@bli-cockpit/cli 0.2.242 → 0.2.244

package/dist/commands/project-args.js

@@ -0,0 +1,82 @@
+/**
+ * `cockpit project` argument parsing (BLI-3716 list, BLI-21659 show/create/update/archive/restore).
+ *
+ * A description never travels on argv by default: `--file <path>` reads it from a local file (safest on Windows);
+ * `--description <text>` is the short form and `--description none` clears it. Write-safety flags
+ * (`--request-id`, `--expected-updated-at`) belong to the four write verbs.
+ */
+import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs } from "./local-arg-values.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ACTIONS = ["list", "show", "create", "update", "archive", "restore"];
+const WRITES = ["create", "update", "archive", "restore"];
+export function parseProjectArgs(args) {
+    const values = parseNamedArgs(args, {
+        allowedFlags: [
+            "--home", "--dashboard-url", "--archived", "--cursor", "--limit", "--json",
+            "--name", "--description", "--file", "--color", "--request-id", "--expected-updated-at",
+        ],
+        valueFlags: [
+            "--home", "--dashboard-url", "--cursor", "--limit",
+            "--name", "--description", "--file", "--color", "--request-id", "--expected-updated-at",
+        ],
+    });
+    const first = values.positionals[0];
+    const action = (first === undefined ? "list" : first);
+    if (!ACTIONS.includes(action)) {
+        throw new Error(`Unknown project command: ${first}. Try list, show, create, update, archive or restore.`);
+    }
+    const rest = values.positionals.slice(first === undefined ? 0 : 1);
+    const needsRef = action !== "list" && action !== "create";
+    if (needsRef && rest.length !== 1)
+        throw new Error(`project ${action} takes exactly one project id or name.`);
+    if (!needsRef && rest.length > 0)
+        throw new Error(`project ${action} does not take "${rest[0]}".`);
+    const given = (flag) => values.flags.has(flag);
+    const isWrite = WRITES.includes(action);
+    if (!isWrite && (given("--request-id") || given("--expected-updated-at"))) {
+        throw new Error("--request-id and --expected-updated-at belong to create, update, archive and restore.");
+    }
+    if (action !== "create" && action !== "update" && (given("--name") || given("--description") || given("--file"))) {
+        throw new Error("--name, --description and --file belong to project create and update.");
+    }
+    if (action !== "create" && given("--color"))
+        throw new Error("--color belongs to project create.");
+    if (action !== "list" && (given("--cursor") || given("--limit") || values.booleans.has("--archived"))) {
+        throw new Error("--archived, --cursor and --limit belong to project list.");
+    }
+    if (given("--description") && given("--file"))
+        throw new Error("Give --description or --file, not both.");
+    const requestId = optionalNonEmpty(values.flags.get("--request-id"));
+    if (requestId && !UUID_PATTERN.test(requestId))
+        throw new Error("--request-id must be a UUID.");
+    const expectedUpdatedAt = optionalNonEmpty(values.flags.get("--expected-updated-at"));
+    if (expectedUpdatedAt && Number.isNaN(Date.parse(expectedUpdatedAt))) {
+        throw new Error("--expected-updated-at must be the updated_at timestamp you last read.");
+    }
+    const name = optionalNonEmpty(values.flags.get("--name"));
+    if (action === "create" && !name)
+        throw new Error('project create needs --name "<name>".');
+    const rawDescription = values.flags.get("--description");
+    const description = rawDescription === undefined ? undefined : rawDescription.trim().toLowerCase() === "none" ? null : rawDescription;
+    const filePath = optionalNonEmpty(values.flags.get("--file"));
+    if (action === "update" && name === undefined && description === undefined && filePath === undefined) {
+        throw new Error("project update needs --name, --description (or none) or --file.");
+    }
+    return {
+        kind: "project",
+        action,
+        homeDir: optionalNonEmpty(values.flags.get("--home")),
+        dashboardUrl: optionalUrl(values.flags.get("--dashboard-url")),
+        includeArchived: values.booleans.has("--archived"),
+        ...(optionalNonEmpty(values.flags.get("--cursor")) ? { cursor: optionalNonEmpty(values.flags.get("--cursor")) } : {}),
+        ...(values.flags.has("--limit") ? { limit: optionalPositiveInteger(values.flags.get("--limit"), "--limit") } : {}),
+        ...(needsRef ? { ref: rest[0] } : {}),
+        ...(name === undefined ? {} : { name }),
+        ...(description === undefined ? {} : { description }),
+        ...(filePath === undefined ? {} : { filePath }),
+        ...(optionalNonEmpty(values.flags.get("--color")) ? { color: optionalNonEmpty(values.flags.get("--color")) } : {}),
+        ...(requestId ? { requestId } : {}),
+        ...(expectedUpdatedAt ? { expectedUpdatedAt } : {}),
+        json: values.booleans.has("--json"),
+    };
+}

