@bli-cockpit/cli 0.2.30 → 0.2.31

package/dist/cursors/raw-evidence-cursor.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { describeError, isMissingFileFailure } from "../health-detail.js";
 /**
  * Durable local cursor for raw-evidence harvesting.
  *
@@ -41,7 +42,19 @@ export async function readRawEvidenceCursor(paths, options = {}) {
         const raw = JSON.parse(await fs.readFile(rawEvidenceCursorPath(paths, options.filename), "utf8"));
         return parseCursorState(raw);
     }
-    catch {
+    catch (error) {
+        // An empty cursor is the correct answer before the first sync, and saying
+        // so every 15 minutes would bury the case that matters. A cursor that
+        // exists and cannot be read is a different event entirely: the collector
+        // is about to re-offer every object it already delivered and no line
+        // anywhere says why (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[raw-evidence-cursor] cursor unreadable, starting from empty", JSON.stringify({
+                reason: "cursor_unreadable",
+                cursor_file: options.filename ?? PRIMARY_CURSOR_FILENAME,
+                ...describeError(error),
+            }));
+        }
         return emptyRawEvidenceCursorState();
     }
 }

package/dist/discovery-limits.js

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, } from "./repo-identity.js";
 import { getCollectorRuntimePaths } from "./local-state.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
 const SCHEMA_VERSION = "cockpit-discovery-limits.v1";
 // A depth beyond this is a typo rather than a workspace, and an unbounded walk
 // on a huge tree is its own outage. Same for the repo cap.
@@ -32,7 +33,17 @@ export async function readSavedDiscoveryLimits(homeDir = os.homedir()) {
             max_repos: sanitizeLimit(parsed.max_repos, MAX_ALLOWED_REPOS),
         };
     }
-    catch {
+    catch (error) {
+        // No saved limits is the normal state and stays quiet. A file that exists
+        // and will not parse silently reinstates the shipped defaults, which is
+        // exactly the shape of the outage where depth 3 / 50 repos quietly
+        // undercollected for days — so it gets a line (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[discovery-limits] saved limits unreadable, falling back to defaults", JSON.stringify({
+                reason: "discovery_limits_unreadable",
+                ...describeError(error),
+            }));
+        }
         return {};
     }
 }

