@gitroll/tacitt-cli 0.2.0 → 0.4.0

package/dist/{query-BA0XCwnR.mjs → query-ByD0Rp_o.mjs}

@@ -1,10 +1,10 @@
-import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, E as prepareCollectionProduction, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as createCleanup, _ as readStaticSessionMasks, a as scanReviewFields, at as windowsAclCodes, c as readSessionScanRecords, et as makePrivateDirectory, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as isWindowsAclFailure, j as readCollectionIndex, k as renderJobDigest, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as restrictToOwner, o as createWorkPieces, p as openConfiguredUpload, r as prepareSessionScans, rt as windowsOwnerOnly, s as readSessionScanFields, t as preparedScanConfiguration, tt as openPrivateFile, v as staticSessionJobs, w as createCollectionArtifacts, y as writeLogicalJourneyBase, z as parallelismLimits } from "./src-k0Ya1Bri.mjs";
-import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey, zt as filterInventoryByPeriod } from "./locate-U3-nkird.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-B5SArpVY.mjs";
-import { $n as reviewRepairResourceSchema, $t as journeyPolicyRespondSchema, A as createAccount, Ar as hasCurrentStaticReview, At as sendReplaceResultSchema, B as createApplication, Bn as confirmedHideKinds, C as bReviewScope, Cn as confirmedHideAdditions, Cr as journeyClassificationSessionsSchema, Ct as sendActionSchema, D as reviewBatchReuse, Dr as nativeEventsSchema, Dt as journeySendSchema, E as rebindReviewSubmit, Er as privacyDecisionDigest, Et as sendStartSchema, F as readAccountAvatarUrl, Fr as isClassifying, Ft as obsoleteJourney, Gr as journeyRenderSchema, Gt as journeyContextQuerySchema, H as inspectionStartSchema, Hr as journeyFindingsSchema, I as storedCredentialSchema, In as bTermMatcher, Ir as isReadingComplete, Jr as selectionBatchSchema, K as inspectionQuerySchema, Kn as retireWorkDescription, Kr as commandSchema, Lr as isSelectedWork, M as deviceAuthorizationSchema, Mt as sendSettingsSchema, N as deviceProfileScopeSchema, Nr as staticSessionResourceSchema, O as guardedFindingText, On as termHideAdditions, Or as nativeGetSchema, Ot as sendArtifactSchema, P as profileUrlMatchesIdentity, Pr as hasCompleteWorkDescription, Pt as currentJourneyAdapters, Qn as reviewRepairInputSchema, Qr as stateSchema, Qt as searchScopeDigest, Rn as confirmedHideGroupIds, S as isGenericPublicTerm, St as replaceSensitiveTermsSchema, T as rebindReviewOverlay, Tn as readConfirmedHideChange, Tr as assertJourneyPrivacyReady, Tt as sendPrepareSchema, U as validateInspectionBatch, Un as journeyConfirmedHides, Ur as journeyPreviewSchema, Ut as journeyReviewStorageQuerySchema, V as inspectionCancelSchema, Vr as journeyFindingImpactSchema, Vt as applyClassification, Wn as maskedHitsStale, Wr as journeyRenderInputSchema, Wt as reviewCompileSchema, Xn as reviewCandidateInputSchema, Xt as journeySearchResultSchema, Yn as workCorrectionBinding, Yr as selectionSchema, Zn as reviewCandidateResourceSchema, Zr as producerVersion, _ as hideScopeDigest, _t as manualUploadStartSchema, a as locateTermEvidence, ai as selectFrozenConfiguration, at as appendSensitiveTerms, bt as maximumTermsFileBytes, c as bRereadDigest, cr as scanGitSeedsId, d as newJourneyWork, dr as scanExclusionResourceSchema, dt as validateFailureLocation, ei as recommendParallelism, fn as sessionRereadInputSchema, ft as manualUploadActionSchema, g as activeJourneyTerms, gt as manualUploadSchema, h as splitSelectorValues, hn as sessionReviewQuerySchema, ht as manualUploadPrepareSchema, i as scanBatchEquivalenceDigest, ii as freezeConfiguration, in as journeyPlaceSchema, j as accountProfileSchema, jr as staticReviewDigest, jt as sendResolutionSchema, k as staticallyHiddenFindings, kr as nativeRespondSchema, kt as sendReceiptSchema, l as reconcileBSession, ln as sessionReconcileInputSchema, lr as scanGitSeedsResource, lt as artifactFailureDetailSchema, m as selectedValueMembers, mn as sessionReviewInputSchema, mr as journeyInventoryQuerySchema, mt as manualUploadChoiceSchema, n as retireScanGeneration, nt as settingsQuerySchema, o as validateBCrossSegmentReview, on as reviewAttemptResourceSchema, or as scanPreparationDigest, qn as workDecisionDigest, qr as packageCommandSchema, r as scanBatchContextDigest, ri as defaultScopedSettings, rr as planBRepair, rt as readWorkspaceOutcomes, s as bCrossSegmentReviewSchema, sr as scanSessionResourceSchema, t as resetWorkScan, tn as journeyResourceQuerySchema, tr as bReviewDigest, tt as settingsBatchSchema, u as reconstructBFields, ur as verifiedScanGitSeeds, ut as resolveFailureLocation, vn as sessionUsefulnessInputSchema, vr as emptyPreparationFacts, w as rebindReviewAlignment, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, y as changeJourney, yt as emptyTermsRevision, zr as withReadingProgress } from "./src-CC95LYYp.mjs";
-import { $ as schemaVersion, A as inspectionQuerySchema$1, B as privateReviewHash, C as loadAuthenticatedReview, D as sessionUsefulnessRecommendation, E as aggregateUsefulness, F as reuseQuerySchema, G as initializeAndClaim, H as createJourneyPayloadFiles, I as batchQuery, J as withDatabase, K as ownership, L as isPrivateResourceKind, M as sameCandidateRequest, N as validateCandidateAttempt, O as sessionQuery, P as validateUnitCandidate, Q as checkVersion, R as privateResourceHeader, S as loadAcceptedReview, T as loadPrivateResource, U as validateBatchBody, V as batchHeader, W as requireActiveBatch, X as readStoredState, Y as readBundleDirectory, Z as validateState, _ as loadRereadBodies, _t as isSqliteCorruption, a as decodeError, at as inspectStateFiles, b as validateSessionReconciliation, c as dropsAnchor, ct as readResetMarker, d as parseDelivery, dt as syncDirectory, et as beginReset, f as validateCandidate, ft as withStateSnapshot, g as loadReconciliation, gt as isCoordinationBusy, h as loadPreparedBodies, ht as errorCode$1, i as createExecutor, it as hasResetMarker, j as evaluateUnitEvidence, k as resourceSelectionQuerySchema, l as replySchema, lt as recheckPrivatePath, m as loadPreparation, mt as StoreError, n as releaseInheritedHeapFlags, nt as databaseName, o as ProtocolError, ot as present, p as loadStatus, pt as withFileCheckTimings, q as validateDatabase, r as storeHeapLimits, rt as finishReset, s as allowedReplies, st as privatePath, tt as createDatabaseFile, u as operations, ut as stateDirectory, v as loadSessionBodies, w as loadBatch, x as validateSessionBindings, y as validatePreparationSelection, z as termReuseQuerySchema } from "./heap-BHcvxWCw.mjs";
