@bli-cockpit/cli 0.2.27 → 0.2.29

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.27");
+    writeLine(io?.stdout ?? process.stdout, "0.2.29");
     return 0;
   }
 

package/dist/commands/sessions.js

@@ -0,0 +1,162 @@
+/**
+ * `cockpit sessions` — the operator's local answer to "why is session X
+ * missing?".
+ *
+ * Read-only: re-runs attribution, uploads nothing, writes no cursor. Per-session
+ * reasons otherwise live only in a service-role table with no UI (B.4 §6).
+ * Counts and labels only — the project-dir slug encodes a local path and is
+ * never printed. Split out of commands/local.ts (BLI-3104); moved verbatim.
+ */
+import os from "node:os";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
+import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
+import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "../local-state.js";
+const ALL_SESSION_SCAN_WINDOW_MINUTES = 20 * 365 * 24 * 60;
+const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
+export async function runSessions(command, io) {
+    const now = new Date();
+    const homeDir = command.homeDir ?? os.homedir();
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    const window = await sessionsScanWindow(command, now);
+    const wantCodex = command.source !== "claude";
+    const wantClaude = command.source !== "codex";
+    const codex = wantCodex
+        ? await scanAndAttributeCodexSessions({
+            sessionsDirs: defaultCodexSessionDirs(homeDir),
+            worktrees,
+            now,
+            sinceMinutes: window.since_minutes ?? CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES,
+            limit: window.limit,
+        })
+        : null;
+    const claude = wantClaude
+        ? await scanAndAttributeClaudeSessions({
+            projectsDir: path.join(homeDir, ".claude", "projects"),
+            worktrees,
+            now,
+            sinceMinutes: window.since_minutes ?? undefined,
+            limit: window.mode === "default" ? undefined : window.limit,
+        })
+        : null;
+    // Safe output contract (B.4 §6): id, state, reason, scores, signals, sidecar
+    // skip reasons, plus the repo_label basename. Branch is intentionally omitted
+    // — branch names can carry operator-authored task/customer text.
+    const codexRows = (codex?.results ?? []).map((result) => ({
+        source: "codex",
+        session_id: result.codex_session_id,
+        state: result.state,
+        reason: result.reason,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        signals: result.signals,
+        repo_label: result.worktree?.repo_label ?? null,
+    }));
+    const claudeRows = (claude?.results ?? []).map((result) => ({
+        source: "claude_code",
+        session_id: result.claude_session_id,
+        state: result.state,
+        reason: result.reason,
+        attribution_score: result.attribution_score,
+        path_score: result.path_score,
+        signals: result.signals,
+        repo_label: result.worktree?.repo_label ?? null,
+        main_file_oversized: result.main_file_oversized,
+        sidecar_skips: result.sidecar_files
+            .filter((sidecar) => sidecar.skipped_reason)
+            .map((sidecar) => ({
+            file_name: sidecar.file_name,
+            reason: sidecar.skipped_reason,
+        })),
+    }));
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({
+            window,
+            ...(codex
+                ? { codex: { counts: codex.counts, sessions: codexRows } }
+                : {}),
+            ...(claude
+                ? {
+                    claude: {
+                        counts: claude.counts,
+                        project_dirs_skipped: claude.project_dirs_skipped,
+                        sessions: claudeRows,
+                    },
+                }
+                : {}),
+        }, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Cockpit sessions (read-only attribution)");
+    writeLine(io.stdout, `window: ${sessionsWindowLine(window)}`);
+    for (const row of codexRows) {
+        writeLine(io.stdout, sessionRowLine(row));
+    }
+    for (const row of claudeRows) {
+        writeLine(io.stdout, sessionRowLine(row));
+        for (const sidecar of row.sidecar_skips) {
+            writeLine(io.stdout, `    sidecar ${sidecar.file_name}: ${sidecar.reason}`);
+        }
+    }
+    if (codexRows.length === 0 && claudeRows.length === 0) {
