@bli-cockpit/cli 0.2.54 → 0.2.56

package/dist/spool/local-spool.js

@@ -1,426 +1,20 @@
-import crypto from "node:crypto";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { CodexSessionAttributionSchema, } from "@bli-cockpit/telemetry-core";
-const SPOOL_STATE_FILENAME = "upload-state.json";
-const MAX_PENDING_UPLOADS = 20;
-export function emptyUploadSpoolState() {
-    return {
-        schema_version: "cockpit-upload-spool.v1",
-        updated_at: null,
-        last_upload_attempt_at: null,
-        last_upload_success_at: null,
-        last_upload_failure_reason: null,
-        pending_uploads: [],
-        pending_source_retries: [],
-        pending_session_reports: [],
-    };
-}
-export async function readLocalUploadSpoolState(paths) {
-    const filePath = uploadSpoolStatePath(paths);
-    let serialized;
-    try {
-        serialized = await fs.readFile(filePath, "utf8");
-    }
-    catch (error) {
-        if (isErrnoException(error, "ENOENT"))
-            return emptyUploadSpoolState();
-        throw uploadSpoolReadError(filePath, "unreadable", error);
-    }
-    let raw;
-    try {
-        raw = JSON.parse(serialized);
-    }
-    catch (error) {
-        throw uploadSpoolReadError(filePath, "invalid JSON", error);
-    }
-    try {
-        return parseUploadSpoolState(raw);
-    }
-    catch (error) {
-        throw uploadSpoolReadError(filePath, "invalid schema", error);
-    }
-}
-export async function summarizeLocalUploadSpool(paths) {
-    const state = await readLocalUploadSpoolState(paths);
-    return {
-        last_upload_attempt_at: state.last_upload_attempt_at,
-        last_upload_success_at: state.last_upload_success_at,
-        last_upload_failure_reason: state.last_upload_failure_reason,
-        pending_upload_count: state.pending_uploads.length +
-            state.pending_source_retries.length +
-            state.pending_session_reports.length,
-        retry_command: state.pending_uploads[0]?.retry_command ??
-            (state.pending_source_retries.length > 0 ||
-                state.pending_session_reports.length > 0
-                ? "cockpit sync"
-                : null),
-    };
-}
-export async function recordUploadBlocked(paths, options) {
-    const state = await readLocalUploadSpoolState(paths);
-    const next = {
-        ...state,
-        updated_at: options.attemptedAt,
-        last_upload_attempt_at: options.attemptedAt,
-        last_upload_failure_reason: options.reason,
-    };
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-export async function recordUploadSuccess(paths, options) {
-    const state = await readLocalUploadSpoolState(paths);
-    const pending = options.clearPendingForContext === false
-        ? state.pending_uploads
-        : state.pending_uploads.filter((entry) => entry.work_context_id !== options.workContextId);
-    const next = {
-        ...state,
-        updated_at: options.attemptedAt,
-        last_upload_attempt_at: options.attemptedAt,
-        last_upload_success_at: options.attemptedAt,
-        last_upload_failure_reason: firstPendingFailureReason({
-            ...state,
-            pending_uploads: pending,
-        }),
-        pending_uploads: pending,
-    };
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-export async function recordUploadFailure(paths, entry) {
-    const state = await readLocalUploadSpoolState(paths);
-    const createdAt = entry.created_at ?? entry.last_attempt_at;
-    const spoolEntry = {
-        spool_id: `upload-${crypto.randomUUID()}`,
-        created_at: createdAt,
-        ...entry,
-    };
-    const pending = [
-        spoolEntry,
-        ...state.pending_uploads.filter((candidate) => candidate.work_context_id !== spoolEntry.work_context_id ||
-            candidate.ticket_id !== spoolEntry.ticket_id),
-    ].slice(0, MAX_PENDING_UPLOADS);
-    await writeUploadSpoolState(paths, {
-        ...state,
-        updated_at: entry.last_attempt_at,
-        last_upload_attempt_at: entry.last_attempt_at,
-        last_upload_failure_reason: entry.failure_reason,
-        pending_uploads: pending,
-    });
-    return spoolEntry;
-}
-export async function recordSourceRetryFailure(paths, options) {
-    const state = await readLocalUploadSpoolState(paths);
-    const retryEntry = {
-        source: options.source,
-        reason: options.reason,
-        last_attempt_at: options.attemptedAt,
-    };
-    const next = {
-        ...state,
-        updated_at: options.attemptedAt,
-        last_upload_attempt_at: options.attemptedAt,
-        last_upload_failure_reason: options.reason,
-        pending_source_retries: [
-            retryEntry,
-            ...state.pending_source_retries.filter((entry) => entry.source !== options.source),
