@gitroll/tacitt-cli 0.0.0-stage → 0.1.0

package/skills/tacitt/scripts/journey-consolidation.mjs

@@ -0,0 +1,224 @@
+import { join } from 'node:path'
+import { readFile } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { optional, save } from './journey-state.mjs'
+import { answers, task, taskTokens } from './journey-tasks.mjs'
+import {
+  validateClassificationJudgment,
+  validateClassificationProject,
+} from './journey-classification-validation.mjs'
+import { createMetadataTasks } from './journey-classification-metadata.mjs'
+
+const budget = 90000
+const instruction =
+  'You own the semantic audit and reconciliation of every supplied candidate/root; Main only dispatches this generated task and runs CLI validation/ingestion. Read every task range, including all root intents, evidence and context, then author and publish the complete answer yourself. Reconcile candidate buckets globally into final Works, not one final group per input bucket. Input size is not output size: provide only a compact group catalog and one explicit candidate-key-to-group-ID assignment for every candidate. Before proposing a new project, topic or Unsorted, compare every candidate/root against every entry in catalog. Merge equivalent supported identities across differently named candidates and attach proven existing projects using the exact catalog targetProjectId. A root with a targetProjectId has a fixed identity constraint: it must finish in a group with that same targetProjectId, including after overrides; do not redirect it or erase that target. Other roots may be attached to its group when supported. Assign miscellaneous candidates to one Unsorted; retain a topic only when at least three roots genuinely share it. Return ONLY {groups:[{id,projectName,groupKind,targetProjectId?}],assignments:{candidateKey:groupId,...},overrides?:[{rootKey,groupId}]}. Assignment keys must be the exact supplied candidate.key strings; include each exactly once and no other keys. Do not use positional arrays. Do not include description, projectType, recommendation, privacy rationale or other fields. An assignment initially applies to every root in that candidate; overrides split homonyms or path conflicts but cannot violate an existing targetProjectId constraint. Do not merge identities merely because names match. Every supplied root must end in exactly one group. Do not include root keys in groups or invent identities. Known projects attach with exact targetProjectId. The rootContext rows include CLI facts and bounded partial projectEvidence. Partial references are positive evidence, not completeness proof; missing evidence is not negative proof. Checking, using, connecting to, or integrating with a product/tool does not prove that a root develops that product’s repository; require independent repository or content evidence before assigning product project identity. A product topic may remain when roots genuinely share it. A scratch workspace name alone is not project evidence, even if descriptive; however do not ignore exact repository references or independent content evidence. Reject unsupported project or topic claims in workIntent or groupingBasis that merely reinterpret a generated scratch/temp name or copy a sibling’s activity. Missing root-specific intent must remain unknown; a coherent topic requires positive evidence for that root’s membership, otherwise use Unsorted. Do not turn an uncertain initial guess into evidence by repeating it. Before publishing, audit every candidate with workspaceKind folder separately from scratch/temp: a supported named ordinary-folder project is groupKind project, including a singleton; lack of Git metadata does not downgrade it to topic or Unsorted. The known catalog is not exhaustive. Before assigning Unsorted, audit every root with repository references, changes, or an ordinary named folder, together with its sibling roots: an independently evidenced new repository can form its own project even with one root. Missing catalog membership is not negative evidence. Before publishing, compare every retained new group with known project aliases and product-specific task intent so connection checks and supporting work are not split from their supported parent project. Do not use repository reference counts, change counts or apparent dominance as a majority vote for genuinely cross-project roots. Ambiguous or incomplete cross-project evidence needs direct owning intent before adding a targetProjectId; otherwise preserve uncertainty and leave the root unbound. Existing fixed targets remain binding; do not invent corroboration for them. Keep clear projects independent. CLI combines topics with fewer than three final roots and miscellaneous roots into Unsorted. Preserve clear projects with one root. Do not omit roots or force unrelated roots into themes. Names <=240 chars. This is a proposal, never approval.'
