@bli-cockpit/cli 0.2.285 → 0.2.287

package/dist/capture-opt-outs.js

@@ -0,0 +1,129 @@
+import { optOutVerdict, } from "@bli-cockpit/telemetry-core";
+import { writeLine } from "./commands/cli-io.js";
+import { askTowerFounderStanding } from "./founder-standing.js";
+import { recallLiveFounderAnswer } from "./live-founder-memo.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "./local-state.js";
+import { readMemoryCaptureChoice } from "./memory-capture-choice.js";
+import { configOptOutLabels } from "./source-opt-out.js";
+/**
+ * BLI-22640 (Jeetesh's review of 2026-10-25): this machine's opt-outs, which of
+ * them it obeys, and the founder answer it acted on, in one reading.
+ *
+ * - The sync tick calls `refreshFounderStandingForOptOuts` first: a machine
+ *   that holds any opt-out asks Tower live before anything is collected, and
+ *   every decider in that tick reuses the answer (memory only,
+ *   `live-founder-memo.ts`). A machine with no opt-out asks nothing.
+ * - The heartbeat carries `readCaptureOptOuts` as `capture_opt_outs`, so
+ *   Tower's fleet records see what each machine obeyed, ignored and held, and
+ *   Tower can compare `obeyed` with its own owners list. It reports what THIS
+ *   process heard from Tower; it never reads the saved `founder-standing.json`.
+ * - `cockpit doctor` prints `captureOptOutLine` when something is ignored and
+ *   `heldOptOutLine` when Tower could not be asked.
+ *
+ * Never throws: a reading that fails is logged and reads as "no opt-out".
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+export async function readCaptureOptOuts(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    try {
+        const found = await foundOptOuts(homeDir);
+        // What this process heard from Tower this tick; no answer means unknown (held).
+        const standing = found.length > 0 ? (recallLiveFounderAnswer(paths.state_dir)?.standing ?? "unknown") : "unknown";
+        return splitByVerdict(found, standing);
+    }
+    catch (error) {
+        console.error("[capture-opt-outs] opt-outs could not be read; reporting none", JSON.stringify({ reason: "opt_outs_unreadable", error_name: error instanceof Error ? error.name : typeof error }));
+        return { standing: "unknown", obeyed: [], ignored: [] };
+    }
+}
+/**
+ * Asks Tower live when this machine holds an opt-out, so this tick decides on
+ * Tower's current answer. When Tower cannot be asked the answer is `unknown`
+ * and the opt-outs are HELD (`owner_check_unavailable`), never decided on the
+ * saved file. Never throws; logs both branches.
+ */
+export async function refreshFounderStandingForOptOuts(options) {
+    let found;
+    try {
+        found = await foundOptOuts(options.homeDir);
+    }
+    catch {
+        found = [];
+    }
+    if (found.length === 0) {
+        console.error("[capture-opt-outs] no opt-out on this machine; Tower not asked", JSON.stringify({ reason: "no_opt_out" }));
+        return { standing: "unknown", obeyed: [], ignored: [] };
+    }
+    const answer = await askTowerFounderStanding({
+        ...(options.homeDir === undefined ? {} : { homeDir: options.homeDir }),
+        ...(options.dashboardUrl === undefined ? {} : { dashboardUrl: options.dashboardUrl }),
+        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+    });
+    const report = splitByVerdict(found, answer.standing);
+    console.error("[capture-opt-outs] this tick's opt-outs", JSON.stringify({
+        reason: optOutVerdict(report.standing).reason,
+        ...(answer.standing === "unknown" ? { not_live_reason: answer.reason } : {}),
+        obeyed: report.obeyed,
+        ignored: report.ignored,
+    }));
+    return report;
+}
+/** The one line doctor prints, or null when nothing is ignored. */
+export function captureOptOutLine(report) {
+    if (report.ignored.length === 0)
+        return null;
+    return `Ignored on this machine: ${report.ignored.map(labelWords).join(", ")}. Only Tower's founders can keep work out of Tower, `
+        + "so BLI Memory stays on and these sessions upload; your settings are left as you wrote them (opt_out_ignored_not_founder).";
+}
+/** The line doctor prints when Tower could not be asked, or null when nothing is held. */
+export function heldOptOutLine(report) {
+    if (report.standing !== "unknown" || report.obeyed.length === 0)
+        return null;
+    return `Held on this machine: ${report.obeyed.map(labelWords).join(", ")}. Tower could not say whether you are a founder, `
+        + "so nothing these cover is sent until it can; your settings are left as you wrote them (owner_check_unavailable).";
+}
+/**
+ * `cockpit doctor`'s step: asks Tower when this machine holds an opt-out, and
+ * prints one line when any is ignored because the person is not a founder, or
+ * held because Tower could not be asked.
+ * `--json` keeps stdout for its object; the line goes to stderr there. Never
+ * throws: doctor is never lost to this line.
+ */
+export async function reportIgnoredOptOuts(options, io) {
+    try {
+        const report = await refreshFounderStandingForOptOuts({
+            ...(options.homeDir === undefined ? {} : { homeDir: options.homeDir }),
+            fetch: io.fetch,
+        });
+        const line = captureOptOutLine(report) ?? heldOptOutLine(report);
+        if (line)
+            writeLine(options.json ? io.stderr : io.stdout, line);
+    }
+    catch (error) {
+        console.error("[doctor] opt-out report failed; doctor carries on", JSON.stringify({ reason: "opt_out_report_threw", error_name: error instanceof Error ? error.name : typeof error }));
+    }
+}
+async function foundOptOuts(homeDir) {
+    const paths = getCollectorRuntimePaths(homeDir);
+    const config = await readLocalCollectorConfig(paths).catch(() => null);
+    const choice = await readMemoryCaptureChoice(paths);
+    return [
+        ...(choice.state === "off" ? ["memory_capture_off"] : []),
+        ...configOptOutLabels(config),
+    ];
+}
+function splitByVerdict(found, standing) {
+    if (found.length === 0)
+        return { standing, obeyed: [], ignored: [] };
+    return optOutVerdict(standing).obeyed
+        ? { standing, obeyed: found, ignored: [] }
+        : { standing, obeyed: [], ignored: found };
+}
+function labelWords(label) {
+    switch (label) {
+        case "memory_capture_off": return "BLI Memory off";
+        case "collect_claude_jsonl_false": return "collect_claude_jsonl: false";
+        case "collect_codex_jsonl_false": return "collect_codex_jsonl: false";
+        case "raw_evidence_upload_disabled": return "raw_evidence_upload: \"disabled\"";
+    }
+}

