@bli-cockpit/cli 0.2.40 → 0.2.41

package/dist/commands/scout.js

@@ -16,7 +16,7 @@
  * as the page is; moving a card is super_admin whichever surface asks, and a
  * refusal never costs a person the board.
  */
-import { writeLine } from "./cli-io.js";
+import { colorEnabled, writeLine } from "./cli-io.js";
 import { renderScoutBoard, resolveExperimentRef, refusalSentence, shortId, truncationLines, } from "./scout-render.js";
 import { loadPairedSession, towerFailureDetail, towerJsonRequest, } from "../tower-client.js";
 /** The dashboard route caps nothing here, but a board read should never hang a shell. */
@@ -49,7 +49,7 @@ export async function runScout(command, io) {
             writeLine(io.stdout, JSON.stringify({ ok: true, audience: payload.audience ?? null, windowDays: payload.windowDays ?? board.windowDays ?? null, board, lines }));
         }
         else {
-            for (const line of renderScoutBoard(payload))
+            for (const line of renderScoutBoard(payload, colorEnabled(io)))
                 writeLine(io.stdout, line);
         }
         writeLine(io.stderr, `[scout cli] board read ${JSON.stringify({
@@ -78,7 +78,7 @@ export async function runScout(command, io) {
         }
         else {
             writeLine(io.stderr, sentence);
-            for (const line of renderScoutBoard(payload))
+            for (const line of renderScoutBoard(payload, colorEnabled(io)))
                 writeLine(io.stdout, line);
         }
         return 1;
@@ -119,7 +119,7 @@ export async function runScout(command, io) {
         if (applied.httpStatus === 403) {
             writeLine(io.stderr, "Deciding a Scout card is a super_admin action; reading the board is not.");
         }
-        for (const line of renderScoutBoard(payload))
+        for (const line of renderScoutBoard(payload, colorEnabled(io)))
             writeLine(io.stdout, line);
         return 1;
     }

package/dist/commands/sessions.js

@@ -71,9 +71,16 @@ export async function runSessions(command, io) {
             reason: sidecar.skipped_reason,
         })),
     }));
+    // BLI-3483: the scanners have always counted the folders and files they
+    // could not read, and this command has always thrown those counts away
+    // except for one field in `--json`. So "No sessions observed" was printed on
+    // a machine where the scan had been blocked from looking — the operator's
+    // one diagnostic tool answering the question with the failure removed.
+    const readFailures = countReadFailures(codex, claude);
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({
             window,
+            read_failures: readFailures,
             ...(codex
                 ? { codex: { counts: codex.counts, sessions: codexRows } }
                 : {}),
@@ -101,10 +108,47 @@ export async function runSessions(command, io) {
         }
     }
     if (codexRows.length === 0 && claudeRows.length === 0) {
-        writeLine(io.stdout, "No sessions observed in the scan window.");
+        writeLine(io.stdout, readFailures.total > 0
+            ? `No sessions listed, but ${readFailures.total} read failure(s) mean the scan could not see everywhere — this is not proof there were none.`
+            : "No sessions observed in the scan window.");
+    }
+    if (readFailures.total > 0) {
+        for (const line of readFailureLines(readFailures)) {
+            writeLine(io.stdout, line);
+        }
     }
     return 0;
 }
+/**
+ * Everything the two scanners looked at and could not read. Counts only — the
+ * project-dir slug encodes a local path and never leaves this machine.
+ */
+function countReadFailures(codex, claude) {
+    const failures = {
+        codex_directory_read_failed: codex?.directory_read_failed_count ?? 0,
+        codex_stat_failed: codex?.stat_failed_count ?? 0,
+        codex_secret_path_skipped: codex?.secret_path_skipped_count ?? 0,
+        claude_project_dir_read_failed: claude?.project_dir_read_failed_count ?? 0,
+        claude_project_dirs_skipped: claude?.project_dirs_skipped ?? 0,
+        claude_session_stat_failed: claude?.session_stat_failed_count ?? 0,
+        claude_sidecar_dir_read_failed: claude?.sidecar_dir_read_failed_count ?? 0,
+        claude_sidecar_stat_failed: claude?.sidecar_stat_failed_count ?? 0,
+    };
+    return {
+        total: Object.values(failures).reduce((sum, count) => sum + count, 0),
+        ...failures,
+    };
+}
+function readFailureLines(failures) {
+    const named = Object.entries(failures)
+        .filter(([field, count]) => field !== "total" && Number(count) > 0)
+        .map(([field, count]) => `  ${field}: ${count}`);
+    return [
+        `read failures during this scan (${failures.total}) — sessions under these are not listed:`,
+        ...named,
+        "  a permission wall is the usual cause; on macOS grant Full Disk Access, on Windows check the folder ACL",
+    ];
+}
 /** `--all`, an explicit `--since-days` capped at pairing, or the default window. */
 async function sessionsScanWindow(command, now) {
     if (command.all) {

