@bli-cockpit/cli 0.2.146 → 0.2.148

package/dist/commands/agent-session-report.js

@@ -10,6 +10,7 @@
  */
 import { CODEX_SESSION_ATTRIBUTION_STATE_RANK, NO_UPLOAD_ATTEMPT_RECORDED, notUploadableAttributionStateReason, } from "@bli-cockpit/telemetry-core";
 import { isLiveRawEvidenceSyncAttribution, isRawEvidenceUploadableAttributionState, } from "../raw-evidence-attribution-policy.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
 /** How many Codex sessions the scan could not read at all. */
 export function codexAttributionReadFailureCount(scan) {
     return scan.directory_read_failed_count + scan.stat_failed_count;
@@ -150,6 +151,7 @@ function sessionReportEntry(result, context) {
         attribution_reason: result.reason,
         attribution_score: result.attribution_score,
         path_score: result.path_score,
+        root_scope: rootScopeForReason(result.reason),
         signals: result.signals,
         ...(result.content_hash_sha256
             ? { session_file_hash_sha256: result.content_hash_sha256 }

package/dist/commands/agent-session-root-scope.js

@@ -0,0 +1,19 @@
+/**
+ * BLI-10734 (roots are labels, not gates): the one place that turns an
+ * attribution reason into the `root_scope` label a report row carries.
+ *
+ * Split out of `agent-session-report.ts` to keep that file under the
+ * readability ratchet's band floor — this helper has no dependency on the
+ * report-row shape, so it stands alone.
+ */
+import { OUTSIDE_APPROVED_ROOT_REASONS } from "./session-sync-health.js";
+/**
+ * Both scopes upload; this label is how a person tells them apart downstream
+ * without re-deriving it from `attribution_reason`. Uses the SAME closed
+ * reason set `session-sync-health.ts` and `session-sync-counters.ts` already
+ * trust as "outside every approved root" — one vocabulary, never a second
+ * guess at what "outside" means.
+ */
+export function rootScopeForReason(reason) {
+    return OUTSIDE_APPROVED_ROOT_REASONS.has(reason) ? "outside" : "inside";
+}

package/dist/commands/brief.js

@@ -13,7 +13,7 @@
  * asked for, never who is asking — the same rule `cockpit jarvis --as` follows.
  */
 import { colorEnabled, dim, writeLine } from "./cli-io.js";
-import { renderBriefStatus } from "./ops-render.js";
+import { renderBriefStatus, renderMissedBrief, } from "./ops-render.js";
 import { loadPairedSession, towerJsonRequest } from "../tower-client.js";
 const REQUEST_DEADLINE_MS = 30_000;
 export async function runBrief(command, io) {
@@ -97,6 +97,8 @@ function logBriefRead(command, io, body, startedAt) {
  */
 async function runBriefStatus(command, io, dashboardUrl, deviceToken, startedAt) {
     const params = new URLSearchParams();
+    if (command.missed)
+        params.set("missed", "1");
     if (command.subject)
         params.set("who", command.subject);
     if (command.render)
@@ -116,6 +118,8 @@ async function runBriefStatus(command, io, dashboardUrl, deviceToken, startedAt)
         writeFailure(command, io, result.reason, result.detail);
         return 1;
     }
+    if (command.missed)
+        return runMissedBrief(command, io, result.body, startedAt);
     const payload = result.body;
     if (command.json) {
         writeLine(io.stdout, JSON.stringify(payload));
@@ -138,6 +142,33 @@ async function runBriefStatus(command, io, dashboardUrl, deviceToken, startedAt)
     })}`);
     return reason === "delivered" ? 0 : 1;
 }
+/**
+ * `cockpit brief status --missed` (BLI-10728) — everybody, not one person.
+ * Exit 0 only when nobody owed a brief is missing one; a non-empty missed
+ * list, or an unreadable roster, is 1 — the same "a script can act on this"
+ * rule `runBriefStatus` follows for a single subject.
+ */
+async function runMissedBrief(command, io, payload, startedAt) {
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify(payload));
+    }
+    else {
+        const styled = colorEnabled(io);
+        for (const line of renderMissedBrief(payload, (text) => dim(text, styled))) {
+            writeLine(io.stdout, line);
+        }
+    }
+    const coverage = payload.coverage ?? {};
+    writeLine(io.stderr, `[brief cli] missed read ${JSON.stringify({
+        verdict: coverage.verdict ?? "unknown",
+        delivered: coverage.delivered ?? null,
+        missed: coverage.missed?.length ?? null,
+        no_page_shape: coverage.noPageShape ?? null,
+        unreadable: coverage.unreadable ?? null,
+        elapsed_ms: Date.now() - startedAt,
+    })}`);
+    return (coverage.missed?.length ?? 0) === 0 && coverage.verdict !== "unreadable" ? 0 : 1;
+}
 function queryFor(command) {
     const params = new URLSearchParams();
     if (command.subject)

package/dist/commands/cal-sync-status.js

@@ -0,0 +1,27 @@
+import { askAgentDoor, emitAgentDoor, failAgentDoor } from "./agent-door.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "[cal cli]";
+const READ_DEADLINE_MS = 30_000;
+export async function runCalSyncStatus(command, door) {
+    const path = command.subjectId
+        ? `/api/cal/sync-status?calendar_id=${encodeURIComponent(command.subjectId)}`
+        : "/api/cal/sync-status";
+    const answer = await askAgentDoor(door, { path, method: "GET", label: "cal sync-status", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const calendars = answer.body.calendars ?? [];
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, calendars });
+    if (calendars.length === 0) {
+        writeLine(door.io.stdout, "No calendars attached yet.");
+        return 0;
+    }
+    for (const calendar of calendars) {
+        const lastRun = calendar.last_run
+            ? `${calendar.last_run.reason} @ ${calendar.last_run.started_at} (${calendar.last_run.items} item(s))`
+            : "never synced";
+        const lag = calendar.lag ? `${calendar.lag.lag_seconds}s` : "unknown";
+        writeLine(door.io.stdout, `${calendar.name}  last_success=${calendar.last_success_at ?? "never"}  last_run=${lastRun}  failures_24h=${calendar.failures_24h}  lag=${lag}${calendar.data_incomplete ? "  (partial read)" : ""}`);
+    }
+    return 0;
+}

