@bli-cockpit/cli 0.2.210 → 0.2.211

package/dist/commands/agent-session-report.js

@@ -246,7 +246,7 @@ export function buildAgentSessionReport(options) {
  */
 export function buildAgentSessionSummary(options) {
     const sidecarOutcomes = options.outcomes.flatMap((outcome) => outcome.sync.raw_evidence_outcomes.filter((upload) => upload.kind === "claude_jsonl_sidecar"));
-    const attributedClaude = options.claudeAttribution.results.filter((result) => isLiveRawEvidenceSyncAttribution(result.state, result.reason));
+    const attributedClaude = options.claudeAttribution.results.filter((result) => isLiveRawEvidenceSyncAttribution(result.state, result.reason, result.worktree !== null));
     const sidecarsCollected = attributedClaude.reduce((total, result) => total +
         result.sidecar_files.filter((sidecar) => !sidecar.skipped_reason).length, 0);
     const sidecarsSkipped = options.claudeAttribution.results.reduce((total, result) => total +

package/dist/commands/doctor-access.js

@@ -160,10 +160,12 @@ function shellQuote(value) {
  * a gate on it, so a session sitting outside one is not a defect doctor found
  * and cannot repair. This row is therefore always informational (`ok`): it
  * reports how many of this scan's sessions were inside vs. outside, never
- * asks for approval, and attempts no fix. Widening a root only adds the redacted transcript BYTES for those
- * directories, so the message names `cockpit roots add` as an OPTIONAL step an
- * operator can choose, never something doctor, or any person, is waiting on to
- * approve. The
+ * asks for approval, and attempts no fix. Since BLI-17916 the scheduled sync
+ * uploads the redacted transcript of an outside-root session too (under the
+ * collector's outside-roots workspace), so widening a root buys only
+ * attribution to a repo; the message names `cockpit roots add` as an OPTIONAL
+ * step an operator can choose, never something doctor, or any person, is
+ * waiting on to approve. The
  * row only turns red the ordinary way every other doctor check does: the scan
  * itself throwing (`work_directory_scan_incomplete` from unreadable session
  * folders), which `runDoctorWithDeps`'s existing `check_threw` handling
@@ -180,7 +182,7 @@ export async function readRootsCoverWork(context) {
     if (!outsideCount)
         return ok("roots-cover-work", "work_covered", `${scan.observed} sessions seen; no working folders outside your saved roots. ${sessionCoverageLine(scan, outsideCount)}`);
     return {
-        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside your saved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label. Nothing needs approving. Optional: add a folder as a root to also upload its redacted transcript text (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
+        ...ok("roots-cover-work", "work_outside_roots_labelled", `${insideCount} of ${scan.observed} sessions inside your saved roots, ${outsideCount} outside — every one already reached the server, the outside ones carrying an outside label, and their redacted transcripts upload too, a few per sync, newest first. Nothing needs approving. Optional: add a folder as a root to attribute its sessions to a repo (scan ${scan.generated_at}):\n${outside.map(entry => `${entry.count}: ${entry.directory}\n  ${rootsAddCommand(entry.directory, process.platform, homeDir)}`).join("\n")}\n\n${sessionCoverageLine(scan, outsideCount)}`),
         nextAction: rootsAddCommand(outside[0].directory, process.platform, homeDir),
     };
 }

package/dist/commands/local-help-commands.js

@@ -93,7 +93,7 @@ export function localSubcommandHelp(command) {
                 "",
                 "Diagnose, repair, and verify this machine.",
                 "Repairs CLI, background sync, sign-in, roots, memory and hooks, agent rules, catch-up, uploads, and cleanup.",
-                "roots-cover-work is informational: it names how many sessions are inside vs. outside saved roots (all already uploaded, outside ones labelled) and gives cockpit roots add commands for widening a root's redacted transcript content. It never needs a fix.",
+                "roots-cover-work is informational: it names how many sessions are inside vs. outside saved roots (all already uploaded, outside ones labelled) and gives cockpit roots add commands for attributing a folder's sessions to a repo (outside-root transcripts upload either way). It never needs a fix.",
                 "--no-usage-telemetry switches off Claude Code and Codex usage export, including later doctor runs.",
                 "--check or --no-repair diagnoses without repairs. --dry-run previews repairs.",
                 "--backfill-budget defaults to 900 seconds; catch-up repeats chunks until complete, with progress every 30 seconds.",

