@bli-cockpit/cli 0.2.28 → 0.2.30

package/dist/upload.js

@@ -1,146 +1,21 @@
-import { AgentImageArtifactReportRequestSchema, CODEX_SESSION_REPORT_MAX_SESSIONS, CodexSessionAttributionReportResponseSchema, EvidenceCompletenessPayloadSchema, TelemetryIngestEnvelopeSchema, TelemetryIngestEventDtoSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
-import path from "node:path";
-import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
-import { runLocalSourceCollectors } from "./adapters/local-sources.js";
-import { defaultCodexSessionDirs, } from "./adapters/codex-attribution.js";
+import { getCollectorRuntimePaths } from "./local-state.js";
 import { uploadRawEvidenceFilesChunked, } from "./evidence-upload-client.js";
 import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
-import { clearDeliveryAttempt, DELIVERY_BACKOFF_HOLDING_REASON, deliveryHold, readRawEvidenceStagingState, recordDeliveryFailure, summarizeStuckEvidence, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
-import { readLocalUploadSpoolState, recordPendingSessionReport, recordSessionReportFailure, recordSessionReportSuccess, recordUploadBlocked, recordUploadFailure, recordUploadSuccess, } from "./spool/local-spool.js";
-export class LocalUploadBlockedError extends Error {
-    blocker;
-    retry_hint;
-    constructor(blocker, message, retryHint) {
-        super(message);
-        this.name = "LocalUploadBlockedError";
-        this.blocker = blocker;
-        this.retry_hint = retryHint;
-    }
-}
-export async function buildLocalAmbientEnvelope(options = {}) {
-    const now = options.now ?? new Date();
-    const paths = getCollectorRuntimePaths(options.homeDir);
-    const config = await readLocalCollectorConfig(paths).catch(() => {
-        throw new LocalUploadBlockedError("not_installed", "Local collector config missing. Install/update the CLI, then run `cockpit do-everything` before `cockpit sync`.", "npm install -g @bli-cockpit/cli@latest && cockpit do-everything");
-    });
-    const sessionFile = await readLocalCollectorSessionFile(paths).catch(() => {
-        throw new LocalUploadBlockedError("unpaired", "No paired collector session found. Run `cockpit login` or `cockpit pair` before `cockpit sync`.", "cockpit login");
-    });
-    const session = await readLocalSessionReference(paths);
-    if (session.session_state !== "valid") {
-        throw new LocalUploadBlockedError("unpaired", session.session_state === "expired"
-            ? "Collector session expired. Run `cockpit login` or `cockpit pair` again before `cockpit sync`."
-            : "Collector is not paired. Run `cockpit login` or `cockpit pair` before `cockpit sync`.", "cockpit login");
-    }
-    const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
-    const activeContext = await readLocalWorkContextForRepo(paths, repoRoot).catch(() => {
-        throw new LocalUploadBlockedError("missing_context", "Active work context missing. Run `cockpit start --workspace \"$PWD\"` before `cockpit sync`.", "cockpit start --workspace \"$PWD\"");
-    });
-    const repoLabel = safeRepoLabel(activeContext.repo_label ?? repoRoot);
-    const uploadContext = makeUploadWorkContext({
-        activeContext,
-        session,
-        repoLabel,
-        now,
-    });
-    const skipContentHashes = options.skipContentHashes ??
-        new Set(Object.entries(options.cursorObjects ?? {})
-            .filter(([, entry]) => rawEvidenceObjectKeyBelongsToWorkContext(entry.object_key, {
-            operatorId: session.operator_id,
-            workContextId: uploadContext.work_context_id,
-        }))
-            .map(([hash]) => hash));
-    const sourceCollection = await runLocalSourceCollectors({
-        repoRoot,
-        branch: uploadContext.branch,
-        operatorId: session.operator_id,
-        operatorLabel: session.email ?? session.auth_subject_id,
-        sessionId: session.session_id,
-        workContextId: uploadContext.work_context_id,
-        activeWorkContext: activeContext,
-        rawEvidenceStateDir: paths.state_dir,
-        rawEvidenceSessionsDirs: defaultCodexSessionDirs(paths.home_dir),
-        claudeProjectsDir: path.join(paths.home_dir, ".claude", "projects"),
-        rawEvidenceIncludeCodexJsonl: options.rawEvidenceIncludeCodexJsonl,
-        rawEvidenceIncludeClaudeJsonl: options.rawEvidenceIncludeClaudeJsonl,
-        rawEvidenceCodexSessionFiles: options.codexSessionFiles,
-        rawEvidenceCodexAttributionScan: options.codexAttributionScan,
-        rawEvidenceClaudeSessionFiles: options.claudeSessionFiles,
-        rawEvidenceClaudeAttributionScan: options.claudeAttributionScan,
-        rawEvidenceSkipContentHashes: skipContentHashes,
-        rawEvidenceByteBudget: options.rawEvidenceByteBudget,
-        rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
-        rawEvidenceBudget: options.rawEvidenceBudget,
-        now,
-    });
-    const binding = sourceCollection.binding;
-    const ticketBinding = selectedTicketBindingCandidate(binding);
-    const uploadWorkContext = {
-        ...uploadContext,
-        active_ticket_id: binding.selected_ticket_id ?? undefined,
-        ticket_binding_candidates: ticketBinding ? [ticketBinding] : binding.candidates,
-    };
-    const safeRiskFlags = sourceCollection.risk_flags.map((flag) => sanitizeRiskFlag(flag, repoLabel));
-    const events = [
-        makeSourceScanCompletedEvent({
-            context: uploadWorkContext,
-            generatedAt: now.toISOString(),
-            binding,
-            ticketBinding,
-            scans: sourceCollection.scans,
-            gitChangedFileCount: sourceCollection.facts.git?.changed_file_count ?? 0,
-            gitAddedLines: sourceCollection.facts.git?.added_lines ?? 0,
-            gitDeletedLines: sourceCollection.facts.git?.deleted_lines ?? 0,
-            carOpenTicketCount: sourceCollection.facts.car?.open_ticket_count ?? 0,
-            rawEvidenceFacts: sourceCollection.facts.raw_evidence,
-            riskFlags: safeRiskFlags,
-        }),
-    ];
-    const envelope = TelemetryIngestEnvelopeSchema.parse({
-        envelope_version: "telemetry-ingest.v1",
-        generated_at: now.toISOString(),
-        collector_version: LOCAL_COLLECTOR_VERSION,
-        session_reference: sanitizeSessionReference(session),
-        work_context: uploadWorkContext,
-        worktree_inventory: options.worktreeInventory ?? [],
-        source_scan_results: sanitizeSourceScanResults(sourceCollection.scans, repoLabel),
-        events,
-    });
-    return {
-        envelope,
-        dashboard_url: normalizeDashboardUrl(options.dashboardUrl ?? sessionFile.dashboard_url ?? config.dashboard_url),
-        device_token: sessionFile.device_token,
-        ticket_id: binding.selected_ticket_id ?? null,
-        binding,
-        event_count: envelope.events.length,
-        source_scan_count: envelope.source_scan_results.length,
-        risk_flag_count: safeRiskFlags.length,
-        repo_label: repoLabel,
-        head_sha: uploadContext.head_sha ?? null,
-        raw_evidence_upload_files: sourceCollection.facts.raw_evidence?.upload_files ?? [],
-        raw_evidence_facts: sourceCollection.facts.raw_evidence,
-    };
-}
+import { readRawEvidenceStagingState } from "./raw-evidence-staging.js";
+import { recordUploadBlocked, recordUploadFailure, recordUploadSuccess, } from "./spool/local-spool.js";
+import { buildLocalAmbientEnvelope, LocalUploadBlockedError, } from "./upload-envelope.js";
+import { applyRawEvidenceUploadOutcomes, hasRetryableEvidenceGap, logEvidenceBackoffBypassed, logEvidenceHeldByBackoff, logPermanentlyRejectedEvidence, partitionHeldEvidenceFiles, permanentEvidenceFailureReason, persistDeliveryAttempts, retrySourcesForFailedSync, retryableEvidenceGapReason, summarizeRawEvidenceDelivery, } from "./upload-evidence-delivery.js";
+import { reportAgentImageArtifacts } from "./upload-agent-artifacts.js";
+import { isNonEmptyString, readResponseJson, responseErrorMessage, } from "./upload-http.js";
+export { LocalUploadBlockedError, buildLocalAmbientEnvelope, } from "./upload-envelope.js";
+export { partitionHeldEvidenceFiles } from "./upload-evidence-delivery.js";
+export { reportAgentImageArtifacts } from "./upload-agent-artifacts.js";
+export { flushPendingCodexSessionReports, postCodexSessionReport, queueCodexSessionReport, reportCodexSessionAttributions, } from "./upload-session-reports.js";
 export async function syncLocalAmbientEnvelope(options = {}) {
     const attemptedAt = (options.now ?? new Date()).toISOString();
     const paths = getCollectorRuntimePaths(options.homeDir);
     const cursor = await readRawEvidenceCursor(paths);
-    let built;
-    try {
-        built = await buildLocalAmbientEnvelope({
-            ...options,
-            cursorObjects: options.cursorObjects ?? cursor.objects,
-        });
-    }
-    catch (error) {
-        if (error instanceof LocalUploadBlockedError) {
-            await recordUploadBlocked(paths, {
-                attemptedAt,
-                reason: error.message,
-            });
-        }
-        throw error;
-    }
+    const built = await buildEnvelopeOrRecordBlocker(paths, options, cursor.objects, attemptedAt);
     const fetchImpl = options.fetch ?? globalThis.fetch;
     if (!fetchImpl) {
         throw new Error("global fetch is unavailable; use Node.js 20 or newer.");
@@ -149,25 +24,24 @@ export async function syncLocalAmbientEnvelope(options = {}) {
     if (!provenance) {
         throw new Error("Ambient upload requires collector provenance.");
     }
+    // Assigned progressively so the spool path below can still report what did
+    // land if the upload pass throws part-way through.
