@bli-cockpit/cli 0.2.29 → 0.2.31

package/README.md

@@ -13,9 +13,9 @@ added <packages> in <seconds>s
 
 ```bash
 $ cockpit do-everything
-Cockpit harvest onboarding
+Setting up Cockpit
 Dashboard: https://bli-cockpit-dashboard.vercel.app
-Ticket: general ambient
+Ticket: none (general work)
 What's your @buildlaunchiterate.ca email? (press enter to skip): ian@buildlaunchiterate.ca
 Signing in as ian@buildlaunchiterate.ca.
 Code sent; valid 1h, resend in 60s by rerunning this command.
@@ -28,7 +28,7 @@ What you can do:
 Code: 482913
 Signed in as ian@buildlaunchiterate.ca.
 2/5 Device paired.
-PASS: Cockpit collector is ready for harvest.
+PASS: Cockpit is set up and collecting.
 You're live.
 Dashboard: https://bli-cockpit-dashboard.vercel.app/my-work
 Next: cockpit status
@@ -36,9 +36,15 @@ Next: cockpit status
 
 ```bash
 $ cockpit status
-Install: ready
-Auth: paired
-Upload state: ready
+Cockpit status
+Installed: yes
+Signed in: yes
+Ticket: none (general work)
+Last collected: recently
+Uploads: ready
+Waiting to upload: 0
+Old sessions: done
+Stuck files: none
 ```
 
 The OTP proves you own an approved BLI mailbox. The JWT is used once to register this device and is never saved; the durable local credential remains the existing Cockpit device token.
@@ -47,13 +53,14 @@ The OTP proves you own an approved BLI mailbox. The JWT is used once to register
 
 On a blank Mac or Windows PC, `npm i -g @bli-cockpit/cli && cockpit do-everything` is enough to sign in, choose roots, and converge the machine. `onboard` remains the named setup subset, and the rest exist for recovery and maintenance.
 
-The core collection contract is the same on Apple Silicon macOS and native
-Windows: every eligible Codex and Claude session attributable to an approved
-root is collected, redacted before ingest, and either uploaded with a durable
-receipt or surfaced with an explicit ambiguity, skip, or retry reason. A green
-machine must not hide silently missing sessions. This support claim remains
-release-gated: the packed candidate must pass normal-user canaries on both host
-families before its exact version is promoted to npm `latest`.
+Cockpit works the same way on an Apple Silicon Mac and on a normal Windows
+PC. Every Codex and Claude session in a folder you have approved is collected,
+stripped of anything sensitive before it leaves your machine, and then either
+uploaded with a receipt or listed with the exact reason it was not. If a
+session is missing, Cockpit says so — a green screen never hides one.
+
+We only publish a version to npm after it has been tested end-to-end, as a
+normal user, on both macOS and Windows.
 
 | Command | What it does | Why it exists / why this name |
 |---|---|---|
@@ -171,11 +178,11 @@ Local files:
 
 - `~/.config/bli-cockpit/config.json`: dashboard URL, device label, collection roots.
 - `~/.config/bli-cockpit/session.json`: paired device token and owner metadata.
-- `~/.local/state/bli-cockpit/spool/`: safe retry records.
+- `~/.local/state/bli-cockpit/spool/`: uploads waiting to be retried.
 - `~/.local/state/bli-cockpit/spool/install-events/`: private atomic collector
   health receipts waiting for authenticated delivery. Receipts contain only
   sanitized operation metadata, never command output or transcript content.
-- `~/.local/state/bli-cockpit/cursors/`: upload/backfill cursors, no raw content.
+- `~/.local/state/bli-cockpit/cursors/`: bookmarks for how far uploading has got, no raw content.
 - `.codex-autorunner/contextspace/active_context.md`: current work context inside a repo.