package/dist/commands/cal.js

@@ -22,6 +22,7 @@
  */
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./agent-door.js";
 import { runCalDelete } from "./cal-delete.js";
+import { runCalSyncStatus } from "./cal-sync-status.js";
 import { isInteractiveStdin, readPipedText, writeLine } from "./cli-io.js";
 const TAG = "[cal cli]";
 const READ_DEADLINE_MS = 30_000;
@@ -50,6 +51,8 @@ export async function runCal(command, io) {
             return detach(command, door);
         case "sync":
             return sync(command, door);
+        case "sync-status":
+            return runCalSyncStatus(command, door);
         case "delete":
             return runCalDelete(command, door);
     }

package/dist/commands/docs-notion.js

@@ -19,6 +19,12 @@ import { resolveDocId } from "./docs.js";
 const TAG = "[docs cli]";
 const READ_DEADLINE_MS = 30_000;
 const WRITE_DEADLINE_MS = 60_000;
+function runLine(direction, run) {
+    if (!run)
+        return `${direction}: never run`;
+    const moved = run.pushed || run.pulled;
+    return `${direction}: ${run.reason} (${moved} moved, ${run.failed} failed) at ${run.started_at}`;
+}
 /**
  * `sync-status [<id|slug>]` → `GET /api/docs/notion-sync[?document_id=]`. Tower's
  * half of the answer only (synced / tower_changed / never_synced); the door
@@ -39,8 +45,14 @@ export async function syncStatusDocs(command, door) {
     if (!answer.ok)
         return failAgentDoor(door, TAG, answer.reason, answer.detail);
     const body = answer.body;
-    if (door.json)
-        return emitAgentDoor(door, { ok: true, counts: body.counts, documents: body.documents ?? [] });
+    if (door.json) {
+        return emitAgentDoor(door, {
+            ok: true,
+            counts: body.counts,
+            documents: body.documents ?? [],
+            last_run: body.last_run ?? { push: null, pull: null },
+        });
+    }
     const documents = body.documents ?? [];
     for (const doc of documents) {
         writeLine(door.io.stdout, `${doc.id}  ${doc.state.padEnd(13)}  ${(doc.notion_synced_at ?? "never").padEnd(25)}  ${doc.slug ?? "(no slug)"}  ${doc.title}`);
@@ -50,6 +62,7 @@ export async function syncStatusDocs(command, door) {
     writeLine(door.io.stdout, `${body.counts?.linked ?? documents.length} linked: ${Object.entries(byState)
         .map(([state, count]) => `${count} ${state}`)
         .join(", ")}. A Notion edit shows up at the next pull, not here.`);
+    writeLine(door.io.stdout, `Last run — ${runLine("push", body.last_run?.push)} · ${runLine("pull", body.last_run?.pull)}`);
     return 0;
 }
 export async function linkDoc(command, door) {

package/dist/commands/doctor-access.js

@@ -1,5 +1,5 @@
 import os from "node:os";
-import { readRootWorkScan, outsideWorkDirectories, readRootApprovals, rootsAddCommand, rootPathApi } from "../root-work.js";
+import { readRootWorkScan, outsideWorkDirectories, readRootApprovals, rootsAddCommand, rootPathApi, sessionCoverageLine } from "../root-work.js";
 import { writeJsonFile } from "../local-state-files.js";
 import { containsPath } from "../root-normalization.js";
 import { scanWorkDirectories } from "./local-discovery.js";
@@ -156,17 +156,33 @@ function shellQuote(value) {
         return '"$PWD"';
     return `'${value.replace(/'/gu, "'\\''")}'`;
 }
-/** The last scan names work missed by the saved boundary. Diagnosis never grants consent. */
+/**
+ * The last scan names work missed by the saved boundary. Diagnosis never
+ * grants consent — and since BLI-10734 there is nothing left to consent TO
+ * for the session report itself, only for raw evidence: every session this
+ * scan saw now reaches the server (`sessionCoverageLine`), labelled
+ * `root_scope: "outside"` when its directory sits outside every approved
+ * root. Widening the boundary still matters for the redacted transcript
+ * BYTES, which stay root-gated, so this row keeps flagging the gap and
+ * offering `roots add` — it is just no longer offering to rescue a session
+ * that would otherwise vanish.
+ */
 export async function readRootsCoverWork(context) {
     const homeDir = context.command.homeDir ?? os.homedir();
     const paths = getCollectorRuntimePaths(homeDir);
     const scan = await readRootWorkScan(paths) ?? await scanWorkDirectories(homeDir, false);
     const outside = outsideWorkDirectories(scan, (await readLocalCollectorConfig(paths))?.default_repo_paths ?? []);
     const count = outside.reduce((sum, entry) => sum + entry.count, 0);
+    // ticket 10727 (ticket 4382 measured) then BLI-10734 (roots are labels, not
+    // gates): the coverage sentence a person asked doctor for, appended rather
+    // than replacing the existing per-directory breakdown below. Since
+    // BLI-10734, widening a root no longer rescues a session from oblivion —
+    // its metadata already reached the server either way — it buys the
+    // redacted transcript content instead, so the "needs fix" branch says so.
     if (!count)
-        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no known working directories outside approved roots.`);
+        return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no known working directories outside approved roots. ${sessionCoverageLine(scan, count)}`);
     return {
-        ...needsFix("roots-cover-work", "work_outside_roots", `${count} of ${scan.observed} sessions have working directories outside every approved root (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}`),
+        ...needsFix("roots-cover-work", "work_outside_roots", `${count} of ${scan.observed} sessions have working directories outside every approved root — their redacted transcript content stays unuploaded until the root widens, though their metadata already reaches the server with an outside label (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, count)}`),
         nextAction: rootsAddCommand(outside[0].directory, process.platform, homeDir),
     };
 }