     let uploadOutcomes = [];
     let uploadedChunkCount = 0;
     const attemptedDate = options.now ?? new Date(attemptedAt);
     const staging = await readRawEvidenceStagingState(paths.state_dir);
     try {
-        if (built.raw_evidence_upload_files.length > 0 && provenance) {
+        if (built.raw_evidence_upload_files.length > 0) {
             // Objects still inside their backoff window are not offered at all. They
             // become held outcomes below, which keeps them out of the envelope, keeps
             // the sync in retry_pending, and names the reason — the 559th identical
-            // attempt is what BLI-3066 made impossible.
-            const { deliverable, held } = partitionHeldEvidenceFiles(built.raw_evidence_upload_files, staging, attemptedDate);
-            if (held.length > 0) {
-                console.error("[cockpit-sync] raw evidence held by delivery backoff", JSON.stringify({
-                    attempted_at: attemptedAt,
-                    reason: DELIVERY_BACKOFF_HOLDING_REASON,
-                    object_count: held.length,
-                    byte_size: held.reduce((sum, outcome) => sum + (outcome.pointer.byte_size ?? 0), 0),
-                }));
-            }
+            // attempt is what BLI-3066 made impossible. An operator-invoked retry
+            // (`cockpit backfill`, doctor) offers them anyway and says so: the window
+            // is the scheduler's cadence, not an answer to a person asking now
+            // (BLI-3118).
+            const { deliverable, held, bypassed } = partitionHeldEvidenceFiles(built.raw_evidence_upload_files, staging, attemptedDate, options.evidenceDeliveryMode);
+            logEvidenceHeldByBackoff(held, attemptedAt);
+            logEvidenceBackoffBypassed(bypassed, attemptedAt);
             uploadOutcomes = held;
             if (deliverable.length > 0) {
                 const upload = await uploadRawEvidenceFilesChunked({
@@ -183,37 +57,12 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             }
             await persistDeliveryAttempts(paths.state_dir, staging, uploadOutcomes, attemptedDate);
         }
-        const envelope = applyRawEvidenceUploadOutcomes(built.envelope, uploadOutcomes);
-        const response = await fetchImpl(`${built.dashboard_url}/api/ambient/ingest`, {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${built.device_token}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify(envelope),
+        const response = await postEnvelopeToIngest({
+            fetchImpl,
+            built,
+            envelope: applyRawEvidenceUploadOutcomes(built.envelope, uploadOutcomes),
         });
-        const responseBody = await readResponseJson(response);
-        if (!response.ok) {
-            throw new Error(responseErrorMessage(responseBody, `Ambient ingest failed with HTTP ${response.status}`));
-        }
-        // A 2xx response may have persisted the envelope even when a proxy or
-        // incompatible dashboard mangles the receipt. Keep uploaded objects in
-        // that ambiguous case, but do not advance cursors or clear retry state
-        // until the first-party route proves the exact submitted row counts.
-        assertAmbientIngestReceipt(response, responseBody, envelope);
-        for (const outcome of uploadOutcomes) {
-            if (outcome.upload_state === "upload_failed")
-                continue;
-            const contentHash = outcome.pointer.content_hash_sha256;
-            if (!contentHash)
-                continue;
-            markObjectCommitted(cursor, contentHash, {
-                object_key: outcome.object_key,
-                byte_size: outcome.pointer.byte_size ?? 0,
-                committed_at: attemptedAt,
-            });
-        }
-        cursor.updated_at = attemptedAt;
+        advanceRawEvidenceCursor(cursor, uploadOutcomes, attemptedAt);
         await writeRawEvidenceCursor(paths, cursor);
         await reportAgentImageArtifacts({
             fetchImpl,
@@ -232,51 +81,13 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             reason: "agent_artifact_report_local_error",
             recorded_count: 0,
         }));
-        const retryableEvidenceGap = hasRetryableEvidenceGap(built.raw_evidence_facts, uploadOutcomes);
-        const retrySources = retrySourcesForFailedSync(options, built.raw_evidence_facts);
-        await recordUploadSuccess(paths, {
+        await recordIngestedSyncOutcome({
+            paths,
+            options,
+            built,
+            uploadOutcomes,
             attemptedAt,
-            workContextId: built.envelope.work_context.work_context_id,
-            clearPendingForContext: !retryableEvidenceGap,
         });
-        if (retryableEvidenceGap) {
-            await recordUploadFailure(paths, {
-                last_attempt_at: attemptedAt,
-                dashboard_url: built.dashboard_url,
-                work_context_id: built.envelope.work_context.work_context_id,
-                ticket_id: built.ticket_id,
-                repo_label: built.repo_label,
-                branch: built.envelope.work_context.branch,
-                event_count: built.event_count,
-                source_scan_count: built.source_scan_count,
-                risk_flag_count: built.risk_flag_count,
-                raw_evidence_file_count: built.raw_evidence_upload_files.length,
-                retry_sources: retrySources,
-                failure_reason: retryableEvidenceGapReason(built.raw_evidence_facts, uploadOutcomes),
-                retry_command: "cockpit sync",
-            });
-        }
-        else {
-            // No retry to queue, but a permanently rejected object still has to say
-            // so. `recordUploadBlocked` names the reason without spooling a retry —
-            // the machine reports the failure instead of promising a fix it cannot
-            // deliver, and `cockpit status` stops reading clean.
-            const permanentReason = permanentEvidenceFailureReason(uploadOutcomes);
-            if (permanentReason) {
-                await recordUploadBlocked(paths, {
-                    attemptedAt,
-                    reason: permanentReason,
-                });
-                // stderr, which launchd captures to `sync.err.log`, so an unattended
-                // machine leaves a dated record of the objects it gave up on. Reason
-                // labels and counts only — never a path or a byte of content.
-                console.error("[cockpit-sync] raw evidence permanently rejected", JSON.stringify({
-                    attempted_at: attemptedAt,
-                    reason: permanentReason,
-                    object_count: permanentFailedOutcomes(uploadOutcomes).length,
-                }));
-            }
-        }
         return {
             status: "uploaded",
             dashboard_url: built.dashboard_url,
@@ -287,7 +98,7 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             source_scan_count: built.source_scan_count,
             risk_flag_count: built.risk_flag_count,
             http_status: response.status,
-            ...rawEvidenceSummary(built, uploadOutcomes, uploadedChunkCount, cursor, staging, attemptedDate),
+            ...summarizeRawEvidenceDelivery(built, uploadOutcomes, uploadedChunkCount, cursor, staging, attemptedDate),
         };
     }
     catch (error) {
@@ -324,1061 +135,137 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             failure_reason: spooledFailureReason,
             spool_entry_id: entry.spool_id,
             retry_command: entry.retry_command,
-            ...rawEvidenceSummary(built, uploadOutcomes, uploadedChunkCount, cursor, staging, attemptedDate),
+            ...summarizeRawEvidenceDelivery(built, uploadOutcomes, uploadedChunkCount, cursor, staging, attemptedDate),
         };
     }
 }
 /**
- * Split the pack's files into "offer these now" and "still in backoff".
