@bli-cockpit/cli 0.2.237 → 0.2.238

package/dist/tower-client.js

@@ -1,27 +1,7 @@
 /**
- * The one shared "call the dashboard as me" client (BLI-3457).
- *
- * Every command that speaks to Tower on the paired person's behalf — `jarvis`
- * today, the rest of the CLI-parity surface next — needs the same three
- * things: the paired device session, a request that carries its device token,
- * and a failure that names itself instead of throwing a transport stack trace
- * at a person. Before this module each command grew its own copy; the copies
- * drifted (one normalised the dashboard URL, one did not) and only one of them
- * ever named a reason.
- *
- * Contract:
- * - Nothing here throws for a transport error. `towerRequest` returns
- *   `{ ok: false, reason }` for every network-shaped failure, and the reason
- *   label is the thing that travels to the operator.
- * - `loadPairedSession` still throws, because "this machine is not paired" is
- *   not a transport failure — it is a precondition the caller cannot proceed
- *   past, and the command's top level turns it into one plain sentence.
- * - The device token is attached to the request and never returned, logged, or
- *   put in a reason. Log lines here carry metadata only.
- *
- * The HTTP vocabulary (`normalizeDashboardUrl`, `readResponseJson`,
- * `responseErrorMessage`) is reused from `upload-http.ts` rather than copied —
- * the upload path and the conversation path answer to the same rules.
+ * Share authenticated Tower requests across CLI capabilities.
+ * HTTP refusals remain responses for callers to interpret; transport failures
+ * carry named reasons. Warm reads reuse the daemon and writes invalidate cache.
  */
 import { invalidateReadCacheSurface, readCacheSurfaceForPath, } from "@bli-cockpit/telemetry-core/node-read-cache";
 import { errorMessage } from "./commands/cli-io.js";
@@ -109,36 +89,7 @@ export async function towerRequest(options) {
             : null;
         const response = warmResponse ?? (await options.fetch(url, init));
         const respondedMs = Date.now() - startedAt;
-        // The success branch always decided something (BLI-10450 kept the
-        // "log the success branch too" rule intact) — it is just that under
-        // `--json`/`--quiet` the reader already gets that decision back as the
-        // command's own stdout object, so a second copy on stderr is noise, not
-        // signal. The failure branch below never quiets: a request that reached
-        // no response at all is the one case AGENTS.md's logging rule protects.
-        if (!shouldSuppressTowerSuccessLog()) {
-            log(`[tower client] responded ${JSON.stringify({
-                request: options.label,
-                http_status: response.status,
-                content_type: response.headers.get("content-type") ?? "none",
-                streamed: (response.headers.get("content-type") ?? "").includes("application/x-ndjson"),
-                elapsed_ms: respondedMs,
-            })}`);
-        }
-        // BLI-10746: "any write through the CLI or MCP invalidates the affected
-        // cache". A successful (2xx) write to a covered surface throws away
-        // every cached read for that surface — coarse, but a stale row is never
-        // possible this way, only one avoidable extra request.
-        if (method !== "GET" && response.ok) {
-            const surface = readCacheSurfaceForPath(options.path);
-            if (surface) {
-                const stateDir = getCollectorRuntimePaths(options.homeDir).state_dir;
-                const invalidated = invalidateReadCacheSurface(stateDir, options.deviceToken, surface);
-                log(`[tower client] read cache invalidated ${JSON.stringify({
-                    surface,
-                    ...(invalidated.ok ? { removed: invalidated.removed } : { reason: invalidated.reason }),
-                })}`);
-            }
-        }
+        recordTowerResponse(options, response, method, respondedMs, log);
         return { ok: true, response, startedAt, respondedMs };
     }
     catch (error) {
@@ -153,6 +104,38 @@ export async function towerRequest(options) {
         return { ok: false, reason, detail: towerFailureDetail(reason, errorMessage(error)) };
     }
 }
+function recordTowerResponse(options, response, method, respondedMs, log) {
+    // The success branch always decided something (BLI-10450 kept the
+    // "log the success branch too" rule intact) — it is just that under
+    // `--json`/`--quiet` the reader already gets that decision back as the
+    // command's own stdout object, so a second copy on stderr is noise, not
+    // signal. The failure branch below never quiets: a request that reached
+    // no response at all is the one case AGENTS.md's logging rule protects.