package/dist/collection-scope.js

@@ -0,0 +1,201 @@
+/**
+ * BLI-23590: "only collect from my approved folders" (`collection_scope: "roots_only"`).
+ *
+ * Roots are labels by default (session-first collection, BLI-10734): every session the machine can see is uploaded
+ * and tagged inside or outside. A person Tower names eligible (the founders and Ed, decided on the SERVER) can choose
+ * `roots_only`: a session whose working directory is outside every approved root is dropped from the scan result
+ * before anything is staged, uploaded, reported, committed-to-git-scanned or saved to the local work scan. Its only
+ * trace is a count on the heartbeat with {@link COLLECTION_SCOPE_ROOTS_ONLY_REASON}.
+ *
+ * Where the answer comes from, in order:
+ *
+ *   1. Tower's last reply (`collection_scope: { scope, eligible }` on the install-events reply), kept in
+ *      `collection-scope.json` in the state directory so an offline tick keeps the last answer.
+ *   2. The local config key `collection_scope: "roots_only"`, honoured ONLY when the cached reply says
+ *      `eligible: true`. An ineligible person's key, or one nobody has confirmed yet, is ignored and the reason is
+ *      logged. Editing a laptop's config therefore cannot switch this on for anyone Tower has not cleared.
+ *   3. Otherwise `all`, today's behaviour for everyone.
+ *
+ * Plain-words note on "not read": the scan has to open a session file's head to learn its working directory, so the
+ * file is touched; nothing from an outside-root session is kept past that decision (no staging, upload, session row,
+ * hash in a report, git scan or work-scan entry).
+ *
+ * Holds scope, eligibility and a timestamp. Never a path, an id or a byte of a session.
+ *
+ * A new sibling must also join `scripts/build-public-cli.mjs` `runtimeFiles`.
+ */
+import path from "node:path";
+import { COLLECTION_SCOPE_ROOTS_ONLY_REASON, CollectionScopeReplySchema, } from "@bli-cockpit/telemetry-core";
+import { isPathWithin } from "./adapters/attribution-core-paths.js";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+import { readJsonFile, writeJsonFileAtomic } from "./local-state-files.js";
+export const COLLECTION_SCOPE_STATE_FILENAME = "collection-scope.json";
+const TAG = "[collection-scope]";
+export function collectionScopeStatePath(stateDir) {
+    return path.join(stateDir, COLLECTION_SCOPE_STATE_FILENAME);
+}
+/** The cached answer, or null when there is none or it cannot be trusted (said out loud when unreadable). */
+export async function readCollectionScopeState(stateDir) {
+    let raw;
+    try {
+        raw = await readJsonFile(collectionScopeStatePath(stateDir));
+    }
+    catch (error) {
+        if (isMissingFileFailure(error))
+            return null;
+        console.error(TAG + " cache unreadable, collecting as the default", JSON.stringify({ reason: "collection_scope_cache_unreadable", ...describeError(error) }));
+        return null;
+    }
+    const parsed = CollectionScopeReplySchema.safeParse(raw && typeof raw === "object" && !Array.isArray(raw)
+        ? { scope: raw["scope"], eligible: raw["eligible"] }
+        : null);
+    if (!parsed.success) {
+        console.error(TAG + " cache shape invalid, collecting as the default", JSON.stringify({ reason: "collection_scope_cache_shape_invalid" }));
+        return null;
+    }
+    const observedAt = raw["observed_at"];
+    return { ...parsed.data, observed_at: typeof observedAt === "string" ? observedAt : "" };
+}
+/**
+ * Put Tower's reply on file. A reply that names no scope (older server, failed read) is ignored and the previous
+ * answer stays in force. An unknown shape is ignored with a log. Returns true only when the file now holds the reply.
+ */
+export async function recordObservedCollectionScope(stateDir, observed, now = () => new Date()) {
+    if (observed === undefined || observed === null)
+        return false;
+    const parsed = CollectionScopeReplySchema.safeParse(observed);
+    if (!parsed.success) {
+        console.error(TAG + " reply carried a scope this collector does not understand, ignored", JSON.stringify({ reason: "collection_scope_reply_invalid" }));
+        return false;
+    }
+    const previous = await readCollectionScopeState(stateDir);
+    try {
+        await writeJsonFileAtomic(collectionScopeStatePath(stateDir), {
+            schema_version: "cockpit-collection-scope.v1",
+            ...parsed.data,
+            observed_at: now().toISOString(),
+        });
+    }
+    catch (error) {
+        console.error(TAG + " could not cache the answer Tower sent; the previous answer stays in force", JSON.stringify({ reason: "collection_scope_cache_write_failed", ...describeError(error) }));
+        return false;
+    }
+    if (previous?.scope !== parsed.data.scope || previous?.eligible !== parsed.data.eligible) {
+        console.error(TAG + " answer for this person changed", JSON.stringify({ reason: "collection_scope_changed", from: previous?.scope ?? "none", to: parsed.data.scope, eligible: parsed.data.eligible }));
+    }
+    return true;
+}
+/** Pure: the scope a tick runs under, from Tower's cached answer and the local config request. */
+export function resolveEffectiveCollectionScope(input) {
+    const { cache, localRequest } = input;
+    if (cache?.scope === "roots_only") {
+        // Tower only ever sends roots_only for a person it cleared; an `eligible: false` beside it is a contradiction,
+        // and the safe reading of a contradiction is the default.
+        if (cache.eligible)
+            return { scope: "roots_only", source: "server", reason: "tower_set_roots_only" };
+        return { scope: "all", source: "default", reason: "tower_answer_contradicts_itself_ignored" };
