@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/adapters/raw-evidence.js

@@ -1,472 +1,124 @@
-import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, SourceScanResultSchema, } from "@bli-cockpit/telemetry-core";
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import os from "node:os";
+/**
+ * Collect one repo's raw evidence into a private, content-keyed pack.
+ *
+ * This is the content guard between "a transcript exists on this laptop" and
+ * "these bytes may become durable evidence". Attribution before it only reads
+ * metadata; the server commit after it is the second guard.
+ *
+ * The pass, in order:
+ *
+ * 1. **Open a staging directory.** The pack's id comes from its content, so it
+ *    cannot be known yet (BLI-3066). Bytes land in `.staging-<pid>-<rand>`.
+ * 2. **Record what attribution already knew** — every session it scanned and
+ *    every one it could not name, as completeness records, before a single byte
+ *    is read.
+ * 3. **Collect** every source: Codex transcripts, Claude transcripts and their
+ *    subagent sidecars, images explicitly attached to either, and the two git
+ *    diffs.
+ * 4. **Finish** one of three ways — empty, promoted, or failed — each reporting
+ *    the same facts, pointers and scan.
+ *
+ * Three doctrines hold everywhere in this family:
+ *
+ * - **Nothing gets in the way of collecting a session.** Redaction masks and
+ *   continues; it never drops a file.
+ * - **A failure must name itself.** Every path that declines a file records a
+ *   reason label in the gap ledger.
+ * - **Never succeed silently either.** Staging, reuse, holds and failures all
+ *   log metadata — ids, sizes, counts, reason labels. Never content, never a
+ *   local path.
+ *
+ * Who owns what (BLI-3586 moved the bodies out; every public name is still
+ * exported from this file, so no consumer's import changed):
+ *
+ * | module                          | owns                                    |
+ * | ------------------------------- | --------------------------------------- |
+ * | `raw-evidence-collection-state` | what a pass carries, its budget, staging bytes |
+ * | `raw-evidence-codex-reader`     | Codex transcripts, and the capped fallback walk |
+ * | `raw-evidence-claude-reader`    | Claude mains, sidecars, the D7/D9 outcomes |
+ * | `raw-evidence-image-reader`     | images attached to either transcript    |
+ * | `raw-evidence-git-diff-reader`  | the unstaged and staged diffs           |
+ * | `raw-evidence-transcript-file`  | one transcript, end to end              |
+ * | `raw-evidence-sanitize`         | masking, and the receipt it leaves      |
+ * | `raw-evidence-facts`            | the three endings, the pointers, the scan |
+ * | `raw-evidence-completeness`     | the gap ledger                          |
+ * | `raw-evidence-manifest`         | what we say about a file                |
+ * | `raw-evidence-pack-store`       | where the bytes live                    |
+ * | `raw-evidence-keys`             | naming                                  |
+ * | `raw-evidence-git-diff`         | running git                             |
+ * | `raw-evidence-attribution-gaps` | step 2's scan results as ledger records |
+ *
+ * The readers deliberately share one shape — derive the names, guard, mask and
+ * record, hash, check reuse, check budget, then a single `write…ToPack` that
+ * puts the bytes down and adds the manifest entry. They do NOT share one
+ * implementation, because each pushes a different ledger row and logs a
+ * different line, and merging them would change what an operator reads.
+ */
 import path from "node:path";
-import { makeSourceAdapterIdentity, } from "./common.js";
-import { collectAgentImageEvidenceFromJsonlFile, } from "./agent-image-evidence.js";
-import { defaultCodexSessionDirs, } from "./codex-attribution.js";
-import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-policy.js";
-import { describeError } from "../health-detail.js";
-import { contentKeyedRawEvidencePackId, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, evidenceSourceKey, heldSourceKeys, readRawEvidenceStagingState, recordStagedObject, resolveStagedObject, } from "../raw-evidence-staging.js";
-import { isSecretLikePath, safeKeySegment, sha256, shortHash, } from "./raw-evidence-keys.js";
-import { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
-import { countEvidenceEntries, makeEvidenceCompleteness, markBudgetCapApplied, markCapApplied, recordScanned, recordSkipCount, recordTruncationCount, } from "./raw-evidence-completeness.js";
-import { evidenceEntry, pointerFromEntry, RAW_EVIDENCE_BUCKET, } from "./raw-evidence-manifest.js";
-import { chmodPrivate, ensurePrivateDir, persistStagingState, promoteStagedPack, stageManifest, } from "./raw-evidence-pack-store.js";
-import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, REPO_ROOT_MISSING_REASON, RepoRootMissingError, repoRootExists, runGitDiff, } from "./raw-evidence-git-diff.js";
+import { recordClaudeAttributionCompleteness, recordCodexAttributionCompleteness, } from "./raw-evidence-attribution-gaps.js";
+import { ensurePrivateDir } from "./raw-evidence-pack-store.js";
+import { DEFAULT_SESSION_LIMIT, DEFAULT_SINCE_MINUTES, newStagingDir, openCollection, } from "./raw-evidence-collection-state.js";
+import { finishWithEmptyPack, finishWithFailedPack, finishWithPromotedPack, } from "./raw-evidence-facts.js";
+import { collectCodexJsonlFiles } from "./raw-evidence-codex-reader.js";
+import { collectClaudeJsonlFiles } from "./raw-evidence-claude-reader.js";
+import { collectGitDiffFiles } from "./raw-evidence-git-diff-reader.js";
 // Re-exported so every consumer keeps importing from `adapters/raw-evidence`.
 export { RAW_EVIDENCE_BUCKET, RAW_EVIDENCE_RETENTION_MODE, } from "./raw-evidence-manifest.js";
 export { sanitizeTextEvidenceForUpload } from "./raw-evidence-sanitize.js";
-const DEFAULT_SINCE_MINUTES = 24 * 60;
-const DEFAULT_SESSION_LIMIT = 50;
-// Per-sync upload budgets enforced at COLLECTION time (D7b). A single marathon
-// transcript can approach the 500 MiB wire cap (RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES),
-// so 2 GiB leaves room for several files without starving the sync; overflow
-// still defers and converges.
-export const RAW_EVIDENCE_DEFAULT_BYTE_BUDGET = 2 * 1024 * 1024 * 1024;
-export const RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET = 300;
-const CLAUDE_MAX_COLLECT_FILE_BYTES = RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES;
-// ---------------------------------------------------------------------------
-// The pass
-// ---------------------------------------------------------------------------
+export { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "./raw-evidence-collection-state.js";
+/**
+ * Decide which bytes on this laptop are allowed to become durable evidence for
+ * one repo, and put exactly those into one private, content-keyed pack.
+ *
+ * Never throws: a crash mid-pass still returns facts and a `failed` scan, so a
+ * broken sync is reported rather than silently absent.
