@bli-cockpit/cli 0.2.243 → 0.2.244

package/dist/adapters/raw-evidence-budget-admission.js

@@ -0,0 +1,63 @@
+import { terminalDeliveryReason } from "../raw-evidence-staging.js";
+import { admitToStaging } from "../staging-gate.js";
+/**
+ * The one door a file passes before its bytes may be copied: the per-sync
+ * budget below, then the disk (BLI-12832). A refusal from the disk hands the
+ * budget back, because nothing was staged and the next tick re-reads the source.
+ * A copy already staged costs the disk nothing and is never refused by it.
+ */
+export function admitEvidence(collection, byteLength, file) {
+    // Ticket 21952: a copy staged on an earlier tick is queued, not new bytes; re-charging it let a backlog use up the
+    // byte budget every tick. It still costs one object, and its upload resumes from the chunks the server holds.
+    const alreadyStaged = collection.staging.staged[file.contentHash] !== undefined;
+    const charged = alreadyStaged ? 0 : byteLength;
+    const budgetReason = admitToBudget(collection.budget, charged);
+    if (budgetReason)
+        return budgetReason;
+    const allowance = collection.budget.staging;
+    if (!allowance)
+        return null;
+    // BLI-12832: bytes the server refused for good are reclaimed by the prune
+    // (the refusal stays as a receipt), so copying them again would be churn.
+    if (!alreadyStaged &&
+        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
+        refundBudget(collection.budget, charged);
+        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
+        return "delivery_terminal_refused";
+    }
+    const diskReason = admitToStaging(allowance, byteLength, {
+        alreadyStaged,
+        kind: file.kind,
+    });
+    if (!diskReason)
+        return null;
+    refundBudget(collection.budget, charged);
+    return `staging_deferred:${diskReason}`;
+}
+/** Hands back one admission that a later gate refused, so nothing was staged and nothing counts as sent. */
+function refundBudget(budget, byteLength) {
+    budget.remainingObjects += 1;
+    budget.remainingBytes += byteLength;
+    budget.admittedBytes = Math.max(0, (budget.admittedBytes ?? 0) - byteLength);
+    budget.admittedObjects = Math.max(0, (budget.admittedObjects ?? 0) - 1);
+}
+/**
+ * Decrements the per-sync budget when a file fits, or returns a deferred-skip
+ * reason when it does not. The object budget bounds request count; the byte
+ * budget bounds buffered bytes.
+ */
+export function admitToBudget(budget, byteLength) {
+    const single = budget.singleFileByteAllowance;
+    const firstLargeFile = single && budget.remainingBytes === single.normalBytes &&
+        byteLength <= single.maxFileBytes;
+    const reason = budget.remainingObjects <= 0 ? "deferred_object_budget" :
+        byteLength > 0 && byteLength > budget.remainingBytes && !firstLargeFile ? "deferred_byte_budget" : null;
+    if (reason) {
+        [budget.deferredObjects, budget.deferredBytes] = [(budget.deferredObjects ?? 0) + 1, (budget.deferredBytes ?? 0) + byteLength];
+        return reason;
+    }
+    budget.remainingObjects -= 1;
+    budget.remainingBytes -= byteLength;
+    [budget.admittedBytes, budget.admittedObjects] = [(budget.admittedBytes ?? 0) + byteLength, (budget.admittedObjects ?? 0) + 1];
+    return null;
+}

package/dist/adapters/raw-evidence-collection-state.js

@@ -7,13 +7,14 @@
  * contract, so `raw-evidence-completeness.ts` can read and write them without
  * knowing about packs, budgets or disks.
  *
- * Two mechanics live here rather than in any one reader, because the Codex
+ * Two mechanics are exposed here rather than in any one reader, because the Codex
  * reader, the Claude reader, the image reader and the git-diff reader all spend
  * them:
  *
  * - **`admitToBudget`** — the per-sync byte and object budget (D7b),
  *   decremented in place so one `cockpit sync` across many worktrees honours
- *   one cap.
+ *   one cap. Admission and disk-refusal refunds live together in
+ *   `raw-evidence-budget-admission.ts`; the exports here keep reader APIs stable.
  * - **`stageEvidenceBytes`** — bytes go on disk exactly once; content an
  *   earlier sync already staged is adopted rather than copied again.
  *
@@ -26,8 +27,8 @@ import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core"
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, terminalDeliveryReason, } from "../raw-evidence-staging.js";
-import { admitToStaging, openStagingAllowance, } from "../staging-gate.js";
+import { DELIVERY_BACKOFF_BYPASS_REASON, deliveryBackoffApplies, heldSourceKeys, readRawEvidenceStagingState, resolveStagedObject, } from "../raw-evidence-staging.js";
+import { openStagingAllowance, } from "../staging-gate.js";
 import { chmodPrivate } from "./raw-evidence-pack-store.js";
 import { GIT_DIFF_TIMEOUT_MS, MAX_GIT_DIFF_BYTES, } from "./raw-evidence-git-diff.js";
 export const DEFAULT_SINCE_MINUTES = 24 * 60;
@@ -201,60 +202,4 @@ export async function stageEvidenceBytes(collection, options) {
     collection.stagedNewCount += 1;
     return { local_path: destination, staged_in_pack: true };
 }
-/**
- * The one door a file passes before its bytes may be copied: the per-sync
- * budget below, then the disk (BLI-12832). A refusal from the disk hands the
- * budget back, because nothing was staged and the next tick re-reads the source.
- * A copy already staged costs the disk nothing and is never refused by it.
- */
-export function admitEvidence(collection, byteLength, file) {
-    // Ticket 21952: a copy staged on an earlier tick is queued, not new bytes; re-charging it let a backlog use up the
-    // byte budget every tick. It still costs one object, and its upload resumes from the chunks the server holds.
-    const alreadyStaged = collection.staging.staged[file.contentHash] !== undefined;
-    const charged = alreadyStaged ? 0 : byteLength;
-    const budgetReason = admitToBudget(collection.budget, charged);
-    if (budgetReason)
-        return budgetReason;
-    const allowance = collection.budget.staging;
-    if (!allowance)
-        return null;
-    // BLI-12832: bytes the server refused for good are reclaimed by the prune
-    // (the refusal stays as a receipt), so copying them again would be churn.
-    if (!alreadyStaged &&
-        terminalDeliveryReason(collection.staging.delivery_attempts[file.contentHash]?.last_reason)) {
-        refundBudget(collection.budget, charged);
-        console.error("[staging-gate] not copying bytes the server refused for good", JSON.stringify({ reason: "delivery_terminal_refused", kind: file.kind, file_bytes: byteLength }));
-        return "delivery_terminal_refused";
-    }
-    const diskReason = admitToStaging(allowance, byteLength, {
-        alreadyStaged,
-        kind: file.kind,
-    });
-    if (!diskReason)
-        return null;
-    refundBudget(collection.budget, charged);
-    return `staging_deferred:${diskReason}`;
-}
-/** Hands back one admission that a later gate refused, so nothing was staged and nothing counts as sent. */
-function refundBudget(budget, byteLength) {
-    budget.remainingObjects += 1;
-    budget.remainingBytes += byteLength;
-    budget.admittedBytes = Math.max(0, (budget.admittedBytes ?? 0) - byteLength);
-    budget.admittedObjects = Math.max(0, (budget.admittedObjects ?? 0) - 1);
-}
-/**
- * Decrements the per-sync budget when a file fits, or returns a deferred-skip
- * reason when it does not. The object budget bounds request count; the byte
- * budget bounds buffered bytes.
- */
-export function admitToBudget(budget, byteLength) {
-    const reason = budget.remainingObjects <= 0 ? "deferred_object_budget" : byteLength > budget.remainingBytes ? "deferred_byte_budget" : null;
-    if (reason) {
-        [budget.deferredObjects, budget.deferredBytes] = [(budget.deferredObjects ?? 0) + 1, (budget.deferredBytes ?? 0) + byteLength];
-        return reason;
-    }
-    budget.remainingObjects -= 1;
-    budget.remainingBytes -= byteLength;
-    [budget.admittedBytes, budget.admittedObjects] = [(budget.admittedBytes ?? 0) + byteLength, (budget.admittedObjects ?? 0) + 1];
-    return null;
-}
+export { admitEvidence, admitToBudget } from "./raw-evidence-budget-admission.js";

