@bli-cockpit/cli 0.2.70 → 0.2.72

package/dist/commands/doctor-disk-words.js

@@ -0,0 +1,59 @@
+export function days(ms) {
+    return (ms / 86_400_000).toFixed(1);
+}
+/**
+ * What the drain did, in the sentence a person reads (BLI-3797).
+ *
+ * Until this ticket the row said "run `cockpit sync` to deliver them" about
+ * objects no sync would ever offer again: the live sync only sends what it
+ * collected THIS tick, so 1.8 GB of orphaned evidence sat behind a fix sentence
+ * that could not come true. The drain is real now, `--fix` spends it here, and
+ * the row reports what it actually managed rather than issuing an instruction.
+ */
+export function redeliveryLine(result) {
+    if (result.reason === "no_device_session") {
+        return "they cannot be re-offered until this machine signs in — run `cockpit login`";
+    }
+    if (result.reason === "disabled") {
+        return "re-delivery is switched off on this machine (COCKPIT_DISABLE_EVIDENCE_REDELIVERY=1)";
+    }
+    if (result.uploaded > 0 || result.reused > 0) {
+        return `re-delivered ${result.uploaded + result.reused} of them (${mib(result.uploaded_bytes)} MB); ${result.deferred} left for the next tick`;
+    }
+    if (result.failed > 0) {
+        return `re-offering them was refused: ${result.failure_reasons.join(", ") || "unknown"} — the next tick retries under backoff`;
+    }
+    if (result.held > 0) {
+        return `${result.held} are held by delivery backoff and retry on a later tick`;
+    }
+    return "the next `cockpit sync` re-offers them";
+}
+export function diskRowMessage(footprint, capBytes) {
+    const staging = footprint.staging;
+    const parts = [
+        `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
+    ];
+    // BLI-3797: "1,916.9 uncommitted" is a number, not a finding. The row now
+    // names WHY the biggest share of it has not landed and HOW LONG those bytes
+    // have been here — on the reference Mac the answer was
+    // `reconciled_unknown_to_server` on 234 objects whose oldest was 45 days old,
+    // which is a different problem from a delivery that failed this morning.
+    const dominant = staging.dominant_uncommitted_reason;
+    if (dominant) {
+        parts.push(`oldest undelivered ${days(dominant.oldest_disk_age_ms)}d; biggest reason ${dominant.reason} on ${dominant.count} object(s), ${mib(dominant.bytes)} MB`);
+    }
+    // BLI-3619's second half: "unknown" means the local ledger's own capped
+    // memory cannot say, never that delivery failed — and the one command that
+    // actually answers it is named right here, not left for a person to find.
+    if (staging.unknown_count > 0) {
+        parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
+    }
+    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
+    for (const vault of footprint.vaults) {
+        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
+    }
+    return parts.join("; ");
+}
+export function mib(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}

package/dist/commands/doctor-pipeline.js

@@ -7,9 +7,11 @@ import { describeError } from "../health-detail.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { retentionOptionsFromEnv } from "../disk-retention.js";
 import { readDiskFootprint } from "../disk-usage.js";
+import { runEvidenceRedelivery } from "../evidence-redelivery.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths } from "../local-state.js";
 import { runRawEvidenceLocalGc, rawEvidenceGcSummary } from "../raw-evidence-gc.js";
 import { runBackfillCommand } from "./backfill.js";
+import { diskRowMessage, mib, redeliveryLine } from "./doctor-disk-words.js";
 import { doctorRoots } from "./doctor-access.js";
 import { asRecord, fail, needsFix, ok, skipped } from "./doctor-report.js";
 /**
@@ -126,6 +128,18 @@ export async function checkDiskState(context) {
 }
 export async function fixDiskState(context) {
     const paths = getCollectorRuntimePaths(context.command.homeDir);
+    // BLI-3797, BEFORE the prune: the prune can only delete what the ledger
+    // vouches for, so on a machine held over the cap by undelivered evidence it
+    // frees nothing at all. Deliver first, then sweep what delivering made
+    // durable. This never throws and never decides the row's verdict — a drain
+    // that could not run leaves the prune to do exactly what it did before.
+    const redelivery = await runEvidenceRedelivery({
+        homeDir: context.command.homeDir,
+        dashboardUrl: context.command.dashboardUrl,
+        env: context.io.env,
+        fetch: context.io.fetch,
+    });
+    const redelivered = redeliveryLine(redelivery);
     const pruned = await runStagingPrune(paths, {
         env: context.io.env,
         force: true,
@@ -144,27 +158,7 @@ export async function fixDiskState(context) {
     // Deliberately still `ok`: staging over the cap because evidence has not been
     // accepted yet is the collector working, not a machine to repair. The row
     // names the blockage and the one command that goes further.
-    return ok("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest — run \`cockpit sync\` to deliver them, or \`cockpit clean --all-committed\` to drop every accepted copy now`);
-}
-function diskRowMessage(footprint, capBytes) {
-    const staging = footprint.staging;
-    const parts = [
-        `staging ${mib(staging.total_bytes)} MB (${mib(staging.committed_bytes)} committed / ${mib(staging.uncommitted_bytes)} uncommitted / ${mib(staging.unknown_bytes)} unknown) against a ${mib(capBytes)} MB cap`,
-    ];
-    // BLI-3619's second half: "unknown" means the local ledger's own capped
-    // memory cannot say, never that delivery failed — and the one command that
-    // actually answers it is named right here, not left for a person to find.
-    if (staging.unknown_count > 0) {
-        parts.push(`${staging.unknown_count} object(s) unknown to this laptop's own ledger — run \`cockpit clean --reconcile\` to ask the server`);
-    }
-    parts.push(`logs ${mib(footprint.logs.total_bytes)} MB`, `spool ${mib(footprint.spool_bytes)} MB`);
-    for (const vault of footprint.vaults) {
-        parts.push(`${vault.name} ${mib(vault.byte_size)} MB (a one-off; \`cockpit clean --all-committed\` removes it only if every file in it is accepted)`);
-    }
-    return parts.join("; ");
-}
-function mib(bytes) {
-    return (bytes / (1024 * 1024)).toFixed(1);
+    return ok("disk-bounded", "staging_cap_blocked_by_uncommitted", `freed ${mib(pruned.deleted_bytes)} MB; ${message}; ${pruned.cap_blocked_count} object(s) the upload ledger cannot vouch for are holding the rest — ${redelivered} — or \`cockpit clean --all-committed\` to drop every accepted copy now`);
 }
 function capturedIo(io, forward) {
     const stdoutChunks = [];

