@bli-cockpit/cli 0.2.69 → 0.2.72

package/dist/commands/doctor-disk-words.js

@@ -0,0 +1,59 @@
+export function days(ms) {
+    return (ms / 86_400_000).toFixed(1);
+}
+/**
+ * What the drain did, in the sentence a person reads (BLI-3797).
+ *
+ * Until this ticket the row said "run `cockpit sync` to deliver them" about
+ * objects no sync would ever offer again: the live sync only sends what it
+ * collected THIS tick, so 1.8 GB of orphaned evidence sat behind a fix sentence
+ * that could not come true. The drain is real now, `--fix` spends it here, and
+ * the row reports what it actually managed rather than issuing an instruction.
+ */
+export function redeliveryLine(result) {
+    if (result.reason === "no_device_session") {
+        return "they cannot be re-offered until this machine signs in — run `cockpit login`";
+    }
+    if (result.reason === "disabled") {
+        return "re-delivery is switched off on this machine (COCKPIT_DISABLE_EVIDENCE_REDELIVERY=1)";
+    }
+    if (result.uploaded > 0 || result.reused > 0) {
+        return `re-delivered ${result.uploaded + result.reused} of them (${mib(result.uploaded_bytes)} MB); ${result.deferred} left for the next tick`;
+    }
+    if (result.failed > 0) {
+        return `re-offering them was refused: ${result.failure_reasons.join(", ") || "unknown"} — the next tick retries under backoff`;
+    }
+    if (result.held > 0) {
+        return `${result.held} are held by delivery backoff and retry on a later tick`;
+    }
+    return "the next `cockpit sync` re-offers them";
+}
+export function diskRowMessage(footprint, capBytes) {
+    const staging = footprint.staging;
+    const parts = [
+        `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
+    ];
+    // BLI-3797: "1,916.9 uncommitted" is a number, not a finding. The row now
+    // names WHY the biggest share of it has not landed and HOW LONG those bytes
+    // have been here — on the reference Mac the answer was
+    // `reconciled_unknown_to_server` on 234 objects whose oldest was 45 days old,
+    // which is a different problem from a delivery that failed this morning.
+    const dominant = staging.dominant_uncommitted_reason;
+    if (dominant) {
+        parts.push(`oldest undelivered ${days(dominant.oldest_disk_age_ms)}d; biggest reason ${dominant.reason} on ${dominant.count} object(s), ${mib(dominant.bytes)} MB`);
+    }
+    // BLI-3619's second half: "unknown" means the local ledger's own capped
+    // memory cannot say, never that delivery failed — and the one command that
+    // actually answers it is named right here, not left for a person to find.
+    if (staging.unknown_count > 0) {
+        parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
+    }
+    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
+    for (const vault of footprint.vaults) {
+        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
+    }
+    return parts.join("; ");
+}
+export function mib(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}

package/dist/commands/doctor-pipeline.js

@@ -7,9 +7,11 @@ import { describeError } from "../health-detail.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { retentionOptionsFromEnv } from "../disk-retention.js";
 import { readDiskFootprint } from "../disk-usage.js";
+import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
+import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
 /**
@@ -126,6 +128,18 @@ export async function checkDiskState(context) {
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
+    // BLI-3797, BEFORE the prune: the prune can only delete what the ledger
+    // vouches for, so on a machine held over the cap by undelivered evidence it
+    // frees nothing at all. Deliver first, then sweep what delivering made
+    // durable. This never throws and never decides the row's verdict — a drain
+    // that could not run leaves the prune to do exactly what it did before.
+    const redelivery = await runEvidenceRedelivery({
+        homeDir: context.command.homeDir,
+        dashboardUrl: context.command.dashboardUrl,
+        env: context.io.env,
+        fetch: context.io.fetch,
+    });
+    const redelivered = redeliveryLine(redelivery);
     const pruned = await runStagingPrune(paths, {
         env: context.io.env,
         force: true,
@@ -144,27 +158,7 @@ export async function fixDiskState(context) {
     // Deliberately still `ok`: staging over the cap because evidence has not been
     // accepted yet is the collector working, not a machine to repair. The row
     // names the blockage and the one command that goes further.
-    return ok("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest — run \`cockpit sync\` to deliver them, or \`cockpit clean --all-committed\` to drop every accepted copy now`);
-}
-function diskRowMessage(footprint, capBytes) {
-    const staging = footprint.staging;
-    const parts = [
-        `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
-    ];
-    // BLI-3619's second half: "unknown" means the local ledger's own capped
-    // memory cannot say, never that delivery failed — and the one command that
-    // actually answers it is named right here, not left for a person to find.
-    if (staging.unknown_count > 0) {
-        parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
-    }
-    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
-    for (const vault of footprint.vaults) {
-        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
-    }
-    return parts.join("; ");
-}
-function mib(bytes) {
-    return (bytes / (1024 * 1024)).toFixed(1);
+    return ok("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest — ${redelivered} — or \`cockpit clean --all-committed\` to drop every accepted copy now`);
 }
 function capturedIo(io, forward) {
     const stdoutChunks = [];