 
 Remote data:

package/dist/adapters/agent-image-evidence.js

@@ -29,6 +29,10 @@ export async function collectAgentImageEvidenceFromJsonlFile(options) {
             record = JSON.parse(line);
         }
         catch {
+            // Deliberately silent (BLI-3238). Per line of a transcript, and this
+            // scan is looking for image records specifically — a line it cannot
+            // parse is a line that was not going to be one. The transcript's own
+            // adapter already counts parse errors at the session grain.
             continue;
         }
         for (const candidate of imageCandidatesFromRecord(record, {

package/dist/adapters/attribution-core.js

@@ -347,6 +347,10 @@ function fallbackToTranscriptOriginForDeletedRepo(options) {
             return !options.pathExists?.(value);
         }
         catch {
+            // Deliberately silent (BLI-3238). This is an existence PROBE and
+            // failure is the answer: a path we cannot test is a path we cannot
+            // claim is missing, so the candidate is passed over. The scorer is
+            // pure and synchronous by design and has no channel to report on.
             return false;
         }
     }) ?? null;
@@ -386,6 +390,10 @@ function terminalReasonForRecordedPaths(paths, pathExists) {
             return pathExists(value);
         }
         catch {
+            // Deliberately silent (BLI-3238), same probe as above: "cannot test"
+            // folds into "does not exist", which is the conservative direction —
+            // it keeps the older `repo_not_on_disk` label rather than inventing
+            // `cwd_not_a_repo`.
             return false;
         }
     });
@@ -514,6 +522,10 @@ function canonicalExistingAttributionPath(value) {
         return attributionPathApi(value).resolve(realpathSync(value));
     }
     catch {
+        // Deliberately silent (BLI-3238). `realpathSync` is the test for "does
+        // this path resolve to something real?", and `null` — "no canonical form"
+        // — is the answer, not a degradation. Callers already treat a null here
+        // as one more alias that does not apply.
         return null;
     }
 }

package/dist/adapters/car-state.js

@@ -2,6 +2,7 @@ import { SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { makeSourceAdapterIdentity, parseTicketIdFromText, } from "./common.js";
+import { describeError, isMissingFileFailure } from "../health-detail.js";
 export async function collectCarState(context) {
     const ticketsDir = path.join(context.repoRoot, ".codex-autorunner", "tickets");
     try {
@@ -41,7 +42,17 @@ export async function collectCarState(context) {
             facts,
         };
     }
-    catch {
+    catch (error) {
+        // `car_not_present` is honest for a repo with no `car/` folder, which is
+        // most of them, so a missing directory stays quiet. It is also what a
+        // malformed ticket file collapses to — and that version silently costs the
+        // repo its ticket binding while reporting the ordinary answer (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[car-state] car folder present but unreadable, reporting it as not present", JSON.stringify({
+                reason: "car_not_present",
+                ...describeError(error),
+            }));
+        }
         const facts = {
             present: false,
             current_ticket: null,

package/dist/adapters/claude-attribution.js

@@ -5,6 +5,7 @@ import { createReadStream, existsSync } from "node:fs";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
+import { describeError } from "../health-detail.js";
 import { SESSION_FILE_UUID_PATTERN, isPathWithin, sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Claude Code session JSONL -> repo/worktree attribution.
@@ -89,11 +90,24 @@ async function discoverClaudeSessions(projectsDir, cutoffMs) {
     let sessionStatFailedCount = 0;
     let sidecarDirReadFailedCount = 0;
     let sidecarStatFailedCount = 0;
+    // Same shape as the Codex walk: first reason plus counts, once. Per-file
+    // lines across a store of thousands would be their own silence (BLI-3238).
+    let firstDirectoryFailure = null;
+    let firstStatFailure = null;
     let projectEntries;
     try {
         projectEntries = await fs.readdir(projectsDir, { withFileTypes: true });
     }
     catch (error) {
+        // The whole projects root. Absent means Claude Code has never run here;
+        // anything else means every Claude session on this machine is invisible
+        // and the scan still reports a clean zero.