package/dist/commands/heartbeat.js

@@ -25,6 +25,7 @@ import os from "node:os";
 import path from "node:path";
 import { COLLECTOR_HEARTBEAT_SCHEMA_VERSION, MemoryInstallReceiptSchema, memoryInstallGaps, setupReceiptGaps, } from "@bli-cockpit/telemetry-core";
 import { readCachedSetupReceipt } from "./setup-receipt.js";
+import { readStagingInventory } from "../disk-usage.js";
 import { describeError } from "../health-detail.js";
 import { shouldSuppressFleetReceipts, } from "../dev-build.js";
 import { getCollectorRuntimePaths, readLocalCollectorSessionFile, LOCAL_COLLECTOR_VERSION, } from "../local-state.js";
@@ -111,10 +112,44 @@ export function buildCollectorHeartbeat(options) {
         ...(typeof options.facts.sessionsPendingUpload === "number"
             ? { sessions_pending_upload: options.facts.sessionsPendingUpload }
             : {}),
+        ...(typeof options.facts.stagingUncommittedBytes === "number"
+            ? { staging_uncommitted_bytes: options.facts.stagingUncommittedBytes }
+            : {}),
+        ...(options.facts.stagingUncommittedReason
+            ? { staging_uncommitted_reason: options.facts.stagingUncommittedReason }
+            : {}),
         ...(options.memoryInstall ? { memory_install: options.memoryInstall } : {}),
         ...(options.setupReceipt ? { setup_receipt: options.setupReceipt } : {}),
     };
 }
+/**
+ * What this machine is still holding that never reached storage (BLI-3797).
+ *
+ * One extra staging walk per tick, on purpose: `cockpit ops` had no way to see
+ * that a green, syncing, up-to-date laptop was sitting on 1.8 GB of evidence the
+ * server had never received, and a fleet-wide failure nobody can see is the
+ * BLI-2528 shape exactly. The walk is bounded by the pack tree the prune keeps
+ * under a 2 GB cap, and it is best-effort: a read that fails returns nulls and
+ * says so, so the heartbeat omits both fields rather than claiming zero.
+ */
+export async function readHeartbeatStagingFacts(options) {
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    try {
+        const inventory = await readStagingInventory(paths, options.now ?? new Date());
+        const dominant = inventory.dominant_uncommitted_reason;
+        return {
+            bytes: inventory.uncommitted_bytes,
+            reason: dominant ? `${dominant.reason}:${dominant.count}`.slice(0, 120) : null,
+        };
+    }
+    catch (error) {
+        console.error("[heartbeat] the staging tree could not be read; this tick reports no backlog figure", JSON.stringify({
+            reason: "staging_inventory_unreadable",
+            ...describeError(error),
+        }));
+        return { bytes: null, reason: null };
+    }
+}
 /**
  * The cached memory receipt for this tick, or null with a named reason
  * (BLI-3729).

package/dist/commands/public-root.js

@@ -15,7 +15,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.70");
+    writeLine(io?.stdout ?? process.stdout, "0.2.72");
     return 0;
   }
 

package/dist/commands/status.js

@@ -72,7 +72,14 @@ export async function runStatus(command, io) {
         writeConnectedBlock(io, setupReceipt);
         return 0;
     }
-    const status = await inspectLocalCollectorStatus(command);
+    // The staging walk is opt-in (BLI-3797) and this is the surface that pays for
+    // it: one person asking one question. The multi-repo branch above deliberately
+    // does not — the backlog is a MACHINE fact, so N repos would walk one tree N
+    // times to print the same number.
+    const status = await inspectLocalCollectorStatus({
+        ...command,
+        includeStagingBacklog: true,
+    });
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({
             ...status,

package/dist/commands/sync-followups.js

@@ -2,7 +2,8 @@
  * What the sync tick does AFTER collection's own outcome is decided and
  * reported: keep this machine's CLI current on npm `latest` (BLI-2601), put a
  * broken scheduler registration back (BLI-2721), keep BLI Memory registered
- * with both agent hosts (BLI-3580), and stop the laptop filling up (BLI-3619).
+ * with both agent hosts (BLI-3580), re-offer staged evidence that never landed
+ * (BLI-3797), and stop the laptop filling up (BLI-3619).
  *
  * Split out of commands/sync.ts (BLI-3578), moved verbatim. They belong
  * together because they share one rule, and it is the reason both are called
@@ -20,6 +21,7 @@ import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, } from "../local-sta
 import { runAutostartSelfHeal, } from "../autostart-self-heal.js";
 import { runStagingPrune } from "../disk-prune.js";
 import { runEvidenceReconcile, } from "../evidence-reconcile-client.js";
+import { runEvidenceRedelivery, } from "../evidence-redelivery.js";
 import { envWithNodeRuntimeOnPath, runScheduledSelfUpdate, } from "../scheduled-self-update.js";
 /** How many reconcile batches (of up to 500 hashes each) one sync tick may spend. */
 const RECONCILE_BATCHES_PER_TICK = 1;
@@ -215,12 +217,20 @@ function memoryInstallEvent(outcome) {
  * costs one cheap local read and no network call at all, so it never competes
  * with collection for the tick's time. A reconcile failure never blocks the
  * prune that follows it.
+ *
+ * BLI-3797 sits between them: the reconcile has just established which staged
+ * objects the SERVER says it never received, so the redelivery drain re-offers
+ * exactly those, bounded, before the prune runs and can delete whatever landed.
+ * Neither of the two can block the prune, and none of the three can fail a tick.
  */
 export async function runStagingPruneAfterSync(command, io, dashboardUrl, options = {}) {
     const events = [];
     const reconciled = await runReconcileFollowUp(command, io, dashboardUrl, options);
     if (reconciled)
         events.push(reconcileEvent(reconciled));
+    const redelivered = await runRedeliveryFollowUp(command, io, dashboardUrl, options);
+    if (redelivered)
+        events.push(redeliveryEvent(redelivered));
     let result;
     try {
         result = await runStagingPrune(getCollectorRuntimePaths(command.homeDir), {
@@ -269,6 +279,59 @@ async function runReconcileFollowUp(command, io, dashboardUrl, options) {
     });
     return result.reason === "nothing_unknown" ? null : result;
 }
+/**
+ * BLI-3797, between the reconcile above and the prune below, and in that order
+ * for a reason: reconcile turns `unknown` into a server-backed answer, this
+ * re-offers what that answer says never landed, and the prune then deletes
+ * whatever this just made durable. Running the drain first would ask the server
+ * about hashes it is about to be told the truth about; running it after the
+ * prune would leave a tick's worth of freed cap unused.
+ *
+ * Never throws (`runEvidenceRedelivery` already never does); returns `null` for
+ * the boring, common case — nothing on this disk is undelivered — so the steady
+ * state costs no receipt, the same rule the reconcile follow-up above and the
+ * prune's daily throttle below both follow.
+ */
+async function runRedeliveryFollowUp(command, io, dashboardUrl, options) {
+    const result = await runEvidenceRedelivery({
+        homeDir: command.homeDir,
+        dashboardUrl,
+        env: io.env,
+        fetch: io.fetch,
+        ...(options.now ? { now: options.now } : {}),
+    });
+    return result.reason === "nothing_uncommitted" ? null : result;
+}
+/** Counts and byte totals only; no pack id and no hash travels in a receipt. */
+function redeliveryEvent(result) {
+    const detail = [
+        `offered ${result.offered} object(s), ${result.offered_bytes}B, across ${result.packs} pack(s)`,
+        `uploaded ${result.uploaded} (${result.uploaded_bytes}B), reused ${result.reused}, failed ${result.failed}`,
+        `held ${result.held}, deferred ${result.deferred} (${result.deferred_bytes}B)`,
+        result.failure_reasons.length > 0
+            ? `failure_reasons ${result.failure_reasons.join(",")}`
+            : null,
+    ]
+        .filter((part) => Boolean(part))
+        .join("; ");
+    if (result.status === "fail") {
+        return {
+            step: "evidence_redelivery",
+            status: "fail",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    if (result.status === "skipped") {
+        return {
+            step: "evidence_redelivery",
+            status: "skipped",
+            error_code: result.reason,
+            error_detail: detail,
+        };
+    }
+    return { step: "evidence_redelivery", status: "ok", error_detail: detail };
+}
 function prunedNothing() {
     return {
         status: "skipped",

