@bli-cockpit/cli 0.2.53 → 0.2.55

package/dist/commands/onboard.js

@@ -1,18 +1,9 @@
-import { errorMessage, writeLine } from "./cli-io.js";
-import { agentRuleHostLabel } from "./agent-rules-command.js";
-import { autostartLocationLine } from "./autostart-command.js";
-import { backfillRetryCommand, runBackfill, } from "./backfill.js";
-import { attributedSyncRunStatus, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
-import { collectionRootConsentAliases, persistOnboardingRootConfig, resolveOnboardingRootsForCommand, } from "./collection-roots.js";
-import { addInstallEvent, reportInstallEventsBestEffort } from "./install-receipts.js";
-import { canReuseOnboardSession, pairLocalCollectorWithAuthFallback, readOnboardSessionReuseCandidate, requestPairingAccessTokenDetailed, resolveOnboardEmail, } from "./local-auth.js";
+import { resolveOnboardEmail } from "./local-auth.js";
 import { discoverCommandWorktrees } from "./local-discovery.js";
-import { addAutostartInstallEvent, addOnboardFailureEvent, classifyOnboardBlocker, onboardAutostartFailed, } from "./onboard-receipts.js";
-import { nextStepForOnboardBlocker, onboardAgentRulesInstallLine, onboardJsonPayload, reportOnboardMultiRepoResult, reportOnboardSyncBlocked, writeOnboardAutostartBlocker, writeOnboardBackfillBlockedResult, writeOnboardBanner, writeOnboardJson, writeOnboardLiveStatus, writeOnboardMultiRepoSyncBlocked, writeOnboardSingleRepoResultJson, writeOnboardUploadNarrative, writeOnboardWorkContextStarted, writePairingInstructions, } from "./onboard-report.js";
-import { runAttributedWorktreeSync, } from "./session-sync.js";
-import { installAgentRules } from "../agent-rules.js";
-import { installAutostartAgent } from "../autostart.js";
-import { inspectLocalCollectorStatus, logoutLocalCollector, startLocalWorkContext, } from "../local-state.js";
+import { handleOnboardFailure, } from "./onboard-completion.js";
+import { runOnboardMultiRepoFlow, runOnboardSingleRepoFlow, } from "./onboard-flows.js";
+import { writeOnboardBanner } from "./onboard-report.js";
+import { prepareOnboardRoots, installOnboardConfig, pairForOnboarding } from "./onboard-setup.js";
 /**
  * The onboarding runbook: resolve roots, install, pair, discover worktrees,
  * then hand off to whichever arm matches what was found — one repo runs the
@@ -68,382 +59,4 @@ export async function runOnboard(command, io) {
     catch (error) {
         return await handleOnboardFailure(error, command, rootsResult, install, pair, syncHolder.current, installEvents, io);
     }
-}
-/** The parent-folder arm: sync every discovered worktree, then backfill and finish setup once. */
-async function runOnboardMultiRepoFlow(ctx) {
-    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
-    const multi = await runMultiRepoOnboard(resolvedCommand, io, worktrees);
-    addInstallEvent(installEvents, "work_context", "ok");
-    addInstallEvent(installEvents, "sync", multi.ok ? "ok" : "fail", multi.ok ? undefined : "sync_blocked");
-    if (!multi.ok) {
-        if (command.json)
-            writeOnboardMultiRepoSyncBlocked(ctx, multi);
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-        ? undefined
-        : backfill.failureReason ?? "backfill_incomplete");
-    if (!completedBackfill) {
-        writeOnboardBackfillBlockedResult(io, {
-            json: command.json,
-            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, null, null, rootsResult),
-            extra: {
-                mode: "multi_repo",
-                repos: multi.results,
-                codex_sessions: multi.codex_sessions,
-            },
-            backfill,
-        });
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    const multiSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-    reportOnboardMultiRepoResult(ctx, {
-        multi,
-        backfill: completedBackfill,
