@gitroll/tacitt-cli 0.1.0 → 0.2.0

package/dist/{query-Da-KDbSV.mjs → query-BA0XCwnR.mjs}

@@ -1,10 +1,11 @@
-import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, E as prepareCollectionProduction, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Y as createInspectionProcessor, Z as createCleanup, _ as readStaticSessionMasks, a as scanReviewFields, at as windowsAclCodes, c as readSessionScanRecords, et as makePrivateDirectory, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as isWindowsAclFailure, j as readCollectionIndex, k as renderJobDigest, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as restrictToOwner, o as createWorkPieces, p as openConfiguredUpload, r as prepareSessionScans, rt as windowsOwnerOnly, s as readSessionScanFields, t as preparedScanConfiguration, tt as openPrivateFile, v as staticSessionJobs, w as createCollectionArtifacts, y as writeLogicalJourneyBase, z as parallelismLimits } from "./src-BngGpFKd.mjs";
-import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey, zt as filterInventoryByPeriod } from "./locate-Bn32k2se.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-DynBRDBc.mjs";
-import { $ as settingsBatchSchema, $n as bReviewDigest, $r as defaultScopedSettings, $t as journeyResourceQuerySchema, A as accountProfileSchema, Ar as staticSessionResourceSchema, At as sendSettingsSchema, B as inspectionCancelSchema, Br as journeyRenderInputSchema, C as rebindReviewAlignment, Cn as readConfirmedHideChange, Cr as privacyDecisionDigest, Ct as sendPrepareSchema, D as guardedFindingText, Dr as hasCurrentStaticReview, Dt as sendReceiptSchema, E as reviewBatchReuse, En as termHideAdditions, Er as nativeRespondSchema, Et as sendArtifactSchema, F as storedCredentialSchema, Fr as withReadingProgress, Gn as workDecisionDigest, Gr as selectionSchema, Hn as maskedHitsStale, Hr as commandSchema, Ht as reviewCompileSchema, In as confirmedHideGroupIds, Jn as reviewCandidateInputSchema, Jr as stateSchema, Jt as journeySearchResultSchema, Lr as journeyFindingImpactSchema, M as deviceProfileScopeSchema, Mr as isReadingComplete, Mt as currentJourneyAdapters, N as profileUrlMatchesIdentity, Nr as isSelectedWork, Nt as obsoleteJourney, O as staticallyHiddenFindings, Or as staticReviewDigest, Ot as sendReplaceResultSchema, P as readAccountAvatarUrl, Pn as bTermMatcher, Rn as confirmedHideKinds, Rr as journeyFindingsSchema, S as bReviewScope, Sr as assertJourneyPrivacyReady, St as sendChoiceSchema, T as rebindReviewSubmit, Tr as nativeGetSchema, Tt as journeySendSchema, Ur as packageCommandSchema, Ut as journeyContextQuerySchema, V as inspectionStartSchema, Vn as journeyConfirmedHides, Vr as journeyRenderSchema, Vt as journeyReviewStorageQuerySchema, W as inspectionQuerySchema, Wn as retireWorkDescription, Wr as selectionBatchSchema, Xn as reviewRepairInputSchema, Xr as recommendParallelism, Xt as searchScopeDigest, Yn as reviewCandidateResourceSchema, Zn as reviewRepairResourceSchema, Zt as journeyPolicyRespondSchema, _t as emptyTermsRevision, a as validateBCrossSegmentReview, ar as scanSessionResourceSchema, bt as replaceSensitiveTermsSchema, c as reconcileBSession, cr as verifiedScanGitSeeds, ct as resolveFailureLocation, ei as freezeConfiguration, et as settingsQuerySchema, fn as sessionReviewInputSchema, fr as journeyInventoryQuerySchema, ft as manualUploadChoiceSchema, g as hideScopeDigest, gn as sessionUsefulnessInputSchema, gr as emptyPreparationFacts, h as activeJourneyTerms, ht as manualUploadStartSchema, i as locateTermEvidence, in as reviewAttemptResourceSchema, ir as scanPreparationDigest, j as deviceAuthorizationSchema, jr as hasCompleteWorkDescription, k as createAccount, kt as sendResolutionSchema, l as reconstructBFields, lr as scanExclusionResourceSchema, lt as validateFailureLocation, m as splitSelectorValues, mt as manualUploadSchema, n as scanBatchContextDigest, nn as journeyPlaceSchema, o as bCrossSegmentReviewSchema, or as scanGitSeedsId, p as selectedValueMembers, pn as sessionReviewQuerySchema, pt as manualUploadPrepareSchema, qn as workCorrectionBinding, qr as producerVersion, r as scanBatchEquivalenceDigest, rt as appendSensitiveTerms, s as bRereadDigest, sn as sessionReconcileInputSchema, sr as scanGitSeedsResource, st as artifactFailureDetailSchema, t as retireScanGeneration, ti as selectFrozenConfiguration, tr as planBRepair, tt as readWorkspaceOutcomes, u as newJourneyWork, un as sessionRereadInputSchema, ut as manualUploadActionSchema, v as changeJourney, vt as maximumTermsFileBytes, w as rebindReviewOverlay, wr as nativeEventsSchema, wt as sendStartSchema, x as isGenericPublicTerm, xn as confirmedHideAdditions, xr as journeyClassificationSessionsSchema, xt as sendActionSchema, yt as normalizeSensitiveTerms, z as createApplication, zr as journeyPreviewSchema, zt as applyClassification } from "./src-CPPjOyHZ.mjs";
-import { $ as schemaVersion, A as inspectionQuerySchema$1, B as privateReviewHash, C as loadAuthenticatedReview, D as sessionUsefulnessRecommendation, E as aggregateUsefulness, F as reuseQuerySchema, G as initializeAndClaim, H as createJourneyPayloadFiles, I as batchQuery, J as withDatabase, K as ownership, L as isPrivateResourceKind, M as sameCandidateRequest, N as validateCandidateAttempt, O as sessionQuery, P as validateUnitCandidate, Q as checkVersion, R as privateResourceHeader, S as loadAcceptedReview, T as loadPrivateResource, U as validateBatchBody, V as batchHeader, W as requireActiveBatch, X as readStoredState, Y as readBundleDirectory, Z as validateState, _ as loadRereadBodies, _t as isSqliteCorruption, a as decodeError, at as inspectStateFiles, b as validateSessionReconciliation, c as dropsAnchor, ct as readResetMarker, d as parseDelivery, dt as syncDirectory, et as beginReset, f as validateCandidate, ft as withStateSnapshot, g as loadReconciliation, gt as isCoordinationBusy, h as loadPreparedBodies, ht as errorCode$1, i as createExecutor, it as hasResetMarker, j as evaluateUnitEvidence, k as resourceSelectionQuerySchema, l as replySchema, lt as recheckPrivatePath, m as loadPreparation, mt as StoreError, n as releaseInheritedHeapFlags, nt as databaseName, o as ProtocolError, ot as present, p as loadStatus, pt as withFileCheckTimings, q as validateDatabase, r as storeHeapLimits, rt as finishReset, s as allowedReplies, st as privatePath, tt as createDatabaseFile, u as operations, ut as stateDirectory, v as loadSessionBodies, w as loadBatch, x as validateSessionBindings, y as validatePreparationSelection, z as termReuseQuerySchema } from "./heap-tfU61Ehy.mjs";
-import { a as writeJourneyOutput, c as mergeHideIndexTokens, l as packRenderHideIndex, o as createHideIndexTokens, s as hideIndexTexts, t as journeyOutputJob } from "./job--TceKk0l.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-B85GaVIz.mjs";
+import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, E as prepareCollectionProduction, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as createCleanup, _ as readStaticSessionMasks, a as scanReviewFields, at as windowsAclCodes, c as readSessionScanRecords, et as makePrivateDirectory, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as isWindowsAclFailure, j as readCollectionIndex, k as renderJobDigest, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as restrictToOwner, o as createWorkPieces, p as openConfiguredUpload, r as prepareSessionScans, rt as windowsOwnerOnly, s as readSessionScanFields, t as preparedScanConfiguration, tt as openPrivateFile, v as staticSessionJobs, w as createCollectionArtifacts, y as writeLogicalJourneyBase, z as parallelismLimits } from "./src-k0Ya1Bri.mjs";
+import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey, zt as filterInventoryByPeriod } from "./locate-U3-nkird.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-B5SArpVY.mjs";
