@bli-cockpit/cli 0.2.49 → 0.2.51

package/dist/commands/backfill.js

@@ -3,48 +3,52 @@
  * every-15-minutes sync was never running to see.
  *
  * Read `runBackfill` below as the table of contents. It is four stages, in
- * order, and every function in this file belongs to exactly one of them:
+ * order, and every part of this command lives in exactly one of them:
  *
- *   SCAN    resolveBackfillScope   paired? which roots, stores and window
- *           scanBackfillSessions   read both stores into candidates
- *           auditScannedCandidates census what could not be accounted for
- *   PLAN    planBackfillRun        confirm `--all`, or answer a `--dry-run`
- *   UPLOAD  uploadBackfillBatches  sync in batches under the shared lock
- *   REPORT  reportBackfillOutcome  post, checkpoint, decide, assemble
+ *   SCAN    backfill-scan.ts       which roots, stores and window; read both
+ *                                  stores into candidates; census the gaps
+ *   PLAN    backfill-plan.ts       confirm `--all`, or answer a `--dry-run`
+ *   UPLOAD  backfill-upload.ts     sync in batches under the shared lock
+ *   REPORT  backfill-report.ts     post, checkpoint, decide, assemble
  *
- * Two rules run through all four and explain most of the apparent complexity.
- * First, a session may never be silently dropped: everything the scan could
- * not account for lands on the issue ledger and everything a person reads
- * names its own reason. Second, the cursor is the only irreversible thing here
- * — it advances solely through a contiguous prefix of sessions that both
- * earned a durable pointer and were acknowledged by the server, so a
+ * The supporting modules each own one thing the stages share:
+ *
+ *   backfill-types.ts              the shapes every stage passes along
+ *   backfill-command-line.ts       the flag surface and the retry command
+ *   backfill-scope.ts              paired? which roots, sources and window
+ *   backfill-candidates.ts         one session's identity and ordering
+ *   backfill-batches.ts            what is uploadable, cut into batches
+ *   backfill-issues.ts             the ledger of what could not be accounted for
+ *   backfill-reasons.ts            the skip-reason table an operator reads
+ *   backfill-evidence-outcomes.ts  what one upload achieved per session
+ *   backfill-session-report.ts     one attribution row per session seen
+ *   backfill-checkpoint.ts         the durable cursor and pointer writes
+ *   backfill-result.ts             the `--json` payload
+ *   backfill-output.ts             every line and prompt a person sees
+ *
+ * Two rules run through all four stages and explain most of the apparent
+ * complexity. First, a session may never be silently dropped: everything the
+ * scan could not account for lands on the issue ledger and everything a person
+ * reads names its own reason. Second, the cursor is the only irreversible
+ * thing here — it advances solely through a contiguous prefix of sessions that
+ * both earned a durable pointer and were acknowledged by the server, so a
  * misjudged "resolved" loses that history for good.
  */
-import { NO_UPLOAD_ATTEMPT_RECORDED, RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES, notUploadableAttributionStateReason } from "@bli-cockpit/telemetry-core";
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { describeError } from "../health-detail.js";
-import { scanAndAttributeClaudeSessions } from "../adapters/claude-attribution.js";
-import { defaultCodexSessionDirs, scanAndAttributeCodexSessions } from "../adapters/codex-attribution.js";
-import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET } from "../adapters/raw-evidence.js";
-import { acquireBackfillLock, } from "../backfill-lock.js";
-import { BACKFILL_COMPLETION_RECHECK_MS, BACKFILL_COVERAGE_VERSION, emptyBackfillCursorState, prepareBackfillCursorForScope, readBackfillCursor, recordBackfillCursorObservations, recordBackfillScanCoverage, writeBackfillCompletionMarker, writeBackfillCursor, } from "../cursors/backfill-cursor.js";
-import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
-import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, startLocalWorkContext } from "../local-state.js";
-import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
-import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
-import { normalizeCollectionRoots } from "../root-normalization.js";
+import { acquireBackfillLock } from "../backfill-lock.js";
+import { writeBackfillCursor } from "../cursors/backfill-cursor.js";
 import { acquireSyncLock } from "../sync-lock.js";
-import { LocalUploadBlockedError, postCodexSessionReport, syncLocalAmbientEnvelope } from "../upload.js";
-const BACKFILL_UPLOAD_BATCH_SESSIONS = 25;
-const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
-const ALL_BACKFILL_SINCE_MINUTES = 20 * 365 * 24 * 60;
-// Window a bare `cockpit backfill` uses. Wide enough to cover a new machine's
-// recent history and an intern who went quiet for a few weeks, narrow enough
-// that it is not the whole-history scan `--all` deliberately gates.
-export const DEFAULT_BACKFILL_SINCE_DAYS = 30;
+import { DEFAULT_BACKFILL_SINCE_DAYS, backfillRetryCommand, defaultBackfillWindowNotice, } from "./backfill-command-line.js";
+import { isInteractiveStdin, writeHumanBackfillResult, writeLine, } from "./backfill-output.js";
+import { planBackfillRun } from "./backfill-plan.js";
+import { reportBackfillOutcome } from "./backfill-report.js";
+import { lockHeldResult } from "./backfill-result.js";
+import { scanBackfillRun } from "./backfill-scan.js";
+import { uploadBackfillBatches } from "./backfill-upload.js";
+// The command's public surface. Callers (doctor, onboard, local, the CLI
+// router, the BLI-3272 regression test) import these from `./backfill.js`;
+// which sibling implements one is this module's business, not theirs.
+export { DEFAULT_BACKFILL_SINCE_DAYS, backfillRetryCommand } from "./backfill-command-line.js";
+export { buildBackfillSessionReport } from "./backfill-session-report.js";
 export async function runBackfillCommand(command, io) {
     // A bare `cockpit backfill` used to refuse and print three lines telling the
     // operator to pick a window. That put a mandatory flag on the command that
@@ -132,1928 +136,4 @@ export async function runBackfill(command, io) {
         await collectionLock.handle.release();
         await lock.handle.release();
     }
-}
-/**
- * Someone else is already holding a lock this run needs. Reported as blocked
- * with nothing done rather than as a failure — the scan is still valid, and
- * the retry command in it works as soon as the other run finishes.
- */
-function lockHeldResult(command, scanned, blocker) {
-    return {
-        ...baseBackfillResult(command, backfillResultBaseArgs(scanned)),
-        status: "blocked",
-        retry_command: scanned.retryCommand,
-        failure_reason: blocker.failureReason,
-        blocked_at: {
-            what: blocker.what,
-            batch_index: 0,
-            batch_total: 0,
-            done: 0,
-            total: scanned.scan.candidates.length,
-        },
-    };
-}
-/** The `{now, dashboardUrl, sources, window, cursor, scan, reasonCounts}` bag every `baseBackfillResult` call needs. */
-function backfillResultBaseArgs(ctx) {
-    return {
-        now: ctx.now,
-        dashboardUrl: ctx.dashboardUrl,
-        sources: ctx.sources,
-        window: ctx.window,
-        cursor: ctx.cursor,
-        scan: ctx.scan,
-        reasonCounts: ctx.reasonCounts,
-    };
-}
-/**
- * SCAN: is this machine paired, what roots/sources/window apply, and what did
- * the archived Codex + Claude session stores actually contain. Returns either
- * a terminal "not paired" result or everything PLAN/UPLOAD/REPORT need next.
- */
-async function scanBackfillRun(command, io, now) {
-    const paths = getCollectorRuntimePaths(command.homeDir);
-    const scope = await resolveBackfillScope(command, io, now, paths);
-    if (scope.kind === "not_paired") {
-        return {
-            kind: "blocked",
-            result: blockedBackfillResult(command, {
-                now,
-                dashboardUrl: scope.dashboardUrl,
-                reason: "collector_not_paired",
-                cursor: await readBackfillCursor(paths),
-            }),
-        };
-    }
-    const { collectionRoots, sources, worktreeDiscovery } = scope;
-    const storedCursor = command.dryRun
-        ? emptyBackfillCursorState()
-        : await readBackfillCursor(paths);
-    const scopedCursor = prepareBackfillCursorForScope(storedCursor, collectionRoots, sources);
-    const cursor = scopedCursor.cursor;
-    const pointerlessTerminalSessions = await loadPointerlessTerminalSessions(paths, sources);
-    const scan = await scanBackfillSessions({
-        command,
-        homeDir: command.homeDir ?? os.homedir(),
-        worktrees: worktreeDiscovery.worktrees,
-        collectionRoots,
-        sources,
-        window: scope.window,
-        cursor,
-        pointerlessTerminalSessions,
-        now,
-    });
-    const reasonCounts = await auditScannedCandidates(scan, worktreeDiscovery.incomplete_reasons);
-    return {
-        kind: "scanned",
-        now,
-        paths,
-        dashboardUrl: scope.dashboardUrl,
-        sources,
-        window: scope.window,
-        collectionRoots,
-        worktrees: worktreeDiscovery.worktrees,
-        retryCommand: scope.retryCommand,
-        scopedCursor,
-        cursor,
-        scan,
-        reasonCounts,
-        oversizedCandidateKeys: oversizedBackfillCandidateKeys(scan.candidates),
-    };
-}
-/**
- * Answers the four questions every later stage assumes: is this collector
- * paired, which approved roots and repos does it cover, which stores and how
- * far back was it asked for, and — on a dry run — can it even reach the
- * dashboard. Nothing here reads a session; a machine that is not paired stops
- * before any history is touched.
- */
-async function resolveBackfillScope(command, io, now, paths) {
-    const config = await readLocalCollectorConfig(paths);
-    const sessionFile = await readLocalCollectorSessionFile(paths);
-    const session = await readLocalSessionReference(paths);
-    if (session.session_state !== "valid") {
-        return {
-            kind: "not_paired",
-            dashboardUrl: sessionFile.dashboard_url ?? config.dashboard_url,
-        };
-    }
-    const pairedAt = parseRequiredDate(sessionFile.paired_at, "paired_at");
-    const dashboardUrl = normalizeDashboardUrl(sessionFile.dashboard_url ?? config.dashboard_url);
-    const roots = backfillCollectionRoots(command, config.default_repo_paths);
-    const collectionRoots = normalizeCollectionRoots(await collectionRootPathAliases(roots));
-    const worktreeDiscovery = await discoverBackfillWorktrees(collectionRoots, command);
-    const window = backfillWindow(command, now, pairedAt);
-    await validateBackfillReachability({
-        fetchImpl: io.fetch,
-        dashboardUrl,
-        dryRun: command.dryRun,
-    });
-    return {
-        kind: "ready",
-        dashboardUrl,
-        collectionRoots,
-        worktreeDiscovery,
-        retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: selectedSources(command.source),
-        window,
-    };
-}
-/**
- * Finishes the scan's ledger before anything acts on it: adds what repo
- * discovery could not enumerate, reads every candidate file once to find the
- * ones this machine cannot actually deliver, and folds all of it into the
- * reason table the operator sees. Mutates `scan` in place — it is the one
- * owner of `issues` and `retryable_candidate_keys` — and returns the table.