+ */
 export async function collectRawEvidencePack(context, options) {
-    const startedAt = context.now.toISOString();
     const rawEvidenceRoot = path.join(options.stateDir, "raw-evidence");
-    // Staging first, promotion second (BLI-3066). The pack id cannot be known
-    // until the content is, so bytes land in a private staging directory and the
-    // directory is then renamed to its content-keyed name — or dropped, when an
-    // identical pack is already there.
-    const stagingDir = path.join(rawEvidenceRoot, `.staging-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
+    const stagingDir = newStagingDir(rawEvidenceRoot);
     const sinceMinutes = options.sinceMinutes ?? DEFAULT_SINCE_MINUTES;
     const collection = await openCollection(context, options, {
         rawEvidenceRoot,
         stagingDir,
     });
     const scanWindow = {
-        startedAt,
+        startedAt: context.now.toISOString(),
         finishedAt: () => context.now.toISOString(),
         sinceMinutes,
     };
+    const run = { stagingDir, window: scanWindow };
     try {
         await ensurePrivateDir(stagingDir);
         await ensurePrivateDir(collection.filesDir);
         recordAttributionCompleteness(collection, options);
-        if (options.includeCodexJsonl !== false) {
-            await collectCodexJsonlFiles(collection, {
-                codexSessionFiles: options.codexSessionFiles,
-                sessionsDir: options.sessionsDir,
-                sessionsDirs: options.sessionsDirs,
-                sinceMinutes,
-                limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
-            });
-        }
-        if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
-            await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
-        }
-        await collectGitDiffFiles(collection, options.repoRoot);
-        if (collection.entries.length === 0) {
-            return await finishWithEmptyPack(collection, options, {
-                stagingDir,
-                window: scanWindow,
-            });
-        }
-        return await finishWithPromotedPack(collection, options, {
-            stagingDir,
-            window: scanWindow,
-        });
+        await collectEverySource(collection, options, sinceMinutes);
+        return collection.entries.length === 0
+            ? await finishWithEmptyPack(collection, options, run)
+            : await finishWithPromotedPack(collection, options, run);
     }
     catch (error) {
-        return await finishWithFailedPack(collection, {
-            stagingDir,
-            window: scanWindow,
-            error,
-        });
-    }
-}
-async function openCollection(context, options, places) {
-    const byteBudget = options.byteBudget ?? RAW_EVIDENCE_DEFAULT_BYTE_BUDGET;
-    const objectBudget = options.objectBudget ?? RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET;
-    const staging = await readRawEvidenceStagingState(options.stateDir);
-    return {
-        context,
-        filesDir: path.join(places.stagingDir, "files"),
-        rawEvidenceRoot: places.rawEvidenceRoot,
-        packId: "",
-        staging,
-        heldSources: collectionHeldSources(staging, context.now, options),
-        stagedReusedCount: 0,
-        stagedNewCount: 0,
-        deliveryHeldCount: 0,
-        entries: [],
-        skipped: [],
-        truncated: [],
-        failed: [],
-        redacted: [],
-        reused: [],
-        scanned: new Map(),
-        caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
-        skipContentHashes: options.skipContentHashes ?? new Set(),
-        budget: options.budget ?? {
-            remainingBytes: byteBudget,
-            remainingObjects: objectBudget,
-        },
-        index: { value: 0 },
-    };
-}
-/**
- * Which sources this pass refuses to even read because their delivery is inside
- * a backoff window — none of them, when a person asked for this pass.
- *
- * The bypass is logged rather than assumed: an operator retry that quietly
- * ignored a hold would be as unreadable as the hold that quietly blocked it.
- */
-function collectionHeldSources(staging, now, options) {
-    const held = heldSourceKeys(staging, now);
-    if (deliveryBackoffApplies(options.deliveryMode))
-        return held;
-    if (held.size > 0) {
-        console.error("[raw-evidence] delivery backoff bypassed for operator retry", JSON.stringify({
-            reason: DELIVERY_BACKOFF_BYPASS_REASON,
-            source_count: held.size,
-        }));
+        return await finishWithFailedPack(collection, { ...run, error });
     }
-    return new Set();
-}
-/** Every cap this pass could hit, declared up front and flipped when applied. */
-function startingCaps(options) {
-    return [
-        {
-            source: "raw_evidence",
-            cap_type: "byte_budget",
-            limit: options.byteBudget,
-            observed: options.budget?.remainingBytes ?? options.byteBudget,
-            applied: false,
-        },
-        {
-            source: "raw_evidence",
-            cap_type: "object_budget",
-            limit: options.objectBudget,
-            observed: options.budget?.remainingObjects ?? options.objectBudget,
-            applied: false,
-        },
-        {
-            source: "git_diff",
-            cap_type: "max_bytes_per_diff",
-            limit: MAX_GIT_DIFF_BYTES,
-            applied: false,
-        },
-        {
-            source: "git_diff",
-            cap_type: "timeout_ms",
-            limit: GIT_DIFF_TIMEOUT_MS,
-            applied: false,
-        },
-        {
-            source: "codex_jsonl",
-            cap_type: "max_file_bytes",
-            limit: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-            applied: false,
-        },
-        {
-            source: "claude_jsonl",
-            cap_type: "max_file_bytes",
-            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-            applied: false,
-        },
-        {
-            source: "claude_jsonl_sidecar",
-            cap_type: "max_file_bytes",
-            limit: CLAUDE_MAX_COLLECT_FILE_BYTES,
-            applied: false,
-        },
-    ];
-}
-// ---------------------------------------------------------------------------
-// The three ways a pass ends
-// ---------------------------------------------------------------------------
-/**
- * Nothing collected: drop the staging directory instead of leaving an empty
- * pack behind. This used to leave one empty `work-*` dir per sync.
- */
-async function finishWithEmptyPack(collection, options, run) {
-    await discardStagingDir(run.stagingDir);
-    collection.packId = contentKeyedRawEvidencePackId({
-        workContextId: collection.context.workContextId,
-        contentHashes: [],
-    });
-    await persistStagingState(options.stateDir, collection.staging, collection.context.now.toISOString());
-    const facts = makeEmptyPackFacts(collection, run.window);
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context: collection.context,
-            startedAt: run.window.startedAt,
-            status: "partial",
-            facts,
-        }),
-    };
-}
-async function finishWithPromotedPack(collection, options, run) {
-    const context = collection.context;
-    const entries = collection.entries;
-    // The pack is named by what is in it, never by when it was made. Identical
-    // content on the next sync resolves to the identical directory, which is
-    // the whole fix for BLI-3066.
