@bli-cockpit/cli 0.2.285 → 0.2.287

package/dist/commands/public-root.js

@@ -21,7 +21,7 @@ export async function runCockpitCli(argv, io) {
   }
 
   if (command === "--version" || command === "-V" || command === "version") {
-    writeLine(io?.stdout ?? process.stdout, "0.2.285");
+    writeLine(io?.stdout ?? process.stdout, "0.2.287");
     return 0;
   }
 

package/dist/commands/roots-label.js

@@ -0,0 +1,85 @@
+/**
+ * `cockpit roots label <dir> team|drawer` and `cockpit roots list` (BLI-23478, three-shelves design 9.1 item 7).
+ *
+ * A founder labels a folder to say which shelf its sessions and memories belong on: `team` (Tower, as today) or
+ * `drawer` (stays on this laptop; only bare numbers leave). `safe` is refused until the safe is live on this laptop
+ * (`safe_not_live`, design 4.5). A `drawer` label is refused on a laptop Tower has not named an owner's
+ * (`shelf_owner_only`): on a teammate's laptop nothing changes, by construction.
+ *
+ * The full folder path is printed back to the person who typed it (it is their own machine); it is never logged
+ * and never sent. Logs carry labels and counts only.
+ */
+import os from "node:os";
+import { stat } from "node:fs/promises";
+import { safeLog } from "@bli-cockpit/telemetry-core";
+import { loadShelfRules, resolveShelfWith } from "@bli-cockpit/memory-mcp/dist/shelf-routing.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig } from "../local-state.js";
+import { readRootApprovals, readRootLabels, recordRootLabel } from "../root-work.js";
+import { askFounderLive, OWNER_CHECK_UNAVAILABLE } from "../shelf-decision.js";
+import { writeLine } from "./cli-io.js";
+const TAG = "shelf";
+export async function runRootsLabel(command, io) {
+    const homeDir = command.homeDir ?? os.homedir();
+    const refuse = (reason, message) => {
+        safeLog(TAG, "root_label_refused", { refused: reason, shelf: command.shelf === "safe" || command.shelf === "team" || command.shelf === "drawer" ? command.shelf : "other" });
+        writeLine(command.json ? io.stdout : io.stderr, command.json ? JSON.stringify({ ok: false, reason, message }) : message);
+        return 1;
+    };
+    if (command.shelf === "safe") {
+        return refuse("safe_not_live", "The safe is not live on this laptop yet, so a folder cannot be labelled safe. Use drawer: it stays on this laptop.");
+    }
+    if (command.shelf !== "team" && command.shelf !== "drawer") {
+        return refuse("unknown_shelf", "Label a folder team or drawer.");
+    }
+    // Tower is asked live (never the saved heartbeat copy): only a founder may label a folder drawer.
+    const founder = command.shelf === "drawer" ? await askFounderLive({ homeDir, fetchImpl: io.fetch }) : null;
+    if (founder && founder.standing === "unknown") {
+        return refuse(OWNER_CHECK_UNAVAILABLE, "Tower could not be asked whether this is a founder's laptop, so nothing was labelled. Try again shortly.");
+    }
+    if (founder && founder.standing !== "founder") {
+        return refuse("shelf_owner_only", "Drawer labels are for founders' laptops, and Tower says this is not one.");
+    }
+    try {
+        if (!(await stat(command.directory)).isDirectory())
+            return refuse("not_a_directory", "Label a folder, not a file.");
+    }
+    catch {
+        return refuse("folder_not_found", "That folder does not exist on this laptop.");
+    }
+    const labels = await recordRootLabel(getCollectorRuntimePaths(homeDir), command.directory, command.shelf);
+    safeLog(TAG, "root_label_recorded", { shelf: command.shelf, labels });
+    const message = command.shelf === "drawer"
+        ? `Labelled drawer: sessions and memories in ${command.directory} stay on this laptop; only bare numbers reach Tower.`
+        : `Labelled team: sessions and memories in ${command.directory} go to Tower as today.`;
+    writeLine(io.stdout, command.json ? JSON.stringify({ ok: true, shelf: command.shelf, labels }) : message);
+    return 0;
+}
+export async function runRootsList(command, io) {
+    const homeDir = command.homeDir ?? os.homedir();
+    const paths = getCollectorRuntimePaths(homeDir);
+    const [approved, labels, config] = await Promise.all([
+        readRootApprovals(paths),
+        readRootLabels(paths),
+        readLocalCollectorConfig(paths).catch(() => null),
+    ]);
+    const rules = loadShelfRules({ homeDir });
+    const folders = [...new Set([...approved, ...Object.keys(labels)])].sort();
+    const rows = folders.map((folder) => ({
+        folder,
+        approved: approved.includes(folder),
+        label: labels[folder] ?? null,
+        shelf: resolveShelfWith(rules, folder).shelf,
+    }));
+    const shelfDefault = config?.shelf_default ?? "team";
+    safeLog(TAG, "roots_listed", { folders: rows.length, labelled: Object.keys(labels).length, routing_active: rules.active });
+    if (command.json) {
+        writeLine(io.stdout, JSON.stringify({ ok: true, shelf_default: shelfDefault, routing_active: rules.active, roots: rows }));
+        return 0;
+    }
+    writeLine(io.stdout, rows.length === 0 ? "No approved or labelled folders on this laptop." : "Folders on this laptop:");
+    for (const row of rows) {
+        writeLine(io.stdout, `  ${row.shelf.padEnd(6)} ${row.folder}${row.label ? ` (labelled ${row.label})` : ""}${row.approved ? "" : " (not an approved root)"}`);
+    }
+    writeLine(io.stdout, `Everything outside these folders: ${shelfDefault}.`);
+    return 0;
+}

