@bli-cockpit/cli 0.2.150 → 0.2.154

package/dist/adapters/local-sources.js

@@ -34,6 +34,7 @@ export async function runLocalSourceCollectors(options) {
             claudeSessionFiles: options.rawEvidenceClaudeSessionFiles,
             claudeAttributionScan: options.rawEvidenceClaudeAttributionScan,
             skipContentHashes: options.rawEvidenceSkipContentHashes,
+            priorSnapshots: options.rawEvidencePriorSnapshots,
             byteBudget: options.rawEvidenceByteBudget,
             objectBudget: options.rawEvidenceObjectBudget,
             budget: options.rawEvidenceBudget,

package/dist/adapters/raw-evidence-collection-state.js

@@ -73,6 +73,7 @@ export async function openCollection(context, options, places) {
         scanned: new Map(),
         caps: startingCaps({ byteBudget, objectBudget, budget: options.budget }),
         skipContentHashes: options.skipContentHashes ?? new Set(),
+        priorSnapshots: options.priorSnapshots ?? new Map(),
         budget: options.budget ?? {
             remainingBytes: byteBudget,
             remainingObjects: objectBudget,

package/dist/adapters/raw-evidence-facts.js

@@ -268,6 +268,7 @@ function uploadFileFromEntry(entry) {
         ...(entry.artifact_metadata
             ? { artifact_metadata: entry.artifact_metadata }
             : {}),
+        ...(entry.snapshot ? { source_key: entry.source_key, snapshot: entry.snapshot } : {}),
     };
 }
 function stageReasonLabel(state, priorPackCount) {

package/dist/adapters/raw-evidence-manifest.js

@@ -24,6 +24,8 @@ export function evidenceEntry(options) {
         codex_session_id: options.codexSessionId ?? null,
         staged_in_pack: options.stagedInPack !== false,
         source_key: options.sourceKey ?? null,
+        ...(options.snapshot ? { snapshot: options.snapshot } : {}),
+        ...(options.supersedes ? { supersedes: options.supersedes } : {}),
         ...(options.artifactMetadata
             ? {
                 artifact_metadata: {
@@ -54,6 +56,9 @@ export function pointerFromEntry(entry) {
         media_type: entry.media_type,
         redacted_summary: entry.redacted_summary,
         ...(entry.redaction ? { redaction: entry.redaction } : {}),
+        ...(entry.supersedes
+            ? { supersedes_pointer_id: entry.supersedes.pointer_id, supersede_rule: entry.supersedes.rule }
+            : {}),
     };
 }
 export function makeManifest(options) {

package/dist/adapters/raw-evidence-sanitize.js

@@ -4,11 +4,13 @@ import { describeError } from "../health-detail.js";
 /** BLI-3238: a crashed redactor has to say so; see the catch below. */
 export function sanitizeTextEvidenceForUpload(options) {
     const originalBytes = options.originalBytes ?? Buffer.from(options.text, "utf8");
-    // Deliberately outside the try: the content guard is the cheap check that
-    // decides which masking strategy applies, and it is not the thing whose
-    // crash the stub below is for.
-    const secretLikeContent = containsSecretLikeContent(options.text);
     try {
+        // BLI-11094: inside the try. The content guard decides which masking
+        // strategy applies; it used to sit outside on the theory that it cannot
+        // crash, but it runs regexes over the whole file, and a throw from here
+        // escaped this function entirely, which is the one outcome the header
+        // promises never happens. A crash anywhere now lands on the stub.
+        const secretLikeContent = containsSecretLikeContent(options.text);
         const redactionResult = (options.redact ?? redactSecretLikeContent)(options.text, {
             appliedBy: "local_collector",
             redactedFields: options.redactedFields,
@@ -140,28 +142,88 @@ function stubForCrashedRedaction(input) {
         completenessLabel: "redaction_crashed_stubbed",
     };
 }
+/**
+ * Replace every line a redacted range touches, keep every other line as is.
+ *
+ * BLI-11094: this used to split the whole file with
+ * `text.match(/[^\n]*(?:\n|$)/gu)`. With the `u` flag V8 cannot run `[^\n]*`
+ * as a flat loop (a code point may be two UTF-16 units), so it pushes one
+ * backtrack entry per character, and a single line of about 10 million
+ * characters in a two-byte string (a Codex tool output: every crashing file on
+ * Edward's Mac had a 12 to 14 MB line) threw `RangeError: Maximum call stack
+ * size exceeded`. The catch above then uploaded a stub instead of the session.
+ *
+ * Now the lines are found with `indexOf("\n")`, which has no stack at all, and
+ * the output is the untouched text between masked lines, so the cost is one
+ * pass plus the number of ranges, whatever the longest line. The contract is
+ * unchanged and byte-identical (pinned by
+ * `raw-evidence-sanitize-legacy.test.ts`): a segment ends after each `\n`,
+ * offsets are UTF-16 and file-absolute, and a line takes the rule of the FIRST
+ * range in array order that overlaps it.
+ */
 function maskSecretBearingLines(text, redaction) {
     if (redaction.redacted_ranges.length === 0) {
         return "[REDACTED_LINE:secret_like_content_guard]\n";
     }
-    const segments = text.match(/[^\n]*(?:\n|$)/gu)?.filter(Boolean) ?? [];
-    let offset = 0;
-    return segments
-        .map((segment) => {
-        const start = offset;
-        const end = offset + segment.length;
-        offset = end;
-        const matched = redaction.redacted_ranges.find((range) => range.start < end && start < range.end);
-        if (!matched)
-            return segment;
-        return `[REDACTED_LINE:${matched.rule_id}]${lineEndingOf(segment)}`;
-    })
-        .join("");
+    const lineStarts = lineStartOffsets(text);
+    const ruleByLine = new Map();
+    for (const range of redaction.redacted_ranges) {
+        let line = firstLineEndingAfter(lineStarts, text.length, range.start);
+        for (; line < lineStarts.length; line += 1) {
+            const start = lineStarts[line];
+            const end = lineEndOf(lineStarts, text.length, line);
+            if (start >= range.end)
+                break;
+            if (range.start < end && start < range.end && !ruleByLine.has(line)) {
+                ruleByLine.set(line, range.rule_id);
+            }
+        }
+    }
+    const maskedLines = [...ruleByLine.keys()].sort((a, b) => a - b);
+    const pieces = [];
+    let cursor = 0;
+    for (const line of maskedLines) {
+        const start = lineStarts[line];
+        const end = lineEndOf(lineStarts, text.length, line);
+        pieces.push(text.slice(cursor, start));
+        pieces.push(`[REDACTED_LINE:${ruleByLine.get(line)}]${lineEndingOf(text, start, end)}`);
+        cursor = end;
+    }
+    pieces.push(text.slice(cursor));
+    return pieces.join("");
 }
-function lineEndingOf(segment) {
-    if (segment.endsWith("\r\n"))
+/** Where each non-empty segment starts; a segment ends just after its `\n`. */
+function lineStartOffsets(text) {
+    const starts = [];
+    let position = 0;
+    while (position < text.length) {
+        starts.push(position);
+        const newline = text.indexOf("\n", position);
+        position = newline === -1 ? text.length : newline + 1;
+    }
+    return starts;
+}
+function lineEndOf(lineStarts, textLength, line) {
+    return lineStarts[line + 1] ?? textLength;
+}
+/** Index of the first line whose end is past `offset` (binary search). */
+function firstLineEndingAfter(lineStarts, textLength, offset) {
+    let low = 0;
+    let high = lineStarts.length;
+    while (low < high) {
+        const middle = (low + high) >>> 1;
+        if (lineEndOf(lineStarts, textLength, middle) > offset)
+            high = middle;
+        else
+            low = middle + 1;
+    }
+    return low;
+}
+function lineEndingOf(text, start, end) {
+    if (end - start >= 2 && text[end - 2] === "\r" && text[end - 1] === "\n") {
         return "\r\n";
-    if (segment.endsWith("\n"))
+    }
+    if (end - start >= 1 && text[end - 1] === "\n")
         return "\n";
     return "";
 }