+    }
+    if (localRequest === "roots_only") {
+        if (cache?.eligible)
+            return { scope: "roots_only", source: "local_config_eligible", reason: "local_roots_only_request_tower_confirms_eligible" };
+        return {
+            scope: "all",
+            source: "default",
+            reason: cache ? "local_roots_only_ignored_not_eligible" : "local_roots_only_ignored_eligibility_unconfirmed",
+        };
+    }
+    return { scope: "all", source: "default", reason: cache ? "tower_says_all" : "no_answer_from_tower_yet" };
+}
+/**
+ * The tick's decision, logged once. `localRequest` is the config key. Never throws: a read failure is the default
+ * scope with its reason, and the failure was already logged by the reader.
+ */
+export async function settleCollectionScope(stateDir, localRequest) {
+    const cache = await readCollectionScopeState(stateDir);
+    const effective = resolveEffectiveCollectionScope({ cache, localRequest });
+    console.error(TAG + " scope for this tick", JSON.stringify({ reason: effective.reason, scope: effective.scope, source: effective.source, eligible: cache?.eligible ?? null }));
+    return effective;
+}
+/** `settleCollectionScope` for the sync tick, which it must never fail. */
+export async function settleTickCollectionScopeBestEffort(stateDir, observed) {
+    try {
+        await recordObservedCollectionScope(stateDir, observed);
+    }
+    catch (error) {
+        console.error(TAG + " could not settle the answer for this tick", JSON.stringify({ reason: "collection_scope_settle_failed", ...describeError(error) }));
+    }
+}
+// ---------------------------------------------------------------------------
+// The root test and the filter
+// ---------------------------------------------------------------------------
+/**
+ * Is this working directory inside an approved root? Uses the collector's one containment rule
+ * (`isPathWithin`): the platform is read from each path itself (a drive letter or UNC share is Windows), Windows
+ * compares case-insensitively with either slash, `projects-old` is not inside `projects`, and a Windows path never
+ * matches a POSIX root or the reverse.
+ */
+export function cwdInsideRoots(cwd, roots) {
+    if (!cwd || roots.length === 0)
+        return false;
+    return roots.some((root) => isPathWithin(cwd, root));
+}
+/**
+ * A session stays when its working directory is inside an approved root, or when attribution put it in a worktree
+ * that discovery found under the roots and its working directory is inside that worktree (a Codex-managed worktree
+ * of an approved repo lives outside the roots but is the approved repo's work). No recorded working directory means
+ * it cannot be proven inside, so it is withheld.
+ */
+export function sessionInsideRoots(result, roots) {
+    if (cwdInsideRoots(result.local_cwd, roots))
+        return true;
+    return Boolean(result.worktree && cwdInsideRoots(result.local_cwd, [result.worktree.repo_root]));
+}
+export function withholdOutsideRoots(results, roots) {
+    const kept = [];
+    let withheld = 0;
+    let withoutCwd = 0;
+    for (const result of results) {
+        if (sessionInsideRoots(result, roots)) {
+            kept.push(result);
+            continue;
+        }
+        withheld += 1;
+        if (!result.local_cwd)
+            withoutCwd += 1;
+    }
+    return { kept, withheld, withheld_without_cwd: withoutCwd };
+}
+/**
+ * Drop the outside-root sessions from one source's scan result and keep its per-state counts honest (a count of
+ * `unattributed` that still included a withheld session would say the machine saw something it was told to forget).
+ * The other counters (files discovered, scanned) describe the READ and stay as they were.
+ */
+export function scopeScanResult(scan, roots) {
+    const { kept, withheld, withheld_without_cwd } = withholdOutsideRoots(scan.results, roots);
+    if (withheld === 0)
+        return { scan, withheld: 0, withheld_without_cwd: 0 };
+    const counts = Object.fromEntries(Object.keys(scan.counts).map((state) => [state, kept.filter((result) => result.state === state).length]));
+    return { scan: { ...scan, results: kept, counts }, withheld, withheld_without_cwd };
+}
+/**
+ * `cockpit backfill`'s version of the same drop: under `roots_only` a session outside every approved root never becomes
+ * a candidate, so backfill can never upload what the scheduled sync withholds. Under `all` the scans pass through.
+ */
+export function scopeHistoryScans(options, codex, claude) {
+    if (options.collectionScope.scope !== "roots_only")
+        return { codex, claude };
+    const codexScoped = codex ? scopeScanResult(codex, options.collectionRoots) : null;
+    const claudeScoped = claude ? scopeScanResult(claude, options.collectionRoots) : null;
+    logScopeWithhold("backfill", {
+        source: "codex+claude_code",
+        kept: (codexScoped?.scan.results.length ?? 0) + (claudeScoped?.scan.results.length ?? 0),
+        withheld: (codexScoped?.withheld ?? 0) + (claudeScoped?.withheld ?? 0),
+        withheld_without_cwd: (codexScoped?.withheld_without_cwd ?? 0) + (claudeScoped?.withheld_without_cwd ?? 0),
+        roots: options.collectionRoots.length,
+    });
+    return { codex: codexScoped?.scan ?? null, claude: claudeScoped?.scan ?? null };
+}
+/** The one log line every acting site writes, so a withhold is never silent. Counts only. */
+export function logScopeWithhold(site, facts) {
+    console.error(`[${site}] sessions outside the approved roots withheld by collection scope`, JSON.stringify({ reason: COLLECTION_SCOPE_ROOTS_ONLY_REASON, ...facts }));
+}