-    const packId = contentKeyedRawEvidencePackId({
-        workContextId: context.workContextId,
-        contentHashes: entries.map((entry) => entry.content_hash_sha256),
-    });
-    collection.packId = packId;
-    const promotion = await promoteStagedPack({
-        rawEvidenceRoot: collection.rawEvidenceRoot,
-        stagingDir: run.stagingDir,
-        packId,
-        workContextId: context.workContextId,
-        entries,
-    });
-    const evidenceDir = promotion.evidenceDir;
-    rebaseStagedEntriesOntoPack(collection, evidenceDir);
-    const manifestPath = path.join(evidenceDir, "manifest.json");
-    const manifestBytes = await stageManifest({
-        context,
-        packId,
-        manifestPath,
-        entries,
-        skipped: collection.skipped,
-        redacted: collection.redacted,
-        reused: collection.reused,
-        reusePack: promotion.state === "reused",
-    });
-    entries.push(evidenceEntry({
-        context,
-        kind: "manifest",
-        packId,
-        localPath: manifestPath,
-        relativePath: "manifest.json",
-        mediaType: "application/json",
-        redactedSummary: "Local raw evidence pack manifest.",
-        bytes: manifestBytes,
-        // The manifest carries its own content hash in its key, exactly like
-        // every other object in the pack (BLI-3552). Without it the key was
-        // `…/<packId>/manifest.json`, and a pack id is a function of the OTHER
-        // files' hashes — not of the manifest's bytes, which also carry
-        // `created_at`, the ordering-dependent `files[].relative_path`, `branch`,
-        // and the skipped/redacted/reused ledgers. So the same key named
-        // different bytes whenever the pack directory was not adopted verbatim
-        // (a refill, a pruned or wiped state dir, a machine that had never seen
-        // the pack). `begin` then answered `hash_mismatch_committed_object` on
-        // every sync forever, because the new manifest is stable and the old one
-        // is durable. `stageManifest`'s byte-stability trick still stands; it is
-        // now a nice-to-have rather than the only thing between us and a loop.
-        contentAddress: `manifest/${sha256(manifestBytes).slice(0, 16)}.json`,
-    }));
-    await persistStagingState(options.stateDir, collection.staging, context.now.toISOString());
-    console.error("[raw-evidence] pack staged", JSON.stringify({
-        pack_id: packId,
-        stage_state: promotion.state,
-        reason: stageReasonLabel(promotion.state, promotion.priorPackCount),
-        prior_pack_count: promotion.priorPackCount,
-        refilled_file_count: promotion.refilledFileCount,
-        file_count: entries.length,
-        byte_size: totalByteSize(entries),
-        staged_new: collection.stagedNewCount,
-        staged_reused: collection.stagedReusedCount,
-        delivery_held: collection.deliveryHeldCount,
-    }));
-    const facts = {
-        ...packFactsShell(collection, {
-            packId,
-            manifestPath,
-            evidenceDir,
-            window: run.window,
-        }),
-        stage_state: promotion.state,
-        file_count: entries.length,
-        byte_size: totalByteSize(entries),
-        content_kinds: [...new Set(entries.map((entry) => entry.kind))],
-        pointers: entries.map(pointerFromEntry),
-        upload_files: entries.map(uploadFileFromEntry),
-    };
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context,
-            startedAt: run.window.startedAt,
-            status: entries.length > 1 ? "ok" : "partial",
-            facts,
-        }),
-    };
-}
-/**
- * A crashed pass. The staged-object index is deliberately NOT written: this
- * attempt's bookkeeping describes a directory that is about to be deleted.
- */
-async function finishWithFailedPack(collection, run) {
-    collection.failed.push({
-        kind: "raw_evidence",
-        reason: "collection_failed",
-    });
-    // Staging is per-attempt scratch: a crashed pass must not leave a partial
-    // directory behind to be counted, re-hashed or swept later.
-    await discardStagingDir(run.stagingDir);
-    collection.packId =
-        collection.packId ||
-            contentKeyedRawEvidencePackId({
-                workContextId: collection.context.workContextId,
-                contentHashes: collection.entries.map((entry) => entry.content_hash_sha256),
-            });
-    console.error("[raw-evidence] pack collection failed", JSON.stringify({
-        pack_id: collection.packId,
-        reason: "collection_failed",
-        detail: run.error instanceof Error ? run.error.name : typeof run.error,
-        collected_file_count: collection.entries.length,
-        staged_new: collection.stagedNewCount,
-        staged_reused: collection.stagedReusedCount,
-    }));
-    const facts = makeEmptyPackFacts(collection, run.window);
-    return {
-        facts,
-        scan: makeRawEvidenceScan({
-            context: collection.context,
-            startedAt: run.window.startedAt,
-            status: "failed",
-            facts,
-        }),
-    };
-}
-/**
- * A pack with no files of its own: the empty pass and the crashed pass report
- * the same shape, differing only in the scan status and the reason already
- * logged. `evidence_completeness` still carries every gap this pass recorded.
- */
-function makeEmptyPackFacts(collection, scanWindow) {
-    const evidenceDir = path.join(collection.rawEvidenceRoot, collection.packId);
-    return {
-        ...packFactsShell(collection, {
-            packId: collection.packId,
-            manifestPath: path.join(evidenceDir, "manifest.json"),
-            evidenceDir,
-            window: scanWindow,
-        }),
-        stage_state: "empty",
-        file_count: 0,
-        byte_size: 0,
-        content_kinds: [],
-        pointers: [],
-        upload_files: [],
-    };
-}
-/** The counts every ending reports identically, however the pass ended. */
-function packFactsShell(collection, place) {
-    return {
-        pack_id: place.packId,
-        manifest_path: place.manifestPath,
-        evidence_dir: place.evidenceDir,
-        storage_bucket: RAW_EVIDENCE_BUCKET,
-        skipped_count: countEvidenceEntries(collection.skipped),
-        sanitized_count: collection.redacted.length,
-        reused_count: collection.reused.length,
-        staged_reused_count: collection.stagedReusedCount,
-        staged_new_count: collection.stagedNewCount,
-        delivery_held_count: collection.deliveryHeldCount,
-        deferred_byte_budget_count: countDeferred(collection, "deferred_byte_budget"),
-        deferred_object_budget_count: countDeferred(collection, "deferred_object_budget"),
-        evidence_completeness: makeEvidenceCompleteness(collection, {
-            startedAt: place.window.startedAt,
-            finishedAt: place.window.finishedAt(),
-            sinceMinutes: place.window.sinceMinutes,
-        }),
-        reused: collection.reused,
-    };
-}
-function countDeferred(collection, reason) {
-    return countEvidenceEntries(collection.skipped, (entry) => entry.reason === reason);
-}
-function totalByteSize(entries) {
-    return entries.reduce((sum, entry) => sum + entry.byte_size, 0);
-}
-function uploadFileFromEntry(entry) {
-    return {
-        pointer: pointerFromEntry(entry),
-        local_path: entry.local_path,
-        kind: entry.kind,
-        codex_session_id: entry.codex_session_id ?? null,
-        ...(entry.artifact_metadata
-            ? { artifact_metadata: entry.artifact_metadata }
-            : {}),
-    };
-}
-function stageReasonLabel(state, priorPackCount) {
-    if (state === "reused")
-        return "staged_reused";
-    if (state === "restaged_incomplete")
-        return "restaged_incomplete";
-    return priorPackCount > 0 ? "restaged_content_changed" : "staged_new";
 }
 /**
- * Point every entry this pass staged at its home in the promoted pack, and
- * remember the content hash so the next sync can adopt the copy instead of
- * writing it again. Entries adopted from another pack keep their path.