package/dist/adapters/raw-evidence-snapshot-supersede.js

@@ -0,0 +1,82 @@
+/**
+ * Does this transcript snapshot hold every byte of the last one we committed
+ * for the same file (BLI-11088)?
+ *
+ * Every sync stages the current bytes of every live transcript, so a file that
+ * grew lands as a new object beside the old one. When the last committed
+ * snapshot is a byte prefix of the new bytes, the upload carries a CLAIM
+ * (`supersedes_pointer_id` + `supersede_rule: "prefix"`) and the ingest door,
+ * after re-deriving it from Storage, deletes the old object. The rule is
+ * defined once in `@bli-cockpit/telemetry-core/snapshot-supersede`.
+ *
+ * The collector never keeps old bytes. What it remembers about a committed
+ * snapshot lives in the primary cursor's `objects` map (content hash, size,
+ * source key, truncated prefix checkpoints), and that is all the decision
+ * reads. Comparing with the snapshot committed LAST is also what makes a
+ * one-time history rewrite harmless: the first snapshot after it keeps both,
+ * and every later one is a prefix of its predecessor again.
+ *
+ * A snapshot that is not a prefix successor is uploaded exactly as before, and
+ * says so: `snapshot_rewritten`, both sizes, and the byte range the first
+ * difference falls in. Never content.
+ */
+import { firstDifferenceRange, isPrefixSuccessor, prefixCheckpoints, } from "@bli-cockpit/telemetry-core/snapshot-supersede";
+/**
+ * The newest committed snapshot per source key, from the cursor's objects map,
+ * restricted to objects this work context owns (the server refuses a claim
+ * across work sessions, so a claim across contexts would only be refused).
+ */
+export function priorSnapshotsFromCursor(objects, belongsToContext) {
+    const out = new Map();
+    for (const [contentHash, entry] of Object.entries(objects)) {
+        if (!entry.source_key || !belongsToContext(entry.object_key))
+            continue;
+        const current = out.get(entry.source_key);
+        const newer = !current
+            || entry.committed_at > current.committed_at
+            || (entry.committed_at === current.committed_at && entry.byte_size > current.byte_size);
+        if (!newer)
+            continue;
+        out.set(entry.source_key, {
+            raw_evidence_pointer_id: entry.object_key,
+            content_hash_sha256: contentHash,
+            byte_size: entry.byte_size,
+            checkpoints: entry.checkpoints ?? null,
+            committed_at: entry.committed_at,
+        });
+    }
+    return out;
+}
+export function describeSnapshot(bytes) {
+    return { checkpoints: prefixCheckpoints(bytes) };
+}
+/**
+ * The claim this snapshot may make, or null. Logs every decision that had a
+ * prior to compare against; a source seen for the first time has nothing to
+ * decide and says nothing.
+ */
+export function supersedeClaimFor(options) {
+    const { prior } = options;
+    if (!prior || prior.content_hash_sha256 === options.contentHash)
+        return null;
+    if (isPrefixSuccessor(options.bytes, prior)) {
+        console.error("[evidence-upload] snapshot supersedes the previous one", JSON.stringify({
+            reason: "snapshot_supersede_claimed",
+            rule: "prefix",
+            kind: options.kind,
+            previous_byte_size: prior.byte_size,
+            byte_size: options.bytes.byteLength,
+        }));
+        return { pointer_id: prior.raw_evidence_pointer_id, rule: "prefix" };
+    }
+    const range = firstDifferenceRange(options.bytes, prior);
+    console.error("[evidence-upload] snapshot rewritten, keeping both", JSON.stringify({
+        reason: "snapshot_rewritten",
+        kind: options.kind,
+        previous_byte_size: prior.byte_size,
+        byte_size: options.bytes.byteLength,
+        first_differing_offset_at_least: range.at_least,
+        first_differing_offset_below: range.below,
+    }));
+    return null;
+}

package/dist/adapters/raw-evidence-transcript-file.js

@@ -19,6 +19,7 @@ import { isSecretLikePath, sha256, shortHash, } from "./raw-evidence-keys.js";
 import { maskSecretsInTranscript, } from "./raw-evidence-sanitize.js";
 import { markBudgetCapApplied, markCapApplied, } from "./raw-evidence-completeness.js";
 import { evidenceEntry } from "./raw-evidence-manifest.js";
+import { describeSnapshot, supersedeClaimFor } from "./raw-evidence-snapshot-supersede.js";
 import { admitToBudget, stageEvidenceBytes, } from "./raw-evidence-collection-state.js";
 /**
  * Reads, secret-guards, content-addresses, budget-checks, and copies one
@@ -135,6 +136,15 @@ async function stageOneTranscript(collection, file) {
         contentAddress: file.contentAddress(file.contentHash.slice(0, 16)),
         stagedInPack: staged.staged_in_pack,
         sourceKey: file.names.sourceKey,
+        // BLI-11088: remember this snapshot's shape, and claim the last one when
+        // these bytes rebuild it.
+        snapshot: describeSnapshot(file.sanitized.bytes),
+        supersedes: supersedeClaimFor({
+            bytes: file.sanitized.bytes,
+            contentHash: file.contentHash,
+            kind: file.kind,
+            prior: collection.priorSnapshots.get(file.names.sourceKey),
+        }),
     }));
 }
 /**

package/dist/agent-rules.js

@@ -61,11 +61,11 @@ async function installAgentRulesForHost(host, options = {}, hostsInCall = [host]
 }
 async function foldClaudeIntoCodexInclude(host, rulesFile, existing, block) {
     if (!hasManagedBlock(existing)) {
-        console.info("[agent-rules] claude rules already covered by codex include, skipping duplicate write", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+        console.error("[agent-rules] claude rules already covered by codex include, skipping duplicate write", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
         return agentRulesResult(host, rulesFile, "unchanged", block, "included");
     }
     await writeFile(rulesFile, removeManagedBlock(existing), "utf8");
-    console.info("[agent-rules] removed a duplicate managed block now covered by the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+    console.error("[agent-rules] removed a duplicate managed block now covered by the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
     return agentRulesResult(host, rulesFile, "updated", block, "included");
 }
 export async function uninstallCodexAgentRules(options = {}) {
@@ -147,7 +147,7 @@ async function inspectAgentRulesForHost(host, options = {}, hostsInCall = [host]
         };
     }
     if (claudeFoldsIntoCodexInclude(host, hostsInCall, existing, homeDir)) {
-        console.info("[agent-rules] claude rules read as installed via the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
+        console.error("[agent-rules] claude rules read as installed via the codex include", JSON.stringify({ reason: "claude_includes_codex_agents_file", host }));
         return {
             ...agentRulesResult(host, rulesFile, "unchanged", block, "included"),
             installed: true,