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.210");
+    writeLine(io?.stdout ?? process.stdout, "0.2.211");
     return 0;
   }
 

package/dist/commands/scout-render.js

@@ -81,6 +81,8 @@ function renderExperiment(card, styled) {
     for (const row of card.crossref ?? []) {
         if (row.person) {
             out.push(dim(`    On your team · ${row.person} · ${row.observedPattern ?? ""}`, styled));
+            if (row.provenanceLine)
+                out.push(dim(`      ${row.provenanceLine}`, styled));
         }
     }
     if (card.expectedPayoff)

package/dist/commands/session-sync-attribution.js

@@ -11,6 +11,7 @@
  * re-derived anywhere else.
  */
 import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-policy.js";
+import { outsideRootEntryOwesUpload } from "./session-sync-outside-roots.js";
 /**
  * Live sync remains reason-allowlisted even though historical backfill accepts
  * every deterministic fallback state.
@@ -18,9 +19,16 @@ import { isLiveRawEvidenceSyncAttribution } from "../raw-evidence-attribution-po
 export function isLiveSyncCollectableAttributionState(state, reason, hasApprovedWorkspace = false) {
     return isLiveRawEvidenceSyncAttribution(state, reason, hasApprovedWorkspace);
 }
-export function liveSyncCursorEntryRequiresRetry(entry) {
-    return (!entry.uploaded_object_key &&
-        (isLiveSyncCollectableAttributionState(entry.state, entry.reason, Boolean(entry.worktree_fingerprint)) || entry.reason === "repo_not_on_disk"));
+/**
+ * Does this cursor entry still owe a transcript upload, so the next scan window
+ * must reach back to it? An outside-root session owes one too (BLI-17916): the
+ * scheduled sync uploads it now, a few per tick, and the window stays open
+ * until the last of them is durable.
+ */
+export function liveSyncCursorEntryRequiresRetry(entry, now = new Date()) {
+    return ((!entry.uploaded_object_key &&
+        (isLiveSyncCollectableAttributionState(entry.state, entry.reason, Boolean(entry.worktree_fingerprint)) || entry.reason === "repo_not_on_disk")) ||
+        outsideRootEntryOwesUpload(entry, now));
 }
 export function matchesLiveSyncWorktree(result, target) {
     return (isLiveRawEvidenceSyncAttribution(result.state, result.reason, result.worktree !== null) &&

package/dist/commands/session-sync-health.js

@@ -118,6 +118,6 @@ function announceNothingInRoot(sessionsOutsideRoot, collectionRootCount) {
         reason: "nothing_in_root",
         sessions_outside_root: sessionsOutsideRoot,
         collection_root_count: collectionRootCount,
-        next_action: "widen the approved roots (an operator decision) if this machine should be collecting here",
+        next_action: "none needed: outside-root sessions upload under the outside-roots label (see the [session-sync] outside-root raw upload log line for why none did this tick); add a root only to attribute them to a repo",
     }));
 }