package/dist/evidence-upload-client.js

@@ -1,6 +1,7 @@
 import { COMMIT_CRASHED_PLATFORM, RAW_EVIDENCE_UPLOAD_DEFAULT_CHUNK_BYTES, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, RAW_EVIDENCE_UPLOAD_MAX_OBJECTS_PER_BEGIN, RawEvidenceLegacyUploadResponseSchema, RawEvidenceRedactionMetadataSchema, RawEvidenceUploadBeginResponseSchema, RawEvidenceUploadCommitResponseSchema, isPermanentUploadFailure, } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
+import { describeError } from "./health-detail.js";
 const DEFAULT_MAX_ATTEMPTS = 3;
 const RETRY_DELAY_MS = 250;
 export async function uploadRawEvidenceFilesChunked(options) {
@@ -16,7 +17,16 @@ export async function uploadRawEvidenceFilesChunked(options) {
         try {
             stat = await fs.stat(file.local_path);
         }
-        catch {
+        catch (error) {
+            // `file_read_failed` is a durable ledger label and stays. Beside it: a
+            // staged object that vanished (the GC won a race) and one the process
+            // has no permission to open are the same word and opposite repairs
+            // (BLI-3238).
+            console.error("[evidence-upload] staged object could not be stat'd", JSON.stringify({
+                reason: "file_read_failed",
+                stage: "stat",
+                ...describeError(error),
+            }));
             outcomes.push(failedOutcome(file, "file_read_failed"));
             continue;
         }
@@ -32,7 +42,15 @@ export async function uploadRawEvidenceFilesChunked(options) {
         try {
             bytes = await fs.readFile(file.local_path);
         }
-        catch {
+        catch (error) {
+            // Stat succeeded and the read did not — narrower than the stat failure
+            // above and worth telling apart, so it carries its own stage label.
+            console.error("[evidence-upload] staged object could not be read after a successful stat", JSON.stringify({
+                reason: "file_read_failed",
+                stage: "read",
+                byte_size: stat.size,
+                ...describeError(error),
+            }));
             outcomes.push(failedOutcome(file, "file_read_failed"));
             continue;
         }
@@ -437,7 +455,18 @@ async function requestJson(options, routePath, body) {
                 return { ok: response.ok, status: response.status, body: lastBody };
             }
         }
-        catch {
+        catch (error) {
+            // `status: 0` is this function's word for "no answer came back", and it
+            // travels all the way to the upload ledger without ever saying whether
+            // the request left the machine. This is the exact silence BLI-2528 sat
+            // behind for 57 days; the route is named, the body never is.
+            console.error("[evidence-upload] request failed before a status came back", JSON.stringify({
+                reason: "upload_request_transport_error",
+                route: routePath,
+                attempt,
+                max_attempts: maxAttempts,
+                ...describeError(error),
+            }));
             lastStatus = 0;
             lastBody = null;
         }
@@ -578,7 +607,15 @@ async function readResponseJson(response) {
     }
     catch {
         // The raw text is kept for the caller that wants to show it, never for a
-        // label or a log — it is an unbounded HTML page.
+        // label or a log — it is an unbounded HTML page. Its SHAPE is safe and is
+        // the part that matters: a non-JSON body means something in front of the
+        // dashboard answered instead of it (BLI-3067, BLI-3238).
+        console.error("[evidence-upload] reply was not JSON", JSON.stringify({
+            reason: "response_body_not_json",
+            http_status: response.status,
+            byte_size: text.length,
+            content_type: response.headers.get("content-type") ?? "none",
+        }));
         return { message: text, [NON_JSON_RESPONSE_BODY_KEY]: "non_json" };
     }
 }