+ * Every kind of evidence this repo can offer, in the order it is read. Codex and
+ * Claude transcripts are each switchable off by the caller; the git diffs are
+ * not, because they are half the evidence of what someone actually changed.
  */
-function rebaseStagedEntriesOntoPack(collection, evidenceDir) {
-    for (const entry of collection.entries) {
-        if (!entry.staged_in_pack)
-            continue;
-        entry.local_path = path.join(evidenceDir, "files", path.basename(entry.local_path));
-        recordStagedObject(collection.staging, entry.content_hash_sha256, {
-            pack_id: collection.packId,
-            relative_path: `files/${path.basename(entry.local_path)}`,
-            byte_size: entry.byte_size,
-            source_key: entry.source_key,
-            staged_at: collection.context.now.toISOString(),
+async function collectEverySource(collection, options, sinceMinutes) {
+    if (options.includeCodexJsonl !== false) {
+        await collectCodexJsonlFiles(collection, {
+            codexSessionFiles: options.codexSessionFiles,
+            sessionsDir: options.sessionsDir,
+            sessionsDirs: options.sessionsDirs,
+            sinceMinutes,
+            limit: options.sessionLimit ?? DEFAULT_SESSION_LIMIT,
         });
     }
-}
-async function discardStagingDir(stagingDir) {
-    await fs
-        .rm(stagingDir, { recursive: true, force: true })
-        .catch(() => undefined);
-}
-function makeRawEvidenceScan(options) {
-    return SourceScanResultSchema.parse({
-        adapter: makeSourceAdapterIdentity("collector_runtime", "raw-evidence-pack"),
-        work_context_id: options.context.workContextId,
-        status: options.status,
-        started_at: options.startedAt,
-        finished_at: options.context.now.toISOString(),
-        events: [
-            {
-                source_event_id: `raw-evidence-pack:${options.facts.pack_id}`,
-                event_type: "raw_evidence_pack_written",
-                occurred_at: options.context.now.toISOString(),
-                redaction: {
-                    privacy_classification: "remote_durable_raw_evidence",
-                    redaction_status: "raw_remote_durable",
-                    redacted_fields: ["local_path"],
-                    raw_evidence_pointer_ids: options.facts.pointers.map((pointer) => pointer.raw_evidence_pointer_id),
-                    redacted_summary: "Raw prompt/response/tool/session/diff evidence harvested to a private durable remote evidence pack.",
-                },
-                raw_evidence_pointers: options.facts.pointers,
-            },
-        ],
-        diagnostic_labels: [
-            `pack_id:${options.facts.pack_id}`,
-            `files:${options.facts.file_count}`,
-            `bytes:${options.facts.byte_size}`,
-            `skipped:${options.facts.skipped_count}`,
-            `reused:${options.facts.reused_count}`,
-            `stage_state:${options.facts.stage_state}`,
-            `staged_new:${options.facts.staged_new_count}`,
-            `staged_reused:${options.facts.staged_reused_count}`,
-            `delivery_held:${options.facts.delivery_held_count}`,
-            `completeness:${options.facts.evidence_completeness.status}`,
-            `truncated:${options.facts.evidence_completeness.totals.truncated_count}`,
-            `deferred:${options.facts.evidence_completeness.totals.deferred_count}`,
-            `failed:${options.facts.evidence_completeness.totals.failed_count}`,
-            ...options.facts.content_kinds.map((kind) => `kind:${kind}`),
-        ],
-    });
+    if (options.includeClaudeJsonl !== false && options.claudeSessionFiles) {
+        await collectClaudeJsonlFiles(collection, options.claudeSessionFiles);
+    }
+    await collectGitDiffFiles(collection, options.repoRoot);
 }
 // ---------------------------------------------------------------------------
 // What attribution already knew
@@ -483,765 +135,4 @@ function recordAttributionCompleteness(collection, options) {
     if (options.claudeAttributionScan) {
         recordClaudeAttributionCompleteness(collection, options.claudeAttributionScan, new Set(options.claudeSessionFiles?.map((file) => file.local_path) ?? []));
     }
-}
-function recordCodexAttributionCompleteness(collection, scan, selectedPaths) {
-    recordScanned(collection, "codex_attribution", scan.scanned_file_count);
-    collection.caps.push({
-        source: "codex_attribution",
-        cap_type: "scan_window_minutes",
-        limit: scan.since_minutes,
-        observed: scan.since_minutes,
-        applied: false,
-    }, {
-        source: "codex_attribution",
-        cap_type: "session_limit",
-        limit: scan.session_limit,
-        observed: scan.discovered_file_count,
-        applied: scan.session_limit_applied,
-    });
-    recordSkipCount(collection, "codex_attribution", "session_limit_overflow", Math.max(0, scan.discovered_file_count - scan.scanned_file_count));
-    recordSkipCount(collection, "codex_attribution", "directory_read_failed", scan.directory_read_failed_count);
-    recordSkipCount(collection, "codex_attribution", "file_stat_failed", scan.stat_failed_count);
-    recordSkipCount(collection, "codex_attribution", "secret_like_directory", scan.secret_path_skipped_count);
-    recordAttributionResultSkips(collection, "codex_attribution", scan.results, selectedPaths);
-}
-function recordClaudeAttributionCompleteness(collection, scan, selectedPaths) {
-    recordScanned(collection, "claude_attribution", scan.scanned_session_count);
-    if (scan.disabled_reason) {
-        recordSkipCount(collection, "claude_attribution", scan.disabled_reason, 1);
-    }
-    collection.caps.push({
-        source: "claude_attribution",
-        cap_type: "scan_window_minutes",
-        limit: scan.since_minutes,
-        observed: scan.since_minutes,
-        applied: false,
-    }, {
-        source: "claude_attribution",
-        cap_type: "session_limit",
-        limit: scan.session_limit,
-        observed: scan.discovered_session_count,
-        applied: scan.session_limit_applied,
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_file_bytes",
-        limit: scan.max_file_bytes,
-        applied: scan.counts.mains_oversized > 0 ||
-            scan.results.some((result) => result.reason === "file_too_large"),
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_sidecar_files",
-        limit: scan.max_sidecar_files,
-        observed: scan.max_sidecar_files + scan.counts.sidecars_capped,
-        applied: scan.counts.sidecars_capped > 0,
-    }, {
-        source: "claude_attribution",
-        cap_type: "max_line_buffer_bytes",
-        limit: scan.max_line_buffer_bytes,
-        applied: scan.counts.oversized_lines_skipped > 0,
-    });
-    recordSkipCount(collection, "claude_attribution", "session_limit_overflow", Math.max(0, scan.discovered_session_count - scan.scanned_session_count));
-    recordSkipCount(collection, "claude_attribution", "secret_like_project_dir", scan.project_dirs_skipped);
-    recordSkipCount(collection, "claude_attribution", "project_dir_read_failed", scan.project_dir_read_failed_count);
-    recordSkipCount(collection, "claude_attribution", "session_stat_failed", scan.session_stat_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_dir_read_failed", scan.sidecar_dir_read_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_stat_failed", scan.sidecar_stat_failed_count);
-    recordSkipCount(collection, "claude_attribution", "sidecar_limit_overflow", scan.counts.sidecars_capped);
-    recordTruncationCount(collection, "claude_attribution", "oversized_jsonl_line", scan.counts.oversized_lines_skipped, { max_bytes: scan.max_line_buffer_bytes });
-    recordAttributionResultSkips(collection, "claude_attribution", scan.results, selectedPaths);
-    for (const result of scan.results) {
-        for (const sidecar of result.sidecar_files) {
-            if (!sidecar.skipped_reason)
-                continue;
-            recordSkipCount(collection, "claude_attribution", `sidecar_${sidecar.skipped_reason}`, 1);
-        }
-    }
-}
-function recordAttributionResultSkips(collection, source, results, selectedPaths) {
-    for (const result of results) {
-        if (isAttributionAccountedFor(result, selectedPaths))
-            continue;
-        const reason = result.state === "skipped"
-            ? result.reason
-            : `attribution_${result.state}:${result.reason}`;
-        recordSkipCount(collection, source, reason, 1);
-    }
-}
-/**
- * Not every unattributed result is a gap. A selected session is being collected
- * by this pass, and a live-sync-safe synthetic target is owned by another
- * workspace's pack — neither is missing evidence.