package/dist/commands/sync.js

@@ -2,7 +2,7 @@ import { writeLine } from "./cli-io.js";
 import { attributedSyncRunStatus, cursorStatusLine, displayTicketId, rawEvidenceSyncLine, shortSha, worktreeSyncRow, writeAgentSessionSummary, } from "./collection-report.js";
 import { collectionRootConsentAliases } from "./collection-roots.js";
 import { discoverCommandWorktrees } from "./local-discovery.js";
-import { sendCollectorHeartbeatBestEffort, } from "./heartbeat.js";
+import { sendCollectorHeartbeatBestEffort, readHeartbeatStagingFacts, } from "./heartbeat.js";
 import { classifySyncFailureRecords, classifySyncHealthError, redactedSyncErrorDetail, reportInstallEventsBestEffort, } from "./install-receipts.js";
 import { runAttributedWorktreeSync, } from "./session-sync.js";
 import { runAutostartSelfHealAfterSync, runMemoryInstallAfterSync, runScheduledSelfUpdateAfterSync, runStagingPruneAfterSync, } from "./sync-followups.js";
@@ -98,11 +98,22 @@ export async function runSync(command, io) {
  */
 async function sendSyncHeartbeat(command, io, dashboardUrl, facts) {
     const roots = await resolveSyncCollectionRoots(command).catch(() => []);
+    // BLI-3797: the backlog figure rides the same check-in as the root labels, so
+    // `cockpit ops` learns about undelivered evidence on the SAME tick that proves
+    // the machine is alive. Best-effort: nulls omit the fields rather than
+    // reporting a zero nobody measured.
+    const staging = await readHeartbeatStagingFacts({
+        homeDir: command.homeDir,
+    }).catch(() => ({ bytes: null, reason: null }));
     await sendCollectorHeartbeatBestEffort({
         homeDir: command.homeDir,
         dashboardUrl,
         roots,
-        facts,
+        facts: {
+            ...facts,
+            stagingUncommittedBytes: staging.bytes,
+            stagingUncommittedReason: staging.reason,
+        },
         io,
     }).catch((error) => {
         // The sender already swallows everything it knows about; this is the net

package/dist/disk-retention.js

@@ -131,7 +131,11 @@ function pushDeletion(plan, object, reason) {
 function addToBucket(bucket, object) {
     bucket.count += 1;
     bucket.bytes += object.byte_size;
-    bucket.oldest_age_ms = Math.max(bucket.oldest_age_ms, object.age_ms);
+    // Report the age of the BYTES, not of the last answer about them (BLI-3797).
+    // `age_ms` on a reconciled object is the age of the reconcile reply, which
+    // made `oldest_uncommitted_age_ms` read 0.94 days for a 45-day-old backlog.
+    // Deletion still keys off `age_ms` above — this bucket is report-only.
+    bucket.oldest_age_ms = Math.max(bucket.oldest_age_ms, object.disk_age_ms || object.age_ms);
 }
 function removeFromBucket(bucket, object) {
     bucket.count -= 1;