+        if (!isMissingPathError(error)) {
+            console.error("[claude-attribution] Claude projects root unreadable; no sessions can be seen", JSON.stringify({
+                reason: "projects_root_unreadable",
+                ...describeError(error),
+            }));
+        }
         return {
             sessions,
             projectDirsSkipped,
@@ -112,8 +126,10 @@ async function discoverClaudeSessions(projectsDir, cutoffMs) {
             sessionEntries = await fs.readdir(projectDir, { withFileTypes: true });
         }
         catch (error) {
-            if (!isMissingPathError(error))
+            if (!isMissingPathError(error)) {
                 projectDirReadFailedCount += 1;
+                firstDirectoryFailure ??= describeError(error);
+            }
             continue;
         }
         for (const sessionEntry of sessionEntries) {
@@ -126,8 +142,9 @@ async function discoverClaudeSessions(projectsDir, cutoffMs) {
             try {
                 mainStat = await fs.stat(mainFile);
             }
-            catch {
+            catch (error) {
                 sessionStatFailedCount += 1;
+                firstStatFailure ??= describeError(error);
                 continue;
             }
             const sessionUuid = sessionEntry.name.replace(/\.jsonl$/i, "");
@@ -149,6 +166,18 @@ async function discoverClaudeSessions(projectsDir, cutoffMs) {
             });
         }
     }
+    if (projectDirReadFailedCount > 0 || sessionStatFailedCount > 0) {
+        console.error("[claude-attribution] Claude sessions were invisible to the walk", JSON.stringify({
+            reason: "session_discovery_incomplete",
+            project_dir_read_failed_count: projectDirReadFailedCount,
+            session_stat_failed_count: sessionStatFailedCount,
+            found_session_count: sessions.length,
+            ...(firstDirectoryFailure
+                ? { first_directory_failure: firstDirectoryFailure }
+                : {}),
+            ...(firstStatFailure ? { first_stat_failure: firstStatFailure } : {}),
+        }));
+    }
     return {
         sessions,
         projectDirsSkipped,
@@ -164,6 +193,15 @@ async function discoverSidecars(subagentsDir) {
         entries = await fs.readdir(subagentsDir, { withFileTypes: true });
     }
     catch (error) {
+        // Most sessions have no subagents at all, so absent is quiet. Anything
+        // else means the session is collected WITHOUT its subagent transcripts and
+        // nothing downstream can tell that from a session that had none.
+        if (!isMissingPathError(error)) {
+            console.error("[claude-attribution] subagent folder unreadable; sidecars omitted from this session", JSON.stringify({
+                reason: "sidecar_dir_unreadable",
+                ...describeError(error),
+            }));
+        }
         return {
             sidecars: [],
             sidecarsCapped: 0,
@@ -173,6 +211,7 @@ async function discoverSidecars(subagentsDir) {
     }
     const discovered = [];
     let statFailedCount = 0;
+    let firstSidecarStatFailure = null;
     for (const entry of entries) {
         // Only agent transcripts. `*.meta.json` carry operator-authored
         // descriptions and are never harvested (D3).
@@ -186,8 +225,9 @@ async function discoverSidecars(subagentsDir) {
         try {
             stat = await fs.stat(local_path);
         }
-        catch {
+        catch (error) {
             statFailedCount += 1;
+            firstSidecarStatFailure ??= describeError(error);
             continue;
         }
         discovered.push({
@@ -197,6 +237,14 @@ async function discoverSidecars(subagentsDir) {
             byteSize: stat.size,
         });
     }
+    if (statFailedCount > 0) {
+        console.error("[claude-attribution] subagent transcripts skipped", JSON.stringify({
+            reason: "sidecar_stat_failed",
+            stat_failed_count: statFailedCount,
+            found_sidecar_count: discovered.length,
+            ...firstSidecarStatFailure,
+        }));
+    }
     discovered.sort((a, b) => b.mtimeMs - a.mtimeMs);
     const capped = Math.max(0, discovered.length - CLAUDE_SESSION_MAX_SIDECAR_FILES);
     return {
@@ -241,9 +289,16 @@ async function attributeOneSession(session, worktrees, collectionRoots) {
         try {
             streamed = await streamMainSignals(session.mainFile);
         }
-        catch {
+        catch (error) {
             // A read race on one oversized main must not abort the whole scan; honor
-            // the per-file skip contract.
+            // the per-file skip contract. Per session, so worth a line each time:
+            // this is a whole session nobody will ever coach on (BLI-3238).