- */
-async function auditScannedCandidates(scan, discoveryIncompleteReasons) {
-    addRepoDiscoveryIssues(scan.issues, discoveryIncompleteReasons);
-    sortScanIssuesByPriority(scan.issues);
-    const guards = await countReadOnlyGuards(scan.candidates);
-    scan.retryable_candidate_keys = new Set([
-        ...scan.retryable_candidate_keys,
-        ...guards.retryable_candidate_keys,
-    ]);
-    addReadOnlyGuardIssues(scan.issues, guards.counts);
-    return reasonCountsFor(scan.candidates, guards.counts, scan.issues);
-}
-/**
- * PLAN: given the scan, should this run actually upload anything right now?
- * `--all` without `--yes` needs interactive confirmation; `--dry-run` reports
- * what would happen and stops there. Either returns a terminal result;
- * anything else proceeds to UPLOAD.
- */
-async function planBackfillRun(command, io, ctx) {
-    const { dashboardUrl, scan, reasonCounts } = ctx;
-    if (command.all && !command.yes) {
-        if (!command.json) {
-            writeDryRunSummary(io, {
-                candidates: scan.candidates,
-                reasonCounts,
-                dashboardUrl,
-                dryRunOnly: false,
-            });
-        }
-        const confirmed = await confirmAllBackfill(io);
-        if (!confirmed) {
-            return { kind: "result", result: confirmationDeclinedResult(command, ctx) };
-        }
-    }
-    if (command.dryRun) {
-        if (!command.json) {
-            writeDryRunSummary(io, {
-                candidates: scan.candidates,
-                reasonCounts,
-                dashboardUrl,
-                dryRunOnly: true,
-            });
-        }
-        return { kind: "result", result: dryRunResult(command, ctx) };
-    }
-    return { kind: "proceed" };
-}
-/** The operator saw the `--all` review and said no. Nothing was written; everything remains. */
-function confirmationDeclinedResult(command, ctx) {
-    const base = baseBackfillResult(command, backfillResultBaseArgs(ctx));
-    return {
-        ...base,
-        status: "blocked",
-        counts: { ...base.counts, remaining: ctx.scan.candidates.length },
-        failure_reason: "confirmation_declined",
-    };
-}
-/**
- * What a `--dry-run` would have done. It completes unless the scan itself hit
- * something blocking, because a dry run that reports "complete" over a scan
- * that could not see all the history would be the confident wrong answer.
- */
-function dryRunResult(command, ctx) {
-    const blockingIssues = blockingScanIssues(ctx.scan.issues);
-    return {
-        ...baseBackfillResult(command, backfillResultBaseArgs(ctx)),
-        status: blockingIssues.length > 0 ? "partial" : "complete",
-        dry_run: true,
-        retry_command: ctx.retryCommand,
-        ...(blockingIssues.length > 0
-            ? { failure_reason: blockingIssues[0]?.reason }
-            : {}),
-    };
-}
-/**
- * UPLOAD: sync every uploadable candidate in fixed-size batches, heartbeating
- * the backfill lock between batches, stopping early on an exhausted budget or
- * three consecutive failed batches. A candidate whose main is durably
- * oversized-skipped (BLI-2727) is accounted for, not missing — it will never
- * earn a durable pointer under the current cap, and treating it as "still
- * missing" would fail every batch it happens to share with genuinely uploaded
- * siblings, so it is excluded via `oversizedCandidateKeys` throughout.
- */
-async function uploadBackfillBatches(command, io, lock, ctx) {
-    const uploadable = uploadableCandidates(ctx.scan.candidates);
-    const batches = buildBackfillBatches(uploadable);
-    const rawEvidenceBudget = {
-        remainingBytes: RAW_EVIDENCE_DEFAULT_BYTE_BUDGET,
-        remainingObjects: RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET,
-    };
-    const tally = emptyUploadTally();
-    let consecutiveFailures = 0;
-    let blockedAt;
-    let failureReason = blockingScanIssues(ctx.scan.issues)[0]?.reason;
-    const stoppedAt = (what, index) => ({
-        what,
-        batch_index: index + 1,
-        batch_total: batches.length,
-        done: tally.done,
-        total: uploadable.length,
-    });
-    for (const [index, batch] of batches.entries()) {
-        await lock.handle.heartbeat();
-        const outcome = await uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget);
-        foldBatchIntoTally(tally, batch, outcome);
-        consecutiveFailures = outcome.failed ? consecutiveFailures + 1 : 0;
-        if (!command.json) {
-            writeLine(io.stdout, `Uploaded ${tally.done}/${uploadable.length} (batch ${index + 1}/${batches.length})`);
-        }
-        await yieldToEventLoop();
-        if (outcome.deferred) {
-            blockedAt = stoppedAt("raw evidence budget exhausted", index);
-            failureReason = "deferred_budget_exhausted";
-            break;
-        }
-        if (consecutiveFailures >= BACKFILL_MAX_CONSECUTIVE_FAILURES) {
-            blockedAt = stoppedAt("consecutive upload failures", index);
-            failureReason = failedBatchReason(outcome.sync, outcome.missingDurableMain);
-            break;
-        }
-    }
-    return { ...tally, uploadable, batches, blockedAt, failureReason };
-}
-/** Uploads one batch and judges it; every judgement here is a named predicate. */
-async function uploadOneBackfillBatch(command, io, ctx, batch, rawEvidenceBudget) {
-    const sync = await syncBackfillBatch({
-        command,
-        batch,
-        worktrees: ctx.worktrees,
-        codexAttribution: ctx.scan.codexAttribution,
-        claudeAttribution: ctx.scan.claudeAttribution,
-        rawEvidenceBudget,
-        fetchImpl: io.fetch,
-    });
-    const durableInBatch = durableBackfillCandidateKeys(batch, sync);
-    const missingDurableMain = countMissingDurableMains(batch, durableInBatch, ctx.oversizedCandidateKeys);
-    return {
-        sync,
-        durableInBatch,
-        missingDurableMain,
-        failed: didBatchFail(sync, missingDurableMain),
-        deferred: deferredEvidenceCount(sync) > 0,
-    };
-}
-function emptyUploadTally() {
-    return {
-        syncResults: [],
-        completedBatches: 0,
-        failedBatches: 0,
-        done: 0,
-        failed: 0,
-        deferred: 0,
-        uploadedObjects: 0,
-        uploadedChunks: 0,
-        backfilledSessions: 0,
-        durableCandidateKeys: new Set(),
-    };
-}
-function foldBatchIntoTally(tally, batch, outcome) {
-    tally.syncResults.push(outcome.sync);
-    tally.done += batch.candidates.length;
-    tally.uploadedObjects += outcome.sync.raw_evidence_uploaded_object_count;
-    tally.uploadedChunks += outcome.sync.raw_evidence_uploaded_chunk_count;
-    tally.failed += countSessionUploadFailures(outcome.sync);
-    tally.deferred += deferredEvidenceCount(outcome.sync);
-    for (const key of outcome.durableInBatch)
-        tally.durableCandidateKeys.add(key);
-    tally.backfilledSessions = tally.durableCandidateKeys.size;
-    if (outcome.failed)
-        tally.failedBatches += 1;
-    if (!outcome.failed && !outcome.deferred)
-        tally.completedBatches += 1;
-}
-/** Evidence the server accepted the batch for but had no budget left to store. */
-function deferredEvidenceCount(sync) {
-    return (sync.raw_evidence_deferred_byte_budget +
-        sync.raw_evidence_deferred_object_budget);
-}
-/**
- * Candidates in this batch that still owe a durable main transcript. An
- * oversized skip is excluded (BLI-2727): it can never earn a pointer under the
- * current cap, and counting it here would fail every batch it happens to share
- * with genuinely uploaded siblings.
- */
-function countMissingDurableMains(batch, durableInBatch, oversizedCandidateKeys) {
-    return batch.candidates.filter((candidate) => !durableInBatch.has(candidateCursorKey(candidate)) &&
-        !oversizedCandidateKeys.has(candidateCursorKey(candidate))).length;
-}
-/** A batch counts as failed if it did not upload, lost a session, or left one pointerless. */
-function didBatchFail(sync, missingDurableMain) {
-    return (sync.status !== "uploaded" ||
-        countSessionUploadFailures(sync) > 0 ||
-        missingDurableMain > 0);
-}
-/** Names which of the three failure shapes ended the run, most specific first. */
-function failedBatchReason(sync, missingDurableMain) {
-    if (sync.status === "spooled")
-        return sync.failure_reason;
-    if (missingDurableMain > 0)
-        return "durable_session_pointer_missing";
-    return "upload_failed";
-}
-/**
- * REPORT: post the session report, record durable pointers, advance the
- * cursor through the resolved contiguous prefix, decide completion, write the
- * all-history completion marker when this run actually finished it, and
- * assemble the final result. `remaining`/`completionBlocked` deliberately
- * treat an oversized skip differently (BLI-2727): it still counts toward
- * `remaining` so the JSON output never goes silent about it, but it never
- * blocks completion on its own — every completion-gating computation below
- * excludes it explicitly via `oversizedCandidateKeys`/`blockingScanIssues`.
- */
-async function reportBackfillOutcome(command, io, ctx, upload) {
-    let { blockedAt, failureReason } = upload;
-    const posted = await postBackfillSessionReport(command, io, ctx, upload);
-    if (!posted.acknowledged && !blockedAt) {
-        blockedAt = sessionReportStopPoint(upload);
-        failureReason ??= sessionReportFailureReason(posted);
-    }
-    if (posted.acknowledged) {
-        await checkpointResolvedBackfillProgress(ctx, upload);
-    }
-    const completion = summarizeBackfillCompletion({
-        ctx,
-        upload,
-        posted,
-        stoppedEarly: Boolean(blockedAt),
-        failureReason,
-    });
-    if (completion.status === "complete" && command.all) {
-        await writeAllHistoryCompletionMarker(ctx);
-    }
-    return assembleBackfillResult({
-        command,
-        ctx,
-        upload,
-        posted,
-        completion,
-        blockedAt,
-    });
-}
-/**
- * Tells the server what this run observed about every session, uploaded or
- * not. Its acknowledgement — not raw-evidence durability alone — is what makes
- * a historical cursor position irreversible, so the caller gates the whole
- * checkpoint on the `acknowledged` flag returned here.
