@bli-cockpit/cli 0.2.4 → 0.2.7

package/dist/commands/local.js

@@ -1,10 +1,10 @@
-import { execFile, spawn } from "node:child_process";
-import { access, readdir, readFile, stat } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { readdir, readFile, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { createCollectorServer } from "../server.js";
 import { inspectAgentRules, installAgentRules, uninstallAgentRules, } from "../agent-rules.js";
-import { runBackfillCommand } from "./backfill.js";
+import { backfillRetryCommand, runBackfill, runBackfillCommand, } from "./backfill.js";
 import { runDoctor } from "./doctor.js";
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { parseLocalArgs, normalizeUrl } from "./local-args.js";
@@ -12,12 +12,15 @@ import { autostartStatus, installAutostartAgent, uninstallAutostartAgent, } from
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, inspectLocalCollectorStatus, installLocalCollector, logoutLocalCollector, pairLocalCollector, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, startLocalWorkContext, } from "../local-state.js";
 import { CODEX_ATTRIBUTION_SCAN_WINDOW_SESSION_LIMIT, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, defaultCodexSessionDirs, scanAndAttributeCodexSessions, } from "../adapters/codex-attribution.js";
 import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
-import { backfillCompletionMarkerPath, readBackfillCursor, } from "../cursors/backfill-cursor.js";
+import { backfillCompletionCovers, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCompletionMarker, readBackfillCursor, } from "../cursors/backfill-cursor.js";
 import { acquireSyncLock } from "../sync-lock.js";
-import { discoverGitWorktrees } from "../repo-identity.js";
-import { runAttributedWorktreeSync, } from "./session-sync.js";
+import { collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
+import { runAttributedWorktreeSync, matchesLiveSyncWorktree, } from "./session-sync.js";
 import { COLLECTION_ROOT_REQUIRED, missingCollectionRootMessage, normalizeRootsDetailed, resolveOnboardingRoots, rootRejectionExplanation, } from "../onboarding-roots.js";
 import { rawEvidenceGcSummary, runRawEvidenceLocalGc, } from "../raw-evidence-gc.js";
+import { enqueueInstallEventEntry, readPendingInstallEventEntries, recordInstallEventAttemptFailure, removeInstallEventEntry, } from "../spool/install-event-outbox.js";
+import { createCapturedExecRunner, createInteractiveExecRunner, } from "../process-runner.js";
+import { normalizeCollectionRoots } from "../root-normalization.js";
 export const rootCommandNames = new Set([
     "onboard",
     "update",
@@ -107,7 +110,7 @@ export function localCommandHelp(command) {
         "  cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--branch <name>] [--no-auth] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--no-auth] [--json]",
         "  cockpit upgrade [same flags as update]",
-        "  cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--dry-run] [--json]",
+        "  cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--update-tag <tag>] [--dry-run] [--json]",
         "  cockpit fix [same flags as do-everything]",
         "  cockpit install [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--json]",
         "  cockpit login [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--no-auth] [--json]",
@@ -116,7 +119,7 @@ export function localCommandHelp(command) {
         "  cockpit start [--ticket <id>|--clear-ticket] [--topic <label>] [--intent <intent>] [--phase <phase>] [--workspace <path>] [--branch <name>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sync [--workspace <path>] [--dashboard-url <url>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit analyze [--workspace <path>] [--dashboard-url <url>] [--max-depth <n>] [--max-repos <n>] [--json]",
-        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--yes] [--workspace <path>] [--json]",
+        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit serve [--port <port>] [--workspace <path>]",
@@ -132,9 +135,10 @@ function localSubcommandHelp(command) {
         [
             "onboard",
             [
-                "Usage: cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--branch <name>] [--no-auth] [--json]",
+                "Usage: cockpit onboard [--ticket <id>] [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--branch <name>] [--no-auth] [--max-depth <n>] [--max-repos <n>] [--json]",
                 "",
-                "Installs, pairs, starts work context(s), syncs once, and prints readiness proof.",
+                "Installs, pairs, starts work context(s), syncs once, completes all-history",
+                "Codex and Claude backfill for the saved roots, and then prints readiness proof.",
                 "If --workspace is a parent folder, scans child git repos/worktrees and rolls them up by repo.",
                 "`--repo <path>` remains supported as a backward-compatible alias.",
                 `Omit --dashboard-url for normal production setup (${DEFAULT_DASHBOARD_URL}).`,
@@ -159,8 +163,8 @@ function localSubcommandHelp(command) {
                 "Usage: cockpit update [--email <owner@email>] [--device-name <name>] [--dashboard-url <url>] [--workspace <path>] [--allow-home-root] [--no-auth] [--json]",
                 "",
                 "Updates the global public CLI from npm, then reruns `cockpit onboard`",
-                "with the same setup flags so pairing, saved roots, agent rules,",
-                "autostart, and the initial sync are refreshed in one command.",
+                "with the same setup flags so pairing, saved roots, all-history backfill,",
+                "agent rules, autostart, and the initial sync are refreshed in one command.",
                 "`cockpit upgrade` is an alias.",
             ],
         ],
@@ -175,10 +179,11 @@ function localSubcommandHelp(command) {
         [
             "do-everything",
             [
-                "Usage: cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--dry-run] [--json]",
+                "Usage: cockpit do-everything [--workspace <path>] [--dashboard-url <url>] [--update-tag <tag>] [--dry-run] [--json]",
                 "",
-                "Converges an already-onboarded intern machine: latest CLI, auth, saved roots, autostart, backfill, raw-evidence GC, and sync freshness.",
+                "Converges a blank, existing, or reused intern machine: latest CLI, interactive auth and collection-root recovery when needed, saved roots, autostart, all-history backfill, raw-evidence GC, and sync freshness.",
                 "`cockpit fix` is an alias.",
+                "Maintainer canary: use `--update-tag next` so self-update and re-exec stay on the prerelease candidate.",
                 "--dry-run prints the checks and would-fix steps without writing config, plists, cursors, or install telemetry.",
             ],
         ],
@@ -254,12 +259,14 @@ function localSubcommandHelp(command) {
         [
             "backfill",
             [
-                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--yes] [--workspace <path>] [--json]",
+                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
                 "",
                 "Backfills historical Codex and Claude Code session evidence using the saved collection roots from local config when --workspace is omitted.",
                 "Omit --source to scan both sources; there is no --source all literal.",
                 "The non-all window is capped at the collector session paired_at timestamp.",
                 "--all requires a dry-run review and TTY confirmation; pass --yes for headless agent runs.",
+                "Repo discovery scans 3 folder levels and up to 50 repos by default.",
+                "Raise --max-depth or --max-repos when a partial result reports a discovery cap.",
                 "--dry-run validates the paired collector and dashboard reachability, prints the same summary tables, and writes nothing.",
             ],
         ],
@@ -299,12 +306,15 @@ function localSubcommandHelp(command) {
             [