package/dist/commands/local-args-tower-cal.js

@@ -30,10 +30,13 @@ const CAL_ACTIONS = new Set([
     "share",
     "detach",
     "sync",
+    "sync-status",
     "delete",
 ]);
 /** Every verb that names ONE thing first — a calendar id, or (delete) an event id. */
 const CAL_ACTIONS_NEEDING_A_SUBJECT = new Set(["sync", "detach", "share", "delete"]);
+/** `sync-status [<calendar id>]` — every calendar, or one's. Ticket 10730. */
+const CAL_ACTIONS_WITH_OPTIONAL_SUBJECT = new Set(["sync-status"]);
 export function parseCalArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -94,7 +97,7 @@ function readCalAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "today" : first);
     if (!CAL_ACTIONS.has(action)) {
-        throw new Error(`Unknown cal command: ${first}. Try today, week, next, find, calendars, add-ical, create, share, detach, sync, or delete.`);
+        throw new Error(`Unknown cal command: ${first}. Try today, week, next, find, calendars, add-ical, create, share, detach, sync, sync-status, or delete.`);
     }
     return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -111,6 +114,11 @@ function readCalSubjectOrQuery(action, rest) {
         if (rest.length > 1)
             throw new Error(`cal ${action} takes one id, not ${rest.length}.`);
     }
+    else if (CAL_ACTIONS_WITH_OPTIONAL_SUBJECT.has(action)) {
+        subject = optionalNonEmpty(rest[0]);
+        if (rest.length > 1)
+            throw new Error(`cal ${action} takes at most one id, not ${rest.length}.`);
+    }
     else if (action === "find") {
         query = optionalNonEmpty(rest.join(" "));
         if (!query)

package/dist/commands/local-args-tower-mail.js

@@ -29,9 +29,12 @@ const MAIL_ACTIONS = new Set([
     "send",
     "attachment",
     "sync",
+    "sync-status",
 ]);
 /** Every verb that names ONE thing first: a thread, an attachment, a mailbox. */
 const MAIL_ACTIONS_NEEDING_A_SUBJECT = new Set(["read", "attachment", "detach", "sync"]);
+/** `sync-status [<account id>]` — every mailbox, or one's. Ticket 10730. */
+const MAIL_ACTIONS_WITH_OPTIONAL_SUBJECT = new Set(["sync-status"]);
 export function parseMailArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -82,7 +85,7 @@ function readMailAction(values) {
     const first = values.positionals[0];
     const action = (first === undefined ? "inbox" : first);
     if (!MAIL_ACTIONS.has(action)) {
-        throw new Error(`Unknown mail command: ${first}. Try accounts, add-imap, detach, inbox, read, search, send, attachment, or sync.`);
+        throw new Error(`Unknown mail command: ${first}. Try accounts, add-imap, detach, inbox, read, search, send, attachment, sync, or sync-status.`);
     }
     return { action, rest: values.positionals.slice(first === undefined ? 0 : 1) };
 }
@@ -99,6 +102,11 @@ function readMailSubjectOrQuery(action, rest) {
         if (rest.length > 1)
             throw new Error(`mail ${action} takes one id, not ${rest.length}.`);
     }
+    else if (MAIL_ACTIONS_WITH_OPTIONAL_SUBJECT.has(action)) {
+        subject = optionalNonEmpty(rest[0]);
+        if (rest.length > 1)
+            throw new Error(`mail ${action} takes at most one id, not ${rest.length}.`);
+    }
     else if (action === "search") {
         query = optionalNonEmpty(rest.join(" "));
         if (!query)

package/dist/commands/local-args-tower-pages.js

@@ -41,6 +41,7 @@ export function parseBriefArgs(args) {
             "--versions",
             "--claims",
             "--render",
+            "--missed",
             "--reason",
             "--wait",
             "--no-wait",
@@ -140,11 +141,19 @@ export function parseBriefArgs(args) {
     if (render && action !== "status") {
         throw new Error("brief --render belongs to `cockpit brief status`; the page is printed by default.");
     }
+    const missed = values.booleans.has("--missed");
+    if (missed && action !== "status") {
+        throw new Error("brief --missed belongs to `cockpit brief status`; the page is printed by default.");
+    }
+    if (missed && named.length > 0) {
+        throw new Error("brief status --missed answers for everybody; it does not take --for, --as or --who.");
+    }
     return {
         kind: "brief",
         action,
         ...(item ? { item } : {}),
         render,
+        missed,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
         subject: forPerson ?? asPerson ?? whoPerson,
@@ -192,8 +201,11 @@ const NOTES_ACTIONS = new Set([
     "connect",
     "detach",
     "sync",
+    "sync-status",
     // BLI-4394: arm that notetaker's webhook with the vendor's signing secret.
     "webhook",
+    // Ticket 10718: the Granola cron's own last-several-runs health.
+    "granola-status",
 ]);
 /** Actions whose first positional is the note it acts on. */
 const NOTES_ACTIONS_NEEDING_A_NOTE = new Set([
@@ -265,7 +277,7 @@ export function parseNotesArgs(args) {
     const first = values.positionals[0];
     const action = (first === undefined ? "list" : first);
     if (!NOTES_ACTIONS.has(action)) {
-        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, or webhook.`);
+        throw new Error(`Unknown notes command: ${first}. Try list, show, shelf, shelves, upload, paste, share, unshare, move, place, accounts, connect, detach, sync, sync-status, webhook, or granola-status.`);
     }
     const rest = values.positionals.slice(first === undefined ? 0 : 1);
     const json = values.booleans.has("--json");
@@ -283,7 +295,7 @@ export function parseNotesArgs(args) {
         }
     }
     let accountId;
-    if (NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action) || action === "sync") {
+    if (NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action) || action === "sync" || action === "sync-status") {
         accountId = optionalNonEmpty(rest[0]);
         if (!accountId && NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)) {
             throw new Error(`notes ${action} needs a notetaker account id.`);
@@ -352,6 +364,7 @@ export function parseNotesArgs(args) {
     else if (action !== "paste"
         && action !== "connect"
         && action !== "sync"
+        && action !== "sync-status"
         && !NOTES_ACTIONS_NEEDING_A_NOTE.has(action)
         && !NOTES_ACTIONS_NEEDING_AN_ACCOUNT.has(action)
         && rest.length > 0) {