+    if (!shouldSuppressTowerSuccessLog()) {
+        log(`[tower client] responded ${JSON.stringify({
+            request: options.label,
+            http_status: response.status,
+            content_type: response.headers.get("content-type") ?? "none",
+            streamed: (response.headers.get("content-type") ?? "").includes("application/x-ndjson"),
+            elapsed_ms: respondedMs,
+        })}`);
+    }
+    // BLI-10746: "any write through the CLI or MCP invalidates the affected
+    // cache". A successful (2xx) write to a covered surface throws away
+    // every cached read for that surface — coarse, but a stale row is never
+    // possible this way, only one avoidable extra request.
+    if (method !== "GET" && response.ok) {
+        const surface = readCacheSurfaceForPath(options.path);
+        if (surface) {
+            const stateDir = getCollectorRuntimePaths(options.homeDir).state_dir;
+            const invalidated = invalidateReadCacheSurface(stateDir, options.deviceToken, surface);
+            log(`[tower client] read cache invalidated ${JSON.stringify({
+                surface,
+                ...(invalidated.ok ? { removed: invalidated.removed } : { reason: invalidated.reason }),
+            })}`);
+        }
+    }
+}
 /**
  * `towerRequest` plus reading the body as JSON and turning a non-2xx into a
  * named failure carrying the server's own words when it supplied any.

package/dist/tower-stream.js

@@ -1,28 +1,7 @@
 /**
- * Reading a Tower turn as it happens (BLI-3457).
- *
- * The dashboard's conversation routes speak one JSON object per line
- * (`application/x-ndjson`): `activity` events as tools start and settle,
- * `token` events carrying the answer as it is written (BLI-3517), then exactly
- * one `final` event carrying what the plain JSON response used to be.
- * That is the same wire format the browser already reads
- * (`apps/dashboard/src/lib/webchat/tool-trace.ts`); this is the terminal's
- * reader for it.
- *
- * Three things it refuses to do:
- * - Throw. A stream that dies mid-turn comes back as a named reason, never an
- *   exception in the middle of a person's answer.
- * - Present a truncated turn as a complete one. No `final` event means the
- *   turn failed, and it says which way it failed
- *   (`turn_timed_out` when the dashboard's own 120s ceiling is the likely
- *   cause, `stream_ended_without_final` otherwise).
- * - Require the stream. A dashboard that has not shipped streaming yet answers
- *   `application/json`; that single object is read as the final event and the
- *   fallback is named `stream_not_available` rather than passed off as a
- *   stream that happened to be quiet.
- *
- * A malformed line is skipped, named `ndjson_line_unparseable`, and the lines
- * after it still count — one bad byte cannot swallow an answer.
+ * Read Tower stream frames without losing the final answer or partial timing.
+ * Activity, token and revision callbacks are optional; the final result retains
+ * the settled answer. A truncated stream reports its last meaningful reason.
  */
 import { errorMessage } from "./commands/cli-io.js";
 import { isAbortError } from "./tower-client.js";
@@ -131,6 +110,10 @@ export async function readTowerTurn(response, options = {}) {
         activity.push(item.event);
         options.onActivity?.(item.event);
     }
+    return finishTowerTurn(options, { startedAt, activity, notes, streamed, final, draft, tokenFrames, firstByteMs, firstFrameMs, firstTokenMs });
+}
+function finishTowerTurn(options, state) {
+    const { startedAt, activity, notes, streamed, final, draft, tokenFrames, firstByteMs, firstFrameMs, firstTokenMs } = state;
     const elapsedMs = Date.now() - startedAt;
     const timing = { firstByteMs, firstFrameMs, firstTokenMs };
     if (!final) {

package/dist/upload-agent-artifacts.js

@@ -1,14 +1,6 @@
 /**
- * Telling the dashboard about images an agent produced or was shown.
- *
- * A screenshot pasted into a Codex or Claude session is already uploaded as raw
- * evidence like any other object; this is the second, separate report that says
- * "that object is an image, from this session, at this turn" so the dashboard
- * can queue it for redaction and OCR.
- *
- * Non-fatal by design: an older dashboard without the endpoint must not fail a
- * harvest, so every path here returns a `{ posted, reason }` label instead of
- * throwing.
+ * Register durable agent images so downstream OCR/redaction can find them.
+ * Reporting is best effort: return and log named outcomes without failing sync.
