@bli-cockpit/cli 0.2.27 → 0.2.29

package/dist/adapters/raw-evidence.js

@@ -1,5 +1,4 @@
-import { EvidenceCompletenessPayloadSchema, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, SECRET_FILE_SEGMENT_PATTERN, SourceScanResultSchema, containsSecretLikeContent, redactSecretLikeContent, } from "@bli-cockpit/telemetry-core";
-import { spawn } from "node:child_process";
+import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
@@ -8,12 +7,18 @@ import { makeSourceAdapterIdentity, } from "./common.js";
 import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
 import { defaultCodexSessionDirs, } from "./codex-attribution.js";
 import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-policy.js";
+import { contentKeyedRawEvidencePackId, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, evidenceSourceKey, heldSourceKeys, readRawEvidenceStagingState, recordStagedObject, resolveStagedObject, } from "../raw-evidence-staging.js";
+import { isSecretLikePath, safeKeySegment, sha256, shortHash, } from "./raw-evidence-keys.js";
+import { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
+import { countEvidenceEntries, makeEvidenceCompleteness, markBudgetCapApplied, markCapApplied, recordScanned, recordSkipCount, recordTruncationCount, } from "./raw-evidence-completeness.js";
+import { evidenceEntry, pointerFromEntry, RAW_EVIDENCE_BUCKET, } from "./raw-evidence-manifest.js";
+import { chmodPrivate, ensurePrivateDir, persistStagingState, promoteStagedPack, stageManifest, } from "./raw-evidence-pack-store.js";
+import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, runGitDiff, } from "./raw-evidence-git-diff.js";
+// Re-exported so every consumer keeps importing from `adapters/raw-evidence`.
+export { RAW_EVIDENCE_BUCKET, RAW_EVIDENCE_RETENTION_MODE, } from "./raw-evidence-manifest.js";
+export { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
 const DEFAULT_SINCE_MINUTES = 24 * 60;
 const DEFAULT_SESSION_LIMIT = 50;
-const MAX_GIT_DIFF_BYTES = 2 * 1024 * 1024;
-const GIT_DIFF_TIMEOUT_MS = 3_000;
-export const RAW_EVIDENCE_BUCKET = "ambient-raw-evidence";
-export const RAW_EVIDENCE_RETENTION_MODE = "remote_durable";
 // Per-sync upload budgets enforced at COLLECTION time (D7b). A single marathon
 // transcript can approach the 500 MiB wire cap (RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES),
 // so 2 GiB leaves room for several files without starving the sync; overflow
@@ -21,250 +26,394 @@ export const RAW_EVIDENCE_RETENTION_MODE = "remote_durable";
 export const RAW_EVIDENCE_DEFAULT_BYTE_BUDGET = 2 * 1024 * 1024 * 1024;
 export const RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET = 300;
 const CLAUDE_MAX_COLLECT_FILE_BYTES = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES;
+// ---------------------------------------------------------------------------
+// The pass
+// ---------------------------------------------------------------------------
 export async function collectRawEvidencePack(context, options) {
     const startedAt = context.now.toISOString();
-    const packId = rawEvidencePackId(context);
-    const evidenceDir = path.join(options.stateDir, "raw-evidence", packId);
-    const filesDir = path.join(evidenceDir, "files");
-    const entries = [];
-    const skipped = [];
-    const truncated = [];
-    const failed = [];
-    const redacted = [];
-    const reused = [];
+    const rawEvidenceRoot = path.join(options.stateDir, "raw-evidence");
+    // Staging first, promotion second (BLI-3066). The pack id cannot be known
+    // until the content is, so bytes land in a private staging directory and the
+    // directory is then renamed to its content-keyed name — or dropped, when an
+    // identical pack is already there.
+    const stagingDir = path.join(rawEvidenceRoot, `.staging-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
     const sinceMinutes = options.sinceMinutes ?? DEFAULT_SINCE_MINUTES;
-    const sessionLimit = options.sessionLimit ?? DEFAULT_SESSION_LIMIT;
-    const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
-    const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
-    const collection = {
-        context,
-        filesDir,
-        packId,
-        entries,
-        skipped,
-        truncated,
-        failed,
-        redacted,
-        reused,
-        scanned: new Map(),
-        caps: [
-            {
-                source: "raw_evidence",
-                cap_type: "byte_budget",
-                limit: byteBudget,
-                observed: options.budget?.remainingBytes ?? byteBudget,
-                applied: false,
-            },
-            {
-                source: "raw_evidence",
-                cap_type: "object_budget",
-                limit: objectBudget,
-                observed: options.budget?.remainingObjects ?? objectBudget,
-                applied: false,
-            },
-            {
-                source: "git_diff",
-                cap_type: "max_bytes_per_diff",
-                limit: MAX_GIT_DIFF_BYTES,
-                applied: false,
-            },
-            {
-                source: "git_diff",
-                cap_type: "timeout_ms",
-                limit: GIT_DIFF_TIMEOUT_MS,
-                applied: false,
-            },
-            {
-                source: "codex_jsonl",
-                cap_type: "max_file_bytes",
-                limit: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-                applied: false,
-            },
-            {
-                source: "claude_jsonl",
-                cap_type: "max_file_bytes",
-                limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-                applied: false,
-            },
-            {
-                source: "claude_jsonl_sidecar",
-                cap_type: "max_file_bytes",
-                limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-                applied: false,
-            },
-        ],
-        skipContentHashes: options.skipContentHashes ?? new Set(),
-        budget: options.budget ?? {
-            remainingBytes: byteBudget,
-            remainingObjects: objectBudget,
-        },
-        index: { value: 0 },
+    const collection = await openCollection(context, options, {
+        rawEvidenceRoot,
+        stagingDir,
+    });
+    const scanWindow = {
+        startedAt,
+        finishedAt: () => context.now.toISOString(),
+        sinceMinutes,
     };
     try {
-        await ensurePrivateDir(evidenceDir);
-        await ensurePrivateDir(filesDir);
-        recordAttributionCompleteness(collection, {
-            codex: options.codexAttributionScan,
-            claude: options.claudeAttributionScan,
-            selectedCodexPaths: new Set(options.codexSessionFiles?.map((file) => file.local_path) ?? []),
-            selectedClaudePaths: new Set(options.claudeSessionFiles?.map((file) => file.local_path) ?? []),
-        });
+        await ensurePrivateDir(stagingDir);
+        await ensurePrivateDir(collection.filesDir);
+        recordAttributionCompleteness(collection, options);
         if (options.includeCodexJsonl !== false) {
             await collectCodexJsonlFiles(collection, {
                 codexSessionFiles: options.codexSessionFiles,
                 sessionsDir: options.sessionsDir,
                 sessionsDirs: options.sessionsDirs,
                 sinceMinutes,
-                limit: sessionLimit,
+                limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
             });
         }
         if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
             await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
         }
         await collectGitDiffFiles(collection, options.repoRoot);
-        const deferredByteBudgetCount = skipped.filter((entry) => entry.reason === "deferred_byte_budget").reduce((sum, entry) => sum + evidenceEntryCount(entry), 0);
-        const deferredObjectBudgetCount = skipped.filter((entry) => entry.reason === "deferred_object_budget").reduce((sum, entry) => sum + evidenceEntryCount(entry), 0);
-        if (entries.length === 0) {
-            const evidenceCompleteness = makeEvidenceCompleteness(collection, {
-                startedAt,
-                finishedAt: context.now.toISOString(),
-                sinceMinutes,
+        if (collection.entries.length === 0) {
+            return await finishWithEmptyPack(collection, options, {
+                stagingDir,
+                window: scanWindow,
             });
-            const facts = {
-                pack_id: packId,
-                manifest_path: path.join(evidenceDir, "manifest.json"),
-                evidence_dir: evidenceDir,
-                storage_bucket: RAW_EVIDENCE_BUCKET,
-                file_count: 0,
-                byte_size: 0,
-                skipped_count: countEvidenceEntries(skipped),
-                sanitized_count: redacted.length,
-                reused_count: reused.length,
-                deferred_byte_budget_count: deferredByteBudgetCount,
-                deferred_object_budget_count: deferredObjectBudgetCount,
-                content_kinds: [],
-                evidence_completeness: evidenceCompleteness,
-                pointers: [],
-                upload_files: [],
-                reused,
-            };
-            return {
-                facts,
-                scan: makeRawEvidenceScan({
-                    context,
-                    startedAt,
-                    status: "partial",
-                    facts,
-                }),
-            };
         }
-        const manifestWithoutSelf = makeManifest({
-            context,
-            packId,
-            entries,
-            skipped,
-            redacted,
-            reused,
+        return await finishWithPromotedPack(collection, options, {
+            stagingDir,
+            window: scanWindow,
         });
-        const manifestPath = path.join(evidenceDir, "manifest.json");
-        const manifestBytes = Buffer.from(`${JSON.stringify(manifestWithoutSelf, null, 2)}\n`, "utf8");
-        await fs.writeFile(manifestPath, manifestBytes, { mode: 0o600 });
-        await chmodPrivate(manifestPath, 0o600);
-        const manifestEntry = evidenceEntry({
-            context,
-            kind: "manifest",
-            packId,
-            localPath: manifestPath,
-            relativePath: "manifest.json",
-            mediaType: "application/json",
-            redactedSummary: "Local raw evidence pack manifest.",
-            bytes: manifestBytes,
-        });
-        entries.push(manifestEntry);
-        const evidenceCompleteness = makeEvidenceCompleteness(collection, {