package/dist/disk-usage.js

@@ -104,6 +104,7 @@ export async function readStagingInventory(paths, now = new Date()) {
         inventory.packs.push(pack);
         accumulatePack(inventory, pack);
     }
+    rankUncommittedReasons(inventory);
     return inventory;
 }
 /**
@@ -150,15 +151,23 @@ async function readPack(dir, packId, options) {
         manifest_present: manifest !== null,
     };
     for (const relative of await listPackFiles(dir)) {
-        const size = await fs
-            .stat(path.join(dir, relative))
-            .then((info) => (info.isFile() ? info.size : 0))
-            .catch(() => 0);
+        // One stat, two facts: how big the staged copy is and WHEN it was written.
+        // The mtime is the only unfalsifiable record of how long undelivered
+        // evidence has been sitting here (BLI-3797) — every other timestamp on the
+        // machine records when something last had an opinion about it.
+        const info = await fs.stat(path.join(dir, relative)).catch(() => null);
+        const size = info?.isFile() ? info.size : 0;
         if (relative === "manifest.json") {
             pack.manifest_bytes += size;
             continue;
         }
-        pack.objects.push(await classifyObject(dir, packId, relative, size, manifest, options));
+        const stagedOnDiskAt = info && Number.isFinite(info.mtimeMs)
+            ? new Date(info.mtimeMs).toISOString()
+            : null;
+        pack.objects.push(await classifyObject(dir, packId, relative, size, manifest, {
+            ...options,
+            stagedOnDiskAt,
+        }));
     }
     return pack;
 }
@@ -167,7 +176,13 @@ async function classifyObject(dir, packId, relative, size, manifest, options) {
         (await hashUnnamedFile(path.join(dir, relative), size, options.budget));
     const stagedAt = options.stagedAt.get(`${packId}/${relative}`) ?? null;
     const committedAt = hash ? options.ledger.committed.get(hash) : undefined;
-    const base = { pack_id: packId, relative_path: relative, byte_size: size };
+    const base = {
+        pack_id: packId,
+        relative_path: relative,
+        byte_size: size,
+        staged_on_disk_at: options.stagedOnDiskAt,
+        disk_age_ms: ageMs(options.stagedOnDiskAt, options.now),
+    };
     if (committedAt) {
         return {
             ...base,
@@ -359,13 +374,49 @@ function accumulatePack(inventory, pack) {
         }
         inventory.uncommitted_count += 1;
         inventory.uncommitted_bytes += object.byte_size;
-        if (object.decided_at &&
+        tallyUncommittedReason(inventory, object);
+        // The age of the BYTES, not of the answer about them (BLI-3797). Falls back
+        // to `decided_at` only when the file has no readable mtime, which is the
+        // one case where the disk itself cannot say.
+        const stagedAt = object.staged_on_disk_at ?? object.decided_at;
+        if (stagedAt &&
             (!inventory.oldest_uncommitted_at ||
-                object.decided_at.localeCompare(inventory.oldest_uncommitted_at) < 0)) {
-            inventory.oldest_uncommitted_at = object.decided_at;
+                stagedAt.localeCompare(inventory.oldest_uncommitted_at) < 0)) {
+            inventory.oldest_uncommitted_at = stagedAt;
         }
     }
 }
+/**
+ * One more object against its reason label. Kept as a mutable array rather than
+ * a Map so the inventory stays a plain serializable value — it rides `--json`
+ * output and a receipt, and a Map would silently become `{}` in both.
+ */
+function tallyUncommittedReason(inventory, object) {
+    const existing = inventory.uncommitted_reasons.find((tally) => tally.reason === object.reason);
+    const tally = existing ?? {
+        reason: object.reason,
+        count: 0,
+        bytes: 0,
+        oldest_disk_age_ms: 0,
+    };
+    tally.count += 1;
+    tally.bytes += object.byte_size;
+    tally.oldest_disk_age_ms = Math.max(tally.oldest_disk_age_ms, object.disk_age_ms || object.age_ms);
+    if (!existing)
+        inventory.uncommitted_reasons.push(tally);
+}
+/**
+ * Rank the reasons by BYTES, then name the biggest one.
+ *
+ * Bytes, not object count, because the question the ranking answers is "what is
+ * holding this laptop over its cap" — 234 objects at 1,836 MB and 17 at 81 MB
+ * are not the same finding, and counting rows would have called them close.
+ */
+function rankUncommittedReasons(inventory) {
+    inventory.uncommitted_reasons.sort((left, right) => right.bytes - left.bytes || right.count - left.count);
+    inventory.dominant_uncommitted_reason =
+        inventory.uncommitted_reasons[0] ?? null;
+}
 function emptyStagingInventory() {
     return {
         pack_count: 0,
@@ -376,6 +427,8 @@ function emptyStagingInventory() {
         uncommitted_count: 0,
         uncommitted_bytes: 0,
         oldest_uncommitted_at: null,
+        uncommitted_reasons: [],
+        dominant_uncommitted_reason: null,
         unknown_count: 0,
         unknown_bytes: 0,
         manifest_bytes: 0,