-        ],
-    };
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-export async function clearSourceRetryFailure(paths, source, attemptedAt) {
-    const state = await readLocalUploadSpoolState(paths);
-    const next = {
-        ...state,
-        updated_at: attemptedAt,
-        pending_source_retries: state.pending_source_retries.filter((entry) => entry.source !== source),
-    };
-    next.last_upload_failure_reason = firstPendingFailureReason(next);
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-export async function recordPendingSessionReport(paths, entry) {
-    const state = await readLocalUploadSpoolState(paths);
-    const existing = state.pending_session_reports.find((candidate) => candidate.work_context_id === entry.work_context_id);
-    const safeIncomingSessions = parseMetadataOnlySessionReportRows(entry.sessions, "pending_session_report.sessions");
-    const mergedSessions = mergeSessionReportRows(existing?.sessions ?? [], safeIncomingSessions);
-    const pending = {
-        report_id: existing?.report_id ?? `session-report-${crypto.randomUUID()}`,
-        created_at: existing?.created_at ?? entry.attempted_at,
-        last_attempt_at: entry.attempted_at,
-        dashboard_url: entry.dashboard_url,
-        generated_at: entry.generated_at,
-        work_context_id: entry.work_context_id,
-        repo_label: entry.repo_label,
-        branch: entry.branch,
-        repo_fingerprint: entry.repo_fingerprint,
-        repo_origin_url: entry.repo_origin_url,
-        worktree_label: entry.worktree_label,
-        worktree_fingerprint: entry.worktree_fingerprint,
-        worktree_is_primary: entry.worktree_is_primary,
-        sessions: mergedSessions,
-        failure_reason: entry.failure_reason ?? "session_report_pending",
-    };
-    const next = {
-        ...state,
-        updated_at: entry.attempted_at,
-        last_upload_attempt_at: entry.attempted_at,
-        last_upload_failure_reason: pending.failure_reason,
-        pending_session_reports: [
-            pending,
-            ...state.pending_session_reports.filter((candidate) => candidate.report_id !== pending.report_id),
-        ],
-    };
-    await writeUploadSpoolState(paths, next);
-    return pending;
-}
-export async function recordSessionReportFailure(paths, options) {
-    const state = await readLocalUploadSpoolState(paths);
-    const next = {
-        ...state,
-        updated_at: options.attemptedAt,
-        last_upload_attempt_at: options.attemptedAt,
-        last_upload_failure_reason: options.reason,
-        pending_session_reports: state.pending_session_reports.map((entry) => entry.report_id === options.reportId
-            ? {
-                ...entry,
-                last_attempt_at: options.attemptedAt,
-                failure_reason: options.reason,
-            }
-            : entry),
-    };
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-export async function recordSessionReportSuccess(paths, options) {
-    const state = await readLocalUploadSpoolState(paths);
-    const next = {
-        ...state,
-        updated_at: options.attemptedAt,
-        last_upload_attempt_at: options.attemptedAt,
-        last_upload_success_at: options.attemptedAt,
-        pending_session_reports: state.pending_session_reports.filter((entry) => entry.report_id !== options.reportId),
-    };
-    next.last_upload_failure_reason = firstPendingFailureReason(next);
-    await writeUploadSpoolState(paths, next);
-    return next;
-}
-function parseUploadSpoolState(value) {
-    const record = requireRecord(value, "root");
-    if (record["schema_version"] !== "cockpit-upload-spool.v1") {
-        invalidUploadSpoolState("schema_version", 'literal "cockpit-upload-spool.v1"');
-    }
-    return {
-        schema_version: "cockpit-upload-spool.v1",
-        updated_at: requireNullableString(record["updated_at"], "updated_at"),
-        last_upload_attempt_at: requireNullableString(record["last_upload_attempt_at"], "last_upload_attempt_at"),
-        last_upload_success_at: requireNullableString(record["last_upload_success_at"], "last_upload_success_at"),
-        last_upload_failure_reason: requireNullableString(record["last_upload_failure_reason"], "last_upload_failure_reason"),
-        pending_uploads: requireArray(record["pending_uploads"], "pending_uploads").map((entry, index) => parseUploadSpoolEntry(entry, `pending_uploads[${index}]`)),
-        // These fields were added without changing the v1 schema version. Missing
-        // fields are therefore a valid legacy state, while present malformed fields
-        // must fail closed instead of being silently discarded.