package/dist/commands/settings-render.js

@@ -8,7 +8,12 @@
  * Every one of these is defensive about shape on purpose. These bodies come off
  * the wire from a dashboard that may be a release ahead or behind the installed
  * CLI, and a missing field should cost one line of output, not the command.
+ *
+ * Columns are padded in SCREEN CELLS, not UTF-16 code units (BLI-3482) — a
+ * display name written in another script is exactly the row where `padEnd`
+ * silently stops lining up.
  */
+import { padEndDisplay } from "./text-width.js";
 const INDENT = "  ";
 function text(value, fallback = "—") {
     if (typeof value === "string" && value.trim())
@@ -82,7 +87,7 @@ export function renderTeamMembers(body) {
     for (const person of people) {
         const standing = text(person.standing, "");
         const name = text(person.displayName, text(person.email));
-        lines.push(`${INDENT}${name.padEnd(28)} ${text(person.role, "—").padEnd(20)} ${standing}`);
+        lines.push(`${INDENT}${padEndDisplay(name, 28)} ${padEndDisplay(text(person.role, "—"), 20)} ${standing}`);
         if (typeof person.userId === "string") {
             lines.push(`${INDENT}${INDENT}id ${person.userId}`);
         }
@@ -101,7 +106,7 @@ export function renderSwitches(body) {
         const options = Array.isArray(entry.options)
             ? entry.options.map((option) => text(record(option).value)).join(" | ")
             : "";
-        return `${INDENT}${text(entry.key).padEnd(24)} ${text(entry.value).padEnd(12)} (${text(entry.source)}${options ? `; choices: ${options}` : ""})`;
+        return `${INDENT}${padEndDisplay(text(entry.key), 24)} ${padEndDisplay(text(entry.value), 12)} (${text(entry.source)}${options ? `; choices: ${options}` : ""})`;
     });
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}values could not be read: ${body.readFailureReason}`);
@@ -114,7 +119,7 @@ export function renderModelRouting(body) {
         `${INDENT}memory  ${text(body.memoryEffectiveLabel)} (${text(body.memorySource)}${typeof body.memoryVia === "string" ? ` via ${body.memoryVia}` : ""})`,
     ];
     for (const slot of list(body.displaySlots)) {
-        lines.push(`${INDENT}${text(slot.name).padEnd(24)} ${text(slot.currentLabel)} — set in code (${text(slot.pointer)})`);
+        lines.push(`${INDENT}${padEndDisplay(text(slot.name), 24)} ${text(slot.currentLabel)} — set in code (${text(slot.pointer)})`);
     }
     if (typeof body.readFailureReason === "string") {
         lines.push(`${INDENT}settings could not be read: ${body.readFailureReason}`);
@@ -132,6 +137,6 @@ export function renderEnvBlobs(body) {
     const blobs = list(body.blobs);
     if (blobs.length === 0)
         return [`${INDENT}no env files stored`];
-    return blobs.map((blob) => `${INDENT}${text(blob.project).padEnd(12)} ${text(blob.file_name).padEnd(16)} ` +
+    return blobs.map((blob) => `${INDENT}${padEndDisplay(text(blob.project), 12)} ${padEndDisplay(text(blob.file_name), 16)} ` +
         `updated ${text(blob.updated_at)}  id ${text(blob.id)}`);
 }