package/dist/commands/project.js

@@ -1,20 +1,21 @@
 /**
- * `cockpit project list` — the projects issues are filed under (BLI-3716).
+ * `cockpit project list|show|create|update|archive|restore` — the projects issues are filed under
+ * (BLI-3716 list; BLI-21659 the rest).
  *
- * One verb, because `GET /api/work/projects` is the whole of the Work
- * surface's project door today (BLI-3703 scoped projects to list-only; there
- * is no create/update/delete route to put a terminal in front of). Its own
- * command rather than `cockpit issue projects` because a person says
- * "projects", and `cockpit issue list --project <name>` resolves a name
- * against exactly this list.
+ * Its own command rather than `cockpit issue projects` because a person says "projects", and
+ * `cockpit issue list --project <name>` resolves a name against exactly this list. Writes go through
+ * `/api/work/projects` (receipt, `tower_only` delivery: nothing reaches Linear); no verb deletes a project.
  */
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
 import { pageFieldsOf, pageFooter } from "./issue-list-page.js";
+import { readBody } from "./issue-contracts.js";
 const TAG = "[project cli]";
 const READ_DEADLINE_MS = 30_000;
 export async function runProject(command, io) {
     const door = await openAgentDoor("project", command, io);
+    if (command.action !== "list")
+        return await runProjectVerb(command, door);
     const params = new URLSearchParams();
     if (command.includeArchived)
         params.set("include_archived", "true");
@@ -47,4 +48,67 @@ export async function runProject(command, io) {
     if (footer)
         writeLine(door.io.stdout, footer);
     return 0;
+}
+async function runProjectVerb(command, door) {
+    const base = "/api/work/projects";
+    const ref = command.ref ? `${base}/${encodeURIComponent(command.ref)}` : base;
+    if (command.action === "show") {
+        const answer = await askAgentDoor(door, { path: ref, method: "GET", label: "project show", timeoutMs: READ_DEADLINE_MS });
+        if (!answer.ok)
+            return failAgentDoor(door, TAG, answer.reason, answer.detail);
+        const body = answer.body;
+        if (door.json)
+            return emitAgentDoor(door, { ok: true, ...body, ...pageFieldsOf(body) });
+        const project = body.project;
+        const out = door.io.stdout;
+        writeLine(out, `${project?.name ?? command.ref}  (${project?.archived_at ? "archived" : "active"}, ${project?.source ?? "native"})`);
+        writeLine(out, `id ${project?.id ?? ""}  updated ${project?.updated_at ?? ""}`);
+        if (project?.description)
+            writeLine(out, project.description);
+        for (const issue of body.issues ?? [])
+            writeLine(out, `${issue.identifier ?? ""}  ${issue.state ?? ""}  ${issue.title ?? ""}`);
+        const footer = pageFooter(body, "tickets");
+        if (footer)
+            writeLine(out, footer);
+        if (body.href)
+            writeLine(out, `Filtered list: ${body.href}`);
+        return 0;
+    }
+    const payload = {
+        ...(command.requestId ? { request_id: command.requestId } : {}),
+        ...(command.expectedUpdatedAt ? { expected_updated_at: command.expectedUpdatedAt } : {}),
+    };
+    if (command.action === "create" || command.action === "update") {
+        if (command.name !== undefined)
+            payload["name"] = command.name;
+        if (command.color !== undefined)
+            payload["color"] = command.color;
+        if (command.filePath) {
+            const read = await readBody({ filePath: command.filePath }, door.io);
+            if (!read.ok)
+                return failAgentDoor(door, TAG, read.reason, read.detail);
+            payload["description"] = read.text;
+        }
+        else if (command.description !== undefined) {
+            payload["description"] = command.description;
+        }
+    }
+    const path = command.action === "create" ? base : command.action === "update" ? ref : `${ref}/${command.action}`;
+    const answer = await askAgentDoor(door, {
+        path,
+        method: command.action === "update" ? "PATCH" : "POST",
+        label: `project ${command.action}`,
+        timeoutMs: READ_DEADLINE_MS,
+        body: payload,
+    });
+    if (!answer.ok) {
+        const mutation = answer.body?.mutation;
+        return failAgentDoor(door, TAG, answer.reason, answer.detail, mutation ? { mutation } : {});
+    }
+    const body = answer.body;
+    console.error(`${TAG} ${command.action} committed`, JSON.stringify({ project_id: body.project?.id, delivery: body.mutation?.delivery?.status }));
+    if (door.json)
+        return emitAgentDoor(door, { ok: true, project: body.project, mutation: body.mutation });
+    writeLine(door.io.stdout, `${command.action} committed: ${body.project?.name ?? ""} (${body.project?.id ?? ""}), delivery ${body.mutation?.delivery?.status ?? "tower_only"}.`);
+    return 0;
 }

