@gitroll/tacitt-cli 0.2.0 → 0.3.0

package/skills/tacitt/scripts/journey-card-values.mjs

@@ -0,0 +1,116 @@
+import { uncoveredPending } from './journey-state.mjs'
+
+const keyOf = (term) => term.key ?? JSON.stringify([term.type, term.value?.normalize('NFC')])
+const normalized = (value) => value.normalize('NFC').trim().toLowerCase()
+
+/** Examples that differ only in case, spacing, hyphens or underscores show one value. */
+export const exampleKey = (value) =>
+  value
+    .normalize('NFKC')
+    .toLowerCase()
+    .replace(/[\s_-]+/gu, '')
+const exampleLength = 80
+const clip = (value) => {
+  const points = [...value.trim()]
+  return points.length > exampleLength
+    ? `${points
+        .slice(0, exampleLength - 1)
+        .join('')
+        .trimEnd()}…`
+    : points.join('')
+}
+/** Short, distinct examples in their given order; `drop` removes values that belong elsewhere. */
+export function cardExamples(examples, drop = () => false) {
+  const seen = new Set(),
+    kept = []
+  for (const example of examples) {
+    if (typeof example !== 'string') continue
+    const key = exampleKey(example)
+    if (!key || seen.has(key) || drop(example)) continue
+    seen.add(key)
+    kept.push(clip(example))
+  }
+  return kept
+}
+
+/**
+ * Settles a card publication against the current journey before it is sent.
+ *
+ * - An appended batch submits only values that are still open: a later scan pack may have hidden
+ *   a covered value between `tasks` and `ingest`, and the CLI refuses the whole batch for it.
+ * - Every normalized value goes to one card (F4). A value the scan found as the person's own
+ *   identity (`own-identity`, or an own-identity value rule) goes to the card that asks about it,
+ *   so a Hide answer about other people cannot hide the person's own handle. Any other value
+ *   joins the first card that already covers the same value.
+ *
+ * Cards left without values are dropped; their extensions too. A new card's examples are
+ * deduplicated and shortened, and one that is not the own-identity card shows no own-identity
+ * value; when nothing is left it shows its first covered values.
+ */
+export function settleCardValues(submission, view) {
+  const terms = new Map(view.privacy.terms.map((term) => [keyOf(term), term]))
+  const valueOf = (key) => {
+    const value = terms.get(key)?.value
+    return typeof value === 'string' ? normalized(value) : `key:${key}`
+  }
+  const own = new Set(
+    [...view.privacy.terms, ...(view.valueOverrides ?? [])]
+      .filter((term) => term.type === 'own-identity' && typeof term.value === 'string')
+      .map((term) => normalized(term.value)),
+  )
+  const append = submission.mode === 'append'
+  const open = append ? new Set(uncoveredPending(view).map(keyOf)) : null
+  const proposed = new Map([
+    ...(submission.extend ?? []).map((item) => [item.cardId, item.termKeys]),
+    ...submission.cards.map((card) => [card.id, card.termKeys]),
+  ])
+  const slots = [
+    ...(append ? view.privacy.cards : []).map((card) => ({
+      id: card.id,
+      published: card.termKeys,
+      keys: [],
+    })),
+    ...submission.cards.map((card) => ({ id: card.id, published: [], keys: [] })),
+  ]
+  const ownCount = (slot) =>
+    [...slot.published, ...(proposed.get(slot.id) ?? [])].filter(
+      (key) => terms.get(key)?.type === 'own-identity',
+    ).length
+  const ownSlot = slots.reduce(
+    (best, slot) => (ownCount(slot) > (best ? ownCount(best) : 0) ? slot : best),
+    null,
+  )
+  const home = new Map()
+  for (const slot of slots)
+    for (const key of slot.published) if (!home.has(valueOf(key))) home.set(valueOf(key), slot)
+  for (const slot of slots)
+    for (const key of proposed.get(slot.id) ?? []) {
+      if (open && !open.has(key)) continue
+      const value = valueOf(key)
+      const target = (own.has(value) && ownSlot) || home.get(value) || slot
+      if (!home.has(value)) home.set(value, target)
+      target.keys.push(key)
+    }
+  const settled = new Map(slots.map((slot) => [slot.id, slot.keys]))
+  const created = new Set(submission.cards.map((card) => card.id))
+  const extend = slots
+    .filter((slot) => !created.has(slot.id) && slot.keys.length)
+    .map((slot) => ({ cardId: slot.id, termKeys: slot.keys }))
+  const { extend: _proposedExtend, ...rest } = submission
+  const examplesOf = (card, keys) => {
+    const drop = card.id === ownSlot?.id ? () => false : (example) => own.has(normalized(example))
+    const examples = cardExamples(card.examples ?? [], drop)
+    const covered = cardExamples(keys.map((key) => terms.get(key)?.value)).slice(0, 3)
+    return examples.length ? examples : covered.length ? covered : card.examples
+  }
+  return {
+    ...rest,
+    cards: submission.cards
+      .map((card) => {
+        const termKeys = settled.get(card.id) ?? []
+        return { ...card, examples: examplesOf(card, termKeys), termKeys }
+      })
+      .filter((card) => card.termKeys.length),
+    ...(extend.length ? { extend } : {}),
+  }
+}