package/dist/commands/heartbeat.js

@@ -25,10 +25,12 @@ import os from "node:os";
 import path from "node:path";
 import { COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, memoryInstallGaps, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
 import { readCachedSetupReceipt } from "./setup-receipt.js";
+import { readStagingInventory } from "../disk-usage.js";
 import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
 import { readMemoryReceiptFile } from "./memory-install-receipt.js";
+import { readMemoryHookCounts } from "./memory-hook-counts.js";
 const HEARTBEAT_TIMEOUT_MS = 5_000;
 /**
  * The label form of one approved root.
@@ -110,10 +112,44 @@ export function buildCollectorHeartbeat(options) {
         ...(typeof options.facts.sessionsPendingUpload === "number"
             ? { sessions_pending_upload: options.facts.sessionsPendingUpload }
             : {}),
+        ...(typeof options.facts.stagingUncommittedBytes === "number"
+            ? { staging_uncommitted_bytes: options.facts.stagingUncommittedBytes }
+            : {}),
+        ...(options.facts.stagingUncommittedReason
+            ? { staging_uncommitted_reason: options.facts.stagingUncommittedReason }
+            : {}),
         ...(options.memoryInstall ? { memory_install: options.memoryInstall } : {}),
         ...(options.setupReceipt ? { setup_receipt: options.setupReceipt } : {}),
     };
 }
+/**
+ * What this machine is still holding that never reached storage (BLI-3797).
+ *
+ * One extra staging walk per tick, on purpose: `cockpit ops` had no way to see
+ * that a green, syncing, up-to-date laptop was sitting on 1.8 GB of evidence the
+ * server had never received, and a fleet-wide failure nobody can see is the
+ * BLI-2528 shape exactly. The walk is bounded by the pack tree the prune keeps
+ * under a 2 GB cap, and it is best-effort: a read that fails returns nulls and
+ * says so, so the heartbeat omits both fields rather than claiming zero.
+ */
+export async function readHeartbeatStagingFacts(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    try {
+        const inventory = await readStagingInventory(paths, options.now ?? new Date());
+        const dominant = inventory.dominant_uncommitted_reason;
+        return {
+            bytes: inventory.uncommitted_bytes,
+            reason: dominant ? `${dominant.reason}:${dominant.count}`.slice(0, 120) : null,
+        };
+    }
+    catch (error) {
+        console.error("[heartbeat] the staging tree could not be read; this tick reports no backlog figure", JSON.stringify({
+            reason: "staging_inventory_unreadable",
+            ...describeError(error),
+        }));
+        return { bytes: null, reason: null };
+    }
+}
 /**
  * The cached memory receipt for this tick, or null with a named reason
  * (BLI-3729).
@@ -123,6 +159,13 @@ export function buildCollectorHeartbeat(options) {
  * reads and a `--print-config` spawn every fifteen minutes to re-prove a state
  * that changes about once a month. The reason is returned rather than logged
  * here so the ONE heartbeat log line carries it.
+ *
+ * BLI-3788: the hook COUNTS are merged in here, on the tick, and deliberately
+ * not baked into the cached receipt. The five words change about monthly; how
+ * often the prompt hook lost its deadline changes every hour, and a number
+ * cached for a day would answer yesterday's question. An install receipt this
+ * machine could not read means no counts either — there is nowhere to put
+ * them — and that case keeps the receipt's own reason.
  */
 export async function readHeartbeatMemoryReceipt(options) {
     const paths = getCollectorRuntimePaths(options.homeDir);
@@ -142,7 +185,20 @@ export async function readHeartbeatMemoryReceipt(options) {
             return parsed.success ? parsed.data : null;
         },
     });
-    return { receipt: result.receipt, reason: result.reason };
+    if (!result.receipt)
+        return { receipt: null, reason: result.reason };
+    const hooks = readMemoryHookCounts({
+        homeDir: options.homeDir ?? os.homedir(),
+        ...(options.now ? { now: options.now } : {}),
+    });
+    return {
+        receipt: {
+            ...result.receipt,
+            ...(hooks.counts ?? {}),
+            hook_stats_reason: hooks.reason,
+        },
+        reason: result.reason,
+    };
 }
 /**
  * Sends the heartbeat. Returns whether it landed; never throws.
@@ -248,6 +304,13 @@ export async function sendCollectorHeartbeatBestEffort(options) {
             // sync.err.log alone.
             memory_receipt: memory.reason,
             memory_gaps: memory.receipt ? memoryInstallGaps(memory.receipt) : null,
+            // BLI-3788. The hooks are registered (above) AND they either worked or
+            // did not (here). A prompt hook that misses its deadline prints
+            // nothing to the person, so these counts are the only trace one leaves
+            // on this machine; `null` means no counter file, never zero misses.
+            memory_hook_runs_24h: memory.receipt?.hook_runs_24h ?? null,
+            memory_hook_timeouts_24h: memory.receipt?.hook_timeouts_24h ?? null,
+            memory_hook_stats: memory.receipt?.hook_stats_reason ?? null,
         }));
         return true;
     }