  */
 import { AgentImageArtifactReportRequestSchema, } from "@bli-cockpit/telemetry-core";
 import { describeError } from "./health-detail.js";
@@ -37,60 +29,9 @@ export async function reportAgentImageArtifacts(options) {
             },
             body: JSON.stringify(payload),
         });
-        // Both non-2xx branches returned a label and said nothing (BLI-3483). An
-        // image that never gets reported is never redacted and never OCR'd, and
-        // the only place that fact existed was a return value the sync discards.
-        if (!response.ok) {
-            const errorBody = await readResponseJson(response);
-            // A 404 is two different facts. "No such route" is the platform
-            // answering with an empty or HTML body; a JSON error envelope means the
-            // route answered and refused, and calling that "the dashboard has no
-            // agent-artifact route" hid a real refusal behind a shrug for as long as
-            // the door rejected ambient tickets.
-            if (response.status === 404 && !routeAnswered(errorBody)) {
-                console.error("[agent-artifacts] nothing answered at the agent-artifact path; these images stay unreported", JSON.stringify({
-                    reason: "agent_artifact_api_unavailable",
-                    http_status: 404,
-                    artifact_count: artifacts.length,
-                }));
-                return {
-                    posted: false,
-                    reason: "agent_artifact_api_unavailable",
-                    recorded_count: 0,
-                };
-            }
-            const serverReason = serverFailureDetail(errorBody);
-            console.error("[agent-artifacts] report refused", JSON.stringify({
-                reason: "report_failed",
-                http_status: response.status,
-                server_reason: serverReason ?? "none",
-                artifact_count: artifacts.length,
-            }));
-            return {
-                posted: false,
-                reason: `report_failed_http_${response.status}`,
-                recorded_count: 0,
-            };
-        }
-        const body = await readResponseJson(response);
-        const recordedCount = body && typeof body === "object"
-            ? Number(body.recorded_count ?? 0)
-            : 0;
-        const recorded = Number.isFinite(recordedCount) ? recordedCount : 0;
-        // The success branch too: "some images reported" and "every image
-        // reported" are different facts, and a count that is short of
-        // `artifact_count` is the only warning an operator would ever get.
-        console.error("[agent-artifacts] report recorded", JSON.stringify({
-            reason: "recorded",
-            http_status: response.status,
-            artifact_count: artifacts.length,
-            recorded_count: recorded,
-        }));
-        return {
-            posted: true,
-            reason: "recorded",
-            recorded_count: recorded,
-        };
+        if (!response.ok)
+            return await reportRefusedArtifacts(response, artifacts.length);
+        return await recordAcceptedArtifacts(response, artifacts.length);
     }
     catch (error) {
         // The label stays `report_network_error` — it is the wire contract. What
@@ -105,6 +46,59 @@ export async function reportAgentImageArtifacts(options) {
         return { posted: false, reason: "report_network_error", recorded_count: 0 };
     }
 }
+async function recordAcceptedArtifacts(response, artifactCount) {
+    const body = await readResponseJson(response);
+    const recordedCount = body && typeof body === "object"
+        ? Number(body.recorded_count ?? 0)
+        : 0;
+    const recorded = Number.isFinite(recordedCount) ? recordedCount : 0;
+    // The success branch too: "some images reported" and "every image
+    // reported" are different facts, and a count that is short of
+    // `artifact_count` is the only warning an operator would ever get.
+    console.error("[agent-artifacts] report recorded", JSON.stringify({
+        reason: "recorded",
+        http_status: response.status,
+        artifact_count: artifactCount,
+        recorded_count: recorded,
+    }));
+    return {
+        posted: true,
+        reason: "recorded",
+        recorded_count: recorded,
+    };
+}
+async function reportRefusedArtifacts(response, artifactCount) {
+    const errorBody = await readResponseJson(response);
+    // A 404 is two different facts. "No such route" is the platform
+    // answering with an empty or HTML body; a JSON error envelope means the
+    // route answered and refused, and calling that "the dashboard has no
+    // agent-artifact route" hid a real refusal behind a shrug for as long as
+    // the door rejected ambient tickets.
+    if (response.status === 404 && !routeAnswered(errorBody)) {
+        console.error("[agent-artifacts] nothing answered at the agent-artifact path; these images stay unreported", JSON.stringify({
+            reason: "agent_artifact_api_unavailable",
+            http_status: 404,
+            artifact_count: artifactCount,
+        }));
+        return {
+            posted: false,
+            reason: "agent_artifact_api_unavailable",
+            recorded_count: 0,
+        };
+    }
+    const serverReason = serverFailureDetail(errorBody);
+    console.error("[agent-artifacts] report refused", JSON.stringify({
+        reason: "report_failed",
+        http_status: response.status,
+        server_reason: serverReason ?? "none",
+        artifact_count: artifactCount,
+    }));
+    return {
+        posted: false,
+        reason: `report_failed_http_${response.status}`,
+        recorded_count: 0,
+    };
+}
 /**
  * Did the route answer, or did something in front of it?