-            startedAt,
-            finishedAt: context.now.toISOString(),
-            sinceMinutes,
-        });
-        const facts = {
-            pack_id: packId,
-            manifest_path: manifestPath,
-            evidence_dir: evidenceDir,
-            storage_bucket: RAW_EVIDENCE_BUCKET,
-            file_count: entries.length,
-            byte_size: entries.reduce((sum, entry) => sum + entry.byte_size, 0),
-            skipped_count: countEvidenceEntries(skipped),
-            sanitized_count: redacted.length,
-            reused_count: reused.length,
-            deferred_byte_budget_count: deferredByteBudgetCount,
-            deferred_object_budget_count: deferredObjectBudgetCount,
-            content_kinds: [...new Set(entries.map((entry) => entry.kind))],
-            evidence_completeness: evidenceCompleteness,
-            pointers: entries.map(pointerFromEntry),
-            upload_files: entries.map((entry) => ({
-                pointer: pointerFromEntry(entry),
-                local_path: entry.local_path,
-                kind: entry.kind,
-                codex_session_id: entry.codex_session_id ?? null,
-                ...(entry.artifact_metadata
-                    ? { artifact_metadata: entry.artifact_metadata }
-                    : {}),
-            })),
-            reused,
-        };
-        return {
-            facts,
-            scan: makeRawEvidenceScan({
-                context,
-                startedAt,
-                status: entries.length > 1 ? "ok" : "partial",
-                facts,
-            }),
-        };
     }
-    catch {
-        failed.push({
-            kind: "raw_evidence",
-            reason: "collection_failed",
+    catch (error) {
+        return await finishWithFailedPack(collection, {
+            stagingDir,
+            window: scanWindow,
+            error,
         });
-        const evidenceCompleteness = makeEvidenceCompleteness(collection, {
-            startedAt,
-            finishedAt: context.now.toISOString(),
-            sinceMinutes,
-        });
-        const facts = {
-            pack_id: packId,
-            manifest_path: path.join(evidenceDir, "manifest.json"),
-            evidence_dir: evidenceDir,
-            storage_bucket: RAW_EVIDENCE_BUCKET,
-            file_count: 0,
-            byte_size: 0,
-            skipped_count: countEvidenceEntries(skipped),
-            sanitized_count: redacted.length,
-            reused_count: reused.length,
-            deferred_byte_budget_count: skipped
-                .filter((entry) => entry.reason === "deferred_byte_budget")
-                .reduce((sum, entry) => sum + evidenceEntryCount(entry), 0),
-            deferred_object_budget_count: skipped
-                .filter((entry) => entry.reason === "deferred_object_budget")
-                .reduce((sum, entry) => sum + evidenceEntryCount(entry), 0),
-            content_kinds: [],
-            evidence_completeness: evidenceCompleteness,
-            pointers: [],
-            upload_files: [],
-            reused,
-        };
-        return {
+    }
+}
+async function openCollection(context, options, places) {
+    const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
+    const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
+    const staging = await readRawEvidenceStagingState(options.stateDir);
+    return {
+        context,
+        filesDir: path.join(places.stagingDir, "files"),
+        rawEvidenceRoot: places.rawEvidenceRoot,
+        packId: "",
+        staging,
+        heldSources: collectionHeldSources(staging, context.now, options),
+        stagedReusedCount: 0,
+        stagedNewCount: 0,
+        deliveryHeldCount: 0,
+        entries: [],
+        skipped: [],
+        truncated: [],
+        failed: [],
+        redacted: [],
+        reused: [],
+        scanned: new Map(),
+        caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
+        skipContentHashes: options.skipContentHashes ?? new Set(),
+        budget: options.budget ?? {
+            remainingBytes: byteBudget,
+            remainingObjects: objectBudget,
+        },
+        index: { value: 0 },
+    };
+}
+/**
+ * Which sources this pass refuses to even read because their delivery is inside
+ * a backoff window — none of them, when a person asked for this pass.
+ *
+ * The bypass is logged rather than assumed: an operator retry that quietly
+ * ignored a hold would be as unreadable as the hold that quietly blocked it.
+ */
+function collectionHeldSources(staging, now, options) {
+    const held = heldSourceKeys(staging, now);
+    if (deliveryBackoffApplies(options.deliveryMode))
+        return held;
+    if (held.size > 0) {
+        console.error("[raw-evidence] delivery backoff bypassed for operator retry", JSON.stringify({
+            reason: DELIVERY_BACKOFF_BYPASS_REASON,
+            source_count: held.size,
+        }));
+    }
+    return new Set();
+}
+/** Every cap this pass could hit, declared up front and flipped when applied. */
+function startingCaps(options) {
+    return [
+        {
+            source: "raw_evidence",
+            cap_type: "byte_budget",
+            limit: options.byteBudget,
+            observed: options.budget?.remainingBytes ?? options.byteBudget,
+            applied: false,
+        },
+        {
+            source: "raw_evidence",
+            cap_type: "object_budget",
+            limit: options.objectBudget,
+            observed: options.budget?.remainingObjects ?? options.objectBudget,
+            applied: false,
+        },
+        {
+            source: "git_diff",
+            cap_type: "max_bytes_per_diff",
+            limit: MAX_GIT_DIFF_BYTES,
+            applied: false,
+        },
+        {
+            source: "git_diff",
+            cap_type: "timeout_ms",
+            limit: GIT_DIFF_TIMEOUT_MS,
+            applied: false,
+        },
+        {
+            source: "codex_jsonl",
+            cap_type: "max_file_bytes",
+            limit: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
+            applied: false,
+        },
+        {
+            source: "claude_jsonl",
+            cap_type: "max_file_bytes",
+            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
+            applied: false,
+        },
+        {
+            source: "claude_jsonl_sidecar",
+            cap_type: "max_file_bytes",
+            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
+            applied: false,
+        },
+    ];
+}
+// ---------------------------------------------------------------------------
+// The three ways a pass ends
+// ---------------------------------------------------------------------------
+/**
+ * Nothing collected: drop the staging directory instead of leaving an empty
+ * pack behind. This used to leave one empty `work-*` dir per sync.
+ */
+async function finishWithEmptyPack(collection, options, run) {
+    await discardStagingDir(run.stagingDir);
+    collection.packId = contentKeyedRawEvidencePackId({
+        workContextId: collection.context.workContextId,
+        contentHashes: [],
+    });
+    await persistStagingState(options.stateDir, collection.staging, collection.context.now.toISOString());
+    const facts = makeEmptyPackFacts(collection, run.window);
+    return {
+        facts,
+        scan: makeRawEvidenceScan({
+            context: collection.context,
+            startedAt: run.window.startedAt,
+            status: "partial",
+            facts,
+        }),
+    };
+}
+async function finishWithPromotedPack(collection, options, run) {
+    const context = collection.context;
+    const entries = collection.entries;
+    // The pack is named by what is in it, never by when it was made. Identical
+    // content on the next sync resolves to the identical directory, which is
+    // the whole fix for BLI-3066.
+    const packId = contentKeyedRawEvidencePackId({
+        workContextId: context.workContextId,
+        contentHashes: entries.map((entry) => entry.content_hash_sha256),
+    });
+    collection.packId = packId;
+    const promotion = await promoteStagedPack({
+        rawEvidenceRoot: collection.rawEvidenceRoot,
+        stagingDir: run.stagingDir,
+        packId,
+        workContextId: context.workContextId,
+        entries,
+    });
+    const evidenceDir = promotion.evidenceDir;
+    rebaseStagedEntriesOntoPack(collection, evidenceDir);
+    const manifestPath = path.join(evidenceDir, "manifest.json");
+    const manifestBytes = await stageManifest({
+        context,
+        packId,
+        manifestPath,
+        entries,
+        skipped: collection.skipped,
+        redacted: collection.redacted,
+        reused: collection.reused,
+        reusePack: promotion.state === "reused",
+    });
+    entries.push(evidenceEntry({
+        context,
+        kind: "manifest",
+        packId,
+        localPath: manifestPath,
+        relativePath: "manifest.json",
+        mediaType: "application/json",
+        redactedSummary: "Local raw evidence pack manifest.",
+        bytes: manifestBytes,
+    }));
+    await persistStagingState(options.stateDir, collection.staging, context.now.toISOString());
+    console.error("[raw-evidence] pack staged", JSON.stringify({
+        pack_id: packId,
+        stage_state: promotion.state,
+        reason: stageReasonLabel(promotion.state, promotion.priorPackCount),
+        prior_pack_count: promotion.priorPackCount,
+        refilled_file_count: promotion.refilledFileCount,
+        file_count: entries.length,
+        byte_size: totalByteSize(entries),
+        staged_new: collection.stagedNewCount,
+        staged_reused: collection.stagedReusedCount,
+        delivery_held: collection.deliveryHeldCount,
+    }));
+    const facts = {
+        ...packFactsShell(collection, {
+            packId,
+            manifestPath,
+            evidenceDir,
+            window: run.window,
+        }),
+        stage_state: promotion.state,
+        file_count: entries.length,
+        byte_size: totalByteSize(entries),
+        content_kinds: [...new Set(entries.map((entry) => entry.kind))],
+        pointers: entries.map(pointerFromEntry),
+        upload_files: entries.map(uploadFileFromEntry),
+    };
+    return {
+        facts,
+        scan: makeRawEvidenceScan({
+            context,
+            startedAt: run.window.startedAt,
+            status: entries.length > 1 ? "ok" : "partial",
+            facts,
+        }),
+    };
+}
+/**
+ * A crashed pass. The staged-object index is deliberately NOT written: this
+ * attempt's bookkeeping describes a directory that is about to be deleted.