package/dist/commands/memory-hook-counts.js

@@ -0,0 +1,61 @@
+/**
+ * HOW OFTEN DID THE HOOKS MISS? — the reading half (BLI-3788).
+ *
+ * `bli-memory-mcp` counts every hook run into a counts-only file in this
+ * machine's state directory. This module reads it once a sync tick and hands
+ * the last 24 hours to the heartbeat, where it rides the memory receipt into
+ * `ambient_collector_devices.metadata.memory_install` and out onto `cockpit
+ * ops --memory`.
+ *
+ * Nothing here knows the file's shape: the path, the schema and the windowing
+ * rule are `@bli-cockpit/telemetry-core`'s `memory-hook-stats.ts`, which the
+ * writing package spends too. That is the whole point of putting them there.
+ *
+ * ## Which event, and why only one
+ *
+ * The PROMPT hook. It is the one a person waits on with their sentence typed,
+ * the one whose budget QA tick 18 caught it losing, and the one that runs on
+ * every turn — so it is the only one whose miss rate means anything as a
+ * daily number. The file holds all three; a future gauge that wants
+ * SessionStart or Stop reads the same rows with the same function.
+ *
+ * ## Absent is not zero
+ *
+ * A machine with no file has no counts and says `hook_stats_absent`. A machine
+ * whose file will not parse says `hook_stats_unparseable`. Neither reports
+ * zeroes, because a zero here would read as "the hooks ran and never missed",
+ * which is the exact false green this ticket exists to remove.
+ */
+import fs from "node:fs";
+import { memoryHookStatsFilePath, parseMemoryHookStats, summariseMemoryHookWindow, } from "@bli-cockpit/telemetry-core";
+export function readMemoryHookCounts(options) {
+    const readText = options.readText ?? defaultReadText;
+    const file = memoryHookStatsFilePath(options.homeDir);
+    const raw = readText(file);
+    if (raw === null)
+        return { counts: null, reason: "hook_stats_absent" };
+    const parsed = parseMemoryHookStats(raw);
+    if (!parsed.ok)
+        return { counts: null, reason: parsed.reason };
+    const window = summariseMemoryHookWindow(parsed.file, "prompt", {
+        now: options.now ?? new Date(),
+        hours: 24,
+    });
+    return {
+        counts: {
+            hook_runs_24h: window.runs,
+            hook_timeouts_24h: window.timeouts,
+            hook_printed_24h: window.printed,
+            hook_failed_24h: window.failed,
+        },
+        reason: "ok",
+    };
+}
+function defaultReadText(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}