package/dist/commands/agent-session-report.js

@@ -152,6 +152,9 @@ function sessionReportEntry(result, context) {
         attribution_score: result.attribution_score,
         path_score: result.path_score,
         root_scope: rootScopeForReason(result.reason),
+        // BLI-23478 (three shelves): every row this collector sends is a team-shelf row; a drawer session sends no row
+        // (it left the pass in `session-sync-shelf.ts`). Tower refuses a founder's row without it once routing is on.
+        shelf: "team",
         signals: result.signals,
         ...(result.content_hash_sha256
             ? { session_file_hash_sha256: result.content_hash_sha256 }

package/dist/commands/analyze.js

@@ -3,6 +3,7 @@ import { normalizeUrl } from "./local-args.js";
 import { runSync } from "./sync.js";
 import { describeError, isMissingFileFailure } from "../health-detail.js";
 import { DEFAULT_DASHBOARD_URL, getCollectorRuntimePaths, readLocalCollectorSessionFile, } from "../local-state.js";
+import { collectorShelfHeaders } from "../shelf-headers.js";
 export async function runAnalyze(command, io) {
     const sync = await runAnalysisSync(command, io);
     if (sync.exitCode !== 0 || !isUploadedSyncResult(sync.output)) {
@@ -56,6 +57,7 @@ async function queueAnalysis(command, io, sync) {
         method: "POST",
         headers: {
             authorization: `Bearer ${session.device_token}`,
+            ...collectorShelfHeaders(),
             "content-type": "application/json",
         },
         body: "{}",