package/dist/commands/session-sync-outside-roots.js

@@ -0,0 +1,281 @@
+/**
+ * BLI-17916: the scheduled sync uploads the transcript of a session that sits
+ * outside every approved root, the same way `cockpit backfill` does.
+ *
+ * Edward's ruling of 2026-09-17 (ticket 10734) made approved roots a LABEL on
+ * the upload, never a gate. The scheduled sync honoured it for the session
+ * REPORT only: the redacted transcript bytes of an outside-root session went up
+ * through `cockpit backfill` and nothing else, so on a machine where backfill
+ * never finished about a third of the last 30 days of sessions (2,301 of 7,815)
+ * could never be summarised.
+ *
+ * This is the one step that closes it. After the scan, before the upload, it
+ * picks which outside-root sessions ride this tick and hands each the SAME
+ * synthetic workspace backfill uses (`backfill-outside-roots.ts`), so the rest
+ * of the pass needs no special case: a session with a workspace is an ordinary
+ * sync target, goes through the ordinary envelope, and meets the same redaction.
+ * Attribution is left alone: the state stays `unattributed`, the reason stays
+ * `cwd_outside_scanned_worktrees`, the row stays `root_scope: "outside"`, and
+ * the workspace is transport identity only, never a repo the machine owns.
+ *
+ * What this step decides, and says out loud:
+ *
+ *   - A session already durable with unchanged content rides for free. It
+ *     uploads nothing (the object cursor reuses it) and keeps its row stable.
+ *   - A session that is new, changed or not yet uploaded is "owed". The newest
+ *     ones ride this tick up to a per-tick session cap. The rest wait, and their
+ *     row says `deferred_object_budget`, the existing "next tick has room"
+ *     label, instead of the old "not uploadable" one.
+ *   - A transcript larger than the wire cap can never upload, so it does not
+ *     spend a slot every tick; its row says `file_too_large`.
+ *   - Nothing here runs for a source the operator switched off:
+ *     `collect_claude_jsonl: false` means the Claude store is never read (the
+ *     plan, not this step, decides that), so there are no Claude results to pick.
+ *
+ * The cap, the byte allowance and the object allowance are per tick, so a
+ * 1,800-session backlog drains across many ticks and never blows one tick's
+ * time or the machine's memory. Newest first: the sessions a person is most
+ * likely to be waiting on summarise first, and a backlog of old ones never
+ * starves today's.
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
+import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js";
+import { describeError } from "../health-detail.js";
+import { writeJsonFile } from "../local-state-files.js";
+import { rootScopeForReason } from "./agent-session-root-scope.js";
+import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
+/** Most outside-root sessions that upload bytes in one tick. 4 ticks an hour, so up to 3,840 a day. */
+export const OUTSIDE_ROOT_SESSIONS_PER_TICK = 40;
+/** Redacted bytes an outside-root pass may stage in one tick, kept apart from the in-root allowance. */
+export const OUTSIDE_ROOT_BYTES_PER_TICK = 256 * 1024 * 1024;
+/** Files (a Claude main plus its sidecars count one each) an outside-root pass may collect in one tick. */
+export const OUTSIDE_ROOT_OBJECTS_PER_TICK = 120;
+/**
+ * How far back the one-time catch-up scan reaches, and the oldest outside-root
+ * session that still widens a later tick's window. Longer history stays
+ * `cockpit backfill`'s job.
+ */
+export const OUTSIDE_ROOT_HORIZON_DAYS = 30;
+export const OUTSIDE_ROOT_HORIZON_MINUTES = OUTSIDE_ROOT_HORIZON_DAYS * 24 * 60;
+/** The upload_reason a session carries while it waits for a later tick. The existing transient label. */
+export const OUTSIDE_ROOT_WAITING_REASON = "deferred_object_budget";
+/** The upload_reason of a transcript over the wire cap. The existing deterministic label. */
+export const OUTSIDE_ROOT_TOO_LARGE_REASON = "file_too_large";
+const CATCH_UP_MARKER = "outside-root-catchup.json";
+export function outsideRootCatchUpMarkerPath(paths) {
+    return path.join(paths.cursors_dir, CATCH_UP_MARKER);
+}
+/** Has the one-time 30-day look-back already run on this machine? */
+export async function outsideRootCatchUpIsPending(paths) {
+    try {
+        await fs.access(outsideRootCatchUpMarkerPath(paths));
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Record that the look-back ran, so later ticks go back to the normal window.
+ * Best effort: a marker that cannot be written only means the next tick looks
+ * back once more, and it says so.
+ */
+export async function markOutsideRootCatchUpDone(paths, facts) {
+    try {
+        await writeJsonFile(outsideRootCatchUpMarkerPath(paths), {
+            completed_at: facts.now.toISOString(),
+            window_days: OUTSIDE_ROOT_HORIZON_DAYS,
+            sessions_seen: facts.sessions_seen,
+        });
+        console.error("[session-sync] outside-root catch-up look-back done", JSON.stringify({ reason: "catch_up_marker_written", window_days: OUTSIDE_ROOT_HORIZON_DAYS, sessions_seen: facts.sessions_seen }));
+    }
+    catch (error) {
+        console.error("[session-sync] outside-root catch-up marker not written", JSON.stringify({ reason: "catch_up_marker_write_failed", ...describeError(error) }));
+    }
+}
+/** Widens a scan window to the catch-up horizon while the look-back is owed. */
+export function widenForCatchUp(sinceMinutes, catchUpPending, normalMinutes) {
+    if (!catchUpPending)
+        return sinceMinutes;
+    return Math.max(sinceMinutes ?? normalMinutes, OUTSIDE_ROOT_HORIZON_MINUTES);
+}
+/**
+ * Does this cursor entry belong to an outside-root session that still owes its
+ * transcript? Such a session keeps the next scan window open back to its age,
+ * the same way an undurable in-root session does. A transcript over the wire
+ * cap never counts (it can never become durable), and neither does one older
+ * than the horizon (that is backfill's).
+ */
+export function outsideRootEntryOwesUpload(entry, now = new Date()) {
+    if (rootScopeForReason(entry.reason) !== "outside")
+        return false;
+    if (entry.uploaded_object_key && !isRedactionStubObjectKey(entry.uploaded_object_key))
+        return false;
+    if (entry.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES)
+        return false;
+    return now.getTime() - entry.file_mtime_ms <= OUTSIDE_ROOT_HORIZON_MINUTES * 60_000;
+}
+/** Is this scan result a session outside every approved root with no worktree of its own? */
+function isUnclaimedOutsideRootResult(result) {
+    return !result.worktree && rootScopeForReason(result.reason) === "outside";
+}
+/** Already durable remotely with the bytes the scan just read: it needs no upload. */
+function isDurableAndUnchanged(result, entry) {
+    return Boolean(entry &&
+        entry.uploaded_object_key &&
+        !isRedactionStubObjectKey(entry.uploaded_object_key) &&
+        !entry.stubbed &&