package/dist/commands/settings.js

@@ -213,6 +213,12 @@ async function setModels(command, tower, io) {
         return 0;
     }
     writeLine(io.stdout, `Saved: ${asList(body.saved).join(", ") || "nothing"}.`);
+    // BLI-3481: the save succeeded but the belt pre-flight could not reach the
+    // provider, so nobody has checked that the model just chosen will accept
+    // Tower's tool belt. A bare "Saved." there would be a silent success.
+    if (typeof body.warning === "string" && body.warning.length > 0) {
+        writeLine(io.stderr, body.warning);
+    }
     return 0;
 }
 // ── env files ─────────────────────────────────────────────────────────

package/dist/commands/text-width.js

@@ -0,0 +1,108 @@
+/**
+ * How wide a string is ON SCREEN, in terminal cells (BLI-3482).
+ *
+ * `"".length` counts UTF-16 code units, which is the wrong number twice over
+ * for a column: an emoji costs two units and draws two cells, a CJK ideograph
+ * costs one unit and draws two, and a combining accent costs one unit and draws
+ * nothing. Padding by `.length` therefore ragged-edges any table whose cells are
+ * not plain ASCII — the failure a person sees is a column that no longer lines
+ * up, on exactly the rows that carry a name or a title in another script.
+ *
+ * This is a deliberately small wcwidth, not the real one, and its limits are
+ * honest:
+ *
+ * - The wide ranges below are the common East Asian Wide/Fullwidth blocks plus
+ *   the main emoji planes. Ambiguous-width characters (box drawing, `⏺`, Greek,
+ *   Cyrillic) are counted as ONE cell, which is what a Western-locale terminal
+ *   draws; a CJK-locale terminal may draw some of them as two.
+ * - A ZWJ emoji sequence (👨‍👩‍👧) is measured as the sum of its parts, so it
+ *   over-counts on terminals that draw the whole cluster in two cells. Nothing
+ *   here inspects grapheme clusters; that needs `Intl.Segmenter` and a real
+ *   emoji table, which is more machinery than a column deserves.
+ * - U+FE0F (emoji presentation) is counted as zero, so a text-default symbol
+ *   promoted to emoji presentation is under-counted by one.
+ *
+ * Every one of those errors costs alignment, never content: nothing in this
+ * file may drop, cut or reorder text.
+ */
+/** SGR colour sequences occupy no cells, so they are removed before counting. */
+// eslint-disable-next-line no-control-regex
+const ANSI_SGR = /\x1b\[[0-9;]*m/gu;
+/** Zero-cell code points: combining marks, joiners, variation selectors. */
+const ZERO_WIDTH = [
+    [0x0300, 0x036f], // combining diacritical marks
+    [0x0483, 0x0489],
+    [0x0591, 0x05bd],
+    [0x0610, 0x061a],
+    [0x064b, 0x065f],
+    [0x0670, 0x0670],
+    [0x06d6, 0x06dc],
+    [0x0e31, 0x0e31],
+    [0x0e34, 0x0e3a],
+    [0x0e47, 0x0e4e],
+    [0x1ab0, 0x1aff], // combining diacritical marks extended
+    [0x1dc0, 0x1dff], // combining diacritical marks supplement
+    [0x200b, 0x200f], // zero-width space through RTL mark (incl. ZWNJ, ZWJ)
+    [0x20d0, 0x20f0], // combining marks for symbols
+    [0xfe00, 0xfe0f], // variation selectors
+    [0xfe20, 0xfe2f], // combining half marks
+    [0xfeff, 0xfeff], // byte-order mark
+];
+/** Two-cell code points: the common Wide / Fullwidth blocks and emoji planes. */
+const WIDE = [
+    [0x1100, 0x115f], // Hangul Jamo
+    [0x2e80, 0x303e], // CJK radicals, Kangxi, CJK symbols and punctuation
+    [0x3041, 0x33ff], // Hiragana, Katakana, Bopomofo, Hangul Compatibility Jamo
+    [0x3400, 0x4dbf], // CJK Unified Ideographs Extension A
+    [0x4e00, 0x9fff], // CJK Unified Ideographs
+    [0xa000, 0xa4cf], // Yi
+    [0xa960, 0xa97f], // Hangul Jamo Extended-A
+    [0xac00, 0xd7a3], // Hangul syllables
+    [0xf900, 0xfaff], // CJK compatibility ideographs
+    [0xfe10, 0xfe19], // vertical forms
+    [0xfe30, 0xfe6f], // CJK compatibility forms
+    [0xff00, 0xff60], // fullwidth forms
+    [0xffe0, 0xffe6], // fullwidth signs
+    [0x1f300, 0x1f64f], // misc symbols and pictographs, emoticons
+    [0x1f680, 0x1f6ff], // transport and map symbols
+    [0x1f900, 0x1f9ff], // supplemental symbols and pictographs
+    [0x20000, 0x3fffd], // CJK Unified Ideographs Extensions B onward
+];
+function inRanges(code, ranges) {
+    for (const [low, high] of ranges) {
+        if (code < low)
+            return false; // ranges are ascending
+        if (code <= high)
+            return true;
+    }
+    return false;
+}
+/** Cells one code point draws: 0 for combining/invisible, 2 for wide, else 1. */
+export function codePointWidth(code) {
+    if (code === 0x0a || code === 0x0d)
+        return 0;
+    if (code < 0x20 || (code >= 0x7f && code < 0xa0))
+        return 0; // control characters
+    if (inRanges(code, ZERO_WIDTH))
+        return 0;
+    if (inRanges(code, WIDE))
+        return 2;
+    return 1;
+}
+/** Cells a string draws, ignoring any SGR colour sequences inside it. */
+export function displayWidth(text) {
+    let total = 0;
+    for (const character of text.replace(ANSI_SGR, "")) {
+        total += codePointWidth(character.codePointAt(0) ?? 0);
+    }
+    return total;
+}
+/**
+ * `padEnd` that counts cells instead of code units. Like `padEnd`, a string
+ * already at or past the column is returned untouched — a column is a minimum,
+ * never a limit, because cutting a cell to fit loses content.
+ */
+export function padEndDisplay(text, width) {
+    const missing = width - displayWidth(text);
+    return missing > 0 ? `${text}${" ".repeat(missing)}` : text;
+}