package/dist/commands/backfill-scan.js

@@ -18,12 +18,14 @@ import { liveWindowMsFor, scopeBackfillCandidates } from "./backfill-live-window
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { candidateCursorKey, compareBackfillCandidates, isAfterCursor, } from "./backfill-candidates.js";
 import { addReadOnlyGuardIssues, addRepoDiscoveryIssues, backfillScanIssues, countReadOnlyGuards, deterministicSkipCandidateKeys, oversizedBackfillCandidateKeys, retryableCandidateKeys, sortScanIssuesByPriority, } from "./backfill-issues.js";
-import { labelOutsideRootCandidates, outsideRootsWorkspace, } from "./backfill-outside-roots.js";
+import { labelOutsideRootCandidates, outsideRootsWorkspace } from "./backfill-outside-roots.js";
 import { reasonCountsFor } from "./backfill-reasons.js";
 import { blockedBackfillResult } from "./backfill-result.js";
 import { emptyStubReofferPlan, loadStubReofferPlan, reopenStubbedSessions, } from "./backfill-stub-reoffer.js";
 import { loadStubCursorHashes, locateStubbedSessions } from "./backfill-stub-locate.js";
 import { resolveBackfillScope } from "./backfill-scope.js";
+import { scopeHistoryScans } from "../collection-scope.js";
+import { decideShelfMode, OWNER_CHECK_UNAVAILABLE, shelveBackfillScan, teamWorktreesOnly } from "./session-sync-shelf.js";
 /**
  * SCAN: is this machine paired, what roots/sources/window apply, and what did
  * the archived Codex + Claude session stores actually contain. Returns either
@@ -44,14 +46,18 @@ export async function scanBackfillRun(command, io, now) {
         };
     }
     const { collectionRoots, sources, worktreeDiscovery } = scope;
+    const shelfDecision = await decideShelfMode({ homeDir: command.homeDir, dashboardUrl: scope.dashboardUrl, fetchImpl: io.fetch }); // BLI-23478
+    if (shelfDecision.mode === "hold")
+        return { kind: "blocked", result: blockedBackfillResult(command, { now, dashboardUrl: scope.dashboardUrl, reason: OWNER_CHECK_UNAVAILABLE, cursor: await readBackfillCursor(paths) }) };
+    const worktrees = teamWorktreesOnly(worktreeDiscovery.worktrees, shelfDecision);
     const { scopedCursor, cursor, pointerlessTerminalSessions, stubReoffer, stubCursorHashes } = await reopenUndeliveredHistory(command, io, paths, scope);
     const scan = await scanBackfillSessions({
         command,
-        homeDir: command.homeDir ?? os.homedir(),
-        worktrees: worktreeDiscovery.worktrees,
+        homeDir: command.homeDir ?? os.homedir(), shelfDecision,
+        worktrees,
         collectionRoots,
         sources,
-        window: scope.window,
+        window: scope.window, collectionScope: scope.collectionScope,
         cursor,
         pointerlessTerminalSessions,
         stubReoffer,
@@ -67,7 +73,7 @@ export async function scanBackfillRun(command, io, now) {
         sources,
         window: scope.window,
         collectionRoots,
-        worktrees: worktreeDiscovery.worktrees,
+        worktrees,
         retryCommand: scope.retryCommand,
         scopedCursor,
         cursor,
@@ -132,12 +138,11 @@ async function scanBackfillSessions(options) {
     const scanLimit = options.command.maxFiles ?? 10_000;
     const codexSessionDirs = defaultCodexSessionDirs(options.homeDir);
     const claudeProjectsDir = path.join(options.homeDir, ".claude", "projects");
-    const codexAttribution = options.sources.includes("codex")
-        ? await scanCodexHistory(options, codexSessionDirs, scanLimit)
-        : null;
-    const claudeAttribution = options.sources.includes("claude_code")
-        ? await scanClaudeHistory(options, claudeProjectsDir, scanLimit)
-        : null;
+    const codexScanned = options.sources.includes("codex") ? await scanCodexHistory(options, codexSessionDirs, scanLimit) : null;
+    const claudeScanned = options.sources.includes("claude_code") ? await scanClaudeHistory(options, claudeProjectsDir, scanLimit) : null;
+    // BLI-23590 withholds sessions outside the approved roots first; BLI-23478 then keeps drawer sessions home.
+    const scoped = scopeHistoryScans(options, codexScanned, claudeScanned);
+    const { codexAttribution, claudeAttribution } = shelveBackfillScan(scoped.codex, scoped.claude, options.shelfDecision);
     // BLI-11119: a stubbed session is found by the id in its content or by the
     // file hash its cursor entry recorded, across every root the scan walked.
     const scanned = locateStubbedSessions({