+        writeLine(io.stdout, "No sessions observed in the scan window.");
+    }
+    return 0;
+}
+/** `--all`, an explicit `--since-days` capped at pairing, or the default window. */
+async function sessionsScanWindow(command, now) {
+    if (command.all) {
+        return {
+            mode: "all",
+            since_days: null,
+            started_at: new Date(now.getTime() - ALL_SESSION_SCAN_WINDOW_MINUTES * 60_000)
+                .toISOString(),
+            paired_at: await readPairedAt(command.homeDir),
+            since_minutes: ALL_SESSION_SCAN_WINDOW_MINUTES,
+            limit: SESSION_SCAN_OVERRIDE_LIMIT,
+        };
+    }
+    if (command.sinceDays !== undefined) {
+        const requestedMs = now.getTime() - command.sinceDays * 24 * 60 * 60_000;
+        const pairedAt = await readPairedAt(command.homeDir);
+        const pairedMs = pairedAt ? Date.parse(pairedAt) : Number.NaN;
+        const startedAtMs = Number.isFinite(pairedMs)
+            ? Math.max(requestedMs, pairedMs)
+            : requestedMs;
+        return {
+            mode: "since_days",
+            since_days: command.sinceDays,
+            started_at: new Date(startedAtMs).toISOString(),
+            paired_at: pairedAt,
+            since_minutes: Math.max(1, Math.ceil((now.getTime() - startedAtMs) / 60_000)),
+            limit: SESSION_SCAN_OVERRIDE_LIMIT,
+        };
+    }
+    return {
+        mode: "default",
+        since_days: null,
+        started_at: null,
+        paired_at: await readPairedAt(command.homeDir),
+        since_minutes: null,
+        limit: CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT,
+    };
+}
+async function readPairedAt(homeDir) {
+    const session = await readLocalCollectorSessionFile(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return typeof session?.paired_at === "string" ? session.paired_at : null;
+}
+function sessionsWindowLine(window) {
+    if (window.mode === "all")
+        return "all local history";
+    if (window.mode === "since_days") {
+        return `since ${window.started_at} (${window.since_days} day request, paired_at cap ${window.paired_at ?? "unavailable"})`;
+    }
+    return "default scan window";
+}
+function sessionRowLine(row) {
+    const repo = row.repo_label ? ` repo:${row.repo_label}` : "";
+    const signals = row.signals.length > 0 ? ` signals:${row.signals.join("|")}` : "";
+    return `- [${row.source}] ${row.session_id} ${row.state} (${row.reason}) score:${row.attribution_score} path:${row.path_score}${repo}${signals}`;
+}

package/dist/commands/status.js

@@ -0,0 +1,191 @@
+/**
+ * `cockpit status` — what this machine believes about itself: install, pairing,
+ * active work, upload state, retry backlog, and how far historical backfill
+ * has got.
+ *
+ * Read-only. Split out of commands/local.ts (BLI-3104); moved verbatim, since
+ * every line here is what an intern pastes into Slack when something looks
+ * wrong.
+ */
+import { readdir, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { writeLine } from "./cli-io.js";
+import { displayTicketId, displayWorkLabel, shortSha, stuckEvidenceLine, } from "./collection-report.js";
+import { discoverCommandWorktrees } from "./local-discovery.js";
+import { defaultCodexSessionDirs } from "../adapters/codex-attribution.js";
+import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
+import { getCollectorRuntimePaths, inspectLocalCollectorStatus, readLocalCollectorConfig, } from "../local-state.js";
+import { normalizeCollectionRoots } from "../root-normalization.js";
+export async function runStatus(command, io) {
+    const backfillCursor = await inspectBackfillCursor(command.homeDir);
+    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos, homeDir: command.homeDir }, io);
+    if (worktrees.length > 1) {
+        const statuses = await Promise.all(worktrees.map(async (worktree) => ({
+            ...(await inspectLocalCollectorStatus({
+                homeDir: command.homeDir,
+                repoRoot: worktree.repo_root,
+            })),
+            head_sha: worktree.head_sha,
+        })));
+        if (command.json) {
+            writeLine(io.stdout, JSON.stringify({ mode: "multi_repo", statuses, backfill_cursor: backfillCursor }, null, 2));
+            return 0;
+        }
+        writeLine(io.stdout, "Cockpit parent status");
+        writeLine(io.stdout, `backfill: ${backfillCursorLine(backfillCursor)}`);