package/dist/commands/workbook-render.js

@@ -10,11 +10,18 @@
  * summarises, reorders or paraphrases — it wraps, and it strips the emphasis
  * markers a reader did not ask for. `--markdown` bypasses this file entirely
  * and prints the server's bytes, which is what lets this layout be opinionated.
+ *
+ * Two things arrive as arguments rather than being read from the process, so
+ * these functions stay pure and their tests stay deterministic (BLI-3482):
+ * `width` (the wrap column) and `styled` (whether stdout is a terminal that
+ * asked for colour — `workbook.ts` decides it once with `colorEnabled(io)`).
+ * Columns are measured in SCREEN CELLS via `displayWidth`, not in UTF-16 code
+ * units, so a table whose cells carry CJK or emoji still lines up.
  */
-const DIM = "\x1b[2m";
-const RESET = "\x1b[0m";
+import { dim } from "./cli-io.js";
+import { displayWidth, padEndDisplay } from "./text-width.js";
 /** One compartment per project, its documents underneath, addressed as typed. */
-export function renderShelf(projects, width) {
+export function renderShelf(projects, width, styled) {
     const docs = projects.reduce((count, project) => count + (project.docs?.length ?? 0), 0);
     const out = [
         `WORKBOOK · ${projects.length} project${projects.length === 1 ? "" : "s"} · ${docs} document${docs === 1 ? "" : "s"}`,
@@ -27,25 +34,25 @@ export function renderShelf(projects, width) {
             out.push(`  ⏺ cockpit workbook ${project.slug ?? ""} ${doc.slug ?? ""}`);
             out.push(`    ${doc.title ?? ""} · ${doc.kind ?? ""}`);
             if (doc.line) {
-                out.push(...wrap(doc.line, width - 4).map((line) => dim(`    ${line}`)));
+                out.push(...wrap(doc.line, width - 4).map((line) => dim(`    ${line}`, styled)));
             }
-            out.push(dim(`    ${[doc.author, doc.date].filter(Boolean).join(" · ")}`));
+            out.push(dim(`    ${[doc.author, doc.date].filter(Boolean).join(" · ")}`, styled));
         }
     }
     return out;
 }
 /** The document's own header, then its blocks laid out for `width`. */
-export function renderDocText(payload, markdown, width) {
+export function renderDocText(payload, markdown, width, styled) {
     const doc = payload.doc ?? {};
     const out = [];
     if (doc.title)
         out.push(...wrap(doc.title.toUpperCase(), width));
     const meta = [doc.kind, payload.project?.title, doc.author, doc.date].filter(Boolean);
     if (meta.length > 0)
-        out.push(...wrap(meta.join(" · "), width).map((line) => dim(line)));
+        out.push(...wrap(meta.join(" · "), width).map((line) => dim(line, styled)));
     if (out.length > 0)
         out.push("");
-    out.push(...renderMarkdownText(markdown, width));
+    out.push(...renderMarkdownText(markdown, width, styled));
     return out;
 }
 /**
@@ -54,7 +61,7 @@ export function renderDocText(payload, markdown, width) {
  * paragraphs — so there is no "unknown block" case to guess at; anything else
  * falls through as a wrapped paragraph rather than being dropped.
  */
-export function renderMarkdownText(markdown, width) {
+export function renderMarkdownText(markdown, width, styled) {
     const out = [];
     for (const block of markdown.split("\n\n")) {
         const text = block.trim();
@@ -80,7 +87,7 @@ export function renderMarkdownText(markdown, width) {