package/dist/commands/local-discovery.js

@@ -169,14 +169,14 @@ function incompleteDiscoveryMessage(input) {
 }
 /** Reuse the session adapters for onboarding/doctor. No transcript bodies leave them. */
 export async function scanWorkDirectories(homeDir, persist = true) {
-    const [{ scanAndAttributeCodexSessions, defaultCodexSessionDirs }, { scanAndAttributeClaudeSessions }, { readLocalCollectorConfig, getCollectorRuntimePaths }, { saveRootWorkScan, workDirectories }] = await Promise.all([
+    const [{ scanAndAttributeCodexSessions, defaultCodexSessionDirs }, { scanAndAttributeClaudeSessions }, { readLocalCollectorConfig, getCollectorRuntimePaths }, { saveRootWorkScan, workDirectories, ROOT_WORK_SCAN_WINDOW_DAYS }] = await Promise.all([
         import("../adapters/codex-attribution.js"), import("../adapters/claude-attribution.js"), import("../local-state.js"), import("../root-work.js"),
     ]);
     const paths = getCollectorRuntimePaths(homeDir);
     const config = await readLocalCollectorConfig(paths).catch(error => { if (error.code === "ENOENT")
         return null; throw error; });
     const now = new Date();
-    const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: 14 * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
+    const options = { worktrees: [], collectionRoots: config?.default_repo_paths ?? [], now, sinceMinutes: ROOT_WORK_SCAN_WINDOW_DAYS * 24 * 60, limit: Number.MAX_SAFE_INTEGER };
     const codex = await scanAndAttributeCodexSessions({ ...options, sessionsDirs: defaultCodexSessionDirs(homeDir) });
     const claude = config?.collect_claude_jsonl === false ? null : await scanAndAttributeClaudeSessions({ ...options, projectsDir: (await import("node:path")).default.join(homeDir, ".claude", "projects") });
     if (codex.directory_read_failed_count || codex.stat_failed_count || claude?.project_dir_read_failed_count || claude?.session_stat_failed_count) {

package/dist/commands/local-help-commands-tower.js

@@ -108,7 +108,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "mail",
         [
-            "Usage: cockpit mail [accounts|add-imap|inbox|read <thread>|search \"<words>\"|send|attachment <id>|sync <account>|detach <account>] [flags]",
+            "Usage: cockpit mail [accounts|add-imap|inbox|read <thread>|search \"<words>\"|send|attachment <id>|sync <account>|sync-status [<account>]|detach <account>] [flags]",
             "",
             "Every mailbox you attached, in one place. One person, several addresses — nothing here has a \"current\" mailbox.",
             "accounts — every mailbox, its provider (gmail_oauth or imap), its health and when it last synced. The ids other verbs take are on the last line.",
@@ -122,6 +122,7 @@ export const TOWER_COMMAND_HELP = [
             "send --account <id> --to <a[,b]> [--cc <c>] --subject \"<s>\" [--reply-to <message id>] [--file <path>] — the BODY comes from --file or stdin. --account is required: which address this goes out from is yours to say.",
             "attachment <id> --out <path> — downloads one attachment to a file. Attachments are pointers until you ask; nothing is stored in Tower.",
             "sync <account> — reads that mailbox now instead of waiting for the cron. Prints what landed, or the reason it did not.",
+            "sync-status [<account>] — every mailbox's health, or one's: last successful sync, the last pass's own reason, how many messages it carried, failures in the last 24h, and the lag between a message's own clock and when Tower stored it (ticket 10730).",
             "detach <account> — removes the mailbox, its stored mail and its credential.",
             "--json writes one machine-readable object to stdout; every reason and receipt line stays on stderr. Shapes differ by verb: inbox/read answer { messages: [...] }, search answers { matches: [...] } — same MessageRow shape either name, always carrying thread_id.",
             "A refusal keeps Tower's own reason label — needs_rls_client, account_not_found_or_unreadable, account_not_active, google_oauth_not_configured, credential_unavailable, and so on.",
@@ -131,7 +132,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "cal",
         [
-            'Usage: cockpit cal [today|week|next|find "<words>"|calendars|add-ical|create|share <id>|sync <id>|detach <id>|delete <event id> --yes] [flags]',
+            'Usage: cockpit cal [today|week|next|find "<words>"|calendars|add-ical|create|share <id>|sync <id>|sync-status [<id>]|detach <id>|delete <event id> --yes] [flags]',
             "",
             "Every calendar you attached, in one place — plus any calendar a colleague marked shared.",
             "today [--offset 1] [--tz <zone>] — what is on today, in YOUR zone (this machine's, unless --tz says otherwise). --offset 1 is tomorrow, -1 yesterday.",
@@ -148,6 +149,7 @@ export const TOWER_COMMAND_HELP = [
             "      Only a Google calendar can be written to: an iCal secret address is a read address, and `write_not_supported_for_provider` says so by name.",
             "share <id> --org-visible|--private — makes one of YOUR calendars readable by everyone at BLI, or private again. Sharing never lets anybody else change it.",
             "sync <id> [--full] — reads that calendar now instead of waiting for the cron. --full ignores the sync token / ETag and re-reads everything.",
+            "sync-status [<id>] — every calendar's health, or one's: last successful sync, the last pass's own reason, how many events it carried, failures in the last 24h, and the lag between an event's own provider clock and when Tower stored it (ticket 10730).",
             "detach <id> — removes the calendar and its stored events from Tower. The calendar itself is untouched at Google.",
             "delete <event id> --yes — removes ONE event, AT GOOGLE first, then here. Refuses without --yes: a delete can email everybody on it, exactly like create's invitations do. Google already having it gone (404/410) is answered as success, not a refusal.",
             "--json writes one machine-readable object to stdout; every reason and receipt line stays on stderr.",
@@ -269,7 +271,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "brief",
         [
-            "Usage: cockpit brief [done <item>|undone <item>|edit|rewrite|history] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
+            "Usage: cockpit brief [done <item>|undone <item>|edit|rewrite|history|status] [--for <person>] [--date <YYYY-MM-DD>] [--delta [--against <YYYY-MM-DD>]] [--version <pageId>] [--tldr|--full] [--versions] [--claims] [--days <n>] [--render] [--missed] [--reason \"<why>\"] [--wait|--no-wait] [--dashboard-url <url>] [--json]",
             "",
             "Prints the TODAY page — the same page the Tower website shows, rendered for a terminal.",
             "--for opens somebody else's page; the website's own rule decides whether you may, and it refuses in plain words when you may not.",
@@ -295,6 +297,11 @@ export const TOWER_COMMAND_HELP = [
             "      --render adds the TLDR the DM would have carried.",
             "      --who <person> asks about somebody else and is for the people who read across",
             "      the team. Exits 0 only on `delivered`.",
+            "  cockpit brief status --missed",
+            "      Everybody, not one person: every roster person owed a brief who has no delivered",
+            "      receipt for their own most recently passed window, and why — compile_failed,",
+            "      page_refused, dm_failed, or no_page_shape for a person with no page of their own.",
+            "      Reads across the team, same gate as --who; refuses to combine with --for/--as/--who.",
             "edit — opens the page in $VISUAL/$EDITOR as a document: one [claimId] line per sentence you may rewrite, everything else a # comment. Change the words after an id, save, close. Only the lines that really changed are sent, so an accidental save writes nothing.",
             "  An id you delete or invent is refused by name BEFORE anything is sent: a missing line reads as no opinion at all, not as a sentence to remove, and Tower cannot tell those apart.",
             "  --reason \"<why>\" rides on every row, exactly like a commit message. Optional; the before-and-after already teaches on its own.",
@@ -317,7 +324,7 @@ export const TOWER_COMMAND_HELP = [
     [
         "notes",
         [
-            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>] [flags]",
+            "Usage: cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|accounts|connect|detach <id>|sync <id>|sync-status [<id>]] [flags]",
             "Audio uploads: MP3, M4A, WAV, WebM and OGG, up to 4 MB. --wait polls transcription for at most 330 seconds.",
             "",
             "folders [--tree] [--json]: list folders and visible note counts.",
@@ -345,6 +352,8 @@ export const TOWER_COMMAND_HELP = [
             "connect --provider fellow|circleback [--workspace <subdomain>] --key-stdin [--name <n>] — connect one. Fellow needs --workspace, its API is per workspace. THE API KEY IS READ FROM STDIN, never a flag: printf \"%s\" \"<key>\" | cockpit notes connect --provider fellow --workspace <subdomain> --key-stdin",
             "detach <account-id> — take it off. The stored key goes with it; the meetings it already filed stay.",
             "sync <account-id> — read that notetaker now. Prints the run's own counts and reason label, and exits 1 when the pass failed.",
+            "sync-status [<account-id>] — every notetaker's health, or one's: last successful sync, the last pass's own reason, how many meetings it carried, failures in the last 24h, and the lag between the newest meeting it has read and when it last ran (ticket 10730).",
+            "granola-status [--limit <n>] [--json] — the Granola cron's own last several runs (ticket 10718): reason, counts, model, spend and which lookback it used. Granola runs on a shared server-side key, not a connected account, so this is its own read rather than `accounts`.",
             "A large note is read by a model on the server and can take a couple of minutes; the terminal says so before it waits.",
             "--json writes one machine-readable object to stdout; every reason, receipt and progress line stays on stderr.",
             "Sharing and moving need a signed-in session the database can see. If this deployment cannot mint one, they are refused as needs_signed_in_session rather than done with no permission check — and reads say when they came back narrower than the browser's.",