- */
-function isAttributionAccountedFor(result, selectedPaths) {
-    if (result.state === "attributed")
-        return true;
-    if (selectedPaths.has(result.file_path))
-        return true;
-    return (result.worktree !== null &&
-        isLiveRawEvidenceSyncAttribution(result.state, result.reason, true));
-}
-// ---------------------------------------------------------------------------
-// Codex transcripts
-// ---------------------------------------------------------------------------
-async function collectCodexJsonlFiles(collection, options) {
-    const attributed = Boolean(options.codexSessionFiles);
-    const resolvedCandidates = options.codexSessionFiles
-        ? options.codexSessionFiles.map((file) => ({
-            filePath: file.local_path,
-            codexSessionId: file.codex_session_id,
-        }))
-        : (await walkRecentCodexJsonlFiles(collection, options)).map((filePath) => ({ filePath, codexSessionId: null }));
-    collection.caps.push({
-        source: "codex_jsonl",
-        cap_type: "session_limit",
-        limit: options.limit,
-        observed: resolvedCandidates.length,
-        applied: !attributed && resolvedCandidates.length > options.limit,
-    });
-    const candidates = attributed
-        ? resolvedCandidates
-        : resolvedCandidates.slice(0, options.limit);
-    for (const candidate of candidates) {
-        recordScanned(collection, "codex_jsonl");
-        const codexSessionId = candidate.codexSessionId ?? shortHash(candidate.filePath);
-        const transcriptAccepted = await collectOneEvidenceFile(collection, {
-            filePath: candidate.filePath,
-            kind: "codex_jsonl",
-            sessionId: codexSessionId,
-            mediaType: "application/jsonl",
-            // Guard before read/toString: Codex files can exceed the buffered commit
-            // ceiling just like Claude mains.
-            maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
-            redactedSummary: "Raw Codex JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-            contentAddress: (hash16) => `codex/${safeKeySegment(codexSessionId)}/${hash16}.jsonl`,
-        });
-        if (!transcriptAccepted)
-            continue;
-        await collectAgentImagesFromTranscript(collection, {
-            filePath: candidate.filePath,
-            source: "codex",
-            sessionId: codexSessionId,
-            kind: "codex_image_attachment",
-            contentAddress: (hash16, extension) => `codex/${safeKeySegment(codexSessionId)}/images/${hash16}.${extension}`,
-        });
-    }
-}
-/** The unattributed fallback: every recent Codex transcript on this machine. */
-function walkRecentCodexJsonlFiles(collection, options) {
-    const dirs = options.sessionsDirs ??
-        (options.sessionsDir
-            ? [options.sessionsDir]
-            : defaultCodexSessionDirs(os.homedir()));
-    return walkJsonlFiles(dirs, collection.context.now.getTime() - options.sinceMinutes * 60 * 1000);
-}
-// ---------------------------------------------------------------------------
-// Claude transcripts
-// ---------------------------------------------------------------------------
-async function collectClaudeJsonlFiles(collection, sessions) {
-    recordScanned(collection, "claude_jsonl", sessions.reduce((count, session) => count + 1 + session.sidecar_files.length, 0));
-    for (const session of sessions) {
-        await collectOneClaudeSession(collection, session);
-    }
-}
-async function collectOneClaudeSession(collection, session) {
-    const sessionId = session.claude_session_id;
-    const mainOutcome = await collectClaudeMainFile(collection, session);
-    if (mainOutcome === "collected" || mainOutcome === "damped_reuse") {
-        await collectAgentImagesFromTranscript(collection, {
-            filePath: session.local_path,
-            source: "claude_code",
-            sessionId,
-            kind: "claude_image_attachment",
-            contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/images/${hash16}.${extension}`,
-        });
-    }
-    for (const sidecar of session.sidecar_files) {
-        await collectOneClaudeSidecar(collection, session, sidecar.local_path);
-    }
-}
-/**
- * What happens to a Claude main file, as a decision table:
- *
- * | condition             | main bytes                | outcome             |
- * | --------------------- | ------------------------- | ------------------- |
- * | `main_file_oversized` | skipped `file_too_large`  | `skipped_too_large` |
- * | `skip_main` (D9)      | not re-collected          | `damped_reuse`      |
- * | otherwise             | collected, or named skip  | `collected` / `not_collected` |
- *
- * Its images are collected for every outcome except `skipped_too_large` and
- * `not_collected` — the caller decides that, this function only reports.
- *
- * D7: an oversized main was attributed via a streamed read but its bytes are
- * never uploaded (server commit assembles in memory). Its sidecars still
- * collect. D9 damped: the prior durable copy is still good enough, and the
- * session reports `reused_existing` from cursor state, so no skip is recorded.