package/dist/commands/local-args-collector-sources.js

@@ -9,7 +9,7 @@
 import { optionalNonEmpty, optionalPositiveInteger, optionalUrl, parseNamedArgs, } from "./local-arg-values.js";
 export function parseSourcesArgs(args) {
     const values = parseNamedArgs(args, {
-        allowedFlags: ["--older-than", "--home", "--dashboard-url", "--json"],
+        allowedFlags: ["--older-than", "--home", "--dashboard-url", "--json", "--reconcile"],
         valueFlags: ["--older-than", "--home", "--dashboard-url"],
     });
     const action = values.positionals[0] ?? "check";
@@ -17,6 +17,7 @@ export function parseSourcesArgs(args) {
         throw new Error("sources has one verb: `cockpit sources check [--older-than <days>] [--json]`.");
     }
     return {
+        reconcile: values.booleans.has("--reconcile"),
         kind: "sources",
         action: "check",
         olderThanDays: optionalPositiveInteger(values.flags.get("--older-than"), "--older-than") ?? null,

package/dist/commands/local-help-commands-tower-ops.js

@@ -226,10 +226,10 @@ export const TOWER_OPS_COMMAND_HELP = [
             "                                               \"YYYY-MM-DD: \" dates a bullet, without it the bullet is undated. none clears --next or --blocker. blocked needs a blocker (given, or already on the card),",
             "                                               and a blocker goes only on a Blocked card: sent with any other health it is refused (summary_blocker_needs_blocked); sending only a new health drops the stored one.",
             "                                               --version is summary.updatedAt from `home <client> --json`, or none when the client has no card yet (then --health, --headline and at least one --bullet are all needed).",
-            "                                               Limits: headline 140 characters, each bullet 160, next and blocker 200; a longer text is refused here with its length. A day spelled with a month name at the start of a bullet (\"Oct 3: x\") is refused, never saved undated. --version none is for a client with no card: on one that has a card the write is refused with \"This client already has a card: pass its version\". The edit is marked as yours and stands until the client's",
-            "                                               data changes, an action goes overdue or an open action passes 14 days overdue; the next check after that writes the card again (newest wins).",
+            "                                               Limits: headline 140 characters, each bullet 160, next and blocker 200; a longer text is refused here with its length. A day spelled with a month name at the start of a bullet (\"Oct 3: x\") is refused, never saved undated. --version none is for a client with no card: on one that has a card the write is refused with \"This client already has a card: pass its version\". The edit is stored as written by your agent",
+            "                                               (source agent, \"Written by <you>'s agent\"): Tower's check never rewrites it, whatever changes; your agent's next edit, or a person's on the page, replaces it.",
             "                                               A saved card that says On track while an open action is more than 14 days overdue is saved anyway and prints a \"Warning: ...\" line naming the action overdue longest.",
-            "                                               Write the card after your item writes: your own later item writes count as data changes, and the next check rewrites the card.",
+            "                                               Write the card after your item writes: the check will not rewrite it to take them in.",
             "                                               Health rule: an open action more than 14 days overdue, as `cockpit manager home` shows it (Tower's today, America/Vancouver), means the card is at_risk (or blocked, with a named blocker).",
             "                                               Do not set on_track over one; tell the person instead. The headline or a bullet must name the action overdue longest, with the day it was due.",
             "  cockpit manager list <client> [--timeline] [--needs-review] [--status open|done|dropped|closed|all] [--owner <name>|--no-owner] [--overdue] [--kind <kind>] [--search <text>] [--archived] [--review dismissed|all]",
@@ -261,7 +261,7 @@ export const TOWER_OPS_COMMAND_HELP = [
             "                                               --version and --timeline stay flags. A field given as a flag and in the file is refused, so is an unknown key. The file gets the flags' own checks. Example:  cat fields.json | cockpit manager summary Acme --version none --fields-file -",
             "Free text (the flags above and every value in a fields file) that holds a provider key (an sk-, rk_, sb_secret_, ghp_, github_pat_, AKIA/ASIA, xoxb- key, any JWT, a PEM private key) or a password given a value (\"password: x\") is refused, naming the flag or key; ordinary words, a commit sha, a URL and the words \"service-role key\" are plain text.",
             "On a flag, free text (--headline, --bullet, --title, --detail, --next, --blocker, --owners, --source-note) goes in SINGLE quotes so the shell leaves $ alone: \"$12k\" in double quotes loses the $12k (zsh and bash read it as a variable). In bash and zsh write an apostrophe inside single quotes as '\\'' (end the quote, a backslash-escaped apostrophe, reopen); in PowerShell double the apostrophe ('Rowan''s deck'). The command prints what it saved: check it is your words.",
-            "<client> is the client's id, or its exact name (any case; `clients` lists them); a name that matches no client, or several, is refused with the names. Ids and versions are printed by list, queue and show. Items you add are reviewed already.",
+            "<client> is the client's id, or its exact name (any case; `clients` lists them); a name that matches no client, or several, is refused with the names. Ids and versions are printed by list, queue and show. Items you add here are stored as added by your agent, not yet checked (they count in needs review until a person approves or dismisses them), never as you having checked them; text tagged [HR] is refused (item_hr_tagged, summary_hr_tagged).",
             "--version is the item's version exactly as list or show prints it, copied as it is. Every change to an existing item names it: if someone or a sync changed the item",
             "since, the write is refused with a sentence saying so and nothing is written; run show again for the new version and retry.",
             "--owners on an action takes, as the web form says, \"One or more people, separated by commas\" (\"Rowan Ash, Juniper Twig\"), and it REPLACES the whole list. Leave it out and the owners stay;",