package/dist/commands/mail.js

@@ -53,6 +53,8 @@ export async function runMail(command, io) {
             return attachment(command, door);
         case "sync":
             return sync(command, door);
+        case "sync-status":
+            return syncStatus(command, door);
     }
 }
 async function listAccounts(door) {
@@ -317,6 +319,33 @@ async function sync(command, door) {
     writeLine(door.io.stdout, `That mailbox did not sync: ${run.reason}${run.detail ? ` (${run.detail})` : ""}.`);
     return 1;
 }
+/**
+ * `sync-status [<account id>]` → `GET /api/mail/sync-status`. Ticket 10730:
+ * the read the integrations audit went to `mail_sync_runs` directly for.
+ */
+async function syncStatus(command, door) {
+    const path = command.subjectId
+        ? `/api/mail/sync-status?account_id=${encodeURIComponent(command.subjectId)}`
+        : "/api/mail/sync-status";
+    const answer = await askAgentDoor(door, { path, method: "GET", label: "mail sync-status", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return failAgentDoor(door, TAG, answer.reason, answer.detail);
+    const accounts = answer.body.accounts ?? [];
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, accounts });
+    if (accounts.length === 0) {
+        writeLine(door.io.stdout, "No mailboxes attached yet.");
+        return 0;
+    }
+    for (const account of accounts) {
+        const lastRun = account.last_run
+            ? `${account.last_run.reason} @ ${account.last_run.started_at} (${account.last_run.items} item(s))`
+            : "never synced";
+        const lag = account.lag ? `${account.lag.lag_seconds}s` : "unknown";
+        writeLine(door.io.stdout, `${account.address}  last_success=${account.last_success_at ?? "never"}  last_run=${lastRun}  failures_24h=${account.failures_24h}  lag=${lag}${account.data_incomplete ? "  (partial read)" : ""}`);
+    }
+    return 0;
+}
 /** Body on stdin, never argv — `--file` is the safest way on Windows. */
 async function readBody(command, door) {
     if (command.filePath) {

