@bli-cockpit/cli 0.2.251 → 0.2.253

package/dist/adapters/claude-attribution-memoized-reads.js

@@ -0,0 +1,85 @@
+import { captureSessionFactsDelta, observeSessionFactsContent, observeSessionFactsFile, parseSessionFactsDelta, SESSION_FACTS_VERSION, SKILL_USE_VERSION, } from "@bli-cockpit/telemetry-core";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import { extractClaudeSessionSignals } from "./claude-attribution-signals.js";
+import { statSourceForMemo } from "./transcript-read-memo.js";
+/**
+ * The reads attribution does of one Claude file, remembered by the file's stamp (BLI-22797;
+ * `transcript-read-memo.ts`). Every read goes through the same capture-then-merge path whether the file was
+ * opened or recalled, so a recalled file leaves the session's facts exactly as a fresh read does by construction
+ * (`session-facts-delta.ts`). Bump SIGNALS_VERSION when `claude-attribution-signals.ts` changes what it extracts.
+ */
+const SIGNALS_VERSION = "signals.v1";
+export const ATTRIBUTION_READ_RECIPE = ["attribution-reads.v1", SIGNALS_VERSION, SESSION_FACTS_VERSION, SKILL_USE_VERSION].join("|");
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const isStrings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
+const isNum = (v) => typeof v === "number" && Number.isFinite(v);
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function parseSidecarRead(data) {
+    if (!isObj(data) || !isStrings(data["cwds"]) || !isNum(data["byte_size"]) || typeof data["sha256"] !== "string")
+        return null;
+    const facts = parseSessionFactsDelta(data["facts"]);
+    return facts ? { cwds: data["cwds"], byte_size: data["byte_size"], sha256: data["sha256"], facts } : null;
+}
+function parseMainRead(data) {
+    if (!isObj(data) || !isNum(data["byte_size"]) || typeof data["sha256"] !== "string" || !isObj(data["signals"]))
+        return null;
+    const s = data["signals"];
+    if (!isStrings(s["session_ids"]) || !isStrings(s["cwds"]) || !isStrings(s["branches"]) || !isStrings(s["repository_urls"]))
+        return null;
+    if (!isNum(s["line_count"]) || !isNum(s["parse_error_count"]) || !isNum(s["content_record_count"]) || !isNum(s["envelope_field_hit_rate"]))
+        return null;
+    const facts = parseSessionFactsDelta(data["facts"]);
+    return facts ? { signals: s, byte_size: data["byte_size"], sha256: data["sha256"], facts } : null;
+}
+/** The sidecar's cwds, size, hash and facts contribution: recalled when its stamp is unchanged, else read (a read failure throws). */
+export async function readSidecar(memo, localPath) {
+    const stamp = memo ? await statSourceForMemo(localPath) : null;
+    if (memo && stamp) {
+        const hit = memo.recall(localPath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseSidecarRead);
+        if (hit)
+            return hit;
+    }
+    else
+        memo?.note("stamp_missing");
+    const raw = await fs.readFile(localPath);
+    const content = raw.toString("utf8");
+    const read = {
+        cwds: extractClaudeSessionSignals(content).cwds,
+        byte_size: raw.byteLength,
+        sha256: sha256(raw),
+        facts: captureSessionFactsDelta("claude_code", (acc) => void observeSessionFactsContent(acc, content)),
+    };
+    if (memo && stamp) {
+        memo.note("fresh");
+        memo.remember(localPath, stamp, ATTRIBUTION_READ_RECIPE, read);
+    }
+    return read;
+}
+/** The main transcript's signals, size, hash and facts contribution. `{ empty: true }` when it holds only whitespace (never remembered). */
+export async function readMain(memo, filePath) {
+    const stamp = memo ? await statSourceForMemo(filePath) : null;
+    if (memo && stamp) {
+        const hit = memo.recall(filePath, stamp, ATTRIBUTION_READ_RECIPE, stamp.size, parseMainRead);
+        if (hit)
+            return hit;
+    }
+    else
+        memo?.note("stamp_missing");
+    const raw = await fs.readFile(filePath);
+    const content = raw.toString("utf8");
+    const hash = sha256(raw);
+    if (content.trim() === "")
+        return { empty: true, byte_size: raw.byteLength, sha256: hash };
+    let signals;
+    const facts = captureSessionFactsDelta("claude_code", (acc) => {
+        signals = extractClaudeSessionSignals(content, acc);
+        observeSessionFactsFile(acc, { bytes: raw.byteLength, lines: signals.line_count });
+    });
+    const read = { signals: signals, byte_size: raw.byteLength, sha256: hash, facts };
+    if (memo && stamp) {
+        memo.note("fresh");
+        memo.remember(filePath, stamp, ATTRIBUTION_READ_RECIPE, read);
+    }
+    return read;
+}