+import { $n as reviewRepairResourceSchema, $t as journeyPolicyRespondSchema, A as createAccount, Ar as hasCurrentStaticReview, At as sendReplaceResultSchema, B as createApplication, Bn as confirmedHideKinds, C as bReviewScope, Cn as confirmedHideAdditions, Cr as journeyClassificationSessionsSchema, Ct as sendActionSchema, D as reviewBatchReuse, Dr as nativeEventsSchema, Dt as journeySendSchema, E as rebindReviewSubmit, Er as privacyDecisionDigest, Et as sendStartSchema, F as readAccountAvatarUrl, Fr as isClassifying, Ft as obsoleteJourney, Gr as journeyRenderSchema, Gt as journeyContextQuerySchema, H as inspectionStartSchema, Hr as journeyFindingsSchema, I as storedCredentialSchema, In as bTermMatcher, Ir as isReadingComplete, Jr as selectionBatchSchema, K as inspectionQuerySchema, Kn as retireWorkDescription, Kr as commandSchema, Lr as isSelectedWork, M as deviceAuthorizationSchema, Mt as sendSettingsSchema, N as deviceProfileScopeSchema, Nr as staticSessionResourceSchema, O as guardedFindingText, On as termHideAdditions, Or as nativeGetSchema, Ot as sendArtifactSchema, P as profileUrlMatchesIdentity, Pr as hasCompleteWorkDescription, Pt as currentJourneyAdapters, Qn as reviewRepairInputSchema, Qr as stateSchema, Qt as searchScopeDigest, Rn as confirmedHideGroupIds, S as isGenericPublicTerm, St as replaceSensitiveTermsSchema, T as rebindReviewOverlay, Tn as readConfirmedHideChange, Tr as assertJourneyPrivacyReady, Tt as sendPrepareSchema, U as validateInspectionBatch, Un as journeyConfirmedHides, Ur as journeyPreviewSchema, Ut as journeyReviewStorageQuerySchema, V as inspectionCancelSchema, Vr as journeyFindingImpactSchema, Vt as applyClassification, Wn as maskedHitsStale, Wr as journeyRenderInputSchema, Wt as reviewCompileSchema, Xn as reviewCandidateInputSchema, Xt as journeySearchResultSchema, Yn as workCorrectionBinding, Yr as selectionSchema, Zn as reviewCandidateResourceSchema, Zr as producerVersion, _ as hideScopeDigest, _t as manualUploadStartSchema, a as locateTermEvidence, ai as selectFrozenConfiguration, at as appendSensitiveTerms, bt as maximumTermsFileBytes, c as bRereadDigest, cr as scanGitSeedsId, d as newJourneyWork, dr as scanExclusionResourceSchema, dt as validateFailureLocation, ei as recommendParallelism, fn as sessionRereadInputSchema, ft as manualUploadActionSchema, g as activeJourneyTerms, gt as manualUploadSchema, h as splitSelectorValues, hn as sessionReviewQuerySchema, ht as manualUploadPrepareSchema, i as scanBatchEquivalenceDigest, ii as freezeConfiguration, in as journeyPlaceSchema, j as accountProfileSchema, jr as staticReviewDigest, jt as sendResolutionSchema, k as staticallyHiddenFindings, kr as nativeRespondSchema, kt as sendReceiptSchema, l as reconcileBSession, ln as sessionReconcileInputSchema, lr as scanGitSeedsResource, lt as artifactFailureDetailSchema, m as selectedValueMembers, mn as sessionReviewInputSchema, mr as journeyInventoryQuerySchema, mt as manualUploadChoiceSchema, n as retireScanGeneration, nt as settingsQuerySchema, o as validateBCrossSegmentReview, on as reviewAttemptResourceSchema, or as scanPreparationDigest, qn as workDecisionDigest, qr as packageCommandSchema, r as scanBatchContextDigest, ri as defaultScopedSettings, rr as planBRepair, rt as readWorkspaceOutcomes, s as bCrossSegmentReviewSchema, sr as scanSessionResourceSchema, t as resetWorkScan, tn as journeyResourceQuerySchema, tr as bReviewDigest, tt as settingsBatchSchema, u as reconstructBFields, ur as verifiedScanGitSeeds, ut as resolveFailureLocation, vn as sessionUsefulnessInputSchema, vr as emptyPreparationFacts, w as rebindReviewAlignment, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, y as changeJourney, yt as emptyTermsRevision, zr as withReadingProgress } from "./src-CC95LYYp.mjs";
+import { $ as schemaVersion, A as inspectionQuerySchema$1, B as privateReviewHash, C as loadAuthenticatedReview, D as sessionUsefulnessRecommendation, E as aggregateUsefulness, F as reuseQuerySchema, G as initializeAndClaim, H as createJourneyPayloadFiles, I as batchQuery, J as withDatabase, K as ownership, L as isPrivateResourceKind, M as sameCandidateRequest, N as validateCandidateAttempt, O as sessionQuery, P as validateUnitCandidate, Q as checkVersion, R as privateResourceHeader, S as loadAcceptedReview, T as loadPrivateResource, U as validateBatchBody, V as batchHeader, W as requireActiveBatch, X as readStoredState, Y as readBundleDirectory, Z as validateState, _ as loadRereadBodies, _t as isSqliteCorruption, a as decodeError, at as inspectStateFiles, b as validateSessionReconciliation, c as dropsAnchor, ct as readResetMarker, d as parseDelivery, dt as syncDirectory, et as beginReset, f as validateCandidate, ft as withStateSnapshot, g as loadReconciliation, gt as isCoordinationBusy, h as loadPreparedBodies, ht as errorCode$1, i as createExecutor, it as hasResetMarker, j as evaluateUnitEvidence, k as resourceSelectionQuerySchema, l as replySchema, lt as recheckPrivatePath, m as loadPreparation, mt as StoreError, n as releaseInheritedHeapFlags, nt as databaseName, o as ProtocolError, ot as present, p as loadStatus, pt as withFileCheckTimings, q as validateDatabase, r as storeHeapLimits, rt as finishReset, s as allowedReplies, st as privatePath, tt as createDatabaseFile, u as operations, ut as stateDirectory, v as loadSessionBodies, w as loadBatch, x as validateSessionBindings, y as validatePreparationSelection, z as termReuseQuerySchema } from "./heap-BHcvxWCw.mjs";
+import { a as writeJourneyOutput, c as mergeHideIndexTokens, l as packRenderHideIndex, o as createHideIndexTokens, s as hideIndexTexts, t as journeyOutputJob } from "./job-J3NFw3MH.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-B8DAiQ6Z.mjs";
+import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
 import { copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
@@ -826,12 +827,16 @@ function runObserved(frame, leg, work) {
 }
 //#endregion
 //#region packages/local-host/src/router.ts
-/** The browser may explicitly change one Work's visibility; all other decisions stay in chat. */
+/** Decisions the person makes in the panel while the agent waits for them. */
 const nativePanelRespondSchema = z.object({
 	journeyId: nativeRespondSchema.shape.journeyId,
 	expectedRevision: nativeRespondSchema.shape.expectedRevision,
 	idempotencyKey: nativeRespondSchema.shape.idempotencyKey,
 	action: z.union([
+		z.object({
+			kind: z.literal("consent"),
+			allow: z.boolean()
+		}).strict(),
 		z.object({
 			kind: z.literal("work-access"),
 			workId: z.uuid(),
@@ -845,12 +850,13 @@ const nativePanelRespondSchema = z.object({
 			kind: z.literal("card-answer"),
 			cardId: z.uuid(),
 			optionId: z.string(),
-			remember: z.boolean().optional()
+			remember: z.boolean().optional(),
+			excludedTermKeys: z.array(z.string().min(1)).max(2e4).optional()
 		}).strict(),
 		z.object({ kind: z.literal("package-confirm") }).strict()
 	])
 }).strict();
-function createRouter(application, account, stopping, delivery, nativeInspection) {
+function createRouter(application, account, stopping, delivery, nativeInspection, agentPresence) {
 	const t = initTRPC.context().create({
 		sse: {
 			ping: {
@@ -920,6 +926,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			respond: t.procedure.input(sendChoiceSchema).mutation(({ input }) => sending().respond(input)),
 			pause: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().pause(input)),
 			resume: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().resume(input)),
+			withdraw: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().withdraw(input)),
 			advance: t.procedure.input(sendAddress).mutation(({ input }) => sending().advance(input, stopping))
 		}),
 		manualUpload: t.router({
@@ -942,6 +949,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			findingImpact: t.procedure.input(journeyFindingImpactSchema).query(({ input, signal }) => native().findingImpact(input, signal)),
 			preview: t.procedure.input(journeyPreviewSchema).query(({ input, signal }) => native().preview(input, signal)),
 			get: t.procedure.input(nativeGetSchema).query(({ input, signal }) => readThroughContention(() => native().get(input), signal)),
+			presence: t.procedure.input(z.object({ journeyId: z.uuid() }).strict()).query(async ({ input }) => ({ agent: await agentPresence?.(input.journeyId) ?? null })),
 			inventory: t.procedure.input(journeyInventoryQuerySchema).query(({ input }) => native().inventory(input)),
 			events: t.procedure.input(nativeEventsSchema).query(({ input, signal }) => readThroughContention(() => native().events(input, signal), signal))
 		}),
@@ -2827,7 +2835,7 @@ async function startHost(options) {
 		reply.raw.once("close", () => streams.delete(reply.raw));
 	});
 	const trpcOptions = {
-		router: createRouter(options.application, options.account, stopping.signal, delivery, options.nativeInspection),
+		router: createRouter(options.application, options.account, stopping.signal, delivery, options.nativeInspection, options.agentPresence),
 		createContext: ({ req }) => {
 			const currentView = requestObservations.get(req);
 			return {
@@ -5458,6 +5466,10 @@ function parseOptions(args, source = sourceCheckout) {
 						type: "boolean",
 						default: false
 					},
+					detach: {
+						type: "boolean",
+						default: false
+					},
 					"state-dir": { type: "string" },
 					"bundle-dir": { type: "string" },
 					"claude-home": { type: "string" },
@@ -5507,6 +5519,7 @@ function parseOptions(args, source = sourceCheckout) {
 		"all"
 	].includes(parsed.values.agent) || parsed.values.scope !== void 0 && !["user", "project"].includes(parsed.values.scope) || parsed.values["cli-path"] !== void 0 && !isAbsolute(parsed.values["cli-path"]) || parsed.values["configure-agents"] !== void 0 && parsed.values["skip-agent-config"] !== void 0) throw new Error("INVALID_ARGUMENTS");
 	if (parsed.values.async && (!command || !longCommands.has(command))) throw new Error("INVALID_ARGUMENTS");
+	if (parsed.values.detach && command !== "journey.serve") throw new Error("INVALID_ARGUMENTS");
 	const timeoutMs = parsed.values["timeout-ms"] === void 0 ? 3e4 : Number(parsed.values["timeout-ms"]);
 	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647) throw new Error("INVALID_ARGUMENTS");
 	if (parsed.values.output && !stateDump) throw new Error("INVALID_ARGUMENTS");
@@ -5552,6 +5565,8 @@ ${Array.from(businessCommands).join("\n")}
 
 Business commands invoke the shared Application directly without an HTTP server.