package/skills/tacitt/scripts/journey-classification.mjs

@@ -74,9 +74,13 @@ export async function classificationEvidence(directory, manifest, view, call, li
       const root = state.roots.find((entry) => entry.key === key)
       const source = state.unknown.find((entry) => entry.rootKey === key)
       if (!root || !source) throw new Error('INVALID_EVIDENCE_ROOTS')
+      // After the known Works (E2), unresolved roots sit in the "Still being grouped" Work.
+      const workId =
+        view.works.find((work) => work.rootSessionIds?.includes(root.rootSessionId))?.id ??
+        root.workId
       const page = await call('journey.classificationSessions', {
         journeyId: view.journeyId,
-        workId: root.workId,
+        workId,
         includeProjectEvidence: true,
         projectEvidenceRootSessionIds: [root.rootSessionId],
         rootsOnly: true,
@@ -97,7 +101,7 @@ export async function classificationEvidence(directory, manifest, view, call, li
         for (let pageNumber = 0; pageNumber < 2; pageNumber++) {
           const content = await call('journey.classificationRead', {
             journeyId: view.journeyId,
-            workId: root.workId,
+            workId,
             rootSessionId: root.rootSessionId,
             ...(cursor ? { cursor } : {}),
           })

package/skills/tacitt/scripts/journey-panel-host.d.mts

@@ -0,0 +1,9 @@
+import { type ChildProcess, type SpawnOptions } from 'node:child_process'
+
+export function ensureDetachedHost(
+  cli: string[],
+  journeyId: string,
+  options?: {
+    spawnChild?: (command: string, args: string[], options: SpawnOptions) => ChildProcess
+  },
+): Promise<{ url: string; pid: number; started: boolean }>

package/skills/tacitt/scripts/journey-panel-host.mjs

@@ -0,0 +1,56 @@
+import { spawn } from 'node:child_process'
+import { windowsArgument } from './review-stream-client.mjs'
+
+/** `journey.serve --detach` waits up to 60 s for the host; leave room for the CLI's startup. */
+const detachTimeoutMs = 90_000
+
+/**
+ * ADR 0227: before the agent ends its turn at Ready to send, a detached panel host must own the
+ * panel, because some agent hosts (Codex) stop the processes of a turn when it ends. Runs the
+ * paired CLI's `journey.serve --detach`, which reuses a detached host already serving the journey
+ * and otherwise starts one. Resolves `{url, pid, started}`; `started` means the panel moved to
+ * a new URL.
+ */
+export function ensureDetachedHost(cli, journeyId, { spawnChild = spawn } = {}) {
+  const [command, ...prefix] = cli
+  const shell = process.platform === 'win32' && !/\.(exe|com)$/iu.test(command)
+  const args = [...prefix, 'journey.serve', '--detach', '--input', '-']
+  return new Promise((resolve, reject) => {
+    const fail = () => reject(new Error('PANEL_HOST_DETACH_FAILED'))
+    const child = spawnChild(command, shell ? args.map(windowsArgument) : args, {
+      stdio: ['pipe', 'pipe', 'ignore'],
+      shell,
+    })
+    let output = ''
+    const timer = setTimeout(() => child.kill(), detachTimeoutMs)
+    child.stdout.setEncoding('utf8')
+    child.stdout.on('data', (chunk) => (output += chunk))
+    child.once('error', () => {
+      clearTimeout(timer)
+      fail()
+    })
+    child.once('close', (code) => {
+      clearTimeout(timer)
+      const ready = output
+        .split('\n')
+        .flatMap((line) => {
+          try {
+            return [JSON.parse(line)]
+          } catch {
+            return []
+          }
+        })
+        .find((line) => line?.ok === true && line.event === 'ready')?.result
+      if (
+        code !== 0 ||
+        ready?.journeyId !== journeyId ||
+        typeof ready.url !== 'string' ||
+        !Number.isSafeInteger(ready.pid)
+      )
+        return fail()
+      resolve({ url: ready.url, pid: ready.pid, started: ready.reused !== true })
+    })
+    child.stdin.on('error', () => {})
+    child.stdin.end(JSON.stringify({ journeyId }))
+  })
+}