package/dist/commands/backfill-lock-wait.js

@@ -0,0 +1,49 @@
+import { acquireSyncLock, inspectSyncLock, } from "../sync-lock.js";
+export const BACKFILL_SYNC_LOCK_WAIT_MS = 10 * 60_000;
+const LOG_EVERY_MS = 30_000;
+const POLL_EVERY_MS = 1_000;
+const DEFAULT_DEPS = {
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    acquire: acquireSyncLock,
+    inspect: inspectSyncLock,
+};
+/**
+ * Acquire the collection lock, waiting up to `waitMs`. `waitMs <= 0` tries
+ * exactly once (the caller has its own wait, as doctor does).
+ */
+export async function acquireSyncLockWithWait(paths, waitMs = BACKFILL_SYNC_LOCK_WAIT_MS, deps = DEFAULT_DEPS) {
+    const started = deps.now();
+    let nextLogAt = started;
+    for (;;) {
+        const attempt = await deps.acquire(paths, new Date(deps.now()));
+        const waited = deps.now() - started;
+        if (attempt.acquired) {
+            if (waited > 0) {
+                console.error("[backfill] collection lock acquired after waiting", JSON.stringify({ waited_ms: waited }));
+            }
+            return { acquired: true, lock: attempt, waited_ms: waited };
+        }
+        if (waited >= waitMs) {
+            const holder = await holderFields(paths, deps);
+            console.error("[backfill] gave up waiting for collection lock", JSON.stringify({ reason: "sync_lock_held", waited_ms: waited, limit_ms: waitMs, ...holder }));
+            return { acquired: false, waited_ms: waited };
+        }
+        if (deps.now() >= nextLogAt) {
+            const holder = await holderFields(paths, deps);
+            console.error("[backfill] waiting for collection lock", JSON.stringify({ waited_ms: waited, limit_ms: waitMs, ...holder }));
+            nextLogAt += LOG_EVERY_MS;
+        }
+        await deps.sleep(Math.min(POLL_EVERY_MS, waitMs - waited));
+    }
+}
+/** Who holds the lock and how stale its heartbeat is: a pid and milliseconds, nothing else. */
+async function holderFields(paths, deps) {
+    const owner = await deps.inspect(paths);
+    const heartbeatMs = owner ? Date.parse(owner.heartbeat_at) : Number.NaN;
+    return {
+        holder: "sync",
+        holder_pid: owner && owner.pid > 0 ? owner.pid : null,
+        heartbeat_age_ms: Number.isFinite(heartbeatMs) ? Math.max(0, deps.now() - heartbeatMs) : null,
+    };
+}

package/dist/commands/backfill-outside-roots.js

@@ -0,0 +1,97 @@
+/**
+ * BLI-11091: roots are labels on the backfill path too.
+ *
+ * Edward's ruling of 2026-09-17 (ticket 10734) made approved collection roots a
+ * LABEL on the upload, never a gate; PR 1453 carried it through the scheduled
+ * sync. The backfill planner still refused every session whose cwd sat outside
+ * the scanned roots (`cwd_outside_scanned_worktrees`): measured on the
+ * reference Mac, 901 of 1,513 Codex sessions, many of them the only full copy
+ * of that history.
+ *
+ * This module is the one place that closes that gap. A candidate whose
+ * attribution reason is one of the "outside every approved root" reasons (the
+ * SAME closed set `rootScopeForReason` reads, so one vocabulary) and which has
+ * no worktree gets the synthetic `outside-approved-root` workspace the sync
+ * path already uses for its report identity. Its attribution state and reason
+ * are left untouched: the workspace is transport identity only, never a claim
+ * that the session belongs to any repo. The upload itself runs through the
+ * ordinary sync envelope, so redaction applies exactly as it does to an
+ * inside-root session, and the explicit Claude opt-out
+ * (`collect_claude_jsonl: false`) is honoured before any store is read
+ * (`backfill-scope.ts`).
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { repoFingerprintFromLocalRoot, stableWorktreeFingerprint, } from "../repo-identity.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
+/**
+ * The label the sync path writes for a report with no real worktree
+ * (`session-sync-record.ts`). Reused verbatim: one label, not a second one.
+ */
+export const OUTSIDE_ROOTS_WORKSPACE_LABEL = "outside-approved-root";
+/**
+ * The synthetic workspace an outside-root session uploads under. It lives in
+ * the collector's own state directory, so it is always a real, owner-only,
+ * empty folder the envelope builder can stand in, on macOS and Windows alike,
+ * and never a directory of the operator's that git or any source collector
+ * would read.
+ */
+export function outsideRootsWorkspace(homeDir) {
+    const root = path.resolve(getCollectorRuntimePaths(homeDir).state_dir, OUTSIDE_ROOTS_WORKSPACE_LABEL);
+    return {
+        requested_path: root,
+        repo_root: root,
+        repo_label: OUTSIDE_ROOTS_WORKSPACE_LABEL,
+        repo_fingerprint: repoFingerprintFromLocalRoot(root),
+        repo_origin_url: null,
+        branch: "unknown",
+        head_sha: null,
+        worktree_label: OUTSIDE_ROOTS_WORKSPACE_LABEL,
+        worktree_fingerprint: stableWorktreeFingerprint(root),
+        worktree_is_primary: true,
+    };
+}
+/** Does this candidate sit outside every approved root, by its own attribution reason? */
+export function isOutsideRootCandidate(candidate) {
+    return rootScopeForReason(candidate.reason) === "outside";
+}
+/**
+ * Attaches the outside-roots workspace to every outside-root candidate that
+ * has no worktree, and says how many it labelled. A candidate that already has
+ * a worktree keeps it; nothing else about any candidate changes.
+ */
+export function labelOutsideRootCandidates(candidates, workspace) {
+    let codex = 0;
+    let claude = 0;
+    const labelled = candidates.map((candidate) => {
+        if (candidate.worktree || !isOutsideRootCandidate(candidate))
+            return candidate;
+        if (candidate.source === "codex")
+            codex += 1;
+        else
+            claude += 1;
+        return { ...candidate, worktree: workspace };
+    });
+    console.error("[backfill] outside-root sessions labelled for upload", JSON.stringify({
+        root_scope: "outside",
+        count: codex + claude,
+        codex_count: codex,
+        claude_count: claude,
+        candidate_count: candidates.length,
+    }));
+    return labelled;
+}
+/** Is this worktree the synthetic outside-roots workspace (and not a real repo)? */
+export function isOutsideRootsWorkspace(worktree) {
+    return (worktree.repo_label === OUTSIDE_ROOTS_WORKSPACE_LABEL &&
+        path.basename(worktree.repo_root) === OUTSIDE_ROOTS_WORKSPACE_LABEL);
+}
+/**
+ * Creates the synthetic workspace folder before the first upload that needs
+ * it. Only the UPLOAD stage calls this, so a `--dry-run` still writes nothing.
+ */
+export async function ensureOutsideRootsWorkspace(worktree) {
+    await fs.mkdir(worktree.repo_root, { recursive: true, mode: 0o700 });
+    console.error("[backfill] outside-roots workspace ready", JSON.stringify({ repo_label: worktree.repo_label, worktree_fingerprint: worktree.worktree_fingerprint }));
+}

package/dist/commands/backfill-reasons.js

@@ -58,6 +58,23 @@ const REASON_VERDICTS = new Map([
         "repo_not_on_disk",
         { classification: "retryable", note: "repo must exist on disk" },
     ],
+    // BLI-11091: roots are a label, never a gate. These two sessions upload
+    // under the outside-roots workspace with `root_scope: "outside"`; the row
+    // says so instead of calling them skipped.
+    [
+        "cwd_outside_scanned_worktrees",
+        {
+            classification: "permanent",
+            note: "uploaded with the outside-roots label (root_scope outside)",
+        },
+    ],
+    [
+        "no_matching_worktree_signals",
+        {
+            classification: "permanent",
+            note: "uploaded with the outside-roots label (root_scope outside)",
+        },
+    ],
     [
         "cwd_not_a_repo",
         {