-        setup: multiSetup,
-    });
-    return finishOnboardRun(command, installEvents, io, multiSetup.ok ? 0 : 1);
-}
-/** The single-repo arm: start the work context, sync it, backfill, then finish setup once. */
-async function runOnboardSingleRepoFlow(ctx, single) {
-    const { command, resolvedCommand, collectionRoots, rootsResult, install, pair, installEvents, io, worktrees, } = ctx;
-    const worktreeRoot = worktrees[0]?.repo_root ?? single.primaryRoot;
-    const context = await startLocalWorkContext({
-        homeDir: command.homeDir,
-        repoRoot: worktreeRoot,
-        branch: command.branch,
-        activeTicketId: command.activeTicketId,
-    });
-    if (!command.json)
-        writeOnboardWorkContextStarted(io, context);
-    addInstallEvent(installEvents, "work_context", "ok");
-    const run = await runAttributedWorktreeSync({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        collectionRoots: single.attributionCollectionRoots,
-        startContexts: false,
-        worktrees,
-        fetchImpl: io.fetch,
-    });
-    const sync = run.outcomes[0]?.sync ?? null;
-    single.syncHolder.current = sync;
-    if (!sync) {
-        throw new Error("Onboard sync produced no result for the repo worktree.");
-    }
-    const status = await inspectLocalCollectorStatus({
-        homeDir: command.homeDir,
-        repoRoot: worktreeRoot,
-        branch: command.branch,
-    });
-    if (!run.ok || sync.status !== "uploaded") {
-        addInstallEvent(installEvents, "sync", "fail", "sync_blocked");
-        reportOnboardSyncBlocked(ctx, { run, sync, status, worktreeRoot });
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    addInstallEvent(installEvents, "sync", "ok");
-    const backfill = await runRequiredOnboardBackfill(resolvedCommand, io);
-    const completedBackfill = backfill.status === "complete" ? backfill.result : null;
-    addInstallEvent(installEvents, "backfill", completedBackfill ? "ok" : "fail", completedBackfill
-        ? undefined
-        : backfill.failureReason ?? "backfill_incomplete");
-    if (!completedBackfill) {
-        writeOnboardBackfillBlockedResult(io, {
-            json: command.json,
-            base: onboardJsonPayload("blocked", resolvedCommand, install, pair, sync, status, rootsResult),
-            extra: { codex_sessions: run.summary },
-            backfill,
-        });
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    if (command.json) {
-        const jsonSetup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-        writeOnboardSingleRepoResultJson(ctx, {
-            run,
-            sync,
-            status,
-            backfill: completedBackfill,
-            setup: jsonSetup,
-        });
-        return finishOnboardRun(command, installEvents, io, jsonSetup.ok ? 0 : 1);
-    }
-    writeOnboardUploadNarrative(io, { command, run, sync, status });
-    const setup = await completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io);
-    const { agentRules, autostart } = setup;
-    if (!setup.ok) {
-        writeOnboardAutostartBlocker(io, autostart);
-        return finishOnboardRun(command, installEvents, io, 1);
-    }
-    writeLine(io.stdout, "PASS: Tower is set up and collecting.");
-    writeOnboardLiveStatus(io, resolvedCommand, collectionRoots, {
-        pair,
-        status,
-        sync,
-        agentRules,
-        autostart,
-        initialSyncOk: true,
-        backfill: completedBackfill,
-    });
-    return finishOnboardRun(command, installEvents, io, 0);
-}
-/**
- * Every uncaught error from either onboarding arm lands here. `status` is
- * always recomputed fresh against whichever root got furthest, never trusted
- * from before the throw — the arms already recompute it themselves on their
- * own success paths, so nothing upstream is lost by not threading it through.