package/dist/commands/roots.js

@@ -7,23 +7,41 @@ import { recordRootApprovals } from "../root-work.js";
 import { writeJsonFile } from "../local-state-files.js";
 import { configForDisk } from "../source-opt-out.js";
 import { writeLine } from "./cli-io.js";
+export const ROOTS_USAGE = "Usage: cockpit roots add <dir> [--allow-home-root] [--json] | label <dir> team|drawer [--json] | list [--json]";
 export function parseRootsArgs(args) {
-    const [action, directory, ...flags] = args;
-    if (action !== "add" || !directory || directory.startsWith("--"))
-        throw new Error("Usage: cockpit roots add <dir> [--allow-home-root] [--json]");
+    const [action, ...rest] = args;
+    const positional = [];
     let homeDir;
-    for (let index = 0; index < flags.length; index++) {
-        const flag = flags[index];
-        if (flag === "--home-dir" && flags[index + 1]) {
-            homeDir = flags[++index];
+    const allowed = action === "add" ? new Set(["--json", "--allow-home-root"]) : new Set(["--json"]);
+    for (let index = 0; index < rest.length; index++) {
+        const token = rest[index];
+        if (token === "--home-dir" && rest[index + 1]) {
+            homeDir = rest[++index];
             continue;
         }
-        if (flag !== "--json" && flag !== "--allow-home-root")
-            throw new Error(`Unknown roots flag: ${flag}`);
+        if (token.startsWith("--")) {
+            if (!allowed.has(token))
+                throw new Error(`Unknown roots flag: ${token}`);
+            continue;
+        }
+        positional.push(token);
+    }
+    const json = rest.includes("--json");
+    if (action === "add" && positional.length === 1) {
+        return { kind: "roots", action, directory: positional[0], homeDir, json, allowHomeRoot: rest.includes("--allow-home-root") };
+    }
+    if (action === "label" && positional.length === 2) {
+        return { kind: "roots", action, directory: positional[0], shelf: positional[1], homeDir, json };
     }
-    return { kind: "roots", action, directory, homeDir, json: flags.includes("--json"), allowHomeRoot: flags.includes("--allow-home-root") };
+    if (action === "list" && positional.length === 0)
+        return { kind: "roots", action, homeDir, json };
+    throw new Error(ROOTS_USAGE);
 }
 export async function runRoots(command, io) {
+    if (command.action === "label")
+        return (await import("./roots-label.js")).runRootsLabel(command, io);
+    if (command.action === "list")
+        return (await import("./roots-label.js")).runRootsList(command, io);
     const homeDir = command.homeDir ?? os.homedir();
     const { roots, rejected } = normalizeRootsDetailed([command.directory], { homeDir, allowHomeRoot: command.allowHomeRoot });
     if (!roots.length || rejected.length)