package/dist/commands/backfill-scan.js

@@ -17,6 +17,7 @@ import { CLAUDE_CURSOR_FILENAME, readRawEvidenceCursor, } from "../cursors/raw-e
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { candidateCursorKey, compareBackfillCandidates, isAfterCursor, } from "./backfill-candidates.js";
 import { addReadOnlyGuardIssues, addRepoDiscoveryIssues, backfillScanIssues, countReadOnlyGuards, deterministicSkipCandidateKeys, oversizedBackfillCandidateKeys, retryableCandidateKeys, sortScanIssuesByPriority, } from "./backfill-issues.js";
+import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
@@ -117,20 +118,24 @@ async function scanBackfillSessions(options) {
         pointerlessTerminalSessions: options.pointerlessTerminalSessions,
         maxFiles: options.command.maxFiles,
     });
+    // BLI-11091: a session outside every approved root is labelled, not
+    // refused. It rides the synthetic outside-roots workspace from here on, so
+    // batching, retry, cursor and report treat it like any other upload.
+    const candidates = labelOutsideRootCandidates(selection.candidates, outsideRootsWorkspace(options.command.homeDir));
     const issues = await backfillScanIssues({
         codexAttribution,
         claudeAttribution,
         codexSessionDirs,
         claudeProjectsDir,
-        candidates: selection.candidates,
+        candidates,
         omittedCandidateCount: selection.omittedCandidateCount,
     });
     return {
-        candidates: selection.candidates,
+        candidates,
         codexAttribution,
         claudeAttribution,
         issues,
-        retryable_candidate_keys: retryableCandidateKeys(selection.candidates),
+        retryable_candidate_keys: retryableCandidateKeys(candidates),
         omitted_candidate_count: selection.omittedCandidateCount,
     };
 }

package/dist/commands/backfill-scope.js

@@ -44,10 +44,23 @@ export async function resolveBackfillScope(command, io, now, paths) {
         collectionRoots,
         worktreeDiscovery,
         retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: selectedSources(command.source),
+        sources: honourClaudeOptOut(selectedSources(command.source), config.collect_claude_jsonl),
         window,
     };
 }
+/**
+ * Session-first (BLI-11091): now that outside-root sessions upload, an
+ * explicit operator opt-out is the only thing that withholds one. The
+ * per-machine Claude opt-out (`collect_claude_jsonl: false`) the scheduled
+ * sync already honours (`session-sync-plan.ts`) therefore holds here too:
+ * backfill never reads the Claude store on a machine that said no.
+ */
+function honourClaudeOptOut(sources, collectClaudeJsonl) {
+    if (collectClaudeJsonl !== false || !sources.includes("claude_code"))
+        return sources;
+    console.error("[backfill] claude source withheld by operator opt-out", JSON.stringify({ reason: "collect_claude_jsonl_false", sources_before: sources.length }));
+    return sources.filter((source) => source !== "claude_code");
+}
 function backfillCollectionRoots(command, savedRoots) {
     if (command.repoRoot)
         return [path.resolve(command.repoRoot)];

package/dist/commands/backfill-session-report.js

@@ -9,6 +9,7 @@
  */
 import { NO_UPLOAD_ATTEMPT_RECORDED, notUploadableAttributionStateReason, } from "@bli-cockpit/telemetry-core";
 import { isRawEvidenceUploadableAttributionState } from "../raw-evidence-attribution-policy.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
 /**
  * One attribution row per session this run saw, uploaded or not — the only
  * record the server ever gets of a session the collector could not upload.
@@ -80,6 +81,8 @@ function sessionAttributionRow(candidate, uploads, now) {
         attribution_reason: candidate.reason,
         attribution_score: candidate.attribution_score,
         path_score: candidate.path_score,
+        // BLI-11091: the same inside/outside label the sync path writes (PR 1453).
+        root_scope: rootScopeForReason(candidate.reason),
         signals: candidate.signals,
         ...(candidate.content_hash_sha256
             ? { session_file_hash_sha256: candidate.content_hash_sha256 }

package/dist/commands/backfill-upload.js

@@ -5,6 +5,7 @@ import { buildBackfillBatches, uploadableCandidates, } from "./backfill-batches.
 import { candidateCursorKey } from "./backfill-candidates.js";
 import { countSessionUploadFailures, deferredEvidenceCount, durableBackfillCandidateKeys, } from "./backfill-evidence-outcomes.js";
 import { blockingScanIssues } from "./backfill-issues.js";
+import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, } from "./backfill-outside-roots.js";
 import { writeLine } from "./backfill-output.js";
 const BACKFILL_MAX_CONSECUTIVE_FAILURES = 3;
 /**
@@ -58,6 +59,11 @@ export async function uploadBackfillBatches(command, io, lock, ctx) {
         });
     };
     reportProgress();
+    // BLI-11091: outside-root sessions upload under a synthetic workspace that
+    // only exists once something needs it (a dry run never gets here).
+    const outsideWorkspace = batches.find((batch) => isOutsideRootsWorkspace(batch.worktree))?.worktree;
+    if (outsideWorkspace)
+        await ensureOutsideRootsWorkspace(outsideWorkspace);
     for (const [index, batch] of batches.entries()) {
         await lock.handle.heartbeat();
         if (command.deadlineMs !== undefined && Date.now() >= command.deadlineMs) {

package/dist/commands/backfill.js

@@ -9,6 +9,7 @@
  *                                  stores into candidates; census the gaps
  *   PLAN    backfill-plan.ts       confirm `--all`, or answer a `--dry-run`
  *   UPLOAD  backfill-upload.ts     sync in batches under the shared lock
+ *                                  (backfill-lock-wait.ts waits for it)
  *   REPORT  backfill-report.ts     post, checkpoint, decide, assemble
  *
  * The supporting modules each own one thing the stages share:
@@ -18,6 +19,7 @@
  *   backfill-scope.ts              paired? which roots, sources and window
  *   backfill-candidates.ts         one session's identity and ordering
  *   backfill-batches.ts            what is uploadable, cut into batches
+ *   backfill-outside-roots.ts      outside-root sessions: a label, not a skip
  *   backfill-issues.ts             the ledger of what could not be accounted for
  *   backfill-reasons.ts            the skip-reason table an operator reads
  *   backfill-evidence-outcomes.ts  what one upload achieved per session
@@ -36,9 +38,9 @@
  */
 import { acquireBackfillLock } from "../backfill-lock.js";
 import { writeBackfillCursor } from "../cursors/backfill-cursor.js";
-import { acquireSyncLock } from "../sync-lock.js";
 import { DEFAULT_BACKFILL_SINCE_DAYS, backfillRetryCommand, defaultBackfillWindowNotice, } from "./backfill-command-line.js";
 import { isInteractiveStdin, writeHumanBackfillResult, writeLine, } from "./backfill-output.js";
+import { BACKFILL_SYNC_LOCK_WAIT_MS, acquireSyncLockWithWait, } from "./backfill-lock-wait.js";
 import { planBackfillRun } from "./backfill-plan.js";
 import { reportBackfillOutcome } from "./backfill-report.js";
 import { lockHeldResult } from "./backfill-result.js";
@@ -106,21 +108,25 @@ export async function runBackfill(command, io) {
             what: "backfill lock held",
         });
     }
-    let collectionLock;
+    // BLI-11091: the scheduled sync holds this lock most of the time an agent
+    // is working, so wait for it (bounded) instead of exiting at batch 0. Giving
+    // up is `sync_lock_held`, a blocked result and so a non-zero exit.
+    let waited;
     try {
-        collectionLock = await acquireSyncLock(paths);
+        waited = await acquireSyncLockWithWait(paths, command.syncLockWaitMs ?? BACKFILL_SYNC_LOCK_WAIT_MS);
     }
     catch (error) {
         await lock.handle.release();
         throw error;
     }
-    if (!collectionLock.acquired) {
+    if (!waited.acquired) {
         await lock.handle.release();
         return lockHeldResult(command, scanned, {
-            failureReason: "sync_already_running",
+            failureReason: "sync_lock_held",
             what: "sync collection lock held",
         });
     }
+    const collectionLock = waited.lock;
     try {
         // Backfill and scheduled/manual sync share upload spool and raw-evidence
         // cursors. Holding the same collection lock makes their read-modify-write