+        for (const status of statuses) {
+            writeLine(io.stdout, `- ${status.repo_label ?? status.repo}/${status.worktree_label ?? "worktree"} · ${status.branch} · head:${shortSha(status.head_sha)} · ${status.upload_state}`);
+        }
+        return 0;
+    }
+    const status = await inspectLocalCollectorStatus(command);
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ...status, backfill_cursor: backfillCursor }, null, 2));
+        return 0;
+    }
+    writeLine(io.stdout, "Cockpit local status");
+    writeLine(io.stdout, `installed: ${status.installed}`);
+    writeLine(io.stdout, `session_state: ${status.session_state}`);
+    writeLine(io.stdout, `repo: ${status.repo}`);
+    writeLine(io.stdout, `branch: ${status.branch}`);
+    writeLine(io.stdout, `ticket: ${displayTicketId(status.active_ticket_id)}`);
+    writeLine(io.stdout, `work: ${displayWorkLabel(status)}`);
+    writeLine(io.stdout, `collector_freshness: ${status.collector_freshness}`);
+    writeLine(io.stdout, `collector_version: ${status.collector_version}`);
+    writeLine(io.stdout, `upload_state: ${status.upload_state}`);
+    writeLine(io.stdout, `last_upload_attempt: ${status.last_upload_attempt_at ?? "never"}`);
+    writeLine(io.stdout, `last_upload_success: ${status.last_upload_success_at ?? "never"}`);
+    writeLine(io.stdout, `last_upload_failure: ${status.last_upload_failure_reason ?? "none"}`);
+    writeLine(io.stdout, `pending_uploads: ${status.pending_upload_count}`);
+    writeLine(io.stdout, `pending_health_receipts: ${status.pending_health_receipt_count}`);
+    writeLine(io.stdout, `last_health_receipt_failure: ${status.last_health_receipt_failure_reason ?? "none"}`);
+    writeLine(io.stdout, `backfill: ${backfillCursorLine(backfillCursor)}`);
+    writeLine(io.stdout, `stuck_evidence: ${stuckEvidenceLine(status)}`);
+    for (const detail of status.details)
+        writeLine(io.stdout, `- ${detail}`);
+    return 0;
+}
+/**
+ * Done, still working, or never started — and when it is still working, how
+ * many session files sit older than the cursor.
+ */
+async function inspectBackfillCursor(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const roots = await currentBackfillRoots(homeDir);
+    const marker = await readBackfillCompletionMarker(paths);
+    if (backfillCompletionCovers(marker, roots, ["codex", "claude_code"])) {
+        return {
+            state: "done",
+            remaining_count: 0,
+            updated_at: marker?.cursor.updated_at ?? null,
+            completed_at: marker?.completed_at ?? null,
+            sources: summarizeBackfillCursorSources(marker?.cursor ?? emptyBackfillCursorState()),
+        };
+    }
+    const cursor = (prepareBackfillCursorForScope(await readBackfillCursor(paths), roots, ["codex", "claude_code"])).cursor;
+    if (!cursor.updated_at) {
+        return {
+            state: "never_run",
+            remaining_count: 0,
+            updated_at: null,
+            completed_at: null,
+            sources: summarizeBackfillCursorSources(cursor),
+        };
+    }
+    return {
+        state: "remaining",
+        remaining_count: await countRemainingBackfillSessionFiles(homeDir ?? os.homedir(), cursor),
+        updated_at: cursor.updated_at,
+        completed_at: null,
+        sources: summarizeBackfillCursorSources(cursor),
+    };
+}
+async function currentBackfillRoots(homeDir) {
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return normalizeCollectionRoots(config?.default_repo_paths ?? []);
+}
+function summarizeBackfillCursorSources(cursor) {
+    return {
+        codex: summarizeBackfillSource(cursor.sources.codex),
+        claude_code: summarizeBackfillSource(cursor.sources.claude_code),
+    };
+}
+function summarizeBackfillSource(source) {
+    return {
+        oldest_mtime_processed: source.oldest_mtime_processed,
+        observed_count: Object.values(source.state_counts).reduce((total, count) => total + count, 0),
+        state_counts: source.state_counts,
+        reason_counts: source.reason_counts,
+    };
+}
+function backfillCursorLine(status) {
+    switch (status.state) {
+        case "done":
+            return `done (${status.completed_at ?? "completion marker present"})`;
+        case "never_run":
+            return "never run";
+        case "remaining":
+            return `${status.remaining_count} remaining`;
+    }
+}