package/dist/commands/session-sync-plan.js

@@ -18,7 +18,8 @@
  * no per-file record), {@link RETRY_WINDOW_FALLBACK_MINUTES} is the bound
  * instead — generous, but still a bound, never "since epoch".
  */
-import { resolveSourceSwitches } from "../source-opt-out.js";
+import { settleCollectionScope } from "../collection-scope.js";
+import { readSourceSwitches } from "../source-opt-out.js";
 import { readLocalCollectorConfig, } from "../local-state.js";
 import { CLAUDE_CURSOR_FILENAME, emptyRawEvidenceCursorState, readRawEvidenceCursor, } from "../cursors/raw-evidence-cursor.js";
 import { normalizeCollectionRoots } from "../root-normalization.js";
@@ -46,14 +47,14 @@ export const RETRY_WINDOW_BUFFER_MINUTES = 24 * 60;
  */
 export async function planSyncFromLocalState(options) {
     const config = await readLocalCollectorConfig(options.paths).catch(() => null);
-    const switches = resolveSourceSwitches(config);
+    const switches = await readSourceSwitches(config, options.paths, "session_sync");
     const claudeEnabled = switches.claude;
     const codexEnabled = switches.codex;
     if (!codexEnabled) {
-        console.error("[session-sync] codex source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason }));
+        console.error("[session-sync] codex source withheld by operator opt-out", JSON.stringify({ reason: switches.codexReason, verdict: switches.verdict }));
     }
     if (!claudeEnabled) {
-        console.error("[session-sync] claude source withheld by operator opt-out", JSON.stringify({ reason: switches.claudeReason }));
+        console.error("[session-sync] claude source withheld by operator opt-out", JSON.stringify({ reason: switches.claudeReason, verdict: switches.verdict }));
     }
     const collectionRoots = normalizeCollectionRoots(options.approvedCollectionRoots ?? config?.default_repo_paths ?? []);
     const [codexCursorBefore, claudeCursorBefore, uploadSpool, outsideRootCatchUpPending] = await readSyncRetryState(options.paths, claudeEnabled);
@@ -62,9 +63,12 @@ export async function planSyncFromLocalState(options) {
     const legacyRetryPending = Boolean(uploadSpool?.pending_uploads.some((entry) => entry.raw_evidence_file_count > 0 && entry.retry_sources.length === 0));
     const codexSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "codex");
     const claudeSourceRetryPending = sourceScanRetryIsPending(uploadSpool, "claude_code");
+    // BLI-23590: Tower's answer on file, plus the local request only if Tower cleared this person.
+    const collectionScope = await settleCollectionScope(options.paths.state_dir, config?.collection_scope);
     return {
         claudeEnabled,
         codexEnabled,
+        collectionScope,
         collectionRoots,
         codexCursorBefore,
         claudeCursorBefore,