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.242");
+    writeLine(io?.stdout ?? process.stdout, "0.2.244");
     return 0;
   }
 

package/dist/commands/search.js

@@ -26,6 +26,8 @@
  */
 import { askAgentDoor, emitAgentDoor, failAgentDoor, openAgentDoor, } from "./agent-door.js";
 import { writeLine } from "./cli-io.js";
+import { appendDocSearchParams } from "./docs-search-args.js";
+import { appendMsgSearchParams } from "./msg-search-args.js";
 const TAG = "[search cli]";
 const READ_DEADLINE_MS = 30_000;
 /** Group headings, in the order a person reads them. Mirrors the overlay. */
@@ -56,6 +58,12 @@ export async function runSearch(command, io) {
         params.set("kinds", command.kinds.join(","));
     if (command.limit !== undefined)
         params.set("limit", String(command.limit));
+    // BLI-21658: message filters ride the same door, which answers them only for kinds=msg.
+    if (command.msgFilters)
+        appendMsgSearchParams(params, command.msgFilters);
+    // BLI-21697: document filters ride the same door, which answers them only for kinds=doc.
+    if (command.docFilters)
+        appendDocSearchParams(params, command.docFilters);
     const answer = await askAgentDoor(door, {
         path: `/api/search?${params.toString()}`,
         method: "GET",
@@ -139,6 +147,21 @@ function render(door, body) {
             writeLine(door.io.stdout, `${KIND_LABELS[kind] ?? kind.toUpperCase()} did not answer (${reason}). Nothing from there is in this list.`);
         }
     }
+    // Named, so a filtered list is not read as the ranked, semantic one (BLI-21658).
+    if (body.degraded?.msg === "filtered_lexical_only") {
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, "MESSAGES were filtered: keyword matching only (filtered_lexical_only), newest first, not ranked.");
+        if (body.msgPaging?.hasMore && body.msgPaging.nextCursor) {
+            writeLine(door.io.stdout, `More messages exist: \`cockpit msg search ... --before ${body.msgPaging.nextCursor}\` continues with the same filters.`);
+        }
+    }
+    if (body.degraded?.doc === "filtered_lexical_only") {
+        writeLine(door.io.stdout, "");
+        writeLine(door.io.stdout, "DOCUMENTS were filtered: keyword matching only (filtered_lexical_only), not ranked by meaning.");
+        if (body.docCoverage && body.docCoverage.coverage !== "exhausted") {
+            writeLine(door.io.stdout, `Documents coverage: ${body.docCoverage.coverage}${body.docCoverage.reason ? ` (${body.docCoverage.reason})` : ""}; ${body.docCoverage.matched} matched.`);
+        }
+    }
     writeLine(door.io.stdout, "");
     writeLine(door.io.stdout, `${hits.length} result(s) in ${body.elapsedMs ?? 0} ms.`);
     return 0;