package/dist/commands/backfill-scope.js

@@ -4,7 +4,9 @@
  * which stores and how far back was it asked for, and can it reach the
  * dashboard at all. Nothing here opens a transcript.
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { settleCollectionScope } from "../collection-scope.js";
+import { configOptOutLabels, resolveSourceSwitches } from "../source-opt-out.js";
+import { liveStandingForDecision } from "../live-founder-memo.js";
 import path from "node:path";
 import { readLocalCollectorConfig, readLocalCollectorSessionFile, readLocalSessionReference, } from "../local-state.js";
 import { DEFAULT_DISCOVERY_MAX_DEPTH, DEFAULT_DISCOVERY_MAX_REPOS, collectionRootPathAliases, discoverGitWorktreesInRootsWithStatus, } from "../repo-identity.js";
@@ -45,8 +47,11 @@ export async function resolveBackfillScope(command, io, now, paths) {
         collectionRoots,
         worktreeDiscovery,
         retryCommand: backfillDiscoveryRetryCommand(command, worktreeDiscovery),
-        sources: honourSourceOptOuts(selectedSources(command.source), config),
+        sources: honourSourceOptOuts(selectedSources(command.source), config, 
+        // Tower's live word, asked only when the config holds an opt-out (BLI-22640).
+        configOptOutLabels(config).length > 0 ? (await liveStandingForDecision(paths, { fetch: io.fetch, dashboardUrl })).standing : "unknown"),
         window,
+        collectionScope: await settleCollectionScope(paths.state_dir, config.collection_scope),
     };
 }
 /**
@@ -58,8 +63,15 @@ export async function resolveBackfillScope(command, io, now, paths) {
  * Backfill never reads the store of a source the machine said no to, and logs
  * the reason label (ticket 22557).
  */
-function honourSourceOptOuts(sources, config) {
-    const switches = resolveSourceSwitches(config);
+function honourSourceOptOuts(sources, config, standing) {
+    // Founders only (BLI-22640): a non-founder's opt-out is ignored and named here.
+    const switches = resolveSourceSwitches(config, standing);
+    if (switches.ignored.length > 0) {
+        console.error("[backfill] opt-out ignored; only a founder's opt-out is obeyed, so these sessions upload", JSON.stringify({ reason: switches.verdict, ignored: switches.ignored }));
+    }
+    if (switches.held) {
+        console.error("[backfill] opt-out held; Tower could not say whether this person is a founder, so the sources it names send nothing", JSON.stringify({ reason: switches.verdict, held: configOptOutLabels(config) }));
+    }
     const kept = sources.filter((source) => (source === "codex" ? switches.codex : switches.claude));
     if (kept.length === sources.length)
         return sources;

package/dist/commands/backfill-session-report.js

@@ -83,6 +83,8 @@ function sessionAttributionRow(candidate, uploads, now) {
         path_score: candidate.path_score,
         // BLI-11091: the same inside/outside label the sync path writes (PR 1453).
         root_scope: rootScopeForReason(candidate.reason),
+        // BLI-23478: a team-shelf row; a drawer session never becomes a backfill candidate (`backfill-scan.ts`).
+        shelf: "team",
         signals: candidate.signals,
         ...(candidate.content_hash_sha256
             ? { session_file_hash_sha256: candidate.content_hash_sha256 }

package/dist/commands/cli-io.js

@@ -24,9 +24,7 @@ export function writeFragment(stream, text) {
         return;
     stream.write(text);
 }
-export function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
+export { errorMessage } from "../error-message.js";
 // ------------------------------------------------------------------- styling
 const SGR_DIM = "\x1b[2m";
 const SGR_RESET = "\x1b[0m";