-import { a as writeJourneyOutput, c as mergeHideIndexTokens, l as packRenderHideIndex, o as createHideIndexTokens, s as hideIndexTexts, t as journeyOutputJob } from "./job-J3NFw3MH.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-B8DAiQ6Z.mjs";
+import { A as runConfiguredSessionJob, C as readConfiguredSearchFields, D as captureLogicalJourneySources, F as sessionWorkerFailure, G as staticMaskCategory, H as readLogicalJourneyFinalMasks, I as privateCollectionDirectory, K as readWorkspacePair, L as defaultParallelism, M as parseCollectionWorkspaceSummary, N as createSharedSessionPool, O as capturedJourneyScope, P as SessionWorkerError, Q as createCleanup, R as gitSeedsProvider, S as readOriginalSearchFields, T as checkReusableBundle, U as readConfiguredOutputInfo, V as privateJourneyDirectory, W as processJourneyMetadataFields, X as createTemporary, Z as removeNamedTemporarySpools, _ as readStaticSessionMasks, a as scanReviewFields, at as isWindowsAclFailure, c as readSessionScanRecords, g as processJourneyMetadata, h as readCapturedOriginalRows, i as buildWorkScanBatches, it as windowsOwnerOnly, j as readCollectionIndex, l as scanPreparedSession, n as verifyPreparedSessionSources, nt as openPrivateFile, o as createWorkPieces, ot as windowsAclCodes, p as openConfiguredUpload, r as prepareSessionScans, rt as restrictToOwner, s as readSessionScanFields, t as preparedScanConfiguration, tt as makePrivateDirectory, v as staticSessionJobs, w as createCollectionArtifacts, z as parallelismLimits } from "./src-CmP73EcD.mjs";
+import { Bt as sessionPeriodSchema, Dn as entityDictionaryVersion, F as bClassificationKey, Fn as frameRecords, Ft as termTypeInfo, Gt as safeField, H as codePointLength, Ht as ApplicationError, Jt as reviewFamilies, K as utf16Offset, N as bUnitFragments, Ot as privacyTermKey, Qn as admitGitName, T as bLiteralTerms, Ut as UnfinishedJourneyError, V as bDigest, Wt as safeCode, Xn as createEntityMatcher, Zn as admitCustomTerm, Zt as observeSource, b as validateBReview, c as textDigest, h as reviewFindingsDigest, ht as journeyDescribeSchema, jt as reviewTermsInputSchema, l as validateReview, mn as currentDetectorVersion, n as compileBFindings, r as reviewBatchChunks, s as reviewSubmitSchema, t as locateTerms, yn as createStaticProcessor, z as bAnchorKey } from "./locate-U3-nkird.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-DES7hBAP.mjs";
+import { $ as settingsQuerySchema, $r as packageCommandSchema, A as deviceProfileScopeSchema, B as validateInspectionBatch, Bn as journeyConfirmedHides, Br as hasCompleteWorkDescription, Bt as newJourneyWork, C as rebindReviewSubmit, Cr as privacyDecisionDigest, Ct as sendStartSchema, D as createAccount, Dr as hasCurrentStaticReview, E as staticallyHiddenFindings, Er as nativeRespondSchema, Et as obsoleteJourney, Fn as confirmedHideGroupIds, Fr as sendArtifactSchema, Gr as withReadingProgress, Hr as isReadingComplete, Ht as journeyContextQuerySchema, Ir as sendReceiptSchema, Jn as reviewCandidateResourceSchema, Jr as journeyFindingsSchema, Kn as workCorrectionBinding, L as createApplication, Ln as confirmedHideKinds, Lr as sendReplaceResultSchema, Lt as classificationPartition, M as readAccountAvatarUrl, Mr as agentSourceSchema, Mt as applyClassification, N as storedCredentialSchema, Nn as bTermMatcher, Nr as agentSourcesSchema, O as accountProfileSchema, Or as staticReviewDigest, Pr as journeySendSchema, Pt as journeyReviewStorageQuerySchema, Q as settingsBatchSchema, Qn as bReviewDigest, Qr as commandSchema, Qt as journeyResourceQuerySchema, R as inspectionCancelSchema, Rr as sendResolutionSchema, Rt as classificationWorks, S as rebindReviewOverlay, Sn as readConfirmedHideChange, Sr as assertJourneyPrivacyReady, St as sendPrepareSchema, T as guardedFindingText, Tn as termHideAdditions, Tr as nativeGetSchema, Tt as currentJourneyAdapters, U as inspectionQuerySchema, Un as retireWorkDescription, Ur as isSelectedWork, Vn as maskedHitsStale, Vr as isClassifying, Vt as reviewCompileSchema, Wn as workDecisionDigest, Xn as reviewRepairResourceSchema, Xr as journeyRenderInputSchema, Xt as journeyPolicyRespondSchema, Yn as reviewRepairInputSchema, Yr as journeyPreviewSchema, Yt as searchScopeDigest, Zr as journeyRenderSchema, _t as maximumTermsFileBytes, a as bCrossSegmentReviewSchema, ar as scanGitSeedsId, b as bReviewScope, bn as confirmedHideAdditions, br as journeyClassificationSessionsSchema, bt as sendActionSchema, c as reconstructBFields, cr as scanExclusionResourceSchema, ct as validateFailureLocation, d as selectedValueMembers, dn as sessionReviewInputSchema, dr as journeyInventoryQuerySchema, dt as manualUploadChoiceSchema, ei as selectionBatchSchema, er as planBRepair, et as readWorkspaceOutcomes, f as splitSelectorValues, fn as sessionReviewQuerySchema, ft as manualUploadPrepareSchema, g as changeJourney, gt as emptyTermsRevision, hn as sessionUsefulnessInputSchema, hr as emptyPreparationFacts, i as validateBCrossSegmentReview, ii as stateSchema, ir as scanSessionResourceSchema, j as profileUrlMatchesIdentity, k as deviceAuthorizationSchema, ln as sessionRereadInputSchema, lt as manualUploadActionSchema, m as hideScopeDigest, mt as manualUploadStartSchema, n as scanBatchEquivalenceDigest, nt as appendSensitiveTerms, o as bRereadDigest, oi as recommendParallelism, on as sessionReconcileInputSchema, or as scanGitSeedsResource, ot as artifactFailureDetailSchema, p as activeJourneyTerms, pt as manualUploadSchema, qn as reviewCandidateInputSchema, qr as journeyFindingImpactSchema, qt as journeySearchResultSchema, r as locateTermEvidence, ri as producerVersion, rn as reviewAttemptResourceSchema, rr as scanPreparationDigest, s as reconcileBSession, sr as verifiedScanGitSeeds, st as resolveFailureLocation, t as scanBatchContextDigest, ti as selectionSchema, tn as journeyPlaceSchema, vt as normalizeSensitiveTerms, w as reviewBatchReuse, wr as nativeEventsSchema, x as rebindReviewAlignment, xt as sendChoiceSchema, y as isGenericPublicTerm, yt as replaceSensitiveTermsSchema, z as inspectionStartSchema, zr as sendSettingsSchema, zt as retireScanGeneration } from "./src-DNn7SifS.mjs";