  *

package/dist/upload-envelope-build.js

@@ -1,18 +1,7 @@
 /**
- * Is this machine ready to upload, and — if so — `buildLocalAmbientEnvelope`:
- * five steps from a bare repo root to a validated envelope.
- *
- * - `readPairedCollector` — prove the collector is installed and paired, with
- *   its own reason and retry command for each of the three ways a machine can
- *   fail to be ready. "sync failed" with no next step is what turns a
- *   five-second fix into a support thread.
- * - `buildLocalAmbientEnvelope` — find the work context for this repo, run the
- *   source collectors, sanitize what came back and assemble the one event
- *   (`upload-envelope-event.ts`), then parse the envelope against its schema.
- * - The work-context and provenance helpers (`makeUploadWorkContext`,
- *   `makeCollectorProvenance`, `safeRepoLabel`) are also called directly by
- *   `upload-session-reports.ts`, which builds its own provenance without a
- *   full envelope.
+ * Build a validated envelope only after proving the collector is paired.
+ * Read the workspace context, describe transcript images, collect sources,
+ * then sanitize and assemble the event. Blockers retain their retry commands.
  */
 import { priorSnapshotsFromCursor, } from "./adapters/raw-evidence-snapshot-supersede.js";
 import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
@@ -82,18 +71,7 @@ export async function buildLocalAmbientEnvelope(options = {}) {
     const collector = await readPairedCollector(paths);
     const { config, sessionFile, session } = collector;
     const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
-    const activeContext = await readLocalWorkContextForRepo(paths, repoRoot).catch((error) => {
-        // The operator is told "run `cockpit start`", which is right when the file
-        // is simply absent and wrong when it exists and will not parse — the same
-        // advice, forever, on a machine that has already run it (BLI-3238).
-        if (!isMissingFileFailure(error)) {
-            console.error("[upload-envelope] work context present but unreadable, reporting it as missing", JSON.stringify({
-                reason: "missing_context",
-                ...describeError(error),
-            }));
-        }
-        throw new LocalUploadBlockedError("missing_context", "Active work context missing. Run `cockpit start --workspace \"$PWD\"` before `cockpit sync`.", "cockpit start --workspace \"$PWD\"");
-    });
+    const activeContext = await readUploadWorkContext(paths, repoRoot);
     const repoLabel = safeRepoLabel(activeContext.repo_label ?? repoRoot);
     const uploadContext = makeUploadWorkContext({
         activeContext,
@@ -110,39 +88,11 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         deviceToken: sessionFile.device_token,
         fetchImpl: options.fetch,
     });
-    const sourceCollection = await runLocalSourceCollectors({
-        repoRoot,
-        branch: uploadContext.branch,
-        operatorId: session.operator_id,
-        operatorLabel: session.email ?? session.auth_subject_id,
-        sessionId: session.session_id,
-        workContextId: uploadContext.work_context_id,
-        activeWorkContext: activeContext,
-        rawEvidenceStateDir: paths.state_dir,
-        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
-        claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
-        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
-        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
-        rawEvidenceCodexSessionFiles: options.codexSessionFiles,
-        rawEvidenceCodexAttributionScan: options.codexAttributionScan,
-        rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,
-        rawEvidenceClaudeAttributionScan: options.claudeAttributionScan,
-        rawEvidenceSkipContentHashes: reusableContentHashes(options, {
-            operatorId: session.operator_id,
-            workContextId: uploadContext.work_context_id,
-        }),
-        rawEvidencePriorSnapshots: priorSnapshotsFromCursor(transcriptCursorObjects(options.cursorObjects), (objectKey) => rawEvidenceObjectKeyBelongsToWorkContext(objectKey, {
-            operatorId: session.operator_id,
-            workContextId: uploadContext.work_context_id,
-        })),
-        rawEvidenceStubReoffers: options.rawEvidenceStubReoffers,
-        rawEvidenceByteBudget: options.rawEvidenceByteBudget,
-        rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