                 .map((line) => plain(line.replace(/^>\s?/, "")))
                 .join(" ")
                 .trim();
-            out.push(...wrap(quote, width - 4).map((line) => dim(`    ${line}`)));
+            out.push(...wrap(quote, width - 4).map((line) => dim(`    ${line}`, styled)));
             continue;
         }
         if (text.startsWith("- ")) {
@@ -102,6 +109,11 @@ export function renderMarkdownText(markdown, width) {
  * width, each row is printed as `header: cell` lines instead — narrower, and
  * still every cell. Dropping columns to fit is never an option: a table with a
  * column missing looks complete and is not.
+ *
+ * Column sizes are SCREEN CELLS (BLI-3482). `.length` counts UTF-16 units, so a
+ * name in Japanese under-padded by one cell per character and a column of
+ * emoji over-padded by one — the fits/does-not-fit decision was measured in
+ * the same wrong unit, which is how a table that fits chose the narrow layout.
  */
 function renderTable(block, width) {
     const rows = block
@@ -121,12 +133,12 @@ function renderTable(block, width) {
     const columns = Math.max(...rows.map((cells) => cells.length));
     const widths = [];
     for (let index = 0; index < columns; index += 1) {
-        widths.push(Math.max(...rows.map((cells) => (cells[index] ?? "").length)));
+        widths.push(Math.max(...rows.map((cells) => displayWidth(cells[index] ?? ""))));
     }
     const tableWidth = widths.reduce((sum, value) => sum + value, 0) + 2 * (columns - 1);
     if (tableWidth <= width) {
         return rows.map((cells) => cells
-            .map((cell, index) => cell.padEnd(index === columns - 1 ? 0 : (widths[index] ?? 0)))
+            .map((cell, index) => padEndDisplay(cell, index === columns - 1 ? 0 : (widths[index] ?? 0)))
             .join("  ")
             .trimEnd());
     }
@@ -160,7 +172,10 @@ export function sectionSlice(markdown, sections, sectionId) {
     return blocks.slice(start, end).join("\n\n").trim();
 }
 // ----------------------------------------------------------------- small parts
-/** Greedy word wrap. A word longer than the column keeps its own line, uncut. */
+/**
+ * Greedy word wrap, measured in screen cells. A word longer than the column
+ * keeps its own line, uncut.
+ */
 export function wrap(text, width) {
     const limit = Math.max(20, width);
     const words = text.split(/\s+/u).filter(Boolean);
@@ -168,17 +183,22 @@ export function wrap(text, width) {
         return [];
     const lines = [];
     let line = "";
+    let lineWidth = 0;
     for (const word of words) {
+        const wordWidth = displayWidth(word);
         if (!line) {
             line = word;
+            lineWidth = wordWidth;
             continue;
         }
-        if (line.length + 1 + word.length <= limit) {
+        if (lineWidth + 1 + wordWidth <= limit) {
             line = `${line} ${word}`;
+            lineWidth += 1 + wordWidth;
         }
         else {
             lines.push(line);
             line = word;
+            lineWidth = wordWidth;
         }
     }
     lines.push(line);
@@ -190,7 +210,4 @@ function plain(text) {
         .replace(/\*\*(.+?)\*\*/gu, "$1")
         .replace(/\*(.+?)\*/gu, "$1")
         .replace(/\\\|/gu, "|");
-}
-function dim(text) {
-    return `${DIM}${text}${RESET}`;
 }