+import { $ as checkVersion, A as resourceSelectionQuerySchema, B as termReuseQuerySchema, C as loadAcceptedReview, D as aggregateUsefulness, E as loadPrivateResource, F as validateUnitCandidate, G as requireActiveBatch, H as batchHeader, I as reuseQuerySchema, J as validateDatabase, K as initializeAndClaim, L as batchQuery, M as evaluateUnitEvidence, N as sameCandidateRequest, O as sessionUsefulnessRecommendation, P as validateCandidateAttempt, Q as validateState, R as isPrivateResourceKind, S as validateSessionBindings, T as loadBatch, U as createJourneyPayloadFiles, V as privateReviewHash, W as validateBatchBody, X as readBundleDirectory, Y as withDatabase, Z as readStoredState, _ as loadReconciliation, _t as isCoordinationBusy, a as decodeError, at as hasResetMarker, b as validatePreparationSelection, c as dropsAnchor, ct as privatePath, d as parseDelivery, dt as stateDirectory, et as schemaVersion, f as validateCandidate, ft as syncDirectory, g as loadPreparedBodies, gt as errorCode$1, h as loadPreparation, ht as StoreError, i as createExecutor, it as finishReset, j as inspectionQuerySchema$1, k as sessionQuery, l as replySchema, lt as readResetMarker, m as loadStatus, mt as withFileCheckTimings, n as releaseInheritedHeapFlags, nt as createDatabaseFile, o as ProtocolError, ot as inspectStateFiles, p as classificationJourneyCommit, pt as withStateSnapshot, q as ownership, r as storeHeapLimits, rt as databaseName, s as allowedReplies, st as present, tt as beginReset, u as operations, ut as recheckPrivatePath, v as loadRereadBodies, vt as isSqliteCorruption, w as loadAuthenticatedReview, x as validateSessionReconciliation, y as loadSessionBodies, z as privateResourceHeader } from "./heap-BaTNC9kf.mjs";
+import { _ as staticBaseProduction, a as writeJourneyOutput, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as prepareSourcePlan, y as workApproval } from "./job-DrcpSL_9.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-CQRWVUWR.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -651,6 +651,7 @@ const operation = z.enum([
 	"journey.terms.select-aliases",
 	"journey.commit",
 	"journey.commit.checked",
+	"journey.classification.commit",
 	"journey.events",
 	"journey.inventory",
 	"journey.preparation.progress",
@@ -853,7 +854,11 @@ const nativePanelRespondSchema = z.object({
 			remember: z.boolean().optional(),
 			excludedTermKeys: z.array(z.string().min(1)).max(2e4).optional()
 		}).strict(),
-		z.object({ kind: z.literal("package-confirm") }).strict()
+		z.object({ kind: z.literal("package-confirm") }).strict(),
+		z.object({
+			kind: z.literal("retry-work"),
+			workId: z.uuid()
+		}).strict()
 	])
 }).strict();
 function createRouter(application, account, stopping, delivery, nativeInspection, agentPresence) {
@@ -944,6 +949,7 @@ function createRouter(application, account, stopping, delivery, nativeInspection
 			cardsRead: t.procedure.input(nativeGetSchema.required()).query(({ input }) => native().cardsRead(input)),
 			files: t.procedure.input(journeyRenderSchema).query(({ input, signal }) => native().files(input, signal)),
 			searchResult: t.procedure.input(nativeGetSchema.required()).query(({ input }) => native().searchResult(input)),
+			prepare: t.procedure.input(nativeGetSchema.required()).mutation(({ input }) => native().prepare(input, stopping)),
 			render: t.procedure.input(journeyRenderInputSchema).mutation(({ input, signal }) => native().render(input, signal)),
 			findings: t.procedure.input(journeyFindingsSchema).query(({ input, signal }) => native().findings(input, signal)),
 			findingImpact: t.procedure.input(journeyFindingImpactSchema).query(({ input, signal }) => native().findingImpact(input, signal)),
@@ -4722,6 +4728,19 @@ function createStagedJourney(access, root, databaseId) {
 				});
 			});
 		},
+		/** BL-216: as `commit`, for a proposal the store applies to its current state. */
+		commitClassification(input) {
+			return access.staged(async (leg, signal) => {
+				const first = await leg.run("journey.classification.commit", input);
+				if (first.status !== "hide-delta") return first;
+				const key = await files.hideKey(first.state.journeyId, signal);
+				const delta = await readConfirmedHideChange({ journeyTerms: (query) => leg.run("journey.terms.read", query) }, key, first.state, first.next);
+				return leg.run("journey.commit", {
+					...classificationJourneyCommit(input, first.next, first.state.revision),
+					confirmedHideDelta: delta
+				});
+			});
+		},
 		resources: createStagedResources(access, files, (input) => inspection.protectedBase(input)),
 		saveResource: createStagedResourceSave(access, files),
 		async putBatch(batch) {
@@ -4996,6 +5015,7 @@ async function openStore(options, backupObsolete) {
 			acknowledgeSessionUsefulness: (input) => stagedJourney.acknowledgeSessionUsefulness(input),
 			current: (journeyId) => access.run("journey.current", journeyId ? { journeyId } : {}),
 			commit: (input) => stagedJourney.commit(input),
+			commitClassification: (input) => stagedJourney.commitClassification(input),
 			hideIndexKey: (journeyId) => stagedJourney.hideIndexKey(journeyId),
 			recordTerms: (input) => stagedJourney.recordTerms(input),
 			journeyTerms: (input) => stagedJourney.journeyTerms(input),
@@ -5566,7 +5586,8 @@ ${Array.from(businessCommands).join("\n")}
 Business commands invoke the shared Application directly without an HTTP server.
 journey.serve starts a focused confirmation host, emits JSON readiness, and waits until stopped.
 journey.serve --detach starts that host in its own process, prints its readiness with the host's
-pid, and exits; stop the host with that pid.
+pid, and exits; stop the host with that pid. A detached host already serving the journey is
+reused and reported with reused: true.
 It does not discover sessions or open a browser. The agent opens its private URL in the right pane.
 Workflow mutations require protocolVersion, runId and expectedRevision in JSON input.
 Long commands emit the operation ID immediately as NDJSON, then wait up to 30000 ms.