-        pending_source_retries: optionalArray(record["pending_source_retries"], "pending_source_retries").map((entry, index) => parseSourceRetryEntry(entry, `pending_source_retries[${index}]`)),
-        pending_session_reports: optionalArray(record["pending_session_reports"], "pending_session_reports").map((entry, index) => parsePendingSessionReport(entry, `pending_session_reports[${index}]`)),
-    };
-}
-function parseUploadSpoolEntry(value, fieldPath) {
-    const record = requireRecord(value, fieldPath);
-    const retryCommand = record["retry_command"] === undefined
-        ? "cockpit sync"
-        : requireString(record["retry_command"], `${fieldPath}.retry_command`);
-    return {
-        spool_id: requireString(record["spool_id"], `${fieldPath}.spool_id`),
-        created_at: requireString(record["created_at"], `${fieldPath}.created_at`),
-        last_attempt_at: requireString(record["last_attempt_at"], `${fieldPath}.last_attempt_at`),
-        dashboard_url: requireString(record["dashboard_url"], `${fieldPath}.dashboard_url`),
-        work_context_id: requireNullableString(record["work_context_id"], `${fieldPath}.work_context_id`),
-        ticket_id: requireNullableString(record["ticket_id"], `${fieldPath}.ticket_id`),
-        repo_label: requireNullableString(record["repo_label"], `${fieldPath}.repo_label`),
-        branch: requireNullableString(record["branch"], `${fieldPath}.branch`),
-        event_count: requireNonNegativeInteger(record["event_count"], `${fieldPath}.event_count`),
-        source_scan_count: requireNonNegativeInteger(record["source_scan_count"], `${fieldPath}.source_scan_count`),
-        risk_flag_count: requireNonNegativeInteger(record["risk_flag_count"], `${fieldPath}.risk_flag_count`),
-        raw_evidence_file_count: requireNonNegativeInteger(record["raw_evidence_file_count"], `${fieldPath}.raw_evidence_file_count`),
-        retry_sources: parseRetrySources(record["retry_sources"], `${fieldPath}.retry_sources`),
-        failure_reason: requireString(record["failure_reason"], `${fieldPath}.failure_reason`),
-        retry_command: retryCommand,
-    };
-}
-async function writeUploadSpoolState(paths, state) {
-    const filePath = uploadSpoolStatePath(paths);
-    const directoryPath = path.dirname(filePath);
-    const serialized = serializeUploadSpoolState(state);
-    const tempPath = path.join(directoryPath, `.${path.basename(filePath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-    await fs.mkdir(directoryPath, { recursive: true, mode: 0o700 });
-    let handle = null;
-    let tempCreated = false;
-    let renamed = false;
-    try {
-        handle = await fs.open(tempPath, "wx", 0o600);
-        tempCreated = true;
-        if (process.platform !== "win32") {
-            await handle.chmod(0o600);
-        }
-        await handle.writeFile(serialized, "utf8");
-        await handle.sync();
-        await handle.close();
-        handle = null;
-        await fs.rename(tempPath, filePath);
-        renamed = true;
-        await fsyncDirectoryBestEffort(directoryPath);
-    }
-    catch (error) {
-        await handle?.close().catch(() => undefined);
-        if (tempCreated && !renamed) {
-            await fs.unlink(tempPath).catch(() => undefined);
-        }
-        throw error;
-    }
-}
-function serializeUploadSpoolState(state) {
-    const json = JSON.stringify(state);
-    const canonical = parseUploadSpoolState(JSON.parse(json));
-    return `${JSON.stringify(canonical, null, 2)}\n`;
-}
-function uploadSpoolStatePath(paths) {
-    return path.join(paths.spool_dir, SPOOL_STATE_FILENAME);
-}
-function parseRetrySources(value, fieldPath) {
-    if (value === undefined)
-        return [];
-    const values = requireArray(value, fieldPath);
-    return [...new Set(values.map((source) => parseRetrySource(source, fieldPath)))];
-}
-function parseSourceRetryEntry(value, fieldPath) {
-    const record = requireRecord(value, fieldPath);
-    return {
-        source: parseRetrySource(record["source"], `${fieldPath}.source`),
-        reason: requireString(record["reason"], `${fieldPath}.reason`),
-        last_attempt_at: requireString(record["last_attempt_at"], `${fieldPath}.last_attempt_at`),
-    };
-}
-function parsePendingSessionReport(value, fieldPath) {
-    const record = requireRecord(value, fieldPath);
-    const sessions = parseMetadataOnlySessionReportRows(record["sessions"], `${fieldPath}.sessions`);
-    return {
-        report_id: requireString(record["report_id"], `${fieldPath}.report_id`),
-        created_at: requireString(record["created_at"], `${fieldPath}.created_at`),
-        last_attempt_at: requireString(record["last_attempt_at"], `${fieldPath}.last_attempt_at`),
