector_bytes,
+        free_bytes: gate.free_bytes,
+    }));
+    if (!words || !gate.reason)
+        return null;
+    return needsFix("disk-bounded", `staging_paused_${gate.reason}`, `${words} ${message}`);
+}
 /**
  * "812.0 MB held, over the 512 MB line; most of it is sync logs (600.0 MB)",
  * or null when the footprint is under the line. Logged either way, because a
  * row that only speaks when it is red cannot say the check ran.
  */
-export function footprintOverSentence(footprint) {
+export function footprintOverSentence(footprint, ceilingBytes = FOOTPRINT_NEEDS_FIX_BYTES) {
     const total = footprintTotalBytes(footprint);
     const holder = footprintHolder(footprint);
-    const over = total > FOOTPRINT_NEEDS_FIX_BYTES;
+    const over = total > ceilingBytes;
     console.error("[cockpit-doctor] collector footprint", JSON.stringify({
         reason: over ? "footprint_over_512mb" : "footprint_within_512mb",
         total_bytes: total,
-        limit_bytes: FOOTPRINT_NEEDS_FIX_BYTES,
+        limit_bytes: ceilingBytes,
         holder: holder?.label ?? null,
         holder_bytes: holder?.bytes ?? 0,
         study_entries_not_counted: footprint.state.study_entries,
     }));
     if (!over)
         return null;
-    return `${mib(total)} MB held, over the ${mib(FOOTPRINT_NEEDS_FIX_BYTES)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
+    return `${mib(total)} MB held, over the ${mib(ceilingBytes)} MB line; most of it is ${holder?.label ?? "unknown"} (${mib(holder?.bytes ?? 0)} MB)`;
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
@@ -216,11 +238,16 @@ export async function fixDiskState(context) {
     }
     const footprint = await readDiskFootprint(paths);
     const message = diskRowMessage(footprint, pruned.cap_bytes);
-    const over = pruned.cap_blocked_by_uncommitted ? null : footprintOverSentence(footprint);
+    const over = pruned.cap_blocked_by_uncommitted
+        ? null
+        : footprintOverSentence(footprint, stagingGateLimitsFromEnv(context.io.env).ceilingBytes);
     if (over) {
         return needsFix("disk-bounded", "footprint_over_512mb", `freed ${mib(pruned.deleted_bytes)} MB; ${over}; ${message}`);
     }
     if (!pruned.cap_blocked_by_uncommitted) {
+        const stillPaused = await stagingPausedRow(context, footprint, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
+        if (stillPaused)
+            return stillPaused;
         return ok("disk-bounded", `freed_${pruned.deleted_files}`, `freed ${mib(pruned.deleted_bytes)} MB; ${message}`);
     }
     // Unaccepted evidence still occupies the cap. Keep the disk row actionable.