+async function countRemainingBackfillSessionFiles(homeDir, cursor) {
+    const codex = await countJsonlFilesBeforeCursor(defaultCodexSessionDirs(homeDir), cursor.sources.codex.oldest_mtime_ms_processed);
+    const claude = await countClaudeMainFilesBeforeCursor(path.join(homeDir, ".claude", "projects"), cursor.sources.claude_code.oldest_mtime_ms_processed);
+    return codex + claude;
+}
+async function countJsonlFilesBeforeCursor(roots, oldestProcessedMs) {
+    let count = 0;
+    await walkFiles(roots, async (filePath, entryName) => {
+        if (!entryName.endsWith(".jsonl"))
+            return;
+        const info = await stat(filePath).catch(() => null);
+        if (!info?.isFile())
+            return;
+        if (oldestProcessedMs === null || info.mtimeMs < oldestProcessedMs)
+            count += 1;
+    });
+    return count;
+}
+async function countClaudeMainFilesBeforeCursor(projectsDir, oldestProcessedMs) {
+    let count = 0;
+    await walkFiles([projectsDir], async (filePath, entryName) => {
+        if (!entryName.endsWith(".jsonl"))
+            return;
+        if (filePath.includes(`${path.sep}subagents${path.sep}`))
+            return;
+        const info = await stat(filePath).catch(() => null);
+        if (!info?.isFile())
+            return;
+        if (oldestProcessedMs === null || info.mtimeMs < oldestProcessedMs)
+            count += 1;
+    });
+    return count;
+}
+/** Unreadable folders are skipped rather than failing the walk. */
+async function walkFiles(roots, onFile, shouldStop = () => false) {
+    const stack = [...roots];
+    while (stack.length > 0 && !shouldStop()) {
+        const current = stack.pop();
+        if (!current)
+            continue;
+        let entries;
+        try {
+            entries = await readdir(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (shouldStop())
+                return;
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(full);
+            }
+            else if (entry.isFile()) {
+                await onFile(full, entry.name);
+            }
+        }
+    }
+}

package/dist/evidence-upload-client.js

@@ -1,4 +1,4 @@
-import { RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
+import { COMMIT_CRASHED_PLATFORM, RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 const DEFAULT_MAX_ATTEMPTS = 3;
@@ -289,6 +289,29 @@ async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
         if (permanent) {
             return failedOutcome(entry.file, permanent, uploadedChunks);
         }
+        // A 5xx whose body is not JSON did not come from the route. The commit
+        // handler always answers `{ code, message, ... }`; an HTML error page means
+        // the serverless process was killed — an out-of-memory on a large
+        // assembly, or a hard timeout — so nothing server-side ran a catch, wrote a
+        // ledger reason, or logged a line. Naming it separately is the only way an
+        // operator reading upload reasons can tell "the server refused these bytes"
+        // from "the server never survived them".
+        //
+        // The stem comes from telemetry-core so the label the collector writes and
+        // the label `classifyUploadFailure` reads are the same string by
+        // construction; the status rides on the end so a 502 gateway timeout can
+        // still be told from a 500 process kill, and core strips it back off.
+        if (commit.status >= 500 && isNonJsonResponseBody(commit.body)) {
+            console.error("[evidence-commit] the server died before it could answer; the object is still pending", JSON.stringify({
+                upload_id: disposition.upload_id,
+                http_status: commit.status,
+                byte_size: entry.bytes.byteLength,
+                chunk_count: entry.chunkCount,
+                uploaded_chunk_count: uploadedChunks,
+                reason: COMMIT_CRASHED_PLATFORM,
+            }));
+            return failedOutcome(entry.file, `${COMMIT_CRASHED_PLATFORM}_http_${commit.status}`, uploadedChunks);
+        }
         const detail = safeFailureDetail(commit.body);
         return failedOutcome(entry.file, `commit_failed_http_${commit.status}${detail ? `_${detail}` : ""}`, uploadedChunks);
     }
@@ -530,6 +553,22 @@ function summarizeOutcomes(outcomes, usedLegacyFallback) {
         used_legacy_fallback: usedLegacyFallback,
     };
 }
+/**
+ * Marks a body the server did not produce as JSON.