+
+function dispatchDescriptor(item) {
+  return {
+    id: item.id,
+    path: item.path,
+    answer: item.answer,
+    descriptor: item.descriptor,
+    prompt: item.prompt,
+    inputHash: item.inputHash,
+  }
+}
+
+const formatPayload = (data) => {
+  const candidates = data.candidates.map(
+    (candidate) =>
+      `{${Object.entries(candidate)
+        .map(
+          ([key, value]) =>
+            `${JSON.stringify(key)}:${key === 'roots' ? `[\n${value.map((row) => JSON.stringify(row)).join(',\n')}\n]` : JSON.stringify(value)}`,
+        )
+        .join(',')}}`,
+  )
+  return `{"catalog":${JSON.stringify(data.catalog)},"rootContext":[\n${data.rootContext.map((row) => JSON.stringify(row)).join(',\n')}\n],"candidates":[\n${candidates.join(',\n')}\n]}`
+}
+
+async function latestJudgments(manifest) {
+  const latest = new Map()
+  const pendingProjectTasks = []
+  for (const item of manifest.tasks) {
+    if (item.projectKeys) {
+      if (!(await optional(item.answer))) {
+        pendingProjectTasks.push(item)
+        continue
+      }
+      const results = await answers([item], 'items')
+      const ids = results.map((result) => result.projectId)
+      if (ids.length !== item.projectKeys.length || new Set(ids).size !== ids.length)
+        throw new Error('PROJECT_METADATA_COVERAGE_INVALID')
+      const expected = item.projectKeys.map(
+        (key) => manifest.classification.projects.find((project) => project.key === key)?.projectId,
+      )
+      if (expected.some((id) => !id) || expected.some((id) => !ids.includes(id)))
+        throw new Error('PROJECT_METADATA_COVERAGE_INVALID')
+      for (const result of results) {
+        if (
+          !item.projectKeys.includes(
+            manifest.classification.projects.find(
+              (project) => project.projectId === result.projectId,
+            )?.key,
+          )
+        )
+          throw new Error('PROJECT_METADATA_COVERAGE_INVALID')
+        validateClassificationProject(result, result.projectId)
+      }
+      continue
+    }
+    if (!(await optional(item.answer))) continue
+    const results = await answers([item], 'judgments')
+    const value = JSON.parse(await readFile(item.answer, 'utf8'))
+    const requested = value.evidenceRootKeys ?? []
+    if (!Array.isArray(requested) || requested.some((key) => !item.rootKeys.includes(key)))
+      throw new Error('INVALID_EVIDENCE_ROOTS')
+    if (item.evidenceRound > 0 && requested.length) throw new Error('EVIDENCE_ESCALATION_LIMIT')
+    const seen = new Set()
+    for (const result of results) {
+      if (!item.rootKeys.includes(result.rootKey) || seen.has(result.rootKey))
+        throw new Error('CLASSIFICATION_JUDGMENT_COVERAGE_INVALID')
+      validateClassificationJudgment(result, result.rootKey)
+      if (
+        result.targetProjectId &&
+        !manifest.classification.projects.some(
+          (project) => project.projectId === result.targetProjectId,
+        )
+      )
+        throw new Error('UNKNOWN_TARGET_PROJECT')
+      seen.add(result.rootKey)
+      latest.set(result.rootKey, result)
+    }
+    if (seen.size !== item.rootKeys.length)
+      throw new Error('CLASSIFICATION_JUDGMENT_COVERAGE_INVALID')
+  }
+  return { latest, pendingProjectTasks }
+}
+
+export async function consolidateClassification(directory, manifest, { refresh = false } = {}) {
+  if (!manifest.classification?.complete) throw new Error('CLASSIFICATION_READS_INCOMPLETE')
+  const { latest, pendingProjectTasks } = await latestJudgments(manifest)
+  const unknownKeys = manifest.classification.unknown.map((item) => item.rootKey)
+  if (unknownKeys.some((key) => !latest.has(key)))
+    throw new Error('CLASSIFICATION_ANSWERS_INCOMPLETE')
+  if (refresh && (!manifest.consolidation || manifest.consolidation.automatic))
+    throw new Error('CLASSIFICATION_REFRESH_UNAVAILABLE')
+  if (unknownKeys.length === 0) {
+    manifest.consolidation = {
+      automatic: true,
+      answer: null,
+      candidates: [],
+      projectCatalog: manifest.classification.projects.map((project) => ({
+        projectId: project.projectId,
+        projectName: project.projectName,