package/dist/adapters/claude-attribution-score.js

@@ -1,12 +1,11 @@
-import { finalizeSessionFacts, newSessionFactsAccumulator, observeSessionFactsContent, observeSessionFactsFile, } from "@bli-cockpit/telemetry-core";
-import crypto from "node:crypto";
+import { finalizeSessionFacts, mergeSessionFactsDelta, newSessionFactsAccumulator, observeSessionFactsFile, } from "@bli-cockpit/telemetry-core";
 import { existsSync } from "node:fs";
-import fs from "node:fs/promises";
 import path from "node:path";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
 import { describeError } from "../health-detail.js";
 import { isPathWithin, sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
-import { extractClaudeSessionSignals, isSchemaDriftSuspected, streamMainSignals, } from "./claude-attribution-signals.js";
+import { isSchemaDriftSuspected, streamMainSignals } from "./claude-attribution-signals.js";
+import { readMain, readSidecar } from "./claude-attribution-memoized-reads.js";
 import { CLAUDE_SESSION_MAX_FILE_BYTES, } from "./claude-attribution-types.js";
 /**
  * Turns one discovered session into an attribution verdict: read (or, for an
@@ -18,7 +17,7 @@ import { CLAUDE_SESSION_MAX_FILE_BYTES, } from "./claude-attribution-types.js";
  * are counted: a sidecar rejected for a cwd mismatch is another worktree's
  * work and must not inflate this session's numbers.
  */
-export async function attributeOneSession(session, worktrees, collectionRoots) {
+export async function attributeOneSession(session, worktrees, collectionRoots, readMemo) {
     const factsAcc = newSessionFactsAccumulator("claude_code");
     const base = createSessionBase(session);
     if (session.mainByteSize === 0) {
@@ -26,7 +25,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
     }
     const read = session.mainByteSize > CLAUDE_SESSION_MAX_FILE_BYTES
         ? await streamOversizedMain(session, base, factsAcc)
-        : await readMainSignals(session, base, factsAcc);
+        : await readMainSignals(session, base, factsAcc, readMemo);
     if (typeof read === "string")
         return skippedResult(base, read);
     const signals = read;
@@ -54,7 +53,7 @@ export async function attributeOneSession(session, worktrees, collectionRoots) {
         extraSignals.push("main_file_oversized");
     if (isSchemaDriftSuspected(signals))
         extraSignals.push("schema_drift_suspected");
-    const sidecarFiles = await collectSessionSidecars(session, outcome, factsAcc);
+    const sidecarFiles = await collectSessionSidecars(session, outcome, factsAcc, readMemo);
     return {
         ...base,
         session_facts: finalizeSessionFacts(factsAcc),
@@ -116,10 +115,10 @@ async function streamOversizedMain(session, base, factsAcc) {
     base.oversized_lines_skipped = streamed.oversizedLinesSkipped;
     return streamed.signals;
 }
-async function readMainSignals(session, base, factsAcc) {
-    let raw;
+async function readMainSignals(session, base, factsAcc, readMemo) {
+    let read;
     try {
-        raw = await fs.readFile(session.mainFile);
+        read = await readMain(readMemo, session.mainFile);
     }
     catch (error) {
         console.error("[claude-attribution] session file unreadable, skipping it", JSON.stringify({
@@ -130,18 +129,12 @@ async function readMainSignals(session, base, factsAcc) {
         }));
         return "file_read_failed";
     }
-    const content = raw.toString("utf8");
-    base.content_hash_sha256 = sha256(raw);
-    base.byte_size = raw.byteLength;
-    if (content.trim() === "") {
+    base.content_hash_sha256 = read.sha256;
+    base.byte_size = read.byte_size;
+    if ("empty" in read)
         return "empty_file";
-    }
-    const signals = extractClaudeSessionSignals(content, factsAcc);
-    observeSessionFactsFile(factsAcc, {
-        bytes: raw.byteLength,
-        lines: signals.line_count,
-    });
-    return signals;
+    mergeSessionFactsDelta(factsAcc, read.facts);
+    return read.signals;
 }
 function applySessionMetadata(base, signals) {
     const metaSessionId = sanitizeSessionId(signals.session_ids[0]);
@@ -155,9 +148,9 @@ function applySessionMetadata(base, signals) {
         base.cwd_hash = shortHash(primaryCwd);
     }
 }
-async function collectSessionSidecars(session, outcome, factsAcc) {
+async function collectSessionSidecars(session, outcome, factsAcc, readMemo) {
     return isRawEvidenceUploadableAttributionState(outcome.state, outcome.worktree !== null) && outcome.worktree
-        ? await collectSidecarDiagnostics(session.sidecars, outcome.worktree, factsAcc)
+        ? await collectSidecarDiagnostics(session.sidecars, outcome.worktree, factsAcc, readMemo)
         : session.sidecars.map((sidecar) => ({
             local_path: sidecar.local_path,
             file_name: sidecar.file_name,
@@ -174,7 +167,7 @@ async function collectSessionSidecars(session, outcome, factsAcc) {
  * oversized sidecar is recorded with a reason and the session stays
  * harvestable.
  */
-async function collectSidecarDiagnostics(sidecars, worktree, facts) {
+async function collectSidecarDiagnostics(sidecars, worktree, facts, readMemo) {
     const out = [];
     for (const sidecar of sidecars) {
         const entry = {
@@ -188,9 +181,9 @@ async function collectSidecarDiagnostics(sidecars, worktree, facts) {
             out.push({ ...entry, skipped_reason: "file_too_large" });
             continue;
         }
-        let raw;
+        let read;
         try {
-            raw = await fs.readFile(sidecar.local_path);
+            read = await readSidecar(readMemo, sidecar.local_path);
         }
         catch (error) {
             // `file_read_failed` stays on the sidecar row. Beside it: a subagent
@@ -205,8 +198,7 @@ async function collectSidecarDiagnostics(sidecars, worktree, facts) {
             out.push({ ...entry, skipped_reason: "file_read_failed" });
             continue;
         }
-        const content = raw.toString("utf8");
-        const sidecarCwds = extractClaudeSessionSignals(content).cwds;
+        const sidecarCwds = read.cwds;
         if (sidecarCwds.length > 0 &&
             !sidecarCwds.some((cwd) => isPathWithin(cwd, worktree.repo_root))) {
             out.push({ ...entry, skipped_reason: "sidecar_cwd_mismatch" });
@@ -214,11 +206,11 @@ async function collectSidecarDiagnostics(sidecars, worktree, facts) {
         }
         // Accepted: this subagent's turns are part of this session, so its tokens
         // are too. Counted only now, after the cwd check has cleared it.
-        observeSessionFactsContent(facts, content);
+        mergeSessionFactsDelta(facts, read.facts);
         out.push({
             ...entry,
-            byte_size: raw.byteLength,
-            content_hash_sha256: sha256(raw),
+            byte_size: read.byte_size,
+            content_hash_sha256: read.sha256,
         });
     }
     return out;
@@ -233,7 +225,4 @@ function skippedResult(base, reason) {
         path_score: 0,
         worktree: null,
     };
-}
-function sha256(value) {
-    return crypto.createHash("sha256").update(value).digest("hex");
 }

package/dist/adapters/claude-attribution.js

@@ -37,7 +37,7 @@ export async function scanAndAttributeClaudeSessions(options) {
         .slice(0, limit);
     const results = [];
     for (const session of sessions) {
-        results.push(await attributeOneSession(session, options.worktrees, options.collectionRoots ?? []));
+        results.push(await attributeOneSession(session, options.worktrees, options.collectionRoots ?? [], options.readMemo));
     }
     const sumBy = (pick) => results.reduce((total, result) => total + pick(result), 0);
     const countState = (state) => results.filter((result) => result.state === state).length;

package/dist/adapters/raw-evidence-collection-state.js

@@ -24,6 +24,7 @@
  * collection is done.
  */
 import { openPrepareMemo } from "./raw-evidence-prepare-memo.js";
+import { openTranscriptReadMemo } from "./transcript-read-memo.js";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
@@ -65,6 +66,7 @@ export async function openCollection(context, options, places) {
         budget.images ??= options.images;
     const stagingAllowance = (budget.staging ??= await openStagingAllowance(options.stateDir, options.env ?? process.env, { statfs: options.statfs }));
     budget.prepareMemo ??= await openPrepareMemo(options.stateDir);
+    budget.readMemo ??= await openTranscriptReadMemo(options.stateDir, "image_scan").catch(() => undefined);
     return {
         context,
         filesDir: path.join(places.stagingDir, "files"),

package/dist/adapters/raw-evidence-image-reader.js

@@ -9,18 +9,42 @@
  */
 import path from "node:path";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
+import { statSourceForMemo } from "./transcript-read-memo.js";
+import { AGENT_IMAGE_MAX_BYTES } from "./agent-image-validation.js";
 import { evidenceSourceKey } from "../raw-evidence-staging.js";
 import { sha256 } from "./raw-evidence-keys.js";
 import { markBudgetCapApplied, recordScanned, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
 import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
+/**
+ * BLI-22797: a transcript with no image candidate is remembered by its stamp, so the next tick does not open it.
+ * Only that answer is remembered: an image whose bytes live in another file can change while the transcript does
+ * not, so a transcript that offered images is always read again. Bump the version when
+ * `agent-image-records.ts` changes what counts as a candidate.
+ */
+const IMAGE_SCAN_RECIPE = ["image-scan.v1", String(AGENT_IMAGE_MAX_BYTES)].join("|");
 export async function collectAgentImagesFromTranscript(collection, options) {
-    const result = await collectAgentImageEvidenceFromJsonlFile({
-        filePath: options.filePath,
-        source: options.source,
-        sessionId: options.sessionId,
-        sidecarId: options.sidecarId,
-    });
+    const memo = collection.budget.readMemo;
+    const stamp = memo ? await statSourceForMemo(options.filePath) : null;
+    const remembered = memo && stamp
+        ? memo.recall(options.filePath, stamp, IMAGE_SCAN_RECIPE, stamp.size, (data) => (data === "no_image_candidates" ? true : null))
+        : null;
+    if (!remembered && memo && !stamp)
+        memo.note("stamp_missing");
+    const result = remembered
+        ? { images: [], skipped: [] }
+        : await collectAgentImageEvidenceFromJsonlFile({
+            filePath: options.filePath,
+            source: options.source,
+            sessionId: options.sessionId,
+            sidecarId: options.sidecarId,
+        });
+    if (!remembered && memo && stamp) {
+        memo.note("fresh");
+        if (result.images.length === 0 && result.skipped.length === 0) {
+            memo.remember(options.filePath, stamp, IMAGE_SCAN_RECIPE, "no_image_candidates");
+        }
+    }
     recordScanned(collection, options.kind, result.images.length + result.skipped.length);
     for (const skipped of result.skipped) {
         collection.skipped.push({

