@gitroll/tacitt-cli 0.1.0 → 0.3.0

package/dist/{query-Da-KDbSV.mjs → query-DN99jiRc.mjs}

@@ -1,10 +1,11 @@
-import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, E as prepareCollectionProduction, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Y as createInspectionProcessor, Z as createCleanup, _ as readStaticSessionMasks, a as scanReviewFields, at as windowsAclCodes, c as readSessionScanRecords, et as makePrivateDirectory, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as isWindowsAclFailure, j as readCollectionIndex, k as renderJobDigest, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as restrictToOwner, o as createWorkPieces, p as openConfiguredUpload, r as prepareSessionScans, rt as windowsOwnerOnly, s as readSessionScanFields, t as preparedScanConfiguration, tt as openPrivateFile, v as staticSessionJobs, w as createCollectionArtifacts, y as writeLogicalJourneyBase, z as parallelismLimits } from "./src-BngGpFKd.mjs";
-import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey, zt as filterInventoryByPeriod } from "./locate-Bn32k2se.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-DynBRDBc.mjs";
-import { $ as settingsBatchSchema, $n as bReviewDigest, $r as defaultScopedSettings, $t as journeyResourceQuerySchema, A as accountProfileSchema, Ar as staticSessionResourceSchema, At as sendSettingsSchema, B as inspectionCancelSchema, Br as journeyRenderInputSchema, C as rebindReviewAlignment, Cn as readConfirmedHideChange, Cr as privacyDecisionDigest, Ct as sendPrepareSchema, D as guardedFindingText, Dr as hasCurrentStaticReview, Dt as sendReceiptSchema, E as reviewBatchReuse, En as termHideAdditions, Er as nativeRespondSchema, Et as sendArtifactSchema, F as storedCredentialSchema, Fr as withReadingProgress, Gn as workDecisionDigest, Gr as selectionSchema, Hn as maskedHitsStale, Hr as commandSchema, Ht as reviewCompileSchema, In as confirmedHideGroupIds, Jn as reviewCandidateInputSchema, Jr as stateSchema, Jt as journeySearchResultSchema, Lr as journeyFindingImpactSchema, M as deviceProfileScopeSchema, Mr as isReadingComplete, Mt as currentJourneyAdapters, N as profileUrlMatchesIdentity, Nr as isSelectedWork, Nt as obsoleteJourney, O as staticallyHiddenFindings, Or as staticReviewDigest, Ot as sendReplaceResultSchema, P as readAccountAvatarUrl, Pn as bTermMatcher, Rn as confirmedHideKinds, Rr as journeyFindingsSchema, S as bReviewScope, Sr as assertJourneyPrivacyReady, St as sendChoiceSchema, T as rebindReviewSubmit, Tr as nativeGetSchema, Tt as journeySendSchema, Ur as packageCommandSchema, Ut as journeyContextQuerySchema, V as inspectionStartSchema, Vn as journeyConfirmedHides, Vr as journeyRenderSchema, Vt as journeyReviewStorageQuerySchema, W as inspectionQuerySchema, Wn as retireWorkDescription, Wr as selectionBatchSchema, Xn as reviewRepairInputSchema, Xr as recommendParallelism, Xt as searchScopeDigest, Yn as reviewCandidateResourceSchema, Zn as reviewRepairResourceSchema, Zt as journeyPolicyRespondSchema, _t as emptyTermsRevision, a as validateBCrossSegmentReview, ar as scanSessionResourceSchema, bt as replaceSensitiveTermsSchema, c as reconcileBSession, cr as verifiedScanGitSeeds, ct as resolveFailureLocation, ei as freezeConfiguration, et as settingsQuerySchema, fn as sessionReviewInputSchema, fr as journeyInventoryQuerySchema, ft as manualUploadChoiceSchema, g as hideScopeDigest, gn as sessionUsefulnessInputSchema, gr as emptyPreparationFacts, h as activeJourneyTerms, ht as manualUploadStartSchema, i as locateTermEvidence, in as reviewAttemptResourceSchema, ir as scanPreparationDigest, j as deviceAuthorizationSchema, jr as hasCompleteWorkDescription, k as createAccount, kt as sendResolutionSchema, l as reconstructBFields, lr as scanExclusionResourceSchema, lt as validateFailureLocation, m as splitSelectorValues, mt as manualUploadSchema, n as scanBatchContextDigest, nn as journeyPlaceSchema, o as bCrossSegmentReviewSchema, or as scanGitSeedsId, p as selectedValueMembers, pn as sessionReviewQuerySchema, pt as manualUploadPrepareSchema, qn as workCorrectionBinding, qr as producerVersion, r as scanBatchEquivalenceDigest, rt as appendSensitiveTerms, s as bRereadDigest, sn as sessionReconcileInputSchema, sr as scanGitSeedsResource, st as artifactFailureDetailSchema, t as retireScanGeneration, ti as selectFrozenConfiguration, tr as planBRepair, tt as readWorkspaceOutcomes, u as newJourneyWork, un as sessionRereadInputSchema, ut as manualUploadActionSchema, v as changeJourney, vt as maximumTermsFileBytes, w as rebindReviewOverlay, wr as nativeEventsSchema, wt as sendStartSchema, x as isGenericPublicTerm, xn as confirmedHideAdditions, xr as journeyClassificationSessionsSchema, xt as sendActionSchema, yt as normalizeSensitiveTerms, z as createApplication, zr as journeyPreviewSchema, zt as applyClassification } from "./src-CPPjOyHZ.mjs";
-import { $ as schemaVersion, A as inspectionQuerySchema$1, B as privateReviewHash, C as loadAuthenticatedReview, D as sessionUsefulnessRecommendation, E as aggregateUsefulness, F as reuseQuerySchema, G as initializeAndClaim, H as createJourneyPayloadFiles, I as batchQuery, J as withDatabase, K as ownership, L as isPrivateResourceKind, M as sameCandidateRequest, N as validateCandidateAttempt, O as sessionQuery, P as validateUnitCandidate, Q as checkVersion, R as privateResourceHeader, S as loadAcceptedReview, T as loadPrivateResource, U as validateBatchBody, V as batchHeader, W as requireActiveBatch, X as readStoredState, Y as readBundleDirectory, Z as validateState, _ as loadRereadBodies, _t as isSqliteCorruption, a as decodeError, at as inspectStateFiles, b as validateSessionReconciliation, c as dropsAnchor, ct as readResetMarker, d as parseDelivery, dt as syncDirectory, et as beginReset, f as validateCandidate, ft as withStateSnapshot, g as loadReconciliation, gt as isCoordinationBusy, h as loadPreparedBodies, ht as errorCode$1, i as createExecutor, it as hasResetMarker, j as evaluateUnitEvidence, k as resourceSelectionQuerySchema, l as replySchema, lt as recheckPrivatePath, m as loadPreparation, mt as StoreError, n as releaseInheritedHeapFlags, nt as databaseName, o as ProtocolError, ot as present, p as loadStatus, pt as withFileCheckTimings, q as validateDatabase, r as storeHeapLimits, rt as finishReset, s as allowedReplies, st as privatePath, tt as createDatabaseFile, u as operations, ut as stateDirectory, v as loadSessionBodies, w as loadBatch, x as validateSessionBindings, y as validatePreparationSelection, z as termReuseQuerySchema } from "./heap-tfU61Ehy.mjs";
-import { a as writeJourneyOutput, c as mergeHideIndexTokens, l as packRenderHideIndex, o as createHideIndexTokens, s as hideIndexTexts, t as journeyOutputJob } from "./job--TceKk0l.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-B85GaVIz.mjs";
+import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, Q as createCleanup, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as removeNamedTemporarySpools, _ as readStaticSessionMasks, a as scanReviewFields, at as isWindowsAclFailure, c as readSessionScanRecords, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as windowsOwnerOnly, j as readCollectionIndex, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as openPrivateFile, o as createWorkPieces, ot as windowsAclCodes, p as openConfiguredUpload, r as prepareSessionScans, rt as restrictToOwner, s as readSessionScanFields, t as preparedScanConfiguration, tt as makePrivateDirectory, v as staticSessionJobs, w as createCollectionArtifacts, z as parallelismLimits } from "./src-CPbdnGrk.mjs";
+import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey } from "./locate-U3-nkird.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-qoLRvX-A.mjs";
+import { $ as settingsQuerySchema, $n as reviewCandidateInputSchema, $t as journeySearchResultSchema, A as deviceProfileScopeSchema, Ar as nativeEventsSchema, B as validateInspectionBatch, Br as isSelectedWork, Bt as journeyReviewStorageQuerySchema, C as rebindReviewSubmit, Ct as sendStartSchema, D as createAccount, Dt as sendReplaceResultSchema, E as staticallyHiddenFindings, En as confirmedHideAdditions, Er as journeyClassificationSessionsSchema, Et as sendReceiptSchema, Gr as journeyFindingsSchema, Gt as retireScanGeneration, Hr as withReadingProgress, Jr as journeyRenderSchema, Jt as journeyContextQuerySchema, Kn as journeyConfirmedHides, Kr as journeyPreviewSchema, Kt as newJourneyWork, L as createApplication, Lr as hasCompleteWorkDescription, M as readAccountAvatarUrl, Mr as nativeRespondSchema, Mt as obsoleteJourney, N as storedCredentialSchema, Nr as hasCurrentStaticReview, O as accountProfileSchema, On as readConfirmedHideChange, Or as assertJourneyPrivacyReady, Ot as sendResolutionSchema, Pr as staticReviewDigest, Q as settingsBatchSchema, Qn as workCorrectionBinding, Qr as selectionSchema, R as inspectionCancelSchema, Rr as isClassifying, Rt as applyClassification, S as rebindReviewOverlay, St as sendPrepareSchema, T as guardedFindingText, Tt as sendArtifactSchema, U as inspectionQuerySchema, Un as confirmedHideKinds, Ut as classificationPartition, Vn as confirmedHideGroupIds, Wr as journeyFindingImpactSchema, Wt as classificationWorks, Xn as workDecisionDigest, Xr as packageCommandSchema, Yn as retireWorkDescription, Yr as commandSchema, Zr as selectionBatchSchema, _n as sessionReviewInputSchema, _r as journeyInventoryQuerySchema, _t as maximumTermsFileBytes, a as bCrossSegmentReviewSchema, b as bReviewScope, bt as sendActionSchema, c as reconstructBFields, ct as validateFailureLocation, d as selectedValueMembers, dr as scanGitSeedsId, dt as manualUploadChoiceSchema, ei as producerVersion, er as reviewCandidateResourceSchema, et as readWorkspaceOutcomes, f as splitSelectorValues, fn as sessionReconcileInputSchema, fr as scanGitSeedsResource, ft as manualUploadPrepareSchema, g as changeJourney, gt as emptyTermsRevision, hn as sessionRereadInputSchema, i as validateBCrossSegmentReview, in as journeyResourceQuerySchema, ir as bReviewDigest, j as profileUrlMatchesIdentity, jn as termHideAdditions, jr as nativeGetSchema, jt as currentJourneyAdapters, k as deviceAuthorizationSchema, kr as privacyDecisionDigest, kt as sendSettingsSchema, ln as reviewAttemptResourceSchema, lr as scanPreparationDigest, lt as manualUploadActionSchema, m as hideScopeDigest, mr as scanExclusionResourceSchema, mt as manualUploadStartSchema, n as scanBatchEquivalenceDigest, nn as journeyPolicyRespondSchema, nr as reviewRepairResourceSchema, nt as appendSensitiveTerms, o as bRereadDigest, or as planBRepair, ot as artifactFailureDetailSchema, p as activeJourneyTerms, pr as verifiedScanGitSeeds, pt as manualUploadSchema, qn as maskedHitsStale, qr as journeyRenderInputSchema, qt as reviewCompileSchema, r as locateTermEvidence, ri as recommendParallelism, s as reconcileBSession, sn as journeyPlaceSchema, st as resolveFailureLocation, t as scanBatchContextDigest, ti as stateSchema, tn as searchScopeDigest, tr as reviewRepairInputSchema, ur as scanSessionResourceSchema, vn as sessionReviewQuerySchema, vt as normalizeSensitiveTerms, w as reviewBatchReuse, wt as journeySendSchema, x as rebindReviewAlignment, xn as sessionUsefulnessInputSchema, xr as emptyPreparationFacts, xt as sendChoiceSchema, y as isGenericPublicTerm, yt as replaceSensitiveTermsSchema, z as inspectionStartSchema, zn as bTermMatcher, zr as isReadingComplete } from "./src-B4R5XMEP.mjs";
+import { $ as checkVersion, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as requireActiveBatch, H as batchHeader, I as reuseQuerySchema, J as validateDatabase, K as initializeAndClaim, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as validateState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as createJourneyPayloadFiles, V as privateReviewHash, W as validateBatchBody, X as readBundleDirectory, Y as withDatabase, Z as readStoredState, _ as loadReconciliation, _t as isCoordinationBusy, a as decodeError, at as hasResetMarker, b as validatePreparationSelection, c as dropsAnchor, ct as privatePath, d as parseDelivery, dt as stateDirectory, et as schemaVersion, f as validateCandidate, ft as syncDirectory, g as loadPreparedBodies, gt as errorCode$1, h as loadPreparation, ht as StoreError, i as createExecutor, it as finishReset, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as readResetMarker, m as loadStatus, mt as withFileCheckTimings, n as releaseInheritedHeapFlags, nt as createDatabaseFile, o as ProtocolError, ot as inspectStateFiles, p as classificationJourneyCommit, pt as withStateSnapshot, q as ownership, r as storeHeapLimits, rt as databaseName, s as allowedReplies, st as present, tt as beginReset, u as operations, ut as recheckPrivatePath, v as loadRereadBodies, vt as isSqliteCorruption, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, z as privateResourceHeader } from "./heap-eO_uWpD1.mjs";
+import { _ as staticBaseProduction, a as writeJourneyOutput, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as prepareSourcePlan, y as workApproval } from "./job-rK-Ho9OD.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-CLXdKr2I.mjs";
+import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
 import { copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
@@ -650,6 +651,7 @@ const operation = z.enum([
 	"journey.terms.select-aliases",
 	"journey.commit",
 	"journey.commit.checked",
+	"journey.classification.commit",
 	"journey.events",
 	"journey.inventory",
 	"journey.preparation.progress",
@@ -826,12 +828,16 @@ function runObserved(frame, leg, work) {
 }
 //#endregion
 //#region packages/local-host/src/router.ts
-/** The browser may explicitly change one Work's visibility; all other decisions stay in chat. */