-        rawEvidenceBudget: options.rawEvidenceBudget,
-        rawEvidenceImages,
-        rawEvidenceDeliveryMode: options.evidenceDeliveryMode,
-        now,
-    });
+    const sourceCollection = await collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now);
+    return assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now);
+}
+function assembleLocalEnvelope(options, collector, uploadContext, repoLabel, sourceCollection, now) {
+    const { config, sessionFile, session } = collector;
     const binding = sourceCollection.binding;
     const ticketBinding = selectedTicketBindingCandidate(binding);
     const uploadWorkContext = {
@@ -191,6 +141,57 @@ export async function buildLocalAmbientEnvelope(options = {}) {
         raw_evidence_facts: sourceCollection.facts.raw_evidence,
     };
 }
+async function collectEnvelopeSources(options, paths, repoRoot, uploadContext, session, activeContext, rawEvidenceImages, now) {
+    const sourceCollection = await runLocalSourceCollectors({
+        repoRoot,
+        branch: uploadContext.branch,
+        operatorId: session.operator_id,
+        operatorLabel: session.email ?? session.auth_subject_id,
+        sessionId: session.session_id,
+        workContextId: uploadContext.work_context_id,
+        activeWorkContext: activeContext,
+        rawEvidenceStateDir: paths.state_dir,
+        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
+        claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
+        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
+        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
+        rawEvidenceCodexSessionFiles: options.codexSessionFiles,
+        rawEvidenceCodexAttributionScan: options.codexAttributionScan,
+        rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,
+        rawEvidenceClaudeAttributionScan: options.claudeAttributionScan,
+        rawEvidenceSkipContentHashes: reusableContentHashes(options, {
+            operatorId: session.operator_id,
+            workContextId: uploadContext.work_context_id,
+        }),
+        rawEvidencePriorSnapshots: priorSnapshotsFromCursor(transcriptCursorObjects(options.cursorObjects), (objectKey) => rawEvidenceObjectKeyBelongsToWorkContext(objectKey, {
+            operatorId: session.operator_id,
+            workContextId: uploadContext.work_context_id,
+        })),
+        rawEvidenceStubReoffers: options.rawEvidenceStubReoffers,
+        rawEvidenceByteBudget: options.rawEvidenceByteBudget,
+        rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
+        rawEvidenceBudget: options.rawEvidenceBudget,
+        rawEvidenceImages,
+        rawEvidenceDeliveryMode: options.evidenceDeliveryMode,
+        now,
+    });
+    return sourceCollection;
+}
+async function readUploadWorkContext(paths, repoRoot) {
+    const activeContext = await readLocalWorkContextForRepo(paths, repoRoot).catch((error) => {
+        // The operator is told "run `cockpit start`", which is right when the file
+        // is simply absent and wrong when it exists and will not parse — the same
+        // advice, forever, on a machine that has already run it (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[upload-envelope] work context present but unreadable, reporting it as missing", JSON.stringify({
+                reason: "missing_context",
+                ...describeError(error),
+            }));
+        }
+        throw new LocalUploadBlockedError("missing_context", "Active work context missing. Run `cockpit start --workspace \"$PWD\"` before `cockpit sync`.", "cockpit start --workspace \"$PWD\"");
+    });
+    return activeContext;
+}
 /**
  * Content hashes whose bytes are already durable and may be skipped this sync.
  *

package/dist/upload-evidence-delivery-reconcile.js

@@ -1,12 +1,7 @@
 import { EvidenceCompletenessPayloadSchema, } from "@bli-cockpit/telemetry-core";
 /**
- * 4. Reconciling the envelope with what actually became durable.
- *
- * Ingest refuses pointers whose objects never became durable, so failed
- * uploads are pruned from the envelope instead of failing the whole sync.
- * Successful upload responses can also carry server-side sanitized hash and
- * redaction metadata; apply those before ingest so refs describe the bytes
- * actually stored in the durable bucket.
+ * Prune failed pointers before ingest and apply server-sanitized metadata so
+ * refs describe the bytes actually stored. Any successful duplicate is durable.