+      })),
+    }
+    await save(join(directory, 'manifest.json'), manifest)
+    return {
+      stage: 'classification',
+      consolidationReady: true,
+      readyForIngest: pendingProjectTasks.length === 0,
+      automatic: true,
+      tasks: pendingProjectTasks,
+    }
+  }
+  if (manifest.consolidation) {
+    if (refresh && manifest.consolidation.automatic)
+      throw new Error('CLASSIFICATION_REFRESH_UNAVAILABLE')
+    if (refresh) {
+      manifest.consolidationHistory ??= []
+      manifest.consolidationHistory.push({
+        ...manifest.consolidation,
+        supersededAt: new Date().toISOString(),
+      })
+    } else {
+      if (manifest.consolidation.automatic)
+        return {
+          stage: 'classification',
+          consolidationReady: true,
+          readyForIngest: pendingProjectTasks.length === 0,
+          automatic: true,
+          tasks: pendingProjectTasks,
+        }
+      if (!(await optional(manifest.consolidation.answer)))
+        return {
+          stage: 'classification',
+          consolidationReady: true,
+          readyForIngest: false,
+          tasks: [dispatchDescriptor(manifest.consolidation)],
+        }
+      const result = await createMetadataTasks(directory, manifest)
+      const tasks = [...pendingProjectTasks, ...result.tasks]
+      return {
+        ...result,
+        readyForIngest: result.readyForIngest && pendingProjectTasks.length === 0,
+        tasks,
+      }
+    }
+  }
+  const roots = unknownKeys.map((rootKey) => {
+    const judgment = latest.get(rootKey)
+    validateClassificationJudgment(judgment, rootKey)
+    return {
+      rootKey,
+      projectName: judgment.projectName,
+      workIntent: judgment.workIntent,
+      groupingBasis: judgment.groupingBasis,
+      ...(judgment.targetProjectId ? { targetProjectId: judgment.targetProjectId } : {}),
+    }
+  })
+  const candidatesByName = new Map()
+  for (const root of roots) {
+    const projectName = root.projectName.trim().normalize('NFC')
+    const name = projectName.toLocaleLowerCase('en-US')
+    const identity = JSON.stringify([root.targetProjectId ?? null, name])
+    let candidate = candidatesByName.get(identity)
+    if (!candidate) {
+      candidate = {
+        key: `c${candidatesByName.size + 1}`,
+        projectName,
+        ...(root.targetProjectId ? { targetProjectId: root.targetProjectId } : {}),
+        roots: [],
+      }
+      candidatesByName.set(identity, candidate)
+    }
+    candidate.roots.push([
+      root.rootKey,
+      root.workIntent,
+      root.groupingBasis,
+      ...(root.targetProjectId ? [root.targetProjectId] : []),
+    ])
+  }
+  const catalog = manifest.classification.projects.map((project) => ({
+    projectId: project.projectId,
+    projectName: project.projectName,
+  }))
+  const candidates = [...candidatesByName.values()]
+  const rootContext = manifest.classification.unknown.map((root) => [
+    root.rootKey,
+    root.metadata?.workspaceKind ?? null,
+    root.metadata?.workspaceName ?? null,
+    root.metadata?.projectEvidence ?? null,
+  ])
+  const data = { catalog, rootContext, candidates }
+  if (taskTokens(directory, 'consolidation', instruction, data, formatPayload) > budget)
+    throw new Error('CLASSIFICATION_CONSOLIDATION_TOO_LARGE')
+  const consolidationId = refresh ? `consolidation-${randomUUID()}` : 'consolidation'
+  manifest.consolidation = await task(directory, consolidationId, instruction, data, formatPayload)
+  const descriptor = JSON.parse(await readFile(manifest.consolidation.descriptor, 'utf8'))
+  descriptor.candidates = candidates
+  descriptor.projectCatalog = catalog
+  await save(manifest.consolidation.descriptor, descriptor)
+  manifest.consolidation.candidates = candidates
+  manifest.consolidation.projectCatalog = catalog
+  await save(join(directory, 'manifest.json'), manifest)
+  return {
+    stage: 'classification',
+    consolidationReady: true,
+    readyForIngest: false,
+    tasks: [dispatchDescriptor(manifest.consolidation)],
+  }
+}
+
+export { classificationSubmission } from './journey-consolidation-submit.mjs'