+/** Decisions the person makes in the panel while the agent waits for them. */
 const nativePanelRespondSchema = z.object({
 	journeyId: nativeRespondSchema.shape.journeyId,
 	expectedRevision: nativeRespondSchema.shape.expectedRevision,
 	idempotencyKey: nativeRespondSchema.shape.idempotencyKey,
 	action: z.union([
+		z.object({
+			kind: z.literal("consent"),
+			allow: z.boolean()
+		}).strict(),
 		z.object({
 			kind: z.literal("work-access"),
 			workId: z.uuid(),
@@ -845,12 +851,17 @@ const nativePanelRespondSchema = z.object({
 			kind: z.literal("card-answer"),
 			cardId: z.uuid(),
 			optionId: z.string(),
-			remember: z.boolean().optional()
+			remember: z.boolean().optional(),
+			excludedTermKeys: z.array(z.string().min(1)).max(2e4).optional()
 		}).strict(),
-		z.object({ kind: z.literal("package-confirm") }).strict()
+		z.object({ kind: z.literal("package-confirm") }).strict(),
+		z.object({
+			kind: z.literal("retry-work"),
+			workId: z.uuid()
+		}).strict()
 	])
 }).strict();
-function createRouter(application, account, stopping, delivery, nativeInspection) {
+function createRouter(application, account, stopping, delivery, nativeInspection, agentPresence) {
 	const t = initTRPC.context().create({
 		sse: {
 			ping: {
@@ -920,6 +931,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			respond: t.procedure.input(sendChoiceSchema).mutation(({ input }) => sending().respond(input)),
 			pause: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().pause(input)),
 			resume: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().resume(input)),
+			withdraw: t.procedure.input(sendActionSchema).mutation(({ input }) => sending().withdraw(input)),
 			advance: t.procedure.input(sendAddress).mutation(({ input }) => sending().advance(input, stopping))
 		}),
 		manualUpload: t.router({
@@ -937,11 +949,13 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			cardsRead: t.procedure.input(nativeGetSchema.required()).query(({ input }) => native().cardsRead(input)),
 			files: t.procedure.input(journeyRenderSchema).query(({ input, signal }) => native().files(input, signal)),
 			searchResult: t.procedure.input(nativeGetSchema.required()).query(({ input }) => native().searchResult(input)),
+			prepare: t.procedure.input(nativeGetSchema.required()).mutation(({ input }) => native().prepare(input, stopping)),
 			render: t.procedure.input(journeyRenderInputSchema).mutation(({ input, signal }) => native().render(input, signal)),
 			findings: t.procedure.input(journeyFindingsSchema).query(({ input, signal }) => native().findings(input, signal)),
 			findingImpact: t.procedure.input(journeyFindingImpactSchema).query(({ input, signal }) => native().findingImpact(input, signal)),
 			preview: t.procedure.input(journeyPreviewSchema).query(({ input, signal }) => native().preview(input, signal)),
 			get: t.procedure.input(nativeGetSchema).query(({ input, signal }) => readThroughContention(() => native().get(input), signal)),
+			presence: t.procedure.input(z.object({ journeyId: z.uuid() }).strict()).query(async ({ input }) => ({ agent: await agentPresence?.(input.journeyId) ?? null })),
 			inventory: t.procedure.input(journeyInventoryQuerySchema).query(({ input }) => native().inventory(input)),
 			events: t.procedure.input(nativeEventsSchema).query(({ input, signal }) => readThroughContention(() => native().events(input, signal), signal))
 		}),
@@ -2827,7 +2841,7 @@ async function startHost(options) {
 		reply.raw.once("close", () => streams.delete(reply.raw));
 	});
 	const trpcOptions = {
-		router: createRouter(options.application, options.account, stopping.signal, delivery, options.nativeInspection),
+		router: createRouter(options.application, options.account, stopping.signal, delivery, options.nativeInspection, options.agentPresence),
 		createContext: ({ req }) => {
 			const currentView = requestObservations.get(req);
 			return {
@@ -4714,6 +4728,19 @@ function createStagedJourney(access, root, databaseId) {
 				});
 			});
 		},
+		/** BL-216: as `commit`, for a proposal the store applies to its current state. */
+		commitClassification(input) {
+			return access.staged(async (leg, signal) => {
+				const first = await leg.run("journey.classification.commit", input);
+				if (first.status !== "hide-delta") return first;
+				const key = await files.hideKey(first.state.journeyId, signal);
+				const delta = await readConfirmedHideChange({ journeyTerms: (query) => leg.run("journey.terms.read", query) }, key, first.state, first.next);
+				return leg.run("journey.commit", {
+					...classificationJourneyCommit(input, first.next, first.state.revision),
+					confirmedHideDelta: delta
+				});
+			});
+		},
 		resources: createStagedResources(access, files, (input) => inspection.protectedBase(input)),
 		saveResource: createStagedResourceSave(access, files),
 		async putBatch(batch) {
@@ -4988,6 +5015,7 @@ async function openStore(options, backupObsolete) {
 			acknowledgeSessionUsefulness: (input) => stagedJourney.acknowledgeSessionUsefulness(input),
 			current: (journeyId) => access.run("journey.current", journeyId ? { journeyId } : {}),
 			commit: (input) => stagedJourney.commit(input),
+			commitClassification: (input) => stagedJourney.commitClassification(input),
 			hideIndexKey: (journeyId) => stagedJourney.hideIndexKey(journeyId),
 			recordTerms: (input) => stagedJourney.recordTerms(input),
 			journeyTerms: (input) => stagedJourney.journeyTerms(input),
@@ -5458,6 +5486,10 @@ function parseOptions(args, source = sourceCheckout) {
 						type: "boolean",
 						default: false
 					},
+					detach: {
+						type: "boolean",
+						default: false
+					},
 					"state-dir": { type: "string" },
 					"bundle-dir": { type: "string" },
 					"claude-home": { type: "string" },
@@ -5507,6 +5539,7 @@ function parseOptions(args, source = sourceCheckout) {
 		"all"
 	].includes(parsed.values.agent) || parsed.values.scope !== void 0 && !["user", "project"].includes(parsed.values.scope) || parsed.values["cli-path"] !== void 0 && !isAbsolute(parsed.values["cli-path"]) || parsed.values["configure-agents"] !== void 0 && parsed.values["skip-agent-config"] !== void 0) throw new Error("INVALID_ARGUMENTS");
 	if (parsed.values.async && (!command || !longCommands.has(command))) throw new Error("INVALID_ARGUMENTS");
+	if (parsed.values.detach && command !== "journey.serve") throw new Error("INVALID_ARGUMENTS");
 	const timeoutMs = parsed.values["timeout-ms"] === void 0 ? 3e4 : Number(parsed.values["timeout-ms"]);
 	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647) throw new Error("INVALID_ARGUMENTS");
 	if (parsed.values.output && !stateDump) throw new Error("INVALID_ARGUMENTS");
@@ -5552,6 +5585,9 @@ ${Array.from(businessCommands).join("\n")}
 
 Business commands invoke the shared Application directly without an HTTP server.
 journey.serve starts a focused confirmation host, emits JSON readiness, and waits until stopped.
+journey.serve --detach starts that host in its own process, prints its readiness with the host's
+pid, and exits; stop the host with that pid. A detached host already serving the journey is
+reused and reported with reused: true.
 It does not discover sessions or open a browser. The agent opens its private URL in the right pane.
 Workflow mutations require protocolVersion, runId and expectedRevision in JSON input.
 Long commands emit the operation ID immediately as NDJSON, then wait up to 30000 ms.
@@ -5760,105 +5796,6 @@ function createJourneyFindings(storage) {
 	};
 }
 //#endregion
-//#region apps/cli/src/journey/plan.ts
-async function prepareSourcePlan(storage, harnesses, journeyId, sensitiveTerms, signal, period = {}) {
-	const saved = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	}))[0];
-	if (saved?.kind === "plan") return saved;
-	const discovered = await harnesses.discover(signal);
-	if (!discovered.complete) throw new ApplicationError("SCOPE_NOT_READY");
-	const inventory = filterInventoryByPeriod(discovered, period);
-	if (inventory.sessions.length === 0) throw new ApplicationError("INVALID_SELECTION");
-	const families = reviewFamilies(inventory);
-	const defaults = defaultScopedSettings();
-	const settings = {
-		...defaults,
-		overall: {
-			...defaults.overall,
-			cleanup: {
-				ref: {
-					id: "native-evidence",
-					version: "2"
-				},
-				options: { assessedSessionsOnly: true }
-			}
-		},
-		workspaces: Object.fromEntries(inventory.workspaces.map((work) => [work.id, {
-			parameters: {
-				"screened-identifiers": { enabled: false },
-				"ip-addresses": { enabled: false },
-				hostnames: { enabled: false },
-				"cloud-resources": { enabled: false },
-				"mac-addresses": { enabled: false },
-				"public-key-containers": { enabled: false },
-				"geographic-coordinates": { enabled: false },
-				urls: { enabled: false },
-				"filesystem-paths": { mode: "identity-roots" }
-			},
-			optionalSteps: { "phone-numbers": true }
-		}]))
-	};
-	const configuration = freezeConfiguration(settings, inventory.sessions.flatMap((session) => {
-		const owner = families.owners.get(session.id);
-		return owner ? [{
-			sessionId: session.id,
-			workspaceId: session.workspaceId,
-			settingsOwner: {
-				sessionId: owner.id,
-				workspaceId: owner.workspaceId
-			}
-		}] : [];
-	}));
-	const resource = {
-		kind: "plan",
-		journeyId,
-		approval: {
-			runId: journeyId,
-			revision: 0,
-			approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			inventory,
-			sourceChangePolicy: "fail",
-			treatment: {
-				kind: "configured",
-				configuration,
-				dictionaryRevision: sensitiveTerms.revision
-			}
-		},
-		replacementKey: randomBytes(32).toString("hex"),
-		sensitiveTerms: {
-			revision: sensitiveTerms.revision,
-			terms: [...sensitiveTerms.terms]
-		}
-	};
-	await storage.saveResource(resource);
-	return resource;
-}
-function workApproval(approval, rootIds) {
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("PROCESSING_PLAN_UNAVAILABLE");
-	const families = reviewFamilies(approval.inventory);
-	const ids = new Set(rootIds.flatMap((id) => {
-		const members = families.members.get(id);
-		if (!members) throw new ApplicationError("UNKNOWN_ITEM");
-		return members.map((session) => session.id);
-	}));
-	const sessions = approval.inventory.sessions.filter((session) => ids.has(session.id));
-	const workspaces = new Set(sessions.map((session) => session.workspaceId));
-	return {
-		...approval,
-		inventory: {
-			...approval.inventory,
-			sessions,
-			workspaces: approval.inventory.workspaces.filter((workspace) => workspaces.has(workspace.id))
-		},
-		treatment: {
-			...approval.treatment,
-			configuration: selectFrozenConfiguration(approval.treatment.configuration, ids)
-		}
-	};
-}
-//#endregion
 //#region apps/cli/src/journey/metadata/processing.ts
 /** Load the frozen plan and active terms once; each Work then resolves its own policy. */
 async function metadataPolicy(storage, state, processing) {
@@ -6060,6 +5997,10 @@ function bindJourneyDestination(storage, destination) {
 			await guard(input.journeyId);
 			return storage.saveResource(input);
 		},
+		async commitClassification(input) {
+			await guard(input.journeyId);
+			return storage.commitClassification(input);
+		},
 		async respondPolicy(input) {
 			await guard(input.request.journeyId);
 			return storage.respondPolicy(input);
@@ -6784,6 +6725,14 @@ async function publishWorkBatches(storage, plan, work, resources, signal) {
 }
 //#endregion
 //#region apps/cli/src/journey/prepare/scan-sessions.ts
+/** Scan refusals caused by one session's own sources, the codes admission refusals also isolate. */
+const rootScanRefusals = /* @__PURE__ */ new Set([
+	"ARTIFACT_PROCESSING_UNSUPPORTED",
+	"PROCESSING_UNSUPPORTED",
+	"ARTIFACT_SOURCE_CHANGED",
+	"ARTIFACT_LIMIT",
+	"PROCESSING_LIMIT"
+]);
 /**
 * Track A (ADR 0172, ADR 0177): every session of the Work is submitted to the shared pool at once,
 * ahead of Track B, and each completed session's receipt is saved as it arrives. Once every session
@@ -6847,7 +6796,11 @@ async function publishScanSessions(storage, plan, work, prepared, binding, direc
 		volumes.scanInputFields += resource.input.fieldCount;
 		volumes.scanFileBytes += resource.input.file.byteLength;
 	}, (error) => {
-		failure ??= { error };
+		const rootSessionId = families.owners.get(selected.session.id)?.id;
+		failure ??= rootSessionId ? {
+			error,
+			rootSessionId
+		} : { error };
 		withdraw.abort();
 	});
 	if (pooled) {
@@ -6885,7 +6838,11 @@ async function publishScanSessions(storage, plan, work, prepared, binding, direc
 			...paragraphs ? { scanHostedCopies: paragraphs.hosted } : {}
 		}
 	});
-	if (failure) throw failure.error;
+	if (failure) {
+		const code = safeCode(failure.error);
+		if (!hooks.signal.aborted && failure.rootSessionId && rootScanRefusals.has(code)) throw new RootPreparationFailure(code, /* @__PURE__ */ new Map([[failure.rootSessionId, code]]), { cause: failure.error });
+		throw failure.error;
+	}
 	hooks.signal.throwIfAborted();
 	if (resources.length !== prepared.sessions.length) throw new ApplicationError("SCOPE_NOT_READY");
 	return {
@@ -7111,223 +7068,6 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 	}
 }
 //#endregion
-//#region apps/cli/src/journey/static/production.ts
-/**
-* The single production both Track B and packaging use for one Work generation (ADR 0172):
-* frozen captures, built-in static detection only (no custom terms, no Git seeds), the Work's
-* exceptions and a replacement key bound to this generation. Identical inputs give identical
-* session render jobs, so packaging can require the stored Track B result by job digest.