- *
- * A held file becomes an `upload_failed` outcome labelled
- * `delivery_backoff_holding`. That is deliberate rather than a quiet omission:
- * the pointer gets pruned from the envelope (the object is genuinely not
- * durable), the sync stays in `retry_pending`, and the reason travels to the
- * status output. A hold that read as success would be the green-status-hiding-
- * missing-collection failure the fleet contract forbids.
+ * Assemble the envelope, and if this machine simply cannot upload, say so in
+ * the spool before the error leaves. A blocker that only ever surfaced as a
+ * thrown exception would be invisible to the next `cockpit status`.
  */
-export function partitionHeldEvidenceFiles(files, staging, now) {
-    const deliverable = [];
-    const held = [];
-    for (const file of files) {
-        const hold = deliveryHold(staging, file.pointer.content_hash_sha256, now);
-        if (!hold) {
-            deliverable.push(file);
-            continue;
-        }
-        held.push({
-            pointer: file.pointer,
-            object_key: file.pointer.object_key ?? "",
-            codex_session_id: file.codex_session_id ?? null,
-            kind: file.kind ?? "raw_evidence",
-            ...(file.artifact_metadata
-                ? { artifact_metadata: file.artifact_metadata }
-                : {}),
-            upload_state: "upload_failed",
-            reason: DELIVERY_BACKOFF_HOLDING_REASON,
-            uploaded_chunk_count: 0,
+async function buildEnvelopeOrRecordBlocker(paths, options, cursorObjects, attemptedAt) {
+    try {
+        return await buildLocalAmbientEnvelope({
+            ...options,
+            cursorObjects: options.cursorObjects ?? cursorObjects,
         });
     }
-    return { deliverable, held };
-}
-/**
- * Count what just happened to each object, and when it may be offered again.
- *
- * Written immediately after the upload pass and before ingest, so an ingest
- * failure cannot lose the attempt counts — losing them resets every backoff to
- * zero and the fleet is back to 15-minute retries forever. A held outcome is
- * not itself an attempt: counting it would push its own next attempt further
- * out on every sync and eventually never retry at all.
- */
-async function persistDeliveryAttempts(stateDir, staging, outcomes, attemptedAt) {
-    let changed = false;
-    for (const outcome of outcomes) {
-        const contentHash = outcome.pointer.content_hash_sha256;
-        if (!contentHash)
-            continue;
-        if (outcome.reason === DELIVERY_BACKOFF_HOLDING_REASON)
-            continue;
-        if (outcome.upload_state === "upload_failed") {
-            const entry = recordDeliveryFailure(staging, contentHash, {
-                reason: outcome.reason ?? "upload_failed",
+    catch (error) {
+        if (error instanceof LocalUploadBlockedError) {
+            await recordUploadBlocked(paths, {
                 attemptedAt,
-                byteSize: outcome.pointer.byte_size ?? 0,
+                reason: error.message,
             });
-            changed = true;
-            console.error("[cockpit-sync] raw evidence delivery failed", JSON.stringify({
-                reason: entry.last_reason,
-                kind: outcome.kind,
-                attempts: entry.attempts,
-                first_failed_at: entry.first_failed_at,
-                next_attempt_at: entry.next_attempt_at,
-                byte_size: entry.byte_size,
-            }));
-            continue;
-        }
-        if (clearDeliveryAttempt(staging, contentHash)) {
-            changed = true;
-            console.error("[cockpit-sync] raw evidence delivery recovered", JSON.stringify({
-                reason: "delivery_recovered",
-                kind: outcome.kind,
-                upload_state: outcome.upload_state,
-            }));
         }
+        throw error;
     }
-    if (!changed)
-        return;
-    staging.updated_at = attemptedAt.toISOString();
-    await writeRawEvidenceStagingState(stateDir, staging).catch((error) => {
-        console.error("[cockpit-sync] delivery attempt state write failed", JSON.stringify({
-            reason: "staging_state_write_failed",
-            detail: error instanceof Error ? error.name : typeof error,
-            tracked_count: Object.keys(staging.delivery_attempts).length,
-        }));
-    });
-}
-function retrySourcesForFailedSync(options, facts) {
-    const sources = new Set();
-    if ((options.codexSessionFiles?.length ?? 0) > 0 ||
-        (options.codexAttributionScan?.directory_read_failed_count ?? 0) > 0 ||
-        (options.codexAttributionScan?.stat_failed_count ?? 0) > 0 ||
-        facts?.evidence_completeness.source_counts.some((count) => count.source.startsWith("codex_") &&
-            count.scanned_count + count.included_count + count.reused_count > 0)) {
-        sources.add("codex");
-    }
-    if ((options.claudeSessionFiles?.length ?? 0) > 0 ||
-        (options.claudeAttributionScan?.project_dir_read_failed_count ?? 0) > 0 ||
-        (options.claudeAttributionScan?.session_stat_failed_count ?? 0) > 0 ||
-        (options.claudeAttributionScan?.sidecar_dir_read_failed_count ?? 0) > 0 ||
-        (options.claudeAttributionScan?.sidecar_stat_failed_count ?? 0) > 0 ||
-        facts?.evidence_completeness.source_counts.some((count) => count.source.startsWith("claude_") &&
-            count.scanned_count + count.included_count + count.reused_count > 0)) {
-        sources.add("claude_code");
-    }
-    return [...sources];
-}
-/**
- * The failed uploads a later attempt could still rescue.
- *
- * An object storage has already refused on its own terms is not one of them,
- * and counting it as one is what kept Edward's Mac in `retry_pending` through
- * 13 consecutive syncs that were never going to end differently (BLI-2528).
- */
-function retryableFailedOutcomes(outcomes) {
-    return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
-        !isPermanentUploadFailure(outcome.reason));
-}
-/** Failed uploads that no retry can rescue, kept so they can still be named. */
-function permanentFailedOutcomes(outcomes) {
-    return outcomes.filter((outcome) => outcome.upload_state === "upload_failed" &&
-        isPermanentUploadFailure(outcome.reason));
-}
-/**
- * The reason to show for objects that failed for good.
- *
- * Returns null when there are none. These never queue a retry, but they must
- * never disappear either: a machine with a permanently rejected object has
- * missing collection, and a status that reads clean would hide it.
- */
-function permanentEvidenceFailureReason(outcomes) {
-    const reasons = new Set(permanentFailedOutcomes(outcomes).map((outcome) => outcome.reason ?? "unknown"));
-    if (reasons.size === 0)
-        return null;
-    return `raw_evidence_permanently_rejected:${[...reasons].sort().join(",")}`;
-}
-function hasRetryableEvidenceGap(facts, outcomes) {
-    if (retryableFailedOutcomes(outcomes).length > 0) {
-        return true;
-    }
-    if (!facts)
-        return false;
-    if (facts.deferred_byte_budget_count > 0 ||
-        facts.deferred_object_budget_count > 0) {
-        return true;
-    }
-    if (facts.evidence_completeness.status === "failed" ||
-        facts.evidence_completeness.totals.failed_count > 0 ||
-        facts.evidence_completeness.failure_reasons.length > 0) {
-        return true;
-    }
-    return facts.evidence_completeness.skip_reasons.some(({ reason }) => isRetryableEvidenceSkipReason(reason));
 }
 /**
- * Skip reasons a later sync can still turn into evidence.
+ * POST the envelope and refuse to believe an unreadable answer.
  *
- * `delivery_backoff_holding` is one of them, and it has to be: a source held by
- * backoff is missing collection right now. If it did not land here the sync
- * would read clean while a transcript sat undelivered for nine days, which is
- * the exact shape of BLI-3066.