package/dist/health-detail.js

@@ -87,17 +87,126 @@ function localIdentifiers() {
         identifiers.push([os.hostname(), "[host]"]);
     }
     catch {
-        // A host with no resolvable name has nothing to leak.
+        // A host with no resolvable name has nothing to leak. Deliberately silent
+        // (BLI-3238): this runs inside the redactor, so reporting it here would
+        // recurse into the very function that is failing.
     }
     try {
         identifiers.push([os.userInfo().username, "[user]"]);
     }
     catch {
-        // Same: no account name available means none can travel.
+        // Same: no account name available means none can travel, and the same
+        // recursion argument applies.
     }
     // A one- or two-character name would match far too much ordinary text.
     return identifiers.filter(([value]) => value && value.length > 2);
 }
 function literalPattern(value) {
     return new RegExp(value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), "giu");
+}
+/**
+ * Describes a caught error in fields that are safe to log, and never throws
+ * doing it.
+ *
+ * BLI-3238. A bare `catch {}` in the harvester is how collection dies for days
+ * without anyone noticing (BLI-2528: 57 days, one probe away the whole time).
+ * The counter-pressure is that an error message on this machine is not neutral
+ * text — an fs error carries the operator's absolute path, a fetch error
+ * carries a host, and a parse error can carry a fragment of the transcript
+ * being parsed. So:
+ *
+ * - A syscall error (`code` + `syscall`) reports its code and syscall and
+ *   drops the message entirely. `ENOENT: no such file or directory, open
+ *   '/Users/<person>/…'` says nothing `ENOENT open` does not, and the tail is
+ *   pure local identifier.
+ * - Every other message goes through `redactedHealthDetail`, the same
+ *   secret-and-path scrubber the health receipts use before leaving the
+ *   machine, and is capped at `HEALTH_DETAIL_MAX_CHARS`.
+ * - One level of `cause` is unwrapped, because `TypeError: fetch failed` on
+ *   its own names nothing and its cause is the whole answer.
+ */
+export function describeError(error) {
+    if (!(error instanceof Error)) {
+        // `null` and `undefined` are fully described by their name; repeating them
+        // as a detail says nothing twice.
+        const named = error === null || error === undefined;
+        return {
+            error_name: error === null ? "null" : typeof error,
+            ...(named ? {} : detailField(safeString(error))),
+        };
+    }
+    const fields = {
+        error_name: error.name || "Error",
+        ...codeField(error),
+        ...syscallField(error),
+        ...messageField(error),
+    };
+    const cause = error.cause;
+    if (cause instanceof Error) {
+        const causeFields = describeError(cause);
+        if (causeFields.error_name)
+            fields.cause_name = causeFields.error_name;
+        if (causeFields.error_code)
+            fields.cause_code = causeFields.error_code;
+        if (causeFields.error_detail)
+            fields.cause_detail = causeFields.error_detail;
+    }
+    return fields;
+}
+/**
+ * Is this the ordinary "there is nothing there yet" failure?
+ *
+ * Nearly every collector read has a legitimate empty state — no cursor before
+ * the first sync, no config before onboarding, no session before login — and
+ * logging that on every 15-minute tick would bury the failures that matter.
+ * A read that fails for any OTHER reason is the interesting one: a corrupt
+ * cursor and a permission-denied config both read as "first run" today, and
+ * that is the exact shape of BLI-2528.
+ */
+export function isMissingFileFailure(error) {
+    const code = errorCode(error);
+    return code === "ENOENT" || code === "ENOTDIR";
+}
+function codeField(error) {
+    const code = errorCode(error);
+    return code ? { error_code: code } : {};
+}
+function errorCode(error) {
+    if (!error || typeof error !== "object")
+        return undefined;
+    const code = error.code;
+    if (typeof code === "string" && code)
+        return code;
+    if (typeof code === "number")
+        return String(code);
+    return undefined;
+}
+function syscallField(error) {
+    const syscall = error.syscall;
+    return typeof syscall === "string" && syscall ? { error_syscall: syscall } : {};
+}
+/**
+ * The message, or nothing at all when the code and syscall already carry the
+ * whole meaning. Dropping it is not lost information: it is a path.
+ */
+function messageField(error) {
+    const syscall = error.syscall;
+    if (errorCode(error) && typeof syscall === "string" && syscall)
+        return {};
+    return detailField(error.message);
+}
+function detailField(message) {
+    const detail = redactedHealthDetail(message);
+    return detail ? { error_detail: detail } : {};
+}
+/** `String(value)` can itself throw on an exotic object; a describer must not. */
+function safeString(value) {
+    try {
+        return String(value);
+    }
+    catch {
+        // Deliberately silent, and the only silence in this module that cannot be
+        // reported: the failure happened inside the reporter.
+        return "";
+    }
 }