-*/
-async function staticBaseProduction(storage, state, work, processing, hooks) {
-	const excluded = work.excludedReview?.snapshotId === state.snapshotId && work.excludedReview.inputRevision === work.inputRevision ? new Set(work.excludedReview.rootSessionIds) : /* @__PURE__ */ new Set();
-	const roots = work.rootSessionIds.filter((id) => !excluded.has(id));
-	if (!roots.length) return void 0;
-	const plan = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "plan"
-	}))[0];
-	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
-	const approval = workApproval(plan.approval, roots);
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("CORRUPTED_STATE");
-	const parts = new Set(approval.inventory.sessions.flatMap((session) => session.parts.map((part) => part.id)));
-	const captures = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "capture"
-	})).flatMap((item) => item.kind === "capture" && parts.has(item.capture.partId) ? [item.capture] : []);
-	if (captures.length !== parts.size) throw new ApplicationError("SCOPE_NOT_READY");
-	const { sensitiveTerms: _live, customTerms: _terms, staticExceptions: _unscoped, ...local } = processing;
-	const production = await prepareCollectionProduction(approval, state.journeyId, {
-		configured: {
-			...local,
-			gitNames: async () => ({
-				names: [],
-				snapshots: []
-			}),
-			replacementKey: createHash("sha256").update(JSON.stringify([
-				"static-base-v1",
-				plan.replacementKey,
-				work.id,
-				work.inputRevision
-			])).digest("hex"),
-			staticExceptions: {
-				workId: work.id,
-				values: state.exceptions.filter((item) => item.workId === work.id).map(({ kind, value }) => ({
-					kind,
-					value
-				}))
-			}
-		},
-		captures,
-		everyAdmissionRefusal: true
-	}, hooks);
-	if (production.kind !== "configured" || production.workspaceFailures.length) throw new ApplicationError("SCOPE_NOT_READY");
-	const families = reviewFamilies(approval.inventory);
-	const admitted = new Set(production.selection.sessions.map((item) => item.session.id));
-	return {
-		production,
-		families,
-		work: {
-			...work,
-			rootSessionIds: roots.filter((id) => families.members.get(id)?.some((member) => admitted.has(member.id))),
-			access: work.access === "private" ? "private" : "public"
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/static/store.ts
-/** Identity, length and complete digest of one owner-only file; a symlink is never followed. */
-async function describe(path, signal) {
-	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const before = await handle.stat({ bigint: true });
-		if (!before.isFile()) throw new ApplicationError("CORRUPTED_STATE");
-		const digest = createHash("sha256");
-		let byteLength = 0;
-		const buffer = Buffer.allocUnsafe(1048576);
-		for (;;) {
-			signal.throwIfAborted();
-			const { bytesRead } = await handle.read(buffer, 0, buffer.length, byteLength);
-			if (!bytesRead) break;
-			digest.update(buffer.subarray(0, bytesRead));
-			byteLength += bytesRead;
-		}
-		const after = await handle.stat({ bigint: true });
-		if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || BigInt(byteLength) !== after.size) throw new ApplicationError("CORRUPTED_STATE");
-		return {
-			path,
-			identity: {
-				dev: String(after.dev),
-				ino: String(after.ino)
-			},
-			sha256: digest.digest("hex"),
-			byteLength
-		};
-	} finally {
-		await handle.close();
-	}
-}
-/** A stored file must still be the exact recorded file and bytes. */
-async function authenticate(file, signal) {
-	const actual = await describe(file.path, signal);
-	if (JSON.stringify(actual) !== JSON.stringify(file)) throw new ApplicationError("CORRUPTED_STATE");
-}
-/**
-* Persist one Track B session as owner-only private state beside the journey's other scan
-* files: its three spools and a digest-bound result description. Nothing here is uploaded.
-*/
-async function saveStaticSession(storage, binding, item, result, signal) {
-	const owned = [
-		result.spoolPath,
-		result.companionSpoolPath,
-		result.maskSpoolPath
-	];
-	const resultPath = join(binding.directory, `${randomUUID()}.static.json`);
-	let saved = false;
-	try {
-		if (result.kind !== "render" || result.maskSpoolPath === void 0 || result.maskEntries === void 0 || result.metadataMasks === void 0 || result.reviewSpoolPath !== void 0) throw new ApplicationError("CORRUPTED_STATE");
-		const stored = {
-			kind: "render",
-			processingMs: result.processingMs,
-			maskEntries: result.maskEntries,
-			metadataMasks: result.metadataMasks,
-			metadata: result.metadata,
-			parts: result.parts,
-			entries: result.entries,
-			agentSetup: result.agentSetup
-		};
-		const file = await open(resultPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
-		owned.push(resultPath);
-		try {
-			await file.writeFile(JSON.stringify(stored));
-			await file.sync();
-		} finally {
-			await file.close();
-		}
-		const resource = staticSessionResourceSchema.parse({
-			kind: "static-session",
-			journeyId: binding.journeyId,
-			workId: binding.work.id,
-			inputRevision: binding.work.inputRevision,
-			snapshotId: binding.snapshotId,
-			sessionId: item.sessionId,
-			jobDigest: item.digest,
-			result: await describe(resultPath, signal),
-			primary: await describe(result.spoolPath, signal),
-			companion: await describe(result.companionSpoolPath, signal),
-			masks: await describe(result.maskSpoolPath, signal)
-		});
-		await storage.saveResource(resource);
-		saved = true;
-		return resource;
-	} finally {
-		if (!saved) {
-			for (const path of owned) if (path !== void 0) await unlink(path).catch(() => {});
-		}
-	}
-}
-/** Current-generation Track B receipts of one Work, keyed by application session ID. */
-async function staticSessions(storage, journeyId, work) {
-	const resources = (await storage.resources({
-		journeyId,
-		kind: "static-session",
-		idPrefix: `${work.id}:${work.inputRevision}:`
-	})).filter((item) => item.kind === "static-session" && item.workId === work.id && item.inputRevision === work.inputRevision);
-	return new Map(resources.map((item) => [item.sessionId, item]));
-}
-/**
-* Shape guard like the worker transport's: the bytes are bound by the recorded digest, and the
-* archive writer checks parts, entries and masks again when it consumes them.
-*/
-function isStoredResult(value) {
-	return typeof value === "object" && value !== null && Reflect.get(value, "kind") === "render" && Array.isArray(Reflect.get(value, "maskEntries")) && Array.isArray(Reflect.get(value, "metadataMasks")) && Array.isArray(Reflect.get(value, "parts")) && Array.isArray(Reflect.get(value, "entries")) && Array.isArray(Reflect.get(value, "agentSetup")) && typeof Reflect.get(value, "metadata") === "string" && Number.isSafeInteger(Reflect.get(value, "processingMs"));
-}
-/** Authenticated result description of one stored Track B session. */
-async function readStaticResult(resource, signal) {
-	await authenticate(resource.result, signal);
-	const handle = await open(resource.result.path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const text = await handle.readFile("utf8");
-		if (createHash("sha256").update(text).digest("hex") !== resource.result.sha256) throw new ApplicationError("CORRUPTED_STATE");
-		const value = JSON.parse(text);
-		if (!isStoredResult(value)) throw new ApplicationError("CORRUPTED_STATE");
-		return value;
-	} finally {
-		await handle.close();
-	}
-}
-/**
-* Packaging from the Track B base: the stored result of exactly this job, with fresh hard links
-* to its authenticated spools that the archive writer may consume. Static detection never runs.
-*/
-async function linkedStaticResult(resource, job, signal) {
-	if (!resource || resource.jobDigest !== job.digest) throw new ApplicationError("SCOPE_NOT_READY");
-	const result = await readStaticResult(resource, signal);
-	const links = [];
-	try {
-		const linked = async (file) => {
-			const path = join(job.spoolDirectory, `${randomUUID()}.session`);
-			await link(file.path, path);
-			links.push(path);
-			const stat = await lstat(path, { bigint: true });
-			if (String(stat.dev) !== file.identity.dev || String(stat.ino) !== file.identity.ino) throw new ApplicationError("CORRUPTED_STATE");
-			await authenticate({
-				...file,
-				path
-			}, signal);
-			return path;
-		};
-		return {
-			...result,
-			spoolPath: await linked(resource.primary),
-			companionSpoolPath: await linked(resource.companion),
-			maskSpoolPath: await linked(resource.masks)
-		};
-	} catch (error) {
-		for (const path of links) await unlink(path).catch(() => {});
-		throw error;
-	}
-}
-//#endregion
 //#region apps/cli/src/journey/static/run.ts
 /**
 * Track B for one Work generation (ADR 0172): render every admitted session with all built-in
@@ -7413,6 +7153,7 @@ async function prepareStaticWork(options) {
 		const target = current.works.find((item) => item.id === work.id);
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (current.snapshotId !== snapshotId || target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
+		const images = resources.map((resource) => resource.imagesOmitted);
 		return {
 			...current,
 			works: current.works.map((item) => item.id === work.id ? {
@@ -7420,7 +7161,8 @@ async function prepareStaticWork(options) {
 				staticReview: {
 					snapshotId,
 					inputRevision: work.inputRevision,
-					digest: staticReviewDigest(resources)
+					digest: staticReviewDigest(resources),
+					...images.every((count) => count !== void 0) ? { imagesOmitted: images.reduce((sum, count) => sum + count, 0) } : {}
 				}
 			} : item)
 		};
@@ -7657,8 +7399,8 @@ function createJourneyPreparation(options) {
 			}));
 			if (!state.works.length) throw new ApplicationError("INVALID_SELECTION");
 			if (!scanRequested) await captureSortingScope(storage, journeyId, workApproval(plan.approval, state.works.flatMap((work) => work.rootSessionIds)), directory, abort.signal);
-			const works = scanRequested && state.scope.status === "confirmed" ? state.works : [];
-			if (works.length) run = await runWorkers(options.workers);
+			const scanWorks = scanRequested && state.scope.status === "confirmed" ? state.works : [];
+			if (scanWorks.length) run = await runWorkers(options.workers);
 			const frozen = state;
 			const blockWork = (work, error) => changeJourney(storage, journeyId, "snapshot", (before) => {
 				if (before.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
@@ -7672,8 +7414,8 @@ function createJourneyPreparation(options) {
 				});
 			}, 100);
 			let submittedWorks = 0;
-			const submitted = Promise.withResolvers();
-			if (!works.length) submitted.resolve();
+			let works = [];
+			let submitted = Promise.withResolvers();
 			const submission = () => {
 				let done = false;
 				return () => {
@@ -7694,6 +7436,14 @@ function createJourneyPreparation(options) {
 					return false;
 				}
 			};
+			/** D2: the person dropped this Work while it was prepared; the other Works go on. */
+			const droppedMidScan = async (workId) => {
+				const now = await storage.current(journeyId);
+				const work = now?.works.find((item) => item.id === workId);
+				return Boolean(now && now.phase !== "paused" && now.scope.status === "confirmed" && work && !isSelectedWork(work));
+			};
+			/** Scan generations this run prepared, including those its own isolation started. */
+			const prepared = /* @__PURE__ */ new Set();
 			/** True when failing roots left the Work, which is then prepared again (ADR 0188). */
 			const prepareWorkOnce = async (planned, onSubmitted) => {
 				abort.signal.throwIfAborted();
@@ -7707,6 +7457,7 @@ function createJourneyPreparation(options) {
 					"reading",
 					"review"
 				].includes(work.status)) return false;
+				prepared.add(`${work.id}:${work.inputRevision}`);
 				await prepareClassificationMetadata(storage, latest, work, options.processing, abort.signal);
 				let failures = collectPreparationFailures(plan.approval.inventory, work.rootSessionIds, {
 					journeyId,
@@ -7723,6 +7474,7 @@ function createJourneyPreparation(options) {
 						onTiming: (timing) => options.onTiming?.(planned.id, timing)
 					}, run.workers, (revised) => {
 						work = revised;
+						prepared.add(`${revised.id}:${revised.inputRevision}`);
 						failures = collectPreparationFailures(plan.approval.inventory, revised.rootSessionIds, {
 							journeyId,
 							snapshotId: latest.snapshotId,
@@ -7735,7 +7487,10 @@ function createJourneyPreparation(options) {
 					const code = safeCode(error);
 					if (code !== "OPERATION_CANCELED") options.onFailure(error, failures.read());
 					abort.signal.throwIfAborted();
-					if (code === "OPERATION_CANCELED") throw error;
+					if (code === "OPERATION_CANCELED") {
+						if (await droppedMidScan(planned.id)) return false;
+						throw error;
+					}
 					if (work && await isolateRoots(work, error)) return true;
 					if (work) await blockWork(work, error);
 				}
@@ -7745,14 +7500,14 @@ function createJourneyPreparation(options) {