@@ -5775,105 +5796,6 @@ function createJourneyFindings(storage) {
 	};
 }
 //#endregion
-//#region apps/cli/src/journey/plan.ts
-async function prepareSourcePlan(storage, harnesses, journeyId, sensitiveTerms, signal, period = {}) {
-	const saved = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	}))[0];
-	if (saved?.kind === "plan") return saved;
-	const discovered = await harnesses.discover(signal);
-	if (!discovered.complete) throw new ApplicationError("SCOPE_NOT_READY");
-	const inventory = filterInventoryByPeriod(discovered, period);
-	if (inventory.sessions.length === 0) throw new ApplicationError("INVALID_SELECTION");
-	const families = reviewFamilies(inventory);
-	const defaults = defaultScopedSettings();
-	const settings = {
-		...defaults,
-		overall: {
-			...defaults.overall,
-			cleanup: {
-				ref: {
-					id: "native-evidence",
-					version: "2"
-				},
-				options: { assessedSessionsOnly: true }
-			}
-		},
-		workspaces: Object.fromEntries(inventory.workspaces.map((work) => [work.id, {
-			parameters: {
-				"screened-identifiers": { enabled: false },
-				"ip-addresses": { enabled: false },
-				hostnames: { enabled: false },
-				"cloud-resources": { enabled: false },
-				"mac-addresses": { enabled: false },
-				"public-key-containers": { enabled: false },
-				"geographic-coordinates": { enabled: false },
-				urls: { enabled: false },
-				"filesystem-paths": { mode: "identity-roots" }
-			},
-			optionalSteps: { "phone-numbers": true }
-		}]))
-	};
-	const configuration = freezeConfiguration(settings, inventory.sessions.flatMap((session) => {
-		const owner = families.owners.get(session.id);
-		return owner ? [{
-			sessionId: session.id,
-			workspaceId: session.workspaceId,
-			settingsOwner: {
-				sessionId: owner.id,
-				workspaceId: owner.workspaceId
-			}
-		}] : [];
-	}));
-	const resource = {
-		kind: "plan",
-		journeyId,
-		approval: {
-			runId: journeyId,
-			revision: 0,
-			approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			inventory,
-			sourceChangePolicy: "fail",
-			treatment: {
-				kind: "configured",
-				configuration,
-				dictionaryRevision: sensitiveTerms.revision
-			}
-		},
-		replacementKey: randomBytes(32).toString("hex"),
-		sensitiveTerms: {
-			revision: sensitiveTerms.revision,
-			terms: [...sensitiveTerms.terms]
-		}
-	};
-	await storage.saveResource(resource);
-	return resource;
-}
-function workApproval(approval, rootIds) {
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("PROCESSING_PLAN_UNAVAILABLE");
-	const families = reviewFamilies(approval.inventory);
-	const ids = new Set(rootIds.flatMap((id) => {
-		const members = families.members.get(id);
-		if (!members) throw new ApplicationError("UNKNOWN_ITEM");
-		return members.map((session) => session.id);
-	}));
-	const sessions = approval.inventory.sessions.filter((session) => ids.has(session.id));
-	const workspaces = new Set(sessions.map((session) => session.workspaceId));
-	return {
-		...approval,
-		inventory: {
-			...approval.inventory,
-			sessions,
-			workspaces: approval.inventory.workspaces.filter((workspace) => workspaces.has(workspace.id))
-		},
-		treatment: {
-			...approval.treatment,
-			configuration: selectFrozenConfiguration(approval.treatment.configuration, ids)
-		}
-	};
-}
-//#endregion
 //#region apps/cli/src/journey/metadata/processing.ts
 /** Load the frozen plan and active terms once; each Work then resolves its own policy. */
 async function metadataPolicy(storage, state, processing) {
@@ -6075,6 +5997,10 @@ function bindJourneyDestination(storage, destination) {
 			await guard(input.journeyId);
 			return storage.saveResource(input);
 		},
+		async commitClassification(input) {
+			await guard(input.journeyId);
+			return storage.commitClassification(input);
+		},
 		async respondPolicy(input) {
 			await guard(input.request.journeyId);
 			return storage.respondPolicy(input);
@@ -6799,6 +6725,14 @@ async function publishWorkBatches(storage, plan, work, resources, signal) {
 }
 //#endregion
 //#region apps/cli/src/journey/prepare/scan-sessions.ts
+/** Scan refusals caused by one session's own sources, the codes admission refusals also isolate. */
+const rootScanRefusals = /* @__PURE__ */ new Set([
+	"ARTIFACT_PROCESSING_UNSUPPORTED",
+	"PROCESSING_UNSUPPORTED",
+	"ARTIFACT_SOURCE_CHANGED",
+	"ARTIFACT_LIMIT",
+	"PROCESSING_LIMIT"
+]);
 /**
 * Track A (ADR 0172, ADR 0177): every session of the Work is submitted to the shared pool at once,
 * ahead of Track B, and each completed session's receipt is saved as it arrives. Once every session
@@ -6862,7 +6796,11 @@ async function publishScanSessions(storage, plan, work, prepared, binding, direc
 		volumes.scanInputFields += resource.input.fieldCount;
 		volumes.scanFileBytes += resource.input.file.byteLength;
 	}, (error) => {
-		failure ??= { error };
+		const rootSessionId = families.owners.get(selected.session.id)?.id;
+		failure ??= rootSessionId ? {
+			error,
+			rootSessionId
+		} : { error };
 		withdraw.abort();
 	});
 	if (pooled) {
@@ -6900,7 +6838,11 @@ async function publishScanSessions(storage, plan, work, prepared, binding, direc
 			...paragraphs ? { scanHostedCopies: paragraphs.hosted } : {}
 		}
 	});
-	if (failure) throw failure.error;
+	if (failure) {
+		const code = safeCode(failure.error);
+		if (!hooks.signal.aborted && failure.rootSessionId && rootScanRefusals.has(code)) throw new RootPreparationFailure(code, /* @__PURE__ */ new Map([[failure.rootSessionId, code]]), { cause: failure.error });
+		throw failure.error;
+	}
 	hooks.signal.throwIfAborted();
 	if (resources.length !== prepared.sessions.length) throw new ApplicationError("SCOPE_NOT_READY");
 	return {
@@ -7126,224 +7068,6 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 	}
 }
 //#endregion
-//#region apps/cli/src/journey/static/production.ts
-/**
-* The single production both Track B and packaging use for one Work generation (ADR 0172):
-* frozen captures, built-in static detection only (no custom terms, no Git seeds), the Work's
-* exceptions and a replacement key bound to this generation. Identical inputs give identical
-* session render jobs, so packaging can require the stored Track B result by job digest.
-*/
-async function staticBaseProduction(storage, state, work, processing, hooks) {
-	const excluded = work.excludedReview?.snapshotId === state.snapshotId && work.excludedReview.inputRevision === work.inputRevision ? new Set(work.excludedReview.rootSessionIds) : /* @__PURE__ */ new Set();
-	const roots = work.rootSessionIds.filter((id) => !excluded.has(id));
-	if (!roots.length) return void 0;
-	const plan = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "plan"
-	}))[0];
-	if (plan?.kind !== "plan") throw new ApplicationError("CORRUPTED_STATE");
-	const approval = workApproval(plan.approval, roots);
-	if (approval.treatment?.kind !== "configured") throw new ApplicationError("CORRUPTED_STATE");
-	const parts = new Set(approval.inventory.sessions.flatMap((session) => session.parts.map((part) => part.id)));
-	const captures = (await storage.resources({
-		journeyId: state.journeyId,
-		kind: "capture"
-	})).flatMap((item) => item.kind === "capture" && parts.has(item.capture.partId) ? [item.capture] : []);
-	if (captures.length !== parts.size) throw new ApplicationError("SCOPE_NOT_READY");
-	const { sensitiveTerms: _live, customTerms: _terms, staticExceptions: _unscoped, ...local } = processing;
-	const production = await prepareCollectionProduction(approval, state.journeyId, {
-		configured: {
-			...local,
-			gitNames: async () => ({
-				names: [],
-				snapshots: []
-			}),
-			replacementKey: createHash("sha256").update(JSON.stringify([
-				"static-base-v1",
-				plan.replacementKey,
-				work.id,
-				work.inputRevision
-			])).digest("hex"),
-			staticExceptions: {
-				workId: work.id,
-				values: state.exceptions.filter((item) => item.workId === work.id).map(({ kind, value }) => ({
-					kind,
-					value
-				}))
-			}
-		},
-		captures,
-		everyAdmissionRefusal: true
-	}, hooks);
-	if (production.kind !== "configured" || production.workspaceFailures.length) throw new ApplicationError("SCOPE_NOT_READY");
-	const families = reviewFamilies(approval.inventory);
-	const admitted = new Set(production.selection.sessions.map((item) => item.session.id));
-	return {
-		production,
-		families,
-		work: {
-			...work,
-			rootSessionIds: roots.filter((id) => families.members.get(id)?.some((member) => admitted.has(member.id))),
-			access: work.access === "private" ? "private" : "public"
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/static/store.ts
-/** Identity, length and complete digest of one owner-only file; a symlink is never followed. */
-async function describe(path, signal) {
-	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const before = await handle.stat({ bigint: true });
-		if (!before.isFile()) throw new ApplicationError("CORRUPTED_STATE");
-		const digest = createHash("sha256");
-		let byteLength = 0;
-		const buffer = Buffer.allocUnsafe(1048576);
-		for (;;) {
-			signal.throwIfAborted();
-			const { bytesRead } = await handle.read(buffer, 0, buffer.length, byteLength);
-			if (!bytesRead) break;
-			digest.update(buffer.subarray(0, bytesRead));
-			byteLength += bytesRead;
-		}
-		const after = await handle.stat({ bigint: true });
-		if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs || BigInt(byteLength) !== after.size) throw new ApplicationError("CORRUPTED_STATE");
-		return {
-			path,
-			identity: {
-				dev: String(after.dev),
-				ino: String(after.ino)
-			},
-			sha256: digest.digest("hex"),
-			byteLength
-		};
-	} finally {
-		await handle.close();
-	}
-}
-/** A stored file must still be the exact recorded file and bytes. */
-async function authenticate(file, signal) {
-	const actual = await describe(file.path, signal);
-	if (JSON.stringify(actual) !== JSON.stringify(file)) throw new ApplicationError("CORRUPTED_STATE");
-}
-/**
-* Persist one Track B session as owner-only private state beside the journey's other scan
-* files: its three spools and a digest-bound result description. Nothing here is uploaded.
