@bli-cockpit/cli 0.2.149 → 0.2.154

package/dist/adapters/local-sources.js

@@ -34,6 +34,7 @@ export async function runLocalSourceCollectors(options) {
             claudeSessionFiles: options.rawEvidenceClaudeSessionFiles,
             claudeAttributionScan: options.rawEvidenceClaudeAttributionScan,
             skipContentHashes: options.rawEvidenceSkipContentHashes,
+            priorSnapshots: options.rawEvidencePriorSnapshots,
             byteBudget: options.rawEvidenceByteBudget,
             objectBudget: options.rawEvidenceObjectBudget,
             budget: options.rawEvidenceBudget,

package/dist/adapters/raw-evidence-collection-state.js

@@ -73,6 +73,7 @@ export async function openCollection(context, options, places) {
         scanned: new Map(),
         caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
+        priorSnapshots: options.priorSnapshots ?? new Map(),
         budget: options.budget ?? {
             remainingBytes: byteBudget,
             remainingObjects: objectBudget,

package/dist/adapters/raw-evidence-facts.js

@@ -268,6 +268,7 @@ function uploadFileFromEntry(entry) {
         ...(entry.artifact_metadata
             ? { artifact_metadata: entry.artifact_metadata }
             : {}),
+        ...(entry.snapshot ? { source_key: entry.source_key, snapshot: entry.snapshot } : {}),
     };
 }
 function stageReasonLabel(state, priorPackCount) {

package/dist/adapters/raw-evidence-manifest.js

@@ -24,6 +24,8 @@ export function evidenceEntry(options) {
         codex_session_id: options.codexSessionId ?? null,
         staged_in_pack: options.stagedInPack !== false,
         source_key: options.sourceKey ?? null,
+        ...(options.snapshot ? { snapshot: options.snapshot } : {}),
+        ...(options.supersedes ? { supersedes: options.supersedes } : {}),
         ...(options.artifactMetadata
             ? {
                 artifact_metadata: {
@@ -54,6 +56,9 @@ export function pointerFromEntry(entry) {
         media_type: entry.media_type,
         redacted_summary: entry.redacted_summary,
         ...(entry.redaction ? { redaction: entry.redaction } : {}),
+        ...(entry.supersedes
+            ? { supersedes_pointer_id: entry.supersedes.pointer_id, supersede_rule: entry.supersedes.rule }
+            : {}),
     };
 }
 export function makeManifest(options) {