package/skills/tacitt/scripts/journey-state.mjs

@@ -65,7 +65,8 @@ export async function cardBatchOpen(run) {
   const manifest = await optional(join(active.directory, 'manifest.json'))
   if (!manifest?.batch) return false
   const receipt = await optional(join(active.directory, 'receipt.json'))
-  return !['applied', 'replayed'].includes(receipt?.status)
+  // A refused batch is retired and an emptied one finished: neither holds the next batch back.
+  return !['applied', 'replayed', 'skipped', 'rejected'].includes(receipt?.status)
 }
 /** Pending values that no published card covers yet: the input of the next card batch. */
 export function uncoveredPending(view) {
@@ -76,16 +77,21 @@ export function uncoveredPending(view) {
       !covered.has(term.key ?? JSON.stringify([term.type, term.value?.normalize('NFC')])),
   )
 }
+/**
+ * Classification tasks depend on grouping, not on scan progress: the known Works' scan keeps
+ * moving their input revision and the person may change access, so neither retires them.
+ */
 export function stageFingerprint(view, stage) {
+  const classification = stage === 'classification'
   return hash({
     snapshotId: view.snapshotId,
     guidance: view.guidanceDigest,
     works: view.works.map((work) => [
       work.id,
-      work.inputRevision,
+      classification ? null : work.inputRevision,
       work.rootSessionIds,
-      work.access,
-      stage === 'classification'
+      classification ? null : work.access,
+      classification
         ? [
             work.title,
             work.projectName,

package/skills/tacitt/scripts/journey-tasks.mjs

@@ -122,7 +122,7 @@ export async function createTasks(directory, stage, view, call, { batch = false
   for (const group of groups) {
     const instruction =
       stage === 'cards'
-        ? 'INTERNAL decision-card drafting for Main (not browser publication): return {cards:[{id,question,examples,termRefs,options:[{id,label,rule}]}]}. Use UUID card IDs. termRefs lists the supplied term refs (for example "T12"); cover every supplied ref exactly once. Ask a concise contextual retention question with exactly two options: id hide (hide the covered values) and id keep (retain the covered values). Keep their rules meaningful for final resolution. Group by broad privacy-information category and shared retention policy. Specific projects, tools, filenames and capabilities belong in examples, not separate question topics. Main alone reads the complete candidate catalog and reconciles drafts globally into 5–10 final questions for the entire journey, never more than 20. Preserve coherent decision boundaries and exact disjoint keys; batch boundaries must never become final questions. Identify affected Work names only as context. Never answer for the person.'
+        ? "INTERNAL decision-card drafting for Main (not browser publication): return {cards:[{id,question,examples,termRefs,options:[{id,label,rule}]}]}. Use UUID card IDs. termRefs lists the supplied term refs (for example \"T12\"); cover every supplied ref exactly once. Write the question, option labels, rules and any context in English whatever language the conversation uses; keep example values exactly as they appear in the source. Ask a concise contextual retention question with exactly two options: id hide (hide the covered values) and id keep (retain the covered values). Keep their rules meaningful for final resolution. Group by broad privacy-information category and shared retention policy. Specific projects, tools, filenames and capabilities belong in examples, not separate question topics. Never put the person's own identity and other people on one card: an own-identity card covers only values tied to the person's own signals (own-identity terms, the session author, local account, own handle, email or domain); when unsure whose a value is, put it on the other-people card. Common review or chat jargon (for example LGTM, PTAL, nit, WIP) and generic words are not privacy values: never use them as examples or as a question's subject, and cover their refs on the card that fits the context they came from. Examples show short values, never sentences: list each value once, ignoring case, spacing, hyphens and underscores, and cut a long value with a trailing ellipsis. Main alone reads the complete candidate catalog and reconciles drafts globally into 5–10 final questions for the entire journey, never more than 20. Preserve coherent decision boundaries and exact disjoint keys; batch boundaries must never become final questions. Identify affected Work names only as context. Never answer for the person."
         : 'Final privacy resolution: return {resolutions:[{type,value,disposition,reason}]}. Resolve every supplied term strictly by the confirmed card answer: Hide gives "hidden" and Keep gives "keep" for every covered term; never override the answer of the person with your own judgment; when the same value is also under another card answered Hide, the CLI makes it Hidden, so still resolve by the answer of this card (credentials and contact details are masked separately and never reach these tasks). Use guidance only for a term the answer does not settle. disposition MUST be exactly the string "hidden" or "keep" (the card option id "hide" means "hidden"), never pending. If rules cannot settle a value, report explicit failure instead of inventing an answer.'
     const base = stage === 'cards' ? {} : { card: { ...group.card, termKeys: undefined }, guidance }
     const dataFor = (terms) => {