- */
-async function postBackfillSessionReport(command, io, ctx, upload) {
-    const sessions = buildBackfillSessionReport({
-        candidates: ctx.scan.candidates,
-        syncResults: upload.syncResults,
-        now: ctx.now,
-    });
-    if (sessions.length === 0) {
-        return {
-            sessions,
-            report: emptyReport("no_sessions_observed"),
-            acknowledged: true,
-        };
-    }
-    const reportContext = await ensureBackfillReportContext({
-        homeDir: command.homeDir,
-        paths: ctx.paths,
-        collectionRoots: ctx.collectionRoots,
-        worktrees: ctx.worktrees,
-        candidates: ctx.scan.candidates,
-    });
-    const report = await postCodexSessionReport({
-        homeDir: command.homeDir,
-        repoRoot: reportContext.repoRoot,
-        dashboardUrl: ctx.dashboardUrl,
-        sessions,
-        fetch: io.fetch,
-        now: ctx.now,
-    });
-    return {
-        sessions,
-        report,
-        acknowledged: report.posted && report.recorded_count >= sessions.length,
-    };
-}
-/** Where a run that uploaded cleanly but could not file its report stopped. */
-function sessionReportStopPoint(upload) {
-    return {
-        what: "session report failed",
-        batch_index: upload.completedBatches,
-        batch_total: upload.batches.length,
-        done: upload.done,
-        total: upload.uploadable.length,
-    };
-}
-/** A partial acknowledgement is its own reason; otherwise the post's own. */
-function sessionReportFailureReason(posted) {
-    return posted.report.posted &&
-        posted.report.recorded_count < posted.sessions.length
-        ? "session_report_ack_incomplete"
-        : posted.report.reason;
-}
-/**
- * Makes this run's progress durable once the server has acknowledged it:
- * session pointers first, then the backfill cursor through the contiguous
- * resolved prefix. Raw-evidence durability is necessary but not sufficient —
- * both writes wait on the report acknowledgement, because a cursor advanced
- * past a session the server never recorded can never be walked back.
- */
-async function checkpointResolvedBackfillProgress(ctx, upload) {
-    const { paths, scan, cursor, now } = ctx;
-    if (upload.durableCandidateKeys.size > 0) {
-        await recordBackfillDurableSessionPointers({
-            paths,
-            candidates: scan.candidates,
-            syncResults: upload.syncResults,
-            now,
-        });
-    }
-    const cursorAdvanced = advanceBackfillCursorThroughResolvedPrefix({
-        cursor,
-        candidates: scan.candidates,
-        durableCandidateKeys: upload.durableCandidateKeys,
-        retryableCandidateKeys: scan.retryable_candidate_keys,
-        discoveryComplete: !scan.issues.some((issue) => issue.scope === "global"),
-        now,
-    });
-    if (cursorAdvanced)
-        await writeBackfillCursor(paths, cursor);
-}
-/**
- * Answers "is this backfill finished, and if not, why not" as pure arithmetic
- * over what the scan found and what the upload resolved — no side effects, so
- * the one place BLI-2727's oversized-skip rule is applied is readable in full.
- * `remaining` is a reporting total that still counts oversized skips so the
- * JSON never goes silent about them; every `*Blocking` count excludes them,
- * because a file too large for the current cap is a permanent labeled fact
- * that no rerun can resolve and completion must not wait on forever.
- */
-function summarizeBackfillCompletion(options) {
-    const { scan, oversizedCandidateKeys } = options.ctx;
-    const { upload, posted } = options;
-    const unresolvedUploadableKeys = new Set(upload.uploadable
-        .filter((candidate) => !upload.durableCandidateKeys.has(candidateCursorKey(candidate)))
-        .map(candidateCursorKey));
-    const unresolvedUploadableBlocking = [...unresolvedUploadableKeys].filter((key) => !oversizedCandidateKeys.has(key)).length;
-    const unresolvedRetryableBlocking = [...scan.retryable_candidate_keys].filter((key) => !oversizedCandidateKeys.has(key)).length;
-    const remaining = countRemainingHistory({
-        scan,
-        unresolvedUploadableKeys,
-        posted,
-    });
-    const failed = Math.max(upload.failed, unresolvedUploadableBlocking);
-    const blockingIssues = blockingScanIssues(scan.issues);
-    const completionBlocked = blockingIssues.length > 0 ||
-        unresolvedUploadableBlocking > 0 ||
-        unresolvedRetryableBlocking > 0 ||
-        upload.deferred > 0 ||
-        failed > 0 ||
-        !posted.acknowledged;
-    let failureReason = options.failureReason;
-    if (!failureReason && completionBlocked) {
-        const retryableCandidateReason = scan.candidates.find((candidate) => scan.retryable_candidate_keys.has(candidateCursorKey(candidate)) &&
-            !oversizedCandidateKeys.has(candidateCursorKey(candidate)))?.reason;
-        failureReason =
-            blockingIssues[0]?.reason ??
-                (unresolvedUploadableBlocking > 0
-                    ? "durable_session_pointer_missing"
-                    : (retryableCandidateReason ?? "backfill_incomplete"));
-    }
-    return {
-        remaining,
-        failed,
-        status: options.stoppedEarly || completionBlocked ? "partial" : "complete",
-        failureReason,
-    };
-}
-/**
- * How much history a rerun still has to do. A reporting total, not a
- * completion gate: it counts every unresolved candidate — oversized skips
- * included, so `--json` never goes silent about them (BLI-2727) — plus what
- * selection dropped, what discovery never saw, and the report itself when the
- * server has not acknowledged it.
- */
-function countRemainingHistory(options) {
-    const unresolvedKnownKeys = new Set([
-        ...options.unresolvedUploadableKeys,
-        ...options.scan.retryable_candidate_keys,
-    ]);
-    const unseenGlobalFailures = options.scan.issues
-        .filter((issue) => issue.scope === "global")
-        .reduce((total, issue) => total + issue.count, 0);
-    const reportRetryable = options.posted.acknowledged
-        ? 0
-        : // The cursor is intentionally all-or-nothing for the report. Even
-            // chunks already accepted by the server are retried idempotently when
-            // another required chunk lacks an acknowledgement.
-            Math.max(1, options.posted.sessions.length);
-    return (unresolvedKnownKeys.size +
-        options.scan.omitted_candidate_count +
-        unseenGlobalFailures +
-        reportRetryable);
-}
-/**
- * Proof, for doctor and status, that archived history is covered. Only an
- * `--all` run earns it: a bounded `--since-days` run may complete its
- * requested window, but that is not proof of an all-history backfill.
- */
-async function writeAllHistoryCompletionMarker(ctx) {
-    const { paths, cursor, sources, scopedCursor, scan, oversizedCandidateKeys, now } = ctx;
-    recordBackfillScanCoverage(cursor, sources, now, now);
-    await writeBackfillCursor(paths, cursor);
-    const oversizedCandidates = scan.candidates.filter((candidate) => oversizedCandidateKeys.has(candidateCursorKey(candidate)));
-    await writeBackfillCompletionMarker(paths, {
-        schema_version: "cockpit-backfill-complete.v2",
-        coverage_version: BACKFILL_COVERAGE_VERSION,
-        collection_scope_id: scopedCursor.collection_scope_id,
-        sources,
-        completed_at: now.toISOString(),
-        revalidate_after: new Date(now.getTime() + BACKFILL_COMPLETION_RECHECK_MS).toISOString(),
-        cursor,
-        ...(oversizedCandidates.length > 0
-            ? {
-                oversized_skips: {
-                    reason: "file_too_large",
-                    count: oversizedCandidates.length,
-                    byte_sizes: oversizedCandidates.map((candidate) => candidate.byte_size),
-                },
-            }
-            : {}),
-    });
-}
-/** The `--json` payload: every stage's numbers merged onto the scan's baseline. */
-function assembleBackfillResult(options) {
-    const { command, ctx, upload, posted, completion } = options;
-    const base = baseBackfillResult(command, backfillResultBaseArgs(ctx));
-    return {
-        ...base,
-        status: completion.status,
-        retry_command: ctx.retryCommand,
-        counts: {
-            ...base.counts,
-            backfilled: upload.backfilledSessions,
-            failed: completion.failed,
-            deferred: upload.deferred,
-            remaining: completion.remaining,
-        },
-        batches: {
-            total: upload.batches.length,
-            completed: upload.completedBatches,
-            failed: upload.failedBatches,
-        },
-        report: posted.report,
-        server_acknowledged: {
-            codex_session_report_recorded_count: posted.report.recorded_count,
-            raw_evidence_uploaded_object_count: upload.uploadedObjects,
-            raw_evidence_uploaded_chunk_count: upload.uploadedChunks,
-        },
-        blocked_at: options.blockedAt,
-        failure_reason: completion.failureReason,
-    };
-}
-function defaultBackfillWindowNotice() {
-    return [
-        `No window given — backfilling the last ${DEFAULT_BACKFILL_SINCE_DAYS} days.`,
-        "The effective start is capped at the collector paired_at timestamp.",
-        "Use `cockpit backfill --since-days N` for a different window, or `cockpit backfill --all` for the full local history (review a dry-run first; add `--yes` on headless agent runs).",
-    ].join("\n");
-}
-/**
- * Produces a copyable retry that preserves the requested history window and
- * every discovery/selection override. Values that need quoting use syntax
- * accepted by the supported native shells: POSIX shells on macOS and
- * PowerShell on Windows.