+            console.error("[claude-attribution] oversized session could not be streamed, skipping it", JSON.stringify({
+                reason: "file_read_failed",
+                stage: "stream_oversized_main",
+                byte_size: session.mainByteSize,
+                ...describeError(error),
+            }));
             return skippedResult(base, "file_read_failed");
         }
         signals = streamed.signals;
@@ -257,7 +312,13 @@ async function attributeOneSession(session, worktrees, collectionRoots) {
         try {
             raw = await fs.readFile(session.mainFile);
         }
-        catch {
+        catch (error) {
+            console.error("[claude-attribution] session file unreadable, skipping it", JSON.stringify({
+                reason: "file_read_failed",
+                stage: "read_main",
+                byte_size: session.mainByteSize,
+                ...describeError(error),
+            }));
             return skippedResult(base, "file_read_failed");
         }
         const content = raw.toString("utf8");
@@ -346,7 +407,16 @@ async function collectSidecarDiagnostics(sidecars, worktree) {
         try {
             raw = await fs.readFile(sidecar.local_path);
         }
-        catch {
+        catch (error) {
+            // `file_read_failed` stays on the sidecar row. Beside it: a subagent
+            // transcript that was stat'd successfully seconds ago and now will not
+            // read is a race worth being able to recognise (BLI-3238).
+            console.error("[claude-attribution] subagent transcript unreadable, skipping it", JSON.stringify({
+                reason: "file_read_failed",
+                stage: "read_sidecar",
+                byte_size: sidecar.byteSize,
+                ...describeError(error),
+            }));
             out.push({ ...entry, skipped_reason: "file_read_failed" });
             continue;
         }
@@ -397,6 +467,10 @@ function createSignalAccumulator() {
                 record = JSON.parse(line);
             }
             catch {
+                // Deliberately silent (BLI-3238), same as the Codex line parser: per
+                // LINE across hundreds of thousands, the last line of a live session
+                // is routinely half-written, the count travels in `parseErrorCount` at
+                // the right grain, and the error would carry transcript text.
                 parseErrorCount += 1;
                 return;
             }

package/dist/adapters/codex-attribution.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { normalizeGitOrigin } from "../repo-identity.js";
+import { describeError } from "../health-detail.js";
 import { sanitizeSessionId, scoreSignalsAgainstWorktrees, sessionIdFromFileName, shortHash, } from "./attribution-core.js";
 /**
  * Deterministic Codex session JSONL -> repo/worktree attribution.
@@ -74,6 +75,11 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
     const secretPathSkippedCount = 0;
     const stack = Array.isArray(dir) ? [...dir] : [dir];
     const seenFiles = new Set();
+    // The counts already travel in the scan result; what never did is WHY, and
+    // one line per skipped file in a store of thousands would be its own kind of
+    // silence. First reason plus count, logged once (BLI-3238).
+    let firstDirectoryFailure = null;
+    let firstStatFailure = null;
     while (stack.length > 0) {
         const current = stack.pop();
         if (!current)
@@ -83,8 +89,10 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
             entries = await fs.readdir(current, { withFileTypes: true });
         }
         catch (error) {
-            if (!isMissingPathError(error))
+            if (!isMissingPathError(error)) {
                 directoryReadFailedCount += 1;
+                firstDirectoryFailure ??= describeError(error);
+            }
             continue;
         }
         for (const entry of entries) {
@@ -99,8 +107,9 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
             try {
                 stat = await fs.stat(full);
             }
-            catch {
+            catch (error) {
                 statFailedCount += 1;
+                firstStatFailure ??= describeError(error);
                 continue;
             }
             if (stat.mtimeMs >= cutoffMs) {
@@ -112,6 +121,18 @@ async function discoverCodexJsonlFiles(dir, cutoffMs) {
             }
         }
     }
+    if (directoryReadFailedCount > 0 || statFailedCount > 0) {
+        console.error("[codex-attribution] Codex sessions were invisible to the walk", JSON.stringify({
+            reason: "session_discovery_incomplete",
+            directory_read_failed_count: directoryReadFailedCount,
+            stat_failed_count: statFailedCount,
+            found_file_count: out.length,
+            ...(firstDirectoryFailure
+                ? { first_directory_failure: firstDirectoryFailure }
+                : {}),
+            ...(firstStatFailure ? { first_stat_failure: firstStatFailure } : {}),
+        }));
+    }
     out.sort((a, b) => b.mtimeMs - a.mtimeMs);
     return {
         files: out,
@@ -158,7 +179,15 @@ async function attributeOneSession(file, worktrees, collectionRoots) {
     try {
         read = await readCodexMetadataSignals(file.file);
     }
-    catch {
+    catch (error) {
+        // One skipped session, with `file_read_failed` on its row. Logged per
+        // session because it is per SESSION, not per file in a walk: a session
+        // that cannot be read is a session nobody will ever coach on (BLI-3238).