 				for (let attempt = 0; attempt < planned.rootSessionIds.length; attempt++) if (!await prepareWorkOnce(planned, onSubmitted)) return;
 			};
 			/** Track B for one Work; its failure blocks that Work like a Track A failure would. */
-			const staticWork = async (planned) => {
-				await submitted.promise;
+			const staticWork = async (planned, passSubmitted) => {
+				await passSubmitted;
 				abort.signal.throwIfAborted();
 				const latest = await storage.current(journeyId);
 				abort.signal.throwIfAborted();
 				if (!latest?.consent || latest.phase === "paused" || latest.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
 				const work = latest.works.find((item) => item.id === planned.id);
-				if (!work) return;
+				if (!work || !isSelectedWork(work)) return;
 				try {
 					await inBackgroundStoreLane(() => prepareStaticWork({
 						storage,
@@ -7767,6 +7522,7 @@ function createJourneyPreparation(options) {
 				} catch (error) {
 					abort.signal.throwIfAborted();
 					const code = safeCode(error);
+					if (code === "OPERATION_CANCELED" && await droppedMidScan(work.id)) return;
 					if (code === "COORDINATION_BUSY" || code === "OPERATION_CANCELED") throw error;
 					options.onFailure(error);
 					await blockWork(work, error);
@@ -7779,23 +7535,50 @@ function createJourneyPreparation(options) {
 				abort.abort(error);
 			};
 			const statics = [];
-			await Promise.all(Array.from({ length: run.pool ? works.length : Math.min(1, works.length) }, async () => {
-				for (let work = works[next++]; work && !fatal; work = works[next++]) {
-					const planned = work;
-					const onSubmitted = submission();
-					try {
-						await retryContention(() => prepareWork(planned, onSubmitted), (error) => options.onFailure(error), abort.signal);
-					} catch (error) {
-						stop(error);
-					} finally {
-						onSubmitted();
+			const pass = async (batch) => {
+				works = batch;
+				next = 0;
+				submittedWorks = 0;
+				submitted = Promise.withResolvers();
+				if (!works.length) submitted.resolve();
+				const passSubmitted = submitted.promise;
+				await Promise.all(Array.from({ length: run.pool ? works.length : Math.min(1, works.length) }, async () => {
+					for (let work = works[next++]; work && !fatal; work = works[next++]) {
+						const planned = work;
+						const onSubmitted = submission();
+						try {
+							await retryContention(() => prepareWork(planned, onSubmitted), (error) => options.onFailure(error), abort.signal);
+						} catch (error) {
+							stop(error);
+						} finally {
+							onSubmitted();
+						}
+						statics.push(retryContention(() => staticWork(planned, passSubmitted), (error) => options.onFailure(error), abort.signal).catch(stop));
 					}
-					statics.push(retryContention(() => staticWork(planned), (error) => options.onFailure(error), abort.signal).catch(stop));
+				}));
+				while (submittedWorks < works.length) submission()();
+			};
+			/** Selected Works this run has not prepared yet, waiting while grouping continues (E2). */
+			const later = async () => {
+				for (;;) {
+					abort.signal.throwIfAborted();
+					const latest = await storage.current(journeyId);
+					if (!latest || latest.phase === "paused" || latest.scope.status !== "confirmed") return [];
+					const ready = latest.works.filter((work) => isSelectedWork(work) && [
+						"pending",
+						"reading",
+						"review"
+					].includes(work.status) && !prepared.has(`${work.id}:${work.inputRevision}`));
+					if (ready.length || !isClassifying(latest)) return ready;
+					await setTimeout$1(laterWorksPollMs, void 0, { signal: abort.signal }).catch(() => abort.signal.throwIfAborted());
 				}
-			}));
-			while (submittedWorks < works.length) submission()();
+			};
+			for (let batch = scanWorks; batch.length && !fatal; batch = await later()) {
+				if (!run.workers && !run.pool) run = await runWorkers(options.workers);
+				await pass(batch);
+			}
 			await Promise.all(statics);
-			if (works.length) options.onTiming?.(journeyId, {
+			if (scanWorks.length) options.onTiming?.(journeyId, {
 				scope: "preparation",
 				phases: { "journey-prepare": Math.round(performance$1.now() - startedAt) },
 				volumes: {
@@ -7820,6 +7603,8 @@ function createJourneyPreparation(options) {
 		}
 	};
 }
+/** How often a run waiting for grouping to publish more Works checks the journey (E2). */
+const laterWorksPollMs = 2e3;
 /**
 * Another process can hold the store past one admission deadline (ADR 0082); the Work runs
 * again after a bounded backoff instead of stopping the pass. A pending Work re-prepares
@@ -7863,7 +7648,7 @@ async function runWorkers(workers) {
 //#endregion
 //#region apps/cli/src/journey/package-base.ts
 /** Package-only staging from the complete Track B base; scanning never calls this. */
-async function packageBase(storage, state, work, processing, directory, signal, readState = () => storage.current(state.journeyId)) {
+async function packageBase(storage, state, work, processing, directory, signal, readState = () => storage.current(state.journeyId), write = writeJourneyBase) {
 	assertJourneyPrivacyReady(state, true);
 	const existing = (await storage.resources({
 		journeyId: state.journeyId,
@@ -7871,53 +7656,18 @@ async function packageBase(storage, state, work, processing, directory, signal,
 		id: `${work.id}:${work.inputRevision}`
 	})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === work.inputRevision);
 	if (existing?.kind === "base") return existing;
-	const hooks = {
-		signal,
-		onTemporary: async () => {},
-		onPhase: async () => {}
-	};
-	const prepared = await staticBaseProduction(storage, state, work, processing, hooks);
-	if (!prepared) throw new ApplicationError("ARTIFACT_EMPTY_SCOPE");
-	const { families } = prepared;
-	const stored = await staticSessions(storage, state.journeyId, work);
-	const written = await writeLogicalJourneyBase({
-		production: prepared.production,
+	const inputs = await staticBaseInputs(storage, state, work);
+	if (!inputs) throw new ApplicationError("ARTIFACT_EMPTY_SCOPE");
+	const base = await write({
+		inputs,
+		stored: [...(await staticSessions(storage, state.journeyId, work)).values()],
 		directory,
-		captureReview: false,
-		work: prepared.work,
-		prerendered: async (job) => {
-			if (job.spoolDirectory === void 0) throw new ApplicationError("CORRUPTED_STATE");
-			return linkedStaticResult(stored.get(job.session.id), {
-				digest: renderJobDigest(job),
-				spoolDirectory: job.spoolDirectory
-			}, signal);
-		}
-	}, hooks);
+		processing
+	}, signal);
 	const after = await readState();
 	const current = after?.works.find((item) => item.id === work.id);
 	if (!after || after.snapshotId !== state.snapshotId || after.configurationId !== state.configurationId || current?.revision !== work.revision || current.inputRevision !== work.inputRevision || after.pendingHideId) throw new ApplicationError("REVISION_CONFLICT");
 	assertJourneyPrivacyReady(after, true);
-	const base = {
-		kind: "base",
-		journeyId: state.journeyId,
-		workId: work.id,
-		inputRevision: work.inputRevision,
-		bundleId: written.bundleId,
-		primary: written.primary,
-		companion: written.companion,
-		maskLedger: written.maskLedger,
-		sourceBindings: [...written.sourceBindings],
-		sessions: written.sessionBindings.map((binding) => {
-			const root = families.owners.get(binding.applicationSessionId);
-			if (!root) throw new ApplicationError("CORRUPTED_STATE");
-			return {
-				applicationSessionId: binding.applicationSessionId,
-				archiveSessionId: binding.sessionId,
-				rootSessionId: root.id,
-				role: root.id === binding.applicationSessionId ? "main" : "worker"
-			};
-		})
-	};
 	await storage.saveResource(base);
 	return base;
 }
@@ -7931,12 +7681,21 @@ const priorities = [
 ];
 //#endregion
 //#region apps/cli/src/journey/keywords.ts
+/** The journey's frozen source plan; it is saved once and never rewritten. */
+async function readJourneyPlan(storage, journeyId) {
+	const plan = (await storage.resources({
+		journeyId,
+		kind: "plan"
+	}))[0];
+	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	return plan;
+}
 /**
 * ADR 0172: the confirmed dictionary applied once, as the last step before the ZIP — custom
 * terms, the snapshot-frozen Git seeds of the given sessions' workspaces (ADR 0169, never live
 * Git) and AI-confirmed Hidden values. Neither scan track applies any of these.
 */
-async function finalKeywordDictionary(storage, state, sessionIds) {
+async function finalKeywordDictionary(storage, state, sessionIds, plan) {
 	if (!state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const dictionary = /* @__PURE__ */ new Map();
 	const add = (term, kind, bounded) => {
@@ -7951,16 +7710,12 @@ async function finalKeywordDictionary(storage, state, sessionIds) {
 		const admitted = admitCustomTerm(value);
 		if (admitted) add(admitted.value, "private", false);
 	}
-	const plan = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "plan"
-	}))[0];
-	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	const { approval } = plan ?? await readJourneyPlan(storage, state.journeyId);
 	const sessions = new Set(sessionIds);
 	const roots = /* @__PURE__ */ new Map();
-	for (const session of plan.approval.inventory.sessions) {
+	for (const session of approval.inventory.sessions) {
 		if (!sessions.has(session.id)) continue;
-		const workspace = plan.approval.inventory.workspaces.find((item) => item.id === session.workspaceId);
+		const workspace = approval.inventory.workspaces.find((item) => item.id === session.workspaceId);
 		if (!workspace) throw new ApplicationError("CORRUPTED_STATE");
 		const paths = workspace.path === null ? [] : [workspace.path];
 		roots.set(JSON.stringify(paths), paths);
@@ -8307,8 +8062,26 @@ function createRenderWorkers(workers, size) {
 			return pool.serial(() => writeJourneyOutput(work, signal));
 		}
 	};
+	const writeBase = async (work, signal) => {
+		const named = /* @__PURE__ */ new Set();
+		try {
+			const result = await pool.acquire().request({
+				kind: "journey-base",
+				job: journeyBaseJob(work)
+			}, signal, { onSpool: (path) => named.add(path) });
+			if (result.kind !== "journey-base") throw new Error("ARTIFACT_PROCESSING_FAILED");
+			return result.base;
+		} catch (error) {
+			await removeNamedTemporarySpools(named).catch((cleanup) => workers.onFallback?.(cleanup));
+			if (error instanceof SessionWorkerError) throw new ApplicationError(error.message, void 0, { cause: error });
+			if (signal.aborted) throw error;
+			workers.onFallback?.(error);
+			return pool.serial(() => writeJourneyBase(work, signal));
+		}
+	};
 	return {
 		write,
+		writeBase,
 		close: () => pool.discard()
 	};
 }
@@ -8486,7 +8259,7 @@ function createJourneyRenderer(options) {
 			work
 		};
 	}
-	async function produce(state, work, signal, write, session) {
+	async function produce(state, work, signal, write, session, plan, writeBase) {
 		const { journeyId } = state;
 		const workId = work.id;
 		assertJourneyPrivacyReady(state, true);
@@ -8518,12 +8291,12 @@ function createJourneyRenderer(options) {
 			});
 			const next = moved.works.find((item) => item.id === workId);
 			if (!next) throw new ApplicationError("REVISION_CONFLICT");
-			return produce(moved, next, signal, write, session);
+			return produce(moved, next, signal, write, session, plan, writeBase);
 		}
 		if (!output) {
 			const directory = await journeyDirectory(options.stateDir, journeyId);
-			await packageBase(storage, state, work, options.processing, directory, signal, () => session.current());
-			const { base, tokens, confirmed, request } = await journeyOutputRequest(storage, state, work, options.processing, signal);
+			await packageBase(storage, state, work, options.processing, directory, signal, () => session.current(), writeBase);
+			const { base, tokens, confirmed, request } = await journeyOutputRequest(storage, state, work, options.processing, signal, await plan());
 			const { output: written, tokens: collected } = await write({
 				request: {
 					...request,
@@ -8614,10 +8387,10 @@ function createJourneyRenderer(options) {
 			};
 		});
 	}
-	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId)) {
+	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId), plan = () => readJourneyPlan(storage, journeyId), writeBase = writeJourneyBase) {
 		const { state, work } = await admit(workId, session);
 		try {
-			return await produce(state, work, signal, write, session);
+			return await produce(state, work, signal, write, session, plan, writeBase);
 		} catch (error) {
 			if (signal.aborted) throw error;
 			const renderFailure = {
@@ -8640,19 +8413,26 @@ function createJourneyRenderer(options) {
 		}
 	}
 	/**
-	* A several-Work render writes each Work's output in packaging workers; state, database and
-	* resource writes stay on this thread under the cross-process state lock (ADR 0181). Any Work
-	* may be split into shards, so the pool is not limited to one worker per Work (ADR 0199).