+        result.content_hash_sha256 &&
+        entry.file_hash_sha256 === result.content_hash_sha256);
+}
+function sightingsOf(scan, plan) {
+    const sightings = [];
+    for (const result of scan.codexAttribution.results) {
+        if (isUnclaimedOutsideRootResult(result)) {
+            sightings.push({ source: "codex", sessionId: result.codex_session_id, result });
+        }
+    }
+    // A machine that opted out of Claude has no Claude results to begin with
+    // (`session-sync-scan.ts` returns an empty scan); the guard keeps this step
+    // honest on its own as well.
+    if (plan.claudeEnabled) {
+        for (const result of scan.claudeAttribution.results) {
+            if (isUnclaimedOutsideRootResult(result)) {
+                sightings.push({ source: "claude_code", sessionId: result.claude_session_id, result });
+            }
+        }
+    }
+    return sightings;
+}
+export function outsideRootKey(source, sessionId) {
+    return `${source}:${sessionId}`;
+}
+/**
+ * Pick this tick's outside-root sessions and give them the synthetic workspace.
+ * Returns the scan to upload from (the input scan when nothing is admitted) with
+ * the admission facts the upload and the report steps read.
+ */
+export async function admitOutsideRootSessions(options) {
+    const { plan, scan } = options;
+    const sightings = sightingsOf(scan, plan);
+    if (sightings.length === 0) {
+        return { ...scan, outsideRoots: null };
+    }
+    const cursorFor = (source) => source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore;
+    const free = [];
+    const owed = [];
+    const holds = new Map();
+    let tooLarge = 0;
+    for (const sighting of sightings) {
+        const entry = cursorFor(sighting.source).sessions[sighting.sessionId];
+        if (sighting.result.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES) {
+            holds.set(outsideRootKey(sighting.source, sighting.sessionId), OUTSIDE_ROOT_TOO_LARGE_REASON);
+            tooLarge += 1;
+        }
+        else if (isDurableAndUnchanged(sighting.result, entry)) {
+            free.push(sighting);
+        }
+        else {
+            owed.push(sighting);
+        }
+    }
+    // Newest first, with the session id as a tie-break so two ticks over the same
+    // files pick the same sessions.
+    owed.sort((left, right) => right.result.session_file_mtime_ms - left.result.session_file_mtime_ms ||
+        left.sessionId.localeCompare(right.sessionId));
+    const riding = owed.slice(0, OUTSIDE_ROOT_SESSIONS_PER_TICK);
+    const waiting = owed.slice(OUTSIDE_ROOT_SESSIONS_PER_TICK);
+    for (const sighting of waiting) {
+        holds.set(outsideRootKey(sighting.source, sighting.sessionId), OUTSIDE_ROOT_WAITING_REASON);
+    }
+    const admitted = [...riding, ...free];
+    const counts = {
+        outside_root_sessions: sightings.length,
+        riding_owed: riding.length,
+        riding_already_durable: free.length,
+        waiting_next_tick: waiting.length,
+        too_large: tooLarge,
+        codex_riding: admitted.filter((sighting) => sighting.source === "codex").length,
+        claude_riding: admitted.filter((sighting) => sighting.source === "claude_code").length,
+    };
+    const budget = {
+        sessions_per_tick: OUTSIDE_ROOT_SESSIONS_PER_TICK,
+        bytes_per_tick: OUTSIDE_ROOT_BYTES_PER_TICK,
+        objects_per_tick: OUTSIDE_ROOT_OBJECTS_PER_TICK,
+    };
+    if (admitted.length === 0) {
+        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "nothing_to_upload_outside_roots", ...counts, ...budget }));
+        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
+    }
+    const workspace = outsideRootsWorkspace(options.homeDir);
+    try {
+        await ensureOutsideRootsWorkspace(workspace);
+    }
+    catch (error) {
+        // Not silent, and not a crash: every outside-root session keeps waiting and
+        // says why, and the in-root sessions of this tick are unaffected.
+        for (const sighting of admitted) {
+            holds.set(outsideRootKey(sighting.source, sighting.sessionId), "outside_root_workspace_unavailable");
+        }
+        console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "workspace_unavailable", ...counts, ...budget, ...describeError(error) }));
+        return { ...scan, outsideRoots: { workspace: null, holds, counts } };
+    }
+    const admittedKeys = new Set(admitted.map((sighting) => outsideRootKey(sighting.source, sighting.sessionId)));
+    const labelled = {
+        ...scan,
+        codexAttribution: {
+            ...scan.codexAttribution,
+            results: scan.codexAttribution.results.map((result) => admittedKeys.has(outsideRootKey("codex", result.codex_session_id)) && isUnclaimedOutsideRootResult(result)
+                ? { ...result, worktree: workspace }
+                : result),
+        },
+        claudeAttribution: {
+            ...scan.claudeAttribution,
+            results: scan.claudeAttribution.results.map((result) => admittedKeys.has(outsideRootKey("claude_code", result.claude_session_id)) && isUnclaimedOutsideRootResult(result)
+                ? { ...result, worktree: workspace }
+                : result),
+        },
+        outsideRoots: { workspace, holds, counts },
+    };
+    console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
+    return labelled;
+}
+/**
+ * Says why an outside-root session did not ride this tick, on its report row.
+ * A row that has a pointer, or a reason the upload itself recorded, is left
+ * alone; the rest were never offered an upload, so the step that decided
+ * ("waiting for a later tick", "over the wire cap") names it instead of the old
+ * "not uploadable" label, which stopped being true with this ticket.
+ */
+export function applyOutsideRootHolds(rows, holds) {
+    if (!holds || holds.size === 0)
+        return rows;
+    return rows.map((row) => {
+        const hold = holds.get(outsideRootKey(row.source, row.codex_session_id));
+        if (!hold || row.raw_evidence_pointer_id || row.upload_state !== "not_uploaded")
+            return row;
+        if (row.upload_reason && !row.upload_reason.startsWith("not_uploadable_attribution_state"))
+            return row;
+        return { ...row, upload_reason: hold };
+    });
+}
+/**
+ * The outside-root pass gets its own allowance, so a busy in-root tick cannot
+ * starve it and it cannot take the in-root room. The disk gate and the image
+ * description session stay shared (they live on the same budget object).
+ */
+export function giveOutsideRootsTheirOwnAllowance(budget) {
+    budget.remainingBytes = OUTSIDE_ROOT_BYTES_PER_TICK;
+    budget.remainingObjects = OUTSIDE_ROOT_OBJECTS_PER_TICK;
+}
+/** The sync target list with the outside-roots workspace moved last, so in-root evidence goes first. */
+export function outsideRootsLast(worktrees) {
+    return [
+        ...worktrees.filter((worktree) => !isOutsideRootsWorkspace(worktree)),
+        ...worktrees.filter((worktree) => isOutsideRootsWorkspace(worktree)),
+    ];
+}