 journey.serve starts a focused confirmation host, emits JSON readiness, and waits until stopped.
+journey.serve --detach starts that host in its own process, prints its readiness with the host's
+pid, and exits; stop the host with that pid.
 It does not discover sessions or open a browser. The agent opens its private URL in the right pane.
 Workflow mutations require protocolVersion, runId and expectedRevision in JSON input.
 Long commands emit the operation ID immediately as NDJSON, then wait up to 30000 ms.
@@ -7254,7 +7269,8 @@ async function saveStaticSession(storage, binding, item, result, signal) {
 			result: await describe(resultPath, signal),
 			primary: await describe(result.spoolPath, signal),
 			companion: await describe(result.companionSpoolPath, signal),
-			masks: await describe(result.maskSpoolPath, signal)
+			masks: await describe(result.maskSpoolPath, signal),
+			...result.images === void 0 ? {} : { imagesOmitted: result.images }
 		});
 		await storage.saveResource(resource);
 		saved = true;
@@ -7413,6 +7429,7 @@ async function prepareStaticWork(options) {
 		const target = current.works.find((item) => item.id === work.id);
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (current.snapshotId !== snapshotId || target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
+		const images = resources.map((resource) => resource.imagesOmitted);
 		return {
 			...current,
 			works: current.works.map((item) => item.id === work.id ? {
@@ -7420,7 +7437,8 @@ async function prepareStaticWork(options) {
 				staticReview: {
 					snapshotId,
 					inputRevision: work.inputRevision,
-					digest: staticReviewDigest(resources)
+					digest: staticReviewDigest(resources),
+					...images.every((count) => count !== void 0) ? { imagesOmitted: images.reduce((sum, count) => sum + count, 0) } : {}
 				}
 			} : item)
 		};
@@ -7657,8 +7675,8 @@ function createJourneyPreparation(options) {
 			}));
 			if (!state.works.length) throw new ApplicationError("INVALID_SELECTION");
 			if (!scanRequested) await captureSortingScope(storage, journeyId, workApproval(plan.approval, state.works.flatMap((work) => work.rootSessionIds)), directory, abort.signal);
-			const works = scanRequested && state.scope.status === "confirmed" ? state.works : [];
-			if (works.length) run = await runWorkers(options.workers);
+			const scanWorks = scanRequested && state.scope.status === "confirmed" ? state.works : [];
+			if (scanWorks.length) run = await runWorkers(options.workers);
 			const frozen = state;
 			const blockWork = (work, error) => changeJourney(storage, journeyId, "snapshot", (before) => {
 				if (before.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
@@ -7672,8 +7690,8 @@ function createJourneyPreparation(options) {
 				});
 			}, 100);
 			let submittedWorks = 0;
-			const submitted = Promise.withResolvers();
-			if (!works.length) submitted.resolve();
+			let works = [];
+			let submitted = Promise.withResolvers();
 			const submission = () => {
 				let done = false;
 				return () => {
@@ -7694,6 +7712,14 @@ function createJourneyPreparation(options) {
 					return false;
 				}
 			};
+			/** D2: the person dropped this Work while it was prepared; the other Works go on. */
+			const droppedMidScan = async (workId) => {
+				const now = await storage.current(journeyId);
+				const work = now?.works.find((item) => item.id === workId);
+				return Boolean(now && now.phase !== "paused" && now.scope.status === "confirmed" && work && !isSelectedWork(work));
+			};
+			/** Scan generations this run prepared, including those its own isolation started. */
+			const prepared = /* @__PURE__ */ new Set();
 			/** True when failing roots left the Work, which is then prepared again (ADR 0188). */
 			const prepareWorkOnce = async (planned, onSubmitted) => {
 				abort.signal.throwIfAborted();
@@ -7707,6 +7733,7 @@ function createJourneyPreparation(options) {
 					"reading",
 					"review"
 				].includes(work.status)) return false;
+				prepared.add(`${work.id}:${work.inputRevision}`);
 				await prepareClassificationMetadata(storage, latest, work, options.processing, abort.signal);
 				let failures = collectPreparationFailures(plan.approval.inventory, work.rootSessionIds, {
 					journeyId,
@@ -7723,6 +7750,7 @@ function createJourneyPreparation(options) {
 						onTiming: (timing) => options.onTiming?.(planned.id, timing)
 					}, run.workers, (revised) => {
 						work = revised;
+						prepared.add(`${revised.id}:${revised.inputRevision}`);
 						failures = collectPreparationFailures(plan.approval.inventory, revised.rootSessionIds, {
 							journeyId,
 							snapshotId: latest.snapshotId,
@@ -7735,7 +7763,10 @@ function createJourneyPreparation(options) {
 					const code = safeCode(error);
 					if (code !== "OPERATION_CANCELED") options.onFailure(error, failures.read());
 					abort.signal.throwIfAborted();
-					if (code === "OPERATION_CANCELED") throw error;
+					if (code === "OPERATION_CANCELED") {
+						if (await droppedMidScan(planned.id)) return false;
+						throw error;
+					}
 					if (work && await isolateRoots(work, error)) return true;
 					if (work) await blockWork(work, error);
 				}
@@ -7745,14 +7776,14 @@ function createJourneyPreparation(options) {
 				for (let attempt = 0; attempt < planned.rootSessionIds.length; attempt++) if (!await prepareWorkOnce(planned, onSubmitted)) return;
 			};
 			/** Track B for one Work; its failure blocks that Work like a Track A failure would. */
-			const staticWork = async (planned) => {
-				await submitted.promise;
+			const staticWork = async (planned, passSubmitted) => {
+				await passSubmitted;
 				abort.signal.throwIfAborted();
 				const latest = await storage.current(journeyId);
 				abort.signal.throwIfAborted();
 				if (!latest?.consent || latest.phase === "paused" || latest.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
 				const work = latest.works.find((item) => item.id === planned.id);
-				if (!work) return;
+				if (!work || !isSelectedWork(work)) return;
 				try {
 					await inBackgroundStoreLane(() => prepareStaticWork({
 						storage,
@@ -7767,6 +7798,7 @@ function createJourneyPreparation(options) {
 				} catch (error) {
 					abort.signal.throwIfAborted();
 					const code = safeCode(error);
+					if (code === "OPERATION_CANCELED" && await droppedMidScan(work.id)) return;
 					if (code === "COORDINATION_BUSY" || code === "OPERATION_CANCELED") throw error;
 					options.onFailure(error);
 					await blockWork(work, error);
@@ -7779,23 +7811,50 @@ function createJourneyPreparation(options) {
 				abort.abort(error);
 			};
 			const statics = [];
-			await Promise.all(Array.from({ length: run.pool ? works.length : Math.min(1, works.length) }, async () => {
-				for (let work = works[next++]; work && !fatal; work = works[next++]) {
-					const planned = work;
-					const onSubmitted = submission();
-					try {
-						await retryContention(() => prepareWork(planned, onSubmitted), (error) => options.onFailure(error), abort.signal);
-					} catch (error) {
-						stop(error);
-					} finally {
-						onSubmitted();
+			const pass = async (batch) => {
+				works = batch;
+				next = 0;
+				submittedWorks = 0;
+				submitted = Promise.withResolvers();
+				if (!works.length) submitted.resolve();
+				const passSubmitted = submitted.promise;
+				await Promise.all(Array.from({ length: run.pool ? works.length : Math.min(1, works.length) }, async () => {
+					for (let work = works[next++]; work && !fatal; work = works[next++]) {
+						const planned = work;
+						const onSubmitted = submission();
+						try {
+							await retryContention(() => prepareWork(planned, onSubmitted), (error) => options.onFailure(error), abort.signal);
+						} catch (error) {
+							stop(error);
+						} finally {
+							onSubmitted();
+						}
+						statics.push(retryContention(() => staticWork(planned, passSubmitted), (error) => options.onFailure(error), abort.signal).catch(stop));
 					}
-					statics.push(retryContention(() => staticWork(planned), (error) => options.onFailure(error), abort.signal).catch(stop));
+				}));
+				while (submittedWorks < works.length) submission()();
+			};
+			/** Selected Works this run has not prepared yet, waiting while grouping continues (E2). */
+			const later = async () => {