+	* A several-Work render writes each Work's base and output in packaging workers; state,
+	* database and resource writes stay on this thread under the cross-process state lock
+	* (ADR 0181, ADR 0228). Any Work may be split into shards, so the pool is not limited to one
+	* worker per Work (ADR 0199). A `workIds` call of one Work uses workers too, so a panel batch
+	* never packages on the serving thread.
 	*/
 	async function renderScope(journeyId, works, signal) {
 		const workers = options.workers;
 		const size = workers ? workers.parallelism ?? renderWorkerCount() : 0;
-		if (!workers || works < 2 || size < 1) return void 0;
+		if (!workers || works < 1 || size < 1) return void 0;
 		const pool = createRenderWorkers(workers, size);
 		const session = batchedRenderSession(storage, journeyId);
+		let plan;
+		const readPlan = () => plan ??= readJourneyPlan(storage, journeyId).catch((error) => {
+			plan = void 0;
+			throw error;
+		});
 		return {
 			concurrency: size + 1,
-			render: (workId) => render(journeyId, workId, signal, pool.write, session),
+			render: (workId) => render(journeyId, workId, signal, pool.write, session, readPlan, pool.writeBase),
 			close: pool.close
 		};
 	}
@@ -8662,7 +8442,7 @@ function createJourneyRenderer(options) {
 	};
 }
 /** Package-only native output request: the final keyword dictionary covers all retained fields. */
-async function journeyOutputRequest(storage, state, work, processingConfig, _signal) {
+async function journeyOutputRequest(storage, state, work, processingConfig, _signal, plan) {
 	const { journeyId } = state;
 	const workId = work.id;
 	const base = (await storage.resources({
@@ -8670,14 +8450,11 @@ async function journeyOutputRequest(storage, state, work, processingConfig, _sig
 		kind: "base",
 		id: `${workId}:${work.inputRevision}`
 	})).find((item) => item.kind === "base" && item.workId === workId && item.inputRevision === work.inputRevision);
-	const plan = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	}))[0];
-	if (base?.kind !== "base" || plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
+	if (base?.kind !== "base") throw new ApplicationError("CORRUPTED_STATE");
+	const { replacementKey } = plan ?? await readJourneyPlan(storage, journeyId);
 	const hides = createFamilyHides();
 	const confirmed = await journeyConfirmedHides(storage, state);
-	const dictionary = await finalKeywordDictionary(storage, state, base.sessions.map((session) => session.applicationSessionId));
+	const dictionary = await finalKeywordDictionary(storage, state, base.sessions.map((session) => session.applicationSessionId), plan);
 	const exceptions = workExceptions(state, workId);
 	const tokens = createHideIndexTokens();
 	const title = await renderTitle(storage, state, work);
@@ -8692,7 +8469,7 @@ async function journeyOutputRequest(storage, state, work, processingConfig, _sig
 			companion: base.companion,
 			workId,
 			baseBundleId: base.bundleId,
-			replacementKey: plan.replacementKey,
+			replacementKey,
 			edits: [],
 			families: hides.request(base.sessions, dictionary, exceptions),
 			metadata: {
@@ -9411,73 +9188,73 @@ function createClassificationReader(storage, stateDir) {
 }
 //#endregion
 //#region apps/cli/src/journey/works/regroup.ts
-/** Rebind accepted frozen evidence; original batch/chunk IDs remain its audit provenance. */
-async function regroupPrivacySources(storage, state, works, changedMetadata, signal) {
-	const owners = new Map(works.flatMap((work) => work.rootSessionIds.map((id) => [id, work.id])));
+/**
+* The session of every accepted finding chunk outside the proposal's retained Works, read from
+* frozen batches before the commit so the store transaction can rebind them without I/O.
+*/
+async function resolveChunkSessions(storage, state, works, signal) {
 	const retained = new Set(works.map((work) => work.id));
 	const batches = /* @__PURE__ */ new Map();
-	const terms = [];
-	for (const term of state.privacy.terms) {
-		const sources = [];
-		for (const source of term.sources) {
-			signal.throwIfAborted();
-			if (source.kind === "metadata") {
-				if (retained.has(source.workId) && !changedMetadata.has(source.workId)) sources.push(source);
-				continue;
-			}
-			if (retained.has(source.workId)) {
-				sources.push(source);
-				continue;
-			}
-			let batch = batches.get(source.batchId);
-			if (!batch) {
-				const record = await storage.inspectReview({
-					kind: "attempt",
-					journeyId: state.journeyId,
-					batchId: source.batchId
-				});
-				if (!record || record.batch.snapshotId !== state.snapshotId) throw new ApplicationError("CORRUPTED_STATE");
-				batch = record.batch;
-				if (batches.size >= 16) batches.clear();
-				batches.set(source.batchId, batch);
-			}
-			const chunk = batch.chunks.find((item) => item.id === source.chunkId) ?? batch.duplicates?.find((item) => item.id === source.chunkId);
-			const workId = chunk && owners.get(chunk.sessionId);
-			if (!workId) throw new ApplicationError("CORRUPTED_STATE");
-			sources.push({
-				...source,
-				workId
+	const resolved = /* @__PURE__ */ new Map();
+	for (const term of state.privacy.terms) for (const source of term.sources) {
+		signal.throwIfAborted();
+		if (source.kind === "metadata" || retained.has(source.workId)) continue;
+		const key = `${source.batchId}:${source.chunkId}`;
+		if (resolved.has(key)) continue;
+		let batch = batches.get(source.batchId);
+		if (!batch) {
+			const record = await storage.inspectReview({
+				kind: "attempt",
+				journeyId: state.journeyId,
+				batchId: source.batchId
 			});
-		}
-		terms.push({
-			...term,
-			sources
+			if (!record || record.batch.snapshotId !== state.snapshotId) throw new ApplicationError("CORRUPTED_STATE");
+			batch = record.batch;
+			if (batches.size >= 16) batches.clear();
+			batches.set(source.batchId, batch);
+		}
+		const chunk = batch.chunks.find((item) => item.id === source.chunkId) ?? batch.duplicates?.find((item) => item.id === source.chunkId);
+		if (!chunk) throw new ApplicationError("CORRUPTED_STATE");
+		resolved.set(key, {
+			batchId: source.batchId,
+			chunkId: source.chunkId,
+			sessionId: chunk.sessionId
 		});
 	}
-	return terms;
+	return [...resolved.values()];
 }
 //#endregion
 //#region apps/cli/src/journey/works/proposal.ts
-/** One atomic complete root partition; recommendations have no access authority. */
+/**
+* One atomic root partition; recommendations have no access authority. Roots still being grouped
+* wait in one unread Work while the other Works are confirmed and read; the submission that
+* groups them may arrive after confirmation and keeps it (E2). The proposal is prepared from one
+* read and applied by the store against the current state, so scan writes in between do not
+* refuse it (BL-216).
+*/
 function createClassificationProposal(storage) {
 	return async (input, signal) => {
 		signal.throwIfAborted();
 		const state = await storage.current(input.journeyId);
 		if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
-		const commit = (next = state) => storage.commit({
+		const classifying = isClassifying(state);
+		const late = state.scope.status === "confirmed";
+		const bound = input.expectedClassificationRevision !== void 0 && classifying && input.expectedClassificationRevision === state.classificationRevision;
+		const requestHash = textDigest(JSON.stringify(input));
+		const event = {
+			journeyId: state.journeyId,
+			kind: "response",
+			source: "conversation",
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		if (input.expectedClassificationRevision !== void 0 ? !bound : state.revision !== input.expectedRevision) return storage.commit({
 			expectedRevision: input.expectedRevision,
 			requestKey: input.idempotencyKey,
-			requestHash: textDigest(JSON.stringify(input)),
-			state: next,
-			event: {
-				journeyId: state.journeyId,
-				kind: "response",
-				source: "conversation",
-				at: (/* @__PURE__ */ new Date()).toISOString()
-			}
+			requestHash,
+			state,
+			event
 		});
-		if (state.revision !== input.expectedRevision) return commit();
-		if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
+		if (late && !classifying) throw new ApplicationError("INVALID_TRANSITION");
 		if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (!state.snapshotId || state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 		const plan = (await storage.resources({
@@ -9503,6 +9280,11 @@ function createClassificationProposal(storage) {
 				});
 			} else merged.set(key, item);
 		}
+		const pending = input.pendingRootSessionIds ?? [];
+		for (const root of pending) {
+			if (!roots.has(root) || seen.has(root)) throw new ApplicationError("INVALID_SELECTION");
+			seen.add(root);
+		}
 		if (seen.size !== roots.size) throw new ApplicationError("INVALID_SELECTION");
 		const families = reviewFamilies(plan.approval.inventory);
 		const captures = await storage.resources({
@@ -9510,75 +9292,43 @@ function createClassificationProposal(storage) {
 			kind: "capture"
 		});
 		const captured = new Set(captures.flatMap((resource) => resource.kind === "capture" ? [resource.capture.partId] : []));
-		const works = [];
+		const workspacesOf = (rootSessionIds) => {
+			const sessions = rootSessionIds.flatMap((root) => families.members.get(root) ?? []);
+			if (sessions.some((session) => session.parts.some((part) => !captured.has(part.id)))) throw new ApplicationError("SCOPE_NOT_READY");
+			return [...new Set(sessions.map((session) => session.workspaceId))];
+		};
+		const items = [];
 		for (const item of merged.values()) {
 			signal.throwIfAborted();
-			const sessions = item.rootSessionIds.flatMap((root) => families.members.get(root) ?? []);
-			if (sessions.some((session) => session.parts.some((part) => !captured.has(part.id)))) throw new ApplicationError("SCOPE_NOT_READY");
-			const base = state.works.find((work) => work.rootSessionIds.length === item.rootSessionIds.length && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root))) ?? newJourneyWork(randomUUID(), item.projectName, item.rootSessionIds, [...new Set(sessions.map((session) => session.workspaceId))]);
-			const { classificationMetadata: _display, ...original } = base;
-			works.push({
-				...original,
-				projectName: item.projectName,
-				title: base.titleOrigin === "explicit" ? base.title : item.projectName,
-				description: item.description,
-				projectType: {
-					type: item.projectType,
-					reason: item.recommendation.reason,
-					origin: "model"
-				},
-				placement: "placed",
-				classificationRecommendation: item.recommendation,
-				suggestion: null,
-				artifact: null,
-				revision: base.revision + 1
+			items.push({
+				...item,
+				workId: randomUUID(),
+				workspaceIds: workspacesOf(item.rootSessionIds)
 			});
 		}
-		const retained = new Set(works.map((work) => work.id));
-		const changedMetadata = new Set(works.filter((work) => {
-			const old = state.works.find((item) => item.id === work.id);
-			return !old || JSON.stringify([
-				work.title,
-				work.projectName,
-				work.description,
-				work.classificationRecommendation?.reason
-			]) !== JSON.stringify([
-				old.title,
-				old.projectName,
-				old.description,
-				old.classificationRecommendation?.reason
-			]);
-		}).map((work) => work.id));
-		const regrouped = state.works.some((work) => !retained.has(work.id)) || changedMetadata.size > 0;
-		const cardTerms = new Set(state.privacy.cards.flatMap((card) => card.termKeys));
-		const preserved = await regroupPrivacySources(storage, state, works, changedMetadata, signal);
-		const forced = new Set(preserved.filter((term) => !termTypeInfo[term.type].asked).map((term) => term.value));
-		const overrides = new Map(state.valueOverrides?.map((item) => [item.value, item.choice]) ?? []);
-		const terms = preserved.map((term) => ({
-			...term,
-			disposition: forced.has(term.value) ? "hidden" : overrides.has(term.value) ? overrides.get(term.value) === "hide" ? "hidden" : "keep" : regrouped && cardTerms.has(privacyTermKey(term)) ? "pending" : term.disposition
-		}));
-		return commit({
-			...state,
-			works,
-			classificationRevision: state.revision + 1,
-			scope: {
-				status: "pending",
-				actor: null,
-				at: null
-			},
-			privacy: {
-				...state.privacy,
-				terms,
-				packageApproval: null,
-				...regrouped ? {
-					cards: [],
-					answersRevision: state.privacy.answersRevision + 1,
-					confirmedAnswersRevision: null
-				} : {}
-			},
-			readingComplete: works.filter((work) => work.access !== "drop").every((work) => work.totalBatches > 0 && work.completedBatches === work.totalBatches),
-			phase: "processing"
+		const prepared = {
+			journeyId: state.journeyId,
+			requestKey: input.idempotencyKey,
+			requestHash,
+			at: event.at,
+			expectedRevision: input.expectedRevision,
+			expectedClassificationRevision: bound ? input.expectedClassificationRevision ?? null : null,
+			snapshotId: state.snapshotId,
+			partition: classificationPartition(state),
+			late,
+			items,
+			pending: pending.length ? {
+				workId: randomUUID(),
+				rootSessionIds: pending,
+				workspaceIds: [...new Set(pending.flatMap((root) => (families.members.get(root) ?? []).map((session) => session.workspaceId)))]
+			} : null,
+			chunkSessions: []
+		};
+		const { works } = classificationWorks(state, prepared);
+		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
+		return storage.commitClassification({
+			...prepared,
+			chunkSessions
 		});
 	};
 }
@@ -10055,16 +9805,19 @@ function createJourneySendArtifacts(storage) {
 				sha256: output.primary.sha256
 			});
 		},
-		async upload(journeyId, artifact, uploadUrl, signal) {
+		async upload(journeyId, artifact, upload, signal) {
 			const output = await find(journeyId, artifact.workId, artifact.revision);
 			if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			await putPrimary(output.primary, artifact.byteLength, uploadUrl, signal);
+			await putPrimary(output.primary, artifact.byteLength, upload, signal);
 		}
 	};
 }
-/** Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. */
-async function putPrimary(primary, byteLength, uploadUrl, signal) {
-	const url = new URL(uploadUrl);
+/**
+* Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. A
+* checksum upload also sends the SHA-256 header the URL signs, so storage refuses other bytes.