package/dist/adapters/raw-evidence-prepare-memo.js

@@ -13,11 +13,14 @@
  *
  *   - the file's size, inode and mtime/ctime (nanoseconds) are exactly what they were when the
  *     entry was written, so the file has not been appended to, rewritten or replaced;
- *   - the recipe is the same: collector version (slim rules and secret rules ship with it), the
- *     machine's image-handling mode, and whether an image step ran at all;
- *   - the entry is not `volatile`: a transcript that still held an image with no stored
- *     description (or whose slim step failed) can change shape on the next tick without the file
- *     changing, so it is always rebuilt.
+ *   - the recipe is the same: a fingerprint of the rules that decide the bytes (the slim rules, the
+ *     secret rules, the image marker format; NOT the CLI version, BLI-22794), the machine's
+ *     image-handling mode, and whether an image step ran at all;
+ *   - the entry is not `volatile`, or it is volatile ONLY because of images with no stored
+ *     description (`pending_images`, BLI-22794). Such an entry is handed back to the caller, who
+ *     trusts it while none of those images has been described since; a described one rebuilds. A
+ *     volatile entry without `pending_images` (a failed slim step, or any older entry) is never
+ *     recalled: it can change shape on the next tick without the file changing.
  *
  * The caller then reuses the entry ONLY when the remembered content hash is already durable
  * remotely (`skipContentHashes`). Anything else, including every file that is not yet delivered,
@@ -25,19 +28,21 @@
  * known. A memo that is lost, corrupt, or wrong in the safe direction costs one slow tick, never
  * a missed upload. It holds ids, sizes, hashes and redaction metadata, never a byte of content.
  */
+import { createHash } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { isMissingFileFailure } from "../health-detail.js";
 import { readJsonFile, writeJsonFileAtomic } from "../local-state-files.js";
-import { LOCAL_COLLECTOR_VERSION } from "../local-state-config.js";
+import { evidenceRulesFingerprint } from "@bli-cockpit/telemetry-core";
+import { SLIM_RULES_VERSION } from "../slim/slim-transcript.js";
 export const PREPARE_MEMO_FILENAME = "transcript-prepare-memo.json";
 const MEMO_FORMAT = "prepare-memo.v1";
 /** About 700 bytes an entry, so this is at most a few MB; the oldest leave first. */
 export const PREPARE_MEMO_MAX_ENTRIES = 20_000;
 /** A source not seen for this long is a deleted or rotated session. */
-const FORGET_AFTER_MS = 14 * 24 * 3_600_000;
+export const FORGET_AFTER_MS = 14 * 24 * 3_600_000;
 /** Refresh `seen_ms` at most this often, so an unchanged tick does not rewrite the file. */
-const SEEN_REFRESH_MS = 24 * 3_600_000;
+export const SEEN_REFRESH_MS = 24 * 3_600_000;
 const TAG = "[raw-evidence-memo]";
 export function sourceStampOf(stat) {
     return {
@@ -54,29 +59,38 @@ export async function statSourceForMemo(filePath) {
         return null;
     }
 }
+/**
+ * What the prepared bytes depend on besides the file: the slim rules and the secret and image rules.
+ * Computed once per process. NOT the CLI version (BLI-22794): an upgrade that changes none of these
+ * keeps the memo warm. Changing a rule changes this, which rebuilds the memo once; that is intended
+ * (see `SLIM_RULES_VERSION` and telemetry-core's `evidenceRulesFingerprint`).
+ */
+let rulesFingerprint;
+export function rulesFingerprintOf(slimRulesVersion, evidenceRules) {
+    return createHash("sha256").update(`${slimRulesVersion}|${evidenceRules}`).digest("hex").slice(0, 32);
+}
 /** Everything besides the file that decides what its prepared bytes are. */
 export function prepareRecipe(options) {
-    return [MEMO_FORMAT, LOCAL_COLLECTOR_VERSION, options.kind, options.imageMode ?? "no_image_step"].join("|");
+    rulesFingerprint ??= rulesFingerprintOf(SLIM_RULES_VERSION, evidenceRulesFingerprint());
+    return [MEMO_FORMAT, rulesFingerprint, options.kind, options.imageMode ?? "no_image_step"].join("|");
 }
 export function prepareMemoPath(stateDir) {
     return path.join(stateDir, PREPARE_MEMO_FILENAME);
 }
-const EMPTY_COUNTS = { skipped_count: 0, skipped_bytes: 0, rebuilt_count: 0, rebuilt_bytes: 0, volatile_count: 0, volatile_reused_count: 0, volatile_reused_bytes: 0 };
+const EMPTY_COUNTS = { skipped_count: 0, skipped_bytes: 0, rebuilt_count: 0, rebuilt_bytes: 0, volatile_count: 0, volatile_reused_count: 0, volatile_reused_bytes: 0, rebuilt_image_now_described_count: 0 };
 export async function openPrepareMemo(stateDir) {
     const entries = await readMemoEntries(stateDir);
     let dirty = false;
     let counts = { ...EMPTY_COUNTS };
     /** Sources recalled since the last `settle`: only these have their `seen_ms` refreshed. */
     const recalled = new Set();
-    /** In-memory only, never persisted: see `rememberForThisRun`. */
-    const thisRun = new Map();
     return {
         recall(sourceKey, stamp, recipe) {
             const entry = entries.get(sourceKey);
             if (!entry)
-                return recallThisRun(thisRun, sourceKey, stamp, recipe);
-            if (entry.volatile)
-                return recallThisRun(thisRun, sourceKey, stamp, recipe);
+                return null;
+            if (entry.volatile && !entry.pending_images)
+                return null;
             if (entry.recipe !== recipe)
                 return null;
             if (entry.size !== stamp.size || entry.identity !== stamp.identity)
@@ -86,13 +100,13 @@ export async function openPrepareMemo(stateDir) {
         },
         remember(sourceKey, entry, now = Date.now()) {
             entries.set(sourceKey, { ...entry, seen_ms: now });
-            thisRun.delete(sourceKey);
             dirty = true;
         },
-        rememberForThisRun(sourceKey, entry) {
-            thisRun.set(sourceKey, { ...entry, volatile: true, seen_ms: Date.now() });
-        },
         count(outcome, bytes) {
+            if (outcome === "rebuilt_image_now_described") {
+                counts.rebuilt_image_now_described_count += 1;
+                return;
+            }
             if (outcome === "volatile_reused") {
                 counts.volatile_reused_count += 1;
                 counts.volatile_reused_bytes += bytes;
@@ -127,20 +141,12 @@ export async function openPrepareMemo(stateDir) {
         },
     };
 }
-function recallThisRun(thisRun, sourceKey, stamp, recipe) {
-    const entry = thisRun.get(sourceKey);
-    if (!entry || entry.recipe !== recipe)
-        return null;
-    if (entry.size !== stamp.size || entry.identity !== stamp.identity)
-        return null;
-    return entry;
-}
 /**
  * Entries recalled this pass keep their `seen_ms` fresh, lazily, so they are not forgotten while in
  * use. Only those: an entry nobody recalls (a deleted or rotated session) ages out after
  * FORGET_AFTER_MS.
  */
-function refreshSeen(entries, recalled, now) {
+export function refreshSeen(entries, recalled, now) {
     let touched = false;
     for (const key of recalled) {
         const entry = entries.get(key);
@@ -151,13 +157,13 @@ function refreshSeen(entries, recalled, now) {
     }
     return touched;
 }
-function trimEntries(entries, now) {
+export function trimEntries(entries, now, maxEntries = PREPARE_MEMO_MAX_ENTRIES) {
     for (const [key, entry] of entries) {
         if (now - entry.seen_ms > FORGET_AFTER_MS)
             entries.delete(key);
     }
     const newestFirst = [...entries.entries()].sort((a, b) => b[1].seen_ms - a[1].seen_ms);
-    const kept = newestFirst.slice(0, PREPARE_MEMO_MAX_ENTRIES);
+    const kept = newestFirst.slice(0, maxEntries);
     if (kept.length < entries.size) {
         entries.clear();
         for (const [key, entry] of kept)
@@ -205,6 +211,9 @@ function parseEntry(value) {
         return null;
     if (typeof entry["volatile"] !== "boolean" || typeof entry["seen_ms"] !== "number")
         return null;
+    const pending = entry["pending_images"];
+    if (pending !== undefined && (!Array.isArray(pending) || !pending.every((item) => typeof item === "string")))
+        return null;
     const redacted = entry["redacted"];
     if (redacted !== null && (typeof redacted !== "object" || typeof redacted.completenessLabel !== "string"))
         return null;