                 "Usage: cockpit autostart [install|uninstall|status] [--workspace <path>] [--dashboard-url <url>] [--interval-seconds <n>] [--json]",
                 "",
-                "Installs a macOS launchd LaunchAgent that runs `cockpit sync` at login and",
-                "every 15 min (default), surviving reboots — so machines never drift to Stale.",
+                "Installs background sync through launchd on Apple Silicon macOS or a",
+                "per-user Task Scheduler task on native Windows.",
+                "Runs `cockpit sync` every 15 min by default and survives reboots;",
+                "the Windows task runs while the user is signed in.",
                 "Action defaults to `install`. `--workspace` is the parent work folder to sync.",
                 "`--repo <path>` remains supported as a backward-compatible alias.",
                 "Omit --dashboard-url for production; pass it only for staging/custom dashboards.",
-                "macOS-only for now; see docs/runbooks/cockpit-launchd-sync.md.",
+                "See docs/runbooks/cockpit-launchd-sync.md and",
+                "docs/runbooks/cockpit-windows-task-scheduler-sync.md.",
             ],
         ],
         [
@@ -417,7 +427,7 @@ async function runUpdate(command, io) {
             writeLine(io.stdout, JSON.stringify({
                 status: "blocked",
                 step: "npm_install",
-                command: `npm ${SELF_UPDATE_INSTALL_ARGS.join(" ")}`,
+                command: `npm ${selfUpdateInstallArgs().join(" ")}`,
                 exit_code: error.result.code,
             }, null, 2));
         }
@@ -442,12 +452,6 @@ async function runUpdate(command, io) {
     addInstallEvent(installEvents, "onboard_rerun", onboard.code === 0 ? "ok" : "fail", onboard.code === 0 ? undefined : updateOnboardFailureCode(onboard));
     return finish(onboard.code);
 }
-const SELF_UPDATE_INSTALL_ARGS = [
-    "install",
-    "-g",
-    "@bli-cockpit/cli@latest",
-    "--prefer-online",
-];
 export class SelfUpdateError extends Error {
     result;
     eacces;
@@ -460,16 +464,25 @@ export class SelfUpdateError extends Error {
 }
 export async function runSelfUpdate(io, options = {}) {
     const exec = io.exec ?? defaultExec();
+    const tag = options.tag ?? "latest";
     if (!options.json) {
-        writeLine(io.stdout, "Updating Cockpit CLI from npm...");
+        writeLine(io.stdout, `Updating Cockpit CLI from npm (${tag})...`);
     }
-    const install = await exec("npm", [...SELF_UPDATE_INSTALL_ARGS]);
+    const install = await exec("npm", selfUpdateInstallArgs(tag));
     writeExecOutput(io, install, { stdout: !options.json, stderr: true });
     if (install.code !== 0) {
         throw new SelfUpdateError(install);
     }
     return { updated: true, version: LOCAL_COLLECTOR_VERSION };
 }
+function selfUpdateInstallArgs(tag = "latest") {
+    return [
+        "install",
+        "-g",
+        `@bli-cockpit/cli@${tag}`,
+        "--prefer-online",
+    ];
+}
 async function runRelease(command, io) {
     const releaseRoot = await findPublicReleaseRoot(process.cwd());
     if (!releaseRoot) {
@@ -643,6 +656,17 @@ function addAutostartInstallEvent(events, result) {
     }
     addInstallEvent(events, "autostart", result.loaded === false ? "fail" : "ok", result.loaded === false ? "autostart_load_failed" : undefined);
 }
+function onboardAutostartFailed(result) {
+    return (result !== null &&
+        result.status !== "unsupported" &&
+        result.loaded === false);
+}
+function writeOnboardAutostartBlocker(io, result) {
+    writeLine(io.stderr, "BLOCKED: initial collection succeeded, but recurring background collection is not running.");
+    if (result?.message)
+        writeLine(io.stderr, `Failure: ${result.message}`);
+    writeLine(io.stderr, "Next: run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.");
+}
 function onboardFailureStep(blocker, events) {
     if (blocker === COLLECTION_ROOT_REQUIRED)
         return "install";
@@ -671,6 +695,28 @@ export async function reportInstallEventsBestEffort(options) {
     if (options.events.length === 0)
         return;
     const paths = getCollectorRuntimePaths(options.homeDir);
+    try {
+        await enqueueInstallEventEntry(paths, {
+            dashboardUrl: options.dashboardUrl,
+            cliVersion: LOCAL_COLLECTOR_VERSION,
+            command: options.command,
+            osPlatform: os.platform(),
+            events: options.events.map((event) => ({
+                step: event.step.trim().slice(0, 120),
+                status: event.status,
+                ...(event.error_code
+                    ? { error_code: sanitizeInstallErrorCode(event.error_code) }
+                    : {}),
+                ...(event.at ? { at: event.at } : {}),
+            })),
+        });
+    }
+    catch {
+        if (options.json) {
+            writeLine(options.io.stderr, "Install event outbox unavailable: local_write_failed");
+        }
+        return;
+    }
     const session = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!session ||
         session.session_state !== "valid" ||
@@ -678,34 +724,47 @@ export async function reportInstallEventsBestEffort(options) {
         !session.device_token) {
         return;
     }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5_000);
-    try {
-        const response = await options.io.fetch(`${options.dashboardUrl}/api/ambient/install-events`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${session.device_token}`,
-            },
-            body: JSON.stringify({
-                cli_version: LOCAL_COLLECTOR_VERSION,
-                command: options.command,
-                os_platform: os.platform(),
-                events: options.events.slice(0, 40),
-            }),
-            signal: controller.signal,
-        });
-        if (!response.ok) {
-            throw new Error(`http_${response.status}`);
-        }
-    }
-    catch (error) {
-        if (options.json) {
-            writeLine(options.io.stderr, `Install event telemetry skipped: ${classifyInstallTelemetryError(error)}`);
-        }
+    const pending = (await readPendingInstallEventEntries(paths)).slice(0, 20);
+    const failures = [];
+    for (let offset = 0; offset < pending.length; offset += 5) {
+        await Promise.all(pending.slice(offset, offset + 5).map(async (entry) => {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5_000);
+            try {
+                const response = await options.io.fetch(`${entry.dashboard_url}/api/ambient/install-events`, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${session.device_token}`,
+                    },
+                    body: JSON.stringify({
+                        cli_version: entry.cli_version,
+                        command: entry.command,
+                        os_platform: entry.os_platform,
+                        events: entry.events,
+                    }),
+                    signal: controller.signal,
+                });
+                if (!response.ok) {
+                    throw new Error(`http_${response.status}`);
+                }
+                await removeInstallEventEntry(paths, entry.outbox_id);
+            }
+            catch (error) {
+                const failureReason = classifyInstallTelemetryError(error);
+                failures.push(failureReason);
+                await recordInstallEventAttemptFailure(paths, entry, {
+                    attemptedAt: new Date().toISOString(),
+                    failureReason,
+                }).catch(() => undefined);
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        }));
     }
-    finally {
-        clearTimeout(timeout);
+    if (options.json && failures.length > 0) {
+        writeLine(options.io.stderr, `Install event telemetry queued for retry: ${[...new Set(failures)].join(",")}`);
     }
 }
 function classifyInstallTelemetryError(error) {
@@ -987,11 +1046,7 @@ async function readGitConfigEmail(root) {
         });
     });
 }
-/**
- * After a successful onboard, refreshes the launchd autostart agent so intern
- * machines keep syncing without anyone re-running Cockpit. Runtimes without an
- * exec runner skip this because launchd installation cannot be attempted there.