package/dist/adapters/raw-evidence-sanitize.js

@@ -4,11 +4,13 @@ import { describeError } from "../health-detail.js";
 /** BLI-3238: a crashed redactor has to say so; see the catch below. */
 export function sanitizeTextEvidenceForUpload(options) {
     const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
-    // Deliberately outside the try: the content guard is the cheap check that
-    // decides which masking strategy applies, and it is not the thing whose
-    // crash the stub below is for.
-    const secretLikeContent = containsSecretLikeContent(options.text);
     try {
+        // BLI-11094: inside the try. The content guard decides which masking
+        // strategy applies; it used to sit outside on the theory that it cannot
+        // crash, but it runs regexes over the whole file, and a throw from here
+        // escaped this function entirely, which is the one outcome the header
+        // promises never happens. A crash anywhere now lands on the stub.
+        const secretLikeContent = containsSecretLikeContent(options.text);
         const redactionResult = (options.redact ?? redactSecretLikeContent)(options.text, {
             appliedBy: "local_collector",
             redactedFields: options.redactedFields,
@@ -140,28 +142,88 @@ function stubForCrashedRedaction(input) {
         completenessLabel: "redaction_crashed_stubbed",
     };
 }
+/**
+ * Replace every line a redacted range touches, keep every other line as is.
+ *
+ * BLI-11094: this used to split the whole file with
+ * `text.match(/[^\n]*(?:\n|$)/gu)`. With the `u` flag V8 cannot run `[^\n]*`
+ * as a flat loop (a code point may be two UTF-16 units), so it pushes one
+ * backtrack entry per character, and a single line of about 10 million
+ * characters in a two-byte string (a Codex tool output: every crashing file on
+ * Edward's Mac had a 12 to 14 MB line) threw `RangeError: Maximum call stack
+ * size exceeded`. The catch above then uploaded a stub instead of the session.
+ *
+ * Now the lines are found with `indexOf("\n")`, which has no stack at all, and
+ * the output is the untouched text between masked lines, so the cost is one
+ * pass plus the number of ranges, whatever the longest line. The contract is
+ * unchanged and byte-identical (pinned by
+ * `raw-evidence-sanitize-legacy.test.ts`): a segment ends after each `\n`,
+ * offsets are UTF-16 and file-absolute, and a line takes the rule of the FIRST
+ * range in array order that overlaps it.
+ */
 function maskSecretBearingLines(text, redaction) {
     if (redaction.redacted_ranges.length === 0) {
         return "[REDACTED_LINE:secret_like_content_guard]\n";
     }
-    const segments = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? [];
-    let offset = 0;
-    return segments
-        .map((segment) => {
-        const start = offset;
-        const end = offset + segment.length;
-        offset = end;
-        const matched = redaction.redacted_ranges.find((range) => range.start < end && start < range.end);
-        if (!matched)
-            return segment;
-        return `[REDACTED_LINE:${matched.rule_id}]${lineEndingOf(segment)}`;
-    })
-        .join("");
+    const lineStarts = lineStartOffsets(text);
+    const ruleByLine = new Map();
+    for (const range of redaction.redacted_ranges) {
+        let line = firstLineEndingAfter(lineStarts, text.length, range.start);
+        for (; line < lineStarts.length; line += 1) {
+            const start = lineStarts[line];
+            const end = lineEndOf(lineStarts, text.length, line);
+            if (start >= range.end)
+                break;
+            if (range.start < end && start < range.end && !ruleByLine.has(line)) {
+                ruleByLine.set(line, range.rule_id);
+            }
+        }
+    }
+    const maskedLines = [...ruleByLine.keys()].sort((a, b) => a - b);
+    const pieces = [];
+    let cursor = 0;
+    for (const line of maskedLines) {
+        const start = lineStarts[line];
+        const end = lineEndOf(lineStarts, text.length, line);
+        pieces.push(text.slice(cursor, start));
+        pieces.push(`[REDACTED_LINE:${ruleByLine.get(line)}]${lineEndingOf(text, start, end)}`);
+        cursor = end;
+    }
+    pieces.push(text.slice(cursor));
+    return pieces.join("");
 }
-function lineEndingOf(segment) {
-    if (segment.endsWith("\r\n"))
+/** Where each non-empty segment starts; a segment ends just after its `\n`. */
+function lineStartOffsets(text) {
+    const starts = [];
+    let position = 0;
+    while (position < text.length) {
+        starts.push(position);
+        const newline = text.indexOf("\n", position);
+        position = newline === -1 ? text.length : newline + 1;
+    }
+    return starts;
+}
+function lineEndOf(lineStarts, textLength, line) {
+    return lineStarts[line + 1] ?? textLength;
+}
+/** Index of the first line whose end is past `offset` (binary search). */
+function firstLineEndingAfter(lineStarts, textLength, offset) {
+    let low = 0;
+    let high = lineStarts.length;
+    while (low < high) {
+        const middle = (low + high) >>> 1;
+        if (lineEndOf(lineStarts, textLength, middle) > offset)
+            high = middle;
+        else
+            low = middle + 1;
+    }
+    return low;
+}
+function lineEndingOf(text, start, end) {
+    if (end - start >= 2 && text[end - 2] === "\r" && text[end - 1] === "\n") {
         return "\r\n";
-    if (segment.endsWith("\n"))
+    }
+    if (end - start >= 1 && text[end - 1] === "\n")
         return "\n";
     return "";
 }