+        console.error("[codex-attribution] session file unreadable, skipping it", JSON.stringify({
+            reason: "file_read_failed",
+            byte_size: file.byteSize,
+            ...describeError(error),
+        }));
         return skippedResult(base, "file_read_failed");
     }
     base.content_hash_sha256 = read.contentHashSha256;
@@ -268,6 +297,11 @@ function absorbCodexSessionLine(state, line) {
         record = JSON.parse(line);
     }
     catch {
+        // Deliberately silent (BLI-3238). Per LINE, in files with hundreds of
+        // thousands of them, and the last line of a live session is routinely
+        // half-written — this is expected, not a failure. The count travels in
+        // `parseErrorCount` on the scan result, which is the right grain, and the
+        // error object would carry a fragment of the transcript.
         state.parseErrorCount += 1;
         return;
     }

package/dist/adapters/raw-evidence-manifest.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { describeError } from "../health-detail.js";
 import { remoteObjectKey, sha256 } from "./raw-evidence-keys.js";
 export const RAW_EVIDENCE_BUCKET = "ambient-raw-evidence";
 export const RAW_EVIDENCE_RETENTION_MODE = "remote_durable";
@@ -126,7 +127,17 @@ export function manifestDescribesEntries(manifestBytes, entries) {
         return (recorded.length === expected.length &&
             recorded.every((hash, index) => hash === expected[index]));
     }
-    catch {
+    catch (error) {
+        // `false` is the safe answer and is also what a legitimately-stale
+        // manifest returns, so the pack is simply rewritten either way. The
+        // difference is that an unparseable manifest means a pack was written
+        // half-way, which will repeat until someone knows it is happening.
+        console.error("[raw-evidence-manifest] manifest unparseable; treating the pack as not described", JSON.stringify({
+            reason: "manifest_unparseable",
+            byte_size: manifestBytes.byteLength,
+            expected_file_count: entries.length,
+            ...describeError(error),
+        }));
         return false;
     }
 }

package/dist/adapters/raw-evidence-pack-store.js

@@ -14,6 +14,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { makeManifest, manifestDescribesEntries, } from "./raw-evidence-manifest.js";
 import { writeRawEvidenceStagingState, } from "../raw-evidence-staging.js";
+import { describeError } from "../health-detail.js";
 /**
  * Turn the staging directory into the content-keyed pack directory.
  *
@@ -41,9 +42,20 @@ export async function promoteStagedPack(options) {
                 refilledFileCount: 0,
             };
         }
-        catch {
+        catch (error) {
             // A concurrent sync can win the race to the same content-keyed name.
-            // Losing it is fine: the winner staged the identical bytes.
+            // Losing it is fine: the winner staged the identical bytes — and that
+            // race is EEXIST/ENOTEMPTY/EPERM. A rename that fails for any other
+            // reason (no space, cross-device, read-only) also lands here and looks
+            // exactly like the benign race while the pack is never stored
+            // (BLI-3238).