+				for (;;) {
+					abort.signal.throwIfAborted();
+					const latest = await storage.current(journeyId);
+					if (!latest || latest.phase === "paused" || latest.scope.status !== "confirmed") return [];
+					const ready = latest.works.filter((work) => isSelectedWork(work) && [
+						"pending",
+						"reading",
+						"review"
+					].includes(work.status) && !prepared.has(`${work.id}:${work.inputRevision}`));
+					if (ready.length || !isClassifying(latest)) return ready;
+					await setTimeout$1(laterWorksPollMs, void 0, { signal: abort.signal }).catch(() => abort.signal.throwIfAborted());
 				}
-			}));
-			while (submittedWorks < works.length) submission()();
+			};
+			for (let batch = scanWorks; batch.length && !fatal; batch = await later()) {
+				if (!run.workers && !run.pool) run = await runWorkers(options.workers);
+				await pass(batch);
+			}
 			await Promise.all(statics);
-			if (works.length) options.onTiming?.(journeyId, {
+			if (scanWorks.length) options.onTiming?.(journeyId, {
 				scope: "preparation",
 				phases: { "journey-prepare": Math.round(performance$1.now() - startedAt) },
 				volumes: {
@@ -7820,6 +7879,8 @@ function createJourneyPreparation(options) {
 		}
 	};
 }
+/** How often a run waiting for grouping to publish more Works checks the journey (E2). */
+const laterWorksPollMs = 2e3;
 /**
 * Another process can hold the store past one admission deadline (ADR 0082); the Work runs
 * again after a bounded backoff instead of stopping the pass. A pending Work re-prepares
@@ -7931,12 +7992,21 @@ const priorities = [
 ];
 //#endregion
 //#region apps/cli/src/journey/keywords.ts
+/** The journey's frozen source plan; it is saved once and never rewritten. */
+async function readJourneyPlan(storage, journeyId) {
+	const plan = (await storage.resources({
+		journeyId,
+		kind: "plan"
+	}))[0];
+	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	return plan;
+}
 /**
 * ADR 0172: the confirmed dictionary applied once, as the last step before the ZIP — custom
 * terms, the snapshot-frozen Git seeds of the given sessions' workspaces (ADR 0169, never live
 * Git) and AI-confirmed Hidden values. Neither scan track applies any of these.
 */
-async function finalKeywordDictionary(storage, state, sessionIds) {
+async function finalKeywordDictionary(storage, state, sessionIds, plan) {
 	if (!state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const dictionary = /* @__PURE__ */ new Map();
 	const add = (term, kind, bounded) => {
@@ -7951,16 +8021,12 @@ async function finalKeywordDictionary(storage, state, sessionIds) {
 		const admitted = admitCustomTerm(value);
 		if (admitted) add(admitted.value, "private", false);
 	}
-	const plan = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "plan"
-	}))[0];
-	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	const { approval } = plan ?? await readJourneyPlan(storage, state.journeyId);
 	const sessions = new Set(sessionIds);
 	const roots = /* @__PURE__ */ new Map();
-	for (const session of plan.approval.inventory.sessions) {
+	for (const session of approval.inventory.sessions) {
 		if (!sessions.has(session.id)) continue;
-		const workspace = plan.approval.inventory.workspaces.find((item) => item.id === session.workspaceId);
+		const workspace = approval.inventory.workspaces.find((item) => item.id === session.workspaceId);
 		if (!workspace) throw new ApplicationError("CORRUPTED_STATE");
 		const paths = workspace.path === null ? [] : [workspace.path];
 		roots.set(JSON.stringify(paths), paths);
@@ -8486,7 +8552,7 @@ function createJourneyRenderer(options) {
 			work
 		};
 	}
-	async function produce(state, work, signal, write, session) {
+	async function produce(state, work, signal, write, session, plan) {
 		const { journeyId } = state;
 		const workId = work.id;
 		assertJourneyPrivacyReady(state, true);
@@ -8518,12 +8584,12 @@ function createJourneyRenderer(options) {
 			});
 			const next = moved.works.find((item) => item.id === workId);
 			if (!next) throw new ApplicationError("REVISION_CONFLICT");
-			return produce(moved, next, signal, write, session);
+			return produce(moved, next, signal, write, session, plan);
 		}
 		if (!output) {
 			const directory = await journeyDirectory(options.stateDir, journeyId);
 			await packageBase(storage, state, work, options.processing, directory, signal, () => session.current());
-			const { base, tokens, confirmed, request } = await journeyOutputRequest(storage, state, work, options.processing, signal);
+			const { base, tokens, confirmed, request } = await journeyOutputRequest(storage, state, work, options.processing, signal, await plan());
 			const { output: written, tokens: collected } = await write({
 				request: {
 					...request,
@@ -8614,10 +8680,10 @@ function createJourneyRenderer(options) {
 			};
 		});
 	}
-	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId)) {
+	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId), plan = () => readJourneyPlan(storage, journeyId)) {
 		const { state, work } = await admit(workId, session);
 		try {
-			return await produce(state, work, signal, write, session);
+			return await produce(state, work, signal, write, session, plan);
 		} catch (error) {
 			if (signal.aborted) throw error;
 			const renderFailure = {
@@ -8650,9 +8716,14 @@ function createJourneyRenderer(options) {
 		if (!workers || works < 2 || size < 1) return void 0;
 		const pool = createRenderWorkers(workers, size);
 		const session = batchedRenderSession(storage, journeyId);
+		let plan;
+		const readPlan = () => plan ??= readJourneyPlan(storage, journeyId).catch((error) => {
+			plan = void 0;
+			throw error;
+		});
 		return {
 			concurrency: size + 1,
-			render: (workId) => render(journeyId, workId, signal, pool.write, session),
+			render: (workId) => render(journeyId, workId, signal, pool.write, session, readPlan),
 			close: pool.close
 		};
 	}
@@ -8662,7 +8733,7 @@ function createJourneyRenderer(options) {
 	};
 }
 /** Package-only native output request: the final keyword dictionary covers all retained fields. */
-async function journeyOutputRequest(storage, state, work, processingConfig, _signal) {
+async function journeyOutputRequest(storage, state, work, processingConfig, _signal, plan) {
 	const { journeyId } = state;
 	const workId = work.id;
 	const base = (await storage.resources({
@@ -8670,14 +8741,11 @@ async function journeyOutputRequest(storage, state, work, processingConfig, _sig
 		kind: "base",
 		id: `${workId}:${work.inputRevision}`
 	})).find((item) => item.kind === "base" && item.workId === workId && item.inputRevision === work.inputRevision);
-	const plan = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	}))[0];
-	if (base?.kind !== "base" || plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	if (base?.kind !== "base") throw new ApplicationError("CORRUPTED_STATE");
+	const { replacementKey } = plan ?? await readJourneyPlan(storage, journeyId);
 	const hides = createFamilyHides();
 	const confirmed = await journeyConfirmedHides(storage, state);
-	const dictionary = await finalKeywordDictionary(storage, state, base.sessions.map((session) => session.applicationSessionId));
+	const dictionary = await finalKeywordDictionary(storage, state, base.sessions.map((session) => session.applicationSessionId), plan);
 	const exceptions = workExceptions(state, workId);
 	const tokens = createHideIndexTokens();
 	const title = await renderTitle(storage, state, work);
@@ -8692,7 +8760,7 @@ async function journeyOutputRequest(storage, state, work, processingConfig, _sig
 			companion: base.companion,
 			workId,
 			baseBundleId: base.bundleId,
-			replacementKey: plan.replacementKey,
+			replacementKey,
 			edits: [],
 			families: hides.request(base.sessions, dictionary, exceptions),
 			metadata: {
@@ -9458,14 +9526,21 @@ async function regroupPrivacySources(storage, state, works, changedMetadata, sig
 }
 //#endregion
 //#region apps/cli/src/journey/works/proposal.ts
-/** One atomic complete root partition; recommendations have no access authority. */
+/**
+* One atomic root partition; recommendations have no access authority. Roots still being grouped
+* wait in one unread Work while the other Works are confirmed and read; the submission that
+* groups them may arrive after confirmation and keeps it (E2).