- */
-async function handleOnboardFailure(error, command, rootsResult, install, pair, sync, installEvents, io) {
-    const message = errorMessage(error);
-    const statusRoot = rootsResult?.roots[0] ?? command.repoRoot;
-    const status = statusRoot
-        ? await inspectLocalCollectorStatus({
-            homeDir: command.homeDir,
-            repoRoot: statusRoot,
-            branch: command.branch,
-        }).catch(() => null)
-        : null;
-    const blocker = classifyOnboardBlocker(message);
-    addOnboardFailureEvent(installEvents, blocker);
-    const nextStep = nextStepForOnboardBlocker(blocker, command);
-    if (command.json) {
-        writeOnboardJson(io, onboardJsonPayload("blocked", command, install, pair, sync, status, rootsResult, {
-            blocker,
-            message,
-            next_step: nextStep,
-        }));
-    }
-    else {
-        writeLine(io.stderr, `BLOCKED: ${message}`);
-        writeLine(io.stderr, `Next: ${nextStep}`);
-    }
-    return finishOnboardRun(command, installEvents, io, 1);
-}
-/** Step 0: which folders are approved, and who claims to own this machine's uploads. */
-async function prepareOnboardRoots(command, installEvents, io) {
-    const resolvedRoots = await resolveOnboardingRootsForCommand(command, io);
-    const rootsResult = resolvedRoots.rootsResult;
-    const collectionRoots = rootsResult.roots;
-    const attributionCollectionRoots = await collectionRootConsentAliases(collectionRoots);
-    const primaryRoot = resolvedRoots.primaryRoot;
-    const resolvedCommand = {
-        ...command,
-        repoRoot: primaryRoot,
-        collectionRoots,
-    };
-    if (!command.json) {
-        writeLine(io.stdout, `Collecting from: ${collectionRoots.join(", ")}`);
-    }
-    if (rootsResult.homeRootOptIn) {
-        addInstallEvent(installEvents, "home_root_optin", "ok");
-    }
-    return {
-        resolvedRoots,
-        rootsResult,
-        collectionRoots,
-        attributionCollectionRoots,
-        primaryRoot,
-        existingConfig: resolvedRoots.existingConfig,
-        resolvedCommand,
-    };
-}
-/** Step 1: write the local config that makes this machine a known collector. */
-async function installOnboardConfig(command, resolvedRoots, installEvents, io) {
-    const install = await persistOnboardingRootConfig(command, resolvedRoots);
-    addInstallEvent(installEvents, "install", "ok");
-    if (!command.json) {
-        writeLine(io.stdout, "1/5 Installed local collector.");
-        writeLine(io.stdout, `Config: ${install.paths.config_file}`);
-    }
-    return install;
-}
-/**
- * Step 2 of onboarding: reuse the device session when it already belongs to
- * this owner on this dashboard, otherwise sign in and pair — logging the old
- * session out first when it belongs to someone else.
- *
- * Returns null when an existing session was reused, which is why the caller's
- * `pair` stays null and the readiness proof falls back to the status file.