- */
+/** Refreshes the host autostart backend after successful onboarding. */
 async function refreshOnboardAutostart(command, roots, io) {
     if (!io.exec)
         return null;
@@ -1010,8 +1065,8 @@ async function refreshOnboardAutostart(command, roots, io) {
     }
     writeLine(io.stdout, result.loaded
         ? "Background autostart refreshed; Cockpit syncs at login and every 15 min."
-        : "Background autostart refreshed, but launchctl load reported a problem; check `cockpit autostart status`.");
-    writeLine(io.stdout, `Plist: ${result.plist_path}`);
+        : "Background autostart refreshed, but the operating-system scheduler reported a problem; check `cockpit autostart status`.");
+    writeLine(io.stdout, autostartLocationLine(result));
     return result;
 }
 async function refreshOnboardAgentRules(command, roots, io) {
@@ -1052,21 +1107,66 @@ function writeOnboardLiveStatus(io, command, roots, options) {
         (options.status?.session_state === "valid" ? "existing valid session" : "pending")}`);
     writeLine(io.stdout, `Background sync: ${backgroundSyncLine(options.autostart)}`);
     writeLine(io.stdout, `Initial sync: ${options.initialSyncOk ? options.sync?.status ?? "uploaded" : "blocked"}`);
+    writeLine(io.stdout, `Historical backfill: complete (${options.backfill.counts.backfilled} uploaded, ${options.backfill.counts.skipped} explicit skip(s))`);
     writeLine(io.stdout, `Agent rules: ${options.agentRules ? onboardAgentRulesInstallLine(options.agentRules) : "not refreshed"}`);
     writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}/my-work`);
-    if (options.backfillHint)
-        writeLine(io.stdout, options.backfillHint);
     writeLine(io.stdout, "Next: cockpit status");
 }
+function requiredOnboardBackfillCommand(command) {
+    return {
+        homeDir: command.homeDir,
+        all: true,
+        dryRun: false,
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        yes: true,
+        json: true,
+    };
+}
+async function runRequiredOnboardBackfill(command, io) {
+    const backfillCommand = requiredOnboardBackfillCommand(command);
+    const retryCommand = backfillRetryCommand(backfillCommand);
+    try {
+        const result = await runBackfill(backfillCommand, io);
+        return {
+            status: result.status,
+            failureReason: result.status === "complete"
+                ? null
+                : result.failure_reason ?? `backfill_${result.status}`,
+            retryCommand: result.retry_command,
+            result,
+        };
+    }
+    catch (error) {
+        return {
+            status: "failed",
+            failureReason: errorMessage(error),
+            retryCommand,
+            result: null,
+        };
+    }
+}
+function onboardBackfillPayload(outcome) {
+    return (outcome.result ?? {
+        status: "blocked",
+        failure_reason: outcome.failureReason,
+        retry_command: outcome.retryCommand,
+    });
+}
+function writeOnboardBackfillBlocker(io, outcome) {
+    writeLine(io.stderr, "BLOCKED: all-history Codex and Claude backfill is incomplete for the approved collection roots.");
+    writeLine(io.stderr, `Failure: ${outcome.failureReason ?? `backfill_${outcome.status}`}`);
+    writeLine(io.stderr, `Retry: ${outcome.retryCommand}`);
+}
 function backgroundSyncLine(result) {
     if (!result)
-        return "not refreshed (launchd runner unavailable)";
+        return "not refreshed (autostart runner unavailable)";
     if (result.status === "unsupported")
         return `unsupported (${result.message})`;
     if (result.status === "installed" && result.loaded)
         return "installed";
     if (result.status === "installed") {
-        return `installed with warning (${result.message ?? "launchctl load failed"})`;
+        return `installed with warning (${result.message ?? "operating-system scheduler load failed"})`;
     }
     return result.status;
 }
@@ -1148,18 +1248,17 @@ async function runOnboard(command, io) {
     let rootsResult = null;
     let agentRules = null;
     let autostart = null;
-    let backfillHint = null;
     try {
         if (!command.json) {
             writeLine(io.stdout, "Cockpit harvest onboarding");
             writeLine(io.stdout, `Dashboard: ${command.dashboardUrl}`);
             writeLine(io.stdout, `Ticket: ${command.activeTicketId ?? "general ambient"}`);
         }
-        backfillHint = await onboardBackfillHint(command.homeDir);
         const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
         const existingConfig = resolvedRoots.existingConfig;
         rootsResult = resolvedRoots.rootsResult;
         const collectionRoots = rootsResult.roots;
+        const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
         const primaryRoot = resolvedRoots.primaryRoot;
         const resolvedCommand = {
             ...command,
@@ -1227,31 +1326,81 @@ async function runOnboard(command, io) {
                 writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
             }
         }
-        const worktrees = await discoverCommandWorktrees(collectionRoots, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+        const worktrees = await discoverCommandWorktrees(collectionRoots, {
+            maxDepth: command.maxDepth,
+            maxRepos: command.maxRepos,
+            allowEmpty: true,
+        }, io);
         if (worktrees.length > 1) {
             const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
             addInstallEvent(installEvents, "work_context", "ok");
             addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
-            if (multi.ok) {
-                agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
-                addInstallEvent(installEvents, "agent_rules", "ok");
-                autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
-                addAutostartInstallEvent(installEvents, autostart);
+            if (!multi.ok) {
+                if (command.json) {
+                    writeLine(io.stdout, JSON.stringify({
+                        ...onboardResult("blocked", resolvedCommand, install, pair, null, null),
+                        collection_roots: collectionRoots,
+                        root_resolution: rootsResult,
+                        mode: "multi_repo",
+                        repos: multi.results,
+                        codex_sessions: multi.codex_sessions,
+                        blocker: "sync_blocked",
+                        next_step: "Run `cockpit sync --json` until every root returns an uploaded receipt.",
+                    }, null, 2));
+                }
+                return finish(1);
             }
+            const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+            const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+            addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+                ? undefined
+                : backfill.failureReason ?? "backfill_incomplete");
+            if (!completedBackfill) {
+                if (command.json) {
+                    writeLine(io.stdout, JSON.stringify({
+                        ...onboardResult("blocked", resolvedCommand, install, pair, null, null),
+                        collection_roots: collectionRoots,
+                        root_resolution: rootsResult,
+                        mode: "multi_repo",