package/skills/tacitt/scripts/journey-scan-timing.mjs

@@ -0,0 +1,143 @@
+import { join } from 'node:path'
+import { hash, optional, save } from './journey-state.mjs'
+
+const selected = (view) =>
+  view.works.filter((work) => work.access !== 'drop' && work.rootSessionIds.length)
+
+function layout(view) {
+  return view.works
+    .map((work) => ({
+      id: work.id,
+      inputRevision: work.inputRevision,
+      access: work.access,
+      roots: [...work.rootSessionIds].sort((a, b) => a.localeCompare(b)),
+    }))
+    .sort((a, b) => a.id.localeCompare(b.id))
+}
+
+function binding(view, journeyId) {
+  const roots = view.works
+    .flatMap((work) => work.rootSessionIds.map((id) => [id, work.access]))
+    .sort((a, b) => a[0].localeCompare(b[0]))
+  if (new Set(roots.map(([id]) => id)).size !== roots.length)
+    throw new Error('SCAN_TIMING_DUPLICATE_ROOT')
+  return hash({
+    journeyId,
+    snapshotId: view.snapshotId,
+    classificationRevision: view.classificationRevision,
+    configurationId: view.configurationId,
+    roots,
+  })
+}
+
+function complete(view) {
+  if (
+    !view.consent ||
+    view.scope.status !== 'confirmed' ||
+    !view.readingComplete ||
+    view.phase === 'paused'
+  )
+    return false
+  if (
+    selected(view).some(
+      (work) => ['pending', 'blocked'].includes(work.status) || !work.classificationMetadata,
+    )
+  )
+    return false
+  const pending = view.privacy.terms
+    .filter((term) => term.disposition === 'pending')
+    .map((term) => JSON.stringify([term.type, term.value.normalize('NFC')]))
+  if (!pending.length) return true
+  const cards = view.privacy.cards
+  if (!cards.length || cards.length > 20) return false
+  const covered = cards.flatMap((card) => card.termKeys)
+  return (
+    covered.length === pending.length &&
+    new Set(covered).size === covered.length &&
+    pending.every((key) => covered.includes(key))
+  )
+}
+
+/** Observe the complete static + AI + metadata + cards wall interval without owning preparation. */
+export async function scanTiming(run, journeyId, view, start = false, call) {
+  const path = join(run, 'scan-timing.json')
+  let receipt = await optional(path)
+  const identity = binding(view, journeyId)
+  if (!receipt && !start) return null
+  const guidance = !receipt?.completedAt
+    ? (await call('review.guidance', { journeyId })).guidance
+    : null
+  const authority = guidance
+    ? hash({
+        instructions: guidance.instructions,
+        valueOverrides: guidance.valueOverrides,
+        rules: guidance.rules,
+        conditions: guidance.conditions.filter((condition) =>
+          ['explicit', 'delegate', 'preference'].includes(condition.origin),
+        ),
+      })
+    : null
+  if (!receipt) {
+    if (
+      !view.consent ||
+      !view.snapshotId ||
+      view.classificationRevision === null ||
+      view.scope.status !== 'confirmed' ||
+      view.phase === 'paused' ||
+      !selected(view).length
+    )
+      throw new Error('SCAN_TIMING_NOT_ALLOWED')
+    if (
+      view.readingComplete ||
+      view.privacy.terms.length ||
+      view.privacy.cards.length ||
+      view.works.some(
+        (work) =>
+          work.status !== 'pending' ||
+          work.totalBatches ||
+          work.completedBatches ||
+          work.emptyReview ||
+          work.classificationMetadata ||
+          work.metadataReviewedDigest ||
+          work.artifact,
+      )
+    )
+      throw new Error('SCAN_TIMING_ALREADY_PREPARED')
+    receipt = {
+      binding: identity,
+      authority,
+      initialGuidanceDigest: view.guidanceDigest,
+      startedAt: new Date().toISOString(),
+      completedAt: null,
+      startRevision: view.revision,
+      snapshotId: view.snapshotId,
+      initialWorks: layout(view),
+    }
+    await save(path, receipt)
+  }
+  if (receipt.binding !== identity || (authority !== null && receipt.authority !== authority))
+    throw new Error('SCAN_TIMING_SCOPE_CHANGED')
+  if (!receipt.completedAt && complete(view)) {
+    receipt = {
+      ...receipt,
+      completedAt: new Date().toISOString(),
+      endRevision: view.revision,
+      finalWorks: layout(view),