package/dist/commands/session-sync-plan.js

@@ -23,6 +23,7 @@ import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCur
 import { normalizeCollectionRoots } from "../root-normalization.js";
 import { readLocalUploadSpoolState, } from "../spool/local-spool.js";
 import { liveSyncCursorEntryRequiresRetry } from "./session-sync-attribution.js";
+import { outsideRootCatchUpIsPending } from "./session-sync-outside-roots.js";
 /**
  * The bound applied when a retry is pending but no cursor entry names the
  * stuck file (e.g. a legacy spooled upload recorded before per-source retry
@@ -46,7 +47,7 @@ export async function planSyncFromLocalState(options) {
     const config = await readLocalCollectorConfig(options.paths).catch(() => null);
     const claudeEnabled = config?.collect_claude_jsonl !== false;
     const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
-    const [codexCursorBefore, claudeCursorBefore, uploadSpool] = await Promise.all([
+    const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await Promise.all([
         readRawEvidenceCursor(options.paths).catch(() => emptyRawEvidenceCursorState()),
         claudeEnabled
             ? readRawEvidenceCursor(options.paths, {
@@ -54,6 +55,7 @@ export async function planSyncFromLocalState(options) {
             }).catch(() => emptyRawEvidenceCursorState())
             : Promise.resolve(emptyRawEvidenceCursorState()),
         readLocalUploadSpoolState(options.paths).catch(() => null),
+        outsideRootCatchUpIsPending(options.paths),
     ]);
     // A spooled upload from a CLI old enough not to have recorded its source
     // could have come from either one, so both sources own it until it clears.
@@ -73,6 +75,7 @@ export async function planSyncFromLocalState(options) {
             sourceHasPendingRetries("claude_code", uploadSpool, legacyRetryPending, claudeSourceRetryPending, claudeCursorBefore),
         codexRetrySinceMinutes: boundedRetrySinceMinutes(codexCursorBefore, options.now),
         claudeRetrySinceMinutes: boundedRetrySinceMinutes(claudeCursorBefore, options.now),
+        outsideRootCatchUpPending,
     };
 }
 /**
@@ -85,7 +88,7 @@ export async function planSyncFromLocalState(options) {
 export function boundedRetrySinceMinutes(cursor, now) {
     let oldestUndurableMtimeMs = null;
     for (const entry of Object.values(cursor.sessions)) {
-        if (!liveSyncCursorEntryRequiresRetry(entry))
+        if (!liveSyncCursorEntryRequiresRetry(entry, now))
             continue;
         if (oldestUndurableMtimeMs === null ||
             entry.file_mtime_ms < oldestUndurableMtimeMs) {