+ */
+async function finishWithFailedPack(collection, run) {
+    collection.failed.push({
+        kind: "raw_evidence",
+        reason: "collection_failed",
+    });
+    // Staging is per-attempt scratch: a crashed pass must not leave a partial
+    // directory behind to be counted, re-hashed or swept later.
+    await discardStagingDir(run.stagingDir);
+    collection.packId =
+        collection.packId ||
+            contentKeyedRawEvidencePackId({
+                workContextId: collection.context.workContextId,
+                contentHashes: collection.entries.map((entry) => entry.content_hash_sha256),
+            });
+    console.error("[raw-evidence] pack collection failed", JSON.stringify({
+        pack_id: collection.packId,
+        reason: "collection_failed",
+        detail: run.error instanceof Error ? run.error.name : typeof run.error,
+        collected_file_count: collection.entries.length,
+        staged_new: collection.stagedNewCount,
+        staged_reused: collection.stagedReusedCount,
+    }));
+    const facts = makeEmptyPackFacts(collection, run.window);
+    return {
+        facts,
+        scan: makeRawEvidenceScan({
+            context: collection.context,
+            startedAt: run.window.startedAt,
+            status: "failed",
             facts,
-            scan: makeRawEvidenceScan({
-                context,
-                startedAt,
-                status: "failed",
-                facts,
-            }),
-        };
+        }),
+    };
+}
+/**
+ * A pack with no files of its own: the empty pass and the crashed pass report
+ * the same shape, differing only in the scan status and the reason already
+ * logged. `evidence_completeness` still carries every gap this pass recorded.
+ */
+function makeEmptyPackFacts(collection, scanWindow) {
+    const evidenceDir = path.join(collection.rawEvidenceRoot, collection.packId);
+    return {
+        ...packFactsShell(collection, {
+            packId: collection.packId,
+            manifestPath: path.join(evidenceDir, "manifest.json"),
+            evidenceDir,
+            window: scanWindow,
+        }),
+        stage_state: "empty",
+        file_count: 0,
+        byte_size: 0,
+        content_kinds: [],
+        pointers: [],
+        upload_files: [],
+    };
+}
+/** The counts every ending reports identically, however the pass ended. */
+function packFactsShell(collection, place) {
+    return {
+        pack_id: place.packId,
+        manifest_path: place.manifestPath,
+        evidence_dir: place.evidenceDir,
+        storage_bucket: RAW_EVIDENCE_BUCKET,
+        skipped_count: countEvidenceEntries(collection.skipped),
+        sanitized_count: collection.redacted.length,
+        reused_count: collection.reused.length,
+        staged_reused_count: collection.stagedReusedCount,
+        staged_new_count: collection.stagedNewCount,
+        delivery_held_count: collection.deliveryHeldCount,
+        deferred_byte_budget_count: countDeferred(collection, "deferred_byte_budget"),
+        deferred_object_budget_count: countDeferred(collection, "deferred_object_budget"),
+        evidence_completeness: makeEvidenceCompleteness(collection, {
+            startedAt: place.window.startedAt,
+            finishedAt: place.window.finishedAt(),
+            sinceMinutes: place.window.sinceMinutes,
+        }),
+        reused: collection.reused,
+    };
+}
+function countDeferred(collection, reason) {
+    return countEvidenceEntries(collection.skipped, (entry) => entry.reason === reason);
+}
+function totalByteSize(entries) {
+    return entries.reduce((sum, entry) => sum + entry.byte_size, 0);
+}
+function uploadFileFromEntry(entry) {
+    return {
+        pointer: pointerFromEntry(entry),
+        local_path: entry.local_path,
+        kind: entry.kind,
+        codex_session_id: entry.codex_session_id ?? null,
+        ...(entry.artifact_metadata
+            ? { artifact_metadata: entry.artifact_metadata }
+            : {}),
+    };
+}
+function stageReasonLabel(state, priorPackCount) {
+    if (state === "reused")
+        return "staged_reused";
+    if (state === "restaged_incomplete")
+        return "restaged_incomplete";
+    return priorPackCount > 0 ? "restaged_content_changed" : "staged_new";
+}
+/**
+ * Point every entry this pass staged at its home in the promoted pack, and
+ * remember the content hash so the next sync can adopt the copy instead of
+ * writing it again. Entries adopted from another pack keep their path.
+ */
+function rebaseStagedEntriesOntoPack(collection, evidenceDir) {
+    for (const entry of collection.entries) {
+        if (!entry.staged_in_pack)
+            continue;
+        entry.local_path = path.join(evidenceDir, "files", path.basename(entry.local_path));
+        recordStagedObject(collection.staging, entry.content_hash_sha256, {
+            pack_id: collection.packId,
+            relative_path: `files/${path.basename(entry.local_path)}`,
+            byte_size: entry.byte_size,
+            source_key: entry.source_key,
+            staged_at: collection.context.now.toISOString(),
+        });
     }
 }
+async function discardStagingDir(stagingDir) {
+    await fs
+        .rm(stagingDir, { recursive: true, force: true })
+        .catch(() => undefined);
+}
 function makeRawEvidenceScan(options) {
     return SourceScanResultSchema.parse({
         adapter: makeSourceAdapterIdentity("collector_runtime", "raw-evidence-pack"),
@@ -293,6 +442,10 @@ function makeRawEvidenceScan(options) {
             `bytes:${options.facts.byte_size}`,
             `skipped:${options.facts.skipped_count}`,
             `reused:${options.facts.reused_count}`,
+            `stage_state:${options.facts.stage_state}`,
+            `staged_new:${options.facts.staged_new_count}`,
+            `staged_reused:${options.facts.staged_reused_count}`,
+            `delivery_held:${options.facts.delivery_held_count}`,
             `completeness:${options.facts.evidence_completeness.status}`,
             `truncated:${options.facts.evidence_completeness.totals.truncated_count}`,
             `deferred:${options.facts.evidence_completeness.totals.deferred_count}`,
@@ -301,12 +454,20 @@ function makeRawEvidenceScan(options) {
         ],
     });
 }
-function recordAttributionCompleteness(collection, scans) {
-    if (scans.codex) {
-        recordCodexAttributionCompleteness(collection, scans.codex, scans.selectedCodexPaths);
+// ---------------------------------------------------------------------------
+// What attribution already knew
+// ---------------------------------------------------------------------------
+/**
+ * Attribution ran before collection and already knows which sessions it could
+ * not name. Those are gaps in this pass even though no byte was read, so they
+ * are recorded first — a session Cockpit never looked at must not be invisible.
+ */
+function recordAttributionCompleteness(collection, options) {
+    if (options.codexAttributionScan) {
+        recordCodexAttributionCompleteness(collection, options.codexAttributionScan, new Set(options.codexSessionFiles?.map((file) => file.local_path) ?? []));
     }
-    if (scans.claude) {
-        recordClaudeAttributionCompleteness(collection, scans.claude, scans.selectedClaudePaths);
+    if (options.claudeAttributionScan) {
+        recordClaudeAttributionCompleteness(collection, options.claudeAttributionScan, new Set(options.claudeSessionFiles?.map((file) => file.local_path) ?? []));
     }
 }
 function recordCodexAttributionCompleteness(collection, scan, selectedPaths) {
@@ -384,39 +545,46 @@ function recordClaudeAttributionCompleteness(collection, scan, selectedPaths) {
 }
 function recordAttributionResultSkips(collection, source, results, selectedPaths) {
     for (const result of results) {
-        // A selected session is being collected by this pass. A live-sync-safe
-        // synthetic target is also not a skip when another workspace pack owns it.
-        if (result.state === "attributed" ||
-            selectedPaths.has(result.file_path) ||
-            (result.worktree !== null &&
-                isLiveRawEvidenceSyncAttribution(result.state, result.reason, true))) {
+        if (isAttributionAccountedFor(result, selectedPaths))
             continue;
-        }
         const reason = result.state === "skipped"
             ? result.reason
             : `attribution_${result.state}:${result.reason}`;
         recordSkipCount(collection, source, reason, 1);
     }
 }
+/**
+ * Not every unattributed result is a gap. A selected session is being collected
+ * by this pass, and a live-sync-safe synthetic target is owned by another
+ * workspace's pack — neither is missing evidence.
+ */
+function isAttributionAccountedFor(result, selectedPaths) {
+    if (result.state === "attributed")
+        return true;
+    if (selectedPaths.has(result.file_path))
+        return true;
+    return (result.worktree !== null &&
+        isLiveRawEvidenceSyncAttribution(result.state, result.reason, true));
+}
+// ---------------------------------------------------------------------------
+// Codex transcripts
+// ---------------------------------------------------------------------------
 async function collectCodexJsonlFiles(collection, options) {
+    const attributed = Boolean(options.codexSessionFiles);
     const resolvedCandidates = options.codexSessionFiles
         ? options.codexSessionFiles.map((file) => ({
             filePath: file.local_path,
             codexSessionId: file.codex_session_id,
         }))
-        : (await walkJsonlFiles(options.sessionsDirs ??