+ *
+ * A dashboard route always answers with a JSON envelope, so an HTML body on a
+ * 500 means the response came from the platform's error page and not from the
+ * route — the process died before any handler ran. That distinction is the
+ * whole difference between "the commit rejected these bytes" and "the commit
+ * never got to decide", and it was invisible for the nine days of BLI-3067
+ * because both collapsed into `commit_failed_http_500`.
+ */
+export const NON_JSON_RESPONSE_BODY_KEY = "__cockpit_response_body_format";
+function isNonJsonResponseBody(body) {
+    return (!!body &&
+        typeof body === "object" &&
+        body[NON_JSON_RESPONSE_BODY_KEY] === "non_json");
+}
 async function readResponseJson(response) {
     const text = await response.text();
     if (!text)
@@ -538,7 +577,9 @@ async function readResponseJson(response) {
         return JSON.parse(text);
     }
     catch {
-        return { message: text };
+        // The raw text is kept for the caller that wants to show it, never for a
+        // label or a log — it is an unbounded HTML page.
+        return { message: text, [NON_JSON_RESPONSE_BODY_KEY]: "non_json" };
     }
 }
 function batches(items, size) {

package/dist/local-state.js

@@ -8,6 +8,7 @@ import { normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOr
 import { isSamePath, normalizeCollectionRoots, } from "./root-normalization.js";
 import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
 import { summarizeInstallEventOutbox } from "./spool/install-event-outbox.js";
+import { readRawEvidenceStagingState, summarizeStuckEvidence, } from "./raw-evidence-staging.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
     ? localCollectorPackage.version
@@ -340,10 +341,12 @@ export async function inspectLocalCollectorStatus(options = {}) {
     const identity = await resolveIdentityOrFallback(repoRoot, options.branch);
     const context = await readLocalWorkContextForRepo(paths, repoRoot).catch(() => null);
     const branch = options.branch ?? identity.branch;
-    const [uploadSpool, healthOutbox] = await Promise.all([
+    const [uploadSpool, healthOutbox, stagingState] = await Promise.all([
         summarizeLocalUploadSpool(paths),
         summarizeInstallEventOutbox(paths),
+        readRawEvidenceStagingState(paths.state_dir),
     ]);
+    const stuckEvidence = summarizeStuckEvidence(stagingState, now);
     const freshness = classifyCollectorFreshness(context, uploadSpool.last_upload_success_at, now);
     const uploadState = !config
         ? "not_installed"
@@ -377,6 +380,9 @@ export async function inspectLocalCollectorStatus(options = {}) {
     if (healthOutbox.pending_count > 0) {
         details.push(`Collector health retry pending: ${healthOutbox.pending_count} sanitized receipt(s) queued since ${healthOutbox.oldest_created_at ?? "unknown"}.`);
     }
+    if (stuckEvidence.stuck_object_count > 0) {
+        details.push(`Raw evidence stuck: ${stuckEvidence.stuck_object_count} object(s) have never been accepted (${stuckEvidence.held_object_count} waiting on backoff, worst ${stuckEvidence.max_attempts} attempt(s) since ${stuckEvidence.oldest_first_failed_at ?? "unknown"}) — reasons: ${stuckEvidence.reasons.join(", ") || "unknown"}.`);
+    }
     return {
         installed: Boolean(config),
         config_file: paths.config_file,
@@ -405,6 +411,11 @@ export async function inspectLocalCollectorStatus(options = {}) {
         pending_health_receipt_count: healthOutbox.pending_count,
         oldest_pending_health_receipt_at: healthOutbox.oldest_created_at,
         last_health_receipt_failure_reason: healthOutbox.last_failure_reason,
+        stuck_evidence_object_count: stuckEvidence.stuck_object_count,
+        stuck_evidence_held_count: stuckEvidence.held_object_count,
+        stuck_evidence_max_attempts: stuckEvidence.max_attempts,
+        stuck_evidence_oldest_failure_at: stuckEvidence.oldest_first_failed_at,
+        stuck_evidence_reasons: stuckEvidence.reasons,
         details,
     };
 }

package/dist/raw-evidence-gc.js

@@ -2,8 +2,15 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { readRawEvidenceCursor } from "./cursors/raw-evidence-cursor.js";
+import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
 const RAW_EVIDENCE_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 const SYNC_LOG_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * A staging directory belongs to one in-flight collection pass. Anything this
+ * old is the remains of a crash or a kill, never live work — the longest sync
+ * observed on the fleet is minutes, not hours.