+      finalGuidanceDigest: view.guidanceDigest,
+    }
+    await save(path, receipt)
+  }
+  const elapsedMs =
+    Date.parse(receipt.completedAt ?? new Date().toISOString()) - Date.parse(receipt.startedAt)
+  const { initialWorks, finalWorks, ...summary } = receipt
+  return {
+    ...summary,
+    initialWorkCount: initialWorks.length,
+    ...(finalWorks ? { finalWorkCount: finalWorks.length } : {}),
+    receipt: path,
+    status: receipt.completedAt ? 'complete' : 'running',
+    elapsedMs,
+    budgetMs: 30 * 60 * 1000,
+    withinBudget: receipt.completedAt ? elapsedMs < 30 * 60 * 1000 : null,
+  }
+}

package/skills/tacitt/scripts/journey-state.d.mts

@@ -0,0 +1,42 @@
+export function save(path: string, value: unknown): Promise<void>
+export function hash(value: unknown): string
+export function definiteWriteRejection(error: unknown): boolean
+export function stageFingerprint(view: unknown, stage: string): string
+export function planResolutions(
+  view: {
+    works: {
+      access: string
+      rootSessionIds: string[]
+      projectName?: string
+      classificationMetadata?: { projectName?: string }
+    }[]
+    privacy: {
+      terms: { type: string; value: string; disposition: string }[]
+      cards?: { termKeys: string[]; answer?: { optionId: string } | null }[]
+    }
+    valueOverrides?: { value: string; choice: 'hide' | 'keep' }[]
+  },
+  resolutions: {
+    type: string
+    value: string
+    disposition: 'hidden' | 'keep'
+    reason: string
+  }[],
+): {
+  id: string
+  resolutions: { type: string; value: string; disposition: 'hidden' | 'keep'; reason: string }[]
+}[]
+export function recoverWrites(
+  directory: string,
+  manifest: { stage: string; tasks?: { id: string }[]; resolutionBatches?: { id: string }[] },
+  call: (
+    procedure: string,
+    request: unknown,
+  ) => Promise<{ status: string; state?: { revision: number } }>,
+): Promise<{
+  recovered: number
+  completed: number
+  total: number
+  stale: boolean
+  rejected: string | null
+}>

package/skills/tacitt/scripts/journey-state.mjs

@@ -0,0 +1,268 @@
+import { randomUUID, createHash } from 'node:crypto'
+import { readFile, writeFile, rename } from 'node:fs/promises'
+import { join } from 'node:path'
+
+export const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex')
+export const read = async (path) => JSON.parse(await readFile(path, 'utf8'))
+export async function optional(path) {
+  try {
+    return await read(path)
+  } catch (error) {
+    if (error.code === 'ENOENT') return null
+    throw error
+  }
+}
+export async function save(path, value) {
+  const temporary = `${path}.${randomUUID()}.tmp`
+  await writeFile(temporary, typeof value === 'string' ? value : JSON.stringify(value), {
+    mode: 0o600,
+    flag: 'wx',
+  })
+  await rename(temporary, path)
+}
+/** A journey-wide dictionary remains relevant while any Work is selected. */
+export function activeTerms(view) {
+  return view.works.some((work) => work.access !== 'drop' && work.rootSessionIds.length)
+    ? view.privacy.terms
+    : []
+}
+export function phaseOf(view) {
+  if (!view.consent) return 'consent'
+  if (view.phase === 'paused') return 'paused'
+  if (view.phase === 'completed') return 'completed'
+  if (view.phase === 'sending') return 'sending'
+  if (!view.snapshotId) return 'freeze'
+  if (view.classificationRevision === null) return 'classification'
+  if (view.scope.status !== 'confirmed') return 'classification-confirmation'
+  if (!view.readingComplete) return 'scan'
+  const pending = activeTerms(view).some((term) => term.disposition === 'pending')
+  if (pending && !view.privacy.cards.length) return 'cards'
+  if (view.privacy.cards.length) {
+    if (view.privacy.cards.some((card) => !card.answer)) return 'browser-answers'
+    if (view.privacy.confirmedAnswersRevision !== view.privacy.answersRevision)
+      return 'answers-confirmation'
+  }
+  if (pending) return 'resolution'
+  const selected = view.works.filter((work) => work.access !== 'drop' && work.rootSessionIds.length)
+  // Track B builds each Work's private packaging base in the background (ADR 0171).