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -0,0 +1,82 @@
+/**
+ * Does this transcript snapshot hold every byte of the last one we committed
+ * for the same file (BLI-11088)?
+ *
+ * Every sync stages the current bytes of every live transcript, so a file that
+ * grew lands as a new object beside the old one. When the last committed
+ * snapshot is a byte prefix of the new bytes, the upload carries a CLAIM
+ * (`supersedes_pointer_id` + `supersede_rule: "prefix"`) and the ingest door,
+ * after re-deriving it from Storage, deletes the old object. The rule is
+ * defined once in `@bli-cockpit/telemetry-core/snapshot-supersede`.
+ *
+ * The collector never keeps old bytes. What it remembers about a committed
+ * snapshot lives in the primary cursor's `objects` map (content hash, size,
+ * source key, truncated prefix checkpoints), and that is all the decision
+ * reads. Comparing with the snapshot committed LAST is also what makes a
+ * one-time history rewrite harmless: the first snapshot after it keeps both,
+ * and every later one is a prefix of its predecessor again.
+ *
+ * A snapshot that is not a prefix successor is uploaded exactly as before, and
+ * says so: `snapshot_rewritten`, both sizes, and the byte range the first
+ * difference falls in. Never content.
+ */
+import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
+/**
+ * The newest committed snapshot per source key, from the cursor's objects map,
+ * restricted to objects this work context owns (the server refuses a claim
+ * across work sessions, so a claim across contexts would only be refused).
+ */
+export function priorSnapshotsFromCursor(objects, belongsToContext) {
+    const out = new Map();
+    for (const [contentHash, entry] of Object.entries(objects)) {
+        if (!entry.source_key || !belongsToContext(entry.object_key))
+            continue;
+        const current = out.get(entry.source_key);
+        const newer = !current
+            || entry.committed_at > current.committed_at
+            || (entry.committed_at === current.committed_at && entry.byte_size > current.byte_size);
+        if (!newer)
+            continue;
+        out.set(entry.source_key, {
+            raw_evidence_pointer_id: entry.object_key,
+            content_hash_sha256: contentHash,
+            byte_size: entry.byte_size,
+            checkpoints: entry.checkpoints ?? null,
+            committed_at: entry.committed_at,
+        });
+    }
+    return out;
+}
+export function describeSnapshot(bytes) {
+    return { checkpoints: prefixCheckpoints(bytes) };
+}
+/**
+ * The claim this snapshot may make, or null. Logs every decision that had a
+ * prior to compare against; a source seen for the first time has nothing to
+ * decide and says nothing.
+ */
+export function supersedeClaimFor(options) {
+    const { prior } = options;
+    if (!prior || prior.content_hash_sha256 === options.contentHash)
+        return null;
+    if (isPrefixSuccessor(options.bytes, prior)) {
+        console.error("[evidence-upload] snapshot supersedes the previous one", JSON.stringify({
+            reason: "snapshot_supersede_claimed",
+            rule: "prefix",
+            kind: options.kind,
+            previous_byte_size: prior.byte_size,
+            byte_size: options.bytes.byteLength,
+        }));
+        return { pointer_id: prior.raw_evidence_pointer_id, rule: "prefix" };
+    }
+    const range = firstDifferenceRange(options.bytes, prior);
+    console.error("[evidence-upload] snapshot rewritten, keeping both", JSON.stringify({
+        reason: "snapshot_rewritten",
+        kind: options.kind,
+        previous_byte_size: prior.byte_size,
+        byte_size: options.bytes.byteLength,
+        first_differing_offset_at_least: range.at_least,
+        first_differing_offset_below: range.below,
+    }));
+    return null;
+}

package/dist/adapters/raw-evidence-transcript-file.js

@@ -19,6 +19,7 @@ import { isSecretLikePath, sha256, shortHash, } from "./raw-evidence-keys.js";
 import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
+import { describeSnapshot, supersedeClaimFor } from "./raw-evidence-snapshot-supersede.js";
 import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
@@ -135,6 +136,15 @@ async function stageOneTranscript(collection, file) {
         contentAddress: file.contentAddress(file.contentHash.slice(0, 16)),
         stagedInPack: staged.staged_in_pack,
         sourceKey: file.names.sourceKey,
+        // BLI-11088: remember this snapshot's shape, and claim the last one when
+        // these bytes rebuild it.
+        snapshot: describeSnapshot(file.sanitized.bytes),
+        supersedes: supersedeClaimFor({
+            bytes: file.sanitized.bytes,
+            contentHash: file.contentHash,
+            kind: file.kind,
+            prior: collection.priorSnapshots.get(file.names.sourceKey),
+        }),
     }));
 }
 /**