package/dist/commands/session-sync-scan.js

@@ -16,6 +16,8 @@ import { isRedactionStubObjectKey } from "../cursors/raw-evidence-stub-entry.js"
 import { clearSourceRetryFailure, recordSourceRetryFailure, } from "../spool/local-spool.js";
 import { claudeAttributionReadFailureCount, codexAttributionReadFailureCount, } from "./agent-session-report.js";
 import { widenForCatchUp } from "./session-sync-outside-roots.js";
+import { COLLECTION_SCOPE_ROOTS_ONLY_REASON } from "@bli-cockpit/telemetry-core";
+import { logScopeWithhold, scopeScanResult } from "../collection-scope.js";
 import { openTranscriptReadMemo } from "../adapters/transcript-read-memo.js";
 const CLAUDE_FIRST_RUN_BACKFILL_MINUTES = 14 * 24 * 60;
 /** The Claude scan's own default window when nothing widens it: the last 24 hours. */
@@ -29,7 +31,7 @@ const CLAUDE_DEFAULT_WINDOW_MINUTES = 24 * 60;
  */
 export async function scanAndAttributeBothSources(options) {
     const { plan } = options;
-    const codexAttribution = await scanCodexSessionsForSync({
+    const codexScanned = await scanCodexSessionsForSync({
         codexEnabled: plan.codexEnabled,
         homeDir: options.homeDir,
         worktrees: options.worktrees,
@@ -44,7 +46,7 @@ export async function scanAndAttributeBothSources(options) {
     // days so the first sync captures retroactive history instead of only 24h.
     const claudeCursorExists = await fileExists(path.join(options.paths.cursors_dir, CLAUDE_CURSOR_FILENAME));
     const firstRunBackfill = plan.claudeEnabled && !claudeCursorExists;
-    const claudeAttribution = await scanClaudeSessionsForSync({
+    const claudeScanned = await scanClaudeSessionsForSync({
         claudeEnabled: plan.claudeEnabled,
         homeDir: options.homeDir,
         worktrees: options.worktrees,
@@ -56,6 +58,26 @@ export async function scanAndAttributeBothSources(options) {
         outsideRootCatchUpPending: plan.outsideRootCatchUpPending,
         stateDir: options.paths.state_dir,
     });
+    // BLI-23590: under `roots_only` a session outside every approved root leaves the result HERE, before the retry
+    // bookkeeping, the local work scan, the upload, the report or the git scan can see it.
+    let codexAttribution = codexScanned;
+    let claudeAttribution = claudeScanned;
+    let scopeWithheld;
+    if (plan.collectionScope?.scope === "roots_only") {
+        const codex = scopeScanResult(codexScanned, plan.collectionRoots);
+        const claude = scopeScanResult(claudeScanned, plan.collectionRoots);
+        codexAttribution = codex.scan;
+        claudeAttribution = claude.scan;
+        const withheld = codex.withheld + claude.withheld;
+        scopeWithheld = { sessions: withheld, reason: COLLECTION_SCOPE_ROOTS_ONLY_REASON };
+        logScopeWithhold("session-sync", {
+            source: "codex+claude_code",
+            kept: codexAttribution.results.length + claudeAttribution.results.length,
+            withheld,
+            withheld_without_cwd: codex.withheld_without_cwd + claude.withheld_without_cwd,
+            roots: plan.collectionRoots.length,
+        });
+    }
     if (plan.codexEnabled) {
         await reconcileSourceScanRetry({
             paths: options.paths,
@@ -75,7 +97,7 @@ export async function scanAndAttributeBothSources(options) {
         });
     }
     await saveRootWorkScan(options.paths, [...codexAttribution.results, ...claudeAttribution.results], options.now);
-    return { codexAttribution, claudeAttribution, firstRunBackfill };
+    return { codexAttribution, claudeAttribution, firstRunBackfill, ...(scopeWithheld ? { scopeWithheld } : {}) };
 }
 /**
  * Scan and attribute Codex sessions for this sync, widening the window to all