+ */
+const STAGING_ORPHAN_MS = 6 * 60 * 60 * 1000;
 // GC hashes every file in every old-but-kept dir to confirm uploads. Running
 // that on each 15-min sync would re-read the same gigabytes ~96x/day on
 // machines with unconfirmed evidence, so GC is throttled to once per day.
@@ -63,6 +70,177 @@ export async function runRawEvidenceLocalGc(paths, env = process.env, now = new
 export function rawEvidenceGcSummary(result) {
     return `raw-evidence GC: removed ${result.removed_dirs} dirs, freed ~${formatMb(result.freed_bytes)} MB`;
 }
+/**
+ * Collapse byte-identical staged packs down to one survivor.
+ *
+ * Runs at the START of every sync, unthrottled and with no age requirement,
+ * because it is the only thing that drains a machine that already holds 559
+ * copies of the same rollout (BLI-3066). The GC proper cannot: it only deletes
+ * packs whose every file is already committed, and these were never committed —
+ * that is precisely why they piled up.
+ *
+ * Deleting an uncommitted copy is safe here and only here: the survivor holds
+ * the identical bytes, by content hash, so no evidence is lost. Identity comes
+ * from the manifest's recorded file hashes — cheap (one small JSON per pack)
+ * and exact. A pack with no readable manifest is counted and left alone rather
+ * than guessed at.
+ *
+ * The survivor is the newest directory: it is the one the current content-keyed
+ * pack id resolves to, so a fleet machine converges in one extra sync instead
+ * of oscillating between an old name and a new one.
+ */
+export async function sweepDuplicateStagedRawEvidence(paths, env = process.env, now = new Date()) {
+    const empty = {
+        skipped: false,
+        duplicate_groups: 0,
+        removed_dirs: 0,
+        freed_bytes: 0,
+        removed_staging_dirs: 0,
+        unfingerprintable_dirs: 0,
+    };
+    if (env["COCKPIT_DISABLE_GC"] === "1") {
+        return { ...empty, skipped: true };
+    }
+    const rawEvidenceRoot = path.join(paths.state_dir, "raw-evidence");
+    const dirEntries = await fs
+        .readdir(rawEvidenceRoot, { withFileTypes: true })
+        .catch(() => []);
+    // Packs the staged-object index points into are preferred survivors. Keeping
+    // one of those means the next collection reuses it instead of writing a fresh
+    // copy and re-deleting the old one on the sync after — a two-step oscillation
+    // that would look like the sweep working while the bytes moved every cycle.