package/dist/commands/local-help-commands.js

@@ -386,7 +386,9 @@ const COMMAND_HELP = new Map([
     [
         "sources",
         [
-            "Usage: cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
+            "Usage: cockpit sources check [--reconcile] [--older-than <days>] [--dashboard-url <url>] [--json]",
+            "",
+            "--reconcile adds read-only source-row, pointer and revision metadata checks; never collects or repairs.",
             "",
             "Answers, for every Codex and Claude transcript on this machine, whether Tower",
             "holds it: stored in full, stored in part, or not stored, with the reason.",

package/dist/commands/local-help.js

@@ -140,7 +140,7 @@ const COMMAND_SUMMARY_LINES = [
     "  cockpit agent-rules [install|uninstall|status] [--host codex|claude|all] [--workspace <path>] [--json]",
     "  cockpit memory [search \"<question>\"|save|update <id>|forget <id>|profile|install|status|log <win|loss|noise> --store <bli|supermemory|both> \"<reason>\"] [--container <tag>] [--limit <n>] [--no-recent] [--include-originals|--no-originals] [--include-source|--no-source] [--custom-id <id>] [--extract] [--content-stdin] [--reason <label>] [--file <path>] [--dashboard-url <url>] [--dry-run] [--json]",
     "  cockpit clean [--dry-run] [--all-committed] [--reconcile] [--dashboard-url <url>] [--json]",
-    "  cockpit sources check [--older-than <days>] [--dashboard-url <url>] [--json]",
+    "  cockpit sources check [--reconcile] [--older-than <days>] [--dashboard-url <url>] [--json]",
     "  cockpit docs [list|tree|read <id|slug>|create --title <t>|update <id>|delete <id|slug>|trash|versions <id|slug>|restore <id>] [--parent <id>|root|--clear-parent] [--query <text> [--word]] [--limit <n>] [--visibility org|private] [--file <path>|--body-stdin] [--allow-empty] [--dashboard-url <url>] [--json]",
     "  cockpit msg [channels|create <name>|dm <email>|read <channel>|send <channel>|thread <id> --channel <channel>|show <message-id>] [--private] [--members a@x,b@y] [--description <text>] [--thread <id>] [--limit <n>] [--before <cursor>] [--dashboard-url <url>] [--json]",
     "  cockpit issue [list|show <BLI-id>|create --title <t>|update <BLI-id>|move <BLI-id> <state>|comment <BLI-id>|history <BLI-id>] [--state <s>] [--assignee me|unassigned|<uuid>] [--project <name|id>] [--limit <n>] [--priority 0-4] [--size S|M|L] [--parent <BLI-id>] [--file <path>|--body-stdin] [--dashboard-url <url>] [--json]",

package/dist/commands/manager-hints.js

@@ -20,7 +20,7 @@ const L = MANAGER_LIMITS_COPY;
 export const SUMMARY_REFUSAL_NAMES = [
     "summary_changed", "summary_empty", "summary_incomplete", "summary_health_invalid", "summary_headline_empty", "summary_headline_too_long",
     "summary_bullets_count", "summary_bullet_empty", "summary_bullet_too_long", "summary_bullet_date_invalid", "summary_next_too_long",
-    "summary_blocker_too_long", "summary_blocked_needs_blocker", "summary_blocker_needs_blocked",
+    "summary_blocker_too_long", "summary_blocked_needs_blocker", "summary_blocker_needs_blocked", "summary_hr_tagged",
 ];
 /** The way forward after each named refusal of a "Where we are" edit; `home` is the ready-to-run `cockpit manager home <client> --json`. */
 export function summaryHints(home) {
@@ -40,11 +40,12 @@ export function summaryHints(home) {
         summary_blocker_too_long: `Shorten --blocker (the limit is ${L.blockerMax}).`,
         summary_blocked_needs_blocker: "Add --blocker <what blocks it>, or pass another --health.",
         summary_blocker_needs_blocked: "Add --health blocked, or leave --blocker out (`--blocker none` clears the stored one).",
+        summary_hr_tagged: "Run the summary again without the tagged text; that part stays out of Tower.",
     };
 }
 export const ITEM_REFUSAL_NAMES = [
     "item_changed", "item_busy", "item_archived", "item_not_archived", "item_dismissed", "person_item_not_dismissable",
-    "no_proposal", "proposal_replaced", "timeline_not_live", "request_reused", "proposal_decided", "proposal_not_addable",
+    "no_proposal", "proposal_replaced", "timeline_not_live", "request_reused", "proposal_decided", "proposal_not_addable", "item_hr_tagged",
 ];
 /** Refusals that mean "the item is not as you last saw it": reading it again is the way forward. */
 export const RESEEN_REFUSALS = new Set(["item_changed", "item_busy", "proposal_decided", "no_proposal"]);
@@ -65,6 +66,7 @@ export function itemHints(id, flag) {
         person_item_not_dismissable: `Run \`cockpit manager archive ${id}${flag} --version <v>\`.`,
         timeline_not_live: "`cockpit manager list <client> --timeline` lists the client's live timeline items.",
         item_not_archived: "Nothing to bring back: it is in the lists already.",
+        item_hr_tagged: "Run the add or edit again without the tagged text; that part stays out of Tower.",
     };
 }
 /**