+*/
 function createClassificationProposal(storage) {
 	return async (input, signal) => {
 		signal.throwIfAborted();
 		const state = await storage.current(input.journeyId);
 		if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		const classifying = isClassifying(state);
+		const late = state.scope.status === "confirmed";
+		const bound = input.expectedClassificationRevision !== void 0 && classifying && input.expectedClassificationRevision === state.classificationRevision;
 		const commit = (next = state) => storage.commit({
-			expectedRevision: input.expectedRevision,
+			expectedRevision: bound ? state.revision : input.expectedRevision,
 			requestKey: input.idempotencyKey,
 			requestHash: textDigest(JSON.stringify(input)),
 			state: next,
@@ -9476,8 +9551,8 @@ function createClassificationProposal(storage) {
 				at: (/* @__PURE__ */ new Date()).toISOString()
 			}
 		});
-		if (state.revision !== input.expectedRevision) return commit();
-		if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
+		if (input.expectedClassificationRevision !== void 0 ? !bound : state.revision !== input.expectedRevision) return commit();
+		if (late && !classifying) throw new ApplicationError("INVALID_TRANSITION");
 		if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (!state.snapshotId || state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 		const plan = (await storage.resources({
@@ -9503,6 +9578,11 @@ function createClassificationProposal(storage) {
 				});
 			} else merged.set(key, item);
 		}
+		const pending = input.pendingRootSessionIds ?? [];
+		for (const root of pending) {
+			if (!roots.has(root) || seen.has(root)) throw new ApplicationError("INVALID_SELECTION");
+			seen.add(root);
+		}
 		if (seen.size !== roots.size) throw new ApplicationError("INVALID_SELECTION");
 		const families = reviewFamilies(plan.approval.inventory);
 		const captures = await storage.resources({
@@ -9515,7 +9595,18 @@ function createClassificationProposal(storage) {
 			signal.throwIfAborted();
 			const sessions = item.rootSessionIds.flatMap((root) => families.members.get(root) ?? []);
 			if (sessions.some((session) => session.parts.some((part) => !captured.has(part.id)))) throw new ApplicationError("SCOPE_NOT_READY");
-			const base = state.works.find((work) => work.rootSessionIds.length === item.rootSessionIds.length && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root))) ?? newJourneyWork(randomUUID(), item.projectName, item.rootSessionIds, [...new Set(sessions.map((session) => session.workspaceId))]);
+			const existing = state.works.find((work) => work.placement !== "classifying" && work.rootSessionIds.length === item.rootSessionIds.length && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root)));
+			const extended = late ? state.works.find((work) => work.placement === "placed" && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root))) : void 0;
+			if (late && existing) {
+				works.push(existing);
+				continue;
+			}
+			const workspaces = [...new Set(sessions.map((session) => session.workspaceId))];
+			const base = existing ?? (extended ? {
+				...resetWorkScan(extended),
+				rootSessionIds: item.rootSessionIds,
+				sourceWorkspaceIds: [.../* @__PURE__ */ new Set([...extended.sourceWorkspaceIds, ...workspaces])]
+			} : newJourneyWork(randomUUID(), item.projectName, item.rootSessionIds, workspaces, "placed"));
 			const { classificationMetadata: _display, ...original } = base;
 			works.push({
 				...original,
@@ -9528,12 +9619,22 @@ function createClassificationProposal(storage) {
 					origin: "model"
 				},
 				placement: "placed",
+				...late && !extended ? {
+					access: item.recommendation.access,
+					accessOrigin: "model",
+					accessConfirmed: true
+				} : {},
 				classificationRecommendation: item.recommendation,
 				suggestion: null,
 				artifact: null,
 				revision: base.revision + 1
 			});
 		}
+		if (pending.length) {
+			const prior = state.works.find((work) => work.placement === "classifying" && work.rootSessionIds.length === pending.length && work.rootSessionIds.every((root) => pending.includes(root)));
+			const sessions = pending.flatMap((root) => families.members.get(root) ?? []);
+			works.push(prior ?? newJourneyWork(randomUUID(), "Still being grouped", pending, [...new Set(sessions.map((session) => session.workspaceId))], "classifying"));
+		}
 		const retained = new Set(works.map((work) => work.id));
 		const changedMetadata = new Set(works.filter((work) => {
 			const old = state.works.find((item) => item.id === work.id);
@@ -9549,7 +9650,7 @@ function createClassificationProposal(storage) {
 				old.classificationRecommendation?.reason
 			]);
 		}).map((work) => work.id));
-		const regrouped = state.works.some((work) => !retained.has(work.id)) || changedMetadata.size > 0;
+		const regrouped = !late && (state.works.some((work) => !retained.has(work.id)) || changedMetadata.size > 0);
 		const cardTerms = new Set(state.privacy.cards.flatMap((card) => card.termKeys));
 		const preserved = await regroupPrivacySources(storage, state, works, changedMetadata, signal);
 		const forced = new Set(preserved.filter((term) => !termTypeInfo[term.type].asked).map((term) => term.value));
@@ -9562,7 +9663,7 @@ function createClassificationProposal(storage) {
 			...state,
 			works,
 			classificationRevision: state.revision + 1,
-			scope: {
+			scope: late ? state.scope : {
 				status: "pending",
 				actor: null,
 				at: null
@@ -9577,7 +9678,7 @@ function createClassificationProposal(storage) {
 					confirmedAnswersRevision: null
 				} : {}
 			},
-			readingComplete: works.filter((work) => work.access !== "drop").every((work) => work.totalBatches > 0 && work.completedBatches === work.totalBatches),
+			readingComplete: !pending.length && works.filter((work) => work.access !== "drop").every((work) => work.totalBatches > 0 && work.completedBatches === work.totalBatches),
 			phase: "processing"
 		});
 	};
@@ -10511,12 +10612,45 @@ async function perform(context, item, connection, signal) {
 	if (!item.receipt) return observe(item, await connection.reserve(item.operationKey, item.reservation, signal), connection, signal, auto);
 	const receipt = await connection.status(item.receipt.receiptId, signal);
 	const observed = await observe(item, receipt, connection, signal, auto);
-	if (receipt.state !== "awaiting_upload") return observed;
+	if (receipt.state !== "awaiting_upload") return withoutUpload(observed);
 	if (!receipt.upload) throw new ApplicationError("INVALID_STATE");
+	if (item.uploadedReceiptId === receipt.receiptId) {
+		await guard();
+		try {
+			return withoutUpload(await observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto));
+		} catch (error) {
+			if (!(error instanceof JourneyRemoteError) || error.status === 401 || [
+				"settings_changed",
+				"target_conflict",
+				"work_removed"
+			].includes(error.code)) throw error;
+			return withoutUpload(item);
+		}
+	}
+	const current = await connection.resolve(item.reservation.work, signal);
+	if (current.scopeVersion !== item.reservation.expectedScopeVersion || current.accessVersion !== item.reservation.expectedAccessVersion) return renewed(item, null);
 	await guard();
 	await context.upload(item.artifact, receipt.upload.uploadUrl, signal);
 	await guard();
-	return observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto);
+	try {
+		return observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto);
+	} catch (error) {
+		if (error instanceof Object) uploaded.set(error, {
+			...item,
+			uploadedReceiptId: receipt.receiptId
+		});
+		throw error;
+	}
+}
+const uploaded = /* @__PURE__ */ new WeakMap();
+/** The item to save for a failed step whose bytes were already uploaded, if any. */
+function uploadedItem(error) {
+	return error instanceof Object ? uploaded.get(error) : void 0;
+}
+function withoutUpload(item) {
+	if (item.uploadedReceiptId === void 0) return item;
+	const { uploadedReceiptId: _, ...rest } = item;
+	return rest;
 }
 /** A definite stale refusal can renew the intent; unknown outcomes always retry the same key. */
 async function stepItem(context, item, connection, signal) {
@@ -10546,31 +10680,39 @@ async function stepItem(context, item, connection, signal) {
 			status: "blocked",
 			error: "WORK_REMOVED"
 		};
-		return {
-			...item,
-			operationKey: randomUUID(),
-			reservation: null,
-			resolution: null,
-			previousReceipts: item.receipt ? [...item.previousReceipts, item.receipt] : item.previousReceipts,
-			receipt: null,
-			status: "ready",
-			error: "SETTINGS_CHANGED"
-		};
+		return renewed(item, "SETTINGS_CHANGED");
 	}
 }
+/** A fresh intent for the same Work: the old receipt is kept as history and resolve runs again. */
+function renewed(item, error) {
+	return {
+		...withoutUpload(item),
+		operationKey: randomUUID(),
+		reservation: null,
+		resolution: null,
+		previousReceipts: item.receipt ? [...item.previousReceipts, item.receipt] : item.previousReceipts,
+		receipt: null,
+		status: "ready",
+		error
+	};
+}
 const confirmedSettings = (item) => item.settings !== null && item.settingsConfirmed;
 /**
-* The Works one advance steps together. Each Work appears at most once, so its own steps stay
-* strictly ordered. Upload work comes before assessment checks, as before. A confirmed linked
-* Settings change can alter other Works' access versions, so it always steps alone.