-            (options.sessionsDir
-                ? [options.sessionsDir]
-                : defaultCodexSessionDirs(os.homedir())), collection.context.now.getTime() - options.sinceMinutes * 60 * 1000))
-            .map((filePath) => ({ filePath, codexSessionId: null }));
+        : (await walkRecentCodexJsonlFiles(collection, options)).map((filePath) => ({ filePath, codexSessionId: null }));
     collection.caps.push({
         source: "codex_jsonl",
         cap_type: "session_limit",
         limit: options.limit,
         observed: resolvedCandidates.length,
-        applied: !options.codexSessionFiles && resolvedCandidates.length > options.limit,
+        applied: !attributed && resolvedCandidates.length > options.limit,
     });
-    const candidates = options.codexSessionFiles
+    const candidates = attributed
         ? resolvedCandidates
         : resolvedCandidates.slice(0, options.limit);
     for (const candidate of candidates) {
@@ -433,95 +601,118 @@ async function collectCodexJsonlFiles(collection, options) {
             redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
             contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
         });
-        if (transcriptAccepted) {
-            await collectAgentImagesFromTranscript(collection, {
-                filePath: candidate.filePath,
-                source: "codex",
-                sessionId: codexSessionId,
-                kind: "codex_image_attachment",
-                contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
-            });
-        }
+        if (!transcriptAccepted)
+            continue;
+        await collectAgentImagesFromTranscript(collection, {
+            filePath: candidate.filePath,
+            source: "codex",
+            sessionId: codexSessionId,
+            kind: "codex_image_attachment",
+            contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
+        });
     }
 }
+/** The unattributed fallback: every recent Codex transcript on this machine. */
+function walkRecentCodexJsonlFiles(collection, options) {
+    const dirs = options.sessionsDirs ??
+        (options.sessionsDir
+            ? [options.sessionsDir]
+            : defaultCodexSessionDirs(os.homedir()));
+    return walkJsonlFiles(dirs, collection.context.now.getTime() - options.sinceMinutes * 60 * 1000);
+}
+// ---------------------------------------------------------------------------
+// Claude transcripts
+// ---------------------------------------------------------------------------
 async function collectClaudeJsonlFiles(collection, sessions) {
     recordScanned(collection, "claude_jsonl", sessions.reduce((count, session) => count + 1 + session.sidecar_files.length, 0));
     for (const session of sessions) {
-        const sessionId = session.claude_session_id;
-        if (session.main_file_oversized) {
-            // D7: the oversized main was attributed via a streamed read but its bytes
-            // are never uploaded (server commit assembles in memory). Its sidecars
-            // still collect below.
-            collection.skipped.push({
-                kind: "claude_jsonl",
-                label: path.basename(session.local_path),
-                reason: "file_too_large",
-            });
-        }
-        else if (session.skip_main) {
-            // D9 damped: prior durable copy is still good enough; collect sidecars
-            // only. The session reports reused_existing from cursor state, so no
-            // skipped entry is recorded here.
-        }
-        else {
-            const mainAccepted = await collectOneEvidenceFile(collection, {
-                filePath: session.local_path,
-                kind: "claude_jsonl",
-                sessionId,
-                mediaType: "application/jsonl",
-                // Re-check size at collection: a main that grew past the cap between
-                // attribution and collection is an honest file_too_large skip, not an
-                // upload_failed at the chunk client.
-                maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-                redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-                contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/${hash16}.jsonl`,
-            });
-            if (mainAccepted) {
-                await collectAgentImagesFromTranscript(collection, {
-                    filePath: session.local_path,
-                    source: "claude_code",
-                    sessionId,
-                    kind: "claude_image_attachment",
-                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
-                });
-            }
-        }
-        if (session.skip_main && !session.main_file_oversized) {
-            await collectAgentImagesFromTranscript(collection, {
-                filePath: session.local_path,
-                source: "claude_code",
-                sessionId,
-                kind: "claude_image_attachment",
-                contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
-            });
-        }
-        for (const sidecar of session.sidecar_files) {
-            const stem = path.basename(sidecar.local_path).replace(/\.jsonl$/i, "");
-            const safeSidecarId = isSecretLikePath(stem)
-                ? "redacted-file-name"
-                : safeKeySegment(stem);
-            const sidecarAccepted = await collectOneEvidenceFile(collection, {
-                filePath: sidecar.local_path,
-                kind: "claude_jsonl_sidecar",
-                sessionId,
-                mediaType: "application/jsonl",
-                maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-                redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-                contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}-${hash16}.jsonl`,
-            });
-            if (sidecarAccepted) {
-                await collectAgentImagesFromTranscript(collection, {
-                    filePath: sidecar.local_path,
-                    source: "claude_code",
-                    sessionId,
-                    sidecarId: safeSidecarId,
-                    kind: "claude_image_attachment",
-                    contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}/images/${hash16}.${extension}`,
-                });
-            }
-        }
+        await collectOneClaudeSession(collection, session);
+    }
+}
+async function collectOneClaudeSession(collection, session) {
+    const sessionId = session.claude_session_id;
+    const mainOutcome = await collectClaudeMainFile(collection, session);
+    if (mainOutcome === "collected" || mainOutcome === "damped_reuse") {
+        await collectAgentImagesFromTranscript(collection, {
+            filePath: session.local_path,
+            source: "claude_code",
+            sessionId,
+            kind: "claude_image_attachment",
+            contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
+        });
+    }
+    for (const sidecar of session.sidecar_files) {
+        await collectOneClaudeSidecar(collection, session, sidecar.local_path);
     }
 }
+/**
+ * What happens to a Claude main file, as a decision table:
+ *
+ * | condition             | main bytes                | outcome             |
+ * | --------------------- | ------------------------- | ------------------- |
+ * | `main_file_oversized` | skipped `file_too_large`  | `skipped_too_large` |
+ * | `skip_main` (D9)      | not re-collected          | `damped_reuse`      |
+ * | otherwise             | collected, or named skip  | `collected` / `not_collected` |
+ *
+ * Its images are collected for every outcome except `skipped_too_large` and
+ * `not_collected` — the caller decides that, this function only reports.
+ *
+ * D7: an oversized main was attributed via a streamed read but its bytes are
+ * never uploaded (server commit assembles in memory). Its sidecars still
+ * collect. D9 damped: the prior durable copy is still good enough, and the
+ * session reports `reused_existing` from cursor state, so no skip is recorded.
+ */
+async function collectClaudeMainFile(collection, session) {
+    if (session.main_file_oversized) {
+        collection.skipped.push({
+            kind: "claude_jsonl",
+            label: path.basename(session.local_path),
+            reason: "file_too_large",
+        });
+        return "skipped_too_large";
+    }
+    if (session.skip_main)
+        return "damped_reuse";
+    const accepted = await collectOneEvidenceFile(collection, {
+        filePath: session.local_path,
+        kind: "claude_jsonl",
+        sessionId: session.claude_session_id,
+        mediaType: "application/jsonl",
+        // Re-check size at collection: a main that grew past the cap between
+        // attribution and collection is an honest file_too_large skip, not an
+        // upload_failed at the chunk client.
+        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
+        redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
+        contentAddress: (hash16) => `claude/${safeKeySegment(session.claude_session_id)}/${hash16}.jsonl`,
+    });
+    return accepted ? "collected" : "not_collected";
+}
+async function collectOneClaudeSidecar(collection, session, sidecarPath) {
+    const sessionId = session.claude_session_id;
+    const stem = path.basename(sidecarPath).replace(/\.jsonl$/i, "");
+    const safeSidecarId = isSecretLikePath(stem)
+        ? "redacted-file-name"
+        : safeKeySegment(stem);
+    const sidecarAccepted = await collectOneEvidenceFile(collection, {
+        filePath: sidecarPath,
+        kind: "claude_jsonl_sidecar",
+        sessionId,
+        mediaType: "application/jsonl",
+        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
+        redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
+        contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}-${hash16}.jsonl`,
+    });
+    if (!sidecarAccepted)
+        return;
+    await collectAgentImagesFromTranscript(collection, {
+        filePath: sidecarPath,
+        source: "claude_code",
+        sessionId,
+        sidecarId: safeSidecarId,
+        kind: "claude_image_attachment",
+        contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}/images/${hash16}.${extension}`,
+    });
+}
 async function collectAgentImagesFromTranscript(collection, options) {
     const result = await collectAgentImageEvidenceFromJsonlFile({
         filePath: options.filePath,
@@ -576,15 +767,26 @@ async function collectOneAgentImageFile(collection, options) {
     }
     collection.index.value += 1;
     const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${contentHash.slice(0, 16)}.${options.image.extension}`);
-    const destination = path.join(collection.filesDir, path.basename(relativePath));
-    await fs.writeFile(destination, raw, { mode: 0o600 });
-    await chmodPrivate(destination, 0o600);
+    const imageSourceKey = evidenceSourceKey({
+        kind: options.kind,
+        sessionId: options.sessionId,
+        label: options.image.label,
+    });
+    const staged = await stageEvidenceBytes(collection, {
+        contentHash,
+        bytes: raw,
+        fileName: path.basename(relativePath),
+        kind: options.kind,
+        sourceKey: imageSourceKey,
+    });
     collection.entries.push(evidenceEntry({
         context: collection.context,
         kind: options.kind,
         packId: collection.packId,
-        localPath: destination,
+        localPath: staged.local_path,
         relativePath,
+        stagedInPack: staged.staged_in_pack,
+        sourceKey: imageSourceKey,
         mediaType: metadata.media_type,
         redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
         bytes: raw,
@@ -593,63 +795,58 @@ async function collectOneAgentImageFile(collection, options) {
         artifactMetadata: metadata,
     }));
 }
+// ---------------------------------------------------------------------------
+// One transcript, end to end
+// ---------------------------------------------------------------------------
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
- * attributed transcript into the pack. Attribution only reads metadata records;
- * this collection layer and the server commit layer are the two content guards
- * that decide whether transcript bytes can become durable evidence.