package/dist/commands/doctor-budget.js

@@ -0,0 +1,69 @@
+/**
+ * BLI-11101: `cockpit doctor --json` answers within one bounded budget.
+ *
+ * A person at a terminal gets the long defaults (a 900-second catch-up and a
+ * 600-second wait for the collection lock) with progress every 30 seconds. An
+ * agent or script calling `--json` gets one answer: on Edward's Mac the long
+ * defaults ran past 9.5 minutes behind the 15-minute scheduled sync, and a
+ * caller that times out learns nothing. So `--json` without `--lock-wait` or
+ * `--backfill-budget` runs every repair under one deadline measured from the
+ * start of the run, and a repair that does not fit says so by name instead of
+ * queueing. Passing either flag opts back into the long run.
+ */
+export const DOCTOR_JSON_BUDGET_SECONDS = 45;
+export const DEFAULT_LOCK_WAIT_SECONDS = 600;
+export const DEFAULT_BACKFILL_BUDGET_SECONDS = 900;
+/** A repair that execs a whole sync or catch-up chunk is not started with less than this left. */
+export const SLOW_FIX_MIN_SECONDS = {
+    "backfill-complete": 10,
+    "sync-fresh": 15,
+};
+/** The run deadline in epoch ms, or `null` when the caller gets the long defaults. */
+export function doctorRunDeadline(command, startedMs) {
+    if (!command.json)
+        return null;
+    if (command.lockWaitSeconds !== undefined || command.backfillBudgetSeconds !== undefined)
+        return null;
+    return startedMs + DOCTOR_JSON_BUDGET_SECONDS * 1000;
+}
+function remainingSeconds(context, now) {
+    if (context.deadlineMs === undefined || context.deadlineMs === null)
+        return null;
+    return Math.max(0, (context.deadlineMs - now) / 1000);
+}
+/** How long a repair may wait for the collection lock. */
+export function doctorLockWaitSeconds(context, now = Date.now()) {
+    if (context.command.lockWaitSeconds !== undefined)
+        return context.command.lockWaitSeconds;
+    const remaining = remainingSeconds(context, now);
+    return remaining === null ? DEFAULT_LOCK_WAIT_SECONDS : Math.min(DEFAULT_LOCK_WAIT_SECONDS, remaining);
+}
+/** How long the catch-up repair may run, lock waiting included. */
+export function doctorBackfillBudgetSeconds(context, now = Date.now()) {
+    if (context.command.backfillBudgetSeconds !== undefined)
+        return context.command.backfillBudgetSeconds;
+    const remaining = remainingSeconds(context, now);
+    return remaining === null ? DEFAULT_BACKFILL_BUDGET_SECONDS : Math.min(DEFAULT_BACKFILL_BUDGET_SECONDS, remaining);
+}
+/**
+ * The row a slow repair returns instead of starting when the run budget cannot
+ * hold it; `null` means go ahead. Logged either way the budget decides.
+ */
+export function budgetSpentRow(context, row, now = Date.now()) {
+    const floor = SLOW_FIX_MIN_SECONDS[row.id];
+    const remaining = remainingSeconds(context, now);
+    if (floor === undefined || remaining === null)
+        return null;
+    if (remaining >= floor) {
+        console.error("[doctor] repair fits the json budget", JSON.stringify({ row: row.id, remaining_seconds: Math.floor(remaining), floor_seconds: floor }));
+        return null;
+    }
+    console.error("[doctor] repair skipped, json budget spent", JSON.stringify({ reason: "doctor_budget_spent", row: row.id, remaining_seconds: Math.floor(remaining), floor_seconds: floor, budget_seconds: DOCTOR_JSON_BUDGET_SECONDS }));
+    return {
+        ...row,
+        status: "needs_fix",
+        code: "doctor_budget_spent",
+        nextAction: "cockpit doctor",
+        message: `\`cockpit doctor --json\` answers within ${DOCTOR_JSON_BUDGET_SECONDS}s and this repair needs at least ${floor}s; ${Math.floor(remaining)}s were left (was: ${row.code}). Run \`cockpit doctor\` to let it finish.`,
+    };
+}

package/dist/commands/doctor-lock-wait.js

@@ -1,12 +1,13 @@
 import { inspectBackfillLock } from "../backfill-lock.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { inspectSyncLock } from "../sync-lock.js";
-const BUSY = new Set(["sync_already_running", "backfill_already_running", "live_sync_paused_during_backfill"]);
+import { doctorLockWaitSeconds } from "./doctor-budget.js";
+const BUSY = new Set(["sync_already_running", "sync_lock_held", "backfill_already_running", "live_sync_paused_during_backfill"]);
 /** Retry the operation itself: its existing exclusive lock acquisition owns the
  * handoff. Merely observing a free lock never grants permission to collect. */
 export async function withDoctorLockWait(context, run, timing = { now: () => Date.now(), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) }) {
     const started = timing.now();
-    const limit = (context.command.lockWaitSeconds ?? 600) * 1000;
+    const limit = doctorLockWaitSeconds(context) * 1000;
     let nextProgress = 0;
     let row = await run();
     while (BUSY.has(row.code)) {
@@ -27,7 +28,15 @@ export async function withDoctorLockWait(context, run, timing = { now: () => Dat
                 if (result.code === 0 && result.stdout.trim())
                     name = result.stdout.trim().split("\n")[0] ?? name;
             }
-            return { ...row, status: "needs_fix", code: "lock_wait_timeout", nextAction: "cockpit doctor --lock-wait 600", message: `Waited ${Math.round(elapsed / 1000)}s for the collection lock; owner pid ${pid ?? "unknown"}, ${name}. Run \`cockpit doctor --lock-wait 600\`.` };
+            // BLI-11101: the scheduled sync holding the lock is not a fault; it is
+            // doing the upload this row would prove. Say so by name.
+            const syncOwns = !backfill.held && Boolean(sync?.held);
+            const code = syncOwns ? "sync_running" : "lock_wait_timeout";
+            console.error(`[doctor] ${row.id} lock wait ended`, JSON.stringify({ reason: code, owner_pid: pid ?? null, waited_seconds: Math.round(elapsed / 1000), limit_seconds: Math.round(limit / 1000) }));
+            const message = syncOwns
+                ? `The background sync (pid ${pid ?? "unknown"}, ${name}) is running and holds the collection lock; waited ${Math.round(elapsed / 1000)}s. Run \`cockpit doctor\` after it finishes, or \`cockpit doctor --lock-wait 600\` to wait for it.`
+                : `Waited ${Math.round(elapsed / 1000)}s for the collection lock; owner pid ${pid ?? "unknown"}, ${name}. Run \`cockpit doctor --lock-wait 600\`.`;
+            return { ...row, status: "needs_fix", code, nextAction: "cockpit doctor --lock-wait 600", message };
         }
         if (elapsed >= nextProgress) {
             const seconds = Math.floor(elapsed / 1000);

package/dist/commands/doctor-pipeline-verdicts.js

@@ -43,6 +43,8 @@ const COLLECTION_BUSY_REASONS = new Set([
     "live_sync_paused_during_backfill",
     // `cockpit backfill` stood aside for another backfill.
     "backfill_already_running",
+    // `cockpit backfill` waited for the collection lock and gave up (BLI-11091).
+    "sync_lock_held",
 ]);
 export function isCollectionBusyReason(reason) {
     return typeof reason === "string" && COLLECTION_BUSY_REASONS.has(reason);