+  if (selected.some((work) => !work.staticReview)) return 'static-finishing'
+  if (!view.privacy.packageApproval) return 'final-preview-and-confirmation'
+  if (selected.some((work) => work.artifact?.revision !== work.revision)) return 'package'
+  return 'send'
+}
+export function stageFingerprint(view, stage) {
+  return hash({
+    snapshotId: view.snapshotId,
+    guidance: view.guidanceDigest,
+    works: view.works.map((work) => [
+      work.id,
+      work.inputRevision,
+      work.rootSessionIds,
+      work.access,
+      stage === 'classification'
+        ? [
+            work.title,
+            work.projectName,
+            work.description,
+            work.projectType,
+            work.classificationRecommendation,
+          ]
+        : work.classificationMetadata?.digest,
+    ]),
+    pending: ['cards', 'resolution'].includes(stage)
+      ? activeTerms(view).filter((term) => term.disposition === 'pending')
+      : null,
+    answers: ['cards', 'resolution'].includes(stage)
+      ? [view.privacy.answersRevision, view.privacy.confirmedAnswersRevision, view.privacy.cards]
+      : null,
+  })
+}
+export const procedureFor = (stage) =>
+  ({
+    classification: 'journey.classificationSubmit',
+    cards: 'journey.cardsSubmit',
+    resolution: 'journey.resolve',
+  })[stage]
+
+/** These authoritative failures cannot have committed a phase write. */
+export const definiteWriteRejection = (error) =>
+  [
+    'INVALID_SELECTION',
+    'INVALID_ARGUMENTS',
+    'INVALID_REVIEW_SPAN',
+    'UNKNOWN_JOURNEY',
+    'UNKNOWN_WORKSPACE',
+  ].includes(error?.code)
+
+/** Unknown outcomes are replayed byte-for-byte before any freshness decision or refresh. */
+export async function recoverWrites(directory, manifest, call) {
+  const names = manifest.resolutionBatches
+    ? manifest.resolutionBatches.map((batch) => batch.id)
+    : ['batch']
+  let recovered = 0,
+    completed = 0,
+    stale = false,
+    rejected = null
+  for (const name of names) {
+    const prefix = name === 'batch' ? '' : `${name}.`
+    const request = await optional(join(directory, `${prefix}request.json`))
+    if (!request) continue
+    let receipt = await optional(join(directory, `${prefix}receipt.json`))
+    if (!receipt) {
+      try {
+        const result = await call(procedureFor(manifest.stage), request)
+        receipt = { status: result.status, revision: result.state?.revision }
+        await save(join(directory, `${prefix}receipt.json`), receipt)
+        recovered++
+      } catch (error) {
+        const code = error?.code
+        if (!definiteWriteRejection(error)) throw error
+        receipt = { status: 'rejected', code }
+        await save(join(directory, `${prefix}receipt.json`), receipt)
+      }
+    }
+    if (receipt.status === 'stale') stale = true
+    else if (receipt.status === 'rejected') rejected = receipt.code
+    else completed++
+  }
+  return { recovered, completed, total: names.length, stale, rejected }
+}
+
+export const resolutionAuthority = (view) =>
+  hash({
+    tasks: stageFingerprint({ ...view, privacy: { ...view.privacy, terms: [] } }, 'resolution'),
+    scope: view.scope,
+    classificationRevision: view.classificationRevision,
+  })
+export const resolutionEvidence = (view) =>
+  Object.fromEntries(
+    activeTerms(view)
+      .filter((term) => term.disposition === 'pending')
+      .map((term) => [termKey(term), hash(term)]),
+  )
+const termKey = (term) => JSON.stringify([term.type, term.value.normalize('NFC')])
+
+/** Plan complete coverage before any write; same-literal type decisions stay atomic. */
+const OWN_PROJECT_KEEP_REASON =
+  "A Keep card answer for one of the person's own Work project names takes precedence over Hide."
+export function planResolutions(view, resolutions) {
+  const pending = new Set(
+    activeTerms(view)
+      .filter((term) => term.disposition === 'pending')
+      .map(termKey),
+  )
+  const seen = new Set()
+  const groups = new Map()
+  for (const term of resolutions) {
+    const key = termKey(term)
+    if (!pending.has(key) || seen.has(key) || !['hidden', 'keep'].includes(term.disposition))
+      throw new Error('INVALID_SELECTION')
+    seen.add(key)
+    const value = term.value.normalize('NFC')
+    const group = groups.get(value) ?? []
+    group.push(term)
+    groups.set(value, group)
+  }
+  if (seen.size !== pending.size) throw new Error('INVALID_SELECTION')
+  const termsByValue = Map.groupBy(activeTerms(view), (term) => term.value.normalize('NFC'))
+  const overridesByValue = new Map()
+  for (const item of view.valueOverrides ?? []) {
+    const value = item.value.normalize('NFC')
+    if (!overridesByValue.has(value)) overridesByValue.set(value, item)
+  }
+  // Hide wins for a value covered by cards with different answers (ADR 0191), except that a Keep
+  // card answer keeps one of the person's own Work project or repository names (ADR 0202).