package/dist/commands/session-sync-shelf.js

@@ -0,0 +1,143 @@
+/**
+ * Which shelf each session and each worktree belongs to, decided right after the scan and BEFORE anything is read
+ * for upload (BLI-23478, three-shelves design 4.2).
+ *
+ * The scan has already counted every transcript in process (`session_facts`, metadata only). This step splits its
+ * results in two:
+ *
+ *   - team sessions and team worktrees continue down the ordinary pass, unchanged;
+ *   - drawer sessions leave the pass here. No pack is opened for them, nothing is staged, no sidecar, image or diff
+ *     is read, no git is spawned for them, and no session row is reported. Only their counted facts travel on, to
+ *     become a numbers-only bare record (`shelf-reports.ts`).
+ *
+ * A session's shelf comes from its ATTRIBUTION identity, never from where its transcript file lives: the worktree
+ * root it was attributed to, and the working folder it recorded. Both must say `team` for the session to be team;
+ * either saying `drawer`, the two disagreeing, an `ambiguous` attribution, or no identity at all puts it in the
+ * drawer (fail closed). A worktree whose own root resolves to the drawer is dropped from the targets, so its pack
+ * (and its diff) is never built.
+ *
+ * The split runs only on a laptop Tower says, live, is a founder's (`shelf-decision.ts`; never the saved heartbeat
+ * file). Anywhere else (no labels, or Tower says not a founder) it returns its input untouched without resolving a
+ * single path; when Tower cannot be asked the caller holds the whole run before this step.
+ *
+ * Logs: counts and labels only, through `safeLog`.
+ */
+import { safeLog } from "@bli-cockpit/telemetry-core";
+// Re-exported for `cockpit backfill`, whose scan step sits at the readability ceiling.
+export { decideShelfMode, OWNER_CHECK_UNAVAILABLE } from "../shelf-decision.js";
+import { resolveShelfWith, } from "@bli-cockpit/memory-mcp/dist/shelf-routing.js";
+import { isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
+const TAG = "shelf";
+/** Why one session resolved where it did. Exported for the tests. */
+export function sessionShelf(result, rules) {
+    if (!rules.active)
+        return { shelf: "team", reason: "routing_inactive" };
+    if (rules.failed)
+        return { shelf: "drawer", reason: "shelf_resolve_failed" };
+    if (result.state === "ambiguous")
+        return { shelf: "drawer", reason: "ambiguous_attribution" };
+    const byWorktree = result.worktree && !isOutsideRootsWorkspace(result.worktree)
+        ? resolveShelfWith(rules, result.worktree.repo_root)
+        : null;
+    const byCwd = result.local_cwd ? resolveShelfWith(rules, result.local_cwd) : null;
+    if (!byWorktree && !byCwd)
+        return { shelf: "drawer", reason: "no_attribution_identity" };
+    if (byWorktree && byCwd && byWorktree.shelf !== byCwd.shelf)
+        return { shelf: "drawer", reason: "shelf_identity_mismatch" };
+    const decided = byWorktree ?? byCwd;
+    return decided.shelf === "team" ? { shelf: "team", reason: decided.reason } : { shelf: "drawer", reason: decided.reason };
+}
+/** Split a scan by shelf. Returns the input objects themselves when routing is inactive on this laptop. */
+export function splitScanByShelf(options) {
+    const rules = options.decision.rules;
+    if (options.decision.mode !== "founder" || !rules.active) {
+        return { scan: options.scan, worktrees: options.worktrees, shelved: [], worktreesShelved: 0, rules };
+    }
+    const shelved = [];
+    const reasons = new Map();
+    const keep = (result, shelve) => {
+        const decision = sessionShelf(result, rules);
+        if (decision.shelf === "team")
+            return true;
+        reasons.set(decision.reason, (reasons.get(decision.reason) ?? 0) + 1);
+        shelved.push(shelve(decision.reason));
+        return false;
+    };
+    const codexResults = options.scan.codexAttribution.results.filter((result) => keep(result, (reason) => ({
+        key: `codex:${result.codex_session_id}`, source: "codex", reason, facts: result.session_facts, recencyMs: result.session_file_mtime_ms,
+    })));