package/dist/commands/doctor-pipeline.js

@@ -1,4 +1,5 @@
 import { withDoctorLockWait } from "./doctor-lock-wait.js";
+import { doctorBackfillBudgetSeconds, doctorLockWaitSeconds } from "./doctor-budget.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { inspectBackfillLock } from "../backfill-lock.js";
@@ -48,7 +49,7 @@ export async function checkBackfillState(context) {
 }
 export async function fixBackfillState(context) {
     const started = Date.now();
-    const deadline = started + (context.command.backfillBudgetSeconds ?? 900) * 1000;
+    const deadline = started + doctorBackfillBudgetSeconds(context, started) * 1000;
     let caughtUp = 0;
     let chunks = 0;
     let live = null;
@@ -79,7 +80,7 @@ export async function fixBackfillState(context) {
             // Every chunk reacquires the collector's locks. Bound lock waiting by
             // the overall budget too; never abandon an in-flight cursor write.
             const chunkContext = { ...context, command: { ...context.command,
-                    lockWaitSeconds: Math.min(context.command.lockWaitSeconds ?? 600, (deadline - Date.now()) / 1000),
+                    lockWaitSeconds: Math.min(doctorLockWaitSeconds(context), (deadline - Date.now()) / 1000),
                 } };
             const row = await withDoctorLockWait(chunkContext, async () => {
                 if (Date.now() >= deadline)
@@ -91,6 +92,8 @@ export async function fixBackfillState(context) {
                     homeDir: context.command.homeDir, repoRoot: context.command.repoRoot,
                     all: true, dryRun: false, yes: true, json: true,
                     deadlineMs: deadline,
+                    // Doctor's own `withDoctorLockWait` owns the waiting (BLI-11091).
+                    syncLockWaitMs: 0,
                     onProgress: (progress) => { live = progress; },
                 }, capture.io);
                 const parsed = parseDoctorBackfillJson(capture.stdout());

package/dist/commands/doctor.js

@@ -5,6 +5,7 @@ import { withStage } from "../crash-guard.js";
 import { checkSingleInstallState, readRootsCoverWork, fixAuthState, fixRootState, readAuthState, readRootState, } from "./doctor-access.js";
 import { backfillCompletionStepState, backfillFixVerdict, checkBackfillState, checkDiskState, checkGcState, checkSyncState, fixBackfillState, fixDiskState, fixGcState, fixSyncState, syncBacklogDrainingVerdict, syncStandAsideVerdict, } from "./doctor-pipeline.js";
 import { checkMcpAnswersState } from "./doctor-mcp.js";
+import { budgetSpentRow, doctorRunDeadline, DOCTOR_JSON_BUDGET_SECONDS } from "./doctor-budget.js";
 import { checkMemoryDaemonState } from "./doctor-memory-daemon.js";
 import { checkDoctorAgentRules, fixDoctorAgentRules, checkAutostartState, checkMemoryState, fixAutostartState, fixMemoryState, } from "./doctor-registration.js";
 import { dryRunPreview, isInteractiveDoctorFix, maybeReportDoctorEvents, writeDoctorOutput, doctorNeedsPerson, } from "./doctor-report.js";
@@ -15,12 +16,19 @@ export async function runDoctor(command, io, hooks, overrides = {}) {
     return runDoctorWithDeps(command, io, deps);
 }
 export async function runDoctorWithDeps(command, io, deps) {
-    const context = { command, io, deps };
+    const runStarted = Date.now();
+    const deadlineMs = doctorRunDeadline(command, runStarted);
+    const context = { command, io, deps, deadlineMs };
+    console.error("[doctor] run started", JSON.stringify({ json: command.json, check_only: Boolean(command.dryRun || command.checkOnly), budget_seconds: deadlineMs === null ? null : DOCTOR_JSON_BUDGET_SECONDS }));
     const rows = [];
     const repairs = [];
     const diagnoseOnly = command.dryRun || command.checkOnly;
     const diagnosed = new Map();
+    // BLI-11101: every row says how long it took, so the next slow run names
+    // the row without a profiler. A killed run still leaves every finished row.
+    const checkMs = new Map();
     for (const invariant of doctorInvariants()) {
+        const started = Date.now();
         try {
             diagnosed.set(invariant.id, await withStage(`doctor:check:${invariant.id}`, () => invariant.check(context)));
         }
@@ -28,16 +36,24 @@ export async function runDoctorWithDeps(command, io, deps) {
             console.error(`[doctor] ${invariant.id} diagnosis_failed`, JSON.stringify({ reason: "check_threw", ...describeError(error) }));
             diagnosed.set(invariant.id, { id: invariant.id, status: "fail", code: "check_threw", message: "Run `cockpit doctor` to retry this check." });
         }
+        checkMs.set(invariant.id, Date.now() - started);
+        console.error("[doctor] row checked", JSON.stringify({ row: invariant.id, elapsed_ms: checkMs.get(invariant.id), verdict: diagnosed.get(invariant.id)?.status, reason: diagnosed.get(invariant.id)?.code }));
     }
     for (const invariant of doctorInvariants()) {
         let row;
+        const fixStarted = Date.now();
         try {
             row = diagnosed.get(invariant.id);
             const needsCollection = ["backfill-complete", "sync-fresh"].includes(invariant.id);
             const prerequisitesReady = !needsCollection || rows.filter((prior) => prior.id === "authed" || prior.id === "roots-ok").every((prior) => prior.status === "ok");
             const canFix = !diagnoseOnly && prerequisitesReady && invariant.fix &&
                 (!invariant.requiresInteractiveFix || isInteractiveDoctorFix(context) || Boolean(command.collectionRoots?.length));
-            if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
+            const spent = row.status !== "ok" && row.status !== "skipped" && canFix ? budgetSpentRow(context, row) : null;
+            if (spent) {
+                row = spent;
+                repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
+            }
+            else if (row.status !== "ok" && row.status !== "skipped" && canFix && invariant.fix) {
                 row = await withStage(`doctor:fix:${invariant.id}`, () => invariant.fix(context, row));
                 repairs.push({ step: invariant.id, outcome: row.status === "ok" ? "repaired" : "needs_person", reason: row.code });
                 // The replacement process owns the one final receipt, including JSON.
@@ -57,6 +73,9 @@ export async function runDoctorWithDeps(command, io, deps) {
             repairs.push({ step: invariant.id, outcome: "needs_person", reason: row.code });
         }
         console.error(`[doctor] ${invariant.id} ${row.status}`, JSON.stringify({ reason: row.code, repaired: row.fixed ?? false }));
+        const fixMs = Date.now() - fixStarted;
+        const rowCheckMs = checkMs.get(invariant.id) ?? 0;
+        console.error("[doctor] row done", JSON.stringify({ row: invariant.id, elapsed_ms: rowCheckMs + fixMs, check_ms: rowCheckMs, fix_ms: fixMs, verdict: row.status, reason: row.code }));
         rows.push(row);
     }
     // Re-read host state after repairs. Sync is proven by its upload receipts;
@@ -68,10 +87,11 @@ export async function runDoctorWithDeps(command, io, deps) {
             const index = rows.findIndex((row) => row.id === invariant.id);
             if (rows[index]?.status === "fail")
                 continue;
+            const verifyStarted = Date.now();
             try {
                 const checked = await invariant.check(context);
                 rows[index] = { ...checked, fixed: rows[index]?.fixed && checked.status === "ok" };
-                console.error(`[doctor] ${invariant.id} verified`, JSON.stringify({ reason: checked.code, status: checked.status }));
+                console.error(`[doctor] ${invariant.id} verified`, JSON.stringify({ reason: checked.code, status: checked.status, elapsed_ms: Date.now() - verifyStarted }));
                 if (checked.status === "needs_fix" || checked.status === "fail") {
                     const repair = repairs.find((entry) => entry.step === invariant.id);
                     if (repair) {
@@ -102,8 +122,10 @@ export async function runDoctorWithDeps(command, io, deps) {
             rows.push({ id: "memory-registered", status: "needs_fix", code: "receipt_read_threw", message: "Run `cockpit doctor` to read the final setup receipt." });
         }
     }
+    const needsPerson = doctorNeedsPerson(rows, receipt).length;
+    console.error("[doctor] run done", JSON.stringify({ elapsed_ms: Date.now() - runStarted, rows: rows.length, needs_person: needsPerson, check_only: Boolean(diagnoseOnly) }));
     writeDoctorOutput(command, io, rows, receipt, repairs);
-    return doctorNeedsPerson(rows, receipt).length === 0 ? 0 : 1;
+    return needsPerson === 0 ? 0 : 1;
 }
 function doctorInvariants() {
     return [