  */
 export function applyRawEvidenceUploadOutcomes(envelope, outcomes) {
     // Content-addressed keys mean one pointer id can carry several outcomes
@@ -27,39 +22,42 @@ export function applyRawEvidenceUploadOutcomes(envelope, outcomes) {
         return envelope;
     return {
         ...envelope,
-        events: envelope.events.map((event) => ({
-            ...event,
-            metrics: failedPointerIds.size > 0
-                ? {
-                    ...event.metrics,
-                    evidence_failed_count: (event.metrics["evidence_failed_count"] ?? 0) +
-                        failedOutcomes.length,
-                }
-                : event.metrics,
-            attributes: failedPointerIds.size > 0 && event.evidence_completeness
-                ? {
-                    ...event.attributes,
-                    evidence_completeness_schema_version: event.evidence_completeness.schema_version,
-                    evidence_completeness_status: "partial",
-                    evidence_incomplete: true,
-                }
-                : event.attributes,
-            evidence_completeness: failedPointerIds.size > 0 && event.evidence_completeness
-                ? markCompletenessUploadFailures(event.evidence_completeness, failedOutcomes)
-                : event.evidence_completeness,
-            raw_evidence_pointers: event.raw_evidence_pointers.flatMap((pointer) => {
-                const pointerId = pointer.raw_evidence_pointer_id;
-                if (failedPointerIds.has(pointerId))
-                    return [];
-                return [durablePointers.get(pointerId) ?? pointer];
-            }),
-            redaction: failedPointerIds.size > 0
-                ? {
-                    ...event.redaction,
-                    raw_evidence_pointer_ids: event.redaction.raw_evidence_pointer_ids.filter((pointerId) => !failedPointerIds.has(pointerId)),
-                }
-                : event.redaction,
-        })),
+        events: envelope.events.map((event) => reconcileEventEvidence(event, failedPointerIds, failedOutcomes, durablePointers)),
+    };
+}
+function reconcileEventEvidence(event, failedPointerIds, failedOutcomes, durablePointers) {
+    return {
+        ...event,
+        metrics: failedPointerIds.size > 0
+            ? {
+                ...event.metrics,
+                evidence_failed_count: (event.metrics["evidence_failed_count"] ?? 0) +
+                    failedOutcomes.length,
+            }
+            : event.metrics,
+        attributes: failedPointerIds.size > 0 && event.evidence_completeness
+            ? {
+                ...event.attributes,
+                evidence_completeness_schema_version: event.evidence_completeness.schema_version,
+                evidence_completeness_status: "partial",
+                evidence_incomplete: true,
+            }
+            : event.attributes,
+        evidence_completeness: failedPointerIds.size > 0 && event.evidence_completeness
+            ? markCompletenessUploadFailures(event.evidence_completeness, failedOutcomes)
+            : event.evidence_completeness,
+        raw_evidence_pointers: event.raw_evidence_pointers.flatMap((pointer) => {
+            const pointerId = pointer.raw_evidence_pointer_id;
+            if (failedPointerIds.has(pointerId))
+                return [];
+            return [durablePointers.get(pointerId) ?? pointer];
+        }),
+        redaction: failedPointerIds.size > 0
+            ? {
+                ...event.redaction,
+                raw_evidence_pointer_ids: event.redaction.raw_evidence_pointer_ids.filter((pointerId) => !failedPointerIds.has(pointerId)),
+            }
+            : event.redaction,
     };
 }
 /**
@@ -98,6 +96,25 @@ function markCompletenessUploadFailures(completeness, failedOutcomes) {
             failed_count: existing.failed_count + count,
         };
     }
+    const failureReasons = mergeUploadFailureReasons(completeness, failureCounts);
+    return EvidenceCompletenessPayloadSchema.parse({
+        ...completeness,
+        status: "partial",
+        source_counts: sourceCounts,
+        totals: {
+            ...completeness.totals,
+            failed_count: completeness.totals.failed_count + totalFailures,
+        },
+        failure_reasons: failureReasons.sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
+        notes: [
+            ...new Set([
+                ...completeness.notes,
+                "Some collected evidence did not become durable; downstream analysis should lower confidence.",
+            ]),
+        ],
+    });
+}
+function mergeUploadFailureReasons(completeness, failureCounts) {
     const failureReasons = [...completeness.failure_reasons];
     for (const [source, count] of failureCounts) {
         const reason = "upload_failed";
@@ -115,20 +132,5 @@ function markCompletenessUploadFailures(completeness, failedOutcomes) {
             }
         }
     }
-    return EvidenceCompletenessPayloadSchema.parse({
-        ...completeness,
-        status: "partial",
-        source_counts: sourceCounts,
-        totals: {
-            ...completeness.totals,
-            failed_count: completeness.totals.failed_count + totalFailures,
-        },
-        failure_reasons: failureReasons.sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
-        notes: [
-            ...new Set([
-                ...completeness.notes,
-                "Some collected evidence did not become durable; downstream analysis should lower confidence.",
-            ]),
-        ],
-    });
+    return failureReasons;
 }