package/skills/tacitt/scripts/journey.d.mts

@@ -35,6 +35,8 @@ export function runPhase(
     limit?: number
     waitMs?: number
     sleep?: (ms: number) => Promise<void>
+    /** Ensures a detached panel host at a handoff phase (ADR 0227). */
+    ensureHost?: () => Promise<{ url: string; pid: number; started: boolean }>
   },
   call: (procedure: string, input: unknown) => Promise<unknown>,
 ): Promise<Record<string, unknown>>

package/skills/tacitt/scripts/journey.mjs

@@ -3,7 +3,7 @@ import { mkdir, realpath, rm } from 'node:fs/promises'
 import { join, resolve, isAbsolute } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parseArgs } from 'node:util'
-import { main as review, withJourneyCli } from './review.mjs'
+import { blockedWorks, main as review, withJourneyCli } from './review.mjs'
 import {
   read,
   optional,
@@ -28,6 +28,7 @@ import {
   partialClassificationSubmission,
 } from './journey-consolidation.mjs'
 import { consolidateCards, cardSubmission } from './journey-card-consolidation.mjs'
+import { settleCardValues } from './journey-card-values.mjs'
 import {
   classificationProgress,
   publishClassificationProgress,
@@ -35,6 +36,7 @@ import {
 } from './journey-classification-progress.mjs'
 import { answers, createTasks } from './journey-tasks.mjs'
 import { scanTiming } from './journey-scan-timing.mjs'
+import { ensureDetachedHost } from './journey-panel-host.mjs'
 export { phaseOf, stageFingerprint } from './journey-state.mjs'
 
 async function publishCompleteClassification(manifest, view, call, proposalRevision) {
@@ -116,19 +118,22 @@ async function observeScanTiming(run, journeyId, view, start, call) {
   }
 }
 
+const packagedCount = (view) =>
+  view.works.filter(
+    (work) =>
+      work.access !== 'drop' &&
+      work.rootSessionIds.length &&
+      work.status === 'ready' &&
+      work.artifact?.revision === work.revision,
+  ).length
+
 /** Locked by withJourneyCli in production; injected transport permits deterministic crash tests. */
 /** A running journey render (panel or CLI) with packaged/selected Work counts (BL-185). */
 function packagingProgress(view) {
   if (!view.packaging) return {}
   const selected = view.works.filter((work) => work.access !== 'drop' && work.rootSessionIds.length)
   return {
-    packaging: {
-      ...view.packaging,
-      selected: selected.length,
-      packaged: selected.filter(
-        (work) => work.status === 'ready' && work.artifact?.revision === work.revision,
-      ).length,
-    },
+    packaging: { ...view.packaging, selected: selected.length, packaged: packagedCount(view) },
   }
 }
 
@@ -136,28 +141,49 @@ function packagingProgress(view) {
 export const maxAwaitMs = 540_000
 const awaitPollMs = 1000
 