- */
-async function pairForOnboarding(command, input, installEvents, io) {
-    const installedStatus = await inspectLocalCollectorStatus({
-        homeDir: command.homeDir,
-        repoRoot: input.primaryRoot,
-        branch: command.branch,
-    });
-    const installedSession = await readOnboardSessionReuseCandidate(command.homeDir);
-    const canReuseInstalledSession = canReuseOnboardSession(installedSession, input.claimedOwnerEmail, command.dashboardUrl);
-    if (installedStatus.session_state === "valid" && canReuseInstalledSession) {
-        addInstallEvent(installEvents, "auth", "skipped", "existing_session");
-        addInstallEvent(installEvents, "pair", "skipped", "existing_session");
-        if (!command.json) {
-            writeLine(io.stdout, "2/5 Existing valid device session found; pairing skipped.");
-        }
-        return null;
-    }
-    if (installedStatus.session_state === "valid") {
-        await logoutLocalCollector({ homeDir: command.homeDir });
-        if (!command.json) {
-            writeLine(io.stdout, "2/5 Existing valid device session does not match requested owner or dashboard; pairing again.");
-        }
-    }
-    const authResult = await requestPairingAccessTokenDetailed({
-        dashboardUrl: command.dashboardUrl,
-        email: input.claimedOwnerEmail,
-        noAuth: command.noAuth,
-        json: command.json,
-    }, io);
-    addInstallEvent(installEvents, "auth", authResult.status, authResult.errorCode);
-    const pair = await pairLocalCollectorWithAuthFallback({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        claimedOwnerEmail: input.claimedOwnerEmail,
-        deviceName: command.deviceName,
-        pollIntervalMs: command.pollIntervalMs,
-        timeoutMs: command.timeoutMs,
-        pairingAccessToken: authResult.accessToken,
-        fetch: io.fetch,
-        onPairStarted: command.json
-            ? undefined
-            : (request) => writePairingInstructions(io, request),
-    }, io);
-    addInstallEvent(installEvents, "pair", "ok");
-    if (!command.json) {
-        writeLine(io.stdout, "2/5 Device paired.");
-        writeLine(io.stdout, `User: ${pair.session.email ?? pair.session.auth_subject_id}`);
-        writeLine(io.stdout, `Device: ${pair.session.device_name ?? pair.session.device_id ?? "unknown"}`);
-    }
-    return pair;
-}
-async function runMultiRepoOnboard(command, io, worktrees) {
-    if (!command.json) {
-        writeLine(io.stdout, `3/5 Parent folder mode: discovered ${worktrees.length} git worktree(s).`);
-    }
-    const collectionRoots = await collectionRootConsentAliases(command.collectionRoots ??
-        (command.repoRoot ? [command.repoRoot] : []));
-    const run = await runAttributedWorktreeSync({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        branch: command.branch,
-        activeTicketId: command.activeTicketId,
-        collectionRoots,
-        startContexts: true,
-        worktrees,
-        fetchImpl: io.fetch,
-    });
-    const results = run.outcomes.map((outcome) => worktreeSyncRow(outcome, run));
-    const collectionRunStatus = attributedSyncRunStatus(run);
-    if (!command.json) {
-        for (const [index, outcome] of run.outcomes.entries()) {
-            const row = results[index];
-            if (!row)
-                continue;
-            const uploaded = outcome.sync.status === "uploaded";
-            writeLine(uploaded ? io.stdout : io.stderr, `${uploaded ? "SYNCED" : "BLOCKED"} ${row["repo_label"]}/${row["worktree_label"]} (${row["branch"]}) head:${shortSha(outcome.sync.head_sha ?? outcome.worktree.head_sha)} ${outcome.sync.status} objects:${outcome.sync.raw_evidence_uploaded_object_count} chunks:${outcome.sync.raw_evidence_uploaded_chunk_count} reused:${outcome.sync.raw_evidence_reused_count} failed:${outcome.sync.raw_evidence_failed_count} sessions:${row["attributed_session_count"]}${row["failure_reason"] ? ` reason:${row["failure_reason"]}` : ""}`);
-        }
-        writeLine(io.stdout, "4/5 Parent worktree sync complete.");
-        writeLine(io.stdout, `Uploaded: ${results.filter((row) => row["upload_status"] === "uploaded").length}/${results.length}`);
-        writeAgentSessionSummary(io, run.summary);
-        if (run.ok) {