-        dashboard_url: requireString(record["dashboard_url"], `${fieldPath}.dashboard_url`),
-        generated_at: requireString(record["generated_at"], `${fieldPath}.generated_at`),
-        work_context_id: requireString(record["work_context_id"], `${fieldPath}.work_context_id`),
-        repo_label: requireString(record["repo_label"], `${fieldPath}.repo_label`),
-        branch: requireString(record["branch"], `${fieldPath}.branch`),
-        repo_fingerprint: requireString(record["repo_fingerprint"], `${fieldPath}.repo_fingerprint`),
-        repo_origin_url: record["repo_origin_url"] === undefined
-            ? null
-            : requireNullableString(record["repo_origin_url"], `${fieldPath}.repo_origin_url`),
-        worktree_label: requireString(record["worktree_label"], `${fieldPath}.worktree_label`),
-        worktree_fingerprint: requireString(record["worktree_fingerprint"], `${fieldPath}.worktree_fingerprint`),
-        worktree_is_primary: requireBoolean(record["worktree_is_primary"], `${fieldPath}.worktree_is_primary`),
-        sessions,
-        failure_reason: requireString(record["failure_reason"], `${fieldPath}.failure_reason`),
-    };
-}
-function parseMetadataOnlySessionReportRows(value, fieldPath) {
-    const sessions = requireArray(value, fieldPath).map((session, index) => {
-        const parsed = CodexSessionAttributionSchema.safeParse(session);
-        if (!parsed.success) {
-            invalidUploadSpoolState(`${fieldPath}[${index}]`, "metadata-only Codex session attribution");
-        }
-        return parsed.data;
-    });
-    if (sessions.length === 0) {
-        invalidUploadSpoolState(fieldPath, "non-empty array");
-    }
-    return sessions;
-}
-function parseRetrySource(value, fieldPath) {
-    if (value === "codex" || value === "claude_code")
-        return value;
-    return invalidUploadSpoolState(fieldPath, '"codex" or "claude_code"');
-}
-function mergeSessionReportRows(existing, incoming) {
-    const bySession = new Map();
-    for (const session of [...existing, ...incoming]) {
-        bySession.set(`${session.source ?? "codex"}:${session.codex_session_id}`, session);
-    }
-    return [...bySession.values()];
-}
-function firstPendingFailureReason(state) {
-    return (state.pending_uploads[0]?.failure_reason ??
-        state.pending_source_retries[0]?.reason ??
-        state.pending_session_reports[0]?.failure_reason ??
-        null);
-}
-function requireRecord(value, fieldPath) {
-    if (value && typeof value === "object" && !Array.isArray(value)) {
-        return value;
-    }
-    return invalidUploadSpoolState(fieldPath, "object");
-}
-function requireArray(value, fieldPath) {
-    if (Array.isArray(value))
-        return value;
-    return invalidUploadSpoolState(fieldPath, "array");
-}
-function optionalArray(value, fieldPath) {
-    return value === undefined ? [] : requireArray(value, fieldPath);
-}
-function requireString(value, fieldPath) {
-    if (typeof value === "string" && value.trim())
-        return value;
-    return invalidUploadSpoolState(fieldPath, "non-empty string");
-}
-function requireNullableString(value, fieldPath) {
-    if (value === null)
-        return null;
-    return requireString(value, fieldPath);
-}
-function requireNonNegativeInteger(value, fieldPath) {
-    if (typeof value === "number" && Number.isInteger(value) && value >= 0) {
-        return value;
-    }
-    return invalidUploadSpoolState(fieldPath, "non-negative integer");
-}
-function requireBoolean(value, fieldPath) {
-    if (typeof value === "boolean")
-        return value;
-    return invalidUploadSpoolState(fieldPath, "boolean");
-}
-function invalidUploadSpoolState(fieldPath, expected) {
-    throw new Error(`Upload spool state schema mismatch at ${fieldPath}; expected ${expected}.`);
-}
-function isErrnoException(error, code) {
-    return (error instanceof Error &&
-        "code" in error &&
-        error.code === code);
-}
-function uploadSpoolReadError(filePath, classification, cause) {
-    const detail = cause &&
-        typeof cause === "object" &&
-        "code" in cause &&
-        typeof cause.code === "string"
-        ? ` (${cause.code})`
-        : "";
-    return new Error(`Upload spool state at ${filePath} is ${classification}; refusing to treat pending delivery state as empty.${detail}`);
-}
-async function fsyncDirectoryBestEffort(directoryPath) {
-    let handle = null;
-    try {
-        handle = await fs.open(directoryPath, "r");
-        await handle.sync();
-    }
-    catch {
-        // Directory fsync is not supported by every host/filesystem (notably some
-        // Windows versions). The file itself was fsynced before the atomic rename.