package/dist/adapters/raw-evidence-transcript-file.js

@@ -26,6 +26,7 @@ import { mightHoldEmbeddedImages } from "@bli-cockpit/telemetry-core";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
 import { prepareRecipe, statSourceForMemo, } from "./raw-evidence-prepare-memo.js";
+import { logVolatileReuse, trustVolatileEntry } from "./raw-evidence-volatile-reuse.js";
 import { describeSnapshot, stubReplacementClaim, supersedeClaimFor, } from "./raw-evidence-snapshot-supersede.js";
 import { admitEvidence, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
@@ -63,9 +64,9 @@ export async function collectOneEvidenceFile(collection, options) {
         markCapApplied(collection, options.kind, "max_file_bytes");
         return skip("file_too_large");
     }
-    const { sanitized, contentHash, stubClaim, volatile, deferredOnly, redactedEntry } = await prepareTranscriptForUpload(collection, options, names, read.bytes);
+    const { sanitized, contentHash, stubClaim, volatile, pendingImages, redactedEntry } = await prepareTranscriptForUpload(collection, options, names, read.bytes);
     await rememberPreparedTranscript(collection, options, names, {
-        stamp, recipe, readBytes: read.bytes.byteLength, contentHash, byteSize: sanitized.bytes.byteLength, volatile, deferredOnly, redactedEntry,
+        stamp, recipe, readBytes: read.bytes.byteLength, contentHash, byteSize: sanitized.bytes.byteLength, volatile, pendingImages, redactedEntry,
     });
     if (collection.skipContentHashes.has(contentHash) && !stubClaim) {
         collection.reused.push({
@@ -121,7 +122,7 @@ async function prepareTranscriptForUpload(collection, options, names, bytes) {
         byteSize: sanitized.bytes.byteLength,
         alreadyDurable: collection.skipContentHashes.has(contentHash),
     });
-    return { sanitized, contentHash, stubClaim, volatile: images.volatile, deferredOnly: images.deferredOnly, redactedEntry };
+    return { sanitized, contentHash, stubClaim, volatile: images.volatile, pendingImages: images.pendingImages, redactedEntry };
 }
 /**
  * The transcript bytes after the image step. Unchanged (the very same buffer) unless this sync has
@@ -133,10 +134,10 @@ async function prepareEmbeddedImages(collection, file) {
     const session = collection.budget.images;
     const source = file.kind.startsWith("codex") ? "codex" : file.kind.startsWith("claude") ? "claude_code" : null;
     if (!session || !source)
-        return { bytes: file.bytes, volatile: false, deferredOnly: false };
+        return { bytes: file.bytes, volatile: false, pendingImages: null };
     // Drop mode slims every transcript, image-bearing or not; keep mode only describes the ones that can hold an image.
     if (session.mode !== "describe_and_drop" && !mightHoldEmbeddedImages(file.bytes))
-        return { bytes: file.bytes, volatile: false, deferredOnly: false };
+        return { bytes: file.bytes, volatile: false, pendingImages: null };
     try {
         const prepared = await session.prepareTranscript({
             text: file.bytes.toString("utf8"),
@@ -151,15 +152,16 @@ async function prepareEmbeddedImages(collection, file) {
             : prepared.imageCount > 0;
         const slimFailed = session.mode === "describe_and_drop" && prepared.slim === null;
         const volatile = imagesPending || slimFailed;
-        // BLI-22785: volatile ONLY because the budget or a backoff held images back, and the slim step held up.
-        const deferredOnly = volatile && prepared.deferredOnly && !slimFailed;
+        // BLI-22794: volatile ONLY because of images without a stored description (the slim step held
+        // up): the bytes change only when one of these gains one, so the memo may keep the entry.
+        const pendingImages = volatile && !slimFailed ? prepared.pendingImages : null;
         if (!prepared.changed)
-            return { bytes: file.bytes, volatile, deferredOnly };
-        return { bytes: Buffer.from(prepared.text, "utf8"), volatile, deferredOnly };
+            return { bytes: file.bytes, volatile, pendingImages };
+        return { bytes: Buffer.from(prepared.text, "utf8"), volatile, pendingImages };
     }
     catch (error) {
         console.error("[raw-evidence] image or slim step failed, uploading the transcript as it was", JSON.stringify({ reason: "image_step_failed", kind: file.kind, ...describeError(error) }));
-        return { bytes: file.bytes, volatile: true, deferredOnly: false };
+        return { bytes: file.bytes, volatile: true, pendingImages: null };
     }
 }
 /**
@@ -182,6 +184,8 @@ async function reuseUnchangedTranscript(collection, options, names, stamp, recip
     const known = memo.recall(names.sourceKey, stamp, recipe);
     if (!known)
         return false;
+    if (known.volatile && !trustVolatileEntry(collection, memo, known, options.kind, names.sourceKey, stamp.size))
+        return false;
     if (!collection.skipContentHashes.has(known.content_hash)) {
         if (known.volatile)
             logVolatileReuse(options.kind, names.sourceKey, known.content_hash, "hash_not_durable_full_path");
@@ -202,24 +206,21 @@ async function reuseUnchangedTranscript(collection, options, names, stamp, recip
         codex_session_id: options.sessionId,
     });
     if (known.volatile) {
-        // BLI-22785: images held back by this run's budget or a backoff; rebuilding gives the same bytes.
+        // BLI-22794: only images without a description held it back, and none has one now.
         memo.count("volatile_reused", stamp.size);
-        logVolatileReuse(options.kind, names.sourceKey, known.content_hash, "images_deferred_budget_cannot_refill_this_run");
+        logVolatileReuse(options.kind, names.sourceKey, known.content_hash, "pending_images_still_undescribed");
         return true;
     }
     memo.count("skipped", stamp.size);
     return true;
 }
-function logVolatileReuse(kind, sourceKey, contentHash, reason) {
-    console.error("[raw-evidence] volatile transcript " + (reason === "hash_not_durable_full_path" ? "rebuilt" : "reused this run"), JSON.stringify({ reason, kind, source_key: sourceKey, hash_prefix: contentHash.slice(0, 12) }));
-}
 /** Remember what this transcript became, but only if the file stayed put while it was built. */
 async function rememberPreparedTranscript(collection, options, names, built) {
     const memo = collection.budget.prepareMemo;
     if (!memo)
         return;
     memo.count(built.volatile ? "volatile" : "rebuilt", built.readBytes);
-    if ((built.volatile && !built.deferredOnly) || !built.stamp)
+    if ((built.volatile && !built.pendingImages) || !built.stamp)
         return;
     const after = await statSourceForMemo(options.filePath);
     const stable = after !== null
@@ -237,15 +238,13 @@ async function rememberPreparedTranscript(collection, options, names, built) {
             ? { redaction: built.redactedEntry.redaction, completenessLabel: built.redactedEntry.completenessLabel }
             : null,
     };
-    if (built.volatile) {
-        // BLI-22785: in memory for this process only; the memo file keeps no volatile entry.
-        memo.rememberForThisRun(names.sourceKey, entry);
-        return;
-    }
     const known = memo.recall(names.sourceKey, built.stamp, built.recipe);
-    if (known && !known.volatile && known.content_hash === built.contentHash)
+    const pending = built.volatile ? built.pendingImages : undefined;
+    if (known && known.volatile === built.volatile && known.content_hash === built.contentHash
+        && (known.pending_images ?? []).join() === (pending ?? []).join())
         return;
-    memo.remember(names.sourceKey, { ...entry, volatile: false });
+    // BLI-22794: a volatile entry is kept across ticks with the images it is waiting on.
+    memo.remember(names.sourceKey, { ...entry, volatile: built.volatile, ...(pending ? { pending_images: pending } : {}) });
 }
 function nameEvidenceFile(options) {
     const fileName = path.basename(options.filePath);