package/dist/evidence-redelivery-plan.js

@@ -0,0 +1,277 @@
+/**
+ * Rebuilding an upload offer for evidence that is already on this disk.
+ *
+ * BLI-3797. The live sync only ever offers what THIS tick collected: it reads
+ * a transcript, hashes it, stages a copy, uploads that copy, and moves on. If
+ * the upload never happens — the process is killed between staging and
+ * delivery, the envelope is refused, the source file grows so next tick mints a
+ * different hash into a different pack — the staged bytes are orphaned. Nothing
+ * offers them again, ever. `disk-retention.ts` will not delete them (correctly:
+ * the ledger cannot vouch for them), so they sit until the disk fills.
+ *
+ * Measured on the reference Mac 2026-09-06, not reasoned about: 251 objects and
+ * 1,916.9 MB uncommitted against a 2,048 MB cap, 234 of them (1,835.8 MB)
+ * carrying `reconciled_unknown_to_server` — the SERVER was asked and answered
+ * that it has never held those hashes. `raw-evidence-staging.json` held six
+ * delivery-attempt rows in total, so those objects had not failed delivery;
+ * they had never been offered. The oldest pack was written 2026-07-23, 45 days
+ * earlier, and `cockpit doctor`'s fix sentence said "run `cockpit sync` to
+ * deliver them" — a sentence that could not come true.
+ *
+ * The repair is possible because each pack's own `manifest.json` already
+ * carries everything an offer needs: `object_key`, `content_hash_sha256`,
+ * `byte_size`, `media_type` and `redacted_summary` per file, and the pack's
+ * `work_context_id` / `session_id` / `operator_id` / `repo_basename` / `branch`
+ * beside them. This module rebuilds a `RawEvidenceUploadFile` from those
+ * recorded facts and NEVER re-derives them: the bytes on disk were sanitized
+ * when they were staged, and re-reading the original source would both cost the
+ * IO and risk offering content the redactor of the day would have masked
+ * differently.
+ *
+ * Metadata only, as everywhere in this family: pack ids, pack-relative paths,
+ * hashes, byte counts, reason labels. Never content, never an operator path.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { RAW_EVIDENCE_BUCKET, RAW_EVIDENCE_RETENTION_MODE, } from "./adapters/raw-evidence-manifest.js";
+import { RAW_EVIDENCE_DIR } from "./disk-usage.js";
+import { describeError } from "./health-detail.js";
+import { LOCAL_COLLECTOR_VERSION } from "./local-state.js";
+import { deliveryHold, } from "./raw-evidence-staging.js";
+/**
+ * How much undelivered backlog one tick may re-offer.
+ *
+ * A tick is fifteen minutes and the backlog is measured in gigabytes, so this
+ * is a drain rate, not a ceiling on what will eventually be sent: 512 MB a tick
+ * clears the reference Mac's 1.9 GB in four ticks (one hour) without competing
+ * with the tick's own collection, which owns a separate 2 GB budget. The object
+ * count bounds the number of `begin` round-trips for the opposite case — a
+ * backlog of thousands of small objects.
+ */
+export const REDELIVERY_MAX_BYTES_PER_TICK = 512 * 1024 * 1024;
+export const REDELIVERY_MAX_OBJECTS_PER_TICK = 64;
+/**
+ * Which undelivered objects this tick will re-offer, oldest bytes first.
+ *
+ * Oldest first is deliberate: the objects that have been undelivered longest
+ * are the ones most likely to be the only remaining copy of a session whose
+ * source transcript has since been rotated away by its agent host, and they are
+ * also the ones the disk cap will start refusing to keep. A newest-first drain
+ * would leave a 45-day-old orphan permanently at the back of the queue.
+ *
+ * `unknown` objects are deliberately NOT planned. "The ledger cannot say" is
+ * `cockpit clean --reconcile`'s question, it already runs one bounded batch per
+ * tick ahead of this, and it turns each answer into `committed` or
+ * `uncommitted` — so an unknown object reaches this planner on a later tick,
+ * with the server's own answer behind it, rather than being uploaded again on a
+ * guess.
+ */
+export async function planEvidenceRedelivery(options) {
+    const plan = {
+        packs: [],
+        object_count: 0,
+        bytes: 0,
+        held_count: 0,
+        held_bytes: 0,
+        unplannable: {},
+        deferred_count: 0,
+        deferred_bytes: 0,
+    };
+    const maxBytes = options.maxBytes ?? REDELIVERY_MAX_BYTES_PER_TICK;
+    const maxObjects = options.maxObjects ?? REDELIVERY_MAX_OBJECTS_PER_TICK;
+    const root = path.join(options.stateDir, RAW_EVIDENCE_DIR);
+    const candidates = uncommittedOldestFirst(options.inventory);
+    const manifests = new Map();
+    const packPlans = new Map();
+    for (const object of candidates) {
+        if (!object.content_hash) {
+            countUnplannable(plan, "no_content_hash");
+            continue;
+        }
+        if (deliveryHold(options.staging, object.content_hash, options.now)) {
+            plan.held_count += 1;
+            plan.held_bytes += object.byte_size;
+            continue;
+        }
+        if (plan.object_count >= maxObjects ||
+            plan.bytes + object.byte_size > maxBytes) {
+            plan.deferred_count += 1;
+            plan.deferred_bytes += object.byte_size;
+            continue;
+        }
+        if (!manifests.has(object.pack_id)) {
+            manifests.set(object.pack_id, await readPackManifest(path.join(root, object.pack_id), object.pack_id));
+        }
+        const manifest = manifests.get(object.pack_id) ?? null;
+        if (!manifest) {
+            countUnplannable(plan, "manifest_unreadable");
+            continue;
+        }
+        const row = manifest.files.get(object.relative_path);
+        if (!row) {
+            countUnplannable(plan, "no_manifest_row");
+            continue;
+        }
+        let packPlan = packPlans.get(object.pack_id);
+        if (!packPlan) {
+            packPlan = {
+                pack_id: object.pack_id,
+                provenance: manifest.provenance,
+                files: [],
+                bytes: 0,
+            };
+            packPlans.set(object.pack_id, packPlan);