package/dist/agent-rules.js

@@ -61,11 +61,11 @@ async function installAgentRulesForHost(host, options = {}, hostsInCall = [host]
 }
 async function foldClaudeIntoCodexInclude(host, rulesFile, existing, block) {
     if (!hasManagedBlock(existing)) {
-        console.info("[agent-rules] claude rules already covered by codex include, skipping duplicate write", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+        console.error("[agent-rules] claude rules already covered by codex include, skipping duplicate write", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
         return agentRulesResult(host, rulesFile, "unchanged", block, "included");
     }
     await writeFile(rulesFile, removeManagedBlock(existing), "utf8");
-    console.info("[agent-rules] removed a duplicate managed block now covered by the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+    console.error("[agent-rules] removed a duplicate managed block now covered by the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
     return agentRulesResult(host, rulesFile, "updated", block, "included");
 }
 export async function uninstallCodexAgentRules(options = {}) {
@@ -147,7 +147,7 @@ async function inspectAgentRulesForHost(host, options = {}, hostsInCall = [host]
         };
     }
     if (claudeFoldsIntoCodexInclude(host, hostsInCall, existing, homeDir)) {
-        console.info("[agent-rules] claude rules read as installed via the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+        console.error("[agent-rules] claude rules read as installed via the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
         return {
             ...agentRulesResult(host, rulesFile, "unchanged", block, "included"),
             installed: true,

package/dist/commands/agent-door.js

@@ -23,6 +23,7 @@ export async function openAgentDoor(commandName, command, io) {
         deviceToken: session.device_token,
         io,
         json: command.json,
+        homeDir: command.homeDir,
     };
 }
 export async function askAgentDoor(door, options) {
@@ -35,6 +36,8 @@ export async function askAgentDoor(door, options) {
         label: options.label,
         timeoutMs: options.timeoutMs,
         ...(options.body === undefined ? {} : { body: options.body }),
+        ...(options.warmRoute === undefined ? {} : { warmRoute: options.warmRoute }),
+        ...(door.homeDir === undefined ? {} : { homeDir: door.homeDir }),
         log: (line) => writeLine(door.io.stderr, line),
     });
     if (!result.ok) {

package/dist/commands/backfill-lock-wait.js

@@ -0,0 +1,49 @@
+import { acquireSyncLock, inspectSyncLock, } from "../sync-lock.js";
+export const BACKFILL_SYNC_LOCK_WAIT_MS = 10 * 60_000;
+const LOG_EVERY_MS = 30_000;
+const POLL_EVERY_MS = 1_000;
+const DEFAULT_DEPS = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    acquire: acquireSyncLock,
+    inspect: inspectSyncLock,
+};
+/**
+ * Acquire the collection lock, waiting up to `waitMs`. `waitMs <= 0` tries
+ * exactly once (the caller has its own wait, as doctor does).
+ */
+export async function acquireSyncLockWithWait(paths, waitMs = BACKFILL_SYNC_LOCK_WAIT_MS, deps = DEFAULT_DEPS) {
+    const started = deps.now();
+    let nextLogAt = started;
+    for (;;) {
+        const attempt = await deps.acquire(paths, new Date(deps.now()));
+        const waited = deps.now() - started;
+        if (attempt.acquired) {
+            if (waited > 0) {
+                console.error("[backfill] collection lock acquired after waiting", JSON.stringify({ waited_ms: waited }));
+            }
+            return { acquired: true, lock: attempt, waited_ms: waited };
+        }
+        if (waited >= waitMs) {
+            const holder = await holderFields(paths, deps);
+            console.error("[backfill] gave up waiting for collection lock", JSON.stringify({ reason: "sync_lock_held", waited_ms: waited, limit_ms: waitMs, ...holder }));
+            return { acquired: false, waited_ms: waited };
+        }
+        if (deps.now() >= nextLogAt) {
+            const holder = await holderFields(paths, deps);
+            console.error("[backfill] waiting for collection lock", JSON.stringify({ waited_ms: waited, limit_ms: waitMs, ...holder }));
+            nextLogAt += LOG_EVERY_MS;
+        }
+        await deps.sleep(Math.min(POLL_EVERY_MS, waitMs - waited));
+    }
+}
+/** Who holds the lock and how stale its heartbeat is: a pid and milliseconds, nothing else. */
+async function holderFields(paths, deps) {
+    const owner = await deps.inspect(paths);
+    const heartbeatMs = owner ? Date.parse(owner.heartbeat_at) : Number.NaN;
+    return {
+        holder: "sync",
+        holder_pid: owner && owner.pid > 0 ? owner.pid : null,
+        heartbeat_age_ms: Number.isFinite(heartbeatMs) ? Math.max(0, deps.now() - heartbeatMs) : null,
+    };
+}