+* The Works one advance steps together. Upload work comes before assessment checks, smallest
+* ZIP first. Completing
+* an upload advances the owner's scope version, which every resolution and reservation carries,
+* so one Work's resolve-to-complete steps never overlap another's: uploads step one Work at a
+* time (ADR 0214). Assessment checks change nothing and step up to three together; a confirmed
+* linked Settings change alters access versions, so it always steps alone.
 */
 function pickBatch(items) {
-	const uploading = items.filter((item) => ["ready", "uploading"].includes(item.status));
-	const pool = uploading.length ? uploading : items.filter((item) => item.status === "assessing");
-	const first = pool[0];
+	const uploading = items.find((item) => item.status === "uploading") ?? items.filter((item) => item.status === "ready").reduce((smallest, item) => !smallest || item.artifact.byteLength < smallest.artifact.byteLength ? item : smallest, void 0);
+	if (uploading) return [uploading];
+	const assessing = items.filter((item) => item.status === "assessing");
+	const first = assessing[0];
 	if (!first) return [];
 	if (confirmedSettings(first)) return [first];
-	return pool.filter((item) => !confirmedSettings(item)).slice(0, 3);
+	return assessing.filter((item) => !confirmedSettings(item)).slice(0, 3);
 }
 function isCode(error, code) {
 	return error instanceof ApplicationError && error.code === code;
@@ -10681,6 +10823,8 @@ async function advanceItems(host, signal) {
 				continue;
 			}
 			const cause = result.reason;
+			const progressed = uploadedItem(cause);
+			if (progressed) next.set(item.workId, progressed);
 			if (cause instanceof JourneyRemoteError && cause.status === 401 || isCode(cause, "ACCOUNT_SIGNED_OUT")) signIn = true;
 			else if (isCode(cause, "IDENTITY_REJECTED")) changed = true;
 			else if (isInterrupted(cause)) {
@@ -10717,7 +10861,7 @@ async function advanceItems(host, signal) {
 			items
 		}));
 	} catch (error) {
-		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause))) {
+		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE"))) {
 			host.failure("SEND_INTERRUPTED", error);
 			return send.error === "SEND_INTERRUPTED" ? host.applied() : host.save({
 				...send,
@@ -10837,7 +10981,11 @@ async function advanceSend(dependencies, address, signal) {
 					assertScope(current.journey, current.send);
 				},
 				bindingId: binding?.subject === send.subject && !retired ? binding.bundleRecordId : void 0,
-				upload: (artifact, uploadUrl, uploadSignal) => dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, uploadUrl, uploadSignal)
+				upload: async (artifact, uploadUrl, uploadSignal) => {
+					const started = performance.now();
+					await dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, uploadUrl, uploadSignal);
+					dependencies.uploaded?.(artifact.workId, artifact.byteLength, Math.round(performance.now() - started));
+				}
 			};
 		},
 		finish: async (connection, finishSignal) => {
@@ -12481,6 +12629,20 @@ function createJourneySender(dependencies) {
 			if (result.status !== "stale") running.get(runKey(input))?.stop.abort();
 			return result;
 		},
+		/** BL-201: Cancel sign-in returns a confirmed Send that uploaded nothing to Ready to send. */
+		async withdraw(raw) {
+			const input = sendActionSchema.parse(raw);
+			const snapshot = await load(input);
+			if (!matchesAction(snapshot, input)) return saveSend(dependencies, snapshot, snapshot.send, input);
+			if (snapshot.send.status !== "sign-in" || snapshot.send.items.some((item) => item.receipt)) throw new ApplicationError("INVALID_TRANSITION");
+			const result = await saveSend(dependencies, snapshot, {
+				...snapshot.send,
+				status: "prepared",
+				confirmedAt: null
+			}, input);
+			if (result.status !== "stale") running.get(runKey(input))?.stop.abort();
+			return result;
+		},
 		async resume(raw) {
 			const input = sendActionSchema.parse(raw);
 			const snapshot = await load(input);
@@ -12512,6 +12674,10 @@ function createJourneySender(dependencies) {
 }
 //#endregion
 //#region apps/cli/src/account/journey/auth.ts
+/** An access token this close to expiry is renewed first, so a step never starts on it. */
+const renewBeforeMs = 12e4;
+const renewTimeoutMs = 3e4;
+const renewals = /* @__PURE__ */ new WeakMap();
 /** Reuses the existing device sign-in credential; a token is never returned to the panel or Agent. */
 function createJourneySendAuth(account, requestFetch) {
 	/**
@@ -12528,31 +12694,87 @@ function createJourneySendAuth(account, requestFetch) {
 			return state;
 		});
 	}
+	/** A refused access token with a refresh token is renewed on the next use instead (BL-210). */
+	async function refuse(accessToken) {
+		if (!(await account.credentials.update((value) => {
+			if (value.credential?.accessToken === accessToken && value.credential.refreshToken) value.credential = {
+				...value.credential,
+				expiresAt: account.now()
+			};
+			return value;
+		})).credential?.refreshToken) await expire(accessToken);
+	}
+	function renew(credential) {
+		const running = renewals.get(account);
+		if (running) return running;
+		const renewing = (async () => {
+			try {
+				const token = await account.identity.refresh(credential.refreshToken, AbortSignal.timeout(renewTimeoutMs));
+				if (!token) {
+					await expire(credential.accessToken);
+					return null;
+				}
+				return (await account.credentials.update((value) => {
+					if (value.credential?.refreshToken === credential.refreshToken) value.credential = {
+						...value.credential,
+						accessToken: token.accessToken,
+						refreshToken: token.refreshToken ?? credential.refreshToken,
+						scope: token.scope,
+						issuedAt: account.now(),
+						expiresAt: token.expiresAt
+					};
+					return value;
+				})).credential;
+			} finally {
+				renewals.delete(account);
+			}
+		})();
+		renewals.set(account, renewing);
+		return renewing;
+	}
 	async function current() {
 		const credential = (await account.credentials.update((value) => value)).credential;
 		if (!credential || credential.identityUrl !== account.configuration.identityUrl || credential.clientId !== account.configuration.clientId) return null;
-		if (!Number.isFinite(Date.parse(credential.expiresAt)) || Date.parse(credential.expiresAt) <= Date.parse(account.now())) {
+		const left = Date.parse(credential.expiresAt) - Date.parse(account.now());
+		if (Number.isFinite(left) && left > renewBeforeMs) return credential;
+		const { refreshToken } = credential;
+		if (!refreshToken) {
+			if (Number.isFinite(left) && left > 0) return credential;
 			await expire(credential.accessToken);
 			return null;
 		}
-		return credential;
+		try {
+			return await renew({
+				...credential,
+				refreshToken
+			});
+		} catch (error) {
+			if (Number.isFinite(left) && left > 0) return credential;
+			throw error;
+		}
 	}
 	const fetchOwner = requestFetch ?? fetch;
 	const ownerFetch = async (input, init) => {
 		const response = await fetchOwner(input, init);
 		if (response.status === 401) {
 			const header = new Headers(init?.headers).get("authorization");
-			if (header?.startsWith("Bearer ")) await expire(header.slice(7));
+			if (header?.startsWith("Bearer ")) await refuse(header.slice(7));
 		}
 		return response;
 	};
 	return { async connect(signal) {
-		const credential = await current();
+		let credential = await current();
 		if (!credential) return null;
-		const verified = await account.identity.readIdentity(credential.accessToken, signal);
+		let verified = await account.identity.readIdentity(credential.accessToken, signal);
 		if (!verified) {
-			await expire(credential.accessToken);
-			return null;
+			await refuse(credential.accessToken);
+			credential = await current();
+			if (!credential) return null;
+			verified = await account.identity.readIdentity(credential.accessToken, signal);
+			if (!verified) {
+				await expire(credential.accessToken);
+				return null;
+			}
 		}
 		if (verified.identityId !== credential.identityId) throw new ApplicationError("IDENTITY_REJECTED");
 		return createJourneyOwnerClient({
@@ -13097,6 +13319,7 @@ const deviceCodeResponse = z.object({
 });
 const tokenResponse = z.object({
 	access_token: z.string().min(1).max(4096),
+	refresh_token: z.string().min(1).max(4096).optional(),
 	token_type: z.string(),
 	expires_in: z.number().int().positive(),
 	scope: deviceProfileScopeSchema
@@ -13108,13 +13331,24 @@ const userInfoResponse = z.object({
 	picture: z.unknown().optional(),
 	profile: z.string()
 });
-function unavailable(cause) {
-	const error = new ApplicationError("IDENTITY_UNAVAILABLE");
+/**
+* `detail` names the endpoint and what failed (HTTP status, network error name, schema paths),
+* never a response value, so the authorization log can say why without exposing a token.