+            plan.packs.push(packPlan);
+        }
+        packPlan.files.push({
+            pointer: {
+                raw_evidence_pointer_id: row.object_key,
+                privacy_classification: "remote_durable_raw_evidence",
+                retention_policy: {
+                    mode: RAW_EVIDENCE_RETENTION_MODE,
+                    privacy_classification: "remote_durable_raw_evidence",
+                },
+                storage_scope: "remote_object",
+                storage_bucket: RAW_EVIDENCE_BUCKET,
+                object_key: row.object_key,
+                content_hash_sha256: row.content_hash_sha256,
+                byte_size: row.byte_size,
+                media_type: row.media_type,
+                redacted_summary: row.redacted_summary,
+            },
+            local_path: path.join(root, object.pack_id, ...object.relative_path.split("/").filter(Boolean)),
+            kind: row.kind,
+            codex_session_id: null,
+        });
+        packPlan.bytes += object.byte_size;
+        plan.object_count += 1;
+        plan.bytes += object.byte_size;
+    }
+    return plan;
+}
+/**
+ * Every uncommitted object, oldest staged bytes first.
+ *
+ * Sorted on `disk_age_ms` (the file's own mtime) rather than `age_ms`, because
+ * `age_ms` for a reconciled object is the age of the reconcile ANSWER — the
+ * same confusion that had 45-day-old orphans reading as one day old.
+ */
+function uncommittedOldestFirst(inventory) {
+    return inventory.packs
+        .flatMap((pack) => pack.objects)
+        .filter((object) => object.state === "uncommitted")
+        .sort((left, right) => (right.disk_age_ms || right.age_ms) - (left.disk_age_ms || left.age_ms));
+}
+function countUnplannable(plan, reason) {
+    plan.unplannable[reason] = (plan.unplannable[reason] ?? 0) + 1;
+}
+/**
+ * A pack's recorded provenance and file rows.
+ *
+ * Every field is read back from what the collector WROTE when it staged the
+ * pack; nothing is re-derived from the machine's current state. A pack staged
+ * six weeks ago under a work context that no longer exists still knows which
+ * repo, branch, operator and work context it belonged to, and that is the only
+ * honest label for those bytes.
+ */
+async function readPackManifest(dir, packId) {
+    const raw = await fs
+        .readFile(path.join(dir, "manifest.json"), "utf8")
+        .catch(() => null);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const provenance = provenanceFromManifest(parsed, packId);
+        if (!provenance)
+            return null;
+        const files = new Map();
+        for (const entry of asArray(parsed["files"])) {
+            const row = manifestFileRow(entry);
+            if (row)
+                files.set(row.relative_path, row.value);
+        }
+        return { provenance, files };
+    }
+    catch (error) {
+        console.error("[evidence-redelivery] pack manifest unreadable; its objects cannot be re-offered", JSON.stringify({
+            reason: "manifest_unreadable",
+            pack_id: packId,
+            ...describeError(error),
+        }));
+        return null;
+    }
+}
+function provenanceFromManifest(manifest, packId) {
+    const workContextId = asText(manifest["work_context_id"]);
+    const sessionId = asText(manifest["session_id"]);
+    const operatorId = asText(manifest["operator_id"]);
+    const repo = asText(manifest["repo_basename"]) ?? asText(manifest["repo_label"]);
+    if (!workContextId || !sessionId || !operatorId || !repo) {
+        console.error("[evidence-redelivery] pack manifest names no work context; its objects cannot be re-offered", JSON.stringify({
+            reason: "manifest_provenance_incomplete",
+            pack_id: packId,
+            has_work_context: Boolean(workContextId),
+            has_session: Boolean(sessionId),
+            has_operator: Boolean(operatorId),
+            has_repo: Boolean(repo),
+        }));
+        return null;
+    }
+    const repoLabel = asText(manifest["repo_label"]);
+    const worktreeLabel = asText(manifest["worktree_label"]);
+    return {
+        capture_source: "collector_runtime",
+        // The version that is re-offering, not the one that staged: this IS a
+        // delivery by today's collector, and pretending otherwise would misreport
+        // which build put the object in the bucket.
+        capture_adapter_version: LOCAL_COLLECTOR_VERSION,
+        collector_version: LOCAL_COLLECTOR_VERSION,
+        repo,
+        // A pack staged on a detached HEAD or a deleted worktree can have no branch
+        // recorded. `unknown` is a label, not a guess at which branch it was.
+        branch: asText(manifest["branch"]) ?? "unknown",
+        ...(repoLabel ? { repo_label: repoLabel } : {}),
+        ...(worktreeLabel ? { worktree_label: worktreeLabel } : {}),
+        operator_id: operatorId,
+        session_id: sessionId,
+        work_context_id: workContextId,
+    };
+}
+function manifestFileRow(entry) {
+    if (!entry || typeof entry !== "object")
+        return null;
+    const row = entry;
+    const relativePath = asText(row["relative_path"]);
+    const objectKey = asText(row["object_key"]);
+    const hash = asText(row["content_hash_sha256"]);
+    const mediaType = asText(row["media_type"]);
+    const summary = asText(row["redacted_summary"]);
+    const byteSize = row["byte_size"];
+    if (!relativePath ||
+        !objectKey ||
+        !hash ||
+        hash.length !== 64 ||
+        !mediaType ||
+        !summary ||
+        typeof byteSize !== "number") {
+        return null;
+    }
+    return {
+        relative_path: relativePath,
+        value: {
+            object_key: objectKey,
+            content_hash_sha256: hash,
+            byte_size: byteSize,
+            media_type: mediaType,
+            redacted_summary: summary,
+            kind: asText(row["kind"]) ?? "unknown",
+        },
+    };
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function asText(value) {
+    return typeof value === "string" && value.trim() ? value : null;
+}