+                        repos: multi.results,
+                        codex_sessions: multi.codex_sessions,
+                        backfill: onboardBackfillPayload(backfill),
+                        blocker: "backfill_incomplete",
+                        backfill_failure_reason: backfill.failureReason,
+                        next_step: backfill.retryCommand,
+                    }, null, 2));
+                }
+                else {
+                    writeOnboardBackfillBlocker(io, backfill);
+                }
+                return finish(1);
+            }
+            agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
+            addInstallEvent(installEvents, "agent_rules", "ok");
+            autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
+            addAutostartInstallEvent(installEvents, autostart);
+            const onboardOk = !onboardAutostartFailed(autostart);
             if (command.json) {
                 writeLine(io.stdout, JSON.stringify({
-                    ...onboardResult(multi.ok ? "pass" : "blocked", resolvedCommand, install, pair, null, null),
+                    ...onboardResult(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, null, null),
                     collection_roots: collectionRoots,
                     root_resolution: rootsResult,
                     agent_rules: agentRules,
                     autostart,
-                    backfill_hint: backfillHint,
+                    backfill: completedBackfill,
                     mode: "multi_repo",
                     repos: multi.results,
                     codex_sessions: multi.codex_sessions,
+                    ...(!onboardOk && multi.ok
+                        ? {
+                            blocker: "autostart_load_failed",
+                            next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+                        }
+                        : {}),
                 }, null, 2));
             }
-            if (multi.ok && !command.json) {
+            if (onboardOk && !command.json) {
+                writeLine(io.stdout, "PASS: Cockpit collector is ready for harvest.");
                 writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
                     pair,
                     status,
@@ -1259,10 +1408,13 @@ async function runOnboard(command, io) {
                     agentRules,
                     autostart,
                     initialSyncOk: true,
-                    backfillHint,
+                    backfill: completedBackfill,
                 });
             }
-            return finish(multi.ok ? 0 : 1);
+            else if (multi.ok && !command.json) {
+                writeOnboardAutostartBlocker(io, autostart);
+            }
+            return finish(onboardOk ? 0 : 1);
         }
         const worktreeRoot = worktrees[0]?.repo_root ?? primaryRoot;
         const context = await startLocalWorkContext({
@@ -1282,6 +1434,7 @@ async function runOnboard(command, io) {
         const run = await runAttributedWorktreeSync({
             homeDir: command.homeDir,
             dashboardUrl: command.dashboardUrl,
+            collectionRoots: attributionCollectionRoots,
             startContexts: false,
             worktrees,
             fetchImpl: io.fetch,
@@ -1295,39 +1448,76 @@ async function runOnboard(command, io) {
             repoRoot: worktreeRoot,
             branch: command.branch,
         });
-        if (sync.status !== "uploaded") {
+        if (!run.ok || sync.status !== "uploaded") {
             addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
+            const runStatus = attributedSyncRunStatus(run);
             if (command.json) {
                 writeLine(io.stdout, JSON.stringify({
                     ...onboardResult("blocked", resolvedCommand, install, pair, sync, status),
                     collection_roots: collectionRoots,
                     root_resolution: rootsResult,
                     codex_sessions: run.summary,
+                    collection_status: runStatus,
                 }, null, 2));
             }
             else {
-                writeLine(io.stderr, "BLOCKED: ambient upload failed; safe retry metadata was spooled.");
-                writeLine(io.stderr, `Failure: ${sync.failure_reason}`);
-                writeLine(io.stderr, `Retry: ${sync.retry_command}`);
+                const syncFailureReason = sync.status === "spooled" ? sync.failure_reason : null;
+                const retryCommand = sync.status === "spooled"
+                    ? sync.retry_command
+                    : `cockpit sync --workspace ${JSON.stringify(worktreeRoot)}`;
+                writeLine(io.stderr, "BLOCKED: initial collection is incomplete; retry until every eligible session has a durable receipt or explicit terminal reason.");
+                writeLine(io.stderr, `Failure: ${syncFailureReason ?? (run.summary.report_posted ? runStatus : run.summary.report_reason)}`);
+                writeAgentSessionSummary(io, run.summary);
+                writeLine(io.stderr, `Retry: ${retryCommand}`);
             }
             return finish(1);
         }
         addInstallEvent(installEvents, "sync", "ok");
+        const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
+        const completedBackfill = backfill.status === "complete" ? backfill.result : null;
+        addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
+            ? undefined
+            : backfill.failureReason ?? "backfill_incomplete");
+        if (!completedBackfill) {
+            if (command.json) {
+                writeLine(io.stdout, JSON.stringify({
+                    ...onboardResult("blocked", resolvedCommand, install, pair, sync, status),
+                    collection_roots: collectionRoots,
+                    root_resolution: rootsResult,
+                    codex_sessions: run.summary,
+                    backfill: onboardBackfillPayload(backfill),
+                    blocker: "backfill_incomplete",
+                    backfill_failure_reason: backfill.failureReason,
+                    next_step: backfill.retryCommand,
+                }, null, 2));
+            }
+            else {
+                writeOnboardBackfillBlocker(io, backfill);
+            }
+            return finish(1);
+        }
         if (command.json) {
             agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
             addInstallEvent(installEvents, "agent_rules", "ok");
             autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
             addAutostartInstallEvent(installEvents, autostart);
+            const onboardOk = !onboardAutostartFailed(autostart);
             writeLine(io.stdout, JSON.stringify({
-                ...onboardResult("pass", resolvedCommand, install, pair, sync, status),
+                ...onboardResult(onboardOk ? "pass" : "blocked", resolvedCommand, install, pair, sync, status),
                 collection_roots: collectionRoots,
                 root_resolution: rootsResult,
                 agent_rules: agentRules,
                 autostart,
-                backfill_hint: backfillHint,
+                backfill: completedBackfill,
                 codex_sessions: run.summary,
+                ...(!onboardOk
+                    ? {
+                        blocker: "autostart_load_failed",