+ * attributed transcript into the pack.
+ *
+ * Returns whether this file's *content* is accounted for, which is not the same
+ * as "was staged": a transcript whose bytes are already durable remotely
+ * returns true without staging anything, and its images are still worth
+ * collecting. Every false return has pushed a named skip first.
  */
 async function collectOneEvidenceFile(collection, options) {
     const fileName = path.basename(options.filePath);
     const secretLikeFileName = isSecretLikePath(fileName);
-    const evidenceLabel = secretLikeFileName
-        ? "[REDACTED_FILE_NAME]"
-        : fileName;
+    const evidenceLabel = secretLikeFileName ? "[REDACTED_FILE_NAME]" : fileName;
     const packedFileName = secretLikeFileName ? "redacted-file.jsonl" : fileName;
-    if (options.maxFileBytes) {
-        let stat;
-        try {
-            stat = await fs.stat(options.filePath);
-        }
-        catch {
-            collection.skipped.push({
-                kind: options.kind,
-                label: evidenceLabel,
-                reason: "file_read_failed",
-            });
-            return false;
-        }
-        if (stat.size > options.maxFileBytes) {
-            markCapApplied(collection, options.kind, "max_file_bytes");
-            collection.skipped.push({
-                kind: options.kind,
-                label: evidenceLabel,
-                reason: "file_too_large",
-            });
-            return false;
-        }
-    }
-    let raw;
-    try {
-        raw = await fs.readFile(options.filePath);
-    }
-    catch {
+    const sourceKey = evidenceSourceKey({
+        kind: options.kind,
+        sessionId: options.sessionId,
+        sourcePath: options.filePath,
+    });
+    const skip = (reason) => {
         collection.skipped.push({
             kind: options.kind,
             label: evidenceLabel,
-            reason: "file_read_failed",
+            reason,
         });
         return false;
-    }
-    if (options.maxFileBytes && raw.byteLength > options.maxFileBytes) {
-        markCapApplied(collection, options.kind, "max_file_bytes");
-        collection.skipped.push({
+    };
+    // Delivery backoff is checked BEFORE the file is read. An object whose commit
+    // has failed repeatedly costs nothing at all this cycle — no read, no hash,
+    // no copy, no request — and the hold is a named, retryable gap so a held
+    // session cannot make the sync look clean (BLI-3066).
+    if (collection.heldSources.has(sourceKey)) {
+        collection.deliveryHeldCount += 1;
+        skip(DELIVERY_BACKOFF_HOLDING_REASON);
+        console.error("[raw-evidence] delivery backoff holding source", JSON.stringify({
+            reason: DELIVERY_BACKOFF_HOLDING_REASON,
             kind: options.kind,
-            label: evidenceLabel,
-            reason: "file_too_large",
-        });
+            source_key: sourceKey,
+        }));
         return false;
     }
+    const read = await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes);
+    if (read.status === "read_failed")
+        return skip("file_read_failed");
+    if (read.status === "too_large") {
+        markCapApplied(collection, options.kind, "max_file_bytes");
+        return skip("file_too_large");
+    }
+    const raw = read.bytes;
     const sanitized = sanitizeTextEvidenceForUpload({
         text: raw.toString("utf8"),
         originalBytes: raw,
@@ -685,23 +882,22 @@ async function collectOneEvidenceFile(collection, options) {
     const deferReason = admitToBudget(collection.budget, evidenceBytes.byteLength);
     if (deferReason) {
         markBudgetCapApplied(collection, deferReason);
-        collection.skipped.push({
-            kind: options.kind,
-            label: evidenceLabel,
-            reason: deferReason,
-        });
-        return false;
+        return skip(deferReason);
     }
     collection.index.value += 1;
     const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(options.filePath)}-${packedFileName}`);
-    const destination = path.join(collection.filesDir, path.basename(relativePath));
-    await fs.writeFile(destination, evidenceBytes, { mode: 0o600 });
-    await chmodPrivate(destination, 0o600);
+    const staged = await stageEvidenceBytes(collection, {
+        contentHash,
+        bytes: evidenceBytes,
+        fileName: path.basename(relativePath),
+        kind: options.kind,
+        sourceKey,
+    });
     collection.entries.push(evidenceEntry({
         context: collection.context,
         kind: options.kind,
         packId: collection.packId,
-        localPath: destination,
+        localPath: staged.local_path,
         relativePath,
         mediaType: options.mediaType,
         redactedSummary: redaction
@@ -711,9 +907,70 @@ async function collectOneEvidenceFile(collection, options) {
         bytes: evidenceBytes,
         codexSessionId: options.sessionId,
         contentAddress: options.contentAddress(contentHash.slice(0, 16)),
+        stagedInPack: staged.staged_in_pack,
+        sourceKey,
     }));
     return true;
 }
+/**
+ * Size is checked twice on purpose: once by `stat` so an oversized transcript
+ * is never buffered at all, and once on the bytes actually read, because a live
+ * session can grow between the two.
+ */
+async function readEvidenceFileWithinCap(filePath, maxFileBytes) {
+    if (maxFileBytes) {
+        let stat;
+        try {
+            stat = await fs.stat(filePath);
+        }
+        catch {
+            return { status: "read_failed" };
+        }
+        if (stat.size > maxFileBytes)
+            return { status: "too_large" };
+    }
+    let bytes;
+    try {
+        bytes = await fs.readFile(filePath);
+    }
+    catch {
+        return { status: "read_failed" };
+    }
+    if (maxFileBytes && bytes.byteLength > maxFileBytes) {
+        return { status: "too_large" };
+    }
+    return { status: "ok", bytes };
+}
+// ---------------------------------------------------------------------------
+// Staging and budgets
+// ---------------------------------------------------------------------------
+/**
+ * Put these bytes on disk once.
+ *
+ * If an earlier sync already staged this exact content and the copy is still
+ * there, that copy is used — the uploader only needs a readable path, and it
+ * does not care which pack directory holds it. This is the branch that stops
+ * one 334 MB rollout from becoming 559 copies while its commit keeps failing.
+ */
+async function stageEvidenceBytes(collection, options) {
+    const existing = await resolveStagedObject(collection.rawEvidenceRoot, collection.staging, options.contentHash);
+    if (existing) {
+        collection.stagedReusedCount += 1;
+        console.error("[raw-evidence] staged copy reused", JSON.stringify({
+            reason: "staged_reused",
+            kind: options.kind,
+            content_hash_prefix: options.contentHash.slice(0, 16),
+            byte_size: existing.entry.byte_size,
+            pack_id: existing.entry.pack_id,
+        }));
+        return { local_path: existing.local_path, staged_in_pack: false };
+    }
+    const destination = path.join(collection.filesDir, options.fileName);
+    await fs.writeFile(destination, options.bytes, { mode: 0o600 });
+    await chmodPrivate(destination, 0o600);
+    collection.stagedNewCount += 1;
+    return { local_path: destination, staged_in_pack: true };
+}
 /**
  * Decrements the per-sync budget when a file fits, or returns a deferred-skip
  * reason when it does not. The object budget bounds request count; the byte
@@ -728,145 +985,15 @@ function admitToBudget(budget, byteLength) {
     budget.remainingBytes -= byteLength;
     return null;
 }
-export function sanitizeTextEvidenceForUpload(options) {
-    const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
-    const secretLikeContent = containsSecretLikeContent(options.text);
-    try {
-        const redactionResult = (options.redact ?? redactSecretLikeContent)(options.text, {
-            appliedBy: "local_collector",
-            redactedFields: options.redactedFields,
-        });
-        if (options.secretLikeFileName) {
-            const sanitizedText = redactionResult.redacted
-                ? redactionResult.text
-                : options.text;
-            const safeText = containsSecretLikeContent(sanitizedText)
-                ? "[REDACTED_LINE:secret_redaction_failed]\n"
-                : sanitizedText;
-            const sanitizedBytes = Buffer.from(safeText, "utf8");
-            return {
-                status: "redacted",
-                bytes: sanitizedBytes,
-                redaction: withRedactionContentMetadata(redactionResult.metadata ??
-                    fallbackRedactionMetadata({
-                        ruleId: "secret_like_file_name",
-                        originalText: options.text,
-                        redactedFields: options.redactedFields,
-                        fullContentRedacted: false,
-                    }), { originalBytes, sanitizedBytes }),
-                completenessLabel: "secret_like_name_masked",
-            };
-        }
-        if (secretLikeContent) {
-            const redaction = redactionResult.metadata ??