package/dist/commands/notes-accounts.js

@@ -227,4 +227,31 @@ export async function syncNotetaker(command, door) {
     if (run.detail)
         writeLine(door.io.stdout, run.detail);
     return run.ok ? 0 : 1;
+}
+/**
+ * `sync-status [<account id>]` → `GET /api/notes/sync-status`. Ticket 10730:
+ * the read the integrations audit went to `notes_sync_runs` directly for.
+ */
+export async function syncStatusNotetakers(command, door) {
+    const path = command.accountId
+        ? `/api/notes/sync-status?account_id=${encodeURIComponent(command.accountId)}`
+        : "/api/notes/sync-status";
+    const answer = await ask(door, { path, method: "GET", label: "notes sync-status", timeoutMs: READ_DEADLINE_MS });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const accounts = answer.body.accounts ?? [];
+    if (door.json)
+        return emit(door, { ok: true, accounts });
+    if (accounts.length === 0) {
+        writeLine(door.io.stdout, "No notetaker is connected yet.");
+        return 0;
+    }
+    for (const account of accounts) {
+        const lastRun = account.last_run
+            ? `${account.last_run.reason} @ ${account.last_run.started_at} (${account.last_run.items} item(s))`
+            : "never synced";
+        const lag = account.lag ? `${account.lag.lag_seconds}s` : "unknown";
+        writeLine(door.io.stdout, `${account.label ?? account.provider}  last_success=${account.last_success_at ?? "never"}  last_run=${lastRun}  failures_24h=${account.failures_24h}  lag=${lag}${account.data_incomplete ? "  (partial read)" : ""}`);
+    }
+    return 0;
 }

package/dist/commands/notes-granola-status.js

@@ -0,0 +1,41 @@
+/**
+ * `cockpit notes granola-status` — the Granola cron's own health, at a
+ * terminal (ticket 10718). Sibling of `notes.ts`, named in its header.
+ *
+ * Granola is NOT a `notes_accounts` row: it runs on one shared server-side
+ * key, swept by its own Railway cron rather than a per-person connection, so
+ * this reads a different door (`GET /api/notes/granola-status`) over the same
+ * `granola_sync_runs` ledger the ops board's `granola-sync` entry watches.
+ * `--limit` bounds how many of the newest runs come back; the door itself
+ * caps it, so a bare `cockpit notes granola-status` is always cheap.
+ */
+import { writeLine } from "./cli-io.js";
+import { ask, emit, fail, READ_DEADLINE_MS } from "./notes-door.js";
+export async function showGranolaStatus(command, door) {
+    const query = command.limit === undefined ? "" : `?limit=${command.limit}`;
+    const answer = await ask(door, {
+        path: `/api/notes/granola-status${query}`,
+        method: "GET",
+        label: "notes granola-status",
+        timeoutMs: READ_DEADLINE_MS,
+    });
+    if (!answer.ok)
+        return fail(door, answer.reason, answer.detail);
+    const body = answer.body;
+    const runs = body.runs ?? [];
+    if (door.json)
+        return emit(door, { ok: true, runs });
+    if (runs.length === 0) {
+        writeLine(door.io.stdout, "No granola:pull run has ever landed a row.");
+        return 0;
+    }
+    for (const run of runs) {
+        const spend = run.spend_usd === null ? "n/a" : `$${run.spend_usd.toFixed(4)}`;
+        writeLine(door.io.stdout, `${run.started_at}  ${run.reason.padEnd(21)}  seen=${run.notes_seen} stored=${run.notes_stored} `
+            + `failed=${run.notes_failed}  model=${run.model ?? "n/a"}  spend=${spend}`);
+        writeLine(door.io.stdout, `  since=${run.window_start ?? "n/a"}  next-since=${run.window_end ?? "n/a"}`);
+        if (run.detail)
+            writeLine(door.io.stdout, `  ${run.detail}`);
+    }
+    return 0;
+}

package/dist/commands/notes.js

@@ -33,6 +33,9 @@
  *  - `notes-accounts.ts` — BLI-4383: the notetaker a person connects, and the
  *    meetings it records. `connect` reads the API key from STDIN and there is
  *    no flag that would take one.
+ *  - `notes-granola-status.ts` — ticket 10718: the Granola CRON's own health
+ *    (it runs on a shared server-side key, not a `notes_accounts` row), read
+ *    off its `granola_sync_runs` ledger.
  *
  * Every public name is still importable from this file.
  */
@@ -40,10 +43,12 @@ import { loadPairedSession } from "../tower-client.js";
 import { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 import { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
 import { runFolderCommand } from "./notes-folders.js";
-import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
+import { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
+import { showGranolaStatus } from "./notes-granola-status.js";
 export { listNotes, listShelves, showNote, showShelf } from "./notes-reads.js";
 export { uploadNotes, pasteNote, shareNote, moveNote, placeNote } from "./notes-writes.js";
-export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, } from "./notes-accounts.js";
+export { armNotesWebhook, connectNotetaker, detachNotetaker, listNotesAccounts, showNotesWebhook, syncNotetaker, syncStatusNotetakers, } from "./notes-accounts.js";
+export { showGranolaStatus } from "./notes-granola-status.js";
 export { ask, emit, fail, sayUpload, sayScope, errorText, TAG, } from "./notes-door.js";
 export async function runNotes(command, io) {
     const session = await loadPairedSession("notes", command.homeDir);
@@ -91,7 +96,11 @@ export async function runNotes(command, io) {
             return detachNotetaker(command, door);
         case "sync":
             return syncNotetaker(command, door);
+        case "sync-status":
+            return syncStatusNotetakers(command, door);
         case "webhook":
             return armNotesWebhook(command, door);
+        case "granola-status":
+            return showGranolaStatus(command, door);
     }
 }