package/dist/local-state.js

@@ -9,6 +9,7 @@ import { isSamePath, normalizeCollectionRoots, } from "./root-normalization.js";
 import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
 import { summarizeInstallEventOutbox } from "./spool/install-event-outbox.js";
 import { readRawEvidenceStagingState, summarizeStuckEvidence, } from "./raw-evidence-staging.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
     ? localCollectorPackage.version
@@ -115,7 +116,16 @@ export async function pairLocalCollector(options = {}) {
     const homeDir = options.homeDir ?? os.homedir();
     const paths = getCollectorRuntimePaths(homeDir);
     await ensureRuntimeDirectories(paths);
-    const config = await readLocalCollectorConfig(paths).catch(() => {
+    const config = await readLocalCollectorConfig(paths).catch((error) => {
+        // "Local config missing" is correct when it is absent. A config that
+        // exists and will not parse gets the same sentence and the same useless
+        // advice — run onboard again, which will not fix it (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[local-state] collector config present but unreadable, reporting it as missing", JSON.stringify({
+                reason: "config_unreadable",
+                ...describeError(error),
+            }));
+        }
         throw new Error("Local config missing. Run `cockpit onboard` (or `cockpit install`) first, then retry `cockpit login`.");
     });
     const dashboardUrl = normalizeDashboardUrl(options.dashboardUrl ?? config.dashboard_url);
@@ -454,7 +464,18 @@ export async function readLocalSessionReference(paths, fallback = {}) {
         }
         return LocalUserSessionReferenceSchema.parse(rawSession);
     }
-    catch {
+    catch (error) {
+        // `session_state: "missing"` is correct before login and says so loudly
+        // enough on its own. It is also what a session file that EXISTS but is
+        // corrupt, truncated or unreadable collapses to — a paired machine that
+        // silently reads as never-signed-in, which is indistinguishable in every
+        // downstream receipt (BLI-3238).
+        if (!isMissingFileFailure(error)) {
+            console.error("[local-state] session file present but unusable, reading as missing", JSON.stringify({
+                reason: "session_file_unusable",
+                ...describeError(error),
+            }));
+        }
         return LocalUserSessionReferenceSchema.parse({
             operator_id: fallback.operatorId ?? "unknown",
             auth_subject_id: "unknown",
@@ -480,7 +501,17 @@ export async function resolveGitBranch(repoRoot) {
         }
         return head ? `detached:${head.slice(0, 12)}` : "unknown";
     }
-    catch {
+    catch (error) {
+        // A folder that is not a git repo is a legitimate workspace under the
+        // session-first commandment, so a missing `.git` stays quiet. A `.git`
+        // that exists and cannot be read is a different thing: every session
+        // collected from this repo gets branch `unknown` and nothing says why.
+        if (!isMissingFileFailure(error)) {
+            console.error("[local-state] could not read HEAD, branch recorded as unknown", JSON.stringify({
+                reason: "git_head_unreadable",
+                ...describeError(error),
+            }));
+        }
         return "unknown";
     }
 }
@@ -499,13 +530,30 @@ async function ensureRuntimeDirectories(paths) {
     await fs.mkdir(paths.cursors_dir, { recursive: true, mode: 0o700 });
     await fs.mkdir(paths.work_contexts_dir, { recursive: true, mode: 0o700 });
     if (process.platform !== "win32") {
-        await Promise.all([
-            fs.chmod(paths.config_dir, 0o700).catch(() => undefined),
-            fs.chmod(paths.state_dir, 0o700).catch(() => undefined),
-            fs.chmod(paths.spool_dir, 0o700).catch(() => undefined),
-            fs.chmod(paths.cursors_dir, 0o700).catch(() => undefined),
-            fs.chmod(paths.work_contexts_dir, 0o700).catch(() => undefined),
-        ]);
+        // The `mode` above only applies to directories this call CREATES, so these
+        // chmods are what actually tightens a directory that already existed with
+        // looser bits. Failing means the operator's device token and cursors stay
+        // world-readable — non-fatal, deliberately, but not something to find out
+        // about never (BLI-3238). Reported by directory name only, never a path.
+        const tightened = [
+            ["config_dir", fs.chmod(paths.config_dir, 0o700)],
+            ["state_dir", fs.chmod(paths.state_dir, 0o700)],
+            ["spool_dir", fs.chmod(paths.spool_dir, 0o700)],
+            ["cursors_dir", fs.chmod(paths.cursors_dir, 0o700)],
+            ["work_contexts_dir", fs.chmod(paths.work_contexts_dir, 0o700)],
+        ];
+        await Promise.all(tightened.map(async ([name, work]) => {
+            try {
+                await work;
+            }
+            catch (error) {
+                console.error("[local-state] could not restrict a runtime directory to owner-only", JSON.stringify({
+                    reason: "runtime_dir_chmod_failed",
+                    directory: name,
+                    ...describeError(error),
+                }));
+            }
+        }));
     }
 }
 function workContextFile(paths, worktreeFingerprint) {
@@ -545,8 +593,38 @@ function stableWorkContextId(input) {
 function sha256(value) {
     return crypto.createHash("sha256").update(value, "utf8").digest("hex");
 }
+/**
+ * The one reader behind the config file, the session file and every work
+ * context — and therefore the one place worth reporting from.
+ *
+ * Roughly twenty call sites swallow this to `null` or a default with
+ * `.catch(() => null)`, each of them asking a reasonable question ("is this
+ * machine set up?") to which "no" is a legitimate answer. What none of them
+ * could distinguish is "no, nothing is there" from "yes, and it is corrupt or
+ * unreadable" — so the distinction is drawn HERE, once, rather than in twenty
+ * places where it would be twenty chances to forget (BLI-3238).
+ *
+ * The error still propagates unchanged; callers keep whatever they decided.
+ */
 async function readJsonFile(filePath) {
-    return JSON.parse(await fs.readFile(filePath, "utf8"));
+    try {
+        return JSON.parse(await fs.readFile(filePath, "utf8"));
+    }
+    catch (error) {
+        // Absent is the ordinary pre-onboarding state on every one of these files
+        // and stays quiet; anything else means state exists and cannot be used.
+        if (!isMissingFileFailure(error)) {
+            console.error("[local-state] a collector state file exists but could not be read", JSON.stringify({
+                reason: "state_file_unreadable",
+                // Which file, without the path: the basename of these is a fixed
+                // vocabulary (`config.json`, `session.json`, a work-context
+                // fingerprint) and carries no repo or operator name.
+                state_file: path.basename(filePath),
+                ...describeError(error),
+            }));
+        }
+        throw error;
+    }
 }
 async function writeJsonFile(filePath, value) {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
@@ -643,6 +721,15 @@ async function readResponseJson(response) {
         return JSON.parse(text);
     }
     catch {
+        // Pairing path. A captive portal or a proxy answering with HTML is the
+        // classic reason `cockpit login` fails on a new machine and the operator
+        // sees only "pair request failed". The body is never logged; its shape is.
+        console.error("[local-state] pairing reply was not JSON", JSON.stringify({
+            reason: "response_body_not_json",
+            http_status: response.status,
+            byte_size: text.length,
+            content_type: response.headers.get("content-type") ?? "none",
+        }));
         return { message: text };
     }
 }