package/dist/commands/doctor-access.js

@@ -1,6 +1,7 @@
 import os from "node:os";
 import { readRootWorkScan, outsideWorkDirectories, rootsAddCommand, sessionCoverageLine } from "../root-work.js";
 import { scanWorkDirectories } from "./local-discovery.js";
+import { settleCollectionScope } from "../collection-scope.js";
 import { sendCollectorHeartbeatBestEffort } from "./heartbeat.js";
 import { isInteractiveDoctorFix } from "./doctor-report.js";
 import { describeError } from "../health-detail.js";
@@ -175,6 +176,12 @@ function shellQuote(value) {
 export async function readRootsCoverWork(context) {
     const homeDir = context.command.homeDir ?? os.homedir();
     const paths = getCollectorRuntimePaths(homeDir);
+    // BLI-23590: under `roots_only` (Tower cleared this person) a session outside the roots is deliberately not
+    // collected. That is a choice, so the row is ok and says so; it never counts the withheld sessions as a gap.
+    const scope = await settleCollectionScope(paths.state_dir, (await readLocalCollectorConfig(paths).catch(() => null))?.collection_scope);
+    if (scope.scope === "roots_only") {
+        return ok("roots-cover-work", "work_outside_roots_deliberately_withheld", `Collection scope is roots only (${scope.source === "server" ? "set in Tower" : "your local setting, confirmed by Tower"}): sessions whose working folder is outside your approved roots are deliberately not read or uploaded, and only a count reaches Tower. This is a choice, not a gap; nothing needs fixing. To add a folder to what is collected: cockpit roots add <dir>`);
+    }
     const scan = await readRootWorkScan(paths) ?? await scanWorkDirectories(homeDir, false);
     const outside = outsideWorkDirectories(scan, (await readLocalCollectorConfig(paths))?.default_repo_paths ?? []);
     const outsideCount = outside.reduce((sum, entry) => sum + entry.count, 0);

package/dist/commands/doctor-registration.js

@@ -2,6 +2,7 @@ import { inspectAgentRules, installAgentRules } from "../agent-rules.js";
 import { doctorRoots } from "./doctor-access.js";
 import { installAutostartAgent } from "../autostart.js";
 import { clearAutostartOptOut } from "../autostart-opt-out.js";
+import { isMemoryCaptureOff } from "../memory-capture-choice.js";
 import { getCollectorRuntimePaths } from "../local-state.js";
 import { fail, needsFix, ok, skipped } from "./doctor-report.js";
 import { autostartDoctorStatus, autostartRegistrationRoots, readAutostartRegistration, } from "./autostart-reading.js";
@@ -73,10 +74,21 @@ export async function fixAutostartState(context) {
  * a hook failure, which is worse than waiting a day.
  */
 export async function checkMemoryState(context) {
+    if (await memoryOptedOut(context)) {
+        // BLI-22640: a dry run of the opted-out install writes nothing and says
+        // whether any of our entries (or `bli-tower`) still needs the fix.
+        const preview = await installMemoryIntegration({ ...memoryCommandFor(context), dryRun: true }, context.io);
+        return optedOutStepState(preview, "check");
+    }
     const outcome = await inspectMemoryIntegration(memoryCommandFor(context), context.io);
     return memoryStepState(outcome, "check");
 }
 export async function fixMemoryState(context) {
+    if (await memoryOptedOut(context)) {
+        // Never re-adds BLI Memory: the opted-out install only takes our entries
+        // back off and keeps `bli-tower`, which `mcp-answers`' repair relies on.
+        return optedOutStepState(await installMemoryIntegration(memoryCommandFor(context), context.io), "fix");
+    }
     let outcome = await installMemoryIntegration(memoryCommandFor(context), context.io);
     if (!outcome.bin_found) {
         // The public CLI declares the memory and Tower MCP packages as dependencies.
@@ -86,6 +98,33 @@ export async function fixMemoryState(context) {
     }
     return memoryStepState(outcome, "fix");
 }
+async function memoryOptedOut(context) {
+    return isMemoryCaptureOff(getCollectorRuntimePaths(context.command.homeDir), { fetch: context.io.fetch });
+}
+/**
+ * BLI-22640. The row on a machine whose owner turned BLI Memory off: never
+ * red for the absent registration (that is the choice), `skipped
+ * explicit_opt_out` once nothing of ours is left, and a fix only when an
+ * entry of ours is still on disk or `bli-tower` is missing.
+ */
+function optedOutStepState(outcome, phase) {
+    const failed = outcome.targets.find((target) => target.status === "failed");
+    if (failed) {
+        const message = `BLI Memory is off on this machine, but ${failed.target} could not be cleaned: ${failed.reason}`;
+        return phase === "fix"
+            ? fail("memory-registered", failed.reason, message)
+            : needsFix("memory-registered", failed.reason, message);
+    }
+    const leftover = outcome.removed_count ?? 0;
+    const towerPending = outcome.targets.some((target) => target.status === "would_install");
+    if (phase === "check" && (leftover > 0 || towerPending)) {
+        return needsFix("memory-registered", leftover > 0 ? "opted_out_entries_left" : "registration_incomplete", leftover > 0
+            ? `BLI Memory is off on this machine, but ${leftover} of its entries are still registered; doctor removes them`
+            : "BLI Memory is off on this machine; bli-tower is not registered yet");
+    }
+    const removed = phase === "fix" && leftover > 0 ? ` Removed ${leftover} of its entries.` : "";
+    return skipped("memory-registered", outcome.reason === "choice_unreadable" ? "choice_unreadable" : "explicit_opt_out", `BLI Memory is off on this machine (your choice); nothing of it is registered.${removed} \`cockpit memory on\` turns it back on.`);
+}
 function memoryCommandFor(context) {
     return {
         kind: "memory",