- */
-export function backfillRetryCommand(command) {
-    const parts = ["cockpit", "backfill"];
-    if (command.all) {
-        parts.push("--all", "--yes");
-    }
-    else if (command.sinceDays !== undefined) {
-        parts.push("--since-days", String(command.sinceDays));
-    }
-    if (command.source)
-        parts.push("--source", command.source);
-    if (command.maxFiles !== undefined) {
-        parts.push("--max-files", String(command.maxFiles));
-    }
-    if (command.maxDepth !== undefined) {
-        parts.push("--max-depth", String(command.maxDepth));
-    }
-    if (command.maxRepos !== undefined) {
-        parts.push("--max-repos", String(command.maxRepos));
-    }
-    if (command.repoRoot) {
-        parts.push("--workspace", quoteCliArgument(command.repoRoot));
-    }
-    if (command.dryRun)
-        parts.push("--dry-run");
-    return parts.join(" ");
-}
-function backfillDiscoveryRetryCommand(command, discovery) {
-    const retry = { ...command };
-    if (discovery.incomplete_reasons.includes("max_depth_reached")) {
-        retry.maxDepth =
-            (command.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH) + 1;
-    }
-    if (discovery.incomplete_reasons.includes("max_worktrees_reached")) {
-        retry.maxRepos =
-            (command.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS) * 2;
-    }
-    return backfillRetryCommand(retry);
-}
-function quoteCliArgument(value) {
-    if (/^[a-z0-9_./:\\-]+$/iu.test(value))
-        return value;
-    const escaped = process.platform === "win32"
-        ? value.replaceAll("'", "''")
-        : value.replaceAll("'", `'\"'\"'`);
-    return `'${escaped}'`;
-}
-function backfillCollectionRoots(command, savedRoots) {
-    if (command.repoRoot)
-        return [path.resolve(command.repoRoot)];
-    const roots = normalizeCollectionRoots(savedRoots);
-    if (roots.length === 0) {
-        throw new Error("No saved collection roots. Run `cockpit onboard --workspace <path>` or pass `cockpit backfill --workspace <path>`.");
-    }
-    return roots;
-}
-async function discoverBackfillWorktrees(roots, command) {
-    return discoverGitWorktreesInRootsWithStatus(roots, {
-        maxDepth: command.maxDepth ?? DEFAULT_DISCOVERY_MAX_DEPTH,
-        maxWorktrees: command.maxRepos ?? DEFAULT_DISCOVERY_MAX_REPOS,
-    });
-}
-function selectedSources(source) {
-    if (source === "codex")
-        return ["codex"];
-    if (source === "claude")
-        return ["claude_code"];
-    return ["codex", "claude_code"];
-}
-function backfillWindow(command, now, pairedAt) {
-    if (command.all) {
-        return {
-            mode: "all",
-            since_days: null,
-            started_at: new Date(now.getTime() - ALL_BACKFILL_SINCE_MINUTES * 60_000)
-                .toISOString(),
-            paired_at: pairedAt.toISOString(),
-            since_minutes: ALL_BACKFILL_SINCE_MINUTES,
-        };
-    }
-    const requestedMs = now.getTime() - (command.sinceDays ?? 1) * 24 * 60 * 60_000;
-    const startedAtMs = Math.max(requestedMs, pairedAt.getTime());
-    const sinceMinutes = Math.max(1, Math.ceil((now.getTime() - startedAtMs) / 60_000));
-    return {
-        mode: "since_days",
-        since_days: command.sinceDays ?? null,
-        started_at: new Date(startedAtMs).toISOString(),
-        paired_at: pairedAt.toISOString(),
-        since_minutes: sinceMinutes,
-    };
-}
-async function validateBackfillReachability(options) {
-    if (!options.dryRun)
-        return;
-    const response = await options.fetchImpl(options.dashboardUrl, {
-        method: "HEAD",
-    });
-    if (response.status >= 500) {
-        throw new Error(`Dashboard reachability failed with HTTP ${response.status}.`);
-    }
-}
-/**
- * Reads both archived session stores and turns them into the candidates this
- * run will consider: scan each selected store, keep what the cursor has not
- * already resolved, order it, apply the operator's `--max-files` cap, then
- * census what could not be accounted for.
- */
-async function scanBackfillSessions(options) {
-    const scanLimit = options.command.maxFiles ?? 10_000;
-    const codexSessionDirs = defaultCodexSessionDirs(options.homeDir);
-    const claudeProjectsDir = path.join(options.homeDir, ".claude", "projects");
-    const codexAttribution = options.sources.includes("codex")
-        ? await scanCodexHistory(options, codexSessionDirs, scanLimit)
-        : null;
-    const claudeAttribution = options.sources.includes("claude_code")
-        ? await scanClaudeHistory(options, claudeProjectsDir, scanLimit)
-        : null;
-    const selection = selectBackfillCandidates({
-        codexAttribution,
-        claudeAttribution,
-        cursor: options.cursor,
-        pointerlessTerminalSessions: options.pointerlessTerminalSessions,
-        maxFiles: options.command.maxFiles,
-    });
-    const issues = await backfillScanIssues({
-        codexAttribution,
-        claudeAttribution,
-        codexSessionDirs,
-        claudeProjectsDir,
-        candidates: selection.candidates,
-        omittedCandidateCount: selection.omittedCandidateCount,
-    });
-    return {
-        candidates: selection.candidates,
-        codexAttribution,
-        claudeAttribution,
-        issues,
-        retryable_candidate_keys: retryableCandidateKeys(selection.candidates),
-        omitted_candidate_count: selection.omittedCandidateCount,
-    };
-}
-/**
- * The adapter's own limit is a memory guard, not permission to silently leave
- * history undiscovered. When it fires, re-scan the exact discovered population
- * so a user-facing `--max-files` cap can resume from a truthful ordering.
- */
-async function scanCodexHistory(request, sessionsDirs, scanLimit) {
-    const scan = (limit) => scanAndAttributeCodexSessions({
-        sessionsDirs,
-        worktrees: request.worktrees,
-        now: request.now,
-        sinceMinutes: request.window.since_minutes,
-        limit,
-        collectionRoots: request.collectionRoots,
-    });
-    const firstPass = await scan(scanLimit);
-    if (!firstPass.session_limit_applied)
-        return firstPass;
-    return scan(Math.max(scanLimit + 1, firstPass.discovered_file_count));
-}
-/** Same rule for the Claude store: a capped first pass is rescanned in full. */
-async function scanClaudeHistory(request, projectsDir, scanLimit) {
-    const scan = (limit) => scanAndAttributeClaudeSessions({
-        projectsDir,
-        worktrees: request.worktrees,
-        now: request.now,
-        sinceMinutes: request.window.since_minutes,
-        limit,
-        collectionRoots: request.collectionRoots,
-    });
-    const firstPass = await scan(scanLimit);
-    if (!firstPass.session_limit_applied)
-        return firstPass;
-    return scan(Math.max(scanLimit + 1, firstPass.discovered_session_count));
-}
-/**
- * Which scanned sessions this run will actually work on. A session is in play
- * if the cursor has not passed it, or if it is a terminal session that never
- * earned a pointer and so deserves another attempt; those retries sort first
- * so a `--max-files` cap spends its budget on them before newer history.
- */
-function selectBackfillCandidates(options) {
-    const allCandidates = [
-        ...(options.codexAttribution?.results.map(normalizeCodexCandidate) ?? []),
-        ...(options.claudeAttribution?.results.map(normalizeClaudeCandidate) ?? []),
-    ]
-        .filter((candidate) => isAfterCursor(candidate, options.cursor) ||
-        isPointerlessTerminalRetry(candidate, options.pointerlessTerminalSessions))
-        .sort((a, b) => compareBackfillCandidatesForRetry(a, b, options.pointerlessTerminalSessions));
-    const candidates = allCandidates.slice(0, options.maxFiles ?? Number.MAX_SAFE_INTEGER);
-    return {
-        candidates,
-        omittedCandidateCount: allCandidates.length - candidates.length,
-    };
-}
-async function loadPointerlessTerminalSessions(paths, sources) {
-    const [codexCursor, claudeCursor] = await Promise.all([
-        sources.includes("codex")
-            ? readRawEvidenceCursor(paths)
-            : Promise.resolve(null),
-        sources.includes("claude_code")
-            ? readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME })
-            : Promise.resolve(null),
-    ]);
-    const terminalIds = (sessions) => new Set(Object.entries(sessions ?? {})
-        .filter(([, entry]) => isPointerlessTerminalCursorEntry(entry))
-        .map(([sessionId]) => sessionId));
-    const result = {
-        codex: terminalIds(codexCursor?.sessions),
-        claude_code: terminalIds(claudeCursor?.sessions),
-    };
-    const count = result.codex.size + result.claude_code.size;
-    if (count > 0) {
-        console.error("[backfill] pointer-less terminal sessions reopened", JSON.stringify({
-            count,
-            codex_count: result.codex.size,
-            claude_count: result.claude_code.size,
-        }));
-    }
-    return result;
-}
-function isPointerlessTerminalCursorEntry(entry) {
-    return (!entry.uploaded_object_key &&
-        (entry.state === "ambiguous" ||
-            entry.state === "unattributed" ||
-            entry.state === "skipped"));
-}
-function isPointerlessTerminalRetry(candidate, sessions) {
-    return sessions[candidate.source].has(candidate.session_id);
-}
-function compareBackfillCandidatesForRetry(a, b, sessions) {
-    const aRetry = isPointerlessTerminalRetry(a, sessions);
-    const bRetry = isPointerlessTerminalRetry(b, sessions);
-    if (aRetry !== bRetry)
-        return aRetry ? -1 : 1;
-    if (aRetry && bRetry) {
-        return (a.session_file_mtime_ms - b.session_file_mtime_ms ||
-            candidateCursorKey(a).localeCompare(candidateCursorKey(b)));
-    }
-    return compareBackfillCandidates(a, b);
-}
-function normalizeCodexCandidate(result) {
-    return {
-        source: "codex",
-        session_id: result.codex_session_id,
-        file_path: result.file_path,
-        state: result.state,
-        reason: result.reason,
-        signals: result.signals,
-        attribution_score: result.attribution_score,
-        path_score: result.path_score,
-        content_hash_sha256: result.content_hash_sha256,
-        byte_size: result.byte_size,
-        session_file_mtime: result.session_file_mtime,
-        session_file_mtime_ms: result.session_file_mtime_ms,
-        worktree: result.worktree,
-        cwd_basename: result.cwd_basename,
-        cwd_hash: result.cwd_hash,
-    };
-}
-function normalizeClaudeCandidate(result) {
-    return {
-        source: "claude_code",
-        session_id: result.claude_session_id,
-        file_path: result.file_path,
-        state: result.state,
-        reason: result.reason,
-        signals: result.signals,
-        attribution_score: result.attribution_score,
-        path_score: result.path_score,
-        content_hash_sha256: result.content_hash_sha256,
-        byte_size: result.byte_size,
-        session_file_mtime: result.session_file_mtime,
-        session_file_mtime_ms: result.session_file_mtime_ms,
-        worktree: result.worktree,
-        cwd_basename: result.cwd_basename,
-        cwd_hash: result.cwd_hash,
-        claude: result,
-    };
-}
-function isAfterCursor(candidate, cursor) {
-    const source = cursor.sources[candidate.source];
-    const oldest = source?.oldest_mtime_ms_processed;
-    if (oldest === null || oldest === undefined)
-        return true;
-    if (candidate.session_file_mtime_ms < oldest)
-        return true;
-    const key = candidateCursorKey(candidate);
-    if (candidate.session_file_mtime_ms === oldest) {
-        return !source.processed_keys_at_oldest_mtime.includes(key);
-    }
-    const newest = source.newest_mtime_ms_covered;
-    // A cursor written before upper-edge coverage existed gets one safe
-    // migration pass across the previously processed interval. Once that pass is
-    // acknowledged, subsequent --all runs only inspect genuinely newer files.