-                fallbackRedactionMetadata({
-                    ruleId: "secret_like_content_guard",
-                    originalText: options.text,
-                    redactedFields: options.redactedFields,
-                });
-            let maskedText = maskSecretBearingLines(options.text, redaction);
-            if (containsSecretLikeContent(maskedText)) {
-                maskedText = "[REDACTED_LINE:secret_redaction_failed]\n";
-            }
-            const sanitizedBytes = Buffer.from(maskedText, "utf8");
-            return {
-                status: "redacted",
-                bytes: sanitizedBytes,
-                redaction: withRedactionContentMetadata(redaction, {
-                    originalBytes,
-                    sanitizedBytes,
-                }),
-                completenessLabel: "secret_content_masked",
-            };
-        }
-        if (redactionResult.redacted) {
-            const sanitizedBytes = Buffer.from(redactionResult.text, "utf8");
-            return {
-                status: "redacted",
-                bytes: sanitizedBytes,
-                redaction: withRedactionContentMetadata(redactionResult.metadata ??
-                    fallbackRedactionMetadata({
-                        ruleId: "secret_redaction_failed",
-                        originalText: options.text,
-                        redactedFields: options.redactedFields,
-                    }), { originalBytes, sanitizedBytes }),
-                completenessLabel: "secret_content_masked",
-            };
-        }
-        return { status: "clean", bytes: originalBytes };
-    }
-    catch {
-        const sanitizedBytes = Buffer.from("[REDACTED_LINE:redaction_crashed_stubbed]\n", "utf8");
-        return {
-            status: "redacted",
-            bytes: sanitizedBytes,
-            redaction: withRedactionContentMetadata(fallbackRedactionMetadata({
-                ruleId: "redaction_crashed_stubbed",
-                originalText: options.text,
-                redactedFields: options.redactedFields,
-            }), { originalBytes, sanitizedBytes }),
-            completenessLabel: "redaction_crashed_stubbed",
-        };
-    }
-}
-function maskSecretBearingLines(text, redaction) {
-    if (redaction.redacted_ranges.length === 0) {
-        return "[REDACTED_LINE:secret_like_content_guard]\n";
-    }
-    const segments = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? [];
-    let offset = 0;
-    return segments
-        .map((segment) => {
-        const start = offset;
-        const end = offset + segment.length;
-        offset = end;
-        const matched = redaction.redacted_ranges.find((range) => range.start < end && start < range.end);
-        if (!matched)
-            return segment;
-        const lineEnding = segment.endsWith("\r\n")
-            ? "\r\n"
-            : segment.endsWith("\n")
-                ? "\n"
-                : "";
-        return `[REDACTED_LINE:${matched.rule_id}]${lineEnding}`;
-    })
-        .join("");
-}
-function fallbackRedactionMetadata(options) {
-    const fullContentRedacted = options.fullContentRedacted !== false;
-    return {
-        schema_version: "raw-evidence-redaction.v1",
-        status: "sanitized",
-        mode: "deterministic_text_replacement",
-        applied_by: ["local_collector"],
-        rule_counts: [
-            {
-                rule_id: options.ruleId,
-                match_count: 1,
-                redacted_char_count: fullContentRedacted
-                    ? options.originalText.length
-                    : 0,
-            },
-        ],
-        secret_like_match_count: 1,
-        redacted_fields: options.redactedFields,
-        redacted_ranges: fullContentRedacted && options.originalText.length > 0
-            ? [
-                {
-                    start: 0,
-                    end: options.originalText.length,
-                    rule_id: options.ruleId,
-                },
-            ]
-            : [],
-    };
-}
+// ---------------------------------------------------------------------------
+// Git diffs
+// ---------------------------------------------------------------------------
+const GIT_DIFF_TARGETS = [
+    { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
+    { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
+];
 async function collectGitDiffFiles(collection, repoRoot) {
-    const diffTargets = [
-        { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
-        { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
-    ];
-    for (const target of diffTargets) {
+    for (const target of GIT_DIFF_TARGETS) {
         recordScanned(collection, "git_diff");
         let diff;
         try {
@@ -892,334 +1019,107 @@ async function collectGitDiffFiles(collection, repoRoot) {
                 included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
             });
         }
+        // An empty diff is not a gap: there was simply nothing to record. The
+        // truncation marker above still stands even when zero bytes survived.
         if (!diff.stdout.trim())
             continue;
-        const sanitized = sanitizeTextEvidenceForUpload({
-            text: diff.stdout,
-            redactedFields: [`git_diff.${target.label}`],
+        await stageOneGitDiff(collection, {
+            label: target.label,
+            diffText: diff.stdout,
+            truncated: diff.truncated,
         });
-        if (sanitized.status === "redacted") {
-            collection.redacted.push({
-                kind: "git_diff",
-                label: target.label,
-                redaction: sanitized.redaction,
-                completenessLabel: sanitized.completenessLabel,
-            });
-            console.error("[raw-evidence] git diff sanitized", JSON.stringify({
-                mode: sanitized.completenessLabel,
-                original_bytes: Buffer.byteLength(diff.stdout, "utf8"),
-                uploaded_bytes: sanitized.bytes.byteLength,
-            }));
-        }
-        const raw = sanitized.bytes;
-        const redaction = sanitized.redaction;
-        const contentHash = sha256(raw);
-        if (collection.skipContentHashes.has(contentHash)) {
-            collection.reused.push({
-                kind: "git_diff",
-                label: target.label,
-                content_hash_sha256: contentHash,
-                codex_session_id: null,
-            });
-            continue;
-        }
-        const deferReason = admitToBudget(collection.budget, raw.byteLength);
-        if (deferReason) {
-            markBudgetCapApplied(collection, deferReason);
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: deferReason,
-            });
-            continue;
-        }
-        const relativePath = path.join("files", `git-${target.label}.diff`);
-        const destination = path.join(collection.filesDir, path.basename(relativePath));
-        await fs.writeFile(destination, raw, { mode: 0o600 });
-        await chmodPrivate(destination, 0o600);
-        collection.entries.push(evidenceEntry({
-            context: collection.context,
-            kind: "git_diff",
-            packId: collection.packId,
-            localPath: destination,
-            relativePath,
-            mediaType: "text/x-diff",
-            redactedSummary: redaction
-                ? `Raw git ${target.label} diff preserved locally with env/secret paths excluded and secret-like values deterministically redacted.`
-                : diff.truncated
-                    ? `Raw git ${target.label} diff truncated to the capture cap and preserved locally with env/secret paths excluded.`
-                    : `Raw git ${target.label} diff preserved locally with env/secret paths excluded.`,
-            redaction,
-            bytes: raw,
-            contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
-        }));
     }
 }
-async function runGitDiff(args, repoRoot) {
-    const pathspec = [
-        ".",
-        ":(exclude).env",
-        ":(exclude).env.*",
-        ":(exclude)**/.env",
-        ":(exclude)**/.env.*",
-        ":(exclude)**/*secret*",
-        ":(exclude)**/*credential*",
-        ":(exclude)**/*private-key*",
-        ":(exclude)**/*.pem",
-        ":(exclude)**/*.key",
-    ];
-    return new Promise((resolve, reject) => {
-        const child = spawn("git", [...args, ...pathspec], {
-            cwd: repoRoot,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        const stdoutChunks = [];
-        const stderrChunks = [];
-        let observedBytes = 0;
-        let includedBytes = 0;
-        let truncated = false;
-        let timedOut = false;
-        const timeout = setTimeout(() => {
-            timedOut = true;
-            truncated = true;
-            child.kill("SIGTERM");
-        }, GIT_DIFF_TIMEOUT_MS);
-        child.stdout.on("data", (chunk) => {
-            observedBytes += chunk.byteLength;
-            if (includedBytes < MAX_GIT_DIFF_BYTES) {
-                const remaining = MAX_GIT_DIFF_BYTES - includedBytes;
-                const next = chunk.subarray(0, remaining);
-                stdoutChunks.push(next);
-                includedBytes += next.byteLength;
-            }
-            if (observedBytes > MAX_GIT_DIFF_BYTES) {
-                truncated = true;
-                child.kill("SIGTERM");
-            }
-        });
-        child.stderr.on("data", (chunk) => {
-            if (stderrChunks.reduce((sum, item) => sum + item.byteLength, 0) < 4096) {
-                stderrChunks.push(chunk.subarray(0, 4096));
-            }
+async function stageOneGitDiff(collection, target) {
+    const sanitized = sanitizeTextEvidenceForUpload({
+        text: target.diffText,
+        redactedFields: [`git_diff.${target.label}`],
+    });
+    if (sanitized.status === "redacted") {
+        collection.redacted.push({
+            kind: "git_diff",
+            label: target.label,
+            redaction: sanitized.redaction,
+            completenessLabel: sanitized.completenessLabel,
         });
-        child.on("error", (error) => {
-            clearTimeout(timeout);
-            reject(error);
+        console.error("[raw-evidence] git diff sanitized", JSON.stringify({
+            mode: sanitized.completenessLabel,
+            original_bytes: Buffer.byteLength(target.diffText, "utf8"),
+            uploaded_bytes: sanitized.bytes.byteLength,
+        }));
+    }
+    const raw = sanitized.bytes;
+    const redaction = sanitized.redaction;
+    const contentHash = sha256(raw);
+    if (collection.skipContentHashes.has(contentHash)) {
+        collection.reused.push({