package/dist/commands/session-sync-failures.js

@@ -13,7 +13,7 @@
  * without saying why.
  */
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
-import { isDeliveryHoldReason } from "./session-sync-hold.js";
+import { budgetStarved, isDeliveryHoldReason } from "./session-sync-hold.js";
 import { sourceScanFailureReason } from "./session-sync-scan.js";
 /**
  * The label used when a sync fails and nothing on the way there said why.
@@ -55,8 +55,15 @@ export function createSyncFailureLedger() {
  * hold in `session-sync-hold.ts` and rides the same receipt — and a tick that
  * ALSO failed for a real reason still fails on that reason. Nothing is
  * silenced; only the verdict changed.
+ *
+ * Ticket 21952 does the same for the per-tick size budget. Overflow defers to the next tick by design, so a tick that
+ * sent something and held the rest reports a named hold (`held_budget:` in `session-sync-hold.ts`) instead of failing:
+ * one machine was RED on every tick from 2026-10-15 while it uploaded 2 GiB each time. Only a STARVED tick, one that
+ * deferred evidence and let nothing through, still fails `deferred_byte_budget` / `deferred_object_budget`. Without
+ * `budgetUse` (an older caller) the old rule stands: any deferral fails.
  */
-export function recordWorktreeDeliveryFailures(ledger, outcomes) {
+export function recordWorktreeDeliveryFailures(ledger, outcomes, budgetUse) {
+    const budgetHolds = budgetUse !== undefined && !budgetStarved(budgetUse);
     for (const outcome of outcomes) {
         recordWorktreeSyncFailure(ledger, outcome);
         const { sync } = outcome;
@@ -71,15 +78,21 @@ export function recordWorktreeDeliveryFailures(ledger, outcomes) {
         for (const reason of sync.raw_evidence_retry_reasons ?? []) {
             if (isDeliveryHoldReason(reason))
                 continue;
+            if (budgetHolds && isBudgetDeferralReason(reason))
+                continue;
             ledger.add({
                 label: "raw_evidence_retry_required",
                 rendered: `raw_evidence_retry:${reason}`,
             });
         }
-        ledger.fail(sync.raw_evidence_deferred_byte_budget > 0, "deferred_byte_budget");
-        ledger.fail(sync.raw_evidence_deferred_object_budget > 0, "deferred_object_budget");
+        ledger.fail(!budgetHolds && sync.raw_evidence_deferred_byte_budget > 0, "deferred_byte_budget");
+        ledger.fail(!budgetHolds && sync.raw_evidence_deferred_object_budget > 0, "deferred_object_budget");
     }
 }
+/** The two reasons the per-tick budget writes when it defers a file. Exact labels, never a pattern. */
+function isBudgetDeferralReason(reason) {
+    return reason === "deferred_byte_budget" || reason === "deferred_object_budget";
+}
 function recordWorktreeSyncFailure(ledger, { worktree, sync }) {
     if (sync.status === "uploaded")
         return;

package/dist/commands/session-sync-health.js

@@ -13,7 +13,7 @@ import { collectionRootLabel } from "./heartbeat.js";
 import { workDirectories } from "../root-work.js";
 import { createSyncFailureLedger, recordSourceScanFailures, recordUnexplainedFailure, recordUnpostedSessionReportFailure, recordWorktreeDeliveryFailures, } from "./session-sync-failures.js";
 import { countSessionsNewThisTick, countSessionsPendingUpload, } from "./session-sync-counters.js";
-import { logDeliveryHold, summarizeDeliveryHold } from "./session-sync-hold.js";
+import { logBudgetHold, logDeliveryHold, summarizeBudgetHold, summarizeDeliveryHold } from "./session-sync-hold.js";
 /**
  * Decide whether this tick failed, and record every condition that decided it.
  *
@@ -23,7 +23,7 @@ import { logDeliveryHold, summarizeDeliveryHold } from "./session-sync-hold.js";
 export function decideSyncHealth(options) {
     const { outcomes } = options.worktreePass;
     const ledger = createSyncFailureLedger();
-    recordWorktreeDeliveryFailures(ledger, outcomes);
+    recordWorktreeDeliveryFailures(ledger, outcomes, options.worktreePass.budgetUse);
     recordSourceScanFailures(ledger, options.scan);
     const sessionsOutsideRoot = options.sessions.filter((session) => OUTSIDE_APPROVED_ROOT_REASONS.has(session.attribution_reason)).length;
     const nothingInRoot = nothingInRootCount({
@@ -54,6 +54,10 @@ export function decideSyncHealth(options) {
     const hold = summarizeDeliveryHold(outcomes);
     if (hold && ok)
         logDeliveryHold(hold);
+    // Ticket 21952: the size-budget hold, said on every tick that has one, ok or not.
+    const budgetHold = summarizeBudgetHold(options.worktreePass.budgetUse);
+    if (budgetHold)
+        logBudgetHold(budgetHold);
     const records = ledger.sortedRecords();
     return {
         ok,
@@ -61,6 +65,7 @@ export function decideSyncHealth(options) {
         failure_records: records,
         notice,
         hold,
+        budgetHold,
         sessions_outside_root: sessionsOutsideRoot,
         outside_root_directories: workDirectories([...(options.scan.codexAttribution.results ?? []), ...(options.scan.claudeAttribution.results ?? [])].filter(result => OUTSIDE_APPROVED_ROOT_REASONS.has(result.reason)))
             .map(entry => ({ ...collectionRootLabel(entry.directory), count: entry.count }))