package/dist/evidence-redelivery.js

@@ -0,0 +1,280 @@
+/**
+ * Offering undelivered staged evidence again, on the next tick and every tick
+ * after, until it lands or names why it cannot.
+ *
+ * BLI-3797. `evidence-redelivery-plan.ts` says WHICH bytes and rebuilds the
+ * offer; this file spends it against the same chunked upload client the live
+ * sync uses, writes each success into the commit ledger and each failure into
+ * the delivery-attempt history (so the existing 15-min → 6-h backoff applies
+ * and one doomed object is not re-offered 96 times a day), and says what
+ * happened on every branch.
+ *
+ * Four properties, the same ones the reconcile and prune follow-ups keep:
+ *
+ * - **It never throws and never fails a tick.** A drain that cannot run is a
+ *   log line and a receipt, never a reason collection did not happen.
+ * - **It never deletes.** Nothing here removes a staged byte; the prune that
+ *   follows it decides that, and it only ever takes what the ledger vouches
+ *   for — which now includes whatever this just delivered.
+ * - **It is bounded.** One drain rate per tick (see the plan module), so the
+ *   backlog clears in hours without competing with the tick's own collection.
+ * - **It says so on both branches.** A tick with nothing undelivered is silent
+ *   (the steady state, 96 times a day); every other outcome, including a clean
+ *   drain, gets one `[evidence-redelivery]` line with counts and reasons.
+ */
+import { uploadRawEvidenceFilesChunked, } from "./evidence-upload-client.js";
+import { planEvidenceRedelivery, } from "./evidence-redelivery-plan.js";
+import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
+import { readStagingInventory } from "./disk-usage.js";
+import { describeError } from "./health-detail.js";
+import { getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "./local-state.js";
+import { clearDeliveryAttempt, readRawEvidenceStagingState, recordDeliveryFailure, writeRawEvidenceStagingState, } from "./raw-evidence-staging.js";
+/**
+ * The drain the sync tick runs and `cockpit doctor`'s disk fix reuses.
+ * Never throws.
+ */
+export async function runEvidenceRedelivery(options) {
+    const env = options.env ?? process.env;
+    const now = options.now ?? new Date();
+    if (env["COCKPIT_DISABLE_EVIDENCE_REDELIVERY"] === "1") {
+        return emptyResult("disabled", "skipped");
+    }
+    const paths = getCollectorRuntimePaths(options.homeDir);
+    try {
+        const inventory = options.inventory ?? (await readStagingInventory(paths, now));
+        if (inventory.uncommitted_count === 0) {
+            // The steady state, 96 ticks a day. Saying so every time would bury the
+            // ticks that matter; `cockpit doctor`'s disk row still says it out loud
+            // to a person who asks.
+            return emptyResult("nothing_uncommitted", "ok");
+        }
+        const staging = await readRawEvidenceStagingState(paths.state_dir);
+        const plan = await planEvidenceRedelivery({
+            stateDir: paths.state_dir,
+            inventory,
+            staging,
+            now,
+            ...(options.maxBytes != null ? { maxBytes: options.maxBytes } : {}),
+            ...(options.maxObjects != null ? { maxObjects: options.maxObjects } : {}),
+        });
+        if (plan.object_count === 0) {
+            const result = emptyPlanResult(plan);
+            reportRedelivery(result, plan);
+            return result;
+        }
+        const session = await readLocalCollectorSessionFile(paths).catch(() => null);
+        if (!session ||
+            session.session_state !== "valid" ||
+            typeof session.device_token !== "string" ||
+            !session.device_token) {
+            // Not a failure of the backlog: this machine simply cannot speak to the
+            // dashboard right now. The bytes stay, the reason is named, and the next
+            // tick after a `cockpit login` picks them straight back up.
+            const result = {
+                ...emptyPlanResult(plan),
+                status: "skipped",
+                reason: "no_device_session",
+            };
+            reportRedelivery(result, plan);
+            return result;
+        }
+        const outcome = await deliverPlan({
+            plan,
+            dashboardUrl: options.dashboardUrl,
+            deviceToken: session.device_token,
+            fetchImpl: options.fetch ?? fetch,
+            now,
+        });
+        await recordOutcomes(paths, staging, outcome.outcomes, now);
+        const result = {
+            status: outcome.failed > 0 && outcome.uploaded === 0 ? "fail" : "ok",
+            reason: "redelivered",
+            offered: plan.object_count,
+            offered_bytes: plan.bytes,
+            uploaded: outcome.uploaded,
+            uploaded_bytes: outcome.uploadedBytes,
+            reused: outcome.reused,
+            failed: outcome.failed,
+            held: plan.held_count,
+            deferred: plan.deferred_count,
+            deferred_bytes: plan.deferred_bytes,
+            packs: plan.packs.length,
+            failure_reasons: outcome.failureReasons,
+        };
+        reportRedelivery(result, plan);
+        return result;
+    }
+    catch (error) {
+        console.error("[evidence-redelivery] the drain could not run; nothing was re-offered", JSON.stringify({ reason: "redelivery_threw", ...describeError(error) }));
+        return { ...emptyResult("redelivery_threw", "fail") };
+    }
+}
+/**
+ * One `uploadRawEvidenceFilesChunked` call per pack, because provenance is a
+ * PACK fact: the repo, branch, operator, session and work context these bytes
+ * belonged to were recorded when they were staged, and sending one pack's
+ * objects under another pack's labels would file six-week-old evidence against
+ * today's ticket.
+ */
+async function deliverPlan(options) {
+    const result = {
+        outcomes: [],
+        uploaded: 0,
+        uploadedBytes: 0,
+        reused: 0,
+        failed: 0,
+        failureReasons: [],
+    };
+    for (const pack of options.plan.packs) {
+        const uploaded = await deliverOnePack(pack, options);
+        for (const outcome of uploaded) {
+            result.outcomes.push(outcome);
+            if (outcome.upload_state === "uploaded") {
+                result.uploaded += 1;
+                result.uploadedBytes += outcome.pointer.byte_size ?? 0;
+                continue;
+            }
+            if (outcome.upload_state === "reused_existing") {
+                result.reused += 1;
+                continue;
+            }
+            result.failed += 1;
+            const reason = outcome.reason ?? "unknown";
+            if (!result.failureReasons.includes(reason)) {
+                result.failureReasons.push(reason);
+            }
+        }
+    }
+    return result;
+}
+async function deliverOnePack(pack, options) {
+    try {
+        const uploaded = await uploadRawEvidenceFilesChunked({
+            fetchImpl: options.fetchImpl,
+            dashboardUrl: options.dashboardUrl,
+            deviceToken: options.deviceToken,
+            provenance: pack.provenance,
+            generatedAt: options.now.toISOString(),
+            files: pack.files,
+        });
+        return uploaded.outcomes;
+    }
+    catch (error) {
+        // The upload client already reports its own transport failures; this is the
+        // net for anything it does not, and it must not abandon the packs behind
+        // this one. Each file is reported failed so the backoff history records the
+        // attempt rather than re-offering all of them again in fifteen minutes.
+        console.error("[evidence-redelivery] a pack's re-offer threw; the rest of the drain continues", JSON.stringify({
+            reason: "pack_redelivery_threw",
+            pack_id: pack.pack_id,
+            object_count: pack.files.length,
+            ...describeError(error),
+        }));
+        return pack.files.map((file) => ({
+            pointer: file.pointer,
+            object_key: file.pointer.object_key ?? "",
+            codex_session_id: null,
+            kind: file.kind ?? "unknown",
+            upload_state: "upload_failed",
+            reason: "pack_redelivery_threw",
+            uploaded_chunk_count: 0,
+        }));
+    }
+}
+/**
+ * Write what happened where the next tick will read it: the commit ledger for
+ * anything that landed, the delivery-attempt history for anything that did not.
+ *
+ * Both writes happen even when the run partly failed, and the ledger is written
+ * FIRST — a delivered object whose ledger row was lost would be re-offered
+ * forever, which is the failure this whole module exists to end.
+ */
+async function recordOutcomes(paths, staging, outcomes, now) {
+    const cursor = await readRawEvidenceCursor(paths);
+    let ledgerChanged = false;
+    let stagingChanged = false;
+    for (const outcome of outcomes) {
+        const hash = outcome.pointer.content_hash_sha256;
+        if (!hash)
+            continue;
+        if (outcome.upload_state === "upload_failed") {
+            recordDeliveryFailure(staging, hash, {
+                reason: outcome.reason ?? "unknown",
+                attemptedAt: now,
+                byteSize: outcome.pointer.byte_size ?? 0,
+            });
+            stagingChanged = true;
+            continue;
+        }
+        markObjectCommitted(cursor, hash, {
+            object_key: outcome.object_key,
+            byte_size: outcome.pointer.byte_size ?? 0,
+            committed_at: now.toISOString(),
+        });
+        ledgerChanged = true;
+        if (clearDeliveryAttempt(staging, hash))
+            stagingChanged = true;
+    }
+    if (ledgerChanged)
+        await writeRawEvidenceCursor(paths, cursor);
+    if (stagingChanged) {
+        await writeRawEvidenceStagingState(paths.state_dir, staging);
+    }
+}
+/**
+ * One line per non-steady-state tick. Counts, byte totals and reason labels
+ * only — no pack id, no hash, no path, per the logging contract.
+ */
+function reportRedelivery(result, plan) {
+    const fields = {
+        reason: result.reason,
+        status: result.status,
+        offered: result.offered,
+        offered_bytes: result.offered_bytes,
+        uploaded: result.uploaded,
+        uploaded_bytes: result.uploaded_bytes,
+        reused: result.reused,
+        failed: result.failed,
+        held_by_backoff: result.held,
+        deferred_to_next_tick: result.deferred,
+        deferred_bytes: result.deferred_bytes,
+        packs: result.packs,
+        unplannable: plan.unplannable,
+        failure_reasons: result.failure_reasons,
+    };
+    if (result.status === "fail") {
+        console.error("[evidence-redelivery] every re-offered object was refused", JSON.stringify(fields));
+        return;
+    }
+    console.error(result.uploaded > 0
+        ? "[evidence-redelivery] undelivered staged evidence landed"
+        : "[evidence-redelivery] undelivered staged evidence was not re-offered this tick", JSON.stringify(fields));
+}
+function emptyPlanResult(plan) {
+    const nothingPlannable = plan.held_count > 0 && plan.deferred_count === 0
+        ? "all_held_by_backoff"
+        : "nothing_plannable";
+    return {
+        ...emptyResult(nothingPlannable, "ok"),
+        held: plan.held_count,
+        deferred: plan.deferred_count,
+        deferred_bytes: plan.deferred_bytes,
+    };
+}
+function emptyResult(reason, status) {
+    return {
+        status,
+        reason,
+        offered: 0,
+        offered_bytes: 0,
+        uploaded: 0,
+        uploaded_bytes: 0,
+        reused: 0,
+        failed: 0,
+        held: 0,
+        deferred: 0,
+        deferred_bytes: 0,
+        packs: 0,
+        failure_reasons: [],
+    };
+}