package/dist/commands/ops-render-brief.js

@@ -0,0 +1,56 @@
+/**
+ * The daily-brief delivery sections `ops-render.ts` folds in (BLI-10728), its
+ * own module for the same reason `ops-render-spend.ts` and
+ * `ops-render-ladder.ts` have one: `ops-render.ts` sits at the repo's
+ * readability floor (`file-size-ratchet.test.ts`), and a board section is
+ * exactly the kind of thing that keeps growing.
+ *
+ * Two surfaces live here:
+ *   - `renderBriefStreak` — the `BRIEF STREAK` line `cockpit ops status` folds
+ *     into the whole-board render.
+ *   - `renderMissedBrief` — the standalone answer `cockpit brief status
+ *     --missed` prints: every roster person owed a brief who is missing one
+ *     right now, and why.
+ *
+ * Both print sentences the SERVER wrote (`lib/ops/brief-delivery-streak.ts`,
+ * `lib/ops/brief-delivery-coverage.ts`); this file decides order and
+ * indentation and nothing else, the same rule every other `ops-render-*.ts`
+ * sibling keeps.
+ */
+/**
+ * The daily-brief delivery streak (BLI-10728): consecutive most-recent
+ * cycles where every roster person owed a brief got a delivered receipt.
+ */
+export function renderBriefStreak(streak, dim) {
+    const lines = ["", `BRIEF STREAK  ${streak.streakDays ?? 0} day(s)`];
+    if (streak.detail)
+        lines.push(dim(`  ${streak.detail}`));
+    return lines;
+}
+/**
+ * Everybody, not one person: who is missing a delivered receipt for their own
+ * window right now, and why. Mirrors `cockpit ops status`'s `jarvis-ic-dm`
+ * row, computed by the same `readBriefDeliveryCoverage`.
+ */
+export function renderMissedBrief(payload, dim) {
+    const coverage = payload.coverage ?? {};
+    const lines = [`brief delivery — ${coverage.verdict ?? "unknown"}`];
+    if (coverage.detail)
+        lines.push(coverage.detail);
+    lines.push("");
+    const missed = coverage.missed ?? [];
+    if (missed.length === 0) {
+        lines.push("Nobody owed a brief is missing one right now.");
+    }
+    else {
+        lines.push(`${missed.length} missing:`);
+        for (const person of missed) {
+            lines.push(`  ${(person.displayName ?? "?").padEnd(12)} ${person.missReason ?? "?"}`);
+            if (person.detail)
+                lines.push(dim(`    ${person.detail}`));
+        }
+    }
+    lines.push("", dim(`delivered ${coverage.delivered ?? 0} · no page shape ${coverage.noPageShape ?? 0} · ` +
+        `not yet due ${coverage.notOwed ?? 0} · unreadable ${coverage.unreadable ?? 0}`));
+    return lines;
+}

package/dist/commands/ops-render.js

@@ -20,8 +20,15 @@ import { renderSpend } from "./ops-render-spend.js";
 // coverage table and the spend section have one: this file is at the repo's
 // readability floor.
 import { renderLadder } from "./ops-render-ladder.js";
+// BLI-10728: the brief-delivery streak and the standalone `--missed` answer,
+// their own module for the same reason — this file is at the repo's
+// readability floor. Only `renderBriefStreak` is called from here;
+// `renderMissedBrief` is re-exported below for `brief.ts` without a local
+// import that `noUnusedLocals` would then refuse.
+import { renderBriefStreak } from "./ops-render-brief.js";
 export { renderSpend } from "./ops-render-spend.js";
 export { renderLadder } from "./ops-render-ladder.js";
+export { renderBriefStreak, renderMissedBrief } from "./ops-render-brief.js";
 export { renderMemoryHooks, renderMemoryUsage } from "./ops-render-memory.js";
 export { renderCoverageBuckets };
 /** The word a person reads. Short, fixed width, and never a bare colour. */
@@ -141,6 +148,8 @@ options = {}) {
         lines.push(...renderSpend(payload.spend, dim));
     if (payload.ladder)
         lines.push(...renderLadder(payload.ladder, dim));
+    if (payload.briefStreak)
+        lines.push(...renderBriefStreak(payload.briefStreak, dim));
     const slack = payload.skips?.slack;
     const external = payload.skips?.external;
     if (slack || external) {

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.146");
+    writeLine(io?.stdout ?? process.stdout, "0.2.148");
     return 0;
   }
 