package/dist/commands/backfill-outside-roots.js

@@ -0,0 +1,97 @@
+/**
+ * BLI-11091: roots are labels on the backfill path too.
+ *
+ * Edward's ruling of 2026-09-17 (ticket 10734) made approved collection roots a
+ * LABEL on the upload, never a gate; PR 1453 carried it through the scheduled
+ * sync. The backfill planner still refused every session whose cwd sat outside
+ * the scanned roots (`cwd_outside_scanned_worktrees`): measured on the
+ * reference Mac, 901 of 1,513 Codex sessions, many of them the only full copy
+ * of that history.
+ *
+ * This module is the one place that closes that gap. A candidate whose
+ * attribution reason is one of the "outside every approved root" reasons (the
+ * SAME closed set `rootScopeForReason` reads, so one vocabulary) and which has
+ * no worktree gets the synthetic `outside-approved-root` workspace the sync
+ * path already uses for its report identity. Its attribution state and reason
+ * are left untouched: the workspace is transport identity only, never a claim
+ * that the session belongs to any repo. The upload itself runs through the
+ * ordinary sync envelope, so redaction applies exactly as it does to an
+ * inside-root session, and the explicit Claude opt-out
+ * (`collect_claude_jsonl: false`) is honoured before any store is read
+ * (`backfill-scope.ts`).
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { repoFingerprintFromLocalRoot, stableWorktreeFingerprint, } from "../repo-identity.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
+/**
+ * The label the sync path writes for a report with no real worktree
+ * (`session-sync-record.ts`). Reused verbatim: one label, not a second one.
+ */
+export const OUTSIDE_ROOTS_WORKSPACE_LABEL = "outside-approved-root";
+/**
+ * The synthetic workspace an outside-root session uploads under. It lives in
+ * the collector's own state directory, so it is always a real, owner-only,
+ * empty folder the envelope builder can stand in, on macOS and Windows alike,
+ * and never a directory of the operator's that git or any source collector
+ * would read.
+ */
+export function outsideRootsWorkspace(homeDir) {
+    const root = path.resolve(getCollectorRuntimePaths(homeDir).state_dir, OUTSIDE_ROOTS_WORKSPACE_LABEL);
+    return {
+        requested_path: root,
+        repo_root: root,
+        repo_label: OUTSIDE_ROOTS_WORKSPACE_LABEL,
+        repo_fingerprint: repoFingerprintFromLocalRoot(root),
+        repo_origin_url: null,
+        branch: "unknown",
+        head_sha: null,
+        worktree_label: OUTSIDE_ROOTS_WORKSPACE_LABEL,
+        worktree_fingerprint: stableWorktreeFingerprint(root),
+        worktree_is_primary: true,
+    };
+}
+/** Does this candidate sit outside every approved root, by its own attribution reason? */
+export function isOutsideRootCandidate(candidate) {
+    return rootScopeForReason(candidate.reason) === "outside";
+}
+/**
+ * Attaches the outside-roots workspace to every outside-root candidate that
+ * has no worktree, and says how many it labelled. A candidate that already has
+ * a worktree keeps it; nothing else about any candidate changes.
+ */
+export function labelOutsideRootCandidates(candidates, workspace) {
+    let codex = 0;
+    let claude = 0;
+    const labelled = candidates.map((candidate) => {
+        if (candidate.worktree || !isOutsideRootCandidate(candidate))
+            return candidate;
+        if (candidate.source === "codex")
+            codex += 1;
+        else
+            claude += 1;
+        return { ...candidate, worktree: workspace };
+    });
+    console.error("[backfill] outside-root sessions labelled for upload", JSON.stringify({
+        root_scope: "outside",
+        count: codex + claude,
+        codex_count: codex,
+        claude_count: claude,
+        candidate_count: candidates.length,
+    }));
+    return labelled;
+}
+/** Is this worktree the synthetic outside-roots workspace (and not a real repo)? */
+export function isOutsideRootsWorkspace(worktree) {
+    return (worktree.repo_label === OUTSIDE_ROOTS_WORKSPACE_LABEL &&
+        path.basename(worktree.repo_root) === OUTSIDE_ROOTS_WORKSPACE_LABEL);
+}
+/**
+ * Creates the synthetic workspace folder before the first upload that needs
+ * it. Only the UPLOAD stage calls this, so a `--dry-run` still writes nothing.
+ */
+export async function ensureOutsideRootsWorkspace(worktree) {
+    await fs.mkdir(worktree.repo_root, { recursive: true, mode: 0o700 });
+    console.error("[backfill] outside-roots workspace ready", JSON.stringify({ repo_label: worktree.repo_label, worktree_fingerprint: worktree.worktree_fingerprint }));
+}