package/dist/onboarding-roots.js

@@ -294,6 +294,9 @@ function canonicalPath(input, pathApi = path, realpath = realpathSync) {
         return pathApi.resolve(realpath(resolved));
     }
     catch {
+        // Deliberately silent (BLI-3238), per the comment above: a path that does
+        // not exist yet is the ordinary input here, and the lexical resolve is the
+        // documented behavior for it, not a fallback after a failure.
         return resolved;
     }
 }

package/dist/raw-evidence-attribution-policy.js

@@ -3,6 +3,13 @@
  * fallback that produced a worktree identity. Session-first terminal labels
  * are uploadable only when attribution attached an approved-root synthetic
  * workspace; the label stays terminal and no repository provenance is invented.
+ *
+ * A `false` answer is a decision, and every caller that builds a session row
+ * MUST record it as one — `upload_state: "not_uploaded"` plus
+ * `notUploadableAttributionStateReason(<attribution reason>)` from
+ * `@bli-cockpit/telemetry-core`. Spreading `{}` on this branch is what put 1,256
+ * production sessions in `ambient_codex_sessions` with a NULL upload_state and a
+ * NULL upload_reason (BLI-3272): withheld, and silent about it.
  */
 export function isRawEvidenceUploadableAttributionState(state, hasApprovedWorkspace = false) {
     return (state === "attributed" ||