-    if (newest === null)
-        return true;
-    if (candidate.session_file_mtime_ms > newest)
-        return true;
-    if (candidate.session_file_mtime_ms < newest)
-        return false;
-    // A legacy cursor has no boundary identities. Rechecking the equal-time
-    // boundary is safe because durable evidence is content-addressed.
-    return !source.processed_keys_at_newest_mtime.includes(key);
-}
-function compareBackfillCandidates(a, b) {
-    return (b.session_file_mtime_ms - a.session_file_mtime_ms ||
-        candidateCursorKey(a).localeCompare(candidateCursorKey(b)));
-}
-function candidateCursorKey(candidate) {
-    return crypto
-        .createHash("sha256")
-        .update(JSON.stringify([
-        candidate.source,
-        candidate.session_id,
-        normalizedCursorPath(candidate.file_path),
-    ]))
-        .digest("hex");
-}
-function normalizedCursorPath(filePath) {
-    const windowsStyle = path.win32.isAbsolute(filePath) && !path.posix.isAbsolute(filePath);
-    if (windowsStyle)
-        return path.win32.normalize(filePath).toLowerCase();
-    const normalized = path.resolve(filePath);
-    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}
-/**
- * Everything the scan could not account for cleanly, in one ledger. Read in
- * three passes — what the Codex store hid, what the Claude store hid, then
- * what is wrong with the candidates that survived — because the first two are
- * global (discovery may have missed a session at any mtime, so no watermark is
- * safe to advance) and the third only stops the contiguous cursor prefix.
- */
-async function backfillScanIssues(options) {
-    const issues = [];
-    if (options.codexAttribution) {
-        await addCodexStoreScanIssues(issues, options.codexAttribution, options.codexSessionDirs);
-    }
-    if (options.claudeAttribution) {
-        await addClaudeStoreScanIssues(issues, options.claudeAttribution, options.claudeProjectsDir, options.candidates);
-    }
-    addCandidateScanIssues(issues, options.candidates, options.omittedCandidateCount);
-    sortScanIssuesByPriority(issues);
-    return issues;
-}
-/** What the archived Codex store could not tell us — every one of these hides history. */
-async function addCodexStoreScanIssues(issues, codexAttribution, codexSessionDirs) {
-    countScanIssue(issues, "codex_session_limit_applied", codexAttribution.session_limit_applied
-        ? Math.max(1, codexAttribution.discovered_file_count -
-            codexAttribution.scanned_file_count)
-        : 0, "global");
-    // A session directory that simply does not exist on this machine is not a
-    // read failure; subtract those before reporting one.
-    const missingTopLevelDirs = (await Promise.all(codexSessionDirs.map(isMissingPath))).filter(Boolean).length;
-    countScanIssue(issues, "codex_directory_read_failed", Math.max(0, codexAttribution.directory_read_failed_count - missingTopLevelDirs), "global");
-    countScanIssue(issues, "codex_session_stat_failed", codexAttribution.stat_failed_count, "global");
-}
-/** The same census for the Claude store, which also has sidecars to account for. */
-async function addClaudeStoreScanIssues(issues, claudeAttribution, claudeProjectsDir, candidates) {
-    countScanIssue(issues, "claude_session_limit_applied", claudeAttribution.session_limit_applied
-        ? Math.max(1, claudeAttribution.discovered_session_count -
-            claudeAttribution.scanned_session_count)
-        : 0, "global");
-    const projectsDirMissing = await isMissingPath(claudeProjectsDir);
-    countScanIssue(issues, "claude_project_dir_read_failed", Math.max(0, claudeAttribution.project_dir_read_failed_count -
-        (projectsDirMissing ? 1 : 0)), "global");
-    countScanIssue(issues, "claude_session_stat_failed", claudeAttribution.session_stat_failed_count, "global");
-    countScanIssue(issues, "claude_sidecar_stat_failed", claudeAttribution.sidecar_stat_failed_count, "global");
-    countScanIssue(issues, "claude_sidecar_dir_read_failed", await countUnreadableClaudeSidecarDirs(candidates), "global");
-}
-/** What is wrong with the sessions that did survive discovery, plus the one we chose to drop. */
-function addCandidateScanIssues(issues, candidates, omittedCandidateCount) {
-    countScanIssue(issues, "backfill_max_files_applied", omittedCandidateCount, "selection");
-    countScanIssue(issues, "candidate_file_read_failed", candidates.filter((candidate) => candidate.reason === "file_read_failed")
-        .length, "candidate");
-    countScanIssue(issues, "candidate_worktree_unavailable", candidates.filter((candidate) => isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null) && candidate.worktree === null).length, "candidate");
-    countScanIssue(issues, "claude_main_file_too_large", candidates.filter((candidate) => candidate.source === "claude_code" &&
-        candidate.claude?.main_file_oversized).length, "candidate");
-    countScanIssue(issues, "claude_sidecar_limit_applied", candidates.reduce((total, candidate) => total + (candidate.claude?.sidecars_capped ?? 0), 0), "candidate");
-    countScanIssue(issues, "claude_sidecar_file_unreadable", candidates.reduce((total, candidate) => total +
-        (candidate.claude?.sidecar_files.filter((sidecar) => sidecar.skipped_reason === "file_read_failed" ||
-            sidecar.skipped_reason === "file_too_large").length ?? 0), 0), "candidate");
-}
-function scanIssuePriority(scope) {
-    if (scope === "global")
-        return 0;
-    if (scope === "candidate")
-        return 1;
-    return 2;
-}
-function retryableCandidateKeys(candidates) {
-    return new Set(candidates
-        .filter((candidate) => candidate.reason === "file_read_failed" ||
-        candidate.reason === "repo_not_on_disk" ||
-        (isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null) &&
-            !candidate.worktree) ||
-        Boolean(candidate.claude?.main_file_oversized) ||
-        (candidate.claude?.sidecars_capped ?? 0) > 0 ||
-        Boolean(candidate.claude?.sidecar_files.some((sidecar) => sidecar.skipped_reason === "file_read_failed" ||
-            sidecar.skipped_reason === "file_too_large")))
-        .map(candidateCursorKey));
-}
-/**
- * A main session file whose only story is "too large to upload under the
- * current cap" (BLI-2727). This mirrors exactly the two branches in
- * `countReadOnlyGuards` that emit the `file_too_large` reason, so a candidate
- * is in this set if and only if it contributed to that scan issue's count —
- * one predicate, no drift between "why the issue fired" and "which candidate
- * caused it". Deterministic and non-retryable: rerunning backfill cannot
- * resolve it (only a larger cap or a smaller file can), so unlike a transient
- * read failure it must never poison completion or a batch's success.
- */
-function oversizedBackfillCandidateKeys(candidates) {
-    const keys = new Set();
-    for (const candidate of candidates) {
-        if ((candidate.source === "claude_code" &&
-            candidate.claude?.main_file_oversized) ||
-            candidate.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
-            keys.add(candidateCursorKey(candidate));
-        }
-    }
-    return keys;
-}
-// --- Scan issue ledger --------------------------------------------------
-//
-// `scan.issues` is the running ledger of everything the scan could not
-// account for cleanly. Every write to it goes through one of the named
-// operations below instead of a bare `.push`/`.sort`, so the ledger's shape
-// (global vs candidate vs selection scope, priority order) has one owner.
-/** Record one issue on the ledger. */
-function addScanIssue(issues, issue) {
-    issues.push(issue);
-}
-/** Record one issue only if it actually happened; a zero count is not a finding. */
-function countScanIssue(issues, reason, count, scope) {
-    if (count > 0)
-        addScanIssue(issues, { reason, count, scope });
-}
-/** Repo discovery could not fully enumerate a root: one global issue per reason. */
-function addRepoDiscoveryIssues(issues, incompleteReasons) {
-    for (const reason of incompleteReasons) {
-        addScanIssue(issues, {
-            reason: `repo_discovery_${reason}`,
-            count: 1,
-            scope: "global",
-        });
-    }
-}
-/** Stable read order: global issues first, then candidate, then selection; alphabetical within a scope. */
-function sortScanIssuesByPriority(issues) {
-    issues.sort((a, b) => scanIssuePriority(a.scope) - scanIssuePriority(b.scope) ||
-        a.reason.localeCompare(b.reason));
-}
-/** The read-only guard pass's two aggregate outcomes, each recorded once if it fired at all. */
-function addReadOnlyGuardIssues(issues, guardCounts) {
-    const readFailed = guardCounts.get("file_read_failed");
-    if (readFailed) {
-        addScanIssue(issues, {
-            reason: "candidate_file_read_failed",
-            count: readFailed,
-            scope: "candidate",
-        });
-    }
-    const tooLarge = guardCounts.get("file_too_large");
-    if (tooLarge) {
-        addScanIssue(issues, {
-            reason: "file_too_large",
-            count: tooLarge,
-            scope: "candidate",
-        });
-    }
-}
-// BLI-2727: a deterministic, labeled oversized skip must never poison
-// completion — it is a permanent, non-retryable fact about the file, not an
-// in-flight problem a rerun can fix. `scan.issues`/`retryable_candidate_keys`
-// still carry it (so it's never silently dropped from reporting); every
-// completion-gating computation excludes it explicitly instead, by filtering
-// through `blockingScanIssues` below.
-//
-// Two scan issues describe the exact same oversized-main candidates:
-// `backfillScanIssues` pushes the Claude-specific `claude_main_file_too_large`
-// (from `claude?.main_file_oversized`) and `countReadOnlyGuards` (via
-// `addReadOnlyGuardIssues` above) separately pushes the source-agnostic
-// `file_too_large` (same predicate as `oversizedBackfillCandidateKeys`, so
-// this list can never drift from it). Both must be excluded from
-// completion-gating together.