package/dist/commands/manager-limits.json

@@ -146,13 +146,15 @@
       "summary_next_too_long",
       "summary_blocker_too_long",
       "summary_blocked_needs_blocker",
-      "summary_blocker_needs_blocked"
+      "summary_blocker_needs_blocked",
+      "summary_hr_tagged"
     ],
     "item": [
       "item_archived",
       "item_busy",
       "item_changed",
       "item_dismissed",
+      "item_hr_tagged",
       "item_not_archived",
       "no_proposal",
       "person_item_not_dismissable",

package/dist/commands/manager-read-reasons.js

@@ -51,6 +51,7 @@ export const SUMMARY_REFUSAL_WORDS = {
     summary_blocker_too_long: "the blocker was over 200 characters",
     summary_blocked_needs_blocker: "blocked with no blocker",
     summary_blocker_needs_blocked: "a blocker on a card that is not blocked",
+    summary_hr_tagged: "text tagged [HR]",
 };
 /** Why a summary check kept the card that was there instead of writing one (the receipt's `kept_reason`), in words. */
 export const SUMMARY_KEPT_WORDS = {

package/dist/commands/manager-render-home.js

@@ -83,13 +83,14 @@ export function withTodayLine(rows, dates, today) {
     const line = [todayLine(today)];
     return at === -1 ? [...rows, line] : [...rows.slice(0, at), line, ...rows.slice(at)];
 }
-/** Who wrote the card, by its `source`: the credit's opening words (the day follows; a person's name comes after "Edited by"). */
+/** Who wrote the card, by its `source`: the credit's opening words (the day follows; a person's name comes after "Edited by" and "Written by", then "'s agent" for the agent's card). */
 export const SUMMARY_SOURCE_WORDS = {
     model: "Written by AI",
     computed: "AI unavailable · computed from counts",
     person: "Edited by",
+    agent: "Written by",
 };
-/** Who wrote the card and when: "written by AI", "computed from counts", or "edited by" a person. */
+/** Who wrote the card and when: "written by AI", "computed from counts", "edited by" a person, or "written by" a person's agent. */
 function authorLine(summary, now) {
     // The server's own Vancouver day when it sends one; never worked out here when it did.
     const at = summary.writtenOn ? `${dayWords(summary.writtenOn)} (${ageText(summary.writtenAt, now)})` : when(summary.writtenAt, now);
@@ -98,6 +99,8 @@ function authorLine(summary, now) {
     if (summary.source === "computed")
         return `${SUMMARY_SOURCE_WORDS.computed}, ${at}.`;
     // Never a user id in a person's terminal: the door fills the name, or says "a teammate".
+    if (summary.source === "agent")
+        return `${SUMMARY_SOURCE_WORDS.agent} ${summary.editedByName ?? "a teammate"}'s agent, ${at}.`;
     return `${SUMMARY_SOURCE_WORDS.person} ${summary.editedByName ?? "a teammate"}, ${at}.`;
 }
 const CAP_WORDS = {
@@ -169,8 +172,11 @@ function summaryLines(home, now, color) {
         if (checked !== null && Number.isFinite(new Date(checked).getTime()))
             lines.push(`  Last checked ${ageText(checked, now)}.`);
     }
-    if (summary.inputsChanged && !summary.lastCheckFailed)
-        lines.push("  Inputs changed since: the client's data changed, an action went overdue or an open action passed 14 days overdue (for an AI-written card, also a meeting or milestone came within a week or passed) after this was written; the next check writes it again.");
+    if (summary.inputsChanged && !summary.lastCheckFailed) {
+        lines.push(summary.source === "agent"
+            ? "  Inputs changed since: the client's data changed, an action went overdue or an open action passed 14 days overdue after this was written; Tower's check leaves the agent's card, so the agent or a person writes it again."
+            : "  Inputs changed since: the client's data changed, an action went overdue or an open action passed 14 days overdue (for an AI-written card, also a meeting or milestone came within a week or passed) after this was written; the next check writes it again.");
+    }
     lines.push(counts, dim(`  version ${summary.updatedAt} (what \`summary --version\` takes)`, color));
     return lines;
 }
@@ -378,7 +384,9 @@ export function summaryWrittenLines(summary, color, now = new Date()) {
         lines.push(`  Next: ${summary.next}`);
     if (summary.blocker)
         lines.push(`  Blocker: ${summary.blocker}`);
-    lines.push(`  ${authorLine(summary, now)} It stands until the client's data changes, an action goes overdue or an open action passes 14 days overdue; the next check after that writes it again.`);
+    lines.push(summary.source === "agent"
+        ? `  ${authorLine(summary, now)} Tower's check never rewrites it; your agent's next edit, or a person's on the page, replaces it.`
+        : `  ${authorLine(summary, now)} It stands until the client's data changes, an action goes overdue or an open action passes 14 days overdue; the next check after that writes it again.`);
     lines.push(dim(`  version ${summary.updatedAt}`, color));
     return lines;
 }

package/dist/commands/manager-render.js

@@ -149,6 +149,9 @@ export function handledByLines(item, timeline) {
     const human = item.origin === "human";
     if (human && item.createdBy)
         lines.push(`Added by ${person(item.createdByName)}${onDay(item.createdAt)}.`);
+    // An AI item with a creator is a person's agent's add through the door (BLI-21947); the model's own have none.
+    if (!human && item.createdBy)
+        lines.push(`Added by ${person(item.createdByName)}'s agent${onDay(item.createdAt)}${item.reviewStatus === "unreviewed" ? "; not checked yet" : ""}.`);
     if (item.reviewStatus === "rejected" && item.reviewedBy)
         lines.push(`Dismissed by ${person(item.reviewedByName)}${onDay(item.reviewedAt)}.`);
     else if (item.reviewedBy && item.reviewStatus === "reviewed") {