-*/
-async function saveStaticSession(storage, binding, item, result, signal) {
-	const owned = [
-		result.spoolPath,
-		result.companionSpoolPath,
-		result.maskSpoolPath
-	];
-	const resultPath = join(binding.directory, `${randomUUID()}.static.json`);
-	let saved = false;
-	try {
-		if (result.kind !== "render" || result.maskSpoolPath === void 0 || result.maskEntries === void 0 || result.metadataMasks === void 0 || result.reviewSpoolPath !== void 0) throw new ApplicationError("CORRUPTED_STATE");
-		const stored = {
-			kind: "render",
-			processingMs: result.processingMs,
-			maskEntries: result.maskEntries,
-			metadataMasks: result.metadataMasks,
-			metadata: result.metadata,
-			parts: result.parts,
-			entries: result.entries,
-			agentSetup: result.agentSetup
-		};
-		const file = await open(resultPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
-		owned.push(resultPath);
-		try {
-			await file.writeFile(JSON.stringify(stored));
-			await file.sync();
-		} finally {
-			await file.close();
-		}
-		const resource = staticSessionResourceSchema.parse({
-			kind: "static-session",
-			journeyId: binding.journeyId,
-			workId: binding.work.id,
-			inputRevision: binding.work.inputRevision,
-			snapshotId: binding.snapshotId,
-			sessionId: item.sessionId,
-			jobDigest: item.digest,
-			result: await describe(resultPath, signal),
-			primary: await describe(result.spoolPath, signal),
-			companion: await describe(result.companionSpoolPath, signal),
-			masks: await describe(result.maskSpoolPath, signal),
-			...result.images === void 0 ? {} : { imagesOmitted: result.images }
-		});
-		await storage.saveResource(resource);
-		saved = true;
-		return resource;
-	} finally {
-		if (!saved) {
-			for (const path of owned) if (path !== void 0) await unlink(path).catch(() => {});
-		}
-	}
-}
-/** Current-generation Track B receipts of one Work, keyed by application session ID. */
-async function staticSessions(storage, journeyId, work) {
-	const resources = (await storage.resources({
-		journeyId,
-		kind: "static-session",
-		idPrefix: `${work.id}:${work.inputRevision}:`
-	})).filter((item) => item.kind === "static-session" && item.workId === work.id && item.inputRevision === work.inputRevision);
-	return new Map(resources.map((item) => [item.sessionId, item]));
-}
-/**
-* Shape guard like the worker transport's: the bytes are bound by the recorded digest, and the
-* archive writer checks parts, entries and masks again when it consumes them.
-*/
-function isStoredResult(value) {
-	return typeof value === "object" && value !== null && Reflect.get(value, "kind") === "render" && Array.isArray(Reflect.get(value, "maskEntries")) && Array.isArray(Reflect.get(value, "metadataMasks")) && Array.isArray(Reflect.get(value, "parts")) && Array.isArray(Reflect.get(value, "entries")) && Array.isArray(Reflect.get(value, "agentSetup")) && typeof Reflect.get(value, "metadata") === "string" && Number.isSafeInteger(Reflect.get(value, "processingMs"));
-}
-/** Authenticated result description of one stored Track B session. */
-async function readStaticResult(resource, signal) {
-	await authenticate(resource.result, signal);
-	const handle = await open(resource.result.path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const text = await handle.readFile("utf8");
-		if (createHash("sha256").update(text).digest("hex") !== resource.result.sha256) throw new ApplicationError("CORRUPTED_STATE");
-		const value = JSON.parse(text);
-		if (!isStoredResult(value)) throw new ApplicationError("CORRUPTED_STATE");
-		return value;
-	} finally {
-		await handle.close();
-	}
-}
-/**
-* Packaging from the Track B base: the stored result of exactly this job, with fresh hard links
-* to its authenticated spools that the archive writer may consume. Static detection never runs.
-*/
-async function linkedStaticResult(resource, job, signal) {
-	if (!resource || resource.jobDigest !== job.digest) throw new ApplicationError("SCOPE_NOT_READY");
-	const result = await readStaticResult(resource, signal);
-	const links = [];
-	try {
-		const linked = async (file) => {
-			const path = join(job.spoolDirectory, `${randomUUID()}.session`);
-			await link(file.path, path);
-			links.push(path);
-			const stat = await lstat(path, { bigint: true });
-			if (String(stat.dev) !== file.identity.dev || String(stat.ino) !== file.identity.ino) throw new ApplicationError("CORRUPTED_STATE");
-			await authenticate({
-				...file,
-				path
-			}, signal);
-			return path;
-		};
-		return {
-			...result,
-			spoolPath: await linked(resource.primary),
-			companionSpoolPath: await linked(resource.companion),
-			maskSpoolPath: await linked(resource.masks)
-		};
-	} catch (error) {
-		for (const path of links) await unlink(path).catch(() => {});
-		throw error;
-	}
-}
-//#endregion
 //#region apps/cli/src/journey/static/run.ts
 /**
 * Track B for one Work generation (ADR 0172): render every admitted session with all built-in
@@ -7924,7 +7648,7 @@ async function runWorkers(workers) {
 //#endregion
 //#region apps/cli/src/journey/package-base.ts
 /** Package-only staging from the complete Track B base; scanning never calls this. */
-async function packageBase(storage, state, work, processing, directory, signal, readState = () => storage.current(state.journeyId)) {
+async function packageBase(storage, state, work, processing, directory, signal, readState = () => storage.current(state.journeyId), write = writeJourneyBase) {
 	assertJourneyPrivacyReady(state, true);
 	const existing = (await storage.resources({
 		journeyId: state.journeyId,
@@ -7932,53 +7656,18 @@ async function packageBase(storage, state, work, processing, directory, signal,
 		id: `${work.id}:${work.inputRevision}`
 	})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === work.inputRevision);
 	if (existing?.kind === "base") return existing;
-	const hooks = {
-		signal,
-		onTemporary: async () => {},
-		onPhase: async () => {}
-	};
-	const prepared = await staticBaseProduction(storage, state, work, processing, hooks);
-	if (!prepared) throw new ApplicationError("ARTIFACT_EMPTY_SCOPE");
-	const { families } = prepared;
-	const stored = await staticSessions(storage, state.journeyId, work);
-	const written = await writeLogicalJourneyBase({
-		production: prepared.production,
+	const inputs = await staticBaseInputs(storage, state, work);
+	if (!inputs) throw new ApplicationError("ARTIFACT_EMPTY_SCOPE");
+	const base = await write({
+		inputs,
+		stored: [...(await staticSessions(storage, state.journeyId, work)).values()],
 		directory,