+                        next_step: "Run `cockpit autostart install`, then require `cockpit autostart status --json` to exit 0.",
+                    }
+                    : {}),
             }, null, 2));
-            return finish(0);
+            return finish(onboardOk ? 0 : 1);
         }
         writeLine(io.stdout, "4/5 Ambient metadata uploaded.");
         writeLine(io.stdout, `HTTP: ${sync.http_status}`);
@@ -1339,12 +1529,16 @@ async function runOnboard(command, io) {
         writeAgentSessionSummary(io, run.summary);
         writeLine(io.stdout, "5/5 Status ready.");
         writeLine(io.stdout, `Upload state: ${status.upload_state}`);
-        writeLine(io.stdout, "PASS: Cockpit collector is ready for harvest.");
         writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
         agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
         addInstallEvent(installEvents, "agent_rules", "ok");
         autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
         addAutostartInstallEvent(installEvents, autostart);
+        if (onboardAutostartFailed(autostart)) {
+            writeOnboardAutostartBlocker(io, autostart);
+            return finish(1);
+        }
+        writeLine(io.stdout, "PASS: Cockpit collector is ready for harvest.");
         writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
             pair,
             status,
@@ -1352,7 +1546,7 @@ async function runOnboard(command, io) {
             agentRules,
             autostart,
             initialSyncOk: true,
-            backfillHint,
+            backfill: completedBackfill,
         });
         return finish(0);
     }
@@ -1420,7 +1614,8 @@ function shortSha(value) {
     return value ? value.slice(0, 12) : "unknown";
 }
 function sourceFunnelLine(label, counts) {
-    return `${label} sessions: attributed ${counts.attributed}, ambiguous ${counts.ambiguous}, unattributed ${counts.unattributed}, skipped ${counts.skipped}, stale ${counts.stale}`;
+    const readFailures = counts.read_failures > 0 ? `, read_failures ${counts.read_failures}` : "";
+    return `${label} sessions: attributed ${counts.attributed}, fallback ${counts.attributed_fallback}, ambiguous ${counts.ambiguous}, unattributed ${counts.unattributed}, skipped ${counts.skipped}, stale ${counts.stale}${readFailures}`;
 }
 function attributionReportLine(summary) {
     return summary.report_posted
@@ -1475,7 +1670,10 @@ function rawEvidenceSyncLine(sync) {
     const failures = sync.raw_evidence_failure_reasons.length > 0
         ? ` failures: ${sync.raw_evidence_failure_reasons.join(",")}`
         : "";
-    return `Raw evidence: uploaded ${sync.raw_evidence_uploaded_object_count} object(s) in ${sync.raw_evidence_uploaded_chunk_count} chunk(s), reused ${sync.raw_evidence_reused_count}, failed ${sync.raw_evidence_failed_count}${failures}`;
+    const retries = sync.raw_evidence_retry_reasons.length > 0
+        ? ` retry_required: ${sync.raw_evidence_retry_reasons.join(",")}`
+        : "";
+    return `Raw evidence: uploaded ${sync.raw_evidence_uploaded_object_count} object(s) in ${sync.raw_evidence_uploaded_chunk_count} chunk(s), reused ${sync.raw_evidence_reused_count}, failed ${sync.raw_evidence_failed_count}${failures}${retries}`;
 }
 function cursorStatusLine(sync) {
     return `Cursor: ${sync.cursor_tracked_object_count} durable object(s) tracked`;
@@ -1485,75 +1683,69 @@ const DEFAULT_DISCOVERY_MAX_REPOS = 50;
 const ALL_SESSION_SCAN_WINDOW_MINUTES = 20 * 365 * 24 * 60;
 const SESSION_SCAN_OVERRIDE_LIMIT = 10_000;
 async function discoverCommandWorktrees(repoRoot, discovery = {}, io) {
-    if (Array.isArray(repoRoot)) {
-        const discovered = [];
-        for (const root of repoRoot) {
-            discovered.push(...(await discoverCommandWorktrees(root, discovery, io)));
-        }
-        return dedupeWorktrees(discovered);
-    }
     const maxWorktrees = discovery.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS;
-    const worktrees = await discoverGitWorktrees(repoRoot ?? process.cwd(), {
+    const roots = Array.isArray(repoRoot)
+        ? repoRoot
+        : [repoRoot ?? process.cwd()];
+    const result = await discoverGitWorktreesInRootsWithStatus(roots, {
         maxDepth: discovery.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
         maxWorktrees,
     });
-    if (worktrees.length === 0) {
-        throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
+    const worktrees = result.worktrees;
+    if (!result.complete) {
+        const reasons = result.incomplete_reasons.join(",");
+        if (io) {
+            writeLine(io.stderr, `BLOCKED: repo discovery is incomplete (${reasons}); no collection cursor was advanced.`);
+        }
+        throw new Error(`repo discovery incomplete: ${reasons}. Raise --max-depth or --max-repos until every approved-root repo is included.`);
     }
-    if (io && worktrees.length >= maxWorktrees) {
-        writeLine(io.stderr, `Warning: repo discovery hit the cap of ${maxWorktrees}; additional repos may be excluded. Raise --max-repos if this folder really holds more.`);
+    if (worktrees.length === 0 && !discovery.allowEmpty) {
+        throw new Error("No git repos found. Run from a git repo, or from a parent folder containing git repos.");
     }
     return worktrees;
 }
-function dedupeWorktrees(worktrees) {
-    const seen = new Set();
-    const deduped = [];
-    for (const worktree of worktrees) {
-        const key = worktree.worktree_fingerprint || path.resolve(worktree.repo_root);
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        deduped.push(worktree);
-    }
-    return deduped;
-}
 async function runMultiRepoOnboard(command, io, worktrees) {
     if (!command.json) {
         writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
     }
+    const collectionRoots = await collectionRootConsentAliases(command.collectionRoots ??
+        (command.repoRoot ? [command.repoRoot] : []));
     const run = await runAttributedWorktreeSync({
         homeDir: command.homeDir,
         dashboardUrl: command.dashboardUrl,
         branch: command.branch,
         activeTicketId: command.activeTicketId,
+        collectionRoots,
         startContexts: true,
         worktrees,
         fetchImpl: io.fetch,
     });
     const results = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
+    const runStatus = attributedSyncRunStatus(run);
     if (!command.json) {
         for (const [index, outcome] of run.outcomes.entries()) {
             const row = results[index];
             if (!row)
                 continue;
             const uploaded = outcome.sync.status === "uploaded";
-            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "PASS" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
+            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "SYNCED" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
         }
         writeLine(io.stdout, "4/5 Parent worktree sync complete.");
         writeLine(io.stdout, `Uploaded: ${results.filter((row) => row["upload_status"] === "uploaded").length}/${results.length}`);
         writeAgentSessionSummary(io, run.summary);
-        writeLine(io.stdout, "5/5 Status ready.");
-        writeLine(run.ok ? io.stdout : io.stderr, run.ok
-            ? "PASS: Cockpit collector is ready for harvest."