package/dist/commands/manager.js

@@ -144,6 +144,8 @@ function renderAnswer(command, body, color) {
 }
 /** An add answered `created: false`: the same request id came back, so the item that already existed is returned. */
 const ALREADY_ADDED = "Already added earlier under this request id; nothing new was written.";
+/** An add the server stored as the caller's agent's, unchecked (BLI-21947); an older server's reviewed add says nothing more. */
+const addedUnchecked = (body) => body.item?.reviewStatus === "unreviewed" ? " Stored as added by your agent, not yet checked: a person approves or dismisses it." : "";
 /** What a write did, in one sentence a person reads; the item's new version follows on its row. */
 function writeSentence(command, body) {
     const as = "as you";
@@ -152,7 +154,7 @@ function writeSentence(command, body) {
     const queue = waiting === 0 ? "It leaves the review queue." : `${waiting === 1 ? "Its other suggested change still waits" : `Its ${waiting} other suggested changes still wait`} in the review queue.`;
     switch (command.action) {
         // Only an explicit `created: false` is "not created": an older server sends no field, and that add did write.
-        case "add": return body.created === false ? [ALREADY_ADDED] : [command.timeline && !command.occurredAt ? "Added. It has no date, so it sits in \"Needs a date\"." : "Added."];
+        case "add": return body.created === false ? [ALREADY_ADDED] : [`${command.timeline && !command.occurredAt ? "Added. It has no date, so it sits in \"Needs a date\"." : "Added."}${addedUnchecked(body)}`];
         // Railway writes nothing when every field already equals the stored one: no new version, no reviewed mark.
         case "edit": return [body.unchanged === true ? "No change; nothing was written." : "Saved your changes."];
         // Railway writes nothing when the action already has that status, so its version comes back unchanged.

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.243");
+    writeLine(io?.stdout ?? process.stdout, "0.2.244");
     return 0;
   }
 

package/dist/commands/session-sync-outside-roots.js

@@ -22,7 +22,7 @@
  *
  *   - A session already durable with unchanged content rides for free. It
  *     uploads nothing (the object cursor reuses it) and keeps its row stable.
- *   - A session that is new, changed or not yet uploaded is "owed". The newest
+ *   - A session that is new, changed or not yet uploaded is "owed". The longest-waiting
  *     ones ride this tick up to a per-tick session cap. The rest wait, and their
  *     row says `deferred_object_budget`, the existing "next tick has room"
  *     label, instead of the old "not uploadable" one.
@@ -34,9 +34,9 @@
  *
  * The cap, the byte allowance and the object allowance are per tick, so a
  * 1,800-session backlog drains across many ticks and never blows one tick's
- * time or the machine's memory. Newest first: the sessions a person is most
- * likely to be waiting on summarise first, and a backlog of old ones never
- * starves today's.
+ * time or the machine's memory. A persisted retry order rotates offered
+ * sessions behind waiting ones,
+ * including when their source keeps growing.
  *
  * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
  */
@@ -45,12 +45,13 @@ import path from "node:path";
 import { RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES } from "@bli-cockpit/telemetry-core";
 import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js";
 import { describeError } from "../health-detail.js";
-import { writeJsonFile } from "../local-state-files.js";
+import { getCollectorRuntimePaths } from "../local-state.js";
+import { isMissingFileError, writeJsonFileAtomic, writeJsonFile } from "../local-state-files.js";
 import { rootScopeForReason } from "./agent-session-root-scope.js";
 import { ensureOutsideRootsWorkspace, isOutsideRootsWorkspace, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
 /** Most outside-root sessions that upload bytes in one tick. 4 ticks an hour, so up to 3,840 a day. */
 export const OUTSIDE_ROOT_SESSIONS_PER_TICK = 40;
-/** Redacted bytes an outside-root pass may stage in one tick, kept apart from the in-root allowance. */
+/** Normal outside-root byte allowance; a fresh allowance can admit one wire-bounded file. */
 export const OUTSIDE_ROOT_BYTES_PER_TICK = 256 * 1024 * 1024;
 /** Files (a Claude main plus its sidecars count one each) an outside-root pass may collect in one tick. */
 export const OUTSIDE_ROOT_OBJECTS_PER_TICK = 120;
@@ -165,7 +166,27 @@ export async function admitOutsideRootSessions(options) {
     if (sightings.length === 0) {
         return { ...scan, outsideRoots: null };
     }
-    const { admitted, holds, counts, budget } = selectOutsideRootSessions(sightings, plan);
+    const queuePath = path.join(getCollectorRuntimePaths(options.homeDir).cursors_dir, "outside-root-admission.json");
+    const turns = await readAdmissionTurns(queuePath);
+    const { admitted, holds, counts, budget } = selectOutsideRootSessions(sightings, plan, turns);