package/dist/commands/session-sync-scan.js

@@ -14,7 +14,10 @@ import { scanAndAttributeClaudeSessions, } from "../adapters/claude-attribution.
 import { CLAUDE_CURSOR_FILENAME } from "../cursors/raw-evidence-cursor.js";
 import { clearSourceRetryFailure, recordSourceRetryFailure, } from "../spool/local-spool.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
+import { widenForCatchUp } from "./session-sync-outside-roots.js";
 const CLAUDE_FIRST_RUN_BACKFILL_MINUTES = 14 * 24 * 60;
+/** The Claude scan's own default window when nothing widens it: the last 24 hours. */
+const CLAUDE_DEFAULT_WINDOW_MINUTES = 24 * 60;
 /**
  * Scan and attribute both session sources, then settle each source's scan-retry
  * bookkeeping against what the scan actually found.
@@ -31,6 +34,7 @@ export async function scanAndAttributeBothSources(options) {
         collectionRoots: plan.collectionRoots,
         retryPending: plan.codexRetryPending,
         retrySinceMinutes: plan.codexRetrySinceMinutes,
+        outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
     });
     // First run (D B.4 §8): without a Claude cursor yet, widen the window to 14
     // days so the first sync captures retroactive history instead of only 24h.
@@ -45,6 +49,7 @@ export async function scanAndAttributeBothSources(options) {
         retryPending: plan.claudeRetryPending,
         retrySinceMinutes: plan.claudeRetrySinceMinutes,
         firstRunBackfill,
+        outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
     });
     await reconcileSourceScanRetry({
         paths: options.paths,
@@ -72,9 +77,9 @@ export async function scanAndAttributeBothSources(options) {
  * is always scanned, unlike Claude which can be disabled entirely.
  */
 async function scanCodexSessionsForSync(options) {
-    const sinceMinutes = options.retryPending
+    const sinceMinutes = widenForCatchUp(options.retryPending
         ? options.retrySinceMinutes
-        : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES;
+        : CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES, options.outsideRootCatchUpPending, CODEX_ATTRIBUTION_SCAN_WINDOW_MINUTES);
     let scan = await scanAndAttributeCodexSessions({
         sessionsDirs: defaultCodexSessionDirs(options.homeDir),
         worktrees: options.worktrees,
@@ -107,11 +112,11 @@ async function scanCodexSessionsForSync(options) {
 async function scanClaudeSessionsForSync(options) {
     if (!options.claudeEnabled)
         return emptyClaudeScan();
-    const sinceMinutes = options.retryPending
+    const sinceMinutes = widenForCatchUp(options.retryPending
         ? options.retrySinceMinutes
         : options.firstRunBackfill
             ? CLAUDE_FIRST_RUN_BACKFILL_MINUTES
-            : undefined;
+            : undefined, options.outsideRootCatchUpPending, CLAUDE_DEFAULT_WINDOW_MINUTES);
     const projectsDir = path.join(options.homeDir, ".claude", "projects");
     let scan = await scanAndAttributeClaudeSessions({
         projectsDir,