+*/
+function unavailable(detail, cause) {
+	const error = Object.assign(new ApplicationError("IDENTITY_UNAVAILABLE"), { detail });
 	if (cause !== void 0) error.cause = cause;
 	return error;
 }
-async function readJson(response) {
-	if (!response.body) throw unavailable();
+const issuePaths = (error) => error.issues.map((issue) => issue.path.join(".") || "(root)").join(",");
+function networkDetail(error) {
+	if (!(error instanceof Error)) return "Error";
+	const cause = error.cause;
+	const code = typeof cause === "object" && cause !== null && "code" in cause ? cause.code : null;
+	return typeof code === "string" ? `${error.name} ${code}` : error.name;
+}
+async function readJson(response, where) {
+	if (!response.body) throw unavailable(`${where} empty body`);
 	const reader = response.body.getReader();
 	const chunks = [];
 	let bytes = 0;
@@ -13126,7 +13360,7 @@ async function readJson(response) {
 			bytes += next.value.byteLength;
 			if (bytes > maximumResponseBytes) {
 				await reader.cancel().catch(() => void 0);
-				throw unavailable();
+				throw unavailable(`${where} body too large`);
 			}
 			chunks.push(next.value);
 		}
@@ -13136,7 +13370,7 @@ async function readJson(response) {
 	try {
 		return JSON.parse(Buffer.concat(chunks, bytes).toString("utf8"));
 	} catch (error) {
-		throw unavailable(error);
+		throw unavailable(`${where} invalid JSON`, error);
 	}
 }
 function verificationUrl(value, identity) {
@@ -13144,9 +13378,9 @@ function verificationUrl(value, identity) {
 	try {
 		url = new URL(value);
 	} catch (error) {
-		throw unavailable(error);
+		throw unavailable("device-code verification URL invalid", error);
 	}
-	if (!["http:", "https:"].includes(url.protocol) || url.origin !== identity.origin || url.username !== "" || url.password !== "") throw unavailable();
+	if (!["http:", "https:"].includes(url.protocol) || url.origin !== identity.origin || url.username !== "" || url.password !== "") throw unavailable("device-code verification URL outside Identity");
 	return url;
 }
 /**
@@ -13157,7 +13391,7 @@ function createIdentityDeviceClient(options) {
 	const requestFetch = options.fetch ?? fetch;
 	const now = options.now ?? Date.now;
 	const base = new URL(options.identityUrl);
-	if (!["http:", "https:"].includes(base.protocol)) throw unavailable();
+	if (!["http:", "https:"].includes(base.protocol)) throw unavailable("identity URL protocol");
 	async function send(path, init, signal) {
 		try {
 			return await requestFetch(new URL(path, base), {
@@ -13167,9 +13401,18 @@ function createIdentityDeviceClient(options) {
 			});
 		} catch (error) {
 			if (signal.aborted) throw error;
-			throw unavailable(error);
+			throw unavailable(`${path} ${networkDetail(error)}`, error);
 		}
 	}
+	function issued(token) {
+		return {
+			kind: "issued",
+			accessToken: token.access_token,
+			...token.refresh_token ? { refreshToken: token.refresh_token } : {},
+			expiresAt: new Date(now() + token.expires_in * 1e3).toISOString(),
+			scope: token.scope
+		};
+	}
 	function form(fields) {
 		return {
 			method: "POST",
@@ -13182,14 +13425,18 @@ function createIdentityDeviceClient(options) {
 	}
 	return {
 		async requestDeviceCode(signal) {
-			const response = await send("/api/auth/device/code", form({
+			let response = await send("/api/auth/device/code", form({
+				client_id: options.clientId,
+				scope: "openid profile offline_access"
+			}), signal);
+			if (response.status === 400 && errorResponse.safeParse(await readJson(response, "device-code")).data?.error === "invalid_scope") response = await send("/api/auth/device/code", form({
 				client_id: options.clientId,
 				scope: "openid profile"
 			}), signal);
 			if (response.status === 400 || response.status === 401) throw new ApplicationError("IDENTITY_REJECTED");
-			if (response.status !== 200) throw unavailable();
-			const parsed = deviceCodeResponse.safeParse(await readJson(response));
-			if (!parsed.success) throw unavailable(parsed.error);
+			if (response.status !== 200) throw unavailable(`device-code HTTP ${response.status}`);
+			const parsed = deviceCodeResponse.safeParse(await readJson(response, "device-code"));
+			if (!parsed.success) throw unavailable(`device-code schema ${issuePaths(parsed.error)}`, parsed.error);
 			const verification = verificationUrl(parsed.data.verification_uri, base);
 			const complete = verificationUrl(parsed.data.verification_uri_complete, base);
 			return {
@@ -13208,20 +13455,16 @@ function createIdentityDeviceClient(options) {
 				grant_type: deviceCodeGrantType
 			}), signal);
 			if (response.status === 200) {
-				const parsed = tokenResponse.safeParse(await readJson(response));
-				if (!parsed.success || parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable(parsed.success ? void 0 : parsed.error);
-				return {
-					kind: "issued",
-					accessToken: parsed.data.access_token,
-					expiresAt: new Date(now() + parsed.data.expires_in * 1e3).toISOString(),
-					scope: parsed.data.scope
-				};
+				const parsed = tokenResponse.safeParse(await readJson(response, "token"));
+				if (!parsed.success) throw unavailable(`token schema ${issuePaths(parsed.error)}`, parsed.error);
+				if (parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable("token type not bearer");
+				return issued(parsed.data);
 			}
 			if (response.status !== 400) {
 				if (response.status === 401) throw new ApplicationError("IDENTITY_REJECTED");
-				throw unavailable();
+				throw unavailable(`token HTTP ${response.status}`);
 			}
-			const parsed = errorResponse.safeParse(await readJson(response));
+			const parsed = errorResponse.safeParse(await readJson(response, "token"));
 			const code = parsed.success ? parsed.data.error : "";
 			if (code === "authorization_pending") return { kind: "pending" };
 			if (code === "slow_down") return { kind: "slow_down" };
@@ -13229,6 +13472,19 @@ function createIdentityDeviceClient(options) {
 			if (code === "access_denied") return { kind: "denied" };
 			throw new ApplicationError("IDENTITY_REJECTED");
 		},
+		async refresh(refreshToken, signal) {
+			const response = await send("/api/auth/oauth2/token", form({
+				client_id: options.clientId,
+				grant_type: "refresh_token",
+				refresh_token: refreshToken
+			}), signal);
+			if (response.status === 400 || response.status === 401) return null;
+			if (response.status !== 200) throw unavailable(`refresh HTTP ${response.status}`);
+			const parsed = tokenResponse.safeParse(await readJson(response, "refresh"));
+			if (!parsed.success) throw unavailable(`refresh schema ${issuePaths(parsed.error)}`, parsed.error);
+			if (parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable("token type not bearer");
+			return issued(parsed.data);
+		},
 		async readIdentity(accessToken, signal) {
 			const response = await send("/api/auth/oauth2/userinfo", {
 				method: "GET",
@@ -13238,17 +13494,17 @@ function createIdentityDeviceClient(options) {
 				}
 			}, signal);
 			if (response.status === 401 || response.status === 403) return null;
-			if (response.status !== 200) throw unavailable();
-			const parsed = userInfoResponse.safeParse(await readJson(response));
-			if (!parsed.success) throw unavailable(parsed.error);
+			if (response.status !== 200) throw unavailable(`userinfo HTTP ${response.status}`);
+			const parsed = userInfoResponse.safeParse(await readJson(response, "userinfo"));
+			if (!parsed.success) throw unavailable(`userinfo schema ${issuePaths(parsed.error)}`, parsed.error);
 			const profile = accountProfileSchema.safeParse({
 				identityId: parsed.data.sub,
 				displayName: parsed.data.name,
 				avatarUrl: readAccountAvatarUrl(parsed.data.picture),
 				profileUrl: parsed.data.profile
 			});
-			if (!profile.success) throw unavailable(profile.error);
-			if (!profileUrlMatchesIdentity(profile.data.profileUrl, options.identityUrl)) throw unavailable();
+			if (!profile.success) throw unavailable(`userinfo profile ${issuePaths(profile.error)}`, profile.error);
+			if (!profileUrlMatchesIdentity(profile.data.profileUrl, options.identityUrl)) throw unavailable("userinfo profile URL outside Identity");
 			return profile.data;
 		}
 	};
@@ -13367,6 +13623,8 @@ function errorDetail(error) {
 			if (typeof code === "number" && Number.isFinite(code)) detail.code = code;
 			const syscall = data(value, "syscall");
 			if (typeof syscall === "string") detail.syscall = text(syscall);
+			const reason = data(value, "detail");
+			if (typeof reason === "string") detail.detail = text(reason);
 			const cause = data(value, "cause");
 			if (cause !== void 0) detail.cause = visit(cause, depth + 1);
 			const errors = data(value, "errors");
@@ -13849,6 +14107,61 @@ function createConfiguredPreviewPort(workerUrl, environment) {
 	}) };
 }
 //#endregion
+//#region apps/cli/src/inspection/index.ts
+/**
+* Runs each inspection scan in its own Worker so static detection never holds the host's event
+* loop, which also serves requests and store accesses (BL-199).