package/dist/adapters/raw-evidence-volatile-reuse.js

@@ -0,0 +1,27 @@
+/**
+ * BLI-22794: may a remembered image-pending entry stand in for a rebuild? Not when one of its
+ * images has a stored description now (the bytes would differ, counted as
+ * `rebuilt_image_now_described_count`), and not while the describer could still take one of them
+ * this tick: a skipped transcript never reaches the describer, so reusing it would starve the
+ * images. Once the tick's budget is spent, the rest are reused until the next tick.
+ */
+export function trustVolatileEntry(collection, memo, known, kind, sourceKey, bytes) {
+    const session = collection.budget.images;
+    const pending = known.pending_images ?? [];
+    if (!session)
+        return false;
+    if (pending.some((sha256) => session.isDescribed(sha256))) {
+        memo.count("rebuilt_image_now_described", bytes);
+        logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_image_now_described");
+        return false;
+    }
+    if (session.hasDescribeRoom(pending)) {
+        logVolatileReuse(kind, sourceKey, known.content_hash, "rebuilt_describer_has_room");
+        return false;
+    }
+    return true;
+}
+export function logVolatileReuse(kind, sourceKey, contentHash, reason) {
+    const reused = reason === "pending_images_still_undescribed";
+    console.error("[raw-evidence] volatile transcript " + (reused ? "reused across ticks" : "rebuilt"), JSON.stringify({ reason, kind, source_key: sourceKey, hash_prefix: contentHash.slice(0, 12) }));
+}

package/dist/adapters/raw-evidence.js

@@ -106,6 +106,7 @@ export async function collectRawEvidencePack(context, options) {
  * made it possible. Counts and bytes only. Never throws: the memo is a cache.
  */
 async function reportPrepareMemo(collection) {
+    await collection.budget.readMemo?.settle();
     const counts = await collection.budget.prepareMemo?.settle();
     if (!counts || counts.skipped_count + counts.rebuilt_count + counts.volatile_reused_count === 0)
         return;
@@ -118,6 +119,7 @@ async function reportPrepareMemo(collection) {
         rebuilt_volatile_count: counts.volatile_count,
         rebuilt_volatile_reused_count: counts.volatile_reused_count,
         rebuilt_volatile_reused_bytes: counts.volatile_reused_bytes,
+        rebuilt_image_now_described_count: counts.rebuilt_image_now_described_count,
     }));
 }
 /**

package/dist/adapters/transcript-read-memo.js

@@ -0,0 +1,109 @@
+/**
+ * Remember what a transcript file said, so an unchanged file is not opened again (BLI-22797).
+ *
+ * A sync tick with nothing new still re-read every attributed session, every subagent sidecar and every
+ * transcript the image step scans: on the reference Mac 33 of the 37 seconds of main-thread JavaScript went to
+ * reading, parsing and hashing files whose size and mtime had not moved since the tick before. This is the
+ * sibling of the prepare memo (`raw-evidence-prepare-memo.ts`) and uses ITS stamp: size plus inode, mtime and
+ * ctime in nanoseconds, so an append, rewrite or replace is never mistaken for "unchanged". The entry cap, the
+ * `seen_ms` ageing and the atomic write are the prepare memo's own helpers.
+ *
+ * An entry is trusted only when the stamp AND the recipe match. The recipe names the rules that produced the
+ * remembered answer, so changing a rule rebuilds the memo once. What an entry holds is decided by its caller
+ * (`data`); this file never sees a byte of transcript content, and neither does the file on disk: signals,
+ * hashes, sizes and counts only. A memo that is lost, corrupt or stale in the safe direction costs one slow
+ * tick, never a wrong answer. The file path is hashed, so no path reaches the memo either.
+ */
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { isMissingFileFailure } from "../health-detail.js";
+import { readJsonFile, writeJsonFileAtomic } from "../local-state-files.js";
+import { PREPARE_MEMO_MAX_ENTRIES, refreshSeen, trimEntries, } from "./raw-evidence-prepare-memo.js";
+export { sourceStampOf, statSourceForMemo } from "./raw-evidence-prepare-memo.js";
+const MEMO_FORMAT = "transcript-read-memo.v1";
+const TAG = "[transcript-reads]";
+export function transcriptReadMemoPath(stateDir, name) {
+    return path.join(stateDir, `transcript-read-memo-${name}.json`);
+}
+const keyOf = (filePath) => createHash("sha256").update(filePath).digest("hex").slice(0, 32);
+export async function openTranscriptReadMemo(stateDir, name) {
+    const entries = await readEntries(stateDir, name);
+    let dirty = false;
+    let counts = { reused: 0, fresh: 0, stamp_missing: 0, bytes_not_read: 0 };
+    const recalled = new Set();
+    return {
+        recall(filePath, stamp, recipe, bytes, parse) {
+            const key = keyOf(filePath);
+            const entry = entries.get(key);
+            if (!entry || entry.recipe !== recipe || entry.size !== stamp.size || entry.identity !== stamp.identity)
+                return null;
+            const data = parse(entry.data);
+            if (data === null)
+                return null;
+            recalled.add(key);
+            counts.reused += 1;
+            counts.bytes_not_read += bytes;
+            return data;
+        },
+        remember(filePath, stamp, recipe, data, now = Date.now()) {
+            entries.set(keyOf(filePath), { ...stamp, recipe, data, seen_ms: now });
+            dirty = true;
+        },
+        note(outcome) {
+            if (outcome === "fresh")
+                counts.fresh += 1;
+            else
+                counts.stamp_missing += 1;
+        },
+        async settle(now = Date.now()) {
+            const done = counts;
+            counts = { reused: 0, fresh: 0, stamp_missing: 0, bytes_not_read: 0 };
+            dirty = refreshSeen(entries, recalled, now) || dirty;
+            recalled.clear();
+            let written = false;
+            let reason = done.reused > 0 ? "stamp_unchanged" : done.fresh > 0 ? "no_reusable_entry" : "stamp_missing";
+            if (dirty) {
+                const before = entries.size;
+                const kept = trimEntries(entries, now, PREPARE_MEMO_MAX_ENTRIES);
+                try {
+                    await writeJsonFileAtomic(transcriptReadMemoPath(stateDir, name), { schema_version: MEMO_FORMAT, entries: Object.fromEntries(kept) });
+                    dirty = false;
+                    written = true;
+                }
+                catch (error) {
+                    reason = "memo_write_failed";
+                    console.error(TAG + " memo not written; the next tick reads these files again", JSON.stringify({ memo: name, reason, entries: before, error_name: error instanceof Error ? error.name : typeof error }));
+                }
+            }
+            if (done.reused + done.fresh + done.stamp_missing === 0)
+                return;
+            console.error(TAG + " tick", JSON.stringify({ memo: name, reason, reused: done.reused, read_fresh: done.fresh, stamp_missing: done.stamp_missing, bytes_not_read: done.bytes_not_read, entries: entries.size, memo_written: written }));
+        },
+    };
+}
+async function readEntries(stateDir, name) {
+    const entries = new Map();
+    let raw;
+    try {
+        raw = await readJsonFile(transcriptReadMemoPath(stateDir, name));
+    }
+    catch (error) {
+        if (!isMissingFileFailure(error))
+            console.error(TAG + " memo unreadable; every file is read once", JSON.stringify({ memo: name, reason: "read_memo_unreadable" }));
+        return entries;
+    }
+    const stored = raw;
+    if (stored?.schema_version !== MEMO_FORMAT || !stored.entries || typeof stored.entries !== "object")
+        return entries;
+    let dropped = 0;
+    for (const [key, value] of Object.entries(stored.entries)) {
+        const e = value;
+        if (e && typeof e.size === "number" && typeof e.identity === "string" && typeof e.recipe === "string" && typeof e.seen_ms === "number" && e.data !== undefined)
+            entries.set(key, e);
+        else
+            dropped += 1;
+    }
+    if (dropped > 0)
+        console.error(TAG + " memo entries dropped as malformed", JSON.stringify({ memo: name, reason: "read_memo_entries_malformed", dropped, kept: entries.size }));
+    return entries;
+}