package/dist/commands/local-arg-values.js

@@ -105,6 +105,15 @@ export function optionalPositiveInteger(value, flag) {
     }
     return parsed;
 }
+export function optionalNonNegativeInteger(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`${flag} must be a whole number of 0 or more.`);
+    }
+    return parsed;
+}
 export function optionalConfidence(value, flag) {
     if (value === undefined)
         return undefined;

package/dist/commands/local-args-collector-setup.js

@@ -142,8 +142,10 @@ export function parseDoctorArgs(alias, args) {
     return {
         kind: "doctor",
         checkOnly: values.booleans.has("--check") || values.booleans.has("--no-repair"),
-        backfillBudgetSeconds: optionalPositiveInteger(values.flags.get("--backfill-budget"), "--backfill-budget") ?? 900,
-        lockWaitSeconds: optionalPositiveInteger(values.flags.get("--lock-wait"), "--lock-wait") ?? 600,
+        // Absent stays absent (BLI-11101): `doctor-budget.ts` owns the defaults,
+        // and `--json` without either flag runs under one bounded budget.
+        backfillBudgetSeconds: optionalPositiveInteger(values.flags.get("--backfill-budget"), "--backfill-budget"),
+        lockWaitSeconds: optionalPositiveInteger(values.flags.get("--lock-wait"), "--lock-wait"),
         alias,
         homeDir: optionalNonEmpty(values.flags.get("--home")),
         repoRoot: optionalNonEmpty(workRootFlagValue(values)),

package/dist/commands/local-args-collector-work.js

@@ -8,7 +8,7 @@
  * defaults, same refusal sentences.
  */
 import { IntentSourceSchema, WorkIntentSchema, WorkPhaseSchema, } from "@bli-cockpit/telemetry-core";
-import { assertNoPositionals, optionalConfidence, optionalNonEmpty, optionalPositiveInteger, optionalSchemaValue, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
+import { assertNoPositionals, optionalConfidence, optionalNonEmpty, optionalNonNegativeInteger, optionalPositiveInteger, optionalSchemaValue, optionalUrl, parseNamedArgs, workRootFlagValue, } from "./local-arg-values.js";
 export function parseStartArgs(args) {
     const values = parseNamedArgs(args, {
         allowedFlags: [
@@ -134,6 +134,7 @@ export function parseBackfillArgs(args) {
             "--max-files",
             "--max-depth",
             "--max-repos",
+            "--lock-wait",
             "--yes",
             "--json",
         ],
@@ -146,6 +147,7 @@ export function parseBackfillArgs(args) {
             "--max-files",
             "--max-depth",
             "--max-repos",
+            "--lock-wait",
         ],
     });
     assertNoPositionals(values.positionals, "backfill");
@@ -169,7 +171,13 @@ export function parseBackfillArgs(args) {
         maxFiles: optionalPositiveInteger(values.flags.get("--max-files"), "--max-files"),
         maxDepth: optionalPositiveInteger(values.flags.get("--max-depth"), "--max-depth"),
         maxRepos: optionalPositiveInteger(values.flags.get("--max-repos"), "--max-repos"),
+        ...lockWaitMs(values.flags.get("--lock-wait")),
         yes: values.booleans.has("--yes"),
         json: values.booleans.has("--json"),
     };
+}
+/** `--lock-wait <seconds>` (0 = try once); absent means the 10-minute default (BLI-11091). */
+function lockWaitMs(value) {
+    const seconds = optionalNonNegativeInteger(value, "--lock-wait");
+    return seconds === undefined ? {} : { syncLockWaitMs: seconds * 1000 };
 }

package/dist/commands/local-help-commands.js

@@ -95,6 +95,7 @@ export function localSubcommandHelp(command) {
                 "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
                 "--backfill-budget defaults to 900 seconds; catch-up repeats chunks until complete, with progress every 30 seconds.",
                 "--lock-wait defaults to 600 seconds; progress prints every 30 seconds.",
+                "--json without either flag answers within 45 seconds; a repair that does not fit reads doctor_budget_spent.",
                 "--json includes steps, repairs, and needs_person. Exit 0 means nothing needs you.",
                 "Maintainers: --update-tag next keeps self-update on the prerelease candidate.",
             ],
@@ -267,7 +268,7 @@ export function localSubcommandHelp(command) {
         [
             "backfill",
             [
-                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
+                "Usage: cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
                 "",
                 "Backfills historical Codex and Claude Code session evidence using the saved collection roots from local config when --workspace is omitted.",
                 "Omit --source to scan both sources; there is no --source all literal.",
@@ -276,6 +277,8 @@ export function localSubcommandHelp(command) {
                 "Repo discovery scans 3 folder levels and up to 50 repos by default.",
                 "Raise --max-depth or --max-repos when a partial result reports a discovery cap.",
                 "--dry-run validates the paired collector and dashboard reachability, prints the same summary tables, and writes nothing.",
+                "Sessions outside every saved root upload too, labelled outside; only an explicit opt-out withholds a session.",
+                "When the scheduled sync holds the collection lock, backfill waits up to --lock-wait seconds (default 600) and exits 1 with sync_lock_held if it never frees.",
             ],
         ],
         [

package/dist/commands/local-help.js

@@ -109,7 +109,7 @@ export function localCommandHelp(command) {
         "  cockpit correct --claim <claimId> --text \"<what is wrong>\" [--for <person>] [--version <pageId>] [--supersedes <id>] [--dashboard-url <url>] [--json]",
         "  cockpit notes [list|show <id>|shelf|shelves|folders|mkdir <path>|rmdir <path>|rename <path>|upload <paths...> [--wait]|paste|share <id>|unshare <id>|move <id>|place <id>] [--folder <path>] [--series <shelf>] [--kind <kind>] [--since <YYYY-MM-DD>] [--until <YYYY-MM-DD>] [--limit <n>] [--file <path>] [--name <n>] [--exclude \"<sentence>\"] [--to \"<shelf>\"|--clear-shelf] [--apply] [--yes] [--dashboard-url <url>] [--json]",
         "  cockpit notes [accounts [--show-webhook <account-id>]|connect --provider fellow --workspace <sub> --key-stdin [--name <n>]|webhook <account-id> --secret-stdin|detach <account-id>|sync <account-id>] [--json]   (the key and the signing secret are read from stdin, never a flag)",
-        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--yes] [--workspace <path>] [--json]",
+        "  cockpit backfill (--since-days <n>|--all) [--source codex|claude] [--dry-run] [--max-files <n>] [--max-depth <n>] [--max-repos <n>] [--lock-wait <seconds>] [--yes] [--workspace <path>] [--json]",
         "  cockpit status [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit sessions [--source codex|claude] [--since-days <n>|--all] [--workspace <path>] [--max-depth <n>] [--max-repos <n>] [--json]",
         "  cockpit serve [--port <port>] [--workspace <path>]",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.150");
+    writeLine(io?.stdout ?? process.stdout, "0.2.154");
     return 0;
   }
 