package/dist/raw-evidence-gc.js

@@ -227,6 +227,11 @@ async function packContentFingerprint(dir) {
             .digest("hex");
     }
     catch {
+        // Deliberately silent (BLI-3238) — and it is the one silence here that is
+        // already reported. `null` means "not fingerprintable", the dedup sweep
+        // counts every one of them as `unfingerprintable_dirs`, and that count is
+        // logged on EVERY sweep including the clean one. A line per pack would
+        // add nothing the sweep does not already say.
         return null;
     }
 }

package/dist/raw-evidence-staging.js

@@ -2,6 +2,7 @@ import { DELIVERY_BACKOFF_HOLDING } from "@bli-cockpit/telemetry-core";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
 /**
  * Durable local state for raw-evidence STAGING and DELIVERY ATTEMPTS.
  *
@@ -67,7 +68,17 @@ export async function readRawEvidenceStagingState(stateDir) {
         const raw = JSON.parse(await fs.readFile(rawEvidenceStagingStatePath(stateDir), "utf8"));
         return parseStagingState(raw);
     }
-    catch {
+    catch (error) {
+        // Empty is right before the first staged pack. Unreadable is not: this
+        // file carries the delivery-attempt history, so losing it silently resets
+        // every backoff window and re-offers objects the server already refused
+        // (BLI-3066 is what that costs; BLI-3238 is why it now says so).
+        if (!isMissingFileFailure(error)) {
+            console.error("[raw-evidence-staging] staging state unreadable, delivery history reset", JSON.stringify({
+                reason: "staging_state_unreadable",
+                ...describeError(error),
+            }));
+        }
         return emptyRawEvidenceStagingState();
     }
 }

package/dist/repo-identity.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { containsPath, isCodexWorktreePath } from "./root-normalization.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
 const execFileAsync = promisify(execFile);
 const SKIPPED_DIR_NAMES = new Set([
     ".cache",
@@ -352,7 +353,16 @@ async function resolveBranchFromHead(repoRoot) {
         }
         return head ? `detached:${head.slice(0, 12)}` : "unknown";
     }
-    catch {
+    catch (error) {
+        // Not a repo → quiet, that is an ordinary approved folder. A `.git` that
+        // exists and will not read → every session from this worktree is labelled
+        // branch `unknown` and, until BLI-3238, nothing said why.
+        if (!isMissingFileFailure(error)) {
+            console.error("[repo-identity] could not read HEAD, branch recorded as unknown", JSON.stringify({
+                reason: "git_head_unreadable",
+                ...describeError(error),
+            }));
+        }
         return "unknown";
     }
 }
@@ -377,6 +387,10 @@ export function normalizeGitOrigin(rawOrigin) {
         return normalizeOriginParts(url.hostname, url.pathname);
     }
     catch {
+        // Deliberately silent (BLI-3238). `new URL` is being used as the test for
+        // "is this origin URL-shaped?", and a plain path or an unusual remote form
+        // failing to parse IS the answer — the fallback below is the intended
+        // normalization for exactly that case, not a degradation.
         return trimmed
             .replace(/\.git$/i, "")
             .replace(/^\/+|\/+$/g, "")

package/dist/scheduled-self-update.js

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { describeError } from "./health-detail.js";
 const SELF_UPDATE_MIN_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export const SELF_UPDATE_THROTTLE_MARKER = ".last-self-update-check";
 /**
@@ -179,7 +180,16 @@ async function probeInstalledCliVersion(exec) {
         const version = parsed.dependencies?.["@bli-cockpit/cli"]?.version;
         return typeof version === "string" && version.trim() ? version.trim() : null;
     }
-    catch {
+    catch (error) {
+        // `null` means "installed version unknown", which suppresses the whole
+        // self-update decision including the BLI-2678 forced-version floor. A
+        // fleet stuck on an old CLI because `npm ls` started printing something
+        // unparseable would look exactly like a fleet that is up to date.
+        console.error("[self-update] could not read the installed CLI version from npm ls", JSON.stringify({
+            reason: "installed_version_unreadable",
+            byte_size: result.stdout.length,
+            ...describeError(error),
+        }));
         return null;
     }
 }
@@ -197,6 +207,9 @@ function parseNpmVersionField(stdout) {
         return typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
     }
     catch {
+        // Deliberately silent (BLI-3238), same as doctor.ts's copy: the parse is
+        // the test for whether this npm quoted its output, and the unquoted
+        // fallback is the intended handling of the other form.
         return trimmed.replace(/^"|"$/gu, "") || null;
     }
 }