-            : "BLOCKED: One or more worktree uploads were spooled.");
+        if (run.ok) {
+            writeLine(io.stdout, "Live sync receipts complete; verifying all-history Codex and Claude backfill.");
+        }
+        else {
+            writeLine(io.stderr, `BLOCKED: Cockpit collection is ${runStatus}; retry until every eligible session has a durable receipt or explicit terminal reason.`);
+        }
         writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
     }
     return { ok: run.ok, results, codex_sessions: run.summary };
 }
 function worktreeSyncRow(outcome, run) {
     const { worktree, context, sync } = outcome;
-    const matchesWorktree = (result) => result.state === "attributed" &&
-        result.worktree?.worktree_fingerprint === worktree.worktree_fingerprint;
+    const matchesWorktree = (result) => matchesLiveSyncWorktree(result, worktree);
     const codexSessionCount = run.codexAttribution.results.filter(matchesWorktree).length;
     const claudeSessionCount = run.claudeAttribution.results.filter(matchesWorktree).length;
     const attributedSessionCount = codexSessionCount + claudeSessionCount;
@@ -1572,6 +1764,8 @@ function worktreeSyncRow(outcome, run) {
         raw_evidence_reused_count: sync.raw_evidence_reused_count,
         raw_evidence_failed_count: sync.raw_evidence_failed_count,
         raw_evidence_failure_reasons: sync.raw_evidence_failure_reasons,
+        raw_evidence_retry_required: sync.raw_evidence_retry_required,
+        raw_evidence_retry_reasons: sync.raw_evidence_retry_reasons,
         attributed_session_count: attributedSessionCount,
         codex_session_count: codexSessionCount,
         claude_session_count: claudeSessionCount,
@@ -1742,6 +1936,48 @@ async function runStart(command, io) {
     return 0;
 }
 async function runSync(command, io) {
+    const paths = getCollectorRuntimePaths(command.homeDir);
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
+    await reportInstallEventsBestEffort({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        command: "sync",
+        events: [{ step: "sync_started", status: "ok" }],
+        json: command.json,
+        io,
+    });
+    try {
+        const result = await runSyncWithHealthReceipt(command, io);
+        await reportInstallEventsBestEffort({
+            homeDir: command.homeDir,
+            dashboardUrl,
+            command: "sync",
+            events: [result.completion],
+            json: command.json,
+            io,
+        });
+        return result.exitCode;
+    }
+    catch (error) {
+        await reportInstallEventsBestEffort({
+            homeDir: command.homeDir,
+            dashboardUrl,
+            command: "sync",
+            events: [
+                {
+                    step: "sync_complete",
+                    status: "fail",
+                    error_code: classifySyncHealthError(error),
+                },
+            ],
+            json: command.json,
+            io,
+        });
+        throw error;
+    }
+}
+async function runSyncWithHealthReceipt(command, io) {
     const backfillLock = await inspectBackfillLock(getCollectorRuntimePaths(command.homeDir));
     if (backfillLock.held) {
         if (command.json) {
@@ -1749,48 +1985,101 @@ async function runSync(command, io) {
                 status: "live_sync_paused_during_backfill",
                 reason: "live sync paused during backfill",
                 held_since: backfillLock.held_since,
+                collection_complete: false,
+                upload_state: "not_uploaded",
+                retryable: true,
             }, null, 2));
         }
         else {
             writeLine(io.stdout, "live sync paused during backfill");
         }
-        return 0;
+        return {
+            exitCode: 0,
+            completion: {
+                step: "sync_complete",
+                status: "skipped",
+                error_code: "live_sync_paused_during_backfill",
+            },
+        };
     }
     // Single-flight: a launchd timer and a manual sync must not interleave the
     // cursor read-modify-write. A blocked invocation exits cleanly (B.4 §7).
     const lock = await acquireSyncLock(getCollectorRuntimePaths(command.homeDir));
     if (!lock.acquired) {
         if (command.json) {
-            writeLine(io.stdout, JSON.stringify({ status: "sync_already_running", held_since: lock.held_since }, null, 2));
+            writeLine(io.stdout, JSON.stringify({
+                status: "sync_already_running",
+                reason: "another sync owns the collection lock",
+                held_since: lock.held_since,
+                collection_complete: false,
+                upload_state: "not_uploaded",
+                retryable: true,
+            }, null, 2));
         }
         else {
             writeLine(io.stdout, "Cockpit sync already running; skipping this run.");
         }
-        return 0;
+        return {
+            exitCode: 0,
+            completion: {
+                step: "sync_complete",
+                status: "skipped",
+                error_code: "sync_already_running",
+            },
+        };
     }
     try {
-        return await runSyncLocked(command, io);
+        const exitCode = await runSyncLocked(command, io);
+        return {
+            exitCode,
+            completion: {
+                step: "sync_complete",
+                status: exitCode === 0 ? "ok" : "fail",
+                ...(exitCode === 0 ? {} : { error_code: "sync_failed" }),
+            },
+        };
     }
     finally {
         await lock.handle.release();
     }
 }
+function classifySyncHealthError(error) {
+    const message = errorMessage(error);
+    if (/auth|token|session|unauthorized|forbidden|401|403/iu.test(message)) {
+        return "auth_failed";
+    }
+    if (/fetch|network|enotfound|econnrefused|timeout/iu.test(message)) {
+        return "network_failed";
+    }
+    if (/collection.root|workspace|repo|worktree/iu.test(message)) {
+        return "collection_root_failed";
+    }
+    return "sync_failed";
+}
 async function runSyncLocked(command, io) {
-    const worktrees = await discoverCommandWorktrees(command.repoRoot, { maxDepth: command.maxDepth, maxRepos: command.maxRepos }, io);
+    const collectionRoots = await resolveSyncCollectionRoots(command);
+    const worktrees = await discoverCommandWorktrees(collectionRoots, {
+        maxDepth: command.maxDepth,
+        maxRepos: command.maxRepos,
+        allowEmpty: true,
+    }, io);
     const run = await runAttributedWorktreeSync({
         homeDir: command.homeDir,
         dashboardUrl: command.dashboardUrl,
+        collectionRoots,
         startContexts: false,
         worktrees,
         fetchImpl: io.fetch,
     });
-    if (worktrees.length > 1) {
+    if (run.outcomes.length > 1) {
         const rows = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
+        const runStatus = attributedSyncRunStatus(run);
         const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
         if (command.json) {
             writeLine(io.stdout, JSON.stringify({
                 mode: "multi_repo",
-                status: run.ok ? "uploaded" : "spooled",
+                status: runStatus,
+                collection_complete: run.ok,
                 results: run.outcomes.map((outcome) => outcome.sync),
                 repos: rows,
                 codex_sessions: run.summary,
@@ -1798,7 +2087,7 @@ async function runSyncLocked(command, io) {
             }, null, 2));
             return run.ok ? 0 : 1;
         }