-		captureReview: false,
-		work: prepared.work,
-		prerendered: async (job) => {
-			if (job.spoolDirectory === void 0) throw new ApplicationError("CORRUPTED_STATE");
-			return linkedStaticResult(stored.get(job.session.id), {
-				digest: renderJobDigest(job),
-				spoolDirectory: job.spoolDirectory
-			}, signal);
-		}
-	}, hooks);
+		processing
+	}, signal);
 	const after = await readState();
 	const current = after?.works.find((item) => item.id === work.id);
 	if (!after || after.snapshotId !== state.snapshotId || after.configurationId !== state.configurationId || current?.revision !== work.revision || current.inputRevision !== work.inputRevision || after.pendingHideId) throw new ApplicationError("REVISION_CONFLICT");
 	assertJourneyPrivacyReady(after, true);
-	const base = {
-		kind: "base",
-		journeyId: state.journeyId,
-		workId: work.id,
-		inputRevision: work.inputRevision,
-		bundleId: written.bundleId,
-		primary: written.primary,
-		companion: written.companion,
-		maskLedger: written.maskLedger,
-		sourceBindings: [...written.sourceBindings],
-		sessions: written.sessionBindings.map((binding) => {
-			const root = families.owners.get(binding.applicationSessionId);
-			if (!root) throw new ApplicationError("CORRUPTED_STATE");
-			return {
-				applicationSessionId: binding.applicationSessionId,
-				archiveSessionId: binding.sessionId,
-				rootSessionId: root.id,
-				role: root.id === binding.applicationSessionId ? "main" : "worker"
-			};
-		})
-	};
 	await storage.saveResource(base);
 	return base;
 }
@@ -8373,8 +8062,26 @@ function createRenderWorkers(workers, size) {
 			return pool.serial(() => writeJourneyOutput(work, signal));
 		}
 	};
+	const writeBase = async (work, signal) => {
+		const named = /* @__PURE__ */ new Set();
+		try {
+			const result = await pool.acquire().request({
+				kind: "journey-base",
+				job: journeyBaseJob(work)
+			}, signal, { onSpool: (path) => named.add(path) });
+			if (result.kind !== "journey-base") throw new Error("ARTIFACT_PROCESSING_FAILED");
+			return result.base;
+		} catch (error) {
+			await removeNamedTemporarySpools(named).catch((cleanup) => workers.onFallback?.(cleanup));
+			if (error instanceof SessionWorkerError) throw new ApplicationError(error.message, void 0, { cause: error });
+			if (signal.aborted) throw error;
+			workers.onFallback?.(error);
+			return pool.serial(() => writeJourneyBase(work, signal));
+		}
+	};
 	return {
 		write,
+		writeBase,
 		close: () => pool.discard()
 	};
 }
@@ -8552,7 +8259,7 @@ function createJourneyRenderer(options) {
 			work
 		};
 	}
-	async function produce(state, work, signal, write, session, plan) {
+	async function produce(state, work, signal, write, session, plan, writeBase) {
 		const { journeyId } = state;
 		const workId = work.id;
 		assertJourneyPrivacyReady(state, true);
@@ -8584,11 +8291,11 @@ function createJourneyRenderer(options) {
 			});
 			const next = moved.works.find((item) => item.id === workId);
 			if (!next) throw new ApplicationError("REVISION_CONFLICT");
-			return produce(moved, next, signal, write, session, plan);
+			return produce(moved, next, signal, write, session, plan, writeBase);
 		}
 		if (!output) {
 			const directory = await journeyDirectory(options.stateDir, journeyId);
-			await packageBase(storage, state, work, options.processing, directory, signal, () => session.current());
+			await packageBase(storage, state, work, options.processing, directory, signal, () => session.current(), writeBase);
 			const { base, tokens, confirmed, request } = await journeyOutputRequest(storage, state, work, options.processing, signal, await plan());
 			const { output: written, tokens: collected } = await write({
 				request: {
@@ -8680,10 +8387,10 @@ function createJourneyRenderer(options) {
 			};
 		});
 	}
-	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId), plan = () => readJourneyPlan(storage, journeyId)) {
+	async function render(journeyId, workId, signal, write = writeJourneyOutput, session = directRenderSession(storage, journeyId), plan = () => readJourneyPlan(storage, journeyId), writeBase = writeJourneyBase) {
 		const { state, work } = await admit(workId, session);
 		try {
-			return await produce(state, work, signal, write, session, plan);
+			return await produce(state, work, signal, write, session, plan, writeBase);
 		} catch (error) {
 			if (signal.aborted) throw error;
 			const renderFailure = {
@@ -8706,14 +8413,16 @@ function createJourneyRenderer(options) {
 		}
 	}
 	/**
-	* A several-Work render writes each Work's output in packaging workers; state, database and
-	* resource writes stay on this thread under the cross-process state lock (ADR 0181). Any Work
-	* may be split into shards, so the pool is not limited to one worker per Work (ADR 0199).
+	* A several-Work render writes each Work's base and output in packaging workers; state,
+	* database and resource writes stay on this thread under the cross-process state lock
+	* (ADR 0181, ADR 0228). Any Work may be split into shards, so the pool is not limited to one
+	* worker per Work (ADR 0199). A `workIds` call of one Work uses workers too, so a panel batch
+	* never packages on the serving thread.
 	*/
 	async function renderScope(journeyId, works, signal) {
 		const workers = options.workers;
 		const size = workers ? workers.parallelism ?? renderWorkerCount() : 0;
-		if (!workers || works < 2 || size < 1) return void 0;
+		if (!workers || works < 1 || size < 1) return void 0;
 		const pool = createRenderWorkers(workers, size);
 		const session = batchedRenderSession(storage, journeyId);
 		let plan;
@@ -8723,7 +8432,7 @@ function createJourneyRenderer(options) {
 		});
 		return {
 			concurrency: size + 1,
-			render: (workId) => render(journeyId, workId, signal, pool.write, session, readPlan),
+			render: (workId) => render(journeyId, workId, signal, pool.write, session, readPlan, pool.writeBase),
 			close: pool.close
 		};
 	}
@@ -9479,57 +9188,49 @@ function createClassificationReader(storage, stateDir) {
 }
 //#endregion
 //#region apps/cli/src/journey/works/regroup.ts
-/** Rebind accepted frozen evidence; original batch/chunk IDs remain its audit provenance. */
-async function regroupPrivacySources(storage, state, works, changedMetadata, signal) {
-	const owners = new Map(works.flatMap((work) => work.rootSessionIds.map((id) => [id, work.id])));
+/**
+* The session of every accepted finding chunk outside the proposal's retained Works, read from
+* frozen batches before the commit so the store transaction can rebind them without I/O.