package/dist/spool/install-event-outbox.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { describeError } from "../health-detail.js";
 const OUTBOX_DIRECTORY = "install-events";
 const MAX_PENDING_ENTRIES = 100;
 const MAX_EVENTS_PER_ENTRY = 40;
@@ -44,12 +45,21 @@ export async function readPendingInstallEventEntries(paths) {
         try {
             const parsed = parseEntry(JSON.parse(await fs.readFile(filePath, "utf8")));
             if (!parsed) {
+                console.error("[install-outbox] discarding an entry that does not match the schema", JSON.stringify({ reason: "outbox_entry_invalid" }));
                 await fs.rm(filePath, { force: true });
                 continue;
             }
             entries.push(parsed);
         }
-        catch {
+        catch (error) {
+            // This branch DELETES a queued receipt. Whatever the reason — truncated
+            // write, bad JSON, no read permission — the machine loses a health event
+            // it was holding for the server, so it says which reason it was before
+            // dropping it (BLI-3238).
+            console.error("[install-outbox] discarding an unreadable entry", JSON.stringify({
+                reason: "outbox_entry_unreadable",
+                ...describeError(error),
+            }));
             await fs.rm(filePath, { force: true }).catch(() => undefined);
         }
     }

package/dist/spool/local-spool.js

@@ -416,6 +416,9 @@ async function fsyncDirectoryBestEffort(directoryPath) {
     catch {
         // Directory fsync is not supported by every host/filesystem (notably some
         // Windows versions). The file itself was fsynced before the atomic rename.
+        // Deliberately silent (BLI-3238): on those hosts this fails on every
+        // single write, so a line here would be pure noise on exactly the
+        // platform the collector most needs readable logs on.
     }
     finally {
         await handle?.close().catch(() => undefined);

package/dist/sync-lock.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { describeError } from "./health-detail.js";
 /**
  * Single-flight lock for `cockpit sync`. A launchd timer and a manual sync can
  * fire at the same time and interleave the cursor read-modify-write; this lock
@@ -71,10 +72,27 @@ async function tryExclusiveCreate(lockPath, token, now) {
         await handle.close();
         return true;
     }
-    catch {
+    catch (error) {
+        // EEXIST is the whole point of `wx`: another sync holds the lock, and the
+        // caller reports `sync_already_running`. Any OTHER code — no permission on
+        // the cursors directory, a full disk, a read-only volume — produces the
+        // identical false answer, and every sync on the machine then exits saying
+        // another one is running while none ever is (BLI-3238).
+        if (!isLockHeldError(error)) {
+            console.error("[sync-lock] could not create the lock file; reporting the lock as held", JSON.stringify({
+                reason: "sync_lock_create_failed",
+                ...describeError(error),
+            }));
+        }
         return false;
     }
 }
+/** `wx` refusing because the lock exists — the ordinary contended case. */
+function isLockHeldError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        error.code === "EEXIST");
+}
 async function writeLock(lockPath, token, now) {
     await fs.writeFile(lockPath, serializeLock(token, now), { mode: 0o600 });
 }
@@ -108,6 +126,11 @@ async function readLock(lockPath) {
         };
     }
     catch {
+        // Deliberately silent (BLI-3238). This read is the "is anyone holding it?"
+        // probe: no lock file, a half-written one, a lock being removed underneath
+        // us — every one of those means "not held", which is the answer the caller
+        // wants and acts on correctly. Failure IS the result here. The failing
+        // ACQUIRE above is the branch that owns the reporting.
         return null;
     }
 }