-        writeLine(run.ok ? io.stdout : io.stderr, `Cockpit parent sync ${run.ok ? "uploaded" : "spooled"} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
+        writeLine(run.ok ? io.stdout : io.stderr, `Cockpit parent sync ${runStatus} ${run.outcomes.filter((outcome) => outcome.sync.status === "uploaded").length}/${run.outcomes.length} worktree(s).`);
         for (const outcome of run.outcomes) {
             const { worktree, sync } = outcome;
             const uploaded = sync.status === "uploaded";
@@ -1814,12 +2103,19 @@ async function runSyncLocked(command, io) {
     if (!result) {
         throw new Error("Sync produced no result for the repo worktree.");
     }
-    const gc = result.status === "uploaded" ? await runSyncRawEvidenceGc(command, io) : null;
+    const runStatus = attributedSyncRunStatus(run);
+    const gc = run.ok ? await runSyncRawEvidenceGc(command, io) : null;
     if (command.json) {
-        writeLine(io.stdout, JSON.stringify({ ...result, codex_sessions: run.summary, raw_evidence_gc: gc }, null, 2));
-        return result.status === "uploaded" ? 0 : 1;
+        writeLine(io.stdout, JSON.stringify({
+            ...result,
+            status: runStatus,
+            collection_complete: run.ok,
+            codex_sessions: run.summary,
+            raw_evidence_gc: gc,
+        }, null, 2));
+        return run.ok ? 0 : 1;
     }
-    if (result.status === "uploaded") {
+    if (run.ok) {
         writeLine(io.stdout, "Cockpit ambient envelope uploaded.");
         writeLine(io.stdout, `Ticket: ${displayTicketId(result.ticket_id)}`);
         writeLine(io.stdout, `Context: ${result.work_context_id}`);
@@ -1834,12 +2130,43 @@ async function runSyncLocked(command, io) {
             writeLine(io.stdout, rawEvidenceGcSummary(gc));
         return 0;
     }
+    if (result.status === "uploaded") {
+        writeLine(io.stderr, "Cockpit ambient upload was accepted, but session collection is partial; retry `cockpit sync`.");
+        writeAgentSessionSummary(io, run.summary);
+        return 1;
+    }
     writeLine(io.stderr, "Cockpit ambient upload failed; safe retry metadata was spooled.");
     writeLine(io.stderr, `Ticket: ${displayTicketId(result.ticket_id)}`);
     writeLine(io.stderr, `Failure: ${result.failure_reason}`);
     writeLine(io.stderr, `Retry: ${result.retry_command}`);
     return 1;
 }
+async function resolveSyncCollectionRoots(command) {
+    const explicitRoots = normalizeCollectionRoots(command.repoRoot ? [command.repoRoot] : []);
+    if (explicitRoots.length > 0) {
+        return collectionRootConsentAliases(explicitRoots);
+    }
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(command.homeDir)).catch(() => null);
+    const savedRoots = normalizeCollectionRoots(config?.default_repo_paths ?? []);
+    if (savedRoots.length > 0) {
+        return collectionRootConsentAliases(savedRoots);
+    }
+    throw new Error(`${COLLECTION_ROOT_REQUIRED}: no explicit or saved collection root is available.`);
+}
+async function collectionRootConsentAliases(roots) {
+    // Keep both spellings when an existing root is reached through a filesystem
+    // alias such as macOS `/var` -> `/private/var`. Deleted child paths cannot be
+    // realpathed later, so either transcript spelling must remain inside the same
+    // operator-approved physical root.
+    return normalizeCollectionRoots(await collectionRootPathAliases(roots));
+}
+function attributedSyncRunStatus(run) {
+    if (run.ok)
+        return "uploaded";
+    return run.outcomes.every((outcome) => outcome.sync.status === "uploaded")
+        ? "partial"
+        : "spooled";
+}
 async function runAnalyze(command, io) {
     const syncStdout = [];
     const syncStderr = [];
@@ -2015,6 +2342,8 @@ async function runStatus(command, io) {
     writeLine(io.stdout, `last_upload_success: ${status.last_upload_success_at ?? "never"}`);
     writeLine(io.stdout, `last_upload_failure: ${status.last_upload_failure_reason ?? "none"}`);
     writeLine(io.stdout, `pending_uploads: ${status.pending_upload_count}`);
+    writeLine(io.stdout, `pending_health_receipts: ${status.pending_health_receipt_count}`);
+    writeLine(io.stdout, `last_health_receipt_failure: ${status.last_health_receipt_failure_reason ?? "none"}`);
     writeLine(io.stdout, `backfill: ${backfillCursorLine(backfillCursor)}`);
     for (const detail of status.details)
         writeLine(io.stdout, `- ${detail}`);
@@ -2028,39 +2357,20 @@ function displayWorkLabel(status) {
         return `${status.work_label} (${status.work_id})`;
     return status.work_label ?? status.work_id ?? "no active work context";
 }
-async function fileExists(filePath) {
-    try {
-        await access(filePath);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function onboardBackfillHint(homeDir) {
-    const paths = getCollectorRuntimePaths(homeDir);
-    if (await fileExists(backfillCompletionMarkerPath(paths)))
-        return null;
-    const hasArchivedSessions = await hasAnyJsonlFile([
-        path.join(homeDir ?? os.homedir(), ".codex", "archived_sessions"),
-    ]);
-    return hasArchivedSessions
-        ? "Backfill: archived sessions found. Run `cockpit backfill --all` to include older local history."
-        : null;
-}
 async function inspectBackfillCursor(homeDir) {
     const paths = getCollectorRuntimePaths(homeDir);
+    const roots = await currentBackfillRoots(homeDir);
     const marker = await readBackfillCompletionMarker(paths);
-    if (marker) {
+    if (backfillCompletionCovers(marker, roots, ["codex", "claude_code"])) {
         return {
             state: "done",
             remaining_count: 0,
-            updated_at: marker.cursor.updated_at,
-            completed_at: marker.completed_at,
-            sources: summarizeBackfillCursorSources(marker.cursor),
+            updated_at: marker?.cursor.updated_at ?? null,
+            completed_at: marker?.completed_at ?? null,
+            sources: summarizeBackfillCursorSources(marker?.cursor ?? emptyBackfillCursorState()),
         };
     }
-    const cursor = await readBackfillCursor(paths);
+    const cursor = (prepareBackfillCursorForScope(await readBackfillCursor(paths), roots, ["codex", "claude_code"])).cursor;
     if (!cursor.updated_at) {
         return {
             state: "never_run",
@@ -2078,60 +2388,9 @@ async function inspectBackfillCursor(homeDir) {
         sources: summarizeBackfillCursorSources(cursor),
     };
 }
-async function readBackfillCompletionMarker(paths) {
-    try {
-        const raw = JSON.parse(await readFile(backfillCompletionMarkerPath(paths), "utf8"));
-        if (typeof raw.completed_at !== "string")
-            return null;
-        const cursor = raw.cursor && typeof raw.cursor === "object"
-            ? normalizeBackfillCursor(raw.cursor)
-            : await readBackfillCursor(paths);
-        return { completed_at: raw.completed_at, cursor };
-    }
-    catch {
-        return null;
-    }
-}
-function normalizeBackfillCursor(value) {
-    const record = value;
-    return {
-        schema_version: "cockpit-backfill-cursor.v1",
-        updated_at: typeof record.updated_at === "string" && record.updated_at
-            ? record.updated_at
-            : null,
-        sources: {
-            codex: {
-                oldest_mtime_ms_processed: typeof record.sources?.codex?.oldest_mtime_ms_processed === "number"
-                    ? record.sources.codex.oldest_mtime_ms_processed
-                    : null,
-                oldest_mtime_processed: typeof record.sources?.codex?.oldest_mtime_processed === "string"
-                    ? record.sources.codex.oldest_mtime_processed