-            writeLine(io.stdout, "Live sync receipts complete; verifying all-history Codex and Claude backfill.");
-        }
-        else {
-            writeLine(io.stderr, `BLOCKED: Tower collection is ${collectionRunStatus}; retry until every eligible session has a durable receipt or explicit terminal reason.`);
-        }
-        writeLine(io.stdout, `Open: ${command.dashboardUrl}/my-work`);
-    }
-    return { ok: run.ok, results, codex_sessions: run.summary };
-}
-function requiredOnboardBackfillCommand(command) {
-    return {
-        homeDir: command.homeDir,
-        all: true,
-        dryRun: false,
-        maxDepth: command.maxDepth,
-        maxRepos: command.maxRepos,
-        yes: true,
-        json: true,
-    };
-}
-async function runRequiredOnboardBackfill(command, io) {
-    const backfillCommand = requiredOnboardBackfillCommand(command);
-    const retryCommand = backfillRetryCommand(backfillCommand);
-    try {
-        const result = await runBackfill(backfillCommand, io);
-        return {
-            status: result.status,
-            failureReason: result.status === "complete"
-                ? null
-                : result.failure_reason ?? `backfill_${result.status}`,
-            retryCommand: result.retry_command,
-            result,
-        };
-    }
-    catch (error) {
-        return {
-            status: "failed",
-            failureReason: errorMessage(error),
-            retryCommand,
-            result: null,
-        };
-    }
-}
-async function completeOnboardingSetup(resolvedCommand, collectionRoots, installEvents, io) {
-    const agentRules = await refreshOnboardAgentRules(resolvedCommand, collectionRoots, io);
-    addInstallEvent(installEvents, "agent_rules", "ok");
-    const autostart = await refreshOnboardAutostart(resolvedCommand, collectionRoots, io);
-    addAutostartInstallEvent(installEvents, autostart);
-    return { agentRules, autostart, ok: !onboardAutostartFailed(autostart) };
-}
-async function refreshOnboardAgentRules(command, roots, io) {
-    const result = await installAgentRules({
-        homeDir: command.homeDir,
-        scopePaths: roots,
-    });
-    if (command.json)
-        return result;
-    writeLine(io.stdout, `Agent rules: ${onboardAgentRulesInstallLine(result)}`);
-    for (const target of result.targets) {
-        writeLine(io.stdout, `${agentRuleHostLabel(target.host)}: ${target.rules_file}`);
-    }
-    return result;
-}
-/** Refreshes the host autostart backend after successful onboarding. */
-async function refreshOnboardAutostart(command, roots, io) {
-    if (!io.exec)
-        return null;
-    const result = await installAutostartAgent({
-        homeDir: command.homeDir,
-        repoRoot: roots[0],
-        repoRoots: roots,
-        dashboardUrl: command.dashboardUrl,
-        exec: io.exec,
-    });
-    if (command.json)
-        return result;
-    if (result.status === "unsupported") {
-        writeLine(io.stdout, `Background autostart unsupported: ${result.message}`);
-        return result;
-    }
-    writeLine(io.stdout, result.loaded
-        ? "Background autostart refreshed; Tower syncs at login and every 15 min."
-        : "Background autostart refreshed, but the operating-system scheduler reported a problem; check `cockpit autostart status`.");
-    writeLine(io.stdout, autostartLocationLine(result));
-    return result;
-}
-/**
- * Every onboard exit funnels through here so the best-effort install-event
- * report always fires, pass or blocked — replaces a `finish` closure that used
- * to live inside `runOnboard` so the flow functions below can call it too.
- */
-async function finishOnboardRun(command, installEvents, io, code) {
-    await reportInstallEventsBestEffort({
-        homeDir: command.homeDir,
-        dashboardUrl: command.dashboardUrl,
-        command: "onboard",
-        events: installEvents,
-        json: command.json,
-        io,
-    });
-    return code;
 }

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.53");
+    writeLine(io?.stdout ?? process.stdout, "0.2.55");
     return 0;
   }
 

package/dist/commands/session-sync-counters.js

@@ -0,0 +1,55 @@
+/**
+ * The two honest counters the heartbeat carries beside the raw scan count
+ * (BLI-3645).
