What is the scope of the drupal session cookie? I am bootstrapping drupal 7 (using DRUPAL_BOOTSTRAP_FULL) so that I can use drupal's authentication/security features in the rapid development of a web app I'm doing a proof of concept for. (And yes I know it is better to use drush to bootstrap drupal.)

If the PHP file that I am bootstrapping drupal from is in the root drupal directory, then the bootstrapping works -- I know this because inspecting the $user global variable will show that I am logged in.

If the PHP file is not in the root drupal directory (whether a subdirectory of the root drupal directory or a sibling of the root drupal directory), then the bootstrapping works -- I can inspect the $user global variable, but the $user variable says I am an anonymous user rather than the logged in user that I am.

Is my suspicion right that this is related to the scope of the drupal session cookie? If so, what is that scope?
Better late than never?

Yes, if you are creating the cookie with a default path. It will use the current page path. So the cookie will be restricted to any path starting with the defined one (if it's /a/b then the cookie will be available for /a/b, a/b/c etc but not /a alone).

(I had a short period of hair-tearing once where I was accessing a site using it's IP address and unable to understand why the cookies weren't available ... they were hardwired to the domain.)