-                    : null,
-                state_counts: numberRecord(record.sources?.codex?.state_counts),
-                reason_counts: numberRecord(record.sources?.codex?.reason_counts),
-            },
-            claude_code: {
-                oldest_mtime_ms_processed: typeof record.sources?.claude_code?.oldest_mtime_ms_processed === "number"
-                    ? record.sources.claude_code.oldest_mtime_ms_processed
-                    : null,
-                oldest_mtime_processed: typeof record.sources?.claude_code?.oldest_mtime_processed === "string"
-                    ? record.sources.claude_code.oldest_mtime_processed
-                    : null,
-                state_counts: numberRecord(record.sources?.claude_code?.state_counts),
-                reason_counts: numberRecord(record.sources?.claude_code?.reason_counts),
-            },
-        },
-    };
-}
-function numberRecord(value) {
-    if (!value || typeof value !== "object")
-        return {};
-    const out = {};
-    for (const [key, raw] of Object.entries(value)) {
-        if (typeof raw === "number" && Number.isFinite(raw))
-            out[key] = raw;
-    }
-    return out;
+async function currentBackfillRoots(homeDir) {
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return normalizeCollectionRoots(config?.default_repo_paths ?? []);
 }
 function summarizeBackfillCursorSources(cursor) {
     return {
@@ -2190,14 +2449,6 @@ async function countClaudeMainFilesBeforeCursor(projectsDir, oldestProcessedMs)
     });
     return count;
 }
-async function hasAnyJsonlFile(roots) {
-    let found = false;
-    await walkFiles(roots, async (_filePath, entryName) => {
-        if (entryName.endsWith(".jsonl"))
-            found = true;
-    }, () => found);
-    return found;
-}
 async function walkFiles(roots, onFile, shouldStop = () => false) {
     const stack = [...roots];
     while (stack.length > 0 && !shouldStop()) {
@@ -2387,23 +2638,51 @@ async function runServe(command, io) {
 }
 async function runAutostart(command, io) {
     const exec = io.exec ?? defaultExec();
+    const repoRoots = command.action === "install" || command.action === "status"
+        ? await resolveAutostartRoots(command.homeDir, command.repoRoot)
+        : [];
     const result = command.action === "install"
         ? await installAutostartAgent({
             homeDir: command.homeDir,
-            repoRoot: command.repoRoot,
+            repoRoot: repoRoots[0],
+            repoRoots,
             dashboardUrl: command.dashboardUrl,
             intervalSeconds: command.intervalSeconds,
             exec,
         })
         : command.action === "uninstall"
             ? await uninstallAutostartAgent({ homeDir: command.homeDir, exec })
-            : await autostartStatus({ homeDir: command.homeDir, exec });
+            : await autostartStatus({
+                homeDir: command.homeDir,
+                repoRoot: repoRoots[0],
+                repoRoots,
+                dashboardUrl: command.dashboardUrl,
+                intervalSeconds: command.intervalSeconds,
+                exec,
+            });
     if (command.json) {
         writeLine(io.stdout, JSON.stringify(result, null, 2));
-        return result.status === "unsupported" ? 1 : 0;
+        return autostartExitCode(command.action, result);
     }
     writeAutostartResult(io, result);
-    return result.status === "unsupported" ? 1 : 0;
+    return autostartExitCode(command.action, result);
+}
+function autostartExitCode(action, result) {
+    if (result.status === "unsupported")
+        return 1;
+    if (action === "status")
+        return result.status === "loaded" ? 0 : 1;
+    if (action === "install" && result.loaded === false)
+        return 1;
+    if (action === "uninstall" && result.status === "not_loaded")
+        return 1;
+    return 0;
+}
+async function resolveAutostartRoots(homeDir, explicitRoot) {
+    if (explicitRoot)
+        return [explicitRoot];
+    const config = await readLocalCollectorConfig(getCollectorRuntimePaths(homeDir)).catch(() => null);
+    return config?.default_repo_paths ?? [];
 }
 async function runAgentRules(command, io) {
     const hosts = agentRuleHosts(command.host);
@@ -2453,9 +2732,9 @@ function writeAutostartResult(io, result) {
         case "installed":
             writeLine(io.stdout, result.loaded
                 ? "Cockpit autostart installed and loaded."
-                : "Cockpit autostart installed (launchctl load reported a problem).");
+                : "Cockpit autostart installed (the operating-system scheduler reported a problem).");
             writeLine(io.stdout, `Label: ${result.label}`);
-            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, autostartLocationLine(result));
             writeLine(io.stdout, `Interval: every ${result.interval_seconds}s`);
             writeLine(io.stdout, `Repo: ${result.work_dir}`);
             writeLine(io.stdout, `Dashboard: ${result.dashboard_url}`);
@@ -2464,45 +2743,37 @@ function writeAutostartResult(io, result) {
             return;
         case "uninstalled":
             writeLine(io.stdout, "Cockpit autostart removed.");
-            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, autostartLocationLine(result));
             return;
         case "absent":
             writeLine(io.stdout, "Cockpit autostart is not installed.");
-            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, autostartLocationLine(result));
             return;
         case "loaded":
             writeLine(io.stdout, "Cockpit autostart is installed and loaded.");
-            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, autostartLocationLine(result));
             return;
         case "not_loaded":
-            writeLine(io.stdout, "Cockpit autostart plist exists but is not loaded; run `cockpit autostart install` to reload.");
-            writeLine(io.stdout, `Plist: ${result.plist_path}`);
+            writeLine(io.stdout, "Cockpit autostart exists but is disabled or not loaded; run `cockpit autostart install` to repair it.");
+            writeLine(io.stdout, autostartLocationLine(result));
+            if (result.message)
+                writeLine(io.stderr, result.message);
             return;
         case "unsupported":
             writeLine(io.stderr, `Autostart unsupported: ${result.message}`);
             return;
     }
 }
+function autostartLocationLine(result) {
+    return result.task_name
+        ? `Task: ${result.task_name}`
+        : `Plist: ${result.plist_path}`;
+}
 function defaultExec() {
-    return (cmd, args) => new Promise((resolve) => {
-        execFile(cmd, args, { encoding: "utf8" }, (err, stdout, stderr) => {
-            // execFile's error `.code` is the exit code when numeric, but a string
-            // (e.g. "ENOENT") for spawn failures — treat those as a generic 1.
-            const code = err == null ? 0 : typeof err.code === "number" ? err.code : 1;
-            resolve({ code, stdout: stdout ?? "", stderr: stderr ?? "" });
-        });
-    });
+    return createCapturedExecRunner();
 }
 function defaultInteractiveExec() {
-    return (cmd, args) => new Promise((resolve) => {
-        const child = spawn(cmd, args, { stdio: "inherit" });
-        child.on("error", (error) => {
-            resolve({ code: 1, stdout: "", stderr: errorMessage(error) });
-        });
-        child.on("close", (code) => {
-            resolve({ code: code ?? 1, stdout: "", stderr: "" });
-        });
-    });
+    return createInteractiveExecRunner();
 }
 function defaultIo() {
     if (!globalThis.fetch) {