+ * A 2xx may have persisted the envelope even when a proxy or an incompatible
+ * dashboard mangles the receipt. Uploaded objects are kept in that ambiguous
+ * case — they are durable either way — but the caller must not advance cursors
+ * or clear retry state until the first-party route proves the exact submitted
+ * row counts, which is what the receipt check demands.
  */
-function isRetryableEvidenceSkipReason(reason) {
-    if (reason === DELIVERY_BACKOFF_HOLDING_REASON)
-        return true;
-    return /(?:read|stat|directory)_failed|session_limit_overflow/iu.test(reason);
-}
-function retryableEvidenceGapReason(facts, outcomes) {
-    const reasons = new Set();
-    for (const outcome of retryableFailedOutcomes(outcomes)) {
-        reasons.add(outcome.reason ?? "upload_failed");
-    }
-    if (facts) {
-        if (facts.deferred_byte_budget_count > 0)
-            reasons.add("deferred_byte_budget");
-        if (facts.deferred_object_budget_count > 0) {
-            reasons.add("deferred_object_budget");
-        }
-        for (const { reason } of facts.evidence_completeness.failure_reasons) {
-            reasons.add(reason);
-        }
-        if (facts.evidence_completeness.status === "failed" &&
-            facts.evidence_completeness.failure_reasons.length === 0) {
-            reasons.add("evidence_completeness_failed");
-        }
-        for (const { reason } of facts.evidence_completeness.skip_reasons) {
-            if (isRetryableEvidenceSkipReason(reason)) {
-                reasons.add(reason);
-            }
-        }
-    }
-    return `partial_raw_evidence_retry_required:${[
-        ...reasons,
-    ].sort().join(",") || "unknown"}`;
-}
-/**
- * Posts a Codex session attribution report using the paired collector
- * credentials and the work context of a representative repo. Failures come
- * back as reason labels so the harvest never hard-fails on reporting.
- */
-export async function postCodexSessionReport(options) {
-    if (options.sessions.length === 0) {
-        return emptyCodexSessionReportResult("no_sessions_observed");
-    }
-    const fetchImpl = options.fetch ?? globalThis.fetch;
-    if (!fetchImpl) {
-        throw new Error("global fetch is unavailable; use Node.js 20 or newer.");
-    }
-    try {
-        const paths = getCollectorRuntimePaths(options.homeDir);
-        const config = await readLocalCollectorConfig(paths);
-        const sessionFile = await readLocalCollectorSessionFile(paths);
-        const session = await readLocalSessionReference(paths);
-        if (session.session_state !== "valid") {
-            return emptyCodexSessionReportResult("collector_not_paired");
-        }
-        const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
-        const activeContext = await readLocalWorkContextForRepo(paths, repoRoot);
-        const repoLabel = safeRepoLabel(activeContext.repo_label ?? repoRoot);
-        const provenance = makeCollectorProvenance({
-            context: makeUploadWorkContext({
-                activeContext,
-                session,
-                repoLabel,
-                now: options.now ?? new Date(),
-            }),
-            session,
-            repoLabel,
-        });
-        return await reportCodexSessionAttributions({
-            fetchImpl,
-            dashboardUrl: normalizeDashboardUrl(options.dashboardUrl ?? sessionFile.dashboard_url ?? config.dashboard_url),
-            deviceToken: sessionFile.device_token,
-            provenance,
-            generatedAt: (options.now ?? new Date()).toISOString(),
-            sessions: options.sessions,
-        });
-    }
-    catch {
-        return emptyCodexSessionReportResult("collector_not_ready");
-    }
-}
-/**
- * Queues the safe session-attribution rows before the network request. The
- * queue is merged per work context, so an endpoint outage retains every
- * observed session without growing one duplicate report per scheduler pass.
- */
-export async function queueCodexSessionReport(options) {
-    if (options.sessions.length === 0)
-        return null;
-    const paths = getCollectorRuntimePaths(options.homeDir);
-    return await recordPendingSessionReport(paths, {
-        attempted_at: options.generatedAt,
-        dashboard_url: normalizeDashboardUrl(options.dashboardUrl),
-        generated_at: options.generatedAt,
-        work_context_id: options.workContextId,
-        repo_label: safeRepoLabel(options.repoLabel),
-        branch: options.branch,
-        repo_fingerprint: options.repoFingerprint,
-        repo_origin_url: options.repoOriginUrl,
-        worktree_label: options.worktreeLabel,
-        worktree_fingerprint: options.worktreeFingerprint,
-        worktree_is_primary: options.worktreeIsPrimary,
-        sessions: options.sessions,
+async function postEnvelopeToIngest(options) {
+    const response = await options.fetchImpl(`${options.built.dashboard_url}/api/ambient/ingest`, {
+        method: "POST",
+        headers: {
+            "Authorization": `Bearer ${options.built.device_token}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(options.envelope),
     });
-}
-/**
- * Flushes every durable session-attribution report using current credentials.
- * Report payloads do not depend on the source files still being inside the live
- * scan window, so a transient endpoint failure cannot silently age them out.
- */
-export async function flushPendingCodexSessionReports(options) {
-    const paths = getCollectorRuntimePaths(options.homeDir);
-    const state = await readLocalUploadSpoolState(paths);
-    if (state.pending_session_reports.length === 0) {
-        return emptyCodexSessionReportResult("no_pending_session_reports");
+    const responseBody = await readResponseJson(response);
+    if (!response.ok) {
+        throw new Error(responseErrorMessage(responseBody, `Ambient ingest failed with HTTP ${response.status}`));
     }
-    const attemptedAt = (options.now ?? new Date()).toISOString();
-    const fetchImpl = options.fetch ?? globalThis.fetch;
-    if (!fetchImpl) {
-        throw new Error("global fetch is unavailable; use Node.js 20 or newer.");
-    }
-    let sessionFile;
-    let session;
-    try {
-        [sessionFile, session] = await Promise.all([
-            readLocalCollectorSessionFile(paths),
-            readLocalSessionReference(paths),
-        ]);
-    }
-    catch {
-        return await failPendingSessionReports(paths, state.pending_session_reports, attemptedAt, "collector_not_ready");
-    }
-    if (session.session_state !== "valid") {
-        return await failPendingSessionReports(paths, state.pending_session_reports, attemptedAt, "collector_not_paired");
-    }
-    const results = [];
-    for (const pending of state.pending_session_reports) {
-        const provenance = {
-            capture_source: "collector_runtime",
-            capture_adapter_version: LOCAL_COLLECTOR_VERSION,
-            collector_version: LOCAL_COLLECTOR_VERSION,
-            repo: pending.repo_label,
-            branch: pending.branch,
-            repo_label: pending.repo_label,
-            repo_fingerprint: pending.repo_fingerprint,
-            ...(pending.repo_origin_url
-                ? { repo_origin_url: pending.repo_origin_url }
-                : {}),
-            worktree_label: pending.worktree_label,
-            worktree_fingerprint: pending.worktree_fingerprint,
-            worktree_is_primary: pending.worktree_is_primary,
-            operator_id: session.operator_id,
-            session_id: session.session_id,
-            work_context_id: pending.work_context_id,
-        };
-        const result = await reportCodexSessionAttributions({
-            fetchImpl,
-            dashboardUrl: normalizeDashboardUrl(pending.dashboard_url || sessionFile.dashboard_url),
-            deviceToken: sessionFile.device_token,
-            provenance,
-            generatedAt: pending.generated_at,
-            sessions: pending.sessions,
-            maxAttemptsPerRequest: options.maxAttemptsPerRequest,
-            sleep: options.sleep,
-        });
-        results.push(result);
-        if (result.posted) {
-            await recordSessionReportSuccess(paths, {
-                reportId: pending.report_id,
-                attemptedAt,
-            });
-        }
-        else {
-            await recordSessionReportFailure(paths, {
-                reportId: pending.report_id,
-                attemptedAt,
-                reason: result.reason,
-            });
-        }
-    }
-    return combineCodexSessionReportResults(results);
-}
-async function failPendingSessionReports(paths, pendingReports, attemptedAt, reason) {
-    for (const pending of pendingReports) {
-        await recordSessionReportFailure(paths, {
-            reportId: pending.report_id,
-            attemptedAt,
-            reason,
-        });
-    }
-    return {
-        posted: false,
-        reason,
-        chunk_count: 0,
-        recorded_count: 0,
-        failed_count: pendingReports.length,
-        chunks: [],
-    };
-}
-function combineCodexSessionReportResults(results) {
-    if (results.length === 0) {
-        return emptyCodexSessionReportResult("no_pending_session_reports");
-    }
-    const failed = results.filter((result) => !result.posted);
-    return {
-        posted: failed.length === 0,
-        reason: failed[0]?.reason ??