+*/
+async function putPrimary(primary, byteLength, upload, signal) {
+	const url = new URL(upload.uploadUrl);
 	if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
 	const source = await openConfiguredUpload(primary, signal);
 	const cleanup = createCleanup();
@@ -10076,7 +9829,8 @@ async function putPrimary(primary, byteLength, uploadUrl, signal) {
 			redirect: "error",
 			headers: {
 				"Content-Type": "application/zip",
-				"Content-Length": String(byteLength)
+				"Content-Length": String(byteLength),
+				...upload.headers
 			},
 			duplex: "half"
 		};
@@ -10246,7 +10000,7 @@ const completeTimeoutMs = 6e5;
 function createJourneyOwnerClient(options) {
 	const base = apiBase(options.apiUrl);
 	const requestFetch = options.fetch ?? fetch;
-	async function request(path, schema, signal, body, method = "POST", key, timeoutMs = requestTimeoutMs$2) {
+	async function request(path, schema, signal, body, method = "POST", key, timeoutMs = requestTimeoutMs$2, checksumUpload = false) {
 		const token = await options.authorize();
 		signal.throwIfAborted();
 		const response = await requestFetch(new URL(path, base), {
@@ -10255,7 +10009,8 @@ function createJourneyOwnerClient(options) {
 				accept: "application/json",
 				authorization: `Bearer ${token}`,
 				...body === void 0 ? {} : { "content-type": "application/json" },
-				...key === void 0 ? {} : { "idempotency-key": key }
+				...key === void 0 ? {} : { "idempotency-key": key },
+				...checksumUpload ? { "upload-checksum": "sha256" } : {}
 			},
 			...body === void 0 ? {} : { body: JSON.stringify(body) },
 			credentials: "omit",
@@ -10310,14 +10065,14 @@ function createJourneyOwnerClient(options) {
 				membersDigest: preview.membersDigest
 			}, "PUT");
 		},
-		reserve(key, input, signal) {
-			return request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, input, "POST", key);
+		reserve(key, input, signal, checksumUpload = true) {
+			return request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, input, "POST", key, requestTimeoutMs$2, checksumUpload);
 		},
 		complete(id, signal) {
 			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}/complete`, receipt(id), signal, {}, "POST", void 0, completeTimeoutMs);
 		},
-		status(id, signal) {
-			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}`, receipt(id), signal, void 0, "GET");
+		status(id, signal, checksumUpload = true) {
+			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}`, receipt(id), signal, void 0, "GET", void 0, requestTimeoutMs$2, checksumUpload);
 		},
 		async replace(keepWorkIds, signal) {
 			if (keepWorkIds.length === 0) throw new ApplicationError("INVALID_STATE");
@@ -10507,16 +10262,72 @@ async function perform(context, item, connection, signal) {
 	const auto = context.snapshot === true;
 	await guard();
 	if (item.settings && item.settingsConfirmed) return applySettings(item, connection, signal, guard, auto);
-	if (!item.reservation) return resolveItem(item, context.bindingId, connection, signal, auto, context.name);
-	if (!item.receipt) return observe(item, await connection.reserve(item.operationKey, item.reservation, signal), connection, signal, auto);
-	const receipt = await connection.status(item.receipt.receiptId, signal);
+	if (!item.reservation) {
+		const next = await resolveItem(item, context.bindingId, connection, signal, auto, context.name);
+		if (next.reservation) context.fresh?.set(item.workId, null);
+		return next;
+	}
+	if (!item.receipt) {
+		const reserved = await connection.reserve(item.operationKey, item.reservation, signal, context.checksumUploads !== false);
+		const next = await observe(item, reserved, connection, signal, auto);
+		if (context.fresh?.has(item.workId) && reserved.upload && next.status === "uploading") context.fresh.set(item.workId, {
+			receiptId: reserved.receiptId,
+			upload: reserved.upload
+		});
+		return next;
+	}
+	const fresh = context.fresh?.get(item.workId);
+	context.fresh?.delete(item.workId);
+	if (fresh?.receiptId === item.receipt.receiptId) return put(context, item, fresh.receiptId, fresh.upload, connection, signal, guard);
+	const receipt = await connection.status(item.receipt.receiptId, signal, context.checksumUploads !== false);
 	const observed = await observe(item, receipt, connection, signal, auto);
-	if (receipt.state !== "awaiting_upload") return observed;
+	if (receipt.state !== "awaiting_upload") return withoutUpload(observed);
 	if (!receipt.upload) throw new ApplicationError("INVALID_STATE");
+	if (item.uploadedReceiptId === receipt.receiptId) {
+		await guard();
+		try {
+			return withoutUpload(await observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto));
+		} catch (error) {
+			if (!(error instanceof JourneyRemoteError) || error.status === 401 || [
+				"settings_changed",
+				"target_conflict",
+				"work_removed"
+			].includes(error.code)) throw error;
+			return withoutUpload(item);
+		}
+	}
+	const current = await connection.resolve(item.reservation.work, signal);
+	if (current.scopeVersion !== item.reservation.expectedScopeVersion || current.accessVersion !== item.reservation.expectedAccessVersion) return renewed(item, null);
+	return put(context, item, receipt.receiptId, receipt.upload, connection, signal, guard);
+}
+/** Uploads the bytes to the receipt's signed URL and completes it. */
+async function put(context, item, receiptId, upload, connection, signal, guard) {
 	await guard();
-	await context.upload(item.artifact, receipt.upload.uploadUrl, signal);
+	await context.upload(item.artifact, upload, signal);
 	await guard();
-	return observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto);
+	try {
+		return observe(item, await connection.complete(receiptId, signal), connection, signal, context.snapshot === true);
+	} catch (error) {
+		if (upload.headers !== void 0 && error instanceof JourneyRemoteError && error.code === "bundle_mismatch") return {
+			...renewed(withoutUpload(item), null),
+			checksumUploadRefused: true
+		};
+		if (error instanceof Object) uploaded.set(error, {
+			...item,
+			uploadedReceiptId: receiptId
+		});
+		throw error;
+	}
+}
+const uploaded = /* @__PURE__ */ new WeakMap();
+/** The item to save for a failed step whose bytes were already uploaded, if any. */
+function uploadedItem(error) {
+	return error instanceof Object ? uploaded.get(error) : void 0;
+}
+function withoutUpload(item) {
+	if (item.uploadedReceiptId === void 0) return item;
+	const { uploadedReceiptId: _, ...rest } = item;
+	return rest;
 }
 /** A definite stale refusal can renew the intent; unknown outcomes always retry the same key. */
 async function stepItem(context, item, connection, signal) {
@@ -10546,31 +10357,41 @@ async function stepItem(context, item, connection, signal) {
 			status: "blocked",
 			error: "WORK_REMOVED"
 		};
-		return {
-			...item,
-			operationKey: randomUUID(),
-			reservation: null,
-			resolution: null,
-			previousReceipts: item.receipt ? [...item.previousReceipts, item.receipt] : item.previousReceipts,
-			receipt: null,
-			status: "ready",
-			error: "SETTINGS_CHANGED"
-		};
+		return renewed(item, "SETTINGS_CHANGED");
 	}
 }
+/** A fresh intent for the same Work: the old receipt is kept as history and resolve runs again. */
+function renewed(item, error) {
+	return {
+		...withoutUpload(item),
+		operationKey: randomUUID(),
+		reservation: null,
+		resolution: null,
+		previousReceipts: item.receipt ? [...item.previousReceipts, item.receipt] : item.previousReceipts,
+		receipt: null,
+		status: "ready",
+		error
+	};
+}
 const confirmedSettings = (item) => item.settings !== null && item.settingsConfirmed;
 /**
-* The Works one advance steps together. Each Work appears at most once, so its own steps stay
-* strictly ordered. Upload work comes before assessment checks, as before. A confirmed linked
-* Settings change can alter other Works' access versions, so it always steps alone.
+* The Works one advance steps together. Upload work comes before assessment checks, smallest
+* ZIP first. Completing
+* an upload advances the owner's scope version, which every resolution and reservation carries,
+* so one Work's resolve-to-complete steps never overlap another's: uploads step one Work at a
+* time (ADR 0214). Assessment checks change nothing and step up to three together; a confirmed
+* linked Settings change alters access versions, so it always steps alone.
 */
-function pickBatch(items) {
-	const uploading = items.filter((item) => ["ready", "uploading"].includes(item.status));
-	const pool = uploading.length ? uploading : items.filter((item) => item.status === "assessing");
-	const first = pool[0];
+function pickBatch(items, now = Date.now()) {
+	const uploading = items.find((item) => item.status === "uploading") ?? items.filter((item) => item.status === "ready").reduce((smallest, item) => !smallest || item.artifact.byteLength < smallest.artifact.byteLength ? item : smallest, void 0);
+	if (uploading) return [uploading];
+	const assessing = items.filter((item) => item.status === "assessing");
+	const first = assessing[0];
 	if (!first) return [];
 	if (confirmedSettings(first)) return [first];
-	return pool.filter((item) => !confirmedSettings(item)).slice(0, 3);
+	const checks = assessing.filter((item) => !confirmedSettings(item));
+	const start = Math.floor(now / 1e3) * 3 % checks.length;
+	return [...checks.slice(start), ...checks.slice(0, start)].slice(0, 3);
 }
 function isCode(error, code) {
 	return error instanceof ApplicationError && error.code === code;
@@ -10664,7 +10485,11 @@ async function advanceItems(host, signal) {
 			if (finished !== null) return finished;
 		}
 		if (!batch.length) return host.applied();
-		const results = await Promise.allSettled(batch.map((item) => stepItem(host.context(item), item, connection, signal)));
+		const checksumUploads = !send.items.some((item) => item.checksumUploadRefused);
+		const results = await Promise.allSettled(batch.map((item) => stepItem({
+			...host.context(item),
+			checksumUploads
+		}, item, connection, signal)));
 		const failures = results.flatMap((result) => result.status === "rejected" ? [result] : []);
 		if (failures.some(({ reason }) => isCode(reason, "REVISION_CONFLICT"))) return host.stale();
 		const first = failures[0];
@@ -10681,9 +10506,11 @@ async function advanceItems(host, signal) {
 				continue;
 			}
 			const cause = result.reason;
+			const progressed = uploadedItem(cause);
+			if (progressed) next.set(item.workId, progressed);
 			if (cause instanceof JourneyRemoteError && cause.status === 401 || isCode(cause, "ACCOUNT_SIGNED_OUT")) signIn = true;
 			else if (isCode(cause, "IDENTITY_REJECTED")) changed = true;
-			else if (isInterrupted(cause)) {
+			else if (isInterrupted(cause) || isTransientRefusal(cause)) {
 				host.failure("SEND_INTERRUPTED", cause);
 				error = "SEND_INTERRUPTED";
 			} else {
@@ -10717,7 +10544,7 @@ async function advanceItems(host, signal) {
 			items
 		}));
 	} catch (error) {
-		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause))) {
+		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE"))) {
 			host.failure("SEND_INTERRUPTED", error);
 			return send.error === "SEND_INTERRUPTED" ? host.applied() : host.save({
 				...send,
@@ -10791,8 +10618,9 @@ function withoutQuestions(send) {
 	};
 	return send.status === "review" ? aggregate(next) : next;
 }
-async function advanceSend(dependencies, address, signal) {
+async function advanceSend(dependencies, address, signal, chain) {
 	const snapshot = requireSend(await dependencies.storage.loadSend(address.journeyId, address.sendId));
+	if (chain) chain.revision = snapshot.send.revision;
 	if ((await dependencies.storage.loadSend(address.journeyId))?.send?.id !== snapshot.send.id) return {
 		...snapshot,
 		status: "stale"
@@ -10824,20 +10652,25 @@ async function advanceSend(dependencies, address, signal) {
 	return advanceItems({
 		send,
 		failure: dependencies.failure,
-		connect: dependencies.auth.connect,
+		connect: chain?.connect ?? dependencies.auth.connect,
 		profile: (connection, profileSignal) => prepareProfile(dependencies, snapshot, connection, profileSignal),
 		context: (item) => {
 			const binding = snapshot.journey.works.find((value) => value.id === item.workId)?.binding;
 			const retired = !item.receipt && binding?.sentBundleId === item.artifact.bundleId && binding.sentAccess === item.access;
 			return {
 				snapshot: true,
+				...chain ? { fresh: chain.fresh } : {},
 				active: async () => {
 					const current = requireSend(await dependencies.storage.loadSend(snapshot.journey.journeyId));
 					if (current.send.id !== snapshot.send.id || !sameItem(current.send.items, item) || current.send.status === "paused" || current.journey.phase === "paused") throw new ApplicationError("REVISION_CONFLICT");
 					assertScope(current.journey, current.send);
 				},
 				bindingId: binding?.subject === send.subject && !retired ? binding.bundleRecordId : void 0,
-				upload: (artifact, uploadUrl, uploadSignal) => dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, uploadUrl, uploadSignal)
+				upload: async (artifact, upload, uploadSignal) => {
+					const started = performance.now();
+					await dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, upload, uploadSignal);
+					dependencies.uploaded?.(artifact.workId, artifact.byteLength, Math.round(performance.now() - started));
+				}
 			};
 		},
 		finish: async (connection, finishSignal) => {
@@ -10881,6 +10714,14 @@ async function advanceSend(dependencies, address, signal) {
 		})
 	}, signal);
 }
+/**
+* A refusal Passport answers while it or Identity is briefly unavailable. It says nothing about
+* the Work, so the step is retried instead of blocking it (the 2026-11-01 recorded run blocked a
+* Work on one `identity_unavailable`).