+  const cardValues = (optionId) => {
+    const keys = new Set(
+      (view.privacy.cards ?? []).flatMap((card) =>
+        card.answer?.optionId === optionId ? card.termKeys : [],
+      ),
+    )
+    return new Set(
+      activeTerms(view)
+        .filter((term) => keys.has(termKey(term)))
+        .map((term) => term.value.normalize('NFC')),
+    )
+  }
+  const hideCardValues = cardValues('hide')
+  const keepCardValues = cardValues('keep')
+  const ownNames = new Set(
+    view.works.flatMap((work) =>
+      [work.projectName, work.classificationMetadata?.projectName]
+        .filter((name) => typeof name === 'string' && name)
+        .map((name) => name.normalize('NFC').toLowerCase()),
+    ),
+  )
+  const batches = []
+  let batch = []
+  for (const group of groups.values()) {
+    if (group.length > 20000) throw new Error('PROCESSING_LIMIT')
+    if (batch.length + group.length > 20000) {
+      batches.push({ id: randomUUID(), resolutions: batch })
+      batch = []
+    }
+    const value = group[0]?.value.normalize('NFC') ?? ''
+    const sameValue = termsByValue.get(value) ?? []
+    const mandatory = sameValue.some((term) => ['contact', 'credentials'].includes(term.type))
+    const override = overridesByValue.get(value)
+    const ownKeep =
+      !mandatory && !override && keepCardValues.has(value) && ownNames.has(value.toLowerCase())
+    const hideWins =
+      mandatory ||
+      (override ? override.choice === 'hide' : false) ||
+      (!override &&
+        !ownKeep &&
+        (hideCardValues.has(value) ||
+          group.some((term) => term.disposition === 'hidden') ||
+          sameValue.some((term) => term.disposition === 'hidden')))
+    batch.push(
+      ...group.map((term) =>
+        hideWins
+          ? {
+              ...term,
+              disposition: 'hidden',
+              reason:
+                term.disposition === 'hidden'
+                  ? term.reason
+                  : mandatory
+                    ? 'Mandatory masking always hides this keyword.'
+                    : override?.choice === 'hide'
+                      ? 'An explicit current value rule hides this keyword.'
+                      : hideCardValues.has(value) &&
+                          !group.some((item) => item.disposition === 'hidden') &&
+                          !sameValue.some((item) => item.disposition === 'hidden')
+                        ? 'A Hide card answer covering this value takes precedence over Keep.'
+                        : 'A Hidden judgment for this NFC keyword takes precedence across term types.',
+            }
+          : override?.choice === 'keep'
+            ? { ...term, disposition: 'keep' }
+            : ownKeep && term.disposition !== 'keep'
+              ? { ...term, disposition: 'keep', reason: OWN_PROJECT_KEEP_REASON }
+              : term,
+      ),
+    )
+  }
+  if (batch.length) batches.push({ id: randomUUID(), resolutions: batch })
+  return batches
+}
+
+/** Receipts explain our own pending-set changes without accepting other edits as fresh. */
+export async function assertResolutionFresh(directory, manifest, view) {
+  if (resolutionAuthority(view) !== manifest.resolutionAuthority) throw new Error('STALE_TASKS')
+  const expected = new Set()
+  for (const batch of manifest.resolutionBatches) {
+    const receipt = await optional(join(directory, `${batch.id}.receipt.json`))
+    if (receipt && receipt.status !== 'stale') continue
+    for (const term of batch.resolutions) expected.add(termKey(term))
+  }
+  const evidence = resolutionEvidence(view)
+  if ([...expected].some((key) => evidence[key] !== manifest.resolutionEvidence[key]))
+    throw new Error('STALE_TASKS')
+  const actual = new Set(
+    activeTerms(view)
+      .filter((term) => term.disposition === 'pending')
+      .map(termKey),
+  )
+  if (expected.size !== actual.size || [...expected].some((key) => !actual.has(key)))
+    throw new Error('STALE_TASKS')
+}