-const OVERSIZED_SCAN_ISSUE_REASONS = new Set([
-    "file_too_large",
-    "claude_main_file_too_large",
-]);
-function blockingScanIssues(issues) {
-    return issues.filter((issue) => !OVERSIZED_SCAN_ISSUE_REASONS.has(issue.reason));
-}
-async function countUnreadableClaudeSidecarDirs(candidates) {
-    let unreadable = 0;
-    for (const candidate of candidates) {
-        if (candidate.source !== "claude_code")
-            continue;
-        const subagentsDir = path.join(path.dirname(candidate.file_path), path.basename(candidate.file_path).replace(/\.jsonl$/i, ""), "subagents");
-        try {
-            await fs.readdir(subagentsDir);
-        }
-        catch (error) {
-            if (!isMissingFsError(error))
-                unreadable += 1;
-        }
-    }
-    return unreadable;
-}
-async function isMissingPath(filePath) {
-    try {
-        await fs.stat(filePath);
-        return false;
-    }
-    catch (error) {
-        return isMissingFsError(error);
-    }
-}
-function isMissingFsError(error) {
-    if (!error || typeof error !== "object")
-        return false;
-    const code = error.code;
-    return code === "ENOENT" || code === "ENOTDIR";
-}
-async function countReadOnlyGuards(candidates) {
-    const counts = new Map();
-    const retryableCandidateKeys = new Set();
-    // Aggregated: this runs over the whole archived history, so a per-candidate
-    // line could be thousands. The count already travels; the reason did not
-    // (BLI-3238).
-    let firstReadFailure = null;
-    for (const candidate of candidates) {
-        if (candidate.reason === "repo_not_on_disk") {
-            increment(counts, "repo_not_on_disk");
-            retryableCandidateKeys.add(candidateCursorKey(candidate));
-        }
-        if (candidate.source === "claude_code" && candidate.claude?.main_file_oversized) {
-            increment(counts, "file_too_large");
-            retryableCandidateKeys.add(candidateCursorKey(candidate));
-            continue;
-        }
-        if (candidate.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
-            increment(counts, "file_too_large");
-            retryableCandidateKeys.add(candidateCursorKey(candidate));
-            continue;
-        }
-        if (!isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null))
-            continue;
-        try {
-            await fs.readFile(candidate.file_path);
-        }
-        catch (error) {
-            increment(counts, "file_read_failed");
-            firstReadFailure ??= describeError(error);
-            retryableCandidateKeys.add(candidateCursorKey(candidate));
-        }
-    }
-    const readFailedCount = counts.get("file_read_failed") ?? 0;
-    if (readFailedCount > 0) {
-        console.error("[cockpit-backfill] archived sessions could not be read", JSON.stringify({
-            reason: "file_read_failed",
-            read_failed_count: readFailedCount,
-            candidate_count: candidates.length,
-            ...firstReadFailure,
-        }));
-    }
-    return {
-        counts,
-        retryable_candidate_keys: retryableCandidateKeys,
-    };
-}
-function reasonCountsFor(candidates, guardCounts, scanIssues) {
-    const counts = new Map();
-    for (const candidate of candidates)
-        increment(counts, candidate.reason);
-    for (const [reason, count] of guardCounts) {
-        counts.set(reason, Math.max(counts.get(reason) ?? 0, count));
-    }
-    for (const issue of scanIssues) {
-        counts.set(issue.reason, Math.max(counts.get(issue.reason) ?? 0, issue.count));
-    }
-    for (const required of ["file_too_large", "repo_not_on_disk"]) {
-        counts.set(required, counts.get(required) ?? 0);
-    }
-    return [...counts.entries()]
-        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
-        .map(([reason, count]) => ({
-        reason,
-        count,
-        ...reasonClassification(reason),
-    }));
-}
-/**
- * The skip-reason table printed under every backfill run. These strings are
- * what a person reads when coverage is short, so each note says what would
- * have to change, not merely that something went wrong. Reason labels here
- * must match the ones the scan and the guards emit verbatim.
- */
-const REASON_VERDICTS = new Map([
-    [
-        "secret_like_content_guard",
-        {
-            classification: "retryable",
-            note: "historical guard result; collector now masks and retries",
-        },
-    ],
-    [
-        "secret_redaction_failed",
-        {
-            classification: "retryable",
-            note: "historical guard result; collector now masks and retries",
-        },
-    ],
-    [
-        "file_too_large",
-        {
-            classification: "retryable",
-            note: "until the evidence file cap is raised",
-        },
-    ],
-    [
-        "repo_not_on_disk",
-        { classification: "retryable", note: "repo must exist on disk" },
-    ],
-    [
-        "cwd_not_a_repo",
-        {
-            classification: "permanent",
-            note: "cwd exists but is not a repo or folder workspace",
-        },
-    ],
-    [
-        "multiple_transcript_origins",
-        {
-            classification: "permanent",
-            note: "multiple transcript origins; attribution is ambiguous",
-        },
-    ],
-    [
-        "single_repo_folder_fallback",
-        {
-            classification: "permanent",
-            note: "uploadable single-repo folder workspace fallback",
-        },
-    ],
-    [
-        "multi_repo_folder_workspace",
-        {
-            classification: "permanent",
-            note: "uploadable multi-repo folder workspace fallback",
-        },
-    ],
-]);
-const DEFERRED_REASON_VERDICT = {
-    classification: "retryable",
-    note: "rerun cockpit backfill to continue",
-};
-const UNKNOWN_REASON_VERDICT = {
-    classification: "retryable",
-    note: "rerun after fixing source or collector state",
-};
-function reasonClassification(reason) {
-    const known = REASON_VERDICTS.get(reason);
-    if (known)
-        return known;
-    // A budget deferral is the one family, rather than one label: whichever
-    // budget ran out, the remedy is the same rerun.
-    if (reason.startsWith("deferred_"))
-        return DEFERRED_REASON_VERDICT;
-    return UNKNOWN_REASON_VERDICT;
-}
-function uploadableCandidates(candidates) {
-    return candidates.filter((candidate) => isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null) &&
-        candidate.worktree);
-}
-function buildBackfillBatches(candidates) {
-    const byWorktree = new Map();
-    for (const candidate of candidates) {
-        if (!candidate.worktree)
-            continue;
-        const key = candidate.worktree.worktree_fingerprint;
-        byWorktree.set(key, [...(byWorktree.get(key) ?? []), candidate]);
-    }
-    const batches = [];
-    for (const group of byWorktree.values()) {
-        const worktree = group[0]?.worktree;
-        if (!worktree)
-            continue;
-        for (let offset = 0; offset < group.length; offset += BACKFILL_UPLOAD_BATCH_SESSIONS) {
-            batches.push({
-                worktree,
-                candidates: group.slice(offset, offset + BACKFILL_UPLOAD_BATCH_SESSIONS),
-            });
-        }
-    }
-    return batches;
-}
-async function ensureBackfillReportContext(options) {
-    const candidateWorktree = options.candidates.find((candidate) => candidate.worktree)?.worktree;
-    const representative = candidateWorktree ?? options.worktrees[0] ?? null;
-    // A deleted repo or an approved folder workspace can legitimately produce
-    // report-only rows with no current git worktree. Use the exact approved root
-    // as a synthetic local context instead of falling through to process.cwd().
-    const repoRoot = representative?.repo_root ??
-        options.collectionRoots[0] ??
-        process.cwd();
-    try {
-        await readLocalWorkContextForRepo(options.paths, repoRoot);
-    }
-    catch {
-        // Reading it can legitimately fail — there is no context yet, which is
-        // precisely why the next line creates one. That read is a probe and stays
-        // silent; the CREATE is the branch that has to speak (BLI-3238).
-        await startLocalWorkContext({
-            homeDir: options.homeDir,
-            repoRoot,
-            branch: representative?.branch,
-        }).catch((error) => {
-            // Context creation is best-effort here: postCodexSessionReport converts
-            // a remaining local-context failure into a retryable report reason. But
-            // that reason is `collector_not_ready`, which points the operator at
-            // setup rather than at whatever actually failed here.
-            console.error("[cockpit-backfill] could not start a local work context for the batch", JSON.stringify({
-                reason: "work_context_start_failed",
-                ...describeError(error),
-            }));
-        });
-    }
-    return { repoRoot };
-}
-/**
- * Hands one batch to the ordinary sync path. A batch whose repo has no local
- * work context yet is not a failure — backfill routinely visits repos this
- * machine has never synced — so that one blocker is answered by creating the
- * context and retrying; every other error propagates.
- */
-async function syncBackfillBatch(options) {
-    const syncOptions = backfillBatchSyncOptions(options);
-    try {
-        return await syncLocalAmbientEnvelope(syncOptions);
-    }
-    catch (error) {
-        if (error instanceof LocalUploadBlockedError &&
-            error.blocker === "missing_context") {
-            await startLocalWorkContext({
-                homeDir: options.command.homeDir,
-                repoRoot: options.batch.worktree.repo_root,
-                branch: options.batch.worktree.branch,
-            });
-            return await syncLocalAmbientEnvelope(syncOptions);
-        }
-        throw error;
-    }
-}
-/** The batch translated into the live sync path's envelope, session files and all. */
-function backfillBatchSyncOptions(options) {
-    return {
-        homeDir: options.command.homeDir,
-        repoRoot: options.batch.worktree.repo_root,
-        worktreeInventory: worktreeInventoryForRepo(options.batch.worktree, options.worktrees),
-        codexSessionFiles: options.batch.candidates
-            .filter((candidate) => candidate.source === "codex")
-            .map((candidate) => ({
-            local_path: candidate.file_path,
-            codex_session_id: candidate.session_id,
-        })),
-        codexAttributionScan: options.codexAttribution ?? undefined,
-        claudeSessionFiles: options.batch.candidates
-            .filter((candidate) => candidate.source === "claude_code")
-            .map((candidate) => ({
-            local_path: candidate.file_path,
-            claude_session_id: candidate.session_id,
-            main_file_oversized: Boolean(candidate.claude?.main_file_oversized),
-            skip_main: false,
-            sidecar_files: candidate.claude?.sidecar_files
-                .filter((sidecar) => !sidecar.skipped_reason)
-                .map((sidecar) => ({ local_path: sidecar.local_path })) ?? [],
-        })),
-        claudeAttributionScan: options.claudeAttribution ?? undefined,
-        rawEvidenceBudget: options.rawEvidenceBudget,
-        // `cockpit backfill` is only ever an operator asking — by hand, through
-        // onboarding, through doctor, or by running the retry command Cockpit
-        // printed. The delivery-backoff window is the scheduler's cadence, so it
-        // does not gate this pass: honouring it here made the retry that follows a
-        // failed commit a 15-minute no-op that reported
-        // `durable_session_pointer_missing` and never named the hold (BLI-3118).