+    const claudeResults = options.scan.claudeAttribution.results.filter((result) => keep(result, (reason) => ({
+        key: `claude_code:${result.claude_session_id}`, source: "claude_code", reason, facts: result.session_facts, recencyMs: result.session_recency_ms,
+    })));
+    const worktrees = options.worktrees.filter((worktree) => isOutsideRootsWorkspace(worktree) || resolveShelfWith(rules, worktree.repo_root).shelf === "team");
+    const worktreesShelved = options.worktrees.length - worktrees.length;
+    safeLog(TAG, shelved.length > 0 || worktreesShelved > 0 ? "sessions_shelved" : "nothing_shelved", {
+        sessions_team: codexResults.length + claudeResults.length,
+        sessions_shelved: shelved.length,
+        worktrees_team: worktrees.length,
+        worktrees_shelved: worktreesShelved,
+        ambiguous_attribution: reasons.get("ambiguous_attribution") ?? 0,
+        labelled_root: reasons.get("labelled_root") ?? 0,
+        outside_roots_default: reasons.get("outside_roots_default") ?? 0,
+        shelf_identity_mismatch: reasons.get("shelf_identity_mismatch") ?? 0,
+        no_attribution_identity: reasons.get("no_attribution_identity") ?? 0,
+        shelf_resolve_failed: reasons.get("shelf_resolve_failed") ?? 0,
+    });
+    return {
+        // The same objects with fewer results: each filter keeps the element type of the array it filtered.
+        scan: {
+            ...options.scan,
+            codexAttribution: { ...options.scan.codexAttribution, results: codexResults },
+            claudeAttribution: { ...options.scan.claudeAttribution, results: claudeResults },
+        },
+        worktrees,
+        shelved,
+        worktreesShelved,
+        rules,
+    };
+}
+/**
+ * `cockpit backfill`'s branch (design 4.2): either store may be absent (a source not selected), and only the team
+ * results go on to become candidates. Returns the inputs untouched on a laptop with no labels.
+ */
+export function shelveBackfillScan(codexAttribution, claudeAttribution, decision) {
+    const split = splitScanByShelf({
+        scan: { codexAttribution: codexAttribution ?? { results: [] }, claudeAttribution: claudeAttribution ?? { results: [] } },
+        worktrees: [],
+        decision,
+    });
+    if (split.shelved.length === 0)
+        return { codexAttribution, claudeAttribution, shelved: 0 };
+    return {
+        codexAttribution: codexAttribution ? { ...codexAttribution, results: split.scan.codexAttribution.results } : null,
+        claudeAttribution: claudeAttribution ? { ...claudeAttribution, results: split.scan.claudeAttribution.results } : null,
+        shelved: split.shelved.length,
+    };
+}
+/**
+ * Only the worktrees whose root resolves to the team shelf: `cockpit backfill` uses this both for its batches and
+ * for the sibling-worktree inventory a team pack carries (labels, branches, head SHAs), so a drawer worktree's
+ * metadata never rides a team repo's envelope. Returns the input untouched on a laptop with no labels.
+ */
+export function teamWorktreesOnly(worktrees, decision) {
+    return splitScanByShelf({
+        scan: { codexAttribution: { results: [] }, claudeAttribution: { results: [] } },
+        worktrees,
+        decision,
+    }).worktrees;
+}
+/**
+ * The pack-level assertion (design 4.2, "mixed-shelf pack"): immediately before a worktree's pack is built, its root
+ * must still resolve to `team`. The split above makes a mismatch impossible by construction; this belt makes a bug
+ * that broke the split fail closed. The collector's own outside-roots workspace is a transport folder whose
+ * sessions were each decided above, so it is checked by its sessions, not its folder.
+ */
+export function refuseNonTeamPacks(worktrees, rules) {
+    if (!rules?.active)
+        return { allowed: worktrees, refused: 0 };
+    const allowed = worktrees.filter((worktree) => !rules.failed && (isOutsideRootsWorkspace(worktree) || resolveShelfWith(rules, worktree.repo_root).shelf === "team"));
+    const refused = worktrees.length - allowed.length;
+    if (refused > 0)
+        safeLog(TAG, "mixed_shelf_pack", { packs_refused: refused, packs_allowed: allowed.length });
+    return { allowed, refused };
+}