- */
-async function collectClaudeMainFile(collection, session) {
-    if (session.main_file_oversized) {
-        collection.skipped.push({
-            kind: "claude_jsonl",
-            label: path.basename(session.local_path),
-            reason: "file_too_large",
-        });
-        return "skipped_too_large";
-    }
-    if (session.skip_main)
-        return "damped_reuse";
-    const accepted = await collectOneEvidenceFile(collection, {
-        filePath: session.local_path,
-        kind: "claude_jsonl",
-        sessionId: session.claude_session_id,
-        mediaType: "application/jsonl",
-        // Re-check size at collection: a main that grew past the cap between
-        // attribution and collection is an honest file_too_large skip, not an
-        // upload_failed at the chunk client.
-        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-        redactedSummary: "Raw Claude Code JSONL transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-        contentAddress: (hash16) => `claude/${safeKeySegment(session.claude_session_id)}/${hash16}.jsonl`,
-    });
-    return accepted ? "collected" : "not_collected";
-}
-async function collectOneClaudeSidecar(collection, session, sidecarPath) {
-    const sessionId = session.claude_session_id;
-    const stem = path.basename(sidecarPath).replace(/\.jsonl$/i, "");
-    const safeSidecarId = isSecretLikePath(stem)
-        ? "redacted-file-name"
-        : safeKeySegment(stem);
-    const sidecarAccepted = await collectOneEvidenceFile(collection, {
-        filePath: sidecarPath,
-        kind: "claude_jsonl_sidecar",
-        sessionId,
-        mediaType: "application/jsonl",
-        maxFileBytes: CLAUDE_MAX_COLLECT_FILE_BYTES,
-        redactedSummary: "Raw Claude Code subagent transcript with prompts, responses, tool arguments, and tool outputs preserved locally.",
-        contentAddress: (hash16) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}-${hash16}.jsonl`,
-    });
-    if (!sidecarAccepted)
-        return;
-    await collectAgentImagesFromTranscript(collection, {
-        filePath: sidecarPath,
-        source: "claude_code",
-        sessionId,
-        sidecarId: safeSidecarId,
-        kind: "claude_image_attachment",
-        contentAddress: (hash16, extension) => `claude/${safeKeySegment(sessionId)}/subagents/${safeSidecarId}/images/${hash16}.${extension}`,
-    });
-}
-async function collectAgentImagesFromTranscript(collection, options) {
-    const result = await collectAgentImageEvidenceFromJsonlFile({
-        filePath: options.filePath,
-        source: options.source,
-        sessionId: options.sessionId,
-        sidecarId: options.sidecarId,
-    });
-    recordScanned(collection, options.kind, result.images.length + result.skipped.length);
-    for (const skipped of result.skipped) {
-        collection.skipped.push({
-            kind: options.kind,
-            label: skipped.label,
-            reason: skipped.reason,
-        });
-    }
-    for (const image of result.images) {
-        await collectOneAgentImageFile(collection, {
-            image,
-            kind: options.kind,
-            sessionId: options.sessionId,
-            contentAddress: options.contentAddress,
-        });
-    }
-}
-async function collectOneAgentImageFile(collection, options) {
-    const raw = options.image.bytes;
-    const contentHash = sha256(raw);
-    const metadata = {
-        ...options.image.metadata,
-        content_hash_sha256: contentHash,
-        byte_size: raw.byteLength,
-    };
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: options.kind,
-            label: options.image.label,
-            content_hash_sha256: contentHash,
-            codex_session_id: options.sessionId,
-            artifact_metadata: metadata,
-        });
-        return;
-    }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        collection.skipped.push({
-            kind: options.kind,
-            label: options.image.label,
-            reason: deferReason,
-        });
-        return;
-    }
-    collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-agent-image-${contentHash.slice(0, 16)}.${options.image.extension}`);
-    const imageSourceKey = evidenceSourceKey({
-        kind: options.kind,
-        sessionId: options.sessionId,
-        label: options.image.label,
-    });
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash,
-        bytes: raw,
-        fileName: path.basename(relativePath),
-        kind: options.kind,
-        sourceKey: imageSourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: options.kind,
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        stagedInPack: staged.staged_in_pack,
-        sourceKey: imageSourceKey,
-        mediaType: metadata.media_type,
-        redactedSummary: "Raw image explicitly attached to an agent session, preserved in private durable storage.",
-        bytes: raw,
-        codexSessionId: options.sessionId,
-        contentAddress: options.contentAddress(contentHash.slice(0, 16), options.image.extension),
-        artifactMetadata: metadata,
-    }));
-}
-// ---------------------------------------------------------------------------
-// One transcript, end to end
-// ---------------------------------------------------------------------------
-/**
- * Reads, secret-guards, content-addresses, budget-checks, and copies one
- * attributed transcript into the pack.
- *
- * Returns whether this file's *content* is accounted for, which is not the same
- * as "was staged": a transcript whose bytes are already durable remotely
- * returns true without staging anything, and its images are still worth
- * collecting. Every false return has pushed a named skip first.
- */
-async function collectOneEvidenceFile(collection, options) {
-    const fileName = path.basename(options.filePath);
-    const secretLikeFileName = isSecretLikePath(fileName);
-    const evidenceLabel = secretLikeFileName ? "[REDACTED_FILE_NAME]" : fileName;
-    const packedFileName = secretLikeFileName ? "redacted-file.jsonl" : fileName;
-    const sourceKey = evidenceSourceKey({
-        kind: options.kind,
-        sessionId: options.sessionId,
-        sourcePath: options.filePath,
-    });
-    const skip = (reason) => {
-        collection.skipped.push({
-            kind: options.kind,
-            label: evidenceLabel,
-            reason,
-        });
-        return false;
-    };
-    // Delivery backoff is checked BEFORE the file is read. An object whose commit
-    // has failed repeatedly costs nothing at all this cycle — no read, no hash,
-    // no copy, no request — and the hold is a named, retryable gap so a held
-    // session cannot make the sync look clean (BLI-3066).
-    if (collection.heldSources.has(sourceKey)) {
-        collection.deliveryHeldCount += 1;
-        skip(DELIVERY_BACKOFF_HOLDING_REASON);
-        console.error("[raw-evidence] delivery backoff holding source", JSON.stringify({
-            reason: DELIVERY_BACKOFF_HOLDING_REASON,
-            kind: options.kind,
-            source_key: sourceKey,
-        }));
-        return false;
-    }
-    const read = await readEvidenceFileWithinCap(options.filePath, options.maxFileBytes);
-    if (read.status === "read_failed")
-        return skip("file_read_failed");
-    if (read.status === "too_large") {
-        markCapApplied(collection, options.kind, "max_file_bytes");
-        return skip("file_too_large");
-    }
-    const raw = read.bytes;
-    const sanitized = sanitizeTextEvidenceForUpload({
-        text: raw.toString("utf8"),
-        originalBytes: raw,
-        redactedFields: [`${options.kind}.body`],
-        secretLikeFileName,
-    });
-    if (sanitized.status === "redacted") {
-        collection.redacted.push({
-            kind: options.kind,
-            label: evidenceLabel,
-            redaction: sanitized.redaction,
-            completenessLabel: sanitized.completenessLabel,
-        });
-        console.error("[raw-evidence] text evidence sanitized", JSON.stringify({
-            kind: options.kind,
-            mode: sanitized.completenessLabel,
-            original_bytes: raw.byteLength,
-            uploaded_bytes: sanitized.bytes.byteLength,
-        }));
-    }
-    const evidenceBytes = sanitized.bytes;
-    // Both branches carry a record now (BLI-3277), so "was anything replaced?" is
-    // the status, never the presence of `redaction`.