-        // Deliberately silent (BLI-3238): on those hosts this fails on every
-        // single write, so a line here would be pure noise on exactly the
-        // platform the collector most needs readable logs on.
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
+/**
+ * Durable, metadata-only local spool for undelivered uploads. A sync tick
+ * that could not deliver an event batch, a session-attribution report, or a
+ * source's scan results records the reason here instead of losing it — the
+ * spool never stores transcript content or local file paths, only hashes,
+ * ids, and reason labels, so it can sit on disk indefinitely without
+ * widening what a person's machine exposes.
+ *
+ * This file is the table of contents; every responsibility below lives in a
+ * `local-spool-*.ts` sibling and is re-exported here so the module's public
+ * surface never moves:
+ *   -types      the shapes, tuning constants, and the empty-state builder
+ *               (BLI-3637)
+ *   -parse      hand-written schema validation for a JSON-parsed spool file
+ *   -io         read/write/summarize the spool file on disk (atomic write)
+ *   -mutations  every state transition a sync tick can record
+ */
+export { emptyUploadSpoolState, } from "./local-spool-types.js";
+export { readLocalUploadSpoolState, summarizeLocalUploadSpool, } from "./local-spool-io.js";
+export { recordUploadBlocked, recordUploadSuccess, recordUploadFailure, recordSourceRetryFailure, clearSourceRetryFailure, recordPendingSessionReport, recordSessionReportFailure, recordSessionReportSuccess, } from "./local-spool-mutations.js";

package/dist/upload-evidence-delivery-offer.js

@@ -0,0 +1,144 @@
+import { clearDeliveryAttempt, DELIVERY_BACKOFF_BYPASS_REASON, DELIVERY_BACKOFF_HOLDING_REASON, deliveryBackoffApplies, deliveryHold, recordDeliveryFailure, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
+/**
+ * 1. What may we offer this sync? 2. What just happened to each object?
+ *
+ * `partitionHeldEvidenceFiles` keeps objects inside their delivery-backoff
+ * window off the wire, and turns each one into a named failure rather than a
+ * silent omission. `persistDeliveryAttempts` writes the attempt counts that
+ * drive that backoff, before ingest, so an ingest failure cannot reset every
+ * window to zero.
+ */
+/**
+ * Split the pack's files into "offer these now" and "still in backoff".
+ *
+ * A held file becomes an `upload_failed` outcome labelled
+ * `delivery_backoff_holding`. That is deliberate rather than a quiet omission:
+ * the pointer gets pruned from the envelope (the object is genuinely not
+ * durable), the sync stays in `retry_pending`, and the reason travels to the
+ * status output. A hold that read as success would be the green-status-hiding-
+ * missing-collection failure the fleet contract forbids.
+ */
+export function partitionHeldEvidenceFiles(files, staging, now, mode) {
+    const deliverable = [];
+    const held = [];
+    const bypassed = [];
+    const backoffApplies = deliveryBackoffApplies(mode);
+    for (const file of files) {
+        const hold = deliveryHold(staging, file.pointer.content_hash_sha256, now);
+        if (hold && !backoffApplies) {
+            // BLI-3118: a person asked for this one now. Offering it is the whole
+            // point of the retry command Cockpit printed, and the bypass is logged
+            // rather than assumed.