package/dist/commands/backfill-reasons.js

@@ -58,6 +58,23 @@ const REASON_VERDICTS = new Map([
         "repo_not_on_disk",
         { classification: "retryable", note: "repo must exist on disk" },
     ],
+    // BLI-11091: roots are a label, never a gate. These two sessions upload
+    // under the outside-roots workspace with `root_scope: "outside"`; the row
+    // says so instead of calling them skipped.
+    [
+        "cwd_outside_scanned_worktrees",
+        {
+            classification: "permanent",
+            note: "uploaded with the outside-roots label (root_scope outside)",
+        },
+    ],
+    [
+        "no_matching_worktree_signals",
+        {
+            classification: "permanent",
+            note: "uploaded with the outside-roots label (root_scope outside)",
+        },
+    ],
     [
         "cwd_not_a_repo",
         {

package/dist/commands/backfill-scan.js

@@ -17,6 +17,7 @@ import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-e
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { candidateCursorKey, compareBackfillCandidates, isAfterCursor, } from "./backfill-candidates.js";
 import { addReadOnlyGuardIssues, addRepoDiscoveryIssues, backfillScanIssues, countReadOnlyGuards, deterministicSkipCandidateKeys, oversizedBackfillCandidateKeys, retryableCandidateKeys, sortScanIssuesByPriority, } from "./backfill-issues.js";
+import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
@@ -117,20 +118,24 @@ async function scanBackfillSessions(options) {
         pointerlessTerminalSessions: options.pointerlessTerminalSessions,
         maxFiles: options.command.maxFiles,
     });
+    // BLI-11091: a session outside every approved root is labelled, not
+    // refused. It rides the synthetic outside-roots workspace from here on, so
+    // batching, retry, cursor and report treat it like any other upload.
+    const candidates = labelOutsideRootCandidates(selection.candidates, outsideRootsWorkspace(options.command.homeDir));
     const issues = await backfillScanIssues({
         codexAttribution,
         claudeAttribution,
         codexSessionDirs,
         claudeProjectsDir,
-        candidates: selection.candidates,
+        candidates,
         omittedCandidateCount: selection.omittedCandidateCount,
     });
     return {
-        candidates: selection.candidates,
+        candidates,
         codexAttribution,
         claudeAttribution,
         issues,
-        retryable_candidate_keys: retryableCandidateKeys(selection.candidates),
+        retryable_candidate_keys: retryableCandidateKeys(candidates),
         omitted_candidate_count: selection.omittedCandidateCount,
     };
 }

package/dist/commands/backfill-scope.js

@@ -44,10 +44,23 @@ export async function resolveBackfillScope(command, io, now, paths) {
         collectionRoots,
         worktreeDiscovery,
         retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: selectedSources(command.source),
+        sources: honourClaudeOptOut(selectedSources(command.source), config.collect_claude_jsonl),
         window,
     };
 }
+/**
+ * Session-first (BLI-11091): now that outside-root sessions upload, an
+ * explicit operator opt-out is the only thing that withholds one. The
+ * per-machine Claude opt-out (`collect_claude_jsonl: false`) the scheduled
+ * sync already honours (`session-sync-plan.ts`) therefore holds here too:
+ * backfill never reads the Claude store on a machine that said no.
+ */
+function honourClaudeOptOut(sources, collectClaudeJsonl) {
+    if (collectClaudeJsonl !== false || !sources.includes("claude_code"))
+        return sources;
+    console.error("[backfill] claude source withheld by operator opt-out", JSON.stringify({ reason: "collect_claude_jsonl_false", sources_before: sources.length }));
+    return sources.filter((source) => source !== "claude_code");
+}
 function backfillCollectionRoots(command, savedRoots) {
     if (command.repoRoot)
         return [path.resolve(command.repoRoot)];

package/dist/commands/backfill-session-report.js

@@ -9,6 +9,7 @@
  */
 import { NO_UPLOAD_ATTEMPT_RECORDED, notUploadableAttributionStateReason, } from "@bli-cockpit/telemetry-core";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
 /**
  * One attribution row per session this run saw, uploaded or not — the only
  * record the server ever gets of a session the collector could not upload.
@@ -80,6 +81,8 @@ function sessionAttributionRow(candidate, uploads, now) {
         attribution_reason: candidate.reason,
         attribution_score: candidate.attribution_score,
         path_score: candidate.path_score,
+        // BLI-11091: the same inside/outside label the sync path writes (PR 1453).
+        root_scope: rootScopeForReason(candidate.reason),
         signals: candidate.signals,
         ...(candidate.content_hash_sha256
             ? { session_file_hash_sha256: candidate.content_hash_sha256 }