-            (results.every((result) => result.reason === "recorded")
-                ? "recorded"
-                : results[0]?.reason ?? "recorded"),
-        chunk_count: results.reduce((total, result) => total + result.chunk_count, 0),
-        recorded_count: results.reduce((total, result) => total + result.recorded_count, 0),
-        failed_count: results.reduce((total, result) => total + result.failed_count, 0),
-        chunks: results.flatMap((result) => result.chunks),
-    };
+    assertAmbientIngestReceipt(response, responseBody, options.envelope);
+    return response;
 }
 /**
- * Reports Codex session attribution outcomes after sync. Non-fatal by design:
- * older dashboards without the endpoint must not fail the harvest, so the
- * caller receives a posted/skipped label instead of an exception.
+ * Remember every object that is now durable, so the next sync can reuse the
+ * bytes instead of re-uploading them. A failed upload is deliberately absent:
+ * recording it would make the next sync skip a file that never landed.
  */
-export async function reportCodexSessionAttributions(options) {
-    if (options.sessions.length === 0) {
-        return emptyCodexSessionReportResult("no_sessions_observed");
-    }
-    const chunks = [];
-    const sessionChunks = chunkArray(options.sessions, CODEX_SESSION_REPORT_MAX_SESSIONS);
-    for (const [index, sessions] of sessionChunks.entries()) {
-        const chunk = await postCodexSessionAttributionChunk({
-            ...options,
-            sessions,
-            batchIndex: index + 1,
-        });
-        chunks.push(chunk);
-    }
-    const failedCount = chunks.filter((chunk) => !chunk.posted).length;
-    const recordedCount = chunks.reduce((sum, chunk) => sum + chunk.recorded_count, 0);
-    return {
-        posted: failedCount === 0,
-        reason: failedCount === 0
-            ? "recorded"
-            : chunks.find((chunk) => !chunk.posted)?.reason ?? "report_failed",
-        chunk_count: chunks.length,
-        recorded_count: recordedCount,
-        failed_count: failedCount,
-        chunks,
-    };
-}
-async function postCodexSessionAttributionChunk(options) {
-    const maxAttempts = options.maxAttemptsPerRequest ?? 3;
-    const sleep = options.sleep ?? defaultReportSleep;
-    let lastStatus = null;
-    let lastFailureReason = null;
-    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-        try {
-            const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/codex-sessions`, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${options.deviceToken}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify({
-                    schema_version: "ambient-codex-session-attributions.v1",
-                    generated_at: options.generatedAt,
-                    provenance: options.provenance,
-                    sessions: options.sessions,
-                }),
-            });
-            lastStatus = response.status;
-            const body = await readResponseJson(response);
-            if (response.status === 404) {
-                return codexSessionReportChunkResult(options, {
-                    posted: false,
-                    reason: "codex_session_api_unavailable",
-                    httpStatus: response.status,
-                    recordedCount: 0,
-                });
-            }
-            if (response.ok) {
-                const parsed = CodexSessionAttributionReportResponseSchema.safeParse(body);
-                if (!parsed.success) {
-                    lastFailureReason = "report_invalid_response";
-                }
-                else if (parsed.data.recorded_count <
-                    requiredCodexSessionAcknowledgementCount(options.sessions)) {
-                    lastFailureReason = "report_incomplete_acknowledgement";
-                }
-                else {
-                    return codexSessionReportChunkResult(options, {
-                        posted: true,
-                        reason: "recorded",
-                        httpStatus: response.status,
-                        recordedCount: parsed.data.recorded_count,
-                    });
-                }
-            }
-            else {
-                lastFailureReason = `report_failed_http_${response.status}`;
-            }
-            if (response.status < 500 && response.status !== 429) {
-                if (response.ok) {
-                    // A malformed or short 2xx response is retryable. The server may have
-                    // failed between persisting the rows and producing its acknowledgement,
-                    // so only a schema-valid, sufficiently large acknowledgement is safe
-                    // to use for deleting a durable pending report.
-                    if (attempt < maxAttempts)
-                        await sleep(250 * attempt);
-                    continue;
-                }
-                return codexSessionReportChunkResult(options, {
-                    posted: false,
-                    reason: `report_failed_http_${response.status}`,
-                    httpStatus: response.status,
-                    recordedCount: 0,
-                });
-            }
-        }
-        catch {
-            lastStatus = null;
-            lastFailureReason = "report_network_error";
-        }
-        if (attempt < maxAttempts)
-            await sleep(250 * attempt);
-    }
-    return codexSessionReportChunkResult(options, {
-        posted: false,
-        reason: lastFailureReason ??
-            (lastStatus === null
-                ? "report_network_error"
-                : `report_failed_http_${lastStatus}`),
-        httpStatus: lastStatus,
-        recordedCount: 0,
-    });
-}
-function codexSessionReportChunkResult(options, result) {
-    return {
-        batch_index: options.batchIndex,
-        session_count: options.sessions.length,
-        posted: result.posted,
-        reason: result.reason,
-        http_status: result.httpStatus,
-        recorded_count: result.recordedCount,
-    };
-}
-function emptyCodexSessionReportResult(reason) {
-    return {
-        posted: false,
-        reason,
-        chunk_count: 0,
-        recorded_count: 0,
-        failed_count: 0,
-        chunks: [],
-    };
-}
-function chunkArray(items, size) {
-    const chunks = [];
-    for (let offset = 0; offset < items.length; offset += size) {
-        chunks.push(items.slice(offset, offset + size));
-    }
-    return chunks;
-}
-function requiredCodexSessionAcknowledgementCount(sessions) {
-    return new Set(sessions.map((session) => `${session.source ?? "codex"}:${session.codex_session_id}`)).size;
-}
-function defaultReportSleep(milliseconds) {
-    return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-export async function reportAgentImageArtifacts(options) {
-    const artifacts = agentArtifactsFromEvidence(options);
-    if (artifacts.length === 0) {
-        return {
-            posted: false,
-            reason: "no_agent_image_artifacts",
-            recorded_count: 0,
-        };
-    }
-    const payload = AgentImageArtifactReportRequestSchema.parse({
-        schema_version: "ambient-agent-image-artifacts.v1",
-        generated_at: options.generatedAt,
-        provenance: options.provenance,
-        artifacts,
-    });
-    try {
-        const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/agent-artifacts`, {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${options.deviceToken}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify(payload),
-        });
-        if (response.status === 404) {
-            return {
-                posted: false,
-                reason: "agent_artifact_api_unavailable",
-                recorded_count: 0,
-            };
-        }
-        if (!response.ok) {
-            return {
-                posted: false,
-                reason: `report_failed_http_${response.status}`,
-                recorded_count: 0,
-            };
-        }
-        const body = await readResponseJson(response);
-        const recordedCount = body && typeof body === "object"
-            ? Number(body.recorded_count ?? 0)
-            : 0;
-        return {
-            posted: true,
-            reason: "recorded",
-            recorded_count: Number.isFinite(recordedCount) ? recordedCount : 0,
-        };
-    }
-    catch {
-        return { posted: false, reason: "report_network_error", recorded_count: 0 };