package/dist/commands/session-sync-record.js

@@ -7,6 +7,8 @@
  * unreported session out of the live window.
  */
 import { describeError } from "../health-detail.js";
+import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile, } from "../local-state.js";
+import { normalizeDashboardUrl } from "../upload-http.js";
 import { flushPendingCodexSessionReports, queueCodexSessionReport, } from "../upload.js";
 import { CLAUDE_CURSOR_FILENAME, countStaleSessions, readRawEvidenceCursor, recordSessionObservation, writeRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
@@ -24,6 +26,7 @@ export async function reportSessionsAndAdvanceCursors(options) {
     const hadPendingSessionReports = (options.plan.uploadSpool?.pending_session_reports.length ?? 0) > 0;
     const queuedCurrentSessionReport = await queueSessionReportForDelivery({
         homeDir: options.run.homeDir,
+        dashboardUrl: options.run.dashboardUrl,
         outcomes: options.outcomes,
         sessions: options.sessions,
         now: options.now,
@@ -51,6 +54,29 @@ export async function reportSessionsAndAdvanceCursors(options) {
         ...staleCounts,
     };
 }
+/**
+ * BLI-10734 (Edward, 2026-09-17: "roots are labels, not gates"). A machine
+ * whose observed sessions all sit outside every approved root never syncs a
+ * worktree, so there is no real repo to attach the report to — but the
+ * sessions were still observed, and withholding the whole report here (rather
+ * than the raw evidence, which stays root-gated) was the exact silent 100%
+ * gap the ruling named: on 2026-09-17, Vee's machine had 1,594 of 1,594 local
+ * sessions withheld and Savina's 283 of 285, both entirely by this branch
+ * never firing. This identity is deliberately synthetic and never borrows a
+ * real repo's fingerprint — a report for genuinely unrelated work must never
+ * land labelled as belonging to some other repo this machine happens to have
+ * approved.
+ */
+const NO_WORKTREE_REPORT_IDENTITY = {
+    workContextId: "outside-approved-root",
+    repoLabel: "outside-approved-root",
+    branch: "unknown",
+    repoFingerprint: "outside-approved-root",
+    repoOriginUrl: null,
+    worktreeLabel: "outside-approved-root",
+    worktreeFingerprint: "outside-approved-root",
+    worktreeIsPrimary: false,
+};
 /**
  * Persist the metadata-only session report to the spool, before either source
  * cursor advances.
@@ -59,27 +85,56 @@ export async function reportSessionsAndAdvanceCursors(options) {
  * If queueing itself fails, the cursors remain at their prior retryable
  * positions instead of aging an unreported session out of the live window.
  * Returns whether a report for THIS tick was queued.
+ *
+ * A report is owed whenever this tick observed ANY session, worktree upload
+ * or not (BLI-10734): a worktree that did upload still carries its real repo
+ * identity; a tick with no worktree outcome at all falls back to the
+ * synthetic one above rather than dropping every session it saw.
  */
 async function queueSessionReportForDelivery(options) {
-    const firstUploaded = options.outcomes.find((outcome) => outcome.sync.status === "uploaded");
-    if (!firstUploaded || options.sessions.length === 0)
+    if (options.sessions.length === 0)
         return false;
-    const queued = await queueCodexSessionReport({
-        homeDir: options.homeDir,
-        dashboardUrl: firstUploaded.sync.dashboard_url,
-        generatedAt: options.now.toISOString(),
-        workContextId: firstUploaded.sync.work_context_id,
-        repoLabel: firstUploaded.worktree.repo_label,
-        branch: firstUploaded.worktree.branch,
-        repoFingerprint: firstUploaded.worktree.repo_fingerprint,
-        repoOriginUrl: firstUploaded.worktree.repo_origin_url,
-        worktreeLabel: firstUploaded.worktree.worktree_label,
-        worktreeFingerprint: firstUploaded.worktree.worktree_fingerprint,
-        worktreeIsPrimary: firstUploaded.worktree.worktree_is_primary,
-        sessions: options.sessions,
-    });
+    const firstUploaded = options.outcomes.find((outcome) => outcome.sync.status === "uploaded");
+    const queued = await queueCodexSessionReport(firstUploaded
+        ? {
+            homeDir: options.homeDir,
+            dashboardUrl: firstUploaded.sync.dashboard_url,
+            generatedAt: options.now.toISOString(),
+            workContextId: firstUploaded.sync.work_context_id,
+            repoLabel: firstUploaded.worktree.repo_label,
+            branch: firstUploaded.worktree.branch,
+            repoFingerprint: firstUploaded.worktree.repo_fingerprint,
+            repoOriginUrl: firstUploaded.worktree.repo_origin_url,
+            worktreeLabel: firstUploaded.worktree.worktree_label,
+            worktreeFingerprint: firstUploaded.worktree.worktree_fingerprint,
+            worktreeIsPrimary: firstUploaded.worktree.worktree_is_primary,
+            sessions: options.sessions,
+        }
+        : {
+            homeDir: options.homeDir,
+            dashboardUrl: await resolveFallbackDashboardUrl(options.homeDir, options.dashboardUrl),
+            generatedAt: options.now.toISOString(),
+            ...NO_WORKTREE_REPORT_IDENTITY,
+            sessions: options.sessions,
+        });
     return Boolean(queued);
 }
+/**
+ * Where to file a report with no worktree to read a dashboard URL off of: what
+ * the operator typed this tick, else the paired session's own dashboard, else
+ * the saved config, else the public default — the same fallback chain
+ * `upload-envelope-build.ts` already resolves for every other envelope.
+ */
+async function resolveFallbackDashboardUrl(homeDir, explicit) {
+    if (explicit)
+        return normalizeDashboardUrl(explicit);
+    const paths = getCollectorRuntimePaths(homeDir);
+    const [sessionFile, config] = await Promise.all([
+        readLocalCollectorSessionFile(paths).catch(() => null),
+        readLocalCollectorConfig(paths).catch(() => null),
+    ]);
+    return normalizeDashboardUrl(sessionFile?.dashboard_url ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL);
+}
 /**
  * Advance both source cursors to what this tick observed.
  *

package/dist/root-work.js

@@ -23,6 +23,30 @@ export function workDirectories(results, platform = process.platform) {
 export function outsideWorkDirectories(scan, roots, platform = process.platform) {
     return scan.directories.filter(({ directory }) => !roots.some(root => containsPath(root, directory, rootPathApi(platform))));
 }
+/**
+ * The window `commands/local-discovery.ts`'s `scanWorkDirectories` scans for
+ * this machine's own work-directory evidence, named once so the coverage
+ * sentence below can never drift from the window the scan it describes
+ * actually covers (ticket 10727).
+ */
+export const ROOT_WORK_SCAN_WINDOW_DAYS = 14;
+/**
+ * BLI-10734 (Edward, 2026-09-17: "roots are labels, not gates"), landed on
+ * top of the measurement ticket 10727 first shipped this function. The
+ * doctor sentence a person actually asked for: "N of M local sessions on the
+ * server". Every session this scan observed now reaches the server — inside
+ * an approved root unlabelled, outside one carrying `root_scope: "outside"`
+ * (session-first: approved roots are a label, never a gate,
+ * `docs/architecture/session-first-collection.md`) — so `outsideCount` here
+ * names how many carry that label, never how many were withheld. This is not
+ * a server-confirmed delivery receipt (that would need a network round trip);
+ * it is the honest local half of the claim, the same distinction
+ * `docs/runbooks/cockpit-launchd-sync.md` draws for every other coverage
+ * line.
+ */
+export function sessionCoverageLine(scan, outsideCount) {
+    return `${scan.observed} of ${scan.observed} local sessions (last ${ROOT_WORK_SCAN_WINDOW_DAYS} days) reach the server; ${outsideCount} were outside an approved root and are uploaded with an outside label.`;
+}
 export async function saveRootWorkScan(paths, results, now) {
     const scan = { generated_at: now.toISOString(), observed: results.length, directories: workDirectories(results) };
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.146",
+  "version": "0.2.148",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,8 +27,8 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.36",
-    "@bli-cockpit/mcp": "0.1.70",
-    "@bli-cockpit/telemetry-core": "0.1.48"
+    "@bli-cockpit/memory-mcp": "0.1.37",
+    "@bli-cockpit/mcp": "0.1.71",
+    "@bli-cockpit/telemetry-core": "0.1.49"
   }
 }