+ *
+ * `sessions_observed` is a re-scanned STOCK — every session file inside the
+ * current scan window, whether this tick found it for the first time or the
+ * two-hundredth (`docs/reports/collection-coverage-probe-2026-09-05.md`). It
+ * keeps its real name and keeps shipping, because the fleet board still wants
+ * "how big is this machine's session store". Neither counter below replaces
+ * it; both are FLOWS, computed against the cursor as it stood before this
+ * tick touched a single file:
+ *
+ *   - `sessions_new_this_tick` — sessions this tick's scan found that were NOT
+ *     already in that source's cursor. A session already tracked (uploaded,
+ *     retrying, or merely re-scanned inside the normal window) is not "new".
+ *   - `sessions_pending_upload` — sessions INSIDE an approved root, from this
+ *     tick's report, that still have no durable pointer. This is the "only
+ *     copy" set a manager actually needs: files that exist nowhere but this
+ *     machine, right now. Outside-root sessions are a consented absence
+ *     (session-first commandment) and are never counted here, the same rule
+ *     `session-sync-health.ts` applies to `sessions_outside_root`.
+ */
+import { OUTSIDE_APPROVED_ROOT_REASONS } from "./session-sync-health.js";
+/**
+ * How many of this tick's attributed sessions are new to their source's
+ * cursor — never seen by a previous tick at all.
+ *
+ * Compares against the cursor as it stood BEFORE this tick (the `plan` step's
+ * read), not the cursor after recording, because the point is "first seen
+ * since the last tick's watermark" and the cursor only gains this tick's
+ * entries once recording runs.
+ */
+export function countSessionsNewThisTick(options) {
+    let count = 0;
+    for (const session of options.sessions) {
+        const cursorBefore = session.source === "claude_code"
+            ? options.claudeCursorBefore
+            : options.codexCursorBefore;
+        if (!cursorBefore.sessions[session.codex_session_id])
+            count += 1;
+    }
+    return count;
+}
+/**
+ * How many of this tick's attributed sessions are inside an approved root and
+ * still have no durable pointer — the "only copy" set. A session that never
+ * gets one because it is genuinely withheld (a stated `upload_reason`, not the
+ * outside-root one) still counts: it is still, right now, the only copy this
+ * session exists as, and that is exactly the fact a manager needs surfaced,
+ * not silently excluded because the withholding was deliberate.
+ */
+export function countSessionsPendingUpload(sessions) {
+    return sessions.filter((session) => !session.raw_evidence_pointer_id &&
+        !OUTSIDE_APPROVED_ROOT_REASONS.has(session.attribution_reason)).length;
+}

package/dist/commands/session-sync-health.js

@@ -10,6 +10,7 @@
  * Nothing here parses a rendered sentence back apart.
  */
 import { createSyncFailureLedger, recordSourceScanFailures, recordUnexplainedFailure, recordUnpostedSessionReportFailure, recordWorktreeDeliveryFailures, } from "./session-sync-failures.js";
+import { countSessionsNewThisTick, countSessionsPendingUpload, } from "./session-sync-counters.js";
 /**
  * Decide whether this tick failed, and record every condition that decided it.
  *
@@ -50,6 +51,12 @@ export function decideSyncHealth(options) {
         failure_records: records,
         notice,
         sessions_outside_root: sessionsOutsideRoot,
+        sessions_new_this_tick: countSessionsNewThisTick({
+            sessions: options.sessions,
+            codexCursorBefore: options.plan.codexCursorBefore,
+            claudeCursorBefore: options.plan.claudeCursorBefore,
+        }),
+        sessions_pending_upload: countSessionsPendingUpload(options.sessions),
     };
 }
 /**
@@ -60,7 +67,7 @@ export function decideSyncHealth(options) {
  * `attribution-core.ts` writes both of these and nothing else means
  * "outside the boundary".