+*/
+function isTransientRefusal(error) {
+	return error instanceof JourneyRemoteError && (error.status >= 500 || error.status === 429 || error.code === "identity_unavailable");
+}
 //#endregion
 //#region apps/cli/src/account/journey/decisions.ts
 function decide(item, input) {
@@ -11151,10 +10992,10 @@ function createManualUploader(dependencies) {
 				active: guard(upload, item),
 				name: item.title,
 				bindingId: bindings.find((value) => value.subject === upload.subject && value.pathHash === pathHash(item))?.bundleRecordId,
-				upload: (artifact, uploadUrl, uploadSignal) => {
+				upload: (artifact, signedUpload, uploadSignal) => {
 					const slot = upload.slots[item.workId];
 					if (slot === void 0) throw new ApplicationError("ARTIFACT_MISSING");
-					return dependencies.artifacts.upload(upload.resultId, slot, artifact, uploadUrl, uploadSignal);
+					return dependencies.artifacts.upload(upload.resultId, slot, artifact, signedUpload, uploadSignal);
 				}
 			}),
 			applied: () => ({
@@ -11224,10 +11065,10 @@ function createManualUploadArtifacts(application) {
 				})
 			};
 		},
-		async upload(resultId, slot, artifact, uploadUrl, signal) {
+		async upload(resultId, slot, artifact, upload, signal) {
 			const { row, primary } = await find(resultId, slot);
 			if (row.bundleId !== artifact.bundleId || primary.sha256 !== artifact.sha256 || primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			await putPrimary(primary, artifact.byteLength, uploadUrl, signal);
+			await putPrimary(primary, artifact.byteLength, upload, signal);
 		}
 	};
 }
@@ -12390,13 +12231,42 @@ function createJourneyFiles(storage) {
 		};
 	};
 }
+/**
+* One advance carries the Work being uploaded through its phases with one verified connection,
+* instead of one phase per panel round trip, and uploads a receipt it just resolved and reserved
+* without reading it again (ADR 0229). Each phase is still fenced and saved on its own, so Pause, a
+* revision change or a failure stops the chain at the next phase exactly as between advances.
+* The advance returns once that Work leaves its upload phases, so the next Work starts from the
+* caller's next advance as before.
+*/
+async function advanceWork(dependencies, address, signal, phases = 3) {
+	let connection;
+	const chain = {
+		fresh: /* @__PURE__ */ new Map(),
+		async connect(connectSignal) {
+			if (connection === void 0) connection = await dependencies.auth.connect(connectSignal);
+			return connection;
+		}
+	};
+	let result = await advanceSend(dependencies, address, signal, chain);
+	for (let phase = 1; phase < phases && uploading(result, chain.revision); phase += 1) result = await advanceSend(dependencies, address, signal, chain);
+	return result;
+}
+/** The phase saved progress and left its Work mid-upload, with nothing else to report. */
+function uploading(result, before) {
+	const send = result.send;
+	return result.status === "applied" && send !== null && before !== void 0 && send.revision > before && send.status === "sending" && send.error === null && pickBatch(send.items)[0]?.status === "uploading";
+}
 //#endregion
 //#region apps/cli/src/account/journey/send.ts
 function sameIds(left, right) {
 	return left.length === right.length && new Set(left).size === left.length && left.every((id) => right.includes(id));
 }
-/** Durable, bounded orchestration; native chat and panel use the same commands. */
-function createJourneySender(dependencies) {
+/**
+* Durable, bounded orchestration; native chat and panel use the same commands. One advance runs
+* at most `phases` upload phases of one Work (ADR 0229); tests pass 1 to observe each phase.
+*/
+function createJourneySender(dependencies, phases = 3) {
 	const running = /* @__PURE__ */ new Map();
 	const runKey = (address) => `${address.journeyId}:${address.sendId}`;
 	const load = async (address) => {
@@ -12481,6 +12351,20 @@ function createJourneySender(dependencies) {
 			if (result.status !== "stale") running.get(runKey(input))?.stop.abort();
 			return result;
 		},
+		/** BL-201: Cancel sign-in returns a confirmed Send that uploaded nothing to Ready to send. */
+		async withdraw(raw) {
+			const input = sendActionSchema.parse(raw);
+			const snapshot = await load(input);
+			if (!matchesAction(snapshot, input)) return saveSend(dependencies, snapshot, snapshot.send, input);
+			if (snapshot.send.status !== "sign-in" || snapshot.send.items.some((item) => item.receipt)) throw new ApplicationError("INVALID_TRANSITION");
+			const result = await saveSend(dependencies, snapshot, {
+				...snapshot.send,
+				status: "prepared",
+				confirmedAt: null
+			}, input);
+			if (result.status !== "stale") running.get(runKey(input))?.stop.abort();
+			return result;
+		},
 		async resume(raw) {
 			const input = sendActionSchema.parse(raw);
 			const snapshot = await load(input);
@@ -12495,7 +12379,7 @@ function createJourneySender(dependencies) {
 			const current = running.get(key);
 			if (current) return current.result;
 			const stop = new AbortController();
-			const result = advanceSend(dependencies, address, AbortSignal.any([signal, stop.signal])).catch(async (error) => {
+			const result = advanceWork(dependencies, address, AbortSignal.any([signal, stop.signal]), phases).catch(async (error) => {
 				if (!stop.signal.aborted || signal.aborted) throw error;
 				return {
 					...requireSend(await dependencies.storage.loadSend(address.journeyId, address.sendId)),
@@ -12512,6 +12396,10 @@ function createJourneySender(dependencies) {
 }
 //#endregion
 //#region apps/cli/src/account/journey/auth.ts
+/** An access token this close to expiry is renewed first, so a step never starts on it. */
+const renewBeforeMs = 12e4;
+const renewTimeoutMs = 3e4;
+const renewals = /* @__PURE__ */ new WeakMap();
 /** Reuses the existing device sign-in credential; a token is never returned to the panel or Agent. */
 function createJourneySendAuth(account, requestFetch) {
 	/**
@@ -12528,31 +12416,87 @@ function createJourneySendAuth(account, requestFetch) {
 			return state;
 		});
 	}
+	/** A refused access token with a refresh token is renewed on the next use instead (BL-210). */
+	async function refuse(accessToken) {
+		if (!(await account.credentials.update((value) => {
+			if (value.credential?.accessToken === accessToken && value.credential.refreshToken) value.credential = {
+				...value.credential,
+				expiresAt: account.now()
+			};
+			return value;
+		})).credential?.refreshToken) await expire(accessToken);
+	}
+	function renew(credential) {
+		const running = renewals.get(account);
+		if (running) return running;
+		const renewing = (async () => {
+			try {
+				const token = await account.identity.refresh(credential.refreshToken, AbortSignal.timeout(renewTimeoutMs));
+				if (!token) {
+					await expire(credential.accessToken);
+					return null;
+				}
+				return (await account.credentials.update((value) => {
+					if (value.credential?.refreshToken === credential.refreshToken) value.credential = {
+						...value.credential,
+						accessToken: token.accessToken,
+						refreshToken: token.refreshToken ?? credential.refreshToken,
+						scope: token.scope,
+						issuedAt: account.now(),
+						expiresAt: token.expiresAt
+					};
+					return value;
+				})).credential;
+			} finally {
+				renewals.delete(account);
+			}
+		})();
+		renewals.set(account, renewing);
+		return renewing;
+	}
 	async function current() {
 		const credential = (await account.credentials.update((value) => value)).credential;
 		if (!credential || credential.identityUrl !== account.configuration.identityUrl || credential.clientId !== account.configuration.clientId) return null;
-		if (!Number.isFinite(Date.parse(credential.expiresAt)) || Date.parse(credential.expiresAt) <= Date.parse(account.now())) {
+		const left = Date.parse(credential.expiresAt) - Date.parse(account.now());
+		if (Number.isFinite(left) && left > renewBeforeMs) return credential;
+		const { refreshToken } = credential;
+		if (!refreshToken) {
+			if (Number.isFinite(left) && left > 0) return credential;
 			await expire(credential.accessToken);
 			return null;
 		}
-		return credential;
+		try {
+			return await renew({
+				...credential,
+				refreshToken
+			});
+		} catch (error) {
+			if (Number.isFinite(left) && left > 0) return credential;
+			throw error;
+		}
 	}
 	const fetchOwner = requestFetch ?? fetch;
 	const ownerFetch = async (input, init) => {
 		const response = await fetchOwner(input, init);
 		if (response.status === 401) {
 			const header = new Headers(init?.headers).get("authorization");
-			if (header?.startsWith("Bearer ")) await expire(header.slice(7));
+			if (header?.startsWith("Bearer ")) await refuse(header.slice(7));
 		}
 		return response;
 	};
 	return { async connect(signal) {
-		const credential = await current();
+		let credential = await current();
 		if (!credential) return null;
-		const verified = await account.identity.readIdentity(credential.accessToken, signal);
+		let verified = await account.identity.readIdentity(credential.accessToken, signal);
 		if (!verified) {
-			await expire(credential.accessToken);
-			return null;
+			await refuse(credential.accessToken);
+			credential = await current();
+			if (!credential) return null;
+			verified = await account.identity.readIdentity(credential.accessToken, signal);
+			if (!verified) {
+				await expire(credential.accessToken);
+				return null;
+			}
 		}
 		if (verified.identityId !== credential.identityId) throw new ApplicationError("IDENTITY_REJECTED");
 		return createJourneyOwnerClient({
@@ -13097,6 +13041,7 @@ const deviceCodeResponse = z.object({
 });
 const tokenResponse = z.object({
 	access_token: z.string().min(1).max(4096),
+	refresh_token: z.string().min(1).max(4096).optional(),
 	token_type: z.string(),
 	expires_in: z.number().int().positive(),
 	scope: deviceProfileScopeSchema
@@ -13108,13 +13053,24 @@ const userInfoResponse = z.object({
 	picture: z.unknown().optional(),
 	profile: z.string()
 });
-function unavailable(cause) {
-	const error = new ApplicationError("IDENTITY_UNAVAILABLE");
+/**
+* `detail` names the endpoint and what failed (HTTP status, network error name, schema paths),
+* never a response value, so the authorization log can say why without exposing a token.