package/dist/commands/session-sync-upload.js

@@ -15,6 +15,7 @@ import { isOutsideRootsWorkspace } from "./backfill-outside-roots.js";
 import { giveOutsideRootsTheirOwnAllowance, outsideRootsLast, } from "./session-sync-outside-roots.js";
 import { runYieldingAtBoundaries } from "./sync-yield.js";
 import { budgetUseOf } from "./session-sync-hold.js";
+import { refuseNonTeamPacks } from "./session-sync-shelf.js";
 const CLAUDE_DAMP_GROWTH_BYTES = 256 * 1024;
 const CLAUDE_DAMP_MAX_AGE_MS = 6 * 60 * 60 * 1000;
 /**
@@ -28,10 +29,12 @@ export async function syncEveryTargetWorktree(options) {
     const { run, scan } = options;
     // BLI-17916: the outside-roots workspace goes last, so in-root evidence is
     // never held up behind it.
-    const syncWorktrees = outsideRootsLast(liveSyncTargetWorktrees(run.worktrees, [
+    // BLI-23478: and no pack whose root resolves off the team shelf is ever opened (`mixed_shelf_pack`).
+    const packGate = refuseNonTeamPacks(liveSyncTargetWorktrees(run.worktrees, [
         ...scan.codexAttribution.results,
         ...scan.claudeAttribution.results,
-    ]));
+    ]), options.shelfRules);
+    const syncWorktrees = outsideRootsLast(packGate.allowed);
     const discoveredWorktreeKeys = new Set(run.worktrees.map(liveSyncTargetKey));
     // sessionId -> prior durable pointer for damped sessions (drives the
     // growth_damped count + the skip_main decision).
@@ -59,6 +62,7 @@ export async function syncEveryTargetWorktree(options) {
         growthDampedSessionCount: dampedClaudePointers.size,
         yieldedWorktreesLeft: loop.left,
         budgetUse: budgetUseOf(rawEvidenceBudget),
+        packsRefused: packGate.refused,
     };
 }
 function syncTargetWithAllowance(options, worktree, syncWorktrees, rawEvidenceBudget, discoveredWorktreeKeys, dampedClaudePointers) {