+*/
+async function resolveChunkSessions(storage, state, works, signal) {
 	const retained = new Set(works.map((work) => work.id));
 	const batches = /* @__PURE__ */ new Map();
-	const terms = [];
-	for (const term of state.privacy.terms) {
-		const sources = [];
-		for (const source of term.sources) {
-			signal.throwIfAborted();
-			if (source.kind === "metadata") {
-				if (retained.has(source.workId) && !changedMetadata.has(source.workId)) sources.push(source);
-				continue;
-			}
-			if (retained.has(source.workId)) {
-				sources.push(source);
-				continue;
-			}
-			let batch = batches.get(source.batchId);
-			if (!batch) {
-				const record = await storage.inspectReview({
-					kind: "attempt",
-					journeyId: state.journeyId,
-					batchId: source.batchId
-				});
-				if (!record || record.batch.snapshotId !== state.snapshotId) throw new ApplicationError("CORRUPTED_STATE");
-				batch = record.batch;
-				if (batches.size >= 16) batches.clear();
-				batches.set(source.batchId, batch);
-			}
-			const chunk = batch.chunks.find((item) => item.id === source.chunkId) ?? batch.duplicates?.find((item) => item.id === source.chunkId);
-			const workId = chunk && owners.get(chunk.sessionId);
-			if (!workId) throw new ApplicationError("CORRUPTED_STATE");
-			sources.push({
-				...source,
-				workId
+	const resolved = /* @__PURE__ */ new Map();
+	for (const term of state.privacy.terms) for (const source of term.sources) {
+		signal.throwIfAborted();
+		if (source.kind === "metadata" || retained.has(source.workId)) continue;
+		const key = `${source.batchId}:${source.chunkId}`;
+		if (resolved.has(key)) continue;
+		let batch = batches.get(source.batchId);
+		if (!batch) {
+			const record = await storage.inspectReview({
+				kind: "attempt",
+				journeyId: state.journeyId,
+				batchId: source.batchId
 			});
-		}
-		terms.push({
-			...term,
-			sources
+			if (!record || record.batch.snapshotId !== state.snapshotId) throw new ApplicationError("CORRUPTED_STATE");
+			batch = record.batch;
+			if (batches.size >= 16) batches.clear();
+			batches.set(source.batchId, batch);
+		}
+		const chunk = batch.chunks.find((item) => item.id === source.chunkId) ?? batch.duplicates?.find((item) => item.id === source.chunkId);
+		if (!chunk) throw new ApplicationError("CORRUPTED_STATE");
+		resolved.set(key, {
+			batchId: source.batchId,
+			chunkId: source.chunkId,
+			sessionId: chunk.sessionId
 		});
 	}
-	return terms;
+	return [...resolved.values()];
 }
 //#endregion
 //#region apps/cli/src/journey/works/proposal.ts
 /**
 * One atomic root partition; recommendations have no access authority. Roots still being grouped
 * wait in one unread Work while the other Works are confirmed and read; the submission that
-* groups them may arrive after confirmation and keeps it (E2).
+* groups them may arrive after confirmation and keeps it (E2). The proposal is prepared from one
+* read and applied by the store against the current state, so scan writes in between do not
+* refuse it (BL-216).
 */
 function createClassificationProposal(storage) {
 	return async (input, signal) => {
@@ -9539,19 +9240,20 @@ function createClassificationProposal(storage) {
 		const classifying = isClassifying(state);
 		const late = state.scope.status === "confirmed";
 		const bound = input.expectedClassificationRevision !== void 0 && classifying && input.expectedClassificationRevision === state.classificationRevision;
-		const commit = (next = state) => storage.commit({
-			expectedRevision: bound ? state.revision : input.expectedRevision,
+		const requestHash = textDigest(JSON.stringify(input));
+		const event = {
+			journeyId: state.journeyId,
+			kind: "response",
+			source: "conversation",
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		if (input.expectedClassificationRevision !== void 0 ? !bound : state.revision !== input.expectedRevision) return storage.commit({
+			expectedRevision: input.expectedRevision,
 			requestKey: input.idempotencyKey,
-			requestHash: textDigest(JSON.stringify(input)),
-			state: next,
-			event: {
-				journeyId: state.journeyId,
-				kind: "response",
-				source: "conversation",
-				at: (/* @__PURE__ */ new Date()).toISOString()
-			}
+			requestHash,
+			state,
+			event
 		});
-		if (input.expectedClassificationRevision !== void 0 ? !bound : state.revision !== input.expectedRevision) return commit();
 		if (late && !classifying) throw new ApplicationError("INVALID_TRANSITION");
 		if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (!state.snapshotId || state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
@@ -9590,96 +9292,43 @@ function createClassificationProposal(storage) {
 			kind: "capture"
 		});
 		const captured = new Set(captures.flatMap((resource) => resource.kind === "capture" ? [resource.capture.partId] : []));
-		const works = [];
+		const workspacesOf = (rootSessionIds) => {
+			const sessions = rootSessionIds.flatMap((root) => families.members.get(root) ?? []);
+			if (sessions.some((session) => session.parts.some((part) => !captured.has(part.id)))) throw new ApplicationError("SCOPE_NOT_READY");
+			return [...new Set(sessions.map((session) => session.workspaceId))];
+		};
+		const items = [];
 		for (const item of merged.values()) {
 			signal.throwIfAborted();
-			const sessions = item.rootSessionIds.flatMap((root) => families.members.get(root) ?? []);
-			if (sessions.some((session) => session.parts.some((part) => !captured.has(part.id)))) throw new ApplicationError("SCOPE_NOT_READY");
-			const existing = state.works.find((work) => work.placement !== "classifying" && work.rootSessionIds.length === item.rootSessionIds.length && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root)));
-			const extended = late ? state.works.find((work) => work.placement === "placed" && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root))) : void 0;
-			if (late && existing) {
-				works.push(existing);
-				continue;
-			}
-			const workspaces = [...new Set(sessions.map((session) => session.workspaceId))];
-			const base = existing ?? (extended ? {
-				...resetWorkScan(extended),
-				rootSessionIds: item.rootSessionIds,
-				sourceWorkspaceIds: [.../* @__PURE__ */ new Set([...extended.sourceWorkspaceIds, ...workspaces])]
-			} : newJourneyWork(randomUUID(), item.projectName, item.rootSessionIds, workspaces, "placed"));
-			const { classificationMetadata: _display, ...original } = base;
-			works.push({
-				...original,
-				projectName: item.projectName,
-				title: base.titleOrigin === "explicit" ? base.title : item.projectName,
-				description: item.description,
-				projectType: {
-					type: item.projectType,
-					reason: item.recommendation.reason,
-					origin: "model"
-				},
-				placement: "placed",
-				...late && !extended ? {
-					access: item.recommendation.access,
-					accessOrigin: "model",
-					accessConfirmed: true
-				} : {},
-				classificationRecommendation: item.recommendation,
-				suggestion: null,
-				artifact: null,
-				revision: base.revision + 1
+			items.push({
+				...item,
+				workId: randomUUID(),
+				workspaceIds: workspacesOf(item.rootSessionIds)
 			});
 		}
-		if (pending.length) {
-			const prior = state.works.find((work) => work.placement === "classifying" && work.rootSessionIds.length === pending.length && work.rootSessionIds.every((root) => pending.includes(root)));
-			const sessions = pending.flatMap((root) => families.members.get(root) ?? []);
-			works.push(prior ?? newJourneyWork(randomUUID(), "Still being grouped", pending, [...new Set(sessions.map((session) => session.workspaceId))], "classifying"));
-		}
-		const retained = new Set(works.map((work) => work.id));
-		const changedMetadata = new Set(works.filter((work) => {
-			const old = state.works.find((item) => item.id === work.id);
-			return !old || JSON.stringify([
-				work.title,
-				work.projectName,
-				work.description,
-				work.classificationRecommendation?.reason
-			]) !== JSON.stringify([
-				old.title,
-				old.projectName,
-				old.description,
-				old.classificationRecommendation?.reason
-			]);
-		}).map((work) => work.id));
-		const regrouped = !late && (state.works.some((work) => !retained.has(work.id)) || changedMetadata.size > 0);
-		const cardTerms = new Set(state.privacy.cards.flatMap((card) => card.termKeys));