+    const staging = await readRawEvidenceStagingState(paths.state_dir);
+    const referencedPackIds = new Set(Object.values(staging.staged).map((entry) => entry.pack_id));
+    let removedStagingDirs = 0;
+    const packs = [];
+    for (const entry of dirEntries) {
+        if (!entry.isDirectory())
+            continue;
+        const dir = path.join(rawEvidenceRoot, entry.name);
+        if (entry.name.startsWith(".staging-")) {
+            const info = await fs.stat(dir).catch(() => null);
+            if (!info)
+                continue;
+            if (now.getTime() - info.mtimeMs < STAGING_ORPHAN_MS)
+                continue;
+            await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+            if (!(await exists(dir)))
+                removedStagingDirs += 1;
+            continue;
+        }
+        if (!entry.name.startsWith("work-"))
+            continue;
+        const info = await fs.stat(dir).catch(() => null);
+        if (!info?.isDirectory())
+            continue;
+        packs.push({
+            dir,
+            mtimeMs: info.mtimeMs,
+            preferred: referencedPackIds.has(entry.name),
+        });
+    }
+    const groups = new Map();
+    let unfingerprintable = 0;
+    for (const pack of packs) {
+        const fingerprint = await packContentFingerprint(pack.dir);
+        if (!fingerprint) {
+            unfingerprintable += 1;
+            continue;
+        }
+        const group = groups.get(fingerprint);
+        if (group) {
+            group.push(pack);
+        }
+        else {
+            groups.set(fingerprint, [pack]);
+        }
+    }
+    let duplicateGroups = 0;
+    let removedDirs = 0;
+    let freedBytes = 0;
+    for (const group of groups.values()) {
+        if (group.length < 2)
+            continue;
+        duplicateGroups += 1;
+        group.sort((a, b) => Number(b.preferred) - Number(a.preferred) || b.mtimeMs - a.mtimeMs);
+        for (const duplicate of group.slice(1)) {
+            const byteSize = await dirByteSize(duplicate.dir);
+            await fs
+                .rm(duplicate.dir, { recursive: true, force: true })
+                .catch(() => undefined);
+            if (await exists(duplicate.dir))
+                continue;
+            removedDirs += 1;
+            freedBytes += byteSize;
+        }
+    }
+    const result = {
+        skipped: false,
+        duplicate_groups: duplicateGroups,
+        removed_dirs: removedDirs,
+        freed_bytes: freedBytes,
+        removed_staging_dirs: removedStagingDirs,
+        unfingerprintable_dirs: unfingerprintable,
+    };
+    // stderr, which launchd captures to `sync.err.log`. Logged on every sweep,
+    // including the boring one: "0 duplicates today" is the only evidence that
+    // the drain is still running at all.
+    console.error("[raw-evidence] dedup sweep", JSON.stringify({
+        reason: removedDirs > 0 ? "dedup_removed" : "dedup_clean",
+        pack_count: packs.length,
+        duplicate_groups: duplicateGroups,
+        removed_dirs: removedDirs,
+        freed_bytes: freedBytes,
+        removed_staging_dirs: removedStagingDirs,
+        unfingerprintable_dirs: unfingerprintable,
+    }));
+    return result;
+}
+export function rawEvidenceDedupSummary(result) {
+    return `raw-evidence dedup: removed ${result.removed_dirs} duplicate pack(s) across ${result.duplicate_groups} group(s), freed ~${formatMb(result.freed_bytes)} MB`;
+}
+/**
+ * Content identity of a pack, read from the manifest it already carries.
+ *
+ * Only the file content hashes are used — not `pack_id`, not `created_at`, not
+ * the branch or ticket labels. Two packs of the same transcript minted 15
+ * minutes apart differ in all of those and in none of these.
+ */
+async function packContentFingerprint(dir) {
+    const manifestBytes = await fs
+        .readFile(path.join(dir, "manifest.json"), "utf8")
+        .catch(() => null);
+    if (!manifestBytes)
+        return null;
+    try {
+        const parsed = JSON.parse(manifestBytes);
+        const hashes = (parsed.files ?? [])
+            .filter((file) => typeof file.content_hash_sha256 === "string" &&
+            file.content_hash_sha256.length === 64)
+            .map((file) => `${String(file.content_hash_sha256)}:${typeof file.byte_size === "number" ? file.byte_size : 0}`)
+            .sort();
+        if (hashes.length === 0)
+            return null;
+        return crypto
+            .createHash("sha256")
+            .update(hashes.join(","), "utf8")
+            .digest("hex");
+    }
+    catch {
+        return null;
+    }
+}
+async function dirByteSize(dir) {
+    const files = await listFiles(dir).catch(() => null);
+    if (!files)
+        return 0;
+    let total = 0;
+    for (const file of files) {
+        const info = await fs.stat(file).catch(() => null);
+        total += info?.isFile() ? info.size : 0;
+    }
+    return total;
+}
 async function inspectRawEvidenceDirForGc(dir, uploadedHashes) {
     const files = await listFiles(dir).catch(() => null);
     if (!files)