-    }
-}
-function agentArtifactsFromEvidence(options) {
-    const byPointerId = new Map();
-    for (const outcome of options.outcomes) {
-        if (outcome.upload_state === "upload_failed" || !outcome.artifact_metadata) {
-            continue;
-        }
-        const artifact = agentArtifactFromMetadata({
-            metadata: outcome.artifact_metadata,
-            rawEvidencePointerId: outcome.pointer.raw_evidence_pointer_id,
-            objectKey: outcome.object_key,
-            ticketId: options.ticketId,
-            repoFingerprint: options.repoFingerprint,
-            worktreeFingerprint: options.worktreeFingerprint,
-            uploadState: outcome.upload_state,
-        });
-        byPointerId.set(artifact.raw_evidence_pointer_id, artifact);
-    }
-    for (const entry of options.reused) {
-        if (!entry.artifact_metadata)
+function advanceRawEvidenceCursor(cursor, outcomes, attemptedAt) {
+    for (const outcome of outcomes) {
+        if (outcome.upload_state === "upload_failed")
             continue;
-        const objectKey = options.cursorObjects[entry.content_hash_sha256]?.object_key;
-        if (!objectKey)
+        const contentHash = outcome.pointer.content_hash_sha256;
+        if (!contentHash)
             continue;
-        const artifact = agentArtifactFromMetadata({
-            metadata: entry.artifact_metadata,
-            rawEvidencePointerId: objectKey,
-            objectKey,
-            ticketId: options.ticketId,
-            repoFingerprint: options.repoFingerprint,
-            worktreeFingerprint: options.worktreeFingerprint,
-            uploadState: "reused_existing",
+        markObjectCommitted(cursor, contentHash, {
+            object_key: outcome.object_key,
+            byte_size: outcome.pointer.byte_size ?? 0,
+            committed_at: attemptedAt,
         });
-        byPointerId.set(artifact.raw_evidence_pointer_id, artifact);
     }
-    return [...byPointerId.values()];
-}
-function agentArtifactFromMetadata(options) {
-    return {
-        raw_evidence_pointer_id: options.rawEvidencePointerId,
-        agent_source: options.metadata.agent_source,
-        source_session_id: options.metadata.source_session_id,
-        ...(options.metadata.source_message_id
-            ? { source_message_id: options.metadata.source_message_id }
-            : {}),
-        ...(options.metadata.turn_index !== undefined
-            ? { turn_index: options.metadata.turn_index }
-            : {}),
-        occurred_at: options.metadata.occurred_at,
-        artifact_kind: options.metadata.artifact_kind,
-        capture_origin: "agent_session_attachment",
-        ...(options.ticketId ? { ticket_id: options.ticketId } : {}),
-        ...(options.repoFingerprint
-            ? { repo_fingerprint: options.repoFingerprint }
-            : {}),
-        ...(options.worktreeFingerprint
-            ? { worktree_fingerprint: options.worktreeFingerprint }
-            : {}),
-        storage_bucket: "ambient-raw-evidence",
-        object_key: options.objectKey,
-        content_hash_sha256: options.metadata.content_hash_sha256,
-        byte_size: options.metadata.byte_size,
-        media_type: options.metadata.media_type,
-        width: options.metadata.width,
-        height: options.metadata.height,
-        redaction_status: "not_started",
-        ocr_status: "not_started",
-        labels: {
-            collector_upload_state: options.uploadState,
-            ...(options.metadata.source_sidecar_id
-                ? { source_sidecar_id: options.metadata.source_sidecar_id }
-                : {}),
-        },
-    };
-}
-function rawEvidenceSummary(built, outcomes, uploadedChunkCount, cursor, staging, now) {
-    const stuck = summarizeStuckEvidence(staging, now);
-    const cursorReused = built.raw_evidence_facts?.reused ?? [];
-    const serverReusedCount = outcomes.filter((outcome) => outcome.upload_state === "reused_existing").length;
-    const failed = outcomes.filter((outcome) => outcome.upload_state === "upload_failed");
-    const retryRequired = hasRetryableEvidenceGap(built.raw_evidence_facts, outcomes);
-    const retryReason = retryRequired
-        ? retryableEvidenceGapReason(built.raw_evidence_facts, outcomes)
-        : null;
-    const cursorReusedOutcomes = cursorReused.map((entry) => ({
-        object_key: cursor.objects[entry.content_hash_sha256]?.object_key ?? "",
-        raw_evidence_pointer_id: cursor.objects[entry.content_hash_sha256]?.object_key ?? "",
-        kind: entry.kind,
-        codex_session_id: entry.codex_session_id,
-        ...(entry.artifact_metadata
-            ? { artifact_metadata: entry.artifact_metadata }
-            : {}),
-        upload_state: "reused_existing",
-        reason: "cursor_content_match",
-    }));
-    return {
-        raw_evidence_file_count: built.raw_evidence_upload_files.length,
-        raw_evidence_uploaded_object_count: outcomes.filter((outcome) => outcome.upload_state === "uploaded").length,
-        raw_evidence_uploaded_chunk_count: uploadedChunkCount,
-        raw_evidence_reused_count: cursorReused.length + serverReusedCount,
-        raw_evidence_failed_count: failed.length,
-        raw_evidence_sanitized_count: built.raw_evidence_facts?.sanitized_count ?? 0,
-        raw_evidence_failure_reasons: [
-            ...new Set(failed.map((outcome) => outcome.reason ?? "unknown")),
-        ],
-        raw_evidence_retry_required: retryRequired,
-        raw_evidence_retry_reasons: retryReason
-            ? retryReason
-                .replace(/^partial_raw_evidence_retry_required:/u, "")
-                .split(",")
-                .filter(Boolean)
-            : [],
-        raw_evidence_outcomes: [
-            ...outcomes.map((outcome) => ({
-                object_key: outcome.object_key,
-                raw_evidence_pointer_id: outcome.pointer.raw_evidence_pointer_id,
-                kind: outcome.kind,
-                codex_session_id: outcome.codex_session_id,
-                ...(outcome.artifact_metadata
-                    ? { artifact_metadata: outcome.artifact_metadata }
-                    : {}),
-                upload_state: outcome.upload_state,
-                reason: outcome.reason,
-            })),
-            ...cursorReusedOutcomes,
-        ],
-        raw_evidence_deferred_byte_budget: built.raw_evidence_facts?.deferred_byte_budget_count ?? 0,
-        raw_evidence_deferred_object_budget: built.raw_evidence_facts?.deferred_object_budget_count ?? 0,
-        cursor_tracked_object_count: Object.keys(cursor.objects).length,
-        raw_evidence_delivery_held_count: outcomes.filter((outcome) => outcome.reason === DELIVERY_BACKOFF_HOLDING_REASON).length + (built.raw_evidence_facts?.delivery_held_count ?? 0),
-        raw_evidence_stuck_object_count: stuck.stuck_object_count,
-        raw_evidence_max_delivery_attempts: stuck.max_attempts,
-        raw_evidence_oldest_delivery_failure_at: stuck.oldest_first_failed_at,
-    };
+    cursor.updated_at = attemptedAt;
 }
 /**
- * Ingest refuses pointers whose objects never became durable, so failed
- * uploads are pruned from the envelope instead of failing the whole sync.
- * Successful upload responses can also carry server-side sanitized hash and
- * redaction metadata; apply those before ingest so refs describe the bytes
- * actually stored in the durable bucket.
+ * What the operator is owed after ingest accepted the envelope, as a decision
+ * table on the evidence this sync left behind:
+ *
+ * | evidence state                        | ledger                              |
+ * |---------------------------------------|-------------------------------------|
+ * | a gap a later sync could rescue        | success, then a queued retry naming why |
+ * | a gap no retry can rescue             | success, then a blocker naming why, plus a stderr record |
+ * | nothing missing                       | success, pending state cleared      |
+ *
+ * The middle row is the one that matters. A permanently rejected object gets no
+ * retry — nothing would change — but it must still be named, or `cockpit status`
+ * reads clean on a machine with missing collection (BLI-2528).
  */
-function applyRawEvidenceUploadOutcomes(envelope, outcomes) {
-    // Content-addressed keys mean one pointer id can carry several outcomes
-    // (byte-identical files); the pointer is durable if ANY outcome succeeded.