+            kind: "git_diff",
+            label: target.label,
+            content_hash_sha256: contentHash,
+            codex_session_id: null,
         });
-        child.on("close", (code, signal) => {
-            clearTimeout(timeout);
-            if (code === 0 || truncated || signal === "SIGTERM") {
-                resolve({
-                    stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-                    truncated,
-                    observedBytes,
-                    truncationReason: timedOut
-                        ? "git_diff_timeout"
-                        : "max_git_diff_bytes",
-                    truncationCapType: timedOut ? "timeout_ms" : "max_bytes_per_diff",
-                });
-                return;
-            }
-            const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
-            reject(new Error(stderr || `git diff failed with code ${code ?? signal}`));
+        return;
+    }
+    const deferReason = admitToBudget(collection.budget, raw.byteLength);
+    if (deferReason) {
+        markBudgetCapApplied(collection, deferReason);
+        collection.skipped.push({
+            kind: "git_diff",
+            label: target.label,
+            reason: deferReason,
         });
-    });
-}
-function recordScanned(collection, source, count = 1) {
-    collection.scanned.set(source, (collection.scanned.get(source) ?? 0) + count);
-}
-function markBudgetCapApplied(collection, reason) {
-    markCapApplied(collection, "raw_evidence", reason === "deferred_object_budget" ? "object_budget" : "byte_budget");
-}
-function markCapApplied(collection, source, capType) {
-    const cap = collection.caps.find((candidate) => candidate.source === source && candidate.cap_type === capType);
-    if (cap)
-        cap.applied = true;
-}
-function recordSkipCount(collection, source, reason, count) {
-    if (count <= 0)
         return;
-    collection.skipped.push({
-        kind: source,
-        label: reason,
-        reason,
-        count,
+    }
+    const relativePath = path.join("files", `git-${target.label}.diff`);
+    const diffSourceKey = evidenceSourceKey({
+        kind: "git_diff",
+        sessionId: collection.context.workContextId,
+        label: target.label,
     });
-}
-function recordTruncationCount(collection, source, reason, count, details = {}) {
-    if (count <= 0)
-        return;
-    collection.truncated.push({
-        kind: source,
-        reason,
-        count,
-        ...details,
+    const staged = await stageEvidenceBytes(collection, {
+        contentHash,
+        bytes: raw,
+        fileName: path.basename(relativePath),
+        kind: "git_diff",
+        sourceKey: diffSourceKey,
     });
+    collection.entries.push(evidenceEntry({
+        context: collection.context,
+        kind: "git_diff",
+        packId: collection.packId,
+        localPath: staged.local_path,
+        relativePath,
+        stagedInPack: staged.staged_in_pack,
+        sourceKey: diffSourceKey,
+        mediaType: "text/x-diff",
+        redactedSummary: gitDiffSummary(target.label, {
+            redacted: Boolean(redaction),
+            truncated: target.truncated,
+        }),
+        redaction,
+        bytes: raw,
+        contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
+    }));
 }
-function evidenceEntryCount(entry) {
-    return entry.count ?? 1;
-}
-function countEvidenceEntries(entries, predicate = () => true) {
-    return entries.reduce((sum, entry) => sum + (predicate(entry) ? evidenceEntryCount(entry) : 0), 0);
-}
-function makeEvidenceCompleteness(collection, options) {
-    const sources = new Set(collection.scanned.keys());
-    for (const entry of collection.entries)
-        sources.add(entry.kind);
-    for (const entry of collection.skipped)
-        sources.add(entry.kind);
-    for (const entry of collection.reused)
-        sources.add(entry.kind);
-    for (const entry of collection.truncated)
-        sources.add(entry.kind);
-    for (const entry of collection.failed)
-        sources.add(entry.kind);
-    for (const entry of collection.redacted)
-        sources.add(entry.kind);
-    const sourceCounts = [...sources].sort().map((source) => {
-        const skipped = collection.skipped.filter((entry) => entry.kind === source);
-        return {
-            source,
-            scanned_count: collection.scanned.get(source) ?? 0,
-            included_count: collection.entries.filter((entry) => entry.kind === source).length,
-            skipped_count: countEvidenceEntries(skipped),
-            truncated_count: countEvidenceEntries(collection.truncated, (entry) => entry.kind === source),
-            deferred_count: countEvidenceEntries(skipped, (entry) => entry.reason.startsWith("deferred_")),
-            reused_count: collection.reused.filter((entry) => entry.kind === source).length,
-            failed_count: countEvidenceEntries(collection.failed, (entry) => entry.kind === source),
-        };
-    });
-    const totals = sourceCounts.reduce((sum, count) => ({
-        scanned_count: sum.scanned_count + count.scanned_count,
-        included_count: sum.included_count + count.included_count,
-        skipped_count: sum.skipped_count + count.skipped_count,
-        truncated_count: sum.truncated_count + count.truncated_count,
-        deferred_count: sum.deferred_count + count.deferred_count,
-        reused_count: sum.reused_count + count.reused_count,
-        failed_count: sum.failed_count + count.failed_count,
-    }), {
-        scanned_count: 0,
-        included_count: 0,
-        skipped_count: 0,
-        truncated_count: 0,
-        deferred_count: 0,
-        reused_count: 0,
-        failed_count: 0,
-    });
-    const skipReasonCounts = new Map();
-    for (const skipped of collection.skipped) {
-        const key = `${skipped.kind}:${skipped.reason}`;
-        const existing = skipReasonCounts.get(key);
-        if (existing) {
-            existing.count += evidenceEntryCount(skipped);
-        }
-        else {
-            skipReasonCounts.set(key, {
-                source: skipped.kind,
-                reason: skipped.reason,
-                count: evidenceEntryCount(skipped),
-            });
-        }
-    }
-    const failureReasonCounts = new Map();
-    for (const failed of collection.failed) {
-        const key = `${failed.kind}:${failed.reason}`;
-        const existing = failureReasonCounts.get(key);
-        if (existing) {
-            existing.count += evidenceEntryCount(failed);
-        }
-        else {
-            failureReasonCounts.set(key, {
-                source: failed.kind,
-                reason: failed.reason,
-                count: evidenceEntryCount(failed),
-            });
-        }
-    }
-    const truncationCounts = new Map();
-    for (const truncated of collection.truncated) {
-        const key = `${truncated.kind}:${truncated.reason}`;
-        const existing = truncationCounts.get(key);
-        if (existing) {
-            existing.count += evidenceEntryCount(truncated);
-            existing.observed_bytes = Math.max(existing.observed_bytes ?? 0, truncated.observed_bytes ?? 0);
-            existing.included_bytes = Math.max(existing.included_bytes ?? 0, truncated.included_bytes ?? 0);
-        }
-        else {
-            truncationCounts.set(key, {
-                source: truncated.kind,
-                reason: truncated.reason,
-                count: evidenceEntryCount(truncated),
-                ...(truncated.max_bytes !== undefined
-                    ? { max_bytes: truncated.max_bytes }
-                    : {}),
-                ...(truncated.observed_bytes !== undefined
-                    ? { observed_bytes: truncated.observed_bytes }
-                    : {}),
-                ...(truncated.included_bytes !== undefined
-                    ? { included_bytes: truncated.included_bytes }
-                    : {}),
-            });
-        }
+function gitDiffSummary(label, state) {
+    if (state.redacted) {
+        return `Raw git ${label} diff preserved locally with env/secret paths excluded and secret-like values deterministically redacted.`;
     }
-    const redactionCounts = new Map();
-    for (const redacted of collection.redacted) {
-        const ruleIds = redacted.redaction.rule_counts.map((rule) => rule.rule_id);
-        const key = `${redacted.kind}:${redacted.completenessLabel}:${ruleIds.sort().join(",")}`;
-        const existing = redactionCounts.get(key);
-        if (existing) {
-            existing.count += 1;
-            existing.rule_ids = [...new Set([...existing.rule_ids, ...ruleIds])].sort();
-        }
-        else {
-            redactionCounts.set(key, {
-                source: redacted.kind,
-                status: "sanitized",
-                mode: redacted.completenessLabel,
-                count: 1,
-                rule_ids: [...new Set(ruleIds)].sort(),
-            });
-        }
+    if (state.truncated) {
+        return `Raw git ${label} diff truncated to the capture cap and preserved locally with env/secret paths excluded.`;
     }
-    const hasGaps = totals.skipped_count > 0 ||
-        totals.truncated_count > 0 ||
-        totals.deferred_count > 0 ||
-        totals.failed_count > 0 ||
-        collection.redacted.length > 0 ||
-        collection.caps.some((cap) => cap.applied);
-    const status = totals.failed_count > 0 &&
-        totals.included_count + totals.reused_count === 0
-        ? "failed"
-        : totals.included_count + totals.reused_count === 0 && !hasGaps
-            ? "empty"
-            : hasGaps
-                ? "partial"
-                : "complete";
-    return EvidenceCompletenessPayloadSchema.parse({
-        schema_version: "evidence-completeness.v1",
-        status,
-        generated_at: options.finishedAt,
-        scan_window: {
-            started_at: options.startedAt,
-            finished_at: options.finishedAt,
-            since_minutes: options.sinceMinutes,
-        },
-        source_counts: sourceCounts,
-        totals,
-        caps: collection.caps,
-        skip_reasons: [...skipReasonCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
-        failure_reasons: [...failureReasonCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
-        truncation_markers: [...truncationCounts.values()].sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
-        redaction_markers: [...redactionCounts.values()].sort((a, b) => `${a.source}:${a.mode}`.localeCompare(`${b.source}:${b.mode}`)),
-        notes: totals.failed_count > 0
-            ? ["Evidence collection failed; downstream analysis should not infer confidence."]