package/dist/commands/ops-render-memory.js

@@ -70,6 +70,40 @@ export function renderMemoryUsage(memory, dim) {
     }
     return lines;
 }
+/**
+ * The hook half: one line per machine, the server's own words.
+ *
+ * A machine that reports NO counts is printed too, dimmed and named. It is the
+ * whole point: "no measurement" and "no misses" are different facts, and the
+ * only reason this section exists is that they used to be indistinguishable.
+ */
+export function renderMemoryHooks(hooks, dim) {
+    const lines = ["", `HOOKS   ${hooks.summary ?? "(no summary)"}`];
+    if (hooks.readError) {
+        lines.push(`  the devices could not be read (${hooks.readError}); nothing is known about whether recalls are arriving`);
+        return lines;
+    }
+    const devices = hooks.devices ?? [];
+    if (devices.length === 0) {
+        lines.push(dim("  no live collector device to report on"));
+        return lines;
+    }
+    // Worst first: the machine losing recalls is the one somebody acts on, and a
+    // machine that reports nothing sinks below both — it is a rollout gap, not a
+    // failure.
+    const ranked = [...devices].sort((left, right) => {
+        const leftKnown = typeof left.runs === "number" ? 0 : 1;
+        const rightKnown = typeof right.runs === "number" ? 0 : 1;
+        if (leftKnown !== rightKnown)
+            return leftKnown - rightKnown;
+        return (right.timeouts ?? 0) - (left.timeouts ?? 0);
+    });
+    for (const device of ranked) {
+        const line = `  ${device.line ?? `${device.displayName ?? "?"}: (no line)`}`;
+        lines.push((device.timeouts ?? 0) > 0 ? line : dim(line));
+    }
+    return lines;
+}
 /** The two sources that mean a PERSON's agent used memory. Never the import. */
 function agentSaves(counts) {
     return (counts?.mcp ?? 0) + (counts?.stop_hook ?? 0);

package/dist/commands/ops-render.js

@@ -12,7 +12,7 @@
  * artifact does and does not prove — because that is exactly the moment
  * somebody is about to conclude something from it.
  */
-export { renderMemoryUsage } from "./ops-render-memory.js";
+export { renderMemoryHooks, renderMemoryUsage } from "./ops-render-memory.js";
 /** The word a person reads. Short, fixed width, and never a bare colour. */
 export function verdictWord(verdict) {
     switch (verdict) {

package/dist/commands/ops.js

@@ -25,7 +25,7 @@
  */
 import { colorEnabled, dim, writeLine } from "./cli-io.js";
 import { renderOpsStatus } from "./ops-render.js";
-import { renderMemoryUsage, } from "./ops-render-memory.js";
+import { renderMemoryHooks, renderMemoryUsage, } from "./ops-render-memory.js";
 import { asRecord, callTower, openTower, writeCommandFailure } from "./tower-command.js";
 /**
  * A whole compile, plus a little. `maxDuration` on `/api/ops/recompile` is 800
@@ -79,7 +79,7 @@ async function runOpsStatus(command, io, tower) {
         // BLI-3762: a job that ran and wrote less than it owed is not healthy.
         row.verdict === "degraded");
     if (command.json) {
-        writeLine(io.stdout, JSON.stringify(memory ? { ...payload, memory: memory.section } : payload));
+        writeLine(io.stdout, JSON.stringify(memory ? { ...payload, memory: memory.section, hooks: memory.hooks } : payload));
     }
     else {
         const styled = colorEnabled(io);
@@ -91,7 +91,16 @@ async function runOpsStatus(command, io, tower) {
                 writeLine(io.stdout, line);
             }
         }
-        else if (memory) {
+        // BLI-3788. Printed whenever the door sent it, including when the usage
+        // half could not be read: "are the recalls arriving" and "is anybody
+        // saving" are two questions, and one being unreadable does not silence
+        // the other.
+        if (memory?.hooks) {
+            for (const line of renderMemoryHooks(memory.hooks, (text) => dim(text, styled))) {
+                writeLine(io.stdout, line);
+            }
+        }
+        if (memory && !memory.section) {
             // Never a silent gap where a section was asked for: the reason the gauge
             // could not be read is printed where the gauge would have been.
             writeLine(io.stdout, "");
@@ -119,6 +128,12 @@ async function runOpsStatus(command, io, tower) {
         memory_agent_saves: memory?.section
             ? (memory.section.counts?.mcp ?? 0) + (memory.section.counts?.stop_hook ?? 0)
             : null,
+        // BLI-3788: whether the per-turn recalls arrived, on the same line. A
+        // null here is "this dashboard does not report it yet", never zero
+        // misses.
+        memory_hook_runs_24h: memory?.hooks?.totals?.runs ?? null,
+        memory_hook_timeouts_24h: memory?.hooks?.totals?.timeouts ?? null,
+        memory_hook_devices_reporting: memory?.hooks?.reporting ?? null,
     })}`);
     return unhealthy.length > 0 ? 1 : 0;
 }
@@ -144,12 +159,15 @@ async function readMemoryUsage(command, io, tower) {
             reason: result.reason,
             http_status: result.httpStatus ?? null,
         })}`);
-        return { section: null, reason: result.reason };
+        return { section: null, hooks: null, reason: result.reason };
     }
     const body = asRecord(result.body);
+    // BLI-3788: the hook counts ride the same answer, and their absence is a
+    // fact about the SERVER's version rather than about this fleet — an older
+    // dashboard sends no `hooks` key, and printing nothing is right there.
     if (!body.memory)
-        return { section: null, reason: "memory_section_absent" };
-    return { section: body.memory, reason: "ok" };
+        return { section: null, hooks: body.hooks ?? null, reason: "memory_section_absent" };
+    return { section: body.memory, hooks: body.hooks ?? null, reason: "ok" };
 }
 async function runOpsRecompile(command, io, tower) {
     const person = command.person ?? "";