package/dist/local-state-status.js

@@ -1,5 +1,7 @@
 import os from "node:os";
 import path from "node:path";
+import { readStagingInventory } from "./disk-usage.js";
+import { describeError } from "./health-detail.js";
 import { summarizeLocalUploadSpool } from "./spool/local-spool.js";
 import { summarizeInstallEventOutbox } from "./spool/install-event-outbox.js";
 import { readRawEvidenceStagingState, summarizeStuckEvidence, } from "./raw-evidence-staging.js";
@@ -55,6 +57,10 @@ export async function inspectLocalCollectorStatus(options = {}) {
         stuck_evidence_max_attempts: stuckEvidence.max_attempts,
         stuck_evidence_oldest_failure_at: stuckEvidence.oldest_first_failed_at,
         stuck_evidence_reasons: stuckEvidence.reasons,
+        staging_uncommitted_count: reading.staging?.uncommitted_count ?? null,
+        staging_uncommitted_bytes: reading.staging?.uncommitted_bytes ?? null,
+        staging_uncommitted_reason: reading.staging?.dominant_uncommitted_reason?.reason ?? null,
+        staging_oldest_uncommitted_at: reading.staging?.oldest_uncommitted_at ?? null,
         details: describeCollectorStatus(reading),
     };
 }
@@ -76,7 +82,20 @@ async function readCollectorStatus(options, now) {
         readRawEvidenceStagingState(paths.state_dir),
     ]);
     const stuckEvidence = summarizeStuckEvidence(stagingState, now);
+    // Best-effort by construction: a status read must never fail because the
+    // staging tree could not be walked, and an absent backlog reads as "this read
+    // did not ask", never as "there is none".
+    const staging = options.includeStagingBacklog
+        ? await readStagingInventory(paths, now).catch((error) => {
+            console.error("[collector status] the staging tree could not be read; the undelivered backlog is unknown", JSON.stringify({
+                reason: "staging_inventory_unreadable",
+                ...describeError(error),
+            }));
+            return null;
+        })
+        : null;
     return {
+        staging,
         paths,
         config,
         session,
@@ -134,6 +153,18 @@ function describeCollectorStatus(reading) {
     if (healthOutbox.pending_count > 0) {
         details.push(`Collector health retry pending: ${healthOutbox.pending_count} sanitized receipt(s) queued since ${healthOutbox.oldest_created_at ?? "unknown"}.`);
     }
+    // BLI-3797: the line above only sees objects whose delivery FAILED. This one
+    // sees evidence that is on this disk and not in the bucket, however it got
+    // that way — which is the only question that answers "has everything landed?".
+    if (reading.staging && reading.staging.uncommitted_count > 0) {
+        const dominant = reading.staging.dominant_uncommitted_reason;
+        details.push(`Staged evidence not yet accepted: ${reading.staging.uncommitted_count} object(s), ${mib(reading.staging.uncommitted_bytes)} MB, oldest staged ${reading.staging.oldest_uncommitted_at ?? "unknown"}${dominant
+            ? ` — biggest reason ${dominant.reason} on ${dominant.count} object(s)`
+            : ""}. \`cockpit sync\` re-offers them each tick; \`cockpit doctor --fix\` does it now.`);
+    }
+    else if (reading.staging) {
+        details.push("Staged evidence: every object on this disk is accepted.");
+    }
     if (stuckEvidence.stuck_object_count > 0) {
         details.push(`Raw evidence stuck: ${stuckEvidence.stuck_object_count} object(s) have never been accepted (${stuckEvidence.held_object_count} waiting on backoff, worst ${stuckEvidence.max_attempts} attempt(s) since ${stuckEvidence.oldest_first_failed_at ?? "unknown"}) — reasons: ${stuckEvidence.reasons.join(", ") || "unknown"}.`);
     }
@@ -155,6 +186,9 @@ export function classifyCollectorFreshness(context, lastUploadSuccessAt, now) {
         return "stale";
     return now.getTime() - latestActivityAt <= 5 * 60 * 1000 ? "fresh" : "stale";
 }
+function mib(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}
 function latestTimestamp(values) {
     const timestamps = values
         .map((value) => Date.parse(value ?? ""))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.70",
+  "version": "0.2.72",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.10",
-    "@bli-cockpit/mcp": "0.1.11",
-    "@bli-cockpit/telemetry-core": "0.1.31"
+    "@bli-cockpit/memory-mcp": "0.1.11",
+    "@bli-cockpit/mcp": "0.1.12",
+    "@bli-cockpit/telemetry-core": "0.1.32"
   }
 }