package/dist/commands/session-sync.js

@@ -39,7 +39,10 @@ import { readLocalWorkContextForRepo } from "../local-state.js";
  * `runtimeFiles`, or the repo tests stay green while the packed CLI breaks.
  */
 import os from "node:os";
-import { getCollectorRuntimePaths } from "../local-state.js";
+import { getCollectorRuntimePaths, readLocalCollectorConfig, readLocalCollectorSessionFile } from "../local-state.js";
+import { reportShelvedSessions } from "../shelf-reports.js";
+import { splitScanByShelf } from "./session-sync-shelf.js";
+import { decideShelfMode, OWNER_CHECK_UNAVAILABLE } from "../shelf-decision.js";
 import { buildAgentSessionReport, buildAgentSessionSummary, } from "./agent-session-report.js";
 import { collectSessionCommits, withSessionCommits } from "../session-commits.js";
 import { planSyncFromLocalState } from "./session-sync-plan.js";
@@ -78,22 +81,32 @@ function scanHadReadFailure(scan) {
  * run is judged last, after everything that could have a reason has recorded
  * one.
  */
-export async function runAttributedWorktreeSync(options) {
+export async function runAttributedWorktreeSync(requested) {
     const now = new Date();
-    const homeDir = options.homeDir ?? os.homedir();
-    const paths = getCollectorRuntimePaths(options.homeDir);
+    const homeDir = requested.homeDir ?? os.homedir();
+    const paths = getCollectorRuntimePaths(requested.homeDir);
     const plan = await planSyncFromLocalState({
         paths,
         now,
-        approvedCollectionRoots: options.collectionRoots,
+        approvedCollectionRoots: requested.collectionRoots,
     });
-    const scanned = await scanAndAttributeBothSources({
+    const scannedAll = await scanAndAttributeBothSources({
         paths,
         homeDir,
         now,
-        worktrees: options.worktrees,
+        worktrees: requested.worktrees,
         plan,
     });
+    // BLI-23478 (three shelves): on a laptop with shelf settings, Tower is asked LIVE whether its person is a founder
+    // (never the saved copy). No answer holds the whole tick: nothing uploaded, nothing reported, nothing in the
+    // drawer, no cursor moved. A founder's drawer sessions and worktrees then leave the pass HERE, before any pack is
+    // built, any file staged or any git spawned for them. A teammate's laptop asks nothing and is untouched.
+    const shelfDecision = await decideShelfMode({ homeDir, dashboardUrl: requested.dashboardUrl ?? null, fetchImpl: requested.fetchImpl });
+    if (shelfDecision.mode === "hold")
+        return heldSyncRun(scannedAll);
+    const shelfSplit = splitScanByShelf({ scan: scannedAll, worktrees: requested.worktrees, decision: shelfDecision });
+    const scanned = shelfSplit.scan;
+    const options = { ...requested, worktrees: shelfSplit.worktrees };
     // BLI-17916: roots are a label, never a gate. Outside-root sessions ride this
     // tick's upload under the synthetic workspace, a few per tick, newest first.
     const scan = await admitOutsideRootSessions({
@@ -107,6 +120,7 @@ export async function runAttributedWorktreeSync(options) {
         now,
         plan,
         scan,
+        shelfRules: shelfDecision.mode === "founder" ? shelfDecision.rules : null,
     });
     const ticketByWorktree = await readWorktreeTickets(paths, options.worktrees);
     // BLI-13028: which commits each session's working tree created while it ran.
@@ -125,7 +139,50 @@ export async function runAttributedWorktreeSync(options) {
         claudePriorDurablePointers: worktreePass.claudePriorDurablePointers,
     }), commitsBySession), scan.outsideRoots?.holds);
     reportCountedSessionFacts(sessions);
-    return finishAttributedSync(options, { paths, now, plan, scan, sessions, worktreePass });
+    const shelfReports = await sendShelfReports(options, paths, shelfSplit, now);
+    const run = await finishAttributedSync(options, { paths, now, plan, scan, sessions, worktreePass });
+    return {
+        ...run,
+        sessions_shelved: shelfSplit.shelved.length,
+        packs_refused: worktreePass.packsRefused ?? 0,
+        shelf_reports: shelfReports,
+    };
+}
+/**
+ * BLI-23478: the tick Tower could not be asked about. Everything it observed waits for the next tick: no upload,
+ * no session row, no bare record, no drawer write and no cursor movement, so nothing is lost and nothing is decided
+ * on a guess. Said on the receipt (`owner_check_unavailable`), never as a success with no reason.
+ */
+function heldSyncRun(scan) {
+    return {
+        ok: true, failure_reasons: [], failure_records: [], notice: OWNER_CHECK_UNAVAILABLE, hold: null, budgetHold: null,
+        yielded_worktrees_left: 0, sessions_observed: 0, sessions_outside_root: 0, outside_root_directories: [],
+        sessions_new_this_tick: 0, sessions_pending_upload: 0, outcomes: [],
+        codexAttribution: scan.codexAttribution, claudeAttribution: scan.claudeAttribution,
+        summary: buildAgentSessionSummary({
+            codexAttribution: scan.codexAttribution, claudeAttribution: scan.claudeAttribution, outcomes: [], codexStaleCount: 0,
+            claudeStaleCount: 0, firstRunBackfill: scan.firstRunBackfill, growthDamped: 0, report: { posted: false, reason: OWNER_CHECK_UNAVAILABLE },
+        }),
+        sessions_shelved: 0, packs_refused: 0, shelf_reports: null, shelf_hold: OWNER_CHECK_UNAVAILABLE,
+    };
+}
+/** BLI-23478: the drawer sessions' bare records. Skipped entirely when nothing was shelved. */
+async function sendShelfReports(options, paths, split, now) {
+    if (split.shelved.length === 0)
+        return null;
+    const [session, config] = await Promise.all([
+        readLocalCollectorSessionFile(paths).catch(() => null),
+        readLocalCollectorConfig(paths).catch(() => null),
+    ]);
+    return reportShelvedSessions({
+        paths,
+        shelved: split.shelved,
+        dashboardUrl: options.dashboardUrl ?? config?.dashboard_url ?? null,
+        deviceToken: session?.device_token ?? null,
+        fetchImpl: options.fetchImpl,
+        allow: config?.shelf_metrics_allow ?? [],
+        now,
+    });
 }
 async function readWorktreeTickets(paths, worktrees) {
     const ticketByWorktree = new Map();
@@ -197,6 +254,9 @@ async function finishAttributedSync(options, context) {
         outside_root_directories: health.outside_root_directories,
         sessions_new_this_tick: health.sessions_new_this_tick,
         sessions_pending_upload: health.sessions_pending_upload,
+        ...(plan.collectionScope?.scope === "roots_only"
+            ? { collection_scope: { scope: "roots_only", withheld_sessions: scan.scopeWithheld?.sessions ?? 0, reason: scan.scopeWithheld?.reason ?? "collection_scope_roots_only" } }
+            : {}),
         outcomes: worktreePass.outcomes,
         codexAttribution: scan.codexAttribution,
         claudeAttribution: scan.claudeAttribution,