package/dist/commands/session-sync-upload.js

@@ -10,6 +10,8 @@ import { startLocalWorkContext, startLocalWorkContextForAttributedTarget, } from
 import { LocalUploadBlockedError, syncLocalAmbientEnvelope, } from "../upload.js";
 import { RAW_EVIDENCE_DEFAULT_BYTE_BUDGET, RAW_EVIDENCE_DEFAULT_OBJECT_BUDGET, } from "../adapters/raw-evidence.js";
 import { liveSyncTargetKey, liveSyncTargetWorktrees, matchesLiveSyncWorktree, } from "./session-sync-attribution.js";
+import { isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
+import { giveOutsideRootsTheirOwnAllowance, outsideRootsLast, } from "./session-sync-outside-roots.js";
 import { runYieldingAtBoundaries } from "./sync-yield.js";
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
@@ -22,10 +24,12 @@ const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
  */
 export async function syncEveryTargetWorktree(options) {
     const { run, scan } = options;
-    const syncWorktrees = liveSyncTargetWorktrees(run.worktrees, [
+    // BLI-17916: the outside-roots workspace goes last, so in-root evidence is
+    // never held up behind it.
+    const syncWorktrees = outsideRootsLast(liveSyncTargetWorktrees(run.worktrees, [
         ...scan.codexAttribution.results,
         ...scan.claudeAttribution.results,
-    ]);
+    ]));
     const discoveredWorktreeKeys = new Set(run.worktrees.map(liveSyncTargetKey));
     // sessionId -> prior durable pointer for damped sessions (drives the
     // growth_damped count + the skip_main decision).
@@ -40,21 +44,28 @@ export async function syncEveryTargetWorktree(options) {
         items: syncWorktrees,
         shouldYield: run.yieldCheck,
         describe: (outcome) => ({ status: outcome.sync.status }),
-        runOne: (worktree) => syncOneWorktree({
-            run,
-            now: options.now,
-            plan: options.plan,
-            scan,
-            worktree,
-            syncWorktrees,
-            rawEvidenceBudget,
-            // A target git discovery never produced is one the fallback attribution
-            // synthesized, and it syncs through its own attributed work context.
-            isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
-            recordDampedClaudeSession: (sessionId, priorPointer) => {
-                dampedClaudePointers.set(sessionId, priorPointer);
-            },
-        }),
+        runOne: (worktree) => {
+            // The outside-root pass has its own per-tick allowance (bytes and files),
+            // so a busy in-root tick cannot starve it and it cannot take in-root room.
+            if (isOutsideRootsWorkspace(worktree)) {
+                giveOutsideRootsTheirOwnAllowance(rawEvidenceBudget);
+            }
+            return syncOneWorktree({
+                run,
+                now: options.now,
+                plan: options.plan,
+                scan,
+                worktree,
+                syncWorktrees,
+                rawEvidenceBudget,
+                // A target git discovery never produced is one the fallback attribution
+                // synthesized, and it syncs through its own attributed work context.
+                isDiscoveredWorktree: discoveredWorktreeKeys.has(liveSyncTargetKey(worktree)),
+                recordDampedClaudeSession: (sessionId, priorPointer) => {
+                    dampedClaudePointers.set(sessionId, priorPointer);
+                },
+            });
+        },
     });
     const outcomes = loop.results;
     const everyWorktreeUploaded = outcomes.every((outcome) => outcome.sync.status === "uploaded");
@@ -87,12 +98,14 @@ function claudeDurablePointersFromCursor(claudeCursorBefore) {
  */
 async function syncOneWorktree(options) {
     const { run, worktree } = options;
-    const attributedSyntheticTarget = options.isDiscoveredWorktree
-        ? null
-        : worktree;
-    const ensureContext = () => startWorktreeContext(options, attributedSyntheticTarget);
+    // The outside-roots workspace starts its work context the way `cockpit
+    // backfill` does (a plain folder, no attributed-target proof): it is a
+    // transport folder the collector owns, not a repo anyone attributed.
+    const outsideRoots = isOutsideRootsWorkspace(worktree);
+    const attributedSyntheticTarget = options.isDiscoveredWorktree || outsideRoots ? null : worktree;
+    const ensureContext = () => startWorktreeContext(options, attributedSyntheticTarget, outsideRoots);
     let context = null;
-    if (run.startContexts || attributedSyntheticTarget) {
+    if (run.startContexts || attributedSyntheticTarget || outsideRoots) {
         context = await ensureContext();
     }
     const syncOptions = ambientEnvelopeForWorktree(options);
@@ -112,15 +125,21 @@ async function syncOneWorktree(options) {
     }
     return { worktree, context, sync };
 }
-function startWorktreeContext(options, attributedSyntheticTarget) {
+function startWorktreeContext(options, attributedSyntheticTarget, outsideRoots) {
     const { run, worktree } = options;
     const contextOptions = {
         homeDir: run.homeDir,
         repoRoot: worktree.repo_root,
-        activeTicketId: run.activeTicketId,
+        // The caller's ticket and branch belong to the caller's repo, never to the
+        // outside-roots workspace.
+        ...(outsideRoots ? {} : { activeTicketId: run.activeTicketId }),
         operatorId: run.operatorId,
         sessionId: run.sessionId,
-        ...(attributedSyntheticTarget ? {} : { branch: run.branch }),
+        ...(outsideRoots
+            ? { branch: worktree.branch, leaveActiveContext: true }
+            : attributedSyntheticTarget
+                ? {}
+                : { branch: run.branch }),
     };
     return attributedSyntheticTarget
         ? startLocalWorkContextForAttributedTarget(contextOptions, attributedSyntheticTarget)