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.69");
+    writeLine(io?.stdout ?? process.stdout, "0.2.72");
     return 0;
   }
 

package/dist/commands/status.js

@@ -72,7 +72,14 @@ export async function runStatus(command, io) {
         writeConnectedBlock(io, setupReceipt);
         return 0;
     }
-    const status = await inspectLocalCollectorStatus(command);
+    // The staging walk is opt-in (BLI-3797) and this is the surface that pays for
+    // it: one person asking one question. The multi-repo branch above deliberately
+    // does not — the backlog is a MACHINE fact, so N repos would walk one tree N
+    // times to print the same number.
+    const status = await inspectLocalCollectorStatus({
+        ...command,
+        includeStagingBacklog: true,
+    });
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({
             ...status,

package/dist/commands/sync-followups.js

@@ -2,7 +2,8 @@
  * What the sync tick does AFTER collection's own outcome is decided and
  * reported: keep this machine's CLI current on npm `latest` (BLI-2601), put a
  * broken scheduler registration back (BLI-2721), keep BLI Memory registered
- * with both agent hosts (BLI-3580), and stop the laptop filling up (BLI-3619).
+ * with both agent hosts (BLI-3580), re-offer staged evidence that never landed
+ * (BLI-3797), and stop the laptop filling up (BLI-3619).
  *
  * Split out of commands/sync.ts (BLI-3578), moved verbatim. They belong
  * together because they share one rule, and it is the reason both are called
@@ -20,6 +21,7 @@ import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-sta
 import { runAutostartSelfHeal, } from "../autostart-self-heal.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
+import { runEvidenceRedelivery, } from "../evidence-redelivery.js";
 import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
 /** How many reconcile batches (of up to 500 hashes each) one sync tick may spend. */
 const RECONCILE_BATCHES_PER_TICK = 1;
@@ -215,12 +217,20 @@ function memoryInstallEvent(outcome) {
  * costs one cheap local read and no network call at all, so it never competes
  * with collection for the tick's time. A reconcile failure never blocks the
  * prune that follows it.
+ *
+ * BLI-3797 sits between them: the reconcile has just established which staged
+ * objects the SERVER says it never received, so the redelivery drain re-offers
+ * exactly those, bounded, before the prune runs and can delete whatever landed.
+ * Neither of the two can block the prune, and none of the three can fail a tick.
  */
 export async function runStagingPruneAfterSync(command, io, dashboardUrl, options = {}) {
     const events = [];
     const reconciled = await runReconcileFollowUp(command, io, dashboardUrl, options);
     if (reconciled)
         events.push(reconcileEvent(reconciled));
+    const redelivered = await runRedeliveryFollowUp(command, io, dashboardUrl, options);
+    if (redelivered)
+        events.push(redeliveryEvent(redelivered));
     let result;
     try {
         result = await runStagingPrune(getCollectorRuntimePaths(command.homeDir), {
@@ -269,6 +279,59 @@ async function runReconcileFollowUp(command, io, dashboardUrl, options) {
     });
     return result.reason === "nothing_unknown" ? null : result;
 }
+/**
+ * BLI-3797, between the reconcile above and the prune below, and in that order
+ * for a reason: reconcile turns `unknown` into a server-backed answer, this
+ * re-offers what that answer says never landed, and the prune then deletes
+ * whatever this just made durable. Running the drain first would ask the server
+ * about hashes it is about to be told the truth about; running it after the
+ * prune would leave a tick's worth of freed cap unused.
+ *
+ * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
+ * the boring, common case — nothing on this disk is undelivered — so the steady
+ * state costs no receipt, the same rule the reconcile follow-up above and the
+ * prune's daily throttle below both follow.
+ */
+async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
+    const result = await runEvidenceRedelivery({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        env: io.env,
+        fetch: io.fetch,
+        ...(options.now ? { now: options.now } : {}),
+    });
+    return result.reason === "nothing_uncommitted" ? null : result;
+}
+/** Counts and byte totals only; no pack id and no hash travels in a receipt. */
+function redeliveryEvent(result) {
+    const detail = [
+        `offered ${result.offered} object(s), ${result.offered_bytes}B, across ${result.packs} pack(s)`,
+        `uploaded ${result.uploaded} (${result.uploaded_bytes}B), reused ${result.reused}, failed ${result.failed}`,
+        `held ${result.held}, deferred ${result.deferred} (${result.deferred_bytes}B)`,
+        result.failure_reasons.length > 0
+            ? `failure_reasons ${result.failure_reasons.join(",")}`
+            : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    if (result.status === "fail") {
+        return {
+            step: "evidence_redelivery",
+            status: "fail",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    if (result.status === "skipped") {
+        return {
+            step: "evidence_redelivery",
+            status: "skipped",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    return { step: "evidence_redelivery", status: "ok", error_detail: detail };
+}
 function prunedNothing() {
     return {
         status: "skipped",