package/dist/commands/backfill-upload.js

@@ -5,6 +5,7 @@ import { buildBackfillBatches, uploadableCandidates, } from "./backfill-batches.
 import { candidateCursorKey } from "./backfill-candidates.js";
 import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandidateKeys, } from "./backfill-evidence-outcomes.js";
 import { blockingScanIssues } from "./backfill-issues.js";
+import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
@@ -58,6 +59,11 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
         });
     };
     reportProgress();
+    // BLI-11091: outside-root sessions upload under a synthetic workspace that
+    // only exists once something needs it (a dry run never gets here).
+    const outsideWorkspace = batches.find((batch) => isOutsideRootsWorkspace(batch.worktree))?.worktree;
+    if (outsideWorkspace)
+        await ensureOutsideRootsWorkspace(outsideWorkspace);
     for (const [index, batch] of batches.entries()) {
         await lock.handle.heartbeat();
         if (command.deadlineMs !== undefined && Date.now() >= command.deadlineMs) {

package/dist/commands/backfill.js

@@ -9,6 +9,7 @@
  *                                  stores into candidates; census the gaps
  *   PLAN    backfill-plan.ts       confirm `--all`, or answer a `--dry-run`
  *   UPLOAD  backfill-upload.ts     sync in batches under the shared lock
+ *                                  (backfill-lock-wait.ts waits for it)
  *   REPORT  backfill-report.ts     post, checkpoint, decide, assemble
  *
  * The supporting modules each own one thing the stages share:
@@ -18,6 +19,7 @@
  *   backfill-scope.ts              paired? which roots, sources and window
  *   backfill-candidates.ts         one session's identity and ordering
  *   backfill-batches.ts            what is uploadable, cut into batches
+ *   backfill-outside-roots.ts      outside-root sessions: a label, not a skip
  *   backfill-issues.ts             the ledger of what could not be accounted for
  *   backfill-reasons.ts            the skip-reason table an operator reads
  *   backfill-evidence-outcomes.ts  what one upload achieved per session
@@ -36,9 +38,9 @@
  */
 import { acquireBackfillLock } from "../backfill-lock.js";
 import { writeBackfillCursor } from "../cursors/backfill-cursor.js";
-import { acquireSyncLock } from "../sync-lock.js";
 import { DEFAULT_BACKFILL_SINCE_DAYS, backfillRetryCommand, defaultBackfillWindowNotice, } from "./backfill-command-line.js";
 import { isInteractiveStdin, writeHumanBackfillResult, writeLine, } from "./backfill-output.js";
+import { BACKFILL_SYNC_LOCK_WAIT_MS, acquireSyncLockWithWait, } from "./backfill-lock-wait.js";
 import { planBackfillRun } from "./backfill-plan.js";
 import { reportBackfillOutcome } from "./backfill-report.js";
 import { lockHeldResult } from "./backfill-result.js";
@@ -106,21 +108,25 @@ export async function runBackfill(command, io) {
             what: "backfill lock held",
         });
     }
-    let collectionLock;
+    // BLI-11091: the scheduled sync holds this lock most of the time an agent
+    // is working, so wait for it (bounded) instead of exiting at batch 0. Giving
+    // up is `sync_lock_held`, a blocked result and so a non-zero exit.
+    let waited;
     try {
-        collectionLock = await acquireSyncLock(paths);
+        waited = await acquireSyncLockWithWait(paths, command.syncLockWaitMs ?? BACKFILL_SYNC_LOCK_WAIT_MS);
     }
     catch (error) {
         await lock.handle.release();
         throw error;
     }
-    if (!collectionLock.acquired) {
+    if (!waited.acquired) {
         await lock.handle.release();
         return lockHeldResult(command, scanned, {
-            failureReason: "sync_already_running",
+            failureReason: "sync_lock_held",
             what: "sync collection lock held",
         });
     }
+    const collectionLock = waited.lock;
     try {
         // Backfill and scheduled/manual sync share upload spool and raw-evidence
         // cursors. Holding the same collection lock makes their read-modify-write