package/dist/cursors/raw-evidence-cursor.js

@@ -165,10 +165,14 @@ function parseObjectEntry(value) {
     const committedAt = optionalString(record["committed_at"]);
     if (!objectKey || !committedAt)
         return null;
+    const sourceKey = optionalString(record["source_key"]);
     return {
         object_key: objectKey,
         byte_size: optionalNumber(record["byte_size"]),
         committed_at: committedAt,
+        ...(sourceKey
+            ? { source_key: sourceKey, checkpoints: parseCheckpoints(record["checkpoints"]) }
+            : {}),
     };
 }
 function parseSessionEntry(value) {
@@ -193,6 +197,16 @@ function parseSessionEntry(value) {
         last_seen_at: lastSeenAt,
     };
 }
+function parseCheckpoints(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const out = {};
+    for (const [offset, hash] of Object.entries(value)) {
+        if (/^\d+$/.test(offset) && typeof hash === "string")
+            out[offset] = hash;
+    }
+    return out;
+}
 function rawEvidenceCursorPath(paths, filename = PRIMARY_CURSOR_FILENAME) {
     return path.join(paths.cursors_dir, filename);
 }

package/dist/upload-envelope-build.js

@@ -14,6 +14,7 @@
  *   `upload-session-reports.ts`, which builds its own provenance without a
  *   full envelope.
  */
+import { priorSnapshotsFromCursor, } from "./adapters/raw-evidence-snapshot-supersede.js";
 import { TelemetryIngestEnvelopeSchema, } from "@bli-cockpit/telemetry-core";
 import path from "node:path";
 import { getCollectorRuntimePaths, LOCAL_COLLECTOR_VERSION, readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, readLocalWorkContextForRepo, } from "./local-state.js";
@@ -120,6 +121,10 @@ export async function buildLocalAmbientEnvelope(options = {}) {
             operatorId: session.operator_id,
             workContextId: uploadContext.work_context_id,
         }),
+        rawEvidencePriorSnapshots: priorSnapshotsFromCursor(transcriptCursorObjects(options.cursorObjects), (objectKey) => rawEvidenceObjectKeyBelongsToWorkContext(objectKey, {
+            operatorId: session.operator_id,
+            workContextId: uploadContext.work_context_id,
+        })),
         rawEvidenceByteBudget: options.rawEvidenceByteBudget,
         rawEvidenceObjectBudget: options.rawEvidenceObjectBudget,
         rawEvidenceBudget: options.rawEvidenceBudget,
@@ -188,6 +193,10 @@ function reusableContentHashes(options, context) {
         .filter(([, entry]) => rawEvidenceObjectKeyBelongsToWorkContext(entry.object_key, context))
         .map(([hash]) => hash));
 }
+/** Cursor entries that remember a transcript source (BLI-11088); the rest are ignored. */
+function transcriptCursorObjects(objects) {
+    return Object.fromEntries(Object.entries(objects ?? {}).filter((pair) => "source_key" in pair[1] && Boolean(pair[1].source_key)));
+}
 export function makeUploadWorkContext(options) {
     const provenance = makeCollectorProvenance({
         context: options.activeContext,

package/dist/upload-sync.js

@@ -1,23 +1,3 @@
-/**
- * `syncLocalAmbientEnvelope`: one ambient sync, end to end.
- *
- * 1. Assemble the envelope — or record why this machine cannot upload at all
- *    and rethrow, so `cockpit status` names the blocker.
- * 2. Deliver the raw evidence objects, skipping anything inside its delivery
- *    backoff window (`upload-evidence-delivery.ts`).
- * 3. Reconcile the envelope with what actually became durable, POST it to
- *    ingest, and refuse to believe a receipt we cannot read
- *    (`upload-ingest-receipt.ts`).
- * 4. Advance the content cursor, report any agent images, and write the ledger
- *    row — a retry when a later sync could still rescue the gap, a named
- *    blocker when it never can, nothing extra when the sync was clean.
- * 5. On any failure, spool a retry that carries its own reason.
- *
- * The whole file is built around one rule from the fleet contract: a sync that
- * did not collect everything must never read green. Objects held by backoff are
- * reported as named failures, permanent rejections are logged and blocked
- * rather than silently retried forever, and the ledger row always says why.
- */
 import { getCollectorRuntimePaths } from "./local-state.js";
 import { uploadRawEvidenceFilesChunked, } from "./evidence-upload-client.js";
 import { markObjectCommitted, readRawEvidenceCursor, writeRawEvidenceCursor, } from "./cursors/raw-evidence-cursor.js";
@@ -80,7 +60,7 @@ export async function syncLocalAmbientEnvelope(options = {}) {
             built,
             envelope: applyRawEvidenceUploadOutcomes(built.envelope, uploadOutcomes),
         });
-        advanceRawEvidenceCursor(cursor, uploadOutcomes, attemptedAt);
+        advanceRawEvidenceCursor(cursor, uploadOutcomes, attemptedAt, built.raw_evidence_upload_files);
         await writeRawEvidenceCursor(paths, cursor);
         await reportAgentImageArtifacts({
             fetchImpl,
@@ -221,17 +201,25 @@ async function buildEnvelopeOrRecordBlocker(paths, options, cursorObjects, attem
  * bytes instead of re-uploading them. A failed upload is deliberately absent:
  * recording it would make the next sync skip a file that never landed.
  */
-function advanceRawEvidenceCursor(cursor, outcomes, attemptedAt) {
+function advanceRawEvidenceCursor(cursor, outcomes, attemptedAt, files = []) {
+    // BLI-11088: a transcript's source key and snapshot facts ride into the
+    // cursor, so the next sync can prove its snapshot rebuilds this one.
+    const snapshotByHash = new Map(files.filter((file) => file.snapshot && file.source_key && file.pointer.content_hash_sha256)
+        .map((file) => [file.pointer.content_hash_sha256, file]));
     for (const outcome of outcomes) {
         if (outcome.upload_state === "upload_failed")
             continue;
         const contentHash = outcome.pointer.content_hash_sha256;
         if (!contentHash)
             continue;
+        const source = snapshotByHash.get(contentHash);
         markObjectCommitted(cursor, contentHash, {
             object_key: outcome.object_key,
             byte_size: outcome.pointer.byte_size ?? 0,
             committed_at: attemptedAt,
+            ...(source
+                ? { source_key: source.source_key, checkpoints: source.snapshot.checkpoints }
+                : {}),
         });
     }
     cursor.updated_at = attemptedAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.150",
+  "version": "0.2.154",
   "private": false,
   "type": "module",
   "bin": {
@@ -24,11 +24,11 @@
     "pretypecheck": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
     "typecheck": "node -e \"await import('./dist/commands/public-root.js')\"",
     "pretest": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
-    "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
+    "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.39",
-    "@bli-cockpit/mcp": "0.1.73",
-    "@bli-cockpit/telemetry-core": "0.1.51"
+    "@bli-cockpit/memory-mcp": "0.1.41",
+    "@bli-cockpit/mcp": "0.1.75",
+    "@bli-cockpit/telemetry-core": "0.1.53"
   }
 }