package/dist/commands/session-sync.js

@@ -43,7 +43,8 @@ import { getCollectorRuntimePaths } from "../local-state.js";
 import { buildAgentSessionReport, buildAgentSessionSummary, } from "./agent-session-report.js";
 import { collectSessionCommits, withSessionCommits } from "../session-commits.js";
 import { planSyncFromLocalState } from "./session-sync-plan.js";
-import { scanAndAttributeBothSources } from "./session-sync-scan.js";
+import { scanAndAttributeBothSources, sourceScanFailureReason, } from "./session-sync-scan.js";
+import { admitOutsideRootSessions, applyOutsideRootHolds, markOutsideRootCatchUpDone, } from "./session-sync-outside-roots.js";
 import { syncEveryTargetWorktree } from "./session-sync-upload.js";
 import { reportSessionsAndAdvanceCursors } from "./session-sync-record.js";
 import { decideSyncHealth } from "./session-sync-health.js";
@@ -55,6 +56,11 @@ export { sourceScanFailureReason, sourceScanRetryReason, } from "./session-sync-
 export { SYNC_FAILED_WITHOUT_REASON } from "./session-sync-failures.js";
 export { nothingInRootCount } from "./session-sync-health.js";
 export { isDeliveryHoldReason, summarizeDeliveryHold, } from "./session-sync-hold.js";
+/** Did either session store fail to read this tick? A failed read means the scan saw less than exists. */
+function scanHadReadFailure(scan) {
+    return (sourceScanFailureReason("codex", scan.codexAttribution) !== null ||
+        sourceScanFailureReason("claude_code", scan.claudeAttribution) !== null);
+}
 /**
  * Shared dual-source sync orchestration for single-repo and parent-folder
  * modes. Codex AND Claude Code sessions are scanned and attributed once across
@@ -62,7 +68,8 @@ export { isDeliveryHoldReason, summarizeDeliveryHold, } from "./session-sync-hol
  * fallback-attributed transcripts (Codex + Claude main + sidecars). The
  * ambiguous/unattributed/skipped sessions inside an approved root retain those
  * labels while syncing once through that root's synthetic folder workspace.
- * Outside-root sessions remain diagnostic-only. The session row's upload state
+ * Outside-root sessions keep their labels and upload through the collector's
+ * own outside-roots workspace, a few per tick (BLI-17916). The session row's upload state
  * maps ONLY from the main-file outcome (D3); sidecar outcomes aggregate into
  * CLI counts.
  *
@@ -80,13 +87,21 @@ export async function runAttributedWorktreeSync(options) {
         now,
         approvedCollectionRoots: options.collectionRoots,
     });
-    const scan = await scanAndAttributeBothSources({
+    const scanned = await scanAndAttributeBothSources({
         paths,
         homeDir,
         now,
         worktrees: options.worktrees,
         plan,
     });
+    // BLI-17916: roots are a label, never a gate. Outside-root sessions ride this
+    // tick's upload under the synthetic workspace, a few per tick, newest first.
+    const scan = await admitOutsideRootSessions({
+        homeDir: options.homeDir,
+        plan,
+        scan: scanned,
+        now,
+    });
     const worktreePass = await syncEveryTargetWorktree({
         run: options,
         now,
@@ -102,18 +117,20 @@ export async function runAttributedWorktreeSync(options) {
     }
     console.error("[session-sync] bindings read", JSON.stringify({ bound_worktrees: ticketByWorktree.size, reason: "active_work_context" }));
     // BLI-13028: which commits each session's working tree created while it ran.
+    // Read from the scan as it was BEFORE the outside-root step: the synthetic
+    // workspace is not a git tree, and no commit belongs to it.
     const commitsBySession = await collectSessionCommits([
-        ...scan.codexAttribution.results.map((result) => ({ key: `codex:${result.codex_session_id}`, result })),
-        ...scan.claudeAttribution.results.map((result) => ({ key: `claude_code:${result.claude_session_id}`, result })),
+        ...scanned.codexAttribution.results.map((result) => ({ key: `codex:${result.codex_session_id}`, result })),
+        ...scanned.claudeAttribution.results.map((result) => ({ key: `claude_code:${result.claude_session_id}`, result })),
     ]);
-    const sessions = withSessionCommits(buildAgentSessionReport({
+    const sessions = applyOutsideRootHolds(withSessionCommits(buildAgentSessionReport({
         ticketByWorktree,
         codexResults: scan.codexAttribution.results,
         claudeResults: scan.claudeAttribution.results,
         outcomes: worktreePass.outcomes,
         now,
         claudePriorDurablePointers: worktreePass.claudePriorDurablePointers,
-    }), commitsBySession);
+    }), commitsBySession), scan.outsideRoots?.holds);
     // BLI-4341: every session should arrive counted. Say how many did, and say
     // it on the success path too: a silent drop from "all" to "some" is exactly
     // the kind of decay nobody notices.
@@ -133,6 +150,11 @@ export async function runAttributedWorktreeSync(options) {
         sessions,
         outcomes: worktreePass.outcomes,
     });
+    // The one-time 30-day look-back is done once a tick read both stores without
+    // a failure and recorded what it saw in the cursors.
+    if (plan.outsideRootCatchUpPending && !scanHadReadFailure(scan)) {
+        await markOutsideRootCatchUpDone(paths, { now, sessions_seen: sessions.length });
+    }
     const summary = buildAgentSessionSummary({
         codexAttribution: scan.codexAttribution,
         claudeAttribution: scan.claudeAttribution,

package/dist/commands/sync-report.js

@@ -63,7 +63,7 @@ export async function reportNoWorktreeSync(command, io, run, dedup) {
     if (run.notice?.startsWith("nothing_in_root")) {
         // Says out loud what the receipt now says to the dashboard: the sessions
         // this machine ran were all outside the folders it is allowed to look at.
-        writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). Nothing was collected, and nothing is broken.`);
+        writeLine(io.stdout, `Every session seen this run was outside your approved folders (${run.notice}). No transcript was uploaded for them this run (the log line "outside-root raw upload" says why), and nothing is broken.`);
     }
     writeAgentSessionSummary(io, run.summary);
     if (gc && !gc.skipped)

package/dist/local-state-work-context.js

@@ -64,7 +64,9 @@ async function writeLocalWorkContext(options, attributedIdentity) {
         existingContext,
     });
     await writeJsonFile(workContextFile(paths, identity.worktree_fingerprint), context);
-    await writeJsonFile(paths.active_work_context_file, context);
+    if (!options.leaveActiveContext) {
+        await writeJsonFile(paths.active_work_context_file, context);
+    }
     return context;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.210",
+  "version": "0.2.211",
   "private": false,
   "type": "module",
   "bin": {