-    const redaction = sanitized.redaction;
-    const wasRedacted = sanitized.status === "redacted";
-    const contentHash = sha256(evidenceBytes);
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: options.kind,
-            label: evidenceLabel,
-            content_hash_sha256: contentHash,
-            codex_session_id: options.sessionId,
-        });
-        return true;
-    }
-    const deferReason = admitToBudget(collection.budget, evidenceBytes.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        return skip(deferReason);
-    }
-    collection.index.value += 1;
-    const relativePath = path.join("files", `${String(collection.index.value).padStart(3, "0")}-${shortHash(options.filePath)}-${packedFileName}`);
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash,
-        bytes: evidenceBytes,
-        fileName: path.basename(relativePath),
-        kind: options.kind,
-        sourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: options.kind,
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        mediaType: options.mediaType,
-        redactedSummary: wasRedacted
-            ? `${options.redactedSummary} Secret-like values were deterministically redacted before upload.`
-            : options.redactedSummary,
-        redaction,
-        bytes: evidenceBytes,
-        codexSessionId: options.sessionId,
-        contentAddress: options.contentAddress(contentHash.slice(0, 16)),
-        stagedInPack: staged.staged_in_pack,
-        sourceKey,
-    }));
-    return true;
-}
-/**
- * Size is checked twice on purpose: once by `stat` so an oversized transcript
- * is never buffered at all, and once on the bytes actually read, because a live
- * session can grow between the two.
- */
-async function readEvidenceFileWithinCap(filePath, maxFileBytes) {
-    if (maxFileBytes) {
-        let stat;
-        try {
-            stat = await fs.stat(filePath);
-        }
-        catch (error) {
-            // The caller turns this into the `file_read_failed` skip label, which is
-            // the one label an operator can do nothing with. The file was discovered
-            // moments ago, so a failure here is a rotated session, a permission
-            // problem or a dead symlink — three different answers (BLI-3238).
-            console.error("[raw-evidence] evidence file could not be stat'd", JSON.stringify({
-                reason: "file_read_failed",
-                stage: "stat",
-                ...describeError(error),
-            }));
-            return { status: "read_failed" };
-        }
-        if (stat.size > maxFileBytes)
-            return { status: "too_large" };
-    }
-    let bytes;
-    try {
-        bytes = await fs.readFile(filePath);
-    }
-    catch (error) {
-        console.error("[raw-evidence] evidence file could not be read", JSON.stringify({
-            reason: "file_read_failed",
-            stage: "read",
-            ...describeError(error),
-        }));
-        return { status: "read_failed" };
-    }
-    if (maxFileBytes && bytes.byteLength > maxFileBytes) {
-        return { status: "too_large" };
-    }
-    return { status: "ok", bytes };
-}
-// ---------------------------------------------------------------------------
-// Staging and budgets
-// ---------------------------------------------------------------------------
-/**
- * Put these bytes on disk once.
- *
- * If an earlier sync already staged this exact content and the copy is still
- * there, that copy is used — the uploader only needs a readable path, and it
- * does not care which pack directory holds it. This is the branch that stops
- * one 334 MB rollout from becoming 559 copies while its commit keeps failing.
- */
-async function stageEvidenceBytes(collection, options) {
-    const existing = await resolveStagedObject(collection.rawEvidenceRoot, collection.staging, options.contentHash);
-    if (existing) {
-        collection.stagedReusedCount += 1;
-        console.error("[raw-evidence] staged copy reused", JSON.stringify({
-            reason: "staged_reused",
-            kind: options.kind,
-            content_hash_prefix: options.contentHash.slice(0, 16),
-            byte_size: existing.entry.byte_size,
-            pack_id: existing.entry.pack_id,
-        }));
-        return { local_path: existing.local_path, staged_in_pack: false };
-    }
-    const destination = path.join(collection.filesDir, options.fileName);
-    await fs.writeFile(destination, options.bytes, { mode: 0o600 });
-    await chmodPrivate(destination, 0o600);
-    collection.stagedNewCount += 1;
-    return { local_path: destination, staged_in_pack: true };
-}
-/**
- * Decrements the per-sync budget when a file fits, or returns a deferred-skip
- * reason when it does not. The object budget bounds request count; the byte
- * budget bounds buffered bytes.
- */
-function admitToBudget(budget, byteLength) {
-    if (budget.remainingObjects <= 0)
-        return "deferred_object_budget";
-    if (byteLength > budget.remainingBytes)
-        return "deferred_byte_budget";
-    budget.remainingObjects -= 1;
-    budget.remainingBytes -= byteLength;
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Git diffs
-// ---------------------------------------------------------------------------
-const GIT_DIFF_TARGETS = [
-    { label: "unstaged", args: ["diff", "--no-ext-diff", "--"] },
-    { label: "staged", args: ["diff", "--cached", "--no-ext-diff", "--"] },
-];
-async function collectGitDiffFiles(collection, repoRoot) {
-    // BLI-3551: asked once per root, before either target, so a pruned worktree
-    // costs ONE line instead of one per diff target per session per tick — and
-    // the line says the folder is gone rather than accusing git of failing.
-    if (!(await repoRootExists(repoRoot))) {
-        console.error("[raw-evidence] git diff skipped, repository root is no longer on disk", JSON.stringify({
-            reason: REPO_ROOT_MISSING_REASON,
-            diff_targets_skipped: GIT_DIFF_TARGETS.length,
-            next_action: "nothing to do; the diff returns when the worktree is restored or the session ages out",
-        }));
-        for (const target of GIT_DIFF_TARGETS) {
-            recordScanned(collection, "git_diff");
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: REPO_ROOT_MISSING_REASON,
-            });
-        }
-        return;
-    }
-    for (const target of GIT_DIFF_TARGETS) {
-        recordScanned(collection, "git_diff");
-        let diff;
-        try {
-            diff = await runGitDiff(target.args, repoRoot);
-        }
-        catch (error) {
-            // The root was there a moment ago and is not now (or a second collector
-            // pruned it mid-tick). Same named outcome, still not a git failure.