+/**
+ * ADR 0227: from Ready to send the AI work is done. Packaging, upload, assessment and Passport
+ * completion run in the detached panel host (ADR 0217), so the agent ends its turn.
+ */
+const handoffPhases = new Set(['ready-to-send', 'send', 'sending'])
+
 /**
  * D0: the agent waits inside its turn for the person's next panel decision. Returns once the
  * helper phase changes (consent recorded, the last card answered, a Work moved out of Drop
- * needing a read) or a new card batch is due, else after `waitMs` with `changed: false`.
+ * needing a read), a new card batch is due or a blocked Work was Dropped or retried, else after
+ * `waitMs` with `changed: false`. A retried Work needs `journey.prepare` again.
+ *
+ * At a handoff phase it returns at once, without waiting, once a detached panel host owns the
+ * panel: `handoff` tells the agent to end its turn (ADR 0227, superseding ADR 0225's wait).
  */
-async function awaitDecision(journeyId, waitMs, call, sleep) {
+async function awaitDecision(journeyId, waitMs, call, sleep, ensureHost) {
   if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > maxAwaitMs)
     throw new Error('INVALID_ARGUMENTS')
   const started = Date.now()
   let view = await call('journey.get', { journeyId })
   const from = phaseOf(view)
+  const blockedFrom = blockedWorks(view).map((work) => work.workId)
   for (;;) {
     const phase = phaseOf(view)
     const batchDue = phase === 'browser-answers' && uncoveredPending(view).length > 0
-    if (phase !== from || batchDue || Date.now() - started >= waitMs)
+    const blocked = blockedWorks(view)
+    const settled = blockedFrom.filter((id) => !blocked.some((work) => work.workId === id))
+    const retried = settled.filter((id) =>
+      view.works.some((work) => work.id === id && work.access !== 'drop'),
+    )
+    const changed = phase !== from || batchDue || settled.length > 0
+    const handoff = handoffPhases.has(phase)
+    if (changed || handoff || Date.now() - started >= waitMs)
       return {
         command: 'await',
         from,
         phase,
-        changed: phase !== from || batchDue,
+        changed,
         waitedMs: Date.now() - started,
         revision: view.revision,
+        blockedWorks: blocked,
+        ...(retried.length ? { retriedWorks: retried, next: 'journey.prepare' } : {}),
+        ...(handoff ? { handoff: { panel: await ensureHost(), next: 'end-turn' } } : {}),
       }
     await sleep(Math.min(awaitPollMs, Math.max(0, waitMs - (Date.now() - started))))
     view = await call('journey.get', { journeyId })
@@ -165,7 +191,7 @@ async function awaitDecision(journeyId, waitMs, call, sleep) {
 }
 