+            if (!isPackRenameRaceError(error)) {
+                console.error("[raw-evidence-pack-store] could not move the staged pack into place", JSON.stringify({
+                    reason: "pack_rename_failed",
+                    pack_id: options.packId,
+                    ...describeError(error),
+                }));
+            }
         }
     }
     const refilledFileCount = await refillMissingPackFiles(evidenceDir, options.entries);
@@ -120,11 +132,24 @@ export async function persistStagingState(stateDir, staging, nowIso) {
     await writeRawEvidenceStagingState(stateDir, staging).catch((error) => {
         console.error("[raw-evidence] staging state write failed", JSON.stringify({
             reason: "staging_state_write_failed",
-            detail: error instanceof Error ? error.name : typeof error,
             staged_count: Object.keys(staging.staged).length,
+            // Was `error.name` alone, which is "Error" for every fs failure
+            // there is. The code is the part that distinguishes them (BLI-3238).
+            ...describeError(error),
         }));
     });
 }
+/**
+ * The codes `rename` produces when the destination already exists — which is
+ * the benign "another sync staged these identical bytes first" outcome. EPERM
+ * is Windows's version of it.
+ */
+function isPackRenameRaceError(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const code = error.code;
+    return code === "EEXIST" || code === "ENOTEMPTY" || code === "EPERM";
+}
 export async function ensurePrivateDir(dir) {
     await fs.mkdir(dir, { recursive: true, mode: 0o700 });
     await chmodPrivate(dir, 0o700);

package/dist/adapters/raw-evidence-sanitize.js

@@ -1,5 +1,7 @@
 import { containsSecretLikeContent, redactSecretLikeContent, } from "@bli-cockpit/telemetry-core";
 import { sha256 } from "./raw-evidence-keys.js";
+import { describeError } from "../health-detail.js";
+/** BLI-3238: a crashed redactor has to say so; see the catch below. */
 export function sanitizeTextEvidenceForUpload(options) {
     const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
     // Deliberately outside the try: the content guard is the cheap check that
@@ -35,9 +37,25 @@ export function sanitizeTextEvidenceForUpload(options) {
                 redactionResult,
             });
         }
-        return { status: "clean", bytes: originalBytes };
+        return {
+            status: "clean",
+            bytes: originalBytes,
+            redaction: scannedCleanRedactionMetadata(originalBytes),
+        };
     }
-    catch {
+    catch (error) {
+        // The redactor itself crashed. The stub below is the safe answer — a
+        // placeholder goes up instead of unredacted bytes — but it is also
+        // indistinguishable downstream from a file that was legitimately masked,
+        // so a systematic redactor bug would look like a machine that simply
+        // writes a lot of secrets. Never the text, never the field values: name,
+        // code and size only (BLI-3238).
+        console.error("[raw-evidence-sanitize] redaction crashed; uploading a stub instead of the content", JSON.stringify({
+            reason: "redaction_crashed",
+            byte_size: originalBytes.byteLength,
+            redacted_field_count: options.redactedFields.length,
+            ...describeError(error),
+        }));
         return stubForCrashedRedaction({
             text: options.text,
             originalBytes,
@@ -147,6 +165,32 @@ function lineEndingOf(segment) {
         return "\n";
     return "";
 }
+/**
+ * The receipt for a file the scan cleared (BLI-3277).
+ *
+ * Same schema, same `mode` — the deterministic ruleset is what ran — with the
+ * verdict `scanned_clean` and zero of everything else. The content fields are
+ * the point: an evidence ref is only readable downstream when its redaction
+ * record hashes the bytes that are actually in the bucket, and for a clean file
+ * those are the original bytes, so both halves carry the same digest and size.
+ */
+function scannedCleanRedactionMetadata(originalBytes) {
+    const digest = sha256(originalBytes);
+    return {
+        schema_version: "raw-evidence-redaction.v1",
+        status: "scanned_clean",
+        mode: "deterministic_text_replacement",
+        applied_by: ["local_collector"],
+        rule_counts: [],
+        secret_like_match_count: 0,
+        redacted_fields: [],
+        redacted_ranges: [],
+        original_content_hash_sha256: digest,
+        sanitized_content_hash_sha256: digest,
+        original_byte_size: originalBytes.byteLength,
+        sanitized_byte_size: originalBytes.byteLength,
+    };
+}
 function fallbackRedactionMetadata(options) {
     const fullContentRedacted = options.fullContentRedacted !== false;
     return {