-            if (error instanceof RepoRootMissingError) {
-                collection.skipped.push({
-                    kind: "git_diff",
-                    label: target.label,
-                    reason: REPO_ROOT_MISSING_REASON,
-                });
-                continue;
-            }
-            // `git_diff_failed` is the skip label and stays. It covers git not being
-            // installed, the folder not being a repo, a locked index and a diff that
-            // exceeded the child-process buffer — and the diff is half the evidence
-            // for what someone actually changed, so losing it quietly matters.
-            console.error("[raw-evidence] git diff failed", JSON.stringify({
-                reason: "git_diff_failed",
-                diff_target: target.label,
-                ...describeError(error),
-            }));
-            collection.skipped.push({
-                kind: "git_diff",
-                label: target.label,
-                reason: "git_diff_failed",
-            });
-            continue;
-        }
-        if (diff.truncated) {
-            markCapApplied(collection, "git_diff", diff.truncationCapType);
-            collection.truncated.push({
-                kind: "git_diff",
-                reason: diff.truncationReason,
-                ...(diff.truncationCapType === "max_bytes_per_diff"
-                    ? { max_bytes: MAX_GIT_DIFF_BYTES }
-                    : {}),
-                observed_bytes: diff.observedBytes,
-                included_bytes: Buffer.byteLength(diff.stdout, "utf8"),
-            });
-        }
-        // An empty diff is not a gap: there was simply nothing to record. The
-        // truncation marker above still stands even when zero bytes survived.
-        if (!diff.stdout.trim())
-            continue;
-        await stageOneGitDiff(collection, {
-            label: target.label,
-            diffText: diff.stdout,
-            truncated: diff.truncated,
-        });
-    }
-}
-async function stageOneGitDiff(collection, target) {
-    const sanitized = sanitizeTextEvidenceForUpload({
-        text: target.diffText,
-        redactedFields: [`git_diff.${target.label}`],
-    });
-    if (sanitized.status === "redacted") {
-        collection.redacted.push({
-            kind: "git_diff",
-            label: target.label,
-            redaction: sanitized.redaction,
-            completenessLabel: sanitized.completenessLabel,
-        });
-        console.error("[raw-evidence] git diff sanitized", JSON.stringify({
-            mode: sanitized.completenessLabel,
-            original_bytes: Buffer.byteLength(target.diffText, "utf8"),
-            uploaded_bytes: sanitized.bytes.byteLength,
-        }));
-    }
-    const raw = sanitized.bytes;
-    const redaction = sanitized.redaction;
-    const wasRedacted = sanitized.status === "redacted";
-    const contentHash = sha256(raw);
-    if (collection.skipContentHashes.has(contentHash)) {
-        collection.reused.push({
-            kind: "git_diff",
-            label: target.label,
-            content_hash_sha256: contentHash,
-            codex_session_id: null,
-        });
-        return;
-    }
-    const deferReason = admitToBudget(collection.budget, raw.byteLength);
-    if (deferReason) {
-        markBudgetCapApplied(collection, deferReason);
-        collection.skipped.push({
-            kind: "git_diff",
-            label: target.label,
-            reason: deferReason,
-        });
-        return;
-    }
-    const relativePath = path.join("files", `git-${target.label}.diff`);
-    const diffSourceKey = evidenceSourceKey({
-        kind: "git_diff",
-        sessionId: collection.context.workContextId,
-        label: target.label,
-    });
-    const staged = await stageEvidenceBytes(collection, {
-        contentHash,
-        bytes: raw,
-        fileName: path.basename(relativePath),
-        kind: "git_diff",
-        sourceKey: diffSourceKey,
-    });
-    collection.entries.push(evidenceEntry({
-        context: collection.context,
-        kind: "git_diff",
-        packId: collection.packId,
-        localPath: staged.local_path,
-        relativePath,
-        stagedInPack: staged.staged_in_pack,
-        sourceKey: diffSourceKey,
-        mediaType: "text/x-diff",
-        redactedSummary: gitDiffSummary(target.label, {
-            redacted: wasRedacted,
-            truncated: target.truncated,
-        }),
-        redaction,
-        bytes: raw,
-        contentAddress: `git-diff/${target.label}-${contentHash.slice(0, 16)}.diff`,
-    }));
-}
-function gitDiffSummary(label, state) {
-    if (state.redacted) {
-        return `Raw git ${label} diff preserved locally with env/secret paths excluded and secret-like values deterministically redacted.`;
-    }
-    if (state.truncated) {
-        return `Raw git ${label} diff truncated to the capture cap and preserved locally with env/secret paths excluded.`;
-    }
-    return `Raw git ${label} diff preserved locally with env/secret paths excluded.`;
-}
-// ---------------------------------------------------------------------------
-// Walking the session store
-// ---------------------------------------------------------------------------
-/**
- * Newest-first `.jsonl` files under these directories, modified since `cutoffMs`.
- *
- * Secret-like directory and file names are never descended into or opened;
- * symlinked duplicates are collapsed by real path so one transcript reachable
- * two ways is collected once.
- */
-async function walkJsonlFiles(dir, cutoffMs) {
-    const out = [];
-    const stack = Array.isArray(dir) ? [...dir] : [dir];
-    const seen = new Set();
-    // Counted rather than logged per directory: a wide walk can hit many, and
-    // the useful signal is "N directories in the session store were skipped and
-    // here is the first reason", not N near-identical lines (BLI-3238).
-    let unreadableDirCount = 0;
-    let firstUnreadableDir = null;
-    while (stack.length > 0) {
-        const current = stack.pop();
-        if (!current || isSecretLikePath(current))
-            continue;
-        let entries;
-        try {
-            entries = await fs.readdir(current, { withFileTypes: true });
-        }
-        catch (error) {
-            // A directory that cannot be listed hides every session under it, and
-            // the walk's only visible effect is a smaller file count.
-            unreadableDirCount += 1;
-            firstUnreadableDir ??= describeError(error);
-            continue;
-        }
-        for (const entry of entries) {
-            const full = path.join(current, entry.name);
-            if (isSecretLikePath(full))
-                continue;
-            if (entry.isDirectory()) {
-                stack.push(full);
-                continue;
-            }
-            if (!entry.isFile() || !entry.name.endsWith(".jsonl"))
-                continue;
-            const stat = await fs.stat(full);
-            if (stat.mtimeMs < cutoffMs)
-                continue;
-            const dedupeKey = await fs.realpath(full).catch(() => path.resolve(full));
-            if (seen.has(dedupeKey))
-                continue;
-            seen.add(dedupeKey);
-            out.push({ file: full, mtimeMs: stat.mtimeMs });
-        }
-    }
-    if (unreadableDirCount > 0) {
-        console.error("[raw-evidence] session-store directories skipped during the walk", JSON.stringify({
-            reason: "session_dir_unreadable",
-            unreadable_dir_count: unreadableDirCount,
-            found_file_count: out.length,
-            ...firstUnreadableDir,
-        }));
-    }
-    out.sort((a, b) => b.mtimeMs - a.mtimeMs);
-    return out.map((entry) => entry.file);
 }