package/dist/commands/doctor-report.js

@@ -169,6 +169,7 @@ export function doctorNeedsPerson(rows, receipt) {
         "authed": "cockpit doctor",
         "roots-ok": "cockpit doctor",
         "roots-cover-work": "cockpit doctor",
+        "shelf-routing": "cockpit doctor",
         "single-install": "Run npm uninstall -g @bli-cockpit/cli with the Node installation that owns the extra CLI listed above.",
         "autostart-alive": "cockpit doctor",
         "usage-telemetry": "cockpit doctor",

package/dist/commands/doctor-shelf.js

@@ -0,0 +1,62 @@
+/**
+ * The `shelf-routing` doctor row (BLI-23478, three-shelves design 9.1 item 13).
+ *
+ * Reads what the last heartbeat stored about Tower's founder lock (`shelf-state.json`) and this laptop's default.
+ * On a founder's laptop, once Tower enforces the lock AND an owner has switched founder routing on, the repair sets
+ * `shelf_default: drawer`, so a founder's work outside every labelled folder stays on the laptop from then on. It
+ * never overrides a default the founder chose (`cockpit shelf default team`), and it never runs before Tower says
+ * the lock is on: labels and the default do nothing until both locks exist (design 4.1).
+ *
+ * Every other laptop: one `ok` line, nothing written.
+ */
+import os from "node:os";
+import { safeLog } from "@bli-cockpit/telemetry-core";
+import { ensureLocalCollectorConfig } from "../local-state.js";
+import { writeJsonFile } from "../local-state-files.js";
+import { readShelfState } from "../shelf-state.js";
+import { askFounderLive } from "../shelf-decision.js";
+import { configForDisk } from "../source-opt-out.js";
+import { needsFix, ok, skipped } from "./doctor-report.js";
+const ID = "shelf-routing";
+/**
+ * Whether this laptop's founder should have the drawer default now. Shared with the usage-telemetry row. The
+ * switch's state comes from the saved heartbeat answer; WHO is a founder is Tower's live answer, never the saved
+ * copy (`shelf-decision.ts`): a forged `is_owner` in the file changes nothing here.
+ */
+export async function founderRoutingOn(homeDir, fetchImpl) {
+    const state = readShelfState(homeDir);
+    if (!state?.shelf_enforced || state.founder_routing_enabled !== true)
+        return false;
+    return (await askFounderLive({ homeDir, fetchImpl })).standing === "founder";
+}
+export async function checkShelfRouting(context) {
+    const homeDir = context.command.homeDir ?? os.homedir();
+    const state = readShelfState(homeDir);
+    if (!state)
+        return skipped(ID, "not_enforced", "shelf routing: Tower has not answered this laptop yet; nothing changes until it does");
+    if (state.is_owner !== true)
+        return ok(ID, "enforced", "shelf routing: not a founder's laptop; nothing changes here");
+    if (state.cli_too_old) {
+        return { ...needsFix(ID, "cli_too_old", "shelf routing: this CLI is older than Tower's founder lock accepts; run `cockpit update`"), nextAction: "cockpit update" };
+    }
+    if (state.founder_routing_enabled !== true || !state.shelf_enforced) {
+        return ok(ID, "routing_disabled_by_owner", "shelf routing: founder routing is off in Tower; labels wait until an owner switches it on");
+    }
+    const config = await ensureLocalCollectorConfig({ homeDir }).then((result) => result.config).catch(() => null);
+    if (config?.shelf_default === "drawer")
+        return ok(ID, "drawer_default_set", "shelf routing: on; work outside team-labelled folders stays in the drawer on this laptop");
+    if (config?.shelf_default === "team")
+        return ok(ID, "team_default_chosen", "shelf routing: on; you chose team as the default (`cockpit shelf default drawer` to change it)");
+    return needsFix(ID, "drawer_default_missing", "shelf routing: on, but this laptop has no default yet; doctor sets it to drawer");
+}
+export async function fixShelfRouting(context) {
+    const homeDir = context.command.homeDir ?? os.homedir();
+    if (!(await founderRoutingOn(homeDir, context.io.fetch)))
+        return checkShelfRouting(context);
+    const { config, paths } = await ensureLocalCollectorConfig({ homeDir });
+    if (config.shelf_default)
+        return checkShelfRouting(context);
+    await writeJsonFile(paths.config_file, configForDisk({ ...config, shelf_default: "drawer" }));
+    safeLog("shelf", "drawer_default_set", { by: "doctor" });
+    return { ...ok(ID, "drawer_default_set", "shelf routing: on; work outside team-labelled folders now stays in the drawer on this laptop"), fixed: true };
+}