package/dist/commands/workbook.js

@@ -14,7 +14,7 @@
  * on the two supported host families; `cockpit workbook tower workbook | less`
  * is the person's decision to make, not this command's.
  */
-import { writeLine, writeRaw } from "./cli-io.js";
+import { colorEnabled, writeLine, writeRaw } from "./cli-io.js";
 import { renderDocText, renderShelf, sectionSlice, } from "./workbook-render.js";
 import { loadPairedSession, towerFailureDetail, towerJsonRequest, } from "../tower-client.js";
 const READ_DEADLINE_MS = 30_000;
@@ -52,6 +52,7 @@ export async function runWorkbook(command, io) {
 // -------------------------------------------------------------------- index
 function writeIndex(command, io, payload, width) {
     const projects = payload.projects ?? [];
+    const styled = colorEnabled(io);
     if (command.project) {
         const found = projects.find((project) => project.slug === command.project);
         if (!found) {
@@ -73,7 +74,7 @@ function writeIndex(command, io, payload, width) {
             writeLine(io.stdout, JSON.stringify({ ok: true, project: found }));
         }
         else {
-            for (const line of renderShelf([found], width))
+            for (const line of renderShelf([found], width, styled))
                 writeLine(io.stdout, line);
         }
         logIndexRead(io, [found]);
@@ -83,7 +84,7 @@ function writeIndex(command, io, payload, width) {
         writeLine(io.stdout, JSON.stringify({ ok: true, projects }));
     }
     else {
-        for (const line of renderShelf(projects, width))
+        for (const line of renderShelf(projects, width, styled))
             writeLine(io.stdout, line);
     }
     logIndexRead(io, projects);
@@ -134,7 +135,8 @@ function writeDoc(command, io, payload, width) {
         writeRaw(io.stdout, selected);
     }
     else {
-        for (const line of renderDocText(payload, selected, width))
+        const lines = renderDocText(payload, selected, width, colorEnabled(io));
+        for (const line of lines)
             writeLine(io.stdout, line);
     }
     writeLine(io.stderr, `[workbook cli] doc read ${JSON.stringify({