 async function runPhaseCore(
-  { run, journeyId, command, stage, refresh = false, limit = 3, waitMs = 0, sleep },
+  { run, journeyId, command, stage, refresh = false, limit = 3, waitMs = 0, sleep, ensureHost },
   call,
 ) {
   if (!Number.isSafeInteger(limit) || limit < 1 || limit > 16) throw new Error('INVALID_ARGUMENTS')
@@ -175,6 +201,10 @@ async function runPhaseCore(
       waitMs,
       call,
       sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+      ensureHost ??
+        (() => {
+          throw new Error('PANEL_HOST_DETACH_FAILED')
+        }),
     )
   let view = await call('journey.get', { journeyId })
   if (command === 'scan-start')
@@ -202,6 +232,7 @@ async function runPhaseCore(
       revision: view.revision,
       readingComplete: view.readingComplete,
       pending: activeTerms(view).filter((term) => term.disposition === 'pending').length,
+      blockedWorks: blockedWorks(view),
       answersRevision: view.privacy.answersRevision,
       ...packagingProgress(view),
       coldElapsedMs,
@@ -224,14 +255,22 @@ async function runPhaseCore(
     const recovery = await recoverWrites(active.directory, manifest, call)
     // A failed transport leaves the exact pending request intact and never reaches refresh.
     if (recovery.recovered) view = await call('journey.get', { journeyId })
-    if (recovery.stale && (!refresh || command !== 'tasks')) throw new Error('REVISION_CONFLICT')
-    if (recovery.rejected && !(refresh && command === 'tasks')) {
+    // Only scan progress refused a classification-bound proposal: it is still current (ADR 0225).
+    if (
+      recovery.stale &&
+      (!refresh || command !== 'tasks') &&
+      !(stage === 'classification' && classificationBound(manifest, view))
+    )
+      throw new Error('REVISION_CONFLICT')
+    // A refused card batch is retired: the next `tasks` drafts the current Pending set.
+    if (recovery.rejected && !(command === 'tasks' && (refresh || manifest.batch))) {
       const error = new Error(recovery.rejected)
       error.code = recovery.rejected
       throw error
     }
     if (recovery.completed === recovery.total && !recovery.stale && command === 'ingest') {
-      if (stage === 'classification' && manifest.consolidation)
+      // After the known Works, scans keep moving the revision and Works show grouping (E2).
+      if (stage === 'classification' && manifest.consolidation && !manifest.partial)
         await publishCompleteClassification(
           manifest,
           view,
@@ -250,15 +289,15 @@ async function runPhaseCore(
     throw new Error('STAGE_NOT_READY')
   if (consolidationRefresh && (await optional(join(active?.directory ?? run, 'receipt.json'))))
     throw new Error('CLASSIFICATION_ALREADY_SUBMITTED')
-  // A card batch (D3) whose append was accepted is finished: the next `tasks` starts another.
-  const batchDone =
-    stage === 'cards' &&
-    manifest?.batch &&
-    ['applied', 'replayed'].includes(
-      (await optional(join(active.directory, 'receipt.json')))?.status,
-    )
-  if (batchDone && command !== 'tasks') return { stage, status: 'applied', batchDone: true }
-  if (batchDone) manifest = null
+  // A card batch (D3) whose append was accepted, or had no open value left, is finished; one
+  // the CLI refused is retired. Either way the next `tasks` starts another.
+  const batchReceipt =
+    stage === 'cards' && manifest?.batch
+      ? (await optional(join(active.directory, 'receipt.json')))?.status
+      : undefined
+  const batchDone = ['applied', 'replayed', 'skipped'].includes(batchReceipt)
+  if (batchDone && command !== 'tasks') return { stage, status: batchReceipt, batchDone: true }
+  if (batchDone || batchReceipt === 'rejected') manifest = null
   const fingerprint = stageFingerprint(view, stage)
   if (manifest?.resolutionBatches && !refresh)
     await assertResolutionFresh(active.directory, manifest, view)
@@ -277,10 +316,11 @@ async function runPhaseCore(
     const phase = phaseOf(view)
     const revisingCards =
       stage === 'cards' && refresh && ['browser-answers', 'answers-confirmation'].includes(phase)
-    // Batches start while reading continues and after earlier batches (D3).
+    // Batches start while reading continues and after earlier batches (D3); while reading
+    // continues there is no deck to replace, so `--refresh` also starts a batch.
     const cardBatch =
       stage === 'cards' &&
-      !refresh &&
+      (!refresh || phase === 'scan') &&
       view.scope.status === 'confirmed' &&
       !['paused', 'sending', 'completed'].includes(phase) &&
       uncoveredPending(view).length > 0
@@ -335,6 +375,10 @@ async function runPhaseCore(
       fingerprint,
       tasks: stage === 'classification' ? [] : await createTasks(directory, stage, view, call),
       answersRevision: view.privacy.answersRevision,
+      // Refreshed after the known Works (E2): the complete proposal stays bound to classification.
+      ...(stage === 'classification' && grouping(view)
+        ? { partial: { status: 'applied', revision: view.classificationRevision } }