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.251");
+    writeLine(io?.stdout ?? process.stdout, "0.2.253");
     return 0;
   }
 

package/dist/commands/session-sync-scan.js

@@ -15,6 +15,7 @@ import { CLAUDE_CURSOR_FILENAME } from "../cursors/raw-evidence-cursor.js";
 import { clearSourceRetryFailure, recordSourceRetryFailure, } from "../spool/local-spool.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
 import { widenForCatchUp } from "./session-sync-outside-roots.js";
+import { openTranscriptReadMemo } from "../adapters/transcript-read-memo.js";
 const CLAUDE_FIRST_RUN_BACKFILL_MINUTES = 14 * 24 * 60;
 /** The Claude scan's own default window when nothing widens it: the last 24 hours. */
 const CLAUDE_DEFAULT_WINDOW_MINUTES = 24 * 60;
@@ -51,6 +52,7 @@ export async function scanAndAttributeBothSources(options) {
         retrySinceMinutes: plan.claudeRetrySinceMinutes,
         firstRunBackfill,
         outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
+        stateDir: options.paths.state_dir,
     });
     if (plan.codexEnabled) {
         await reconcileSourceScanRetry({
@@ -125,24 +127,33 @@ async function scanClaudeSessionsForSync(options) {
             ? CLAUDE_FIRST_RUN_BACKFILL_MINUTES
             : undefined, options.outsideRootCatchUpPending, CLAUDE_DEFAULT_WINDOW_MINUTES);
     const projectsDir = path.join(options.homeDir, ".claude", "projects");
-    let scan = await scanAndAttributeClaudeSessions({
-        projectsDir,
-        worktrees: options.worktrees,
-        now: options.now,
-        collectionRoots: options.collectionRoots,
-        sinceMinutes,
-    });
-    if (scan.session_limit_applied) {
-        scan = await scanAndAttributeClaudeSessions({
+    // BLI-22797: one memo for both passes, settled once, so an unchanged file is never opened.
+    const readMemo = await openTranscriptReadMemo(options.stateDir, "attribution").catch(() => undefined);
+    try {
+        let scan = await scanAndAttributeClaudeSessions({
             projectsDir,
             worktrees: options.worktrees,
             now: options.now,
             collectionRoots: options.collectionRoots,
             sinceMinutes,
-            limit: scan.discovered_session_count,
+            readMemo,
         });
+        if (scan.session_limit_applied) {
+            scan = await scanAndAttributeClaudeSessions({
+                projectsDir,
+                worktrees: options.worktrees,
+                now: options.now,
+                collectionRoots: options.collectionRoots,
+                sinceMinutes,
+                limit: scan.discovered_session_count,
+                readMemo,
+            });
+        }
+        return scan;
+    }
+    finally {
+        await readMemo?.settle();
     }
-    return scan;
 }
 export function sourceScanRetryReason(source, scan) {
     const reasons = new Set();

package/dist/crash-guard.js

@@ -1,3 +1,4 @@
+import { releaseHeldSyncLocksOnExit } from "./sync-lock.js";
 /**
  * A run that dies must not be able to say it worked (BLI-4110).
  *
@@ -125,6 +126,14 @@ export function installCrashGuard(options = {}) {
         }));
     });
     target.on("exit", () => {
+        // A lock still held at exit is an orphan, whatever the exit code: release
+        // it synchronously so the next tick is not blocked (BLI-22795).
+        try {
+            releaseHeldSyncLocksOnExit();
+        }
+        catch (error) {
+            console.error("[sync-lock] exit release threw", JSON.stringify({ reason: "exit_release_threw", ...describeCrash(error) }));
+        }
         if (commandReturned)
             return;
         // `EXIT_DIED_MID_RUN` has to be in this set, and leaving it out made this

package/dist/evidence-upload-deadline.js

@@ -0,0 +1,36 @@
+/**
+ * A deadline that keeps the event loop alive (BLI-22795).
+ *
+ * `AbortSignal.timeout()` is documented to use an unref'd timer. A fetch whose
+ * socket has gone (network dropped mid-upload) then has nothing ref'd behind
+ * it: the loop drains, Node exits with the await still pending, and the
+ * crash guard logs `died_mid_run` with the collection lock still held. Here
+ * the timer is ref'd, and the race rejects even when an injected or broken
+ * fetch ignores the abort, so the caller always gets a named failure.
+ */
+export const UPLOAD_DEADLINE_ERROR_NAME = "EvidenceUploadDeadlineError";
+export function isUploadDeadlineError(error) {
+    return error instanceof Error && error.name === UPLOAD_DEADLINE_ERROR_NAME;
+}
+export async function fetchWithDeadline(fetchImpl, url, init, deadlineMs) {
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            const error = new Error("upload request exceeded its deadline");
+            error.name = UPLOAD_DEADLINE_ERROR_NAME;
+            controller.abort();
+            reject(error);
+        }, deadlineMs);
+    });
+    try {
+        const pending = fetchImpl(url, { ...init, signal: controller.signal });
+        // If the deadline wins, the abandoned fetch may reject later; that must not
+        // become an unhandled rejection.
+        pending.catch(() => undefined);
+        return await Promise.race([pending, deadline]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/evidence-upload-direct.js