package/dist/evidence-upload-client.js

@@ -102,14 +102,39 @@ export async function uploadRawEvidenceFilesChunked(options) {
         // (after retries) covers a new dashboard whose ledger migration has not
         // been applied yet. Both still serve the legacy v1 route.
         if (begin.status === 404 || begin.status >= 500) {
+            // Until BLI-3483 this downgrade abandoned the entire chunked path
+            // without a word, and the comment above named two causes that the fleet
+            // had no way to tell apart — an old dashboard versus an unapplied ledger
+            // migration. This is the BLI-2528 shape exactly: the code knew, the
+            // operator did not. Once per run, because `break` leaves the loop.
+            console.error("[evidence-upload] chunked upload unavailable; falling back to the legacy single-shot route", JSON.stringify({
+                reason: begin.status === 404
+                    ? "begin_route_absent"
+                    : "begin_server_error_after_retries",
+                http_status: begin.status,
+                server_reason: safeFailureDetail(begin.body) ?? "none",
+                objects_in_batch: batch.length,
+                objects_unresolved: loaded.length - resolvedEntries.size,
+            }));
             beginUnavailable = true;
             break;
         }
         if (!begin.ok) {
+            // The server's own `{ reason }` sat unread in this body while the ledger
+            // recorded the transport status and nothing else (BLI-3483); the commit
+            // path has read it since BLI-2528 and this one now does the same.
+            const beginDetail = safeFailureDetail(begin.body);
+            const beginReason = `begin_failed_http_${begin.status}${beginDetail ? `_${beginDetail}` : ""}`;
+            console.error("[evidence-upload] begin refused these objects", JSON.stringify({
+                reason: "begin_rejected",
+                http_status: begin.status,
+                server_reason: beginDetail ?? "none",
+                objects_in_batch: batch.length,
+            }));
             for (const entry of batch) {
-                outcomes.push(failedOutcome(entry.file, `begin_failed_http_${begin.status}`));
+                outcomes.push(failedOutcome(entry.file, beginReason));
                 for (const duplicate of entry.duplicates) {
-                    outcomes.push(failedOutcome(duplicate, `begin_failed_http_${begin.status}`));
+                    outcomes.push(failedOutcome(duplicate, beginReason));
                 }
                 resolvedEntries.add(entry);
             }
@@ -286,7 +311,21 @@ async function uploadOneObject(options, entry, disposition, chunkSizeBytes) {
                 content_base64: chunk.toString("base64"),
             });
             if (!chunkResponse.ok) {
-                return failedOutcome(entry.file, `chunk_${index}_failed_http_${chunkResponse.status}`, uploadedChunks);
+                // Same treatment the commit path has had since BLI-2528: the server's
+                // own reason rides on the label, so `chunk_3_failed_http_413` becomes
+                // `chunk_3_failed_http_413_object_too_large` and the ledger row names
+                // the cause instead of the transport (BLI-3483).
+                const chunkDetail = safeFailureDetail(chunkResponse.body);
+                console.error("[evidence-upload] chunk rejected", JSON.stringify({
+                    reason: "chunk_rejected",
+                    upload_id: disposition.upload_id,
+                    http_status: chunkResponse.status,
+                    server_reason: chunkDetail ?? "none",
+                    chunk_index: index,
+                    chunk_count: entry.chunkCount,
+                    uploaded_chunk_count: uploadedChunks,
+                }));
+                return failedOutcome(entry.file, `chunk_${index}_failed_http_${chunkResponse.status}${chunkDetail ? `_${chunkDetail}` : ""}`, uploadedChunks);
             }
             uploadedChunks += 1;
         }