-    const durablePointers = new Map();
-    for (const outcome of outcomes) {
-        if (outcome.upload_state === "upload_failed")
-            continue;
-        durablePointers.set(outcome.pointer.raw_evidence_pointer_id, outcome.pointer);
-    }
-    const durablePointerIds = new Set([...durablePointers.keys()]);
-    const failedPointerIds = new Set(outcomes
-        .filter((outcome) => outcome.upload_state === "upload_failed" &&
-        !durablePointerIds.has(outcome.pointer.raw_evidence_pointer_id))
-        .map((outcome) => outcome.pointer.raw_evidence_pointer_id));
-    const failedOutcomes = outcomes.filter((outcome) => failedPointerIds.has(outcome.pointer.raw_evidence_pointer_id));
-    if (failedPointerIds.size === 0 && durablePointers.size === 0)
-        return envelope;
-    return {
-        ...envelope,
-        events: envelope.events.map((event) => ({
-            ...event,
-            metrics: failedPointerIds.size > 0
-                ? {
-                    ...event.metrics,
-                    evidence_failed_count: (event.metrics["evidence_failed_count"] ?? 0) +
-                        failedOutcomes.length,
-                }
-                : event.metrics,
-            attributes: failedPointerIds.size > 0 && event.evidence_completeness
-                ? {
-                    ...event.attributes,
-                    evidence_completeness_schema_version: event.evidence_completeness.schema_version,
-                    evidence_completeness_status: "partial",
-                    evidence_incomplete: true,
-                }
-                : event.attributes,
-            evidence_completeness: failedPointerIds.size > 0 && event.evidence_completeness
-                ? markCompletenessUploadFailures(event.evidence_completeness, failedOutcomes)
-                : event.evidence_completeness,
-            raw_evidence_pointers: event.raw_evidence_pointers.flatMap((pointer) => {
-                const pointerId = pointer.raw_evidence_pointer_id;
-                if (failedPointerIds.has(pointerId))
-                    return [];
-                return [durablePointers.get(pointerId) ?? pointer];
-            }),
-            redaction: failedPointerIds.size > 0
-                ? {
-                    ...event.redaction,
-                    raw_evidence_pointer_ids: event.redaction.raw_evidence_pointer_ids.filter((pointerId) => !failedPointerIds.has(pointerId)),
-                }
-                : event.redaction,
-        })),
-    };
-}
-function markCompletenessUploadFailures(completeness, failedOutcomes) {
-    const failureCounts = new Map();
-    for (const outcome of failedOutcomes) {
-        const source = outcome.kind ?? "raw_evidence";
-        failureCounts.set(source, (failureCounts.get(source) ?? 0) + 1);
-    }
-    const totalFailures = [...failureCounts.values()].reduce((sum, count) => sum + count, 0);
-    const sourceCounts = [...completeness.source_counts];
-    for (const [source, count] of failureCounts) {
-        const existingIndex = sourceCounts.findIndex((entry) => entry.source === source);
-        if (existingIndex === -1) {
-            sourceCounts.push({
-                source,
-                scanned_count: 0,
-                included_count: 0,
-                skipped_count: 0,
-                truncated_count: 0,
-                deferred_count: 0,
-                reused_count: 0,
-                failed_count: count,
-            });
-            continue;
-        }
-        const existing = sourceCounts[existingIndex];
-        if (!existing)
-            continue;
-        sourceCounts[existingIndex] = {
-            ...existing,
-            failed_count: existing.failed_count + count,
-        };
-    }
-    const failureReasons = [...completeness.failure_reasons];
-    for (const [source, count] of failureCounts) {
-        const reason = "upload_failed";
-        const existingIndex = failureReasons.findIndex((entry) => entry.source === source && entry.reason === reason);
-        if (existingIndex === -1) {
-            failureReasons.push({ source, reason, count });
-        }
-        else {
-            const existing = failureReasons[existingIndex];
-            if (existing) {
-                failureReasons[existingIndex] = {
-                    ...existing,
-                    count: existing.count + count,
-                };
-            }
-        }
-    }
-    return EvidenceCompletenessPayloadSchema.parse({
-        ...completeness,
-        status: "partial",
-        source_counts: sourceCounts,
-        totals: {
-            ...completeness.totals,
-            failed_count: completeness.totals.failed_count + totalFailures,
-        },
-        failure_reasons: failureReasons.sort((a, b) => `${a.source}:${a.reason}`.localeCompare(`${b.source}:${b.reason}`)),
-        notes: [
-            ...new Set([
-                ...completeness.notes,
-                "Some collected evidence did not become durable; downstream analysis should lower confidence.",
-            ]),
-        ],
+async function recordIngestedSyncOutcome(options) {
+    const { paths, built, uploadOutcomes, attemptedAt } = options;
+    const retryableEvidenceGap = hasRetryableEvidenceGap(built.raw_evidence_facts, uploadOutcomes);
+    await recordUploadSuccess(paths, {
+        attemptedAt,
+        workContextId: built.envelope.work_context.work_context_id,
+        clearPendingForContext: !retryableEvidenceGap,
     });
-}
-function makeUploadWorkContext(options) {
-    const provenance = makeCollectorProvenance({
-        context: options.activeContext,
-        session: options.session,
-        repoLabel: options.repoLabel,
-    });
-    return {
-        ...options.activeContext,
-        repo: options.repoLabel,
-        repo_label: options.activeContext.repo_label ?? options.repoLabel,
-        repo_fingerprint: options.activeContext.repo_fingerprint,
-        repo_origin_url: options.activeContext.repo_origin_url,
-        head_sha: options.activeContext.head_sha,
-        worktree_label: options.activeContext.worktree_label,
-        worktree_fingerprint: options.activeContext.worktree_fingerprint,
-        worktree_is_primary: options.activeContext.worktree_is_primary,
-        operator_id: options.session.operator_id,
-        session_id: options.session.session_id,
-        updated_at: options.now.toISOString(),
-        provenance,
-    };
-}
-function makeSourceScanCompletedEvent(options) {
-    if (!options.context.provenance) {
-        throw new Error("Upload work context is missing provenance.");
+    if (retryableEvidenceGap) {
+        await recordUploadFailure(paths, {
+            last_attempt_at: attemptedAt,
+            dashboard_url: built.dashboard_url,
+            work_context_id: built.envelope.work_context.work_context_id,
+            ticket_id: built.ticket_id,
+            repo_label: built.repo_label,
+            branch: built.envelope.work_context.branch,
+            event_count: built.event_count,
+            source_scan_count: built.source_scan_count,
+            risk_flag_count: built.risk_flag_count,
+            raw_evidence_file_count: built.raw_evidence_upload_files.length,
+            retry_sources: retrySourcesForFailedSync(options.options, built.raw_evidence_facts),
+            failure_reason: retryableEvidenceGapReason(built.raw_evidence_facts, uploadOutcomes),
+            retry_command: "cockpit sync",
+        });
+        return;
     }
-    const rawEvidencePointers = options.rawEvidenceFacts?.pointers ?? [];
-    const evidenceCompleteness = options.rawEvidenceFacts?.evidence_completeness;
-    const hasRawEvidence = rawEvidencePointers.length > 0;
-    const eventPrivacyClassification = hasRawEvidence
-        ? "redacted_summary"
-        : "metadata";
-    return TelemetryIngestEventDtoSchema.parse({
-        event_id: `ambient-sync:${options.context.work_context_id}:${options.generatedAt}`,
-        event_type: "source_scan_completed",
-        occurred_at: options.generatedAt,
-        provenance: options.context.provenance,
-        privacy_classification: eventPrivacyClassification,
-        redaction: {
-            privacy_classification: eventPrivacyClassification,
-            redaction_status: hasRawEvidence
-                ? "raw_remote_durable"
-                : "metadata_only",
-            redacted_fields: [
-                "prompt_body",
-                "response_body",
-                "diff_body",
-                "transcript_body",
-                "git.changed_paths",
-                "local_file_paths",
-            ],
-            raw_evidence_pointer_ids: rawEvidencePointers.map((pointer) => pointer.raw_evidence_pointer_id),
-            redacted_summary: hasRawEvidence
-                ? "Collector uploaded raw evidence objects separately and sent only references, hashes, source scan, binding, and risk summaries to ingest."
-                : "Collector uploaded metadata-only local work, source scan, binding, and risk summaries.",
-        },
-        redacted_summary: hasRawEvidence
-            ? "Collector uploaded raw evidence objects separately, then sent evidence references and metadata summaries."