@@ -1,4 +1,5 @@
 import { encodeEvidenceBytes } from "@bli-cockpit/telemetry-core/evidence-storage-encoding";
+import { fetchWithDeadline, isUploadDeadlineError } from "./evidence-upload-deadline.js";
 import { noteSyncProgress } from "./sync-lock.js";
 /** The signed capability is the only credential sent to Storage. Never log it,
  * its query string, provider bodies, or thrown errors that might contain it. */
@@ -13,10 +14,10 @@ export async function putSignedChunk(options, signedUrl, bytes, uploadId, index)
     for (let attempt = 1; attempt <= attempts; attempt++) {
         let status = 0;
         try {
-            const response = await options.fetchImpl(signedUrl, {
+            const response = await fetchWithDeadline(options.fetchImpl, signedUrl, {
                 method: "PUT", headers: { "Content-Type": "application/octet-stream", "x-upsert": "false" },
-                body: new Uint8Array(encoded), signal: AbortSignal.timeout(60_000), redirect: "error",
-            });
+                body: new Uint8Array(encoded), redirect: "error",
+            }, 60_000);
             status = response.status;
             await response.body?.cancel();
             if (response.ok) {
@@ -28,8 +29,8 @@ export async function putSignedChunk(options, signedUrl, bytes, uploadId, index)
             if (status < 500 && status !== 429)
                 return false;
         }
-        catch {
-            log("signed_upload_network_failure", uploadId, index, attempt, status);
+        catch (error) {
+            log(isUploadDeadlineError(error) ? "signed_upload_deadline_exceeded" : "signed_upload_network_failure", uploadId, index, attempt, status);
         }
         if (attempt < attempts)
             await (options.sleep ?? sleep)(250 * attempt);

package/dist/evidence-upload-transport.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { describeError } from "./health-detail.js";
+import { fetchWithDeadline, isUploadDeadlineError } from "./evidence-upload-deadline.js";
 import { noteSyncProgress } from "./sync-lock.js";
 /**
  * The `send` stage: one retrying POST to an evidence-upload route, plus the
@@ -10,6 +11,7 @@ import { noteSyncProgress } from "./sync-lock.js";
  */
 const DEFAULT_MAX_ATTEMPTS = 3;
 const RETRY_DELAY_MS = 250;
+const REQUEST_DEADLINE_MS = 120_000;
 export async function requestJson(options, routePath, body) {
     const maxAttempts = options.maxAttemptsPerRequest ?? DEFAULT_MAX_ATTEMPTS;
     const sleep = options.sleep ?? defaultSleep;
@@ -17,7 +19,7 @@ export async function requestJson(options, routePath, body) {
     let lastBody = null;
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
         try {
-            const response = await options.fetchImpl(`${options.dashboardUrl}${routePath}`, {
+            const response = await fetchWithDeadline(options.fetchImpl, `${options.dashboardUrl}${routePath}`, {
                 method: "POST",
                 headers: {
                     "Authorization": `Bearer ${options.deviceToken}`,
@@ -26,7 +28,7 @@ export async function requestJson(options, routePath, body) {
                         ? { "x-tower-evidence-direct": "staged-gzip-v1" } : {}),
                 },
                 body: JSON.stringify(body),
-            });
+            }, REQUEST_DEADLINE_MS);
             lastStatus = response.status;
             lastBody = await readResponseJson(response);
             if (response.ok || (response.status < 500 && response.status !== 429)) {
@@ -42,7 +44,9 @@ export async function requestJson(options, routePath, body) {
             // the request left the machine. This is the exact silence BLI-2528 sat
             // behind for 57 days; the route is named, the body never is.
             console.error("[evidence-upload] request failed before a status came back", JSON.stringify({
-                reason: "upload_request_transport_error",
+                reason: isUploadDeadlineError(error)
+                    ? "upload_request_deadline_exceeded"
+                    : "upload_request_transport_error",
                 route: routePath,
                 attempt,
                 max_attempts: maxAttempts,

package/dist/image-description-session.js

@@ -13,9 +13,10 @@ import { imageStateKey, imageRetryDelayMs, readDescribedImageKeys, readFailedIma
 /** New images sent to the door in one sync (all worktrees together); the count never refills within a tick. */
 export const IMAGE_DESCRIBE_MAX_PER_RUN = 100;
 /**
- * After this long spent DESCRIBING (the clock starts at the first image sent, not when the session
- * opens: collection can reach image-bearing transcripts minutes into a tick), remaining images
- * wait for the next tick.
+ * After this long spent DESCRIBING, remaining images wait for the next tick. Only time inside the
+ * sends counts: collection reaches image-bearing transcripts minutes into a tick and keeps slimming
+ * other transcripts between sends, and a wall clock from the session open (or from the first send)
+ * spent the budget on that work, so almost nothing was described (BLI-22789: 1 of 1,874, then 10).
  */
 export const IMAGE_DESCRIBE_MAX_RUN_MS = 120_000;
 const CONCURRENCY = 3;
@@ -32,9 +33,11 @@ export async function openImageDescriptions(options) {
     const maxPerRun = options.maxPerRun ?? IMAGE_DESCRIBE_MAX_PER_RUN;
     const maxRunMs = options.maxRunMs ?? IMAGE_DESCRIBE_MAX_RUN_MS;
     const sentThisRun = 0;
-    const run = { options, mode, fetchImpl, described, orderedKeys, failedImages, stateDirty, settledThisRun, now, firstSendAt: null, maxPerRun, maxRunMs, sentThisRun };
+    const run = { options, mode, fetchImpl, described, orderedKeys, failedImages, stateDirty, settledThisRun, now, describingMs: 0, maxPerRun, maxRunMs, sentThisRun };
     return {
         mode,
+        isDescribed: (sha256) => described.has(imageStateKey(sha256)),
+        hasDescribeRoom: (sha256s) => describeRoomLeft(run, sha256s),
         async prepareTranscript(input) {
             const afterImages = await describeAndReplace(run, input);
             if (mode !== "describe_and_drop")
@@ -44,6 +47,19 @@ export async function openImageDescriptions(options) {
         },
     };
 }
+function describeRoomLeft(run, sha256s) {
+    if (run.sentThisRun >= run.maxPerRun)
+        return false;
+    if (run.describingMs > run.maxRunMs)
+        return false;
+    return sha256s.some((sha256) => {
+        // Already sent (or found too large) this run: it will not be sent again before the next tick.
+        if (run.settledThisRun.has(sha256))
+            return false;
+        const failure = run.failedImages[imageStateKey(sha256)];
+        return !(failure && failure.retry_after > run.now());
+    });
+}
 function markDescribed(run, sha256) {
     const { described, orderedKeys } = run;
     const key = imageStateKey(sha256);
@@ -55,7 +71,6 @@ function markDescribed(run, sha256) {
 async function sendOne(run, image, text, input) {
     const { options, fetchImpl, settledThisRun, failedImages } = run;
     run.sentThisRun += 1;
-    run.firstSendAt ??= run.now();
     const outcome = await postImageToDescribeDoor({ fetchImpl, dashboardUrl: options.dashboardUrl, deviceToken: options.deviceToken, sleep: options.sleep }, {
         schema_version: "image-describe.v1",
         sha256: image.sha256,
@@ -96,7 +111,7 @@ async function describeAndReplace(run, input) {
     const { mode, described, options, orderedKeys, failedImages } = run;
     const images = findEmbeddedImages(input.text);
     if (images.length === 0)
-        return { text: input.text, imageCount: 0, uniqueCount: 0, replacedCount: 0, charsSaved: 0, deferredOnly: false };
+        return { text: input.text, pendingImages: [], imageCount: 0, uniqueCount: 0, replacedCount: 0, charsSaved: 0, deferredOnly: false };
     const unique = new Map();
     for (const image of images)
         if (!unique.has(image.sha256))
@@ -114,6 +129,7 @@ async function describeAndReplace(run, input) {
     const replaced = mode === "describe_and_drop"
         ? replaceImagesWithMarkers(input.text, images, (image) => described.has(imageStateKey(image.sha256)))
         : { text: input.text, replacedCount: 0, charsSaved: 0 };
+    const pendingImages = [...unique.keys()].filter((sha256) => !described.has(imageStateKey(sha256)));
     console.error(TAG + " transcript prepared", JSON.stringify({
         mode,
         source: input.source,
@@ -128,6 +144,7 @@ async function describeAndReplace(run, input) {
     }));
     return {
         text: replaced.text,
+        pendingImages,
         imageCount: images.length,
         uniqueCount: unique.size,
         replacedCount: replaced.replacedCount,
@@ -164,11 +181,12 @@ function selectImagesToDescribe(run, unique, counts) {
 }
 async function sendPendingImages(run, toSend, counts, input) {
     const { now, maxPerRun, maxRunMs } = run;
+    const callStartedAt = now();
     let next = 0;
     const worker = async () => {
         while (next < toSend.length) {
             const image = toSend[next++];
-            const timeUp = run.firstSendAt !== null && now() - run.firstSendAt > maxRunMs;
+            const timeUp = run.describingMs + (now() - callStartedAt) > maxRunMs;
             if (run.sentThisRun >= maxPerRun || timeUp) {
                 counts.over_budget += 1;
                 continue;
@@ -177,6 +195,7 @@ async function sendPendingImages(run, toSend, counts, input) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(CONCURRENCY, toSend.length) }, worker));
+    run.describingMs += now() - callStartedAt;
 }
 function countImageOutcomes(run, toSend, counts) {
     const { settledThisRun } = run;