package/dist/commands/session-sync-hold.js

@@ -11,7 +11,7 @@
  * reads every `session-sync*.ts` sibling and demands that only the failure
  * ledger writes one, and this file is not it.
  */
-import { formatDeliveryHoldNotice, } from "../delivery-hold-notice.js";
+import { formatBudgetHoldNotice, formatDeliveryHoldNotice, } from "../delivery-hold-notice.js";
 import { DELIVERY_BACKOFF_HOLDING_REASON } from "../raw-evidence-staging.js";
 /**
  * Is this reason a delivery hold rather than a delivery failure?
@@ -87,4 +87,45 @@ export function logDeliveryHold(hold) {
         last_reason: hold.lastReason,
         next_action: "nothing until the next attempt is due; run `cockpit doctor` if it is already past",
     }));
+}
+/** The token's leading word, owned with its grammar by `delivery-hold-notice.ts` so the fleet board parses what this writes. */
+export { BUDGET_HOLD_NOTICE_PREFIX } from "../delivery-hold-notice.js";
+/** Reads the shared budget's counters, or null when the pass carried none. */
+export function budgetUseOf(budget) {
+    if (!budget)
+        return undefined;
+    return {
+        admittedBytes: budget.admittedBytes ?? 0,
+        admittedObjects: budget.admittedObjects ?? 0,
+        deferredBytes: budget.deferredBytes ?? 0,
+        deferredObjects: budget.deferredObjects ?? 0,
+    };
+}
+/**
+ * Did the budget hold anything back while still letting something through?
+ *
+ * The collector's design is that overflow defers and converges: the next tick starts with a fresh budget and picks up
+ * what this one held. A tick that admitted at least one object made progress, so what it deferred is a hold. A tick
+ * that deferred and admitted NOTHING made no progress at all, which stays a failure (`budgetStarved`).
+ */
+export function summarizeBudgetHold(use) {
+    if (!use || use.deferredObjects <= 0 || budgetStarved(use))
+        return null;
+    const notice = formatBudgetHoldNotice(use);
+    return notice ? { ...use, notice } : null;
+}
+/** True when the budget deferred evidence and let nothing through this tick. */
+export function budgetStarved(use) {
+    return Boolean(use && use.deferredObjects > 0 && use.admittedObjects === 0);
+}
+/** The run's line for a size-budget hold: bytes sent, bytes held, and that the next tick takes the rest. */
+export function logBudgetHold(hold) {
+    console.error("[session-sync] raw evidence held back by the per-tick size budget, the next tick takes the rest", JSON.stringify({
+        reason: hold.notice,
+        sent_bytes: hold.admittedBytes,
+        sent_objects: hold.admittedObjects,
+        held_bytes: hold.deferredBytes,
+        held_objects: hold.deferredObjects,
+        next_action: "none; the next tick starts with a fresh budget",
+    }));
 }