-        evidenceDeliveryMode: "operator_retry",
-        fetch: options.fetchImpl,
-    };
-}
-/**
- * One attribution row per session this run saw, uploaded or not — the only
- * record the server ever gets of a session the collector could not upload.
- * Exported for the BLI-3272 regression test; not part of the CLI surface.
- */
-export function buildBackfillSessionReport(options) {
-    const uploads = indexMainTranscriptUploads(options.syncResults);
-    const bestBySession = bestCandidatePerSession(options.candidates);
-    return [...bestBySession.values()].map((candidate) => sessionAttributionRow(candidate, uploads, options.now));
-}
-function indexMainTranscriptUploads(syncResults) {
-    const bySourceAndSession = new Map();
-    const noUploadReasonBySessionId = new Map();
-    for (const sync of syncResults) {
-        if (sync.status !== "uploaded")
-            continue;
-        for (const outcome of sync.raw_evidence_outcomes) {
-            if (!outcome.codex_session_id)
-                continue;
-            const source = outcome.kind === "claude_jsonl"
-                ? "claude_code"
-                : outcome.kind === "codex_jsonl"
-                    ? "codex"
-                    : null;
-            if (!source)
-                continue;
-            if (!outcome.raw_evidence_pointer_id) {
-                if (outcome.reason) {
-                    noUploadReasonBySessionId.set(outcome.codex_session_id, outcome.reason);
-                }
-                continue;
-            }
-            bySourceAndSession.set(`${source}:${outcome.codex_session_id}`, {
-                upload_state: outcome.upload_state,
-                raw_evidence_pointer_id: outcome.raw_evidence_pointer_id,
-                reason: outcome.reason,
-            });
-        }
-    }
-    return { bySourceAndSession, noUploadReasonBySessionId };
-}
-/**
- * One row per session, not per file: the same session can be scanned from
- * several paths, so the best-attributed sighting wins and the most recent one
- * breaks a tie.
- */
-function bestCandidatePerSession(candidates) {
-    const bestByKey = new Map();
-    for (const candidate of candidates) {
-        const key = `${candidate.source}:${candidate.session_id}`;
-        const existing = bestByKey.get(key);
-        if (!existing || rank(candidate.state) > rank(existing.state)) {
-            bestByKey.set(key, candidate);
-        }
-        else if (existing &&
-            rank(candidate.state) === rank(existing.state) &&
-            candidate.session_file_mtime_ms > existing.session_file_mtime_ms) {
-            bestByKey.set(key, candidate);
-        }
-    }
-    return bestByKey;
-}
-function sessionAttributionRow(candidate, uploads, now) {
-    return {
-        codex_session_id: candidate.session_id,
-        source: candidate.source,
-        observed_at: now.toISOString(),
-        attribution_state: candidate.state,
-        attribution_reason: candidate.reason,
-        attribution_score: candidate.attribution_score,
-        path_score: candidate.path_score,
-        signals: candidate.signals,
-        ...(candidate.content_hash_sha256
-            ? { session_file_hash_sha256: candidate.content_hash_sha256 }
-            : {}),
-        session_file_byte_size: candidate.byte_size,
-        session_file_mtime: candidate.session_file_mtime,
-        ...(candidate.worktree
-            ? {
-                repo_fingerprint: candidate.worktree.repo_fingerprint,
-                worktree_fingerprint: candidate.worktree.worktree_fingerprint,
-                repo_label: candidate.worktree.repo_label,
-                branch: candidate.worktree.branch,
-            }
-            : {}),
-        ...(candidate.cwd_basename ? { cwd_basename: candidate.cwd_basename } : {}),
-        ...(candidate.cwd_hash ? { cwd_hash: candidate.cwd_hash } : {}),
-        ...sessionUploadFields(candidate, uploads),
-    };
-}
-/**
- * The upload half of a report row. Every branch names an outcome: a pointer
- * when one exists, and otherwise WHY there is none — BLI-2107 for an
- * attributed session and BLI-3272 for a refused one. Backfill is the path that
- * revisits old sessions, so a silent branch here would keep rewriting the very
- * NULL/NULL rows those tickets found.
- */
-function sessionUploadFields(candidate, uploads) {
-    const upload = uploads.bySourceAndSession.get(`${candidate.source}:${candidate.session_id}`);
-    if (upload) {
-        return {
-            raw_evidence_pointer_id: upload.raw_evidence_pointer_id,
-            upload_state: upload.upload_state,
-            ...(upload.upload_state === "upload_failed"
-                ? { upload_reason: upload.reason ?? NO_UPLOAD_ATTEMPT_RECORDED }
-                : {}),
-        };
-    }
-    const observedReason = uploads.noUploadReasonBySessionId.get(candidate.session_id);
-    const wasUploadable = isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null);
-    return {
-        upload_state: "not_uploaded",
-        upload_reason: observedReason ??
-            (wasUploadable
-                ? NO_UPLOAD_ATTEMPT_RECORDED
-                : notUploadableAttributionStateReason(candidate.reason)),
-    };
-}
-function rank(state) {
-    switch (state) {
-        case "attributed":
-            return 5;
-        case "attributed_fallback":
-            return 4;
-        case "ambiguous":
-            return 3;
-        case "unattributed":
-            return 2;
-        case "skipped":
-            return 1;
-        default:
-            return 0;
-    }
-}
-/**
- * Which candidates in this batch are now safe to leave behind forever: a
- * session counts as durable only when its main transcript AND every sidecar
- * we expected earned a pointer, and nothing in it failed. This set is what the
- * cursor advances through, so an over-generous answer here loses history
- * permanently.
- */
-function durableBackfillCandidateKeys(batch, sync) {
-    const durable = new Set();
-    if (sync.status !== "uploaded")
-        return durable;
-    if (deferredEvidenceCount(sync) > 0) {
-        // Deferred outcomes have no per-file identity. Advancing any candidate in
-        // this batch could therefore strand the deferred main transcript.
-        return durable;
-    }
-    const outcomesBySession = summarizeEvidenceOutcomesBySession(sync);
-    for (const candidate of batch.candidates) {
-        const summary = outcomesBySession.get(`${candidate.source}:${candidate.session_id}`);
-        if (summary &&
-            !summary.failed &&
-            summary.durableMainCount > 0 &&
-            summary.durableSidecarCount >= expectedSidecarCount(candidate)) {
-            durable.add(candidateCursorKey(candidate));
-        }
-    }
-    return durable;
-}
-function summarizeEvidenceOutcomesBySession(sync) {
-    const outcomesBySession = new Map();
-    for (const outcome of sync.raw_evidence_outcomes) {
-        const source = backfillSourceForEvidenceKind(outcome.kind);
-        if (!source || !outcome.codex_session_id)
-            continue;
-        const key = `${source}:${outcome.codex_session_id}`;
-        const summary = outcomesBySession.get(key) ?? {
-            durableMainCount: 0,
-            durableSidecarCount: 0,
-            failed: false,
-        };
-        if (outcome.upload_state === "upload_failed") {
-            summary.failed = true;
-        }
-        else if (outcome.raw_evidence_pointer_id &&
-            (outcome.upload_state === "uploaded" ||
-                outcome.upload_state === "reused_existing")) {
-            if (outcome.kind === "codex_jsonl" || outcome.kind === "claude_jsonl") {
-                summary.durableMainCount += 1;
-            }
-            else if (outcome.kind === "claude_jsonl_sidecar") {
-                summary.durableSidecarCount += 1;
-            }
-        }
-        outcomesBySession.set(key, summary);
-    }
-    return outcomesBySession;
-}
-/** Sidecars this session owes a pointer for; one already skipped at scan time is not owed. */
-function expectedSidecarCount(candidate) {
-    if (candidate.source !== "claude_code")
-        return 0;
-    return (candidate.claude?.sidecar_files.filter((sidecar) => !sidecar.skipped_reason)
-        .length ?? 0);
-}
-/**
- * Writes the pointer a session earned back into the live raw-evidence cursor,
- * so the next scheduled sync knows it is already delivered. Backfill and sync
- * share these cursors; the caller holds the collection lock for exactly this.
- */
-async function recordBackfillDurableSessionPointers(options) {
-    const durableObjectBySession = indexDurableMainObjectKeys(options.syncResults);
-    let recordedCount = 0;
-    for (const source of ["codex", "claude_code"]) {
-        const filename = source === "claude_code" ? CLAUDE_CURSOR_FILENAME : undefined;
-        const cursor = await readRawEvidenceCursor(options.paths, { filename });
-        let changed = false;
-        for (const candidate of options.candidates) {
-            if (candidate.source !== source)
-                continue;
-            const objectKey = durableObjectBySession.get(`${source}:${candidate.session_id}`);
-            const prior = cursor.sessions[candidate.session_id];
-            // No pointer, no prior entry, or already pointed: nothing this pass owes.
-            if (!objectKey || !prior || prior.uploaded_object_key)
-                continue;
-            cursor.sessions[candidate.session_id] = deliveredCursorEntry(prior, candidate, objectKey, options.now);
-            changed = true;
-            recordedCount += 1;
-        }
-        if (changed) {
-            await writeRawEvidenceCursor(options.paths, cursor, {
-                filename,
-                sessionsOnly: source === "claude_code",
-            });
-        }
-    }
-    if (recordedCount > 0) {
-        console.error("[backfill] terminal session pointers recorded", JSON.stringify({ count: recordedCount }));
-    }
-}
-/** Storage keys for main transcripts that actually landed, keyed by source and session. */
-function indexDurableMainObjectKeys(syncResults) {
-    const durableObjectBySession = new Map();
-    for (const sync of syncResults) {
-        for (const outcome of sync.raw_evidence_outcomes) {
-            if (!outcome.codex_session_id ||
-                (outcome.kind !== "codex_jsonl" && outcome.kind !== "claude_jsonl") ||
-                (outcome.upload_state !== "uploaded" &&
-                    outcome.upload_state !== "reused_existing") ||
-                !outcome.object_key) {
-                continue;
-            }
-            const source = outcome.kind === "codex_jsonl" ? "codex" : "claude_code";
-            durableObjectBySession.set(`${source}:${outcome.codex_session_id}`, outcome.object_key);
-        }
-    }
-    return durableObjectBySession;
-}
-/** The cursor entry for a session backfill has just delivered in full. */
-function deliveredCursorEntry(prior, candidate, objectKey, now) {
-    return {
-        ...prior,
-        file_hash_sha256: candidate.content_hash_sha256,
-        file_mtime_ms: candidate.session_file_mtime_ms,
-        byte_size: candidate.byte_size,
-        // The whole file was delivered, so the incremental reader starts at its end.