+    // Offered work rotates even on a later disk/delivery refusal. New arrivals
+    // join behind existing waiters; growth never resets a session's place.
+    const offered = new Set(admitted.map((sighting) => outsideRootKey(sighting.source, sighting.sessionId)));
+    const next = Object.values(turns).reduce((max, turn) => Math.max(max, turn), 0) + 1;
+    const pending = {};
+    for (const sighting of sightings) {
+        const key = outsideRootKey(sighting.source, sighting.sessionId);
+        if (isDurableAndUnchanged(sighting.result, (sighting.source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore).sessions[sighting.sessionId]) ||
+            sighting.result.byte_size > RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES)
+            continue;
+        pending[key] = offered.has(key) ? next + 1 : turns[key] ?? next;
+    }
+    try {
+        await writeJsonFileAtomic(queuePath, pending);
+    }
+    catch (error) {
+        console.error("[session-sync] outside-root admission order not saved", JSON.stringify({ reason: "admission_order_write_failed", ...describeError(error) }));
+    }
     if (admitted.length === 0) {
         console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "nothing_to_upload_outside_roots", ...counts, ...budget }));
         return { ...scan, outsideRoots: { workspace: null, holds, counts } };
@@ -203,7 +224,24 @@ export async function admitOutsideRootSessions(options) {
     console.error("[session-sync] outside-root raw upload", JSON.stringify({ reason: "outside_root_sessions_admitted", ...counts, ...budget }));
     return labelled;
 }
-function selectOutsideRootSessions(sightings, plan) {
+/** Session ids and queue turns only; no source paths or transcript content. */
+async function readAdmissionTurns(filePath) {
+    try {
+        const value = JSON.parse(await fs.readFile(filePath, "utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value) ||
+            Object.entries(value).some(([key, turn]) => !/^(codex|claude_code):/.test(key) || !Number.isSafeInteger(turn) || Number(turn) < 0)) {
+            throw new Error("invalid admission order");
+        }
+        return value;
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            console.error("[session-sync] outside-root admission order unavailable", JSON.stringify({ reason: "admission_order_read_failed", ...describeError(error) }));
+        }
+        return {};
+    }
+}
+function selectOutsideRootSessions(sightings, plan, turns) {
     const cursorFor = (source) => source === "codex" ? plan.codexCursorBefore : plan.claudeCursorBefore;
     const free = [];
     const owed = [];
@@ -222,12 +260,28 @@ function selectOutsideRootSessions(sightings, plan) {
             owed.push(sighting);
         }
     }
-    // Newest first, with the session id as a tie-break so two ticks over the same
-    // files pick the same sessions.
-    owed.sort((left, right) => right.result.session_file_mtime_ms - left.result.session_file_mtime_ms ||
-        left.sessionId.localeCompare(right.sessionId));
-    const riding = owed.slice(0, OUTSIDE_ROOT_SESSIONS_PER_TICK);
-    const waiting = owed.slice(OUTSIDE_ROOT_SESSIONS_PER_TICK);
+    const newTurn = Object.values(turns).reduce((max, turn) => Math.max(max, turn), 0) + 1;
+    owed.sort((left, right) => (turns[outsideRootKey(left.source, left.sessionId)] ?? newTurn) -
+        (turns[outsideRootKey(right.source, right.sessionId)] ?? newTurn) ||
+        left.result.session_file_mtime_ms - right.result.session_file_mtime_ms ||
+        outsideRootKey(left.source, left.sessionId).localeCompare(outsideRootKey(right.source, right.sessionId)));
+    // A main larger than the normal allowance gets a turn without other owed sessions. Otherwise a
+    // smaller main (or the other provider's reader, which runs first) could fill
+    // staging before the existing empty-staging exception ever sees it.
+    const riding = [];
+    let bytes = 0;
+    for (const sighting of owed) {
+        if (riding.length >= OUTSIDE_ROOT_SESSIONS_PER_TICK)
+            break;
+        if (bytes + sighting.result.byte_size > OUTSIDE_ROOT_BYTES_PER_TICK) {
+            if (riding.length === 0)
+                riding.push(sighting);
+            break;
+        }
+        riding.push(sighting);
+        bytes += sighting.result.byte_size;
+    }
+    const waiting = owed.slice(riding.length);
     for (const sighting of waiting) {
         holds.set(outsideRootKey(sighting.source, sighting.sessionId), OUTSIDE_ROOT_WAITING_REASON);
     }
@@ -273,6 +327,10 @@ export function applyOutsideRootHolds(rows, holds) {
  * description session stay shared (they live on the same budget object).
  */
 export function giveOutsideRootsTheirOwnAllowance(budget) {
+    budget.singleFileByteAllowance = {
+        normalBytes: OUTSIDE_ROOT_BYTES_PER_TICK,
+        maxFileBytes: RAW_EVIDENCE_UPLOAD_MAX_FILE_BYTES,
+    };
     budget.remainingBytes = OUTSIDE_ROOT_BYTES_PER_TICK;
     budget.remainingObjects = OUTSIDE_ROOT_OBJECTS_PER_TICK;
 }