package/dist/slim/slim-transcript.js

@@ -25,6 +25,17 @@
 import { newClaudeSlimState, slimClaudeRecord } from "./claude-rules.js";
 import { newCodexSlimState, slimCodexRecord } from "./codex-rules.js";
 import { LineEdits, SeenBlocks, isJsonObject } from "./slim-support.js";
+/**
+ * The version of the slim rule set (claude-rules.ts, codex-rules.ts, claude-tool-results.ts,
+ * claude-attachments.ts, slim-support.ts and this file), BLI-22794. The local prepare memo keys what a
+ * transcript became on this value (plus the secret and image rules, see telemetry-core's
+ * `evidenceRulesFingerprint`) instead of on the CLI version.
+ *
+ * CHANGING ANY SLIM RULE MEANS BUMPING THIS CONSTANT. That rebuilds every collector's prepare memo
+ * once, which is intended: the stored bytes are no longer what the new rules would produce.
+ * `slim-rules-version.test.ts` fails when a rule changes without this moving.
+ */
+export const SLIM_RULES_VERSION = "slim-rules.v1";
 /** The text an image marker starts with; a line carrying one is a modified line (an image became a marker). */
 const IMAGE_MARKER_START = "[image sha256:";
 export function createSlimmer(kind, rulesForTests) {

package/dist/sync-lock.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { describeError } from "./health-detail.js";
@@ -44,23 +45,25 @@ export async function acquireSyncLock(paths, now = new Date(), options = {}) {
         marks: 0,
         lastMarkMs: now.getTime(),
         longestGapMs: 0,
+        lockPath,
+        token,
     };
     const existing = await readLock(lockPath);
-    if (existing && now.getTime() - existing.heartbeat_ms <= STALE_TAKEOVER_MS) {
+    if (existing && isFreshAndAlive(existing, now)) {
         logHeldByLiveOwner(existing, now);
         return { acquired: false, held_since: existing.heartbeat_at };
     }
     // Free or stale: try an exclusive create first; if another process created it
     // in the gap, re-check staleness before taking over.
-    let takeover = existing ? "stale" : null;
+    let takeover = existing ? staleReason(existing) : null;
     let owned = await tryExclusiveCreate(lockPath, token, now, held);
     if (!owned) {
         const current = await readLock(lockPath);
-        if (current && now.getTime() - current.heartbeat_ms <= STALE_TAKEOVER_MS) {
+        if (current && isFreshAndAlive(current, now)) {
             logHeldByLiveOwner(current, now);
             return { acquired: false, held_since: current.heartbeat_at };
         }
-        takeover = current ? "stale" : "unreadable";
+        takeover = current ? staleReason(current) : "unreadable";
         await writeLock(lockPath, token, now, held); // take over the stale lock
         owned = true;
     }
@@ -68,6 +71,63 @@ export async function acquireSyncLock(paths, now = new Date(), options = {}) {
     heldStates.add(held);
     return maintainOwnedLock(lockPath, token, held);
 }
+/**
+ * Does a process with this pid exist? `kill(pid, 0)` sends nothing: ESRCH means
+ * no such process, EPERM means it exists but is not ours (alive). Same on
+ * Windows. An unknown pid (-1 from an older record) is reported alive, so only
+ * the heartbeat decides for it.
+ */
+export function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+/** Blocks only when the heartbeat is fresh AND the owner process still exists. */
+function isFreshAndAlive(record, now) {
+    return now.getTime() - record.heartbeat_ms <= STALE_TAKEOVER_MS && isProcessAlive(record.pid);
+}
+/** A fresh heartbeat reaching here means the owner pid is gone; otherwise it aged out. */
+function staleReason(record) {
+    return isProcessAlive(record.pid) ? "stale" : "dead";
+}
+/**
+ * Synchronous release of every lock this process still holds, for the `exit`
+ * handler (BLI-22795): a process that ends without `release()` must not keep
+ * the next tick out until the heartbeat ages. Ownership-safe by token.
+ */
+export function releaseHeldSyncLocksOnExit() {
+    let released = 0;
+    for (const held of [...heldStates]) {
+        heldStates.delete(held);
+        let outcome = "not_ours_or_gone";
+        try {
+            if (held.lockPath && held.token) {
+                const raw = JSON.parse(fsSync.readFileSync(held.lockPath, "utf8"));
+                if (raw.token === held.token) {
+                    fsSync.rmSync(held.lockPath, { force: true });
+                    outcome = "removed";
+                    released += 1;
+                }
+            }
+        }
+        catch (error) {
+            outcome = `release_failed_${error.code ?? "unknown"}`;
+        }
+        console.error("[sync-lock] lock released on exit", JSON.stringify({
+            reason: "holder_exited_holding_lock",
+            outcome,
+            role: held.role,
+            held_ms: Math.max(0, Date.now() - held.startedMs),
+        }));
+    }
+    return released;
+}
 function maintainOwnedLock(lockPath, token, held) {
     const timer = setInterval(() => {
         // Refresh only while the lock is still ours; if we were taken over, stop
@@ -132,7 +192,13 @@ function logAcquired(held, takeover, previous, now) {
         ? "[sync-lock] lock acquired"
         : "[sync-lock] took over a lock whose owner stopped answering", JSON.stringify({
         role: held.role,
-        reason: takeover === "stale" ? "heartbeat_stale" : takeover === "unreadable" ? "lock_file_unreadable" : "lock_free",
+        reason: takeover === "stale"
+            ? "heartbeat_stale"
+            : takeover === "dead"
+                ? "previous_owner_dead"
+                : takeover === "unreadable"
+                    ? "lock_file_unreadable"
+                    : "lock_free",
         previous_pid: previous && previous.pid > 0 ? previous.pid : null,
         previous_heartbeat_age_ms: previous ? Math.max(0, now.getTime() - previous.heartbeat_ms) : null,
     }));
@@ -222,7 +288,10 @@ export async function inspectSyncLock(paths, now = Date.now()) {
     const record = await readLock(path.join(paths.state_dir, LOCK_FILENAME));
     if (!record)
         return null;
-    return { ...record, held: now - record.heartbeat_ms <= STALE_TAKEOVER_MS };
+    return {
+        ...record,
+        held: now - record.heartbeat_ms <= STALE_TAKEOVER_MS && isProcessAlive(record.pid),
+    };
 }
 /**
  * Remove the lock file only if it still carries `token`: the holder this caller

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.251",
+  "version": "0.2.253",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.73",
-    "@bli-cockpit/mcp": "0.1.154",
-    "@bli-cockpit/telemetry-core": "0.1.80"
+    "@bli-cockpit/memory-mcp": "0.1.75",
+    "@bli-cockpit/mcp": "0.1.156",
+    "@bli-cockpit/telemetry-core": "0.1.82"
   },
   "repository": {
     "type": "git",