+        : {}),
     }
     await save(join(directory, 'manifest.json'), manifest)
     await save(activePath, { directory })
@@ -434,36 +478,50 @@ async function runPhaseCore(
   }
   const key = stage === 'classification' ? 'items' : stage === 'cards' ? 'cards' : 'resolutions'
   const tasks = stage === 'classification' ? [manifest.consolidation] : manifest.tasks
-  const request = {
-    journeyId,
-    expectedRevision: view.revision,
-    idempotencyKey: randomUUID(),
-    // After the known Works, scans keep moving the revision: bind to the classification (E2).
-    ...(stage === 'classification' && manifest.partial
-      ? { expectedClassificationRevision: manifest.partial.revision }
-      : {}),
-    ...(stage === 'classification'
-      ? { [key]: await classificationSubmission(manifest, view) }
-      : stage === 'cards'
-        ? await cardSubmission(manifest)
-        : { [key]: await answers(tasks, key) }),
-    ...(stage === 'resolution' ? { answersRevision: manifest.answersRevision } : {}),
+  // Later scan packs may hide covered values between `tasks` and `ingest`: submit only what is
+  // still open, and give every value one card (F4).
+  const cards = stage === 'cards' ? settleCardValues(await cardSubmission(manifest), view) : null
+  if (cards && manifest.batch && !cards.cards.length && !cards.extend?.length) {
+    await save(join(directory, 'receipt.json'), { status: 'skipped' })
+    return { stage, status: 'skipped', batchDone: true }
   }
-  await save(join(directory, 'request.json'), request)
   let result
-  try {
-    result = await call(procedureFor(stage), request)
-    await save(join(directory, 'receipt.json'), {
-      status: result.status,
-      revision: result.state?.revision,
-    })
-  } catch (error) {
-    if (definiteWriteRejection(error))
+  for (let attempt = 0; ; attempt++) {
+    const request = {
+      journeyId,
+      expectedRevision: view.revision,
+      idempotencyKey: randomUUID(),
+      // After the known Works, scans keep moving the revision: bind to the classification (E2).
+      ...(stage === 'classification' && manifest.partial
+        ? { expectedClassificationRevision: manifest.partial.revision }
+        : {}),
+      ...(stage === 'classification'
+        ? { [key]: await classificationSubmission(manifest, view) }
+        : stage === 'cards'
+          ? cards
+          : { [key]: await answers(tasks, key) }),
+      ...(stage === 'resolution' ? { answersRevision: manifest.answersRevision } : {}),
+    }
+    await save(join(directory, 'request.json'), request)
+    try {
+      result = await call(procedureFor(stage), request)
       await save(join(directory, 'receipt.json'), {
-        status: 'rejected',
-        code: error.code,
+        status: result.status,
+        revision: result.state?.revision,
       })
-    throw error
+    } catch (error) {
+      if (definiteWriteRejection(error))
+        await save(join(directory, 'receipt.json'), {
+          status: 'rejected',
+          code: error.code,
+        })
+      throw error
+    }
+    if (result.status !== 'stale' || stage !== 'classification' || attempt >= boundRetries) break
+    // A scan write between the CLI's read and its commit refuses a still-current proposal
+    // (ADR 0225): submit it again against the current revision.
+    view = await call('journey.get', { journeyId })
+    if (!classificationBound(manifest, view)) break
   }
   if (result.status === 'stale') throw new Error('REVISION_CONFLICT')
   if (stage === 'classification' && !manifest.partial) {
@@ -476,6 +534,14 @@ async function runPhaseCore(
 /** Classification published known Works and is still grouping the remaining roots (E2). */
 const grouping = (view) => view.works.some((work) => work.placement === 'classifying')
 
+/** The complete proposal binds to the classification it replaces, not to scan progress (E2). */
+const classificationBound = (manifest, view) =>
+  Boolean(manifest.partial) &&
+  view.classificationRevision === manifest.partial.revision &&
+  grouping(view)
+/** Submissions of an unchanged classification-bound proposal after a stale answer. */
+const boundRetries = 3
+
 /**
  * E2: publishes known-project Works while unresolved roots are still being grouped, so their
  * scan can start. Its request and receipt are kept apart from the final proposal's.
@@ -575,6 +641,7 @@ export async function main(argv) {
         refresh: values.refresh,
         limit: values.limit === undefined ? 3 : Number(values.limit),
         waitMs: values['wait-ms'] === undefined ? 300_000 : Number(values['wait-ms']),
+        ensureHost: () => ensureDetachedHost(config.cli, config.journeyId),
       },
       call,
     ),

package/skills/tacitt/scripts/review-stream-client.mjs

@@ -160,7 +160,7 @@ export function startReviewStream(
   return current
 }
 
-function windowsArgument(value) {
+export function windowsArgument(value) {
   return /^[\w./:@=+-]+$/u.test(value) ? value : `"${value.replaceAll('"', '""')}"`
 }