+            bypassed.push(hold);
+            deliverable.push(file);
+            continue;
+        }
+        if (!hold) {
+            deliverable.push(file);
+            continue;
+        }
+        held.push({
+            pointer: file.pointer,
+            object_key: file.pointer.object_key ?? "",
+            codex_session_id: file.codex_session_id ?? null,
+            kind: file.kind ?? "raw_evidence",
+            ...(file.artifact_metadata
+                ? { artifact_metadata: file.artifact_metadata }
+                : {}),
+            upload_state: "upload_failed",
+            reason: DELIVERY_BACKOFF_HOLDING_REASON,
+            uploaded_chunk_count: 0,
+        });
+    }
+    return { deliverable, held, bypassed };
+}
+/**
+ * Say out loud that bytes were withheld on purpose.
+ *
+ * Counts and sizes only, never a path. Without this line an unattended machine
+ * withholds evidence for hours and leaves no trace of having done so.
+ */
+export function logEvidenceHeldByBackoff(held, attemptedAt) {
+    if (held.length === 0)
+        return;
+    console.error("[cockpit-sync] raw evidence held by delivery backoff", JSON.stringify({
+        attempted_at: attemptedAt,
+        reason: DELIVERY_BACKOFF_HOLDING_REASON,
+        object_count: held.length,
+        byte_size: held.reduce((sum, outcome) => sum + (outcome.pointer.byte_size ?? 0), 0),
+    }));
+}
+/**
+ * Say out loud that an operator's retry ignored a live backoff window.
+ *
+ * The success branch of BLI-3118: without this line the only trace of the
+ * decision is an object that was held on one run and offered on the next, and
+ * nothing on the machine says which rule made the difference.
+ */
+export function logEvidenceBackoffBypassed(bypassed, attemptedAt) {
+    if (bypassed.length === 0)
+        return;
+    console.error("[cockpit-sync] raw evidence delivery backoff bypassed", JSON.stringify({
+        attempted_at: attemptedAt,
+        reason: DELIVERY_BACKOFF_BYPASS_REASON,
+        object_count: bypassed.length,
+        byte_size: bypassed.reduce((sum, entry) => sum + entry.byte_size, 0),
+        max_attempts: bypassed.reduce((max, entry) => Math.max(max, entry.attempts), 0),
+        last_reasons: [...new Set(bypassed.map((entry) => entry.last_reason))]
+            .sort(),
+    }));
+}
+/**
+ * Count what just happened to each object, and when it may be offered again.
+ *
+ * Written immediately after the upload pass and before ingest, so an ingest
+ * failure cannot lose the attempt counts — losing them resets every backoff to
+ * zero and the fleet is back to 15-minute retries forever. A held outcome is
+ * not itself an attempt: counting it would push its own next attempt further
+ * out on every sync and eventually never retry at all.
+ */
+export async function persistDeliveryAttempts(stateDir, staging, outcomes, attemptedAt) {
+    let changed = false;
+    for (const outcome of outcomes) {
+        const contentHash = outcome.pointer.content_hash_sha256;
+        if (!contentHash)
+            continue;
+        if (outcome.reason === DELIVERY_BACKOFF_HOLDING_REASON)
+            continue;
+        if (outcome.upload_state === "upload_failed") {
+            const entry = recordDeliveryFailure(staging, contentHash, {
+                reason: outcome.reason ?? "upload_failed",
+                attemptedAt,
+                byteSize: outcome.pointer.byte_size ?? 0,
+            });
+            changed = true;
+            console.error("[cockpit-sync] raw evidence delivery failed", JSON.stringify({
+                reason: entry.last_reason,
+                kind: outcome.kind,
+                attempts: entry.attempts,
+                first_failed_at: entry.first_failed_at,
+                next_attempt_at: entry.next_attempt_at,
+                byte_size: entry.byte_size,
+            }));
+            continue;
+        }
+        if (clearDeliveryAttempt(staging, contentHash)) {
+            changed = true;
+            console.error("[cockpit-sync] raw evidence delivery recovered", JSON.stringify({
+                reason: "delivery_recovered",
+                kind: outcome.kind,
+                upload_state: outcome.upload_state,
+            }));
+        }
+    }
+    if (!changed)
+        return;
+    staging.updated_at = attemptedAt.toISOString();
+    await writeRawEvidenceStagingState(stateDir, staging).catch((error) => {
+        console.error("[cockpit-sync] delivery attempt state write failed", JSON.stringify({
+            reason: "staging_state_write_failed",
+            detail: error instanceof Error ? error.name : typeof error,
+            tracked_count: Object.keys(staging.delivery_attempts).length,
+        }));
+    });
+}