package/dist/commands/sync.js

@@ -2,7 +2,7 @@ import { writeLine } from "./cli-io.js";
 import { attributedSyncRunStatus, cursorStatusLine, displayTicketId, rawEvidenceSyncLine, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
 import { collectionRootConsentAliases } from "./collection-roots.js";
 import { discoverCommandWorktrees } from "./local-discovery.js";
-import { sendCollectorHeartbeatBestEffort, } from "./heartbeat.js";
+import { sendCollectorHeartbeatBestEffort, readHeartbeatStagingFacts, } from "./heartbeat.js";
 import { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
 import { runAttributedWorktreeSync, } from "./session-sync.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
@@ -98,11 +98,22 @@ export async function runSync(command, io) {
  */
 async function sendSyncHeartbeat(command, io, dashboardUrl, facts) {
     const roots = await resolveSyncCollectionRoots(command).catch(() => []);
+    // BLI-3797: the backlog figure rides the same check-in as the root labels, so
+    // `cockpit ops` learns about undelivered evidence on the SAME tick that proves
+    // the machine is alive. Best-effort: nulls omit the fields rather than
+    // reporting a zero nobody measured.
+    const staging = await readHeartbeatStagingFacts({
+        homeDir: command.homeDir,
+    }).catch(() => ({ bytes: null, reason: null }));
     await sendCollectorHeartbeatBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
         roots,
-        facts,
+        facts: {
+            ...facts,
+            stagingUncommittedBytes: staging.bytes,
+            stagingUncommittedReason: staging.reason,
+        },
         io,
     }).catch((error) => {
         // The sender already swallows everything it knows about; this is the net

package/dist/disk-retention.js

@@ -131,7 +131,11 @@ function pushDeletion(plan, object, reason) {
 function addToBucket(bucket, object) {
     bucket.count += 1;
     bucket.bytes += object.byte_size;
-    bucket.oldest_age_ms = Math.max(bucket.oldest_age_ms, object.age_ms);
+    // Report the age of the BYTES, not of the last answer about them (BLI-3797).
+    // `age_ms` on a reconciled object is the age of the reconcile reply, which
+    // made `oldest_uncommitted_age_ms` read 0.94 days for a 45-day-old backlog.
+    // Deletion still keys off `age_ms` above — this bucket is report-only.
+    bucket.oldest_age_ms = Math.max(bucket.oldest_age_ms, object.disk_age_ms || object.age_ms);
 }
 function removeFromBucket(bucket, object) {
     bucket.count -= 1;