-            : "Collector uploaded metadata-only source scan, ticket binding, and risk summaries.",
-        metrics: {
-            git_changed_file_count: options.gitChangedFileCount,
-            git_added_lines: options.gitAddedLines,
-            git_deleted_lines: options.gitDeletedLines,
-            car_open_ticket_count: options.carOpenTicketCount,
-            source_scan_count: options.scans.length,
-            risk_flag_count: options.riskFlags.length,
-            raw_evidence_file_count: options.rawEvidenceFacts?.file_count ?? 0,
-            raw_evidence_byte_size: options.rawEvidenceFacts?.byte_size ?? 0,
-            raw_evidence_skipped_count: options.rawEvidenceFacts?.skipped_count ?? 0,
-            raw_evidence_sanitized_count: options.rawEvidenceFacts?.sanitized_count ?? 0,
-            raw_evidence_reused_count: options.rawEvidenceFacts?.reused_count ?? 0,
-            evidence_scanned_count: evidenceCompleteness?.totals.scanned_count ?? 0,
-            evidence_included_count: evidenceCompleteness?.totals.included_count ?? 0,
-            evidence_skipped_count: evidenceCompleteness?.totals.skipped_count ?? 0,
-            evidence_truncated_count: evidenceCompleteness?.totals.truncated_count ?? 0,
-            evidence_deferred_count: evidenceCompleteness?.totals.deferred_count ?? 0,
-            evidence_reused_count: evidenceCompleteness?.totals.reused_count ?? 0,
-            evidence_failed_count: evidenceCompleteness?.totals.failed_count ?? 0,
-        },
-        attributes: {
-            repo_label: options.context.repo,
-            repo_fingerprint: options.context.repo_fingerprint ?? "unknown",
-            worktree_label: options.context.worktree_label ?? "unknown",
-            worktree_fingerprint: options.context.worktree_fingerprint ?? "unknown",
-            worktree_is_primary: options.context.worktree_is_primary ?? false,
-            branch: options.context.branch,
-            ticket_binding_state: options.binding.state,
-            ticket_binding_source: options.binding.selected_source ?? "none",
-            ticket_id: options.binding.selected_ticket_id ?? "unbound",
-            source_adapters: options.scans.map((scan) => scan.adapter.adapter_name),
-            source_statuses: options.scans.map((scan) => `${scan.adapter.adapter_name}:${scan.status}`),
-            redaction_mode: hasRawEvidence
-                ? "remote_durable_raw_evidence"
-                : "metadata_only",
-            raw_payload_included: false,
-            evidence_completeness_schema_version: evidenceCompleteness?.schema_version ?? "evidence-completeness.v1",
-            evidence_completeness_status: evidenceCompleteness?.status ?? "unknown",
-            evidence_incomplete: evidenceCompleteness
-                ? evidenceCompleteness.status !== "complete"
-                : true,
-            ...(options.context.topic_label
-                ? { topic_label: options.context.topic_label }
-                : {}),
-            ...(options.context.topic_summary_redacted
-                ? { topic_summary_redacted: options.context.topic_summary_redacted }
-                : {}),
-            ...(options.context.work_intent
-                ? { work_intent: options.context.work_intent }
-                : {}),
-            ...(options.context.work_phase
-                ? { work_phase: options.context.work_phase }
-                : {}),
-            ...(options.context.intent_source
-                ? { intent_source: options.context.intent_source }
-                : {}),
-            ...(options.context.intent_confidence !== undefined
-                ? { intent_confidence: options.context.intent_confidence }
-                : {}),
-        },
-        evidence_completeness: evidenceCompleteness,
-        ticket_binding: options.ticketBinding ?? undefined,
-        risk_flags: options.riskFlags,
-        raw_evidence_pointers: rawEvidencePointers,
+    const permanentReason = permanentEvidenceFailureReason(uploadOutcomes);
+    if (!permanentReason)
+        return;
+    await recordUploadBlocked(paths, {
+        attemptedAt,
+        reason: permanentReason,
     });
-}
-function makeCollectorProvenance(options) {
-    return {
-        capture_source: "collector_runtime",
-        capture_adapter_version: LOCAL_COLLECTOR_VERSION,
-        collector_version: LOCAL_COLLECTOR_VERSION,
-        repo: options.repoLabel,
-        branch: options.context.branch,
-        repo_label: options.context.repo_label ?? options.repoLabel,
-        repo_fingerprint: options.context.repo_fingerprint,
-        repo_origin_url: options.context.repo_origin_url,
-        worktree_label: options.context.worktree_label,
-        worktree_fingerprint: options.context.worktree_fingerprint,
-        worktree_is_primary: options.context.worktree_is_primary,
-        operator_id: options.session.operator_id,
-        session_id: options.session.session_id,
-        work_context_id: options.context.work_context_id,
-    };
-}
-function sanitizeSessionReference(session) {
-    return {
-        ...session,
-        session_file_path: "local-session-file",
-    };
-}
-function sanitizeSourceScanResults(scans, repoLabel) {
-    return scans.map((scan) => ({
-        ...scan,
-        diagnostic_labels: scan.diagnostic_labels.map(sanitizeDiagnosticLabel),
-        events: scan.events.map((event) => ({
-            ...event,
-            raw_evidence_pointers: [],
-            redaction: {
-                ...event.redaction,
-                raw_evidence_pointer_ids: [],
-            },
-        })),
-        risk_flags: scan.risk_flags.map((flag) => sanitizeRiskFlag(flag, repoLabel)),
-    }));
-}
-function sanitizeDiagnosticLabel(label) {
-    if (label.includes("\n") || label.includes("/") || label.includes("\\")) {
-        const prefix = label.split(":", 1)[0]?.trim();
-        return prefix ? `${prefix}:redacted` : "diagnostic_redacted";
-    }
-    return label.length > 160 ? `${label.slice(0, 157)}...` : label;
-}
-function sanitizeRiskFlag(flag, repoLabel) {
-    return {
-        ...flag,
-        provenance: {
-            ...flag.provenance,
-            repo: repoLabel,
-        },
-    };
-}
-function selectedTicketBindingCandidate(binding) {
-    if (!binding.selected_ticket_id || !binding.selected_source)
-        return null;
-    return (binding.candidates.find((candidate) => candidate.ticket_id === binding.selected_ticket_id &&
-        candidate.binding_source === binding.selected_source) ?? {
-        ticket_id: binding.selected_ticket_id,
-        binding_source: binding.selected_source,
-        confidence: 1,
-        evidence_labels: [`bound_by:${binding.selected_source}`],
+    logPermanentlyRejectedEvidence({
+        reason: permanentReason,
+        outcomes: uploadOutcomes,
+        attemptedAt,
     });
 }
-async function readResponseJson(response) {
-    const text = await response.text();
-    if (!text)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return { message: text };
-    }
-}
-function responseErrorMessage(value, fallback) {
-    if (value && typeof value === "object") {
-        const record = value;
-        const message = record["message"] ?? record["error"];
-        if (typeof message === "string" && message.trim())
-            return message;
-    }
-    return fallback;
-}
+/**
+ * The receipt that proves ingest persisted exactly what was submitted.
+ *
+ * Anything short of a 202 whose counts match the envelope's own totals is
+ * treated as no receipt at all — a proxy's 200, a truncated body, or a
+ * dashboard that accepted fewer rows than were sent all land here.
+ */
 function assertAmbientIngestReceipt(response, value, envelope) {
     if (response.status !== 202 || !value || typeof value !== "object") {
         throw new Error("Ambient ingest returned an invalid durable receipt.");
@@ -1398,23 +285,4 @@ function assertAmbientIngestReceipt(response, value, envelope) {
         ingest["evidence_ref_count"] !== expectedEvidenceRefCount) {
         throw new Error("Ambient ingest returned an incomplete durable receipt.");
     }
-}
-function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
-function normalizeDashboardUrl(value) {
-    const normalized = value.trim().replace(/\/+$/, "");
-    if (!normalized)
-        throw new Error("Dashboard URL cannot be empty.");
-    return normalized;
-}
-function safeRepoLabel(repoRoot) {
-    const basename = path.basename(repoRoot.replace(/[\\/]+$/, ""));
-    return basename || "repo";
-}
-function rawEvidenceObjectKeyBelongsToWorkContext(objectKey, context) {
-    const legacyPrefix = `${context.operatorId}/${context.workContextId}/`;
-    const readableIdGuard = `/ids/${context.operatorId}/${context.workContextId}/`;
-    return (objectKey.startsWith(legacyPrefix) ||
-        (objectKey.startsWith("operators/") && objectKey.includes(readableIdGuard)));
 }