package/dist/commands/session-sync-outside-roots.js

@@ -22,7 +22,7 @@
  *
  *   - A session already durable with unchanged content rides for free. It
  *     uploads nothing (the object cursor reuses it) and keeps its row stable.
- *   - A session that is new, changed or not yet uploaded is "owed". The newest
+ *   - A session that is new, changed or not yet uploaded is "owed". The longest-waiting
  *     ones ride this tick up to a per-tick session cap. The rest wait, and their
  *     row says `deferred_object_budget`, the existing "next tick has room"
  *     label, instead of the old "not uploadable" one.
@@ -34,9 +34,9 @@
  *
  * The cap, the byte allowance and the object allowance are per tick, so a
  * 1,800-session backlog drains across many ticks and never blows one tick's
- * time or the machine's memory. Newest first: the sessions a person is most
- * likely to be waiting on summarise first, and a backlog of old ones never
- * starves today's.
+ * time or the machine's memory. A persisted retry order rotates offered
+ * sessions behind waiting ones,
+ * including when their source keeps growing.
  *
  * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
  */
@@ -45,12 +45,13 @@ import path from "node:path";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
 import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js";
 import { describeError } from "../health-detail.js";
-import { writeJsonFile } from "../local-state-files.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { isMissingFileError, writeJsonFileAtomic, writeJsonFile } from "../local-state-files.js";
 import { rootScopeForReason } from "./agent-session-root-scope.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 /** Most outside-root sessions that upload bytes in one tick. 4 ticks an hour, so up to 3,840 a day. */
 export const OUTSIDE_ROOT_SESSIONS_PER_TICK = 40;
-/** Redacted bytes an outside-root pass may stage in one tick, kept apart from the in-root allowance. */
+/** Normal outside-root byte allowance; a fresh allowance can admit one wire-bounded file. */
 export const OUTSIDE_ROOT_BYTES_PER_TICK = 256 * 1024 * 1024;
 /** Files (a Claude main plus its sidecars count one each) an outside-root pass may collect in one tick. */
 export const OUTSIDE_ROOT_OBJECTS_PER_TICK = 120;
@@ -165,7 +166,27 @@ export async function admitOutsideRootSessions(options) {
     if (sightings.length === 0) {
         return { ...scan, outsideRoots: null };
     }
-    const { admitted, holds, counts, budget } = selectOutsideRootSessions(sightings, plan);
+    const queuePath = path.join(getCollectorRuntimePaths(options.homeDir).cursors_dir, "outside-root-admission.json");
+    const turns = await readAdmissionTurns(queuePath);
+    const { admitted, holds, counts, budget } = selectOutsideRootSessions(sightings, plan, turns);
+    // Offered work rotates even on a later disk/delivery refusal. New arrivals
+    // join behind existing waiters; growth never resets a session's place.
+    const offered = new Set(admitted.map((sighting) => outsideRootKey(sighting.source, sighting.sessionId)));
+    const next = Object.values(turns).reduce((max, turn) => Math.max(max, turn), 0) + 1;
+    const pending = {};
+    for (const sighting of sightings) {
+        const key = outsideRootKey(sighting.source, sighting.sessionId);
+        if (isDurableAndUnchanged(sighting.result, (sighting.source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore).sessions[sighting.sessionId]) ||
+            sighting.result.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES)
+            continue;
+        pending[key] = offered.has(key) ? next + 1 : turns[key] ?? next;
+    }
+    try {
+        await writeJsonFileAtomic(queuePath, pending);
+    }
+    catch (error) {
+        console.error("[session-sync] outside-root admission order not saved", JSON.stringify({ reason: "admission_order_write_failed", ...describeError(error) }));
+    }
     if (admitted.length === 0) {
         console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "nothing_to_upload_outside_roots", ...counts, ...budget }));
         return { ...scan, outsideRoots: { workspace: null, holds, counts } };
@@ -203,7 +224,24 @@ export async function admitOutsideRootSessions(options) {
     console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
     return labelled;
 }
-function selectOutsideRootSessions(sightings, plan) {
+/** Session ids and queue turns only; no source paths or transcript content. */
+async function readAdmissionTurns(filePath) {
+    try {
+        const value = JSON.parse(await fs.readFile(filePath, "utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value) ||
+            Object.entries(value).some(([key, turn]) => !/^(codex|claude_code):/.test(key) || !Number.isSafeInteger(turn) || Number(turn) < 0)) {
+            throw new Error("invalid admission order");
+        }
+        return value;
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            console.error("[session-sync] outside-root admission order unavailable", JSON.stringify({ reason: "admission_order_read_failed", ...describeError(error) }));
+        }
+        return {};
+    }
+}
+function selectOutsideRootSessions(sightings, plan, turns) {
     const cursorFor = (source) => source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore;
     const free = [];
     const owed = [];
@@ -222,12 +260,28 @@ function selectOutsideRootSessions(sightings, plan) {
             owed.push(sighting);
         }
     }
-    // Newest first, with the session id as a tie-break so two ticks over the same
-    // files pick the same sessions.
-    owed.sort((left, right) => right.result.session_file_mtime_ms - left.result.session_file_mtime_ms ||
-        left.sessionId.localeCompare(right.sessionId));
-    const riding = owed.slice(0, OUTSIDE_ROOT_SESSIONS_PER_TICK);
-    const waiting = owed.slice(OUTSIDE_ROOT_SESSIONS_PER_TICK);
+    const newTurn = Object.values(turns).reduce((max, turn) => Math.max(max, turn), 0) + 1;
+    owed.sort((left, right) => (turns[outsideRootKey(left.source, left.sessionId)] ?? newTurn) -
+        (turns[outsideRootKey(right.source, right.sessionId)] ?? newTurn) ||
+        left.result.session_file_mtime_ms - right.result.session_file_mtime_ms ||
+        outsideRootKey(left.source, left.sessionId).localeCompare(outsideRootKey(right.source, right.sessionId)));
+    // A main larger than the normal allowance gets a turn without other owed sessions. Otherwise a
+    // smaller main (or the other provider's reader, which runs first) could fill
+    // staging before the existing empty-staging exception ever sees it.
+    const riding = [];
+    let bytes = 0;
+    for (const sighting of owed) {
+        if (riding.length >= OUTSIDE_ROOT_SESSIONS_PER_TICK)
+            break;
+        if (bytes + sighting.result.byte_size > OUTSIDE_ROOT_BYTES_PER_TICK) {
+            if (riding.length === 0)
+                riding.push(sighting);
+            break;
+        }
+        riding.push(sighting);
+        bytes += sighting.result.byte_size;
+    }
+    const waiting = owed.slice(riding.length);
     for (const sighting of waiting) {
         holds.set(outsideRootKey(sighting.source, sighting.sessionId), OUTSIDE_ROOT_WAITING_REASON);
     }
@@ -273,6 +327,10 @@ export function applyOutsideRootHolds(rows, holds) {
  * description session stay shared (they live on the same budget object).
  */
 export function giveOutsideRootsTheirOwnAllowance(budget) {
+    budget.singleFileByteAllowance = {
+        normalBytes: OUTSIDE_ROOT_BYTES_PER_TICK,
+        maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
+    };
     budget.remainingBytes = OUTSIDE_ROOT_BYTES_PER_TICK;
     budget.remainingObjects = OUTSIDE_ROOT_OBJECTS_PER_TICK;
 }