package/dist/commands/sources-check.js

@@ -1,3 +1,25 @@
+/**
+ * `cockpit sources check [--older-than <days>] [--json]` — does Tower hold
+ * each agent transcript on this machine? (BLI-11122)
+ *
+ * On 2026-09-30 an agent freeing disk ran `find ~/.codex/... -mtime +60
+ * -delete` on the premise that the files were already in Tower; 349 of 1,491
+ * had no copy. This door is the machine answer that was missing: for every
+ * local Codex and Claude transcript it asks Tower which current objects it
+ * holds and answers `stored_full`, `stored_slim` (BLI-17273: Tower holds only the
+ * slim form, keep the file), `stored_partial` or `not_stored`, with the reason
+ * (`sources-verdict.ts`), judged against THIS machine's image mode.
+ *
+ * READ-ONLY, and nothing else: Tower never deletes a person's raw transcripts.
+ * Deleting one is the person's own act, outside Tower. This command reads the
+ * files and the server's list; it never writes, moves or deletes a file under
+ * `~/.codex` or `~/.claude`. `docs/runbooks/freeing-disk-on-a-collector-machine.md`.
+ *
+ * A server that cannot be asked is a failure with its reason (exit 1), never
+ * "not stored". A list cut short (`capped`, `failed_partial`) still answers,
+ * marked incomplete: a missing page can only understate what Tower holds.
+ */
+import { fetchSourceInventory, reconcileSource } from "./sources-reconciliation.js";
 import { writeLine } from "./cli-io.js";
 import { readDescribedImageKeys } from "../image-description-state.js";
 import { resolveImageHandlingMode } from "../image-mode-state.js";
@@ -12,6 +34,10 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     const startedAt = Date.now();
     const paths = getCollectorRuntimePaths(command.homeDir);
     const config = await readLocalCollectorConfig(paths).catch(() => null);
+    if (command.reconcile && !config) {
+        console.error("[collector sources] reconciliation not run", JSON.stringify({ reason: "local_config_unavailable_opt_out_unknown" }));
+        return fail(io, command, "local_config_unavailable_opt_out_unknown", "Local collection preferences could not be read; no transcript store was scanned.");
+    }
     const dashboardUrl = command.dashboardUrl ?? config?.dashboard_url ?? DEFAULT_DASHBOARD_URL;
     const session = await readLocalCollectorSessionFile(paths).catch(() => null);
     if (!session || session.session_state !== "valid" || typeof session.device_token !== "string" || !session.device_token) {
@@ -25,7 +51,9 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     }
     const homeDir = command.homeDir ?? paths.home_dir;
     const olderThanMs = command.olderThanDays === null ? null : now.getTime() - command.olderThanDays * DAY_MS;
-    const local = await discoverLocalTranscripts({ homeDir, olderThanMs });
+    const optOutAll = command.reconcile === true && config?.raw_evidence_upload === "disabled";
+    const optOutClaude = command.reconcile === true && config?.collect_claude_jsonl === false;
+    const local = await discoverLocalTranscripts({ homeDir, olderThanMs, skipAll: optOutAll, skipClaude: optOutClaude });
     const cursors = {
         codex: await readRawEvidenceCursor(paths),
         claude_code: await readRawEvidenceCursor(paths, { filename: CLAUDE_CURSOR_FILENAME, sessionsOnly: true }),
@@ -38,6 +66,36 @@ export async function runSourcesCheck(command, io, now = new Date()) {
     console.error("[collector sources] judging against this machine's image mode", JSON.stringify({ reason: `image_mode_from_${imageMode.source}`, mode: imageMode.mode, slim_aware: imageMode.slimAware }));
     const report = emptyReport(command, remote, local.newer_count, local.file_read_failed + local.directory_read_failed);
     await judgeLocalTranscripts(local.files, remote, cursors, imageMode, describedKeys, report);
+    if (command.reconcile) {
+        const inventory = await fetchSourceInventory({ dashboardUrl, deviceToken: session.device_token, fetchImpl: io.fetch });
+        const { rows: _rows, ...inventoryCounts } = inventory;
+        const counts = { missing_row: 0, missing_pointer: 0, stale_revision: 0, unavailable_evidence: 0, explicit_opt_out: 0, unverifiable: 0, revision_verified: 0 };
+        const optOutSources = optOutAll ? ["codex", "claude_code"] : optOutClaude ? ["claude_code"] : [];
+        counts.explicit_opt_out = optOutSources.length;
+        for (const file of local.files) {
+            const finding = await reconcileSource({ file, inventory, remote,
+                cursor: file.kind === "claude_subagent" ? null : cursors[file.source].sessions[file.session_id] ?? null,
+                facts: fileFacts(file, undefined, { mode: imageMode.mode, describedKeys, slimAware: imageMode.slimAware }),
+            }).catch(() => ({ state: "unavailable_evidence", reason: "local_revision_unreadable" }));
+            counts[finding.state]++;
+            const entry = report.files.find(entry => entry.path === file.file_path);
+            if (entry)
+                entry.reconciliation = finding;
+        }
+        report.reconciliation = { counts, inventory: inventoryCounts,
+            scan: { started_at: new Date(startedAt).toISOString(), finished_at: new Date().toISOString(),
+                roots: ["codex/sessions", "codex/archived_sessions", "claude/projects"], older_than_days: command.olderThanDays, opt_out_sources: optOutSources },
+            limitations: ["Snapshot scan, not a live completeness guarantee; absent local sources cannot be discovered.", "Missing historical source identifiers remain unverifiable.", "Pointer metadata does not prove bucket bytes are readable; no storage bodies fetched.", "explicit_opt_out counts sources, not undiscovered files; opted-out stores are not scanned."],
+        };
+        if (inventory.status !== "exhausted" || report.local.unreadable > 0 || counts.unavailable_evidence > 0) {
+            report.status = "incomplete";
+            report.reason = "reconciliation_partial";
+        }
+    }
+    if (report.local.unreadable > 0) {
+        report.status = "incomplete";
+        report.reason = "local_scan_incomplete";
+    }
     reportSourcesCheck(report, remote, startedAt);
     if (command.json)
         writeLine(io.stdout, JSON.stringify(report, null, 2));
@@ -93,6 +151,7 @@ function reportSourcesCheck(report, remote, startedAt) {
         stored_partial: report.counts.stored_partial,
         not_stored: report.counts.not_stored,
         reasons: report.reasons,
+        ...(report.reconciliation ? { reconciliation: report.reconciliation.counts } : {}),
         elapsed_ms: Date.now() - startedAt,
     }));
 }
@@ -135,6 +194,8 @@ export function sourcesCheckLines(report) {
         `  stored in part  ${report.counts.stored_partial.files} file(s), ${mb(report.counts.stored_partial.bytes)} MB`,
         `  not stored       ${report.counts.not_stored.files} file(s), ${mb(report.counts.not_stored.bytes)} MB`,
     ];
+    if (report.reconciliation)
+        lines.push(`  reconciliation   ${Object.entries(report.reconciliation.counts).map(([state, count]) => `${state} ${count}`).join(", ")}`, `  row inventory    ${report.reconciliation.inventory.status}; ${report.reconciliation.inventory.unique} unique of ${report.reconciliation.inventory.returned} returned (${report.reconciliation.inventory.requested} requested)`, `  scan             ${report.reconciliation.scan.started_at} to ${report.reconciliation.scan.finished_at}; roots ${report.reconciliation.scan.roots.join(", ")}; opted out ${report.reconciliation.scan.opt_out_sources.join(", ") || "none"}`, ...report.reconciliation.limitations.map(reason => `  limitation       ${reason}`));
     const reasons = Object.entries(report.reasons).sort((a, b) => b[1] - a[1]);
     if (reasons.length > 0)
         lines.push(`  why              ${reasons.map(([reason, count]) => `${reason} ${count}`).join(", ")}`);
@@ -144,7 +205,7 @@ export function sourcesCheckLines(report) {
         lines.push(`  unreadable       ${report.local.unreadable} file(s) could not be read and are not answered`);
     lines.push(`  Tower's list     ${report.remote.status}: ${report.remote.unique} current transcript object(s) over ${report.remote.pages} page(s)`);
     if (report.status === "incomplete") {
-        lines.push(`  INCOMPLETE       Tower's list was cut short (${report.reason}); "not stored" and "stored in part" may be understated. Run it again.`);
+        lines.push(`  INCOMPLETE       The scan or evidence list is incomplete (${report.reason}); missing evidence is inconclusive. Run it again.`);
     }
     lines.push("Tower never deletes these files. `--json` lists every file with its path and verdict. Only a \"stored in full\" file is safe to delete by your own hand (never \"stored slim\"); see docs/runbooks/freeing-disk-on-a-collector-machine.md.");
     return lines;

package/dist/commands/sources-discovery.js

@@ -153,7 +153,7 @@ function shapeOrder(shape) {
 }
 async function findTranscriptFiles(options, roots, result, recordFailure) {
     const found = [];
-    const stack = [...roots.codex, roots.claudeProjects];
+    const stack = options.skipAll ? [] : [...roots.codex, ...(options.skipClaude ? [] : [roots.claudeProjects])];
     const seen = new Set();
     while (stack.length > 0) {
         const dir = stack.pop();