+*/
+function createInspectionPort(workerUrl, environment, onAnomaly) {
+	return { async *scan(request, signal, onFailure) {
+		const worker = new Worker(workerUrl, { workerData: {
+			request,
+			environment
+		} });
+		const events = [];
+		let wake;
+		const push = (event) => {
+			events.push(event);
+			wake?.();
+		};
+		const fail = (cause) => push({ error: new Error("INSPECTION_WORKER_FAILED", { cause }) });
+		worker.on("message", (message) => {
+			const parsed = workerMessageSchema.safeParse(message);
+			if (!parsed.success) return fail(parsed.error);
+			const value = parsed.data;
+			try {
+				if (value.kind === "batch") push({ batch: validateInspectionBatch(value.batch) });
+				else if (value.kind === "done") push({ done: true });
+				else if (value.kind === "anomaly") onAnomaly?.(value.event);
+				else onFailure?.(value.stage, Object.assign(new Error(value.message), value.code ? { code: value.code } : {}));
+			} catch (error) {
+				fail(error);
+			}
+		});
+		worker.on("error", fail);
+		worker.on("exit", (code) => fail(/* @__PURE__ */ new Error(`Inspection Worker exited: code=${code}`)));
+		const abort = () => worker.postMessage({ kind: "abort" });
+		if (signal.aborted) abort();
+		else signal.addEventListener("abort", abort, { once: true });
+		try {
+			for (;;) {
+				const event = events.shift();
+				if (!event) {
+					await new Promise((resolve) => wake = resolve);
+					wake = void 0;
+					continue;
+				}
+				if ("done" in event) return;
+				if ("error" in event) throw event.error;
+				yield event.batch;
+			}
+		} finally {
+			signal.removeEventListener("abort", abort);
+			await worker.terminate();
+		}
+	} };
+}
+//#endregion
 //#region apps/cli/src/bundle-directory.ts
 /** The platform cache folder; Windows has none, so its default library is the launch directory. */
 function cacheRoot(options) {
@@ -14080,7 +14393,14 @@ async function compose(options, callbacks, bundles) {
 				artifacts: createJourneySendArtifacts(journeyStorage),
 				auth: createJourneySendAuth(accountPorts),
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
-				failure: (code, cause) => diagnostics.onFailure(code, cause)
+				failure: (code, cause) => diagnostics.onFailure(code, cause),
+				uploaded: (workId, bytes, elapsedMs) => diagnostics.onActivity({
+					event: "journey.send_upload_timing",
+					at: (/* @__PURE__ */ new Date()).toISOString(),
+					operationId: workId,
+					phases: { upload: elapsedMs },
+					volumes: { bytes }
+				})
 			}),
 			manualUploader: createManualUploader({
 				storage: store.manualUpload,
@@ -14152,10 +14472,7 @@ async function compose(options, callbacks, bundles) {
 				onCreated: (path) => process.stderr.write(`Temporary file may contain unredacted originals: ${path}\n`),
 				onRetained: (path) => process.stderr.write(`Retained temporary file may contain unredacted originals: ${path}\n`)
 			}),
-			inspection: createInspectionProcessor({
-				...processing,
-				onAnomaly: producers.onInspectionAnomaly
-			}),
+			inspection: createInspectionPort(bundles?.url("inspection-worker") ?? new URL("./inspection-worker.mjs", import.meta.url), processing.environment, producers.onInspectionAnomaly),
 			systemResources,
 			onDiagnostic: diagnostics.onDiagnostic,
 			onPackagingActivity: diagnostics.onActivity,
@@ -14249,6 +14566,46 @@ async function compose(options, callbacks, bundles) {
 	}
 }
 //#endregion
+//#region apps/cli/src/agent-presence.ts
+const journey = z.object({ journeyId: z.uuid() }).loose();
+const presence = z.object({ at: z.iso.datetime() }).strict();
+const written = /* @__PURE__ */ new Map();
+/** At most one presence write per journey this often, from one CLI process. */
+const presenceIntervalMs = 5e3;
+const presencePath = (stateDir, journeyId) => join(stateDir, "presence", `${journeyId}.json`);
+/**
+* Records that the agent just called the CLI for this journey (E16). It lives beside the journey,
+* not in it, so a heartbeat never moves the journey revision; a failed write is ignored.
+*/
+async function markAgentPresence(stateDir, value) {
+	const parsed = journey.safeParse(value);
+	if (!parsed.success) return;
+	const { journeyId } = parsed.data;
+	const now = Date.now();
+	if (now - (written.get(journeyId) ?? 0) < presenceIntervalMs) return;
+	written.set(journeyId, now);
+	try {
+		const path = presencePath(stateDir, journeyId);
+		await mkdir(join(stateDir, "presence"), {
+			recursive: true,
+			mode: 448
+		});
+		const temporary = `${path}.${now}.tmp`;
+		await writeFile(temporary, JSON.stringify({ at: new Date(now).toISOString() }), { mode: 384 });
+		await rename(temporary, path);
+	} catch {
+		written.delete(journeyId);
+	}
+}
+/** When the agent last called the CLI for this journey, or null when it never did. */
+async function readAgentPresence(stateDir, journeyId) {
+	try {
+		return presence.parse(JSON.parse(await readFile(presencePath(stateDir, journeyId), "utf8")));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region apps/cli/src/commands.ts
 const sendAddress = z.object({
 	journeyId: z.uuid(),
@@ -14274,6 +14631,7 @@ const delivery = z.object({
 /** `signal` carries the process's SIGINT/SIGTERM to long procedures such as journey.prepare. */
 async function invoke(runtime, command, value, signal) {
 	const app = runtime.application;
+	markAgentPresence(runtime.stateDir, value);
 	switch (command) {
 		case "send.get": return app.journeySend?.get(sendAddress.partial({ sendId: true }).parse(value));
 		case "send.prepare": return app.journeySend?.prepare(sendPrepareSchema.parse(value));
@@ -14508,4 +14866,4 @@ async function cancelOperation(runtime, id) {
 	return readOperation(runtime, id);
 }
 //#endregion
-export { startHost as _, createRuntime as a, createRenderActivity as c, businessCommands as d, longCommands as f, createExecutionPort as g, readStateDump as h, invoke as i, helpText as l, startupFailure as m, readOperation as n, executorEventSchema as o, permissionDiagnostic as p, waitOperation as r, executorRequestSchema as s, cancelOperation as t, parseOptions as u, traceStartup as v };
+export { createExecutionPort as _, readAgentPresence as a, executorRequestSchema as c, parseOptions as d, businessCommands as f, readStateDump as g, startupFailure as h, invoke as i, createRenderActivity as l, permissionDiagnostic as m, readOperation as n, createRuntime as o, longCommands as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, helpText as u, startHost as v, traceStartup as y };