package/dist/commands/session-sync-upload.js

@@ -13,6 +13,7 @@ import { liveSyncTargetKey, liveSyncTargetWorktrees, matchesLiveSyncWorktree, }
 import { isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
 import { giveOutsideRootsTheirOwnAllowance, outsideRootsLast, } from "./session-sync-outside-roots.js";
 import { runYieldingAtBoundaries } from "./sync-yield.js";
+import { budgetUseOf } from "./session-sync-hold.js";
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
 /**
@@ -54,6 +55,7 @@ export async function syncEveryTargetWorktree(options) {
         claudePriorDurablePointers: claudeDurablePointersFromCursor(options.plan.claudeCursorBefore),
         growthDampedSessionCount: dampedClaudePointers.size,
         yieldedWorktreesLeft: loop.left,
+        budgetUse: budgetUseOf(rawEvidenceBudget),
     };
 }
 function syncTargetWithAllowance(options, worktree, syncWorktrees, rawEvidenceBudget, discoveredWorktreeKeys, dampedClaudePointers) {

package/dist/commands/session-sync.js

@@ -190,6 +190,7 @@ async function finishAttributedSync(options, context) {
         failure_records: health.failure_records,
         notice: health.notice,
         hold: health.hold,
+        budgetHold: health.budgetHold ?? null,
         yielded_worktrees_left: worktreePass.yieldedWorktreesLeft,
         sessions_observed: sessions.length,
         sessions_outside_root: health.sessions_outside_root,