-        byte_offset: candidate.byte_size,
-        state: candidate.state,
-        reason: candidate.reason,
-        worktree_fingerprint: candidate.worktree?.worktree_fingerprint ?? null,
-        uploaded_object_key: objectKey,
-        uploaded_at: now.toISOString(),
-        uploaded_byte_size: candidate.byte_size,
-        last_seen_at: now.toISOString(),
-    };
-}
-function countSessionUploadFailures(sync) {
-    return sync.raw_evidence_outcomes.filter((outcome) => Boolean(outcome.codex_session_id) &&
-        outcome.upload_state === "upload_failed" &&
-        Boolean(backfillSourceForEvidenceKind(outcome.kind))).length;
-}
-function backfillSourceForEvidenceKind(kind) {
-    if (kind === "codex_jsonl" || kind === "codex_image_attachment") {
-        return "codex";
-    }
-    if (kind === "claude_jsonl" ||
-        kind === "claude_jsonl_sidecar" ||
-        kind === "claude_image_attachment") {
-        return "claude_code";
-    }
-    return null;
-}
-function advanceBackfillCursorThroughResolvedPrefix(options) {
-    if (!options.discoveryComplete)
-        return false;
-    const observations = [];
-    for (const source of ["codex", "claude_code"]) {
-        const remaining = options.candidates
-            .filter((candidate) => candidate.source === source &&
-            isAfterCursor(candidate, options.cursor))
-            .sort(compareBackfillCandidates);
-        for (const candidate of remaining) {
-            const key = candidateCursorKey(candidate);
-            if (options.retryableCandidateKeys.has(key))
-                break;
-            const resolved = isRawEvidenceUploadableAttributionState(candidate.state, candidate.worktree !== null)
-                ? options.durableCandidateKeys.has(key)
-                : true;
-            if (!resolved)
-                break;
-            observations.push({
-                source: candidate.source,
-                cursor_key: key,
-                state: candidate.state,
-                reason: candidate.reason,
-                session_file_mtime_ms: candidate.session_file_mtime_ms,
-                session_file_mtime: candidate.session_file_mtime,
-            });
-        }
-    }
-    if (observations.length === 0)
-        return false;
-    recordBackfillCursorObservations(options.cursor, observations, options.now);
-    return true;
-}
-function worktreeInventoryForRepo(current, worktrees) {
-    return worktrees
-        .filter((worktree) => worktree.repo_fingerprint
-        ? worktree.repo_fingerprint === current.repo_fingerprint
-        : worktree.repo_label === current.repo_label)
-        .map((worktree) => ({
-        repo: worktree.repo_root,
-        repo_label: worktree.repo_label,
-        repo_fingerprint: worktree.repo_fingerprint,
-        repo_origin_url: worktree.repo_origin_url ?? undefined,
-        head_sha: worktree.head_sha ?? undefined,
-        worktree_label: worktree.worktree_label,
-        worktree_fingerprint: worktree.worktree_fingerprint,
-        worktree_is_primary: worktree.worktree_is_primary,
-        branch: worktree.branch,
-    }));
-}
-function baseBackfillResult(command, options) {
-    const states = countBy(options.scan.candidates, (candidate) => candidate.state);
-    const uploadable = uploadableCandidates(options.scan.candidates);
-    const perSource = {
-        codex: sourceCounts("codex", options.scan),
-        claude_code: sourceCounts("claude_code", options.scan),
-    };
-    return {
-        status: "complete",
-        dry_run: command.dryRun,
-        dashboard_url: options.dashboardUrl,
-        verify_url: `${options.dashboardUrl}/my-work`,
-        sources: options.sources,
-        window: options.window,
-        counts: {
-            total: options.scan.candidates.length,
-            uploadable: uploadable.length,
-            backfilled: 0,
-            skipped: options.scan.candidates.length - uploadable.length,
-            failed: 0,
-            deferred: 0,
-            remaining: 0,
-            states,
-            reasons: options.reasonCounts,
-            per_source: perSource,
-        },
-        batches: {
-            total: Math.ceil(uploadable.length / BACKFILL_UPLOAD_BATCH_SESSIONS),
-            completed: 0,
-            failed: 0,
-        },
-        resume_cursor: options.cursor,
-        retry_command: backfillRetryCommand(command),
-        report: emptyReport("not_posted"),
-        server_acknowledged: {
-            codex_session_report_recorded_count: 0,
-            raw_evidence_uploaded_object_count: 0,
-            raw_evidence_uploaded_chunk_count: 0,
-        },
-    };
-}
-function blockedBackfillResult(command, options) {
-    return {
-        status: "blocked",
-        dry_run: command.dryRun,
-        dashboard_url: options.dashboardUrl,
-        verify_url: `${options.dashboardUrl}/my-work`,
-        sources: selectedSources(command.source),
-        window: {
-            mode: command.all ? "all" : "since_days",
-            since_days: command.sinceDays ?? null,
-            started_at: options.now.toISOString(),
-            paired_at: options.now.toISOString(),
-            since_minutes: 0,
-        },
-        counts: {
-            total: 0,
-            uploadable: 0,
-            backfilled: 0,
-            skipped: 0,
-            failed: 0,
-            deferred: 0,
-            remaining: 0,
-            states: {},
-            reasons: [],
-            per_source: {
-                codex: emptySourceCounts(),
-                claude_code: emptySourceCounts(),
-            },
-        },
-        batches: { total: 0, completed: 0, failed: 0 },
-        resume_cursor: options.cursor,
-        retry_command: backfillRetryCommand(command),
-        report: emptyReport("not_posted"),
-        server_acknowledged: {
-            codex_session_report_recorded_count: 0,
-            raw_evidence_uploaded_object_count: 0,
-            raw_evidence_uploaded_chunk_count: 0,
-        },
-        failure_reason: options.reason,
-    };
-}
-function sourceCounts(source, scan) {
-    const candidates = scan.candidates.filter((candidate) => candidate.source === source);
-    const scanned = source === "codex"
-        ? (scan.codexAttribution?.scanned_file_count ?? 0)
-        : (scan.claudeAttribution?.scanned_session_count ?? 0);
-    return {
-        scanned,
-        selected: candidates.length,
-        uploadable: uploadableCandidates(candidates).length,
-        states: countBy(candidates, (candidate) => candidate.state),
-    };
-}
-function emptySourceCounts() {
-    return { scanned: 0, selected: 0, uploadable: 0, states: {} };
-}
-function emptyReport(reason) {
-    return {
-        posted: false,
-        reason,
-        chunk_count: 0,
-        recorded_count: 0,
-        failed_count: 0,
-        chunks: [],
-    };
-}
-function countBy(items, keyOf) {
-    const counts = {};
-    for (const item of items) {
-        const key = keyOf(item);
-        counts[key] = (counts[key] ?? 0) + 1;
-    }
-    return counts;
-}
-function increment(counts, key) {
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-}
-function writeDryRunSummary(io, options) {
-    const uploadable = uploadableCandidates(options.candidates);
-    writeLine(io.stdout, `${options.dryRunOnly ? "DRY-RUN" : "Review"}: ${options.candidates.length} session(s), ${uploadable.length} uploadable, ${options.candidates.length - uploadable.length} skipped.`);
-    writeReasonTable(io, options.reasonCounts);
-    if (options.dryRunOnly) {
-        writeLine(io.stdout, "DRY-RUN: wrote nothing (no cursor, marker, report, or upload).");
-    }
-    writeLine(io.stdout, `Verify after upload: ${options.dashboardUrl}/my-work`);
-}
-function writeHumanBackfillResult(result, io) {
-    if (result.status === "complete") {
-        writeLine(io.stdout, `PASS: ${result.counts.backfilled} backfilled, ${result.counts.skipped} skipped (table). Verify: ${result.verify_url}`);
-        writeReasonTable(io, result.counts.reasons);
-        return;
-    }
-    if (result.status === "partial") {
-        const at = result.blocked_at;
-        if (at) {
-            writeLine(io.stderr, `BLOCKED: ${at.what} at batch ${at.batch_index}/${at.batch_total}, ${at.done}/${at.total} done`);
-        }
-        writeLine(io.stderr, `Failure: ${result.failure_reason ?? "partial_backfill"}`);
-        writeLine(io.stderr, `Retry: ${result.retry_command}`);
-        writeLine(io.stderr, `Stopped: ${result.counts.remaining} remaining — rerun cockpit backfill to continue`);
-        writeReasonTable(io, result.counts.reasons);
-        return;
-    }
-    const at = result.blocked_at;
-    if (at) {
-        writeLine(io.stderr, `BLOCKED: ${at.what} at batch ${at.batch_index}/${at.batch_total}, ${at.done}/${at.total} done`);
-    }
-    else {
-        writeLine(io.stderr, "BLOCKED: backfill could not run.");
-    }
-    writeLine(io.stderr, `Failure: ${result.failure_reason ?? "no_sessions"}`);
-    writeLine(io.stderr, `Retry: ${result.retry_command}`);
-}
-function writeReasonTable(io, reasons) {
-    if (reasons.length === 0)
-        return;
-    writeLine(io.stdout, "Skip/reason table:");
-    for (const reason of reasons) {
-        writeLine(io.stdout, `- ${reason.reason}: ${reason.count} (${reason.classification}; ${reason.note})`);
-    }
-}
-async function confirmAllBackfill(io) {
-    const answer = await readLine(io, "Proceed with --all backfill upload? [y/N] ");
-    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-}
-async function readLine(io, prompt) {
-    io.stdout.write(prompt);
-    io.stdin.setEncoding("utf8");
-    return new Promise((resolve) => {
-        const onData = (chunk) => {
-            io.stdin.removeListener("data", onData);
-            io.stdin.pause();
-            resolve(chunk);
-        };
-        io.stdin.resume();
-        io.stdin.on("data", onData);
-    });
-}
-function isInteractiveStdin(io) {
-    return Boolean(io.stdin.isTTY);
-}
-function parseRequiredDate(value, label) {
-    const date = new Date(value);
-    if (!Number.isFinite(date.getTime())) {
-        throw new Error(`Collector session ${label} is invalid.`);
-    }
-    return date;
-}
-function normalizeDashboardUrl(value) {
-    return value.trim().replace(/\/+$/, "");
-}
-function writeLine(stream, text) {
-    stream.write(`${text}\n`);
-}
-function yieldToEventLoop() {
-    return new Promise((resolve) => setTimeout(resolve, 0));
 }