  */
-const OUTSIDE_APPROVED_ROOT_REASONS = new Set([
+export const OUTSIDE_APPROVED_ROOT_REASONS = new Set([
     "cwd_outside_scanned_worktrees",
     "no_matching_worktree_signals",
 ]);

package/dist/commands/session-sync-plan.js

@@ -4,14 +4,36 @@
  * Every read here degrades on purpose: a missing or corrupt local file becomes
  * an empty cursor or a null spool, because a collector that cannot read its own
  * bookkeeping must still collect. The one decision this step makes that changes
- * what gets collected is the retry width — whether a source reopens all local
- * history instead of its normal live window.
+ * what gets collected is the retry width — whether a source reopens its scan
+ * window, and how far.
+ *
+ * BLI-3645: a `retry_pending` source used to widen to "all local history since
+ * the epoch", every tick, forever, which is what made `sessions_observed` a
+ * 14-day-to-lifetime rolling STOCK instead of an incremental FLOW (see
+ * `docs/reports/collection-coverage-probe-2026-09-05.md`). The window is now
+ * bounded to the AGE of the oldest undurable file that source's own cursor is
+ * still carrying, plus one day of buffer — a real, finite number that shrinks
+ * back down once that file finally uploads, rather than a cutoff that never
+ * moves. When no cursor entry explains the retry (a legacy spooled upload with
+ * no per-file record), {@link RETRY_WINDOW_FALLBACK_MINUTES} is the bound
+ * instead — generous, but still a bound, never "since epoch".
  */
 import { readLocalCollectorConfig, } from "../local-state.js";
 import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { readLocalUploadSpoolState, } from "../spool/local-spool.js";
 import { liveSyncCursorEntryRequiresRetry } from "./session-sync-attribution.js";
+/**
+ * The bound applied when a retry is pending but no cursor entry names the
+ * stuck file (e.g. a legacy spooled upload recorded before per-source retry
+ * tracking existed). 30 days is well past the normal 14-day Codex / 24h
+ * Claude window and comfortably covers a real backlog, without re-reading a
+ * machine's entire lifetime of session files every 15 minutes.
+ */
+export const RETRY_WINDOW_FALLBACK_MINUTES = 30 * 24 * 60;
+/** Buffer added past the oldest undurable file's exact age, for clock skew
+ * and so a file sitting right at the edge of the window is not dropped. */
+export const RETRY_WINDOW_BUFFER_MINUTES = 24 * 60;
 /**
  * Read the local state this sync is bound by — config, both cursors, the upload
  * spool — and turn it into the decisions the rest of the pass reads.
@@ -49,13 +71,31 @@ export async function planSyncFromLocalState(options) {
         codexRetryPending: sourceHasPendingRetries("codex", uploadSpool, legacyRetryPending, codexSourceRetryPending, codexCursorBefore),
         claudeRetryPending: claudeEnabled &&
             sourceHasPendingRetries("claude_code", uploadSpool, legacyRetryPending, claudeSourceRetryPending, claudeCursorBefore),
-        allHistorySinceMinutes: allLocalHistorySinceMinutes(options.now),
+        codexRetrySinceMinutes: boundedRetrySinceMinutes(codexCursorBefore, options.now),
+        claudeRetrySinceMinutes: boundedRetrySinceMinutes(claudeCursorBefore, options.now),
     };
 }
-function allLocalHistorySinceMinutes(now) {
-    // A cutoff just before the Unix epoch is effectively unbounded for Codex and
-    // Claude session files while keeping date arithmetic finite and portable.
-    return Math.ceil(now.getTime() / 60_000) + 24 * 60;
+/**
+ * How far back a retry-widened scan should reopen: the age of the oldest
+ * undurable file this cursor is still carrying, plus a day of buffer — or
+ * {@link RETRY_WINDOW_FALLBACK_MINUTES} when no cursor entry explains the
+ * retry at all. Exported for the tests, which is the point: this is the exact
+ * arithmetic that used to be "since the epoch" and is now a real number.