package/dist/commands/sources-reconciliation.js

@@ -0,0 +1,87 @@
+/** Metadata reconciliation only. Never writes cursors, starts collection or fetches bodies. */
+import fs from "node:fs/promises";
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+export async function fetchSourceInventory(options) {
+    const rows = new Map();
+    const result = { status: "capped", reason: "page_limit", requested: 0, returned: 0, unique: 0, pages: 0, rows: [] };
+    let after = null;
+    try {
+        for (let page = 0; page < (options.maxPages ?? 400); page++) {
+            result.requested += 500;
+            const response = await options.fetchImpl(`${options.dashboardUrl}/api/ambient/evidence/transcripts?inventory=1`, {
+                method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${options.deviceToken}` },
+                body: JSON.stringify({ schema_version: "evidence-transcripts.v1", after, limit: 500 }),
+                signal: AbortSignal.timeout(30_000),
+            });
+            if (!response.ok)
+                throw new Error(`http_${response.status}`);
+            const body = await response.json();
+            if (body.schema_version !== "source-reconciliation.v1" || !Array.isArray(body.rows) || body.rows.length > 500 ||
+                !(body.next_after === null || (typeof body.next_after === "string" && uuid.test(body.next_after))))
+                throw new Error("invalid_response");
+            const valid = body.rows.every((row) => row && typeof row.id === "string" && uuid.test(row.id) &&
+                typeof row.source === "string" && (row.codex_session_id === null || typeof row.codex_session_id === "string") &&
+                (row.raw_evidence_pointer_id === null || (typeof row.raw_evidence_pointer_id === "string" && uuid.test(row.raw_evidence_pointer_id))));
+            if (!valid)
+                throw new Error("invalid_response");
+            const next = body.next_after;
+            if (next && (next <= (after ?? "") || body.rows.length === 0 || next !== body.rows.at(-1).id))
+                throw new Error("cursor_not_advancing");
+            result.pages++;
+            result.returned += body.rows.length;
+            for (const row of body.rows)
+                rows.set(row.id, row);
+            if (!next) {
+                result.status = "exhausted";
+                result.reason = "ok";
+                break;
+            }
+            after = next;
+        }
+    }
+    catch (error) {
+        result.status = result.pages ? "failed_partial" : "unavailable";
+        result.reason = error instanceof Error && /^(http_\d+|invalid_response|cursor_not_advancing)$/.test(error.message) ? error.message : "request_failed";
+    }
+    result.rows = [...rows.values()];
+    result.unique = rows.size;
+    console.error("[collector sources] row inventory", JSON.stringify({ reason: result.reason, status: result.status, requested: result.requested, returned: result.returned, unique: result.unique, pages: result.pages }));
+    return result;
+}
+export async function reconcileSource(input) {
+    const answer = (state, reason) => ({ state, reason });
+    const { file, inventory, remote, cursor, facts } = input;
+    if (file.session_id_source === "path_hash")
+        return answer("unverifiable", "source_identifier_missing");
+    const rows = inventory.rows.filter(row => row.source === file.source && row.codex_session_id === file.session_id);
+    if (!rows.length && inventory.rows.some(row => (!row.source || row.source === file.source) && !row.codex_session_id?.trim())) {
+        return answer("unverifiable", "historical_source_identifier_missing");
+    }
+    if (!rows.length)
+        return inventory.status === "exhausted"
+            ? answer("missing_row", "source_row_absent") : answer("unavailable_evidence", `row_inventory_${inventory.status}`);
+    // Duplicate device rows are expected; any usable pointer can answer this file.
+    const pointers = new Set(rows.map(row => row.raw_evidence_pointer_id).filter(Boolean));
+    if (!pointers.size)
+        return inventory.status === "exhausted"
+            ? answer("missing_pointer", "source_rows_without_pointer") : answer("unavailable_evidence", `row_inventory_${inventory.status}`);
+    const objects = (remote.files.get(file.key) ?? []).filter(object => !object.stub &&
+        (file.kind === "claude_subagent" || (object.ref_id && pointers.has(object.ref_id))));
+    if (!objects.length)
+        return answer("unavailable_evidence", remote.status === "exhausted" ? "pointer_not_in_current_transcripts_or_stub" : `transcripts_${remote.status}`);
+    const split = facts.slimSplit ? await facts.slimSplit() : null;
+    const form = split?.slim ?? (facts.slimAware && facts.wholeForm ? await facts.wholeForm() : await facts.sanitized());
+    const stat = await fs.stat(file.file_path);
+    if (stat.size !== file.byte_size || stat.mtimeMs !== file.mtime_ms)
+        return answer("unavailable_evidence", "local_file_changed_during_check");
+    if (form && objects.some(object => object.content_hash_sha256 === form.sha256 || object.content_hash_sha256 === split?.full.sha256))
+        return answer("revision_verified", "current_redacted_hash_matches_pointer");
+    // Sync refreshes the observed file hash even when growth damping retains an older
+    // durable upload. uploaded_byte_size is the raw source size at that upload.
+    if (form && objects.every(object => object.content_hash_sha256 !== null) && cursor?.uploaded_object_key &&
+        objects.some(object => object.object_key === cursor.uploaded_object_key || object.ref_id === cursor.uploaded_object_key) &&
+        cursor.uploaded_byte_size !== null && cursor.uploaded_byte_size < file.byte_size) {
+        return answer("stale_revision", "local_tail_newer_than_cursor_upload");
+    }
+    return answer("unverifiable", form ? "revision_hash_mismatch_or_legacy_hash_missing" : "redacted_revision_unavailable");
+}

package/dist/evidence-transcripts-client.js

@@ -78,6 +78,7 @@ function addTranscriptObject(object, files, state) {
     const key = transcriptFileKey(identity);
     const list = files.get(key) ?? [];
     list.push({
+        ref_id: object.ref_id,
         object_key: object.object_key,
         byte_size: object.byte_size,
         content_hash_sha256: object.content_hash_sha256,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.243",
+  "version": "0.2.244",
   "private": false,
   "type": "module",
   "bin": {
@@ -27,9 +27,9 @@
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-verb-help.mjs && node ../../scripts/assert-public-cli-surface-doors.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-exit-contract.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-cli-doctor-json.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.71",
-    "@bli-cockpit/mcp": "0.1.148",
-    "@bli-cockpit/telemetry-core": "0.1.78"
+    "@bli-cockpit/memory-mcp": "0.1.72",
+    "@bli-cockpit/mcp": "0.1.149",
+    "@bli-cockpit/telemetry-core": "0.1.79"
   },
   "repository": {
     "type": "git",