-            : collection.redacted.length > 0
-                ? ["Evidence was sanitized before upload; downstream analysis should not treat it as raw-complete."]
-                : hasGaps
-                    ? ["Evidence is incomplete; downstream analysis should lower confidence."]
-                    : [],
-    });
+    return `Raw git ${label} diff preserved locally with env/secret paths excluded.`;
 }
+// ---------------------------------------------------------------------------
+// Walking the session store
+// ---------------------------------------------------------------------------
+/**
+ * Newest-first `.jsonl` files under these directories, modified since `cutoffMs`.
+ *
+ * Secret-like directory and file names are never descended into or opened;
+ * symlinked duplicates are collapsed by real path so one transcript reachable
+ * two ways is collected once.
+ */
 async function walkJsonlFiles(dir, cutoffMs) {
     const out = [];
     const stack = Array.isArray(dir) ? [...dir] : [dir];
@@ -1246,219 +1146,15 @@ async function walkJsonlFiles(dir, cutoffMs) {
             if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
                 continue;
             const stat = await fs.stat(full);
-            if (stat.mtimeMs >= cutoffMs) {
-                const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
-                if (!seen.has(dedupeKey)) {
-                    seen.add(dedupeKey);
-                    out.push({ file: full, mtimeMs: stat.mtimeMs });
-                }
-            }
+            if (stat.mtimeMs < cutoffMs)
+                continue;
+            const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
+            if (seen.has(dedupeKey))
+                continue;
+            seen.add(dedupeKey);
+            out.push({ file: full, mtimeMs: stat.mtimeMs });
         }
     }
     out.sort((a, b) => b.mtimeMs - a.mtimeMs);
     return out.map((entry) => entry.file);
-}
-function makeManifest(options) {
-    return {
-        schema: "bli.local_raw_evidence_pack.v1",
-        pack_id: options.packId,
-        created_at: options.context.now.toISOString(),
-        work_context_id: options.context.workContextId,
-        session_id: options.context.sessionId,
-        operator_id: options.context.operatorId,
-        operator_label: options.context.operatorLabel,
-        repo_label: options.context.repoLabel ?? path.basename(options.context.repoRoot),
-        worktree_label: options.context.worktreeLabel,
-        active_ticket_id: options.context.activeTicketId ?? null,
-        repo_basename: path.basename(options.context.repoRoot),
-        branch: options.context.branch,
-        storage_bucket: RAW_EVIDENCE_BUCKET,
-        raw_policy: {
-            raw_prompts: "preserved_private_durable_remote",
-            raw_responses: "preserved_private_durable_remote",
-            transcripts: "preserved_private_durable_remote",
-            claude_transcripts: "preserved_private_durable_remote",
-            tool_payloads: "preserved_private_durable_remote",
-            git_diffs: "preserved_private_durable_remote_env_secret_paths_excluded",
-            agent_image_attachments: "preserved_private_durable_remote_explicit_agent_session_attachment_only",
-            env_files: "never_read",
-            stdout: "manifest_only_no_raw_content",
-        },
-        files: options.entries.map(redactManifestEntry),
-        skipped: options.skipped,
-        redacted: options.redacted,
-        reused: options.reused,
-    };
-}
-function evidenceEntry(options) {
-    const digest = sha256(options.bytes);
-    const objectKey = remoteObjectKey({
-        context: options.context,
-        packId: options.packId,
-        relativePath: options.relativePath,
-        contentAddress: options.contentAddress,
-    });
-    return {
-        kind: options.kind,
-        local_path: options.localPath,
-        relative_path: options.relativePath,
-        object_key: objectKey,
-        content_hash_sha256: digest,
-        byte_size: options.bytes.byteLength,
-        media_type: options.mediaType,
-        redacted_summary: options.redactedSummary,
-        ...(options.redaction ? { redaction: options.redaction } : {}),
-        codex_session_id: options.codexSessionId ?? null,
-        ...(options.artifactMetadata
-            ? {
-                artifact_metadata: {
-                    ...options.artifactMetadata,
-                    raw_evidence_pointer_id: objectKey,
-                    storage_bucket: RAW_EVIDENCE_BUCKET,
-                    object_key: objectKey,
-                    content_hash_sha256: digest,
-                    byte_size: options.bytes.byteLength,
-                },
-            }
-            : {}),
-    };
-}
-function redactManifestEntry(entry) {
-    return {
-        kind: entry.kind,
-        relative_path: entry.relative_path,
-        object_key: entry.object_key,
-        content_hash_sha256: entry.content_hash_sha256,
-        byte_size: entry.byte_size,
-        media_type: entry.media_type,
-        redacted_summary: entry.redacted_summary,
-        ...(entry.redaction ? { redaction: entry.redaction } : {}),
-        ...(entry.artifact_metadata
-            ? { artifact_metadata: entry.artifact_metadata }
-            : {}),
-    };
-}
-function pointerFromEntry(entry) {
-    return {
-        raw_evidence_pointer_id: entry.object_key,
-        privacy_classification: "remote_durable_raw_evidence",
-        retention_policy: {
-            mode: RAW_EVIDENCE_RETENTION_MODE,
-            privacy_classification: "remote_durable_raw_evidence",
-        },
-        storage_scope: "remote_object",
-        storage_bucket: RAW_EVIDENCE_BUCKET,
-        object_key: entry.object_key,
-        content_hash_sha256: entry.content_hash_sha256,
-        byte_size: entry.byte_size,
-        media_type: entry.media_type,
-        redacted_summary: entry.redacted_summary,
-        ...(entry.redaction ? { redaction: entry.redaction } : {}),
-    };
-}
-/**
- * Raw evidence keys start with human-readable context, then end in immutable
- * content addresses or pack-relative manifest paths. The local cursor reuses
- * prior content hashes across syncs; the readable date/session folders are for
- * operator debugging and incident response.
- */
-function remoteObjectKey(options) {
-    const namespace = readableEvidenceNamespace(options.context);
-    if (options.contentAddress) {
-        return posixPath([
-            ...namespace,
-            options.contentAddress,
-        ]);
-    }
-    return posixPath([
-        ...namespace,
-        options.packId,
-        options.relativePath,
-    ]);
-}
-function readableEvidenceNamespace(context) {
-    return [
-        "operators",
-        operatorSlug(context),
-        "repos",
-        readableKeySegment(context.repoLabel ?? path.basename(context.repoRoot), "repo"),
-        "worktrees",
-        readableKeySegment(context.worktreeLabel ?? path.basename(context.repoRoot), "worktree"),
-        "tickets",
-        readableKeySegment(context.activeTicketId ?? "unbound", "unbound", {
-            lowercase: false,
-        }),
-        "dates",
-        context.now.toISOString().slice(0, 10),
-        "sessions",
-        readableKeySegment(context.sessionId, "session"),
-        "ids",
-        safeKeySegment(context.operatorId),
-        safeKeySegment(context.workContextId),
-    ];
-}
-function operatorSlug(context) {
-    const labelBeforeDomain = (context.operatorLabel ?? context.operatorId)
-        .split("@", 1)[0]
-        .trim();
-    const readable = readableKeySegment(labelBeforeDomain, "operator");
-    return `${readable}-${shortHash(context.operatorId).slice(0, 6)}`;
-}
-function readableKeySegment(value, fallback, options = {}) {
-    const base = options.lowercase === false ? value : value.toLowerCase();
-    const slug = base
-        .trim()
-        .replace(/[^A-Za-z0-9._-]+/g, "-")
-        .replace(/^-+|-+$/g, "")
-        .replace(/-{2,}/g, "-")
-        .slice(0, 80);
-    return slug || fallback;
-}
-function posixPath(parts) {
-    return parts.join("/").replace(/\\/g, "/").replace(/\/+/g, "/");
-}
-function rawEvidencePackId(context) {
-    const material = [
-        context.workContextId,
-        context.sessionId,
-        context.now.toISOString(),
-    ].join(":");
-    return `${context.workContextId}-${shortHash(material)}`;
-}
-function shortHash(value) {
-    return crypto.createHash("sha256").update(value, "utf8").digest("hex").slice(0, 12);
-}
-/**
- * Object keys must satisfy the server's key pattern; ids derived from file
- * content fall back to a hash rather than failing the whole upload batch.
- */
-function safeKeySegment(value) {
-    return /^[A-Za-z0-9._-]{1,80}$/.test(value) ? value : shortHash(value);
-}
-function sha256(value) {
-    return crypto.createHash("sha256").update(value).digest("hex");
-}
-function withRedactionContentMetadata(metadata, options) {
-    if (!metadata) {
-        throw new Error("redacted evidence is missing redaction metadata");
-    }
-    return {
-        ...metadata,
-        original_content_hash_sha256: sha256(options.originalBytes),
-        sanitized_content_hash_sha256: sha256(options.sanitizedBytes),
-        original_byte_size: options.originalBytes.byteLength,
-        sanitized_byte_size: options.sanitizedBytes.byteLength,
-    };
-}
-async function ensurePrivateDir(dir) {
-    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
-    await chmodPrivate(dir, 0o700);
-}
-async function chmodPrivate(target, mode) {
-    if (process.platform === "win32")
-        return;
-    await fs.chmod(target, mode).catch(() => undefined);
-}
-function isSecretLikePath(value) {
-    return SECRET_FILE_SEGMENT_PATTERN.test(value);
 }