+ */
+export function boundedRetrySinceMinutes(cursor, now) {
+    let oldestUndurableMtimeMs = null;
+    for (const entry of Object.values(cursor.sessions)) {
+        if (!liveSyncCursorEntryRequiresRetry(entry))
+            continue;
+        if (oldestUndurableMtimeMs === null ||
+            entry.file_mtime_ms < oldestUndurableMtimeMs) {
+            oldestUndurableMtimeMs = entry.file_mtime_ms;
+        }
+    }
+    if (oldestUndurableMtimeMs === null)
+        return RETRY_WINDOW_FALLBACK_MINUTES;
+    const ageMinutes = Math.ceil((now.getTime() - oldestUndurableMtimeMs) / 60_000);
+    return Math.max(0, ageMinutes) + RETRY_WINDOW_BUFFER_MINUTES;
 }
 /** Whether the spool already recorded a source-scan retry for this source. */
 function sourceScanRetryIsPending(uploadSpool, source) {

package/dist/commands/session-sync-scan.js

@@ -29,7 +29,7 @@ export async function scanAndAttributeBothSources(options) {
         now: options.now,
         collectionRoots: plan.collectionRoots,
         retryPending: plan.codexRetryPending,
-        allHistorySinceMinutes: plan.allHistorySinceMinutes,
+        retrySinceMinutes: plan.codexRetrySinceMinutes,
     });
     // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
     // days so the first sync captures retroactive history instead of only 24h.
@@ -42,7 +42,7 @@ export async function scanAndAttributeBothSources(options) {
         now: options.now,
         collectionRoots: plan.collectionRoots,
         retryPending: plan.claudeRetryPending,
-        allHistorySinceMinutes: plan.allHistorySinceMinutes,
+        retrySinceMinutes: plan.claudeRetrySinceMinutes,
         firstRunBackfill,
     });
     await reconcileSourceScanRetry({
@@ -71,7 +71,7 @@ export async function scanAndAttributeBothSources(options) {
  */
 async function scanCodexSessionsForSync(options) {
     const sinceMinutes = options.retryPending
-        ? options.allHistorySinceMinutes
+        ? options.retrySinceMinutes
         : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES;
     let scan = await scanAndAttributeCodexSessions({
         sessionsDirs: defaultCodexSessionDirs(options.homeDir),
@@ -106,7 +106,7 @@ async function scanClaudeSessionsForSync(options) {
     if (!options.claudeEnabled)
         return emptyClaudeScan();
     const sinceMinutes = options.retryPending
-        ? options.allHistorySinceMinutes
+        ? options.retrySinceMinutes
         : options.firstRunBackfill
             ? CLAUDE_FIRST_RUN_BACKFILL_MINUTES
             : undefined;

package/dist/commands/session-sync.js

@@ -25,6 +25,9 @@
  *   class-lock test reads that file (BLI-3551).
  * - `session-sync-health.ts` — the verdict, and the notice a quiet-but-working
  *   machine still emits.
+ * - `session-sync-counters.ts` — the two honest heartbeat counters beside the
+ *   raw scan count: sessions new since the last tick's cursor, and sessions
+ *   still pending a durable pointer (BLI-3645).
  *
  * What a run REPORTS — the per-session rows and the CLI funnel counts — lives
  * next door in `agent-session-report.ts` and is re-exported from here
@@ -116,6 +119,7 @@ export async function runAttributedWorktreeSync(options) {
         sessions,
         delivery,
         collectionRootCount: plan.collectionRoots.length,
+        plan,
     });
     return {
         ok: health.ok,
@@ -124,6 +128,8 @@ export async function runAttributedWorktreeSync(options) {
         notice: health.notice,
         sessions_observed: sessions.length,
         sessions_outside_root: health.sessions_outside_root,
+        sessions_new_this_tick: health.sessions_new_this_tick,
+        sessions_pending_upload: health.sessions_pending_upload,
         outcomes: worktreePass.outcomes,
         codexAttribution: scan.codexAttribution,
         claudeAttribution: scan.claudeAttribution,