package/dist/local-state.js

@@ -10,6 +10,7 @@ import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
 import { summarizeInstallEventOutbox } from "./spool/install-event-outbox.js";
 import { readRawEvidenceStagingState, summarizeStuckEvidence, } from "./raw-evidence-staging.js";
 import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { serverFailureDetail } from "./upload-http.js";
 const localCollectorPackage = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export const LOCAL_COLLECTOR_VERSION = typeof localCollectorPackage.version === "string"
     ? localCollectorPackage.version
@@ -671,7 +672,7 @@ async function postPairStart(fetchImpl, dashboardUrl, body, accessToken) {
     });
     const parsed = await readResponseJson(response);
     if (!response.ok) {
-        throw new Error(responseErrorMessage(parsed, "Pair request failed"));
+        throw new Error(pairFailureMessage("Pair request failed", response, parsed));
     }
     return parsePairStartResponse(parsed);
 }
@@ -692,7 +693,7 @@ async function pollPairRequest(fetchImpl, dashboardUrl, options) {
         });
         const parsed = await readResponseJson(response);
         if (!response.ok) {
-            throw new Error(responseErrorMessage(parsed, "Pair polling failed"));
+            throw new Error(pairFailureMessage("Pair polling failed", response, parsed));
         }
         const status = readStringField(parsed, "status");
         if (status === "approved") {
@@ -713,6 +714,30 @@ async function pollPairRequest(fetchImpl, dashboardUrl, options) {
     }
     throw new Error("Timed out waiting for dashboard approval. Run `cockpit login` again.");
 }
+/**
+ * What `cockpit login` tells the operator when pairing is refused.
+ *
+ * "Pair request failed" was the whole message — five words, while the status
+ * code sat in hand (BLI-3483). A 401 (this build's token is not accepted), a
+ * 403 (the dashboard knows the device and is refusing it), a 404 (wrong
+ * dashboard URL) and a 502 (something in front of the dashboard answered) are
+ * four different next actions, and the operator could not tell them apart.
+ * `upload.ts` has named its HTTP status since it was written; this is the same
+ * shape. The server's own words come first when it supplied any, and the status
+ * always rides at the end so it is never the thing that got dropped.
+ *
+ * Logged as well as thrown: `cockpit login` failures happen on a machine that
+ * is not collecting yet, so the terminal is the only receipt there is.
+ */
+function pairFailureMessage(fallback, response, body) {
+    const serverWords = responseErrorMessage(body, fallback);
+    console.error("[local-state] pairing request refused", JSON.stringify({
+        reason: fallback === "Pair request failed" ? "pair_start_refused" : "pair_poll_refused",
+        http_status: response.status,
+        server_reason: serverFailureDetail(body) ?? "none",
+    }));
+    return `${serverWords} (HTTP ${response.status})`;
+}
 async function readResponseJson(response) {
     const text = await response.text();
     if (!text)

package/dist/upload-agent-artifacts.js

@@ -12,7 +12,7 @@
  */
 import { AgentImageArtifactReportRequestSchema, } from "@bli-cockpit/telemetry-core";
 import { describeError } from "./health-detail.js";
-import { readResponseJson } from "./upload-http.js";
+import { readResponseJson, serverFailureDetail } from "./upload-http.js";
 export async function reportAgentImageArtifacts(options) {
     const artifacts = agentArtifactsFromEvidence(options);
     if (artifacts.length === 0) {
@@ -37,7 +37,15 @@ export async function reportAgentImageArtifacts(options) {
             },
             body: JSON.stringify(payload),
         });
+        // Both non-2xx branches returned a label and said nothing (BLI-3483). An
+        // image that never gets reported is never redacted and never OCR'd, and
+        // the only place that fact existed was a return value the sync discards.
         if (response.status === 404) {
+            console.error("[agent-artifacts] the dashboard has no agent-artifact route; these images stay unreported", JSON.stringify({
+                reason: "agent_artifact_api_unavailable",
+                http_status: 404,
+                artifact_count: artifacts.length,
+            }));
             return {
                 posted: false,
                 reason: "agent_artifact_api_unavailable",
@@ -45,6 +53,13 @@ export async function reportAgentImageArtifacts(options) {
             };
         }
         if (!response.ok) {
+            const serverReason = serverFailureDetail(await readResponseJson(response));
+            console.error("[agent-artifacts] report refused", JSON.stringify({
+                reason: "report_failed",
+                http_status: response.status,
+                server_reason: serverReason ?? "none",
+                artifact_count: artifacts.length,
+            }));
             return {
                 posted: false,
                 reason: `report_failed_http_${response.status}`,
@@ -55,10 +70,20 @@ export async function reportAgentImageArtifacts(options) {
         const recordedCount = body && typeof body === "object"
             ? Number(body.recorded_count ?? 0)
             : 0;
+        const recorded = Number.isFinite(recordedCount) ? recordedCount : 0;
+        // The success branch too: "some images reported" and "every image
+        // reported" are different facts, and a count that is short of
+        // `artifact_count` is the only warning an operator would ever get.
+        console.error("[agent-artifacts] report recorded", JSON.stringify({
+            reason: "recorded",
+            http_status: response.status,
+            artifact_count: artifacts.length,
+            recorded_count: recorded,
+        }));
         return {
             posted: true,
             reason: "recorded",
-            recorded_count: Number.isFinite(recordedCount) ? recordedCount : 0,
+            recorded_count: recorded,
         };
     }
     catch (error) {