+*/
+function unavailable(detail, cause) {
+	const error = Object.assign(new ApplicationError("IDENTITY_UNAVAILABLE"), { detail });
 	if (cause !== void 0) error.cause = cause;
 	return error;
 }
-async function readJson(response) {
-	if (!response.body) throw unavailable();
+const issuePaths = (error) => error.issues.map((issue) => issue.path.join(".") || "(root)").join(",");
+function networkDetail(error) {
+	if (!(error instanceof Error)) return "Error";
+	const cause = error.cause;
+	const code = typeof cause === "object" && cause !== null && "code" in cause ? cause.code : null;
+	return typeof code === "string" ? `${error.name} ${code}` : error.name;
+}
+async function readJson(response, where) {
+	if (!response.body) throw unavailable(`${where} empty body`);
 	const reader = response.body.getReader();
 	const chunks = [];
 	let bytes = 0;
@@ -13126,7 +13082,7 @@ async function readJson(response) {
 			bytes += next.value.byteLength;
 			if (bytes > maximumResponseBytes) {
 				await reader.cancel().catch(() => void 0);
-				throw unavailable();
+				throw unavailable(`${where} body too large`);
 			}
 			chunks.push(next.value);
 		}
@@ -13136,7 +13092,7 @@ async function readJson(response) {
 	try {
 		return JSON.parse(Buffer.concat(chunks, bytes).toString("utf8"));
 	} catch (error) {
-		throw unavailable(error);
+		throw unavailable(`${where} invalid JSON`, error);
 	}
 }
 function verificationUrl(value, identity) {
@@ -13144,9 +13100,9 @@ function verificationUrl(value, identity) {
 	try {
 		url = new URL(value);
 	} catch (error) {
-		throw unavailable(error);
+		throw unavailable("device-code verification URL invalid", error);
 	}
-	if (!["http:", "https:"].includes(url.protocol) || url.origin !== identity.origin || url.username !== "" || url.password !== "") throw unavailable();
+	if (!["http:", "https:"].includes(url.protocol) || url.origin !== identity.origin || url.username !== "" || url.password !== "") throw unavailable("device-code verification URL outside Identity");
 	return url;
 }
 /**
@@ -13157,7 +13113,7 @@ function createIdentityDeviceClient(options) {
 	const requestFetch = options.fetch ?? fetch;
 	const now = options.now ?? Date.now;
 	const base = new URL(options.identityUrl);
-	if (!["http:", "https:"].includes(base.protocol)) throw unavailable();
+	if (!["http:", "https:"].includes(base.protocol)) throw unavailable("identity URL protocol");
 	async function send(path, init, signal) {
 		try {
 			return await requestFetch(new URL(path, base), {
@@ -13167,9 +13123,18 @@ function createIdentityDeviceClient(options) {
 			});
 		} catch (error) {
 			if (signal.aborted) throw error;
-			throw unavailable(error);
+			throw unavailable(`${path} ${networkDetail(error)}`, error);
 		}
 	}
+	function issued(token) {
+		return {
+			kind: "issued",
+			accessToken: token.access_token,
+			...token.refresh_token ? { refreshToken: token.refresh_token } : {},
+			expiresAt: new Date(now() + token.expires_in * 1e3).toISOString(),
+			scope: token.scope
+		};
+	}
 	function form(fields) {
 		return {
 			method: "POST",
@@ -13182,14 +13147,18 @@ function createIdentityDeviceClient(options) {
 	}
 	return {
 		async requestDeviceCode(signal) {
-			const response = await send("/api/auth/device/code", form({
+			let response = await send("/api/auth/device/code", form({
+				client_id: options.clientId,
+				scope: "openid profile offline_access"
+			}), signal);
+			if (response.status === 400 && errorResponse.safeParse(await readJson(response, "device-code")).data?.error === "invalid_scope") response = await send("/api/auth/device/code", form({
 				client_id: options.clientId,
 				scope: "openid profile"
 			}), signal);
 			if (response.status === 400 || response.status === 401) throw new ApplicationError("IDENTITY_REJECTED");
-			if (response.status !== 200) throw unavailable();
-			const parsed = deviceCodeResponse.safeParse(await readJson(response));
-			if (!parsed.success) throw unavailable(parsed.error);
+			if (response.status !== 200) throw unavailable(`device-code HTTP ${response.status}`);
+			const parsed = deviceCodeResponse.safeParse(await readJson(response, "device-code"));
+			if (!parsed.success) throw unavailable(`device-code schema ${issuePaths(parsed.error)}`, parsed.error);
 			const verification = verificationUrl(parsed.data.verification_uri, base);
 			const complete = verificationUrl(parsed.data.verification_uri_complete, base);
 			return {
@@ -13208,20 +13177,16 @@ function createIdentityDeviceClient(options) {
 				grant_type: deviceCodeGrantType
 			}), signal);
 			if (response.status === 200) {
-				const parsed = tokenResponse.safeParse(await readJson(response));
-				if (!parsed.success || parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable(parsed.success ? void 0 : parsed.error);
-				return {
-					kind: "issued",
-					accessToken: parsed.data.access_token,
-					expiresAt: new Date(now() + parsed.data.expires_in * 1e3).toISOString(),
-					scope: parsed.data.scope
-				};
+				const parsed = tokenResponse.safeParse(await readJson(response, "token"));
+				if (!parsed.success) throw unavailable(`token schema ${issuePaths(parsed.error)}`, parsed.error);
+				if (parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable("token type not bearer");
+				return issued(parsed.data);
 			}
 			if (response.status !== 400) {
 				if (response.status === 401) throw new ApplicationError("IDENTITY_REJECTED");
-				throw unavailable();
+				throw unavailable(`token HTTP ${response.status}`);
 			}
-			const parsed = errorResponse.safeParse(await readJson(response));
+			const parsed = errorResponse.safeParse(await readJson(response, "token"));
 			const code = parsed.success ? parsed.data.error : "";
 			if (code === "authorization_pending") return { kind: "pending" };
 			if (code === "slow_down") return { kind: "slow_down" };
@@ -13229,6 +13194,19 @@ function createIdentityDeviceClient(options) {
 			if (code === "access_denied") return { kind: "denied" };
 			throw new ApplicationError("IDENTITY_REJECTED");
 		},
+		async refresh(refreshToken, signal) {
+			const response = await send("/api/auth/oauth2/token", form({
+				client_id: options.clientId,
+				grant_type: "refresh_token",
+				refresh_token: refreshToken
+			}), signal);
+			if (response.status === 400 || response.status === 401) return null;
+			if (response.status !== 200) throw unavailable(`refresh HTTP ${response.status}`);
+			const parsed = tokenResponse.safeParse(await readJson(response, "refresh"));
+			if (!parsed.success) throw unavailable(`refresh schema ${issuePaths(parsed.error)}`, parsed.error);
+			if (parsed.data.token_type.toLowerCase() !== "bearer") throw unavailable("token type not bearer");
+			return issued(parsed.data);
+		},
 		async readIdentity(accessToken, signal) {
 			const response = await send("/api/auth/oauth2/userinfo", {
 				method: "GET",
@@ -13238,17 +13216,17 @@ function createIdentityDeviceClient(options) {
 				}
 			}, signal);
 			if (response.status === 401 || response.status === 403) return null;
-			if (response.status !== 200) throw unavailable();
-			const parsed = userInfoResponse.safeParse(await readJson(response));
-			if (!parsed.success) throw unavailable(parsed.error);
+			if (response.status !== 200) throw unavailable(`userinfo HTTP ${response.status}`);
+			const parsed = userInfoResponse.safeParse(await readJson(response, "userinfo"));
+			if (!parsed.success) throw unavailable(`userinfo schema ${issuePaths(parsed.error)}`, parsed.error);
 			const profile = accountProfileSchema.safeParse({
 				identityId: parsed.data.sub,
 				displayName: parsed.data.name,
 				avatarUrl: readAccountAvatarUrl(parsed.data.picture),
 				profileUrl: parsed.data.profile
 			});
-			if (!profile.success) throw unavailable(profile.error);
-			if (!profileUrlMatchesIdentity(profile.data.profileUrl, options.identityUrl)) throw unavailable();
+			if (!profile.success) throw unavailable(`userinfo profile ${issuePaths(profile.error)}`, profile.error);
+			if (!profileUrlMatchesIdentity(profile.data.profileUrl, options.identityUrl)) throw unavailable("userinfo profile URL outside Identity");
 			return profile.data;
 		}
 	};
@@ -13367,6 +13345,8 @@ function errorDetail(error) {
 			if (typeof code === "number" && Number.isFinite(code)) detail.code = code;
 			const syscall = data(value, "syscall");
 			if (typeof syscall === "string") detail.syscall = text(syscall);
+			const reason = data(value, "detail");
+			if (typeof reason === "string") detail.detail = text(reason);
 			const cause = data(value, "cause");
 			if (cause !== void 0) detail.cause = visit(cause, depth + 1);
 			const errors = data(value, "errors");
@@ -13849,6 +13829,61 @@ function createConfiguredPreviewPort(workerUrl, environment) {
 	}) };
 }
 //#endregion
+//#region apps/cli/src/inspection/index.ts
+/**
+* Runs each inspection scan in its own Worker so static detection never holds the host's event
+* loop, which also serves requests and store accesses (BL-199).
+*/
+function createInspectionPort(workerUrl, environment, onAnomaly) {
+	return { async *scan(request, signal, onFailure) {
+		const worker = new Worker(workerUrl, { workerData: {
+			request,
+			environment
+		} });
+		const events = [];
+		let wake;
+		const push = (event) => {
+			events.push(event);
+			wake?.();
+		};
+		const fail = (cause) => push({ error: new Error("INSPECTION_WORKER_FAILED", { cause }) });
+		worker.on("message", (message) => {
+			const parsed = workerMessageSchema.safeParse(message);
+			if (!parsed.success) return fail(parsed.error);
+			const value = parsed.data;
+			try {
+				if (value.kind === "batch") push({ batch: validateInspectionBatch(value.batch) });
+				else if (value.kind === "done") push({ done: true });
+				else if (value.kind === "anomaly") onAnomaly?.(value.event);
+				else onFailure?.(value.stage, Object.assign(new Error(value.message), value.code ? { code: value.code } : {}));
+			} catch (error) {
+				fail(error);
+			}
+		});
+		worker.on("error", fail);
+		worker.on("exit", (code) => fail(/* @__PURE__ */ new Error(`Inspection Worker exited: code=${code}`)));
+		const abort = () => worker.postMessage({ kind: "abort" });
+		if (signal.aborted) abort();
+		else signal.addEventListener("abort", abort, { once: true });
+		try {
+			for (;;) {
+				const event = events.shift();
+				if (!event) {
+					await new Promise((resolve) => wake = resolve);
+					wake = void 0;
+					continue;
+				}
+				if ("done" in event) return;
+				if ("error" in event) throw event.error;
+				yield event.batch;
+			}
+		} finally {
+			signal.removeEventListener("abort", abort);
+			await worker.terminate();
+		}
+	} };
+}
+//#endregion
 //#region apps/cli/src/bundle-directory.ts
 /** The platform cache folder; Windows has none, so its default library is the launch directory. */
 function cacheRoot(options) {
@@ -14080,7 +14115,14 @@ async function compose(options, callbacks, bundles) {
 				artifacts: createJourneySendArtifacts(journeyStorage),
 				auth: createJourneySendAuth(accountPorts),
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
-				failure: (code, cause) => diagnostics.onFailure(code, cause)
+				failure: (code, cause) => diagnostics.onFailure(code, cause),
+				uploaded: (workId, bytes, elapsedMs) => diagnostics.onActivity({
+					event: "journey.send_upload_timing",
+					at: (/* @__PURE__ */ new Date()).toISOString(),
+					operationId: workId,
+					phases: { upload: elapsedMs },
+					volumes: { bytes }
+				})
 			}),
 			manualUploader: createManualUploader({
 				storage: store.manualUpload,
@@ -14152,10 +14194,7 @@ async function compose(options, callbacks, bundles) {
 				onCreated: (path) => process.stderr.write(`Temporary file may contain unredacted originals: ${path}\n`),
 				onRetained: (path) => process.stderr.write(`Retained temporary file may contain unredacted originals: ${path}\n`)
 			}),
-			inspection: createInspectionProcessor({
-				...processing,
-				onAnomaly: producers.onInspectionAnomaly
-			}),
+			inspection: createInspectionPort(bundles?.url("inspection-worker") ?? new URL("./inspection-worker.mjs", import.meta.url), processing.environment, producers.onInspectionAnomaly),
 			systemResources,
 			onDiagnostic: diagnostics.onDiagnostic,
 			onPackagingActivity: diagnostics.onActivity,
@@ -14249,6 +14288,46 @@ async function compose(options, callbacks, bundles) {
 	}
 }
 //#endregion
+//#region apps/cli/src/agent-presence.ts
+const journey = z.object({ journeyId: z.uuid() }).loose();
+const presence = z.object({ at: z.iso.datetime() }).strict();
+const written = /* @__PURE__ */ new Map();
+/** At most one presence write per journey this often, from one CLI process. */
+const presenceIntervalMs = 5e3;
+const presencePath = (stateDir, journeyId) => join(stateDir, "presence", `${journeyId}.json`);
+/**
+* Records that the agent just called the CLI for this journey (E16). It lives beside the journey,
+* not in it, so a heartbeat never moves the journey revision; a failed write is ignored.
+*/
+async function markAgentPresence(stateDir, value) {
+	const parsed = journey.safeParse(value);
+	if (!parsed.success) return;
+	const { journeyId } = parsed.data;
+	const now = Date.now();
+	if (now - (written.get(journeyId) ?? 0) < presenceIntervalMs) return;
+	written.set(journeyId, now);
+	try {
+		const path = presencePath(stateDir, journeyId);
+		await mkdir(join(stateDir, "presence"), {
+			recursive: true,
+			mode: 448
+		});
+		const temporary = `${path}.${now}.tmp`;
+		await writeFile(temporary, JSON.stringify({ at: new Date(now).toISOString() }), { mode: 384 });
+		await rename(temporary, path);
+	} catch {
+		written.delete(journeyId);
+	}
+}
+/** When the agent last called the CLI for this journey, or null when it never did. */
+async function readAgentPresence(stateDir, journeyId) {
+	try {
+		return presence.parse(JSON.parse(await readFile(presencePath(stateDir, journeyId), "utf8")));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region apps/cli/src/commands.ts
 const sendAddress = z.object({
 	journeyId: z.uuid(),
@@ -14274,6 +14353,7 @@ const delivery = z.object({
 /** `signal` carries the process's SIGINT/SIGTERM to long procedures such as journey.prepare. */
 async function invoke(runtime, command, value, signal) {
 	const app = runtime.application;
+	markAgentPresence(runtime.stateDir, value);
 	switch (command) {
 		case "send.get": return app.journeySend?.get(sendAddress.partial({ sendId: true }).parse(value));
 		case "send.prepare": return app.journeySend?.prepare(sendPrepareSchema.parse(value));
@@ -14508,4 +14588,4 @@ async function cancelOperation(runtime, id) {
 	return readOperation(runtime, id);
 }
 //#endregion
-export { startHost as _, createRuntime as a, createRenderActivity as c, businessCommands as d, longCommands as f, createExecutionPort as g, readStateDump as h, invoke as i, helpText as l, startupFailure as m, readOperation as n, executorEventSchema as o, permissionDiagnostic as p, waitOperation as r, executorRequestSchema as s, cancelOperation as t, parseOptions as u, traceStartup as v };
+export { createExecutionPort as _, readAgentPresence as a, executorRequestSchema as c, parseOptions as d, businessCommands as f, readStateDump as g, startupFailure as h, invoke as i, createRenderActivity as l, permissionDiagnostic as m, readOperation as n, createRuntime as o, longCommands as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, helpText as u, startHost as v, traceStartup as y };