-		const preserved = await regroupPrivacySources(storage, state, works, changedMetadata, signal);
-		const forced = new Set(preserved.filter((term) => !termTypeInfo[term.type].asked).map((term) => term.value));
-		const overrides = new Map(state.valueOverrides?.map((item) => [item.value, item.choice]) ?? []);
-		const terms = preserved.map((term) => ({
-			...term,
-			disposition: forced.has(term.value) ? "hidden" : overrides.has(term.value) ? overrides.get(term.value) === "hide" ? "hidden" : "keep" : regrouped && cardTerms.has(privacyTermKey(term)) ? "pending" : term.disposition
-		}));
-		return commit({
-			...state,
-			works,
-			classificationRevision: state.revision + 1,
-			scope: late ? state.scope : {
-				status: "pending",
-				actor: null,
-				at: null
-			},
-			privacy: {
-				...state.privacy,
-				terms,
-				packageApproval: null,
-				...regrouped ? {
-					cards: [],
-					answersRevision: state.privacy.answersRevision + 1,
-					confirmedAnswersRevision: null
-				} : {}
-			},
-			readingComplete: !pending.length && works.filter((work) => work.access !== "drop").every((work) => work.totalBatches > 0 && work.completedBatches === work.totalBatches),
-			phase: "processing"
+		const prepared = {
+			journeyId: state.journeyId,
+			requestKey: input.idempotencyKey,
+			requestHash,
+			at: event.at,
+			expectedRevision: input.expectedRevision,
+			expectedClassificationRevision: bound ? input.expectedClassificationRevision ?? null : null,
+			snapshotId: state.snapshotId,
+			partition: classificationPartition(state),
+			late,
+			items,
+			pending: pending.length ? {
+				workId: randomUUID(),
+				rootSessionIds: pending,
+				workspaceIds: [...new Set(pending.flatMap((root) => (families.members.get(root) ?? []).map((session) => session.workspaceId)))]
+			} : null,
+			chunkSessions: []
+		};
+		const { works } = classificationWorks(state, prepared);
+		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
+		return storage.commitClassification({
+			...prepared,
+			chunkSessions
 		});
 	};
 }
@@ -10143,7 +9792,33 @@ function createJourneySendArtifacts(storage) {
 			const output = await find(journey.journeyId, work.id, work.revision);
 			const info = await readConfiguredOutputInfo(output.primary, signal);
 			if (info.work.id !== work.id || info.work.access !== work.access) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			let agentSources = [];
+			try {
+				const base = (await storage.resources({
+					journeyId: journey.journeyId,
+					kind: "base"
+				})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === output.finalMaskLedger.inputRevision && item.primary.sha256 === output.finalMaskLedger.basePrimarySha256);
+				if (base?.kind === "base") {
+					const included = new Set(base.sessions.map((item) => item.applicationSessionId));
+					const resources = await storage.resources({
+						journeyId: journey.journeyId,
+						kind: "static-session"
+					});
+					const unique = /* @__PURE__ */ new Map();
+					for (const resource of resources) {
+						if (resource.kind !== "static-session" || resource.workId !== work.id || resource.inputRevision !== base.inputRevision || !included.has(resource.sessionId)) continue;
+						for (const candidate of resource.agentSources ?? []) {
+							const parsed = agentSourceSchema.safeParse(candidate);
+							if (parsed.success && unique.size < 500) unique.set(JSON.stringify(parsed.data), parsed.data);
+						}
+					}
+					agentSources = [...unique.values()];
+				}
+			} catch {
+				console.error("AGENT_SOURCES_METADATA_UNAVAILABLE");
+			}
 			return sendArtifactSchema.parse({
+				...agentSources.length === 0 ? {} : { agentSources },
 				workId: work.id,
 				revision: work.revision,
 				bundleId: info.manifest.bundleId,
@@ -10156,16 +9831,19 @@ function createJourneySendArtifacts(storage) {
 				sha256: output.primary.sha256
 			});
 		},
-		async upload(journeyId, artifact, uploadUrl, signal) {
+		async upload(journeyId, artifact, upload, signal) {
 			const output = await find(journeyId, artifact.workId, artifact.revision);
 			if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			await putPrimary(output.primary, artifact.byteLength, uploadUrl, signal);
+			await putPrimary(output.primary, artifact.byteLength, upload, signal);
 		}
 	};
 }
-/** Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. */
-async function putPrimary(primary, byteLength, uploadUrl, signal) {
-	const url = new URL(uploadUrl);
+/**
+* Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. A
+* checksum upload also sends the SHA-256 header the URL signs, so storage refuses other bytes.
+*/
+async function putPrimary(primary, byteLength, upload, signal) {
+	const url = new URL(upload.uploadUrl);
 	if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
 	const source = await openConfiguredUpload(primary, signal);
 	const cleanup = createCleanup();
@@ -10177,7 +9855,8 @@ async function putPrimary(primary, byteLength, uploadUrl, signal) {
 			redirect: "error",
 			headers: {
 				"Content-Type": "application/zip",
-				"Content-Length": String(byteLength)
+				"Content-Length": String(byteLength),
+				...upload.headers
 			},
 			duplex: "half"
 		};
@@ -10299,6 +9978,85 @@ async function readOwnerJson(response) {
 	return JSON.parse(Buffer.concat(chunks, bytes).toString("utf8"));
 }
 //#endregion
+//#region apps/cli/src/account/journey/public-sources.ts
+/** Anonymous evidence only. Expected absence, refusal and lookup failure all omit enrichment. */
+async function publicSource(source, requestFetch, signal) {
+	const controller = new AbortController();
+	let onAbort = () => {};
+	const cancelled = new Promise((resolve) => {
+		onAbort = () => {
+			controller.abort();
+			resolve(false);
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (signal?.aborted) onAbort();
+	});
+	let timer;
+	const expired = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			controller.abort();
+			resolve(false);
+		}, 3e3);
+	});
+	const check = async () => {
+		const response = await requestFetch(source.type === "github" ? `https://api.github.com/repos/${source.repo}` : `https://registry.npmjs.org/${encodeURIComponent(source.package)}`, {
+			method: "GET",
+			credentials: "omit",
+			redirect: "error",
+			referrerPolicy: "no-referrer",
+			cache: "no-store",
+			signal: controller.signal
+		});
+		if (response.status !== 200 || source.type === "npm") {
+			await response.body?.cancel();
+			return response.status === 200;
+		}
+		const value = await readOwnerJson(response);
+		return typeof value === "object" && value !== null && "private" in value && value.private === false;
+	};
+	try {
+		return await Promise.race([
+			check(),
+			expired,
+			cancelled
+		]);
+	} catch {
+		return false;
+	} finally {
+		signal?.removeEventListener("abort", onAbort);
+		clearTimeout(timer);
+		controller.abort();
+	}
+}
+/** One upload, at most twenty distinct checks in parallel and a three-second I/O deadline. */
+async function checkPublicAgentSources(candidates, requestFetch = fetch, signal) {
+	signal?.throwIfAborted();
+	if (!Array.isArray(candidates) || candidates.length > 500) return [];
+	const admittedShape = candidates.flatMap((item) => {
+		const parsed = agentSourcesSchema.element.safeParse(item);
+		return parsed.success ? [parsed.data] : [];
+	});
+	const cache = /* @__PURE__ */ new Map();
+	const selected = [];
+	for (const item of admittedShape) {
+		const source = item.source;
+		const key = source.type === "github" ? `github:${source.repo.toLowerCase()}` : `npm:${source.package}`;
+		let result = cache.get(key);
+		if (!result) {
+			if (cache.size === 20) continue;
+			result = publicSource(source, requestFetch, signal);
+			cache.set(key, result);
+		}
+		selected.push({
+			item,
+			result
+		});
+	}
+	const results = await Promise.all(selected.map(async ({ item, result }) => await result ? item : null));
+	signal?.throwIfAborted();
+	return results.filter((item) => item !== null);
+}
+//#endregion
 //#region apps/cli/src/account/journey/client.ts
 const refusalSchema = z.object({
 	error: z.string(),
@@ -10347,7 +10105,7 @@ const completeTimeoutMs = 6e5;
 function createJourneyOwnerClient(options) {
 	const base = apiBase(options.apiUrl);
 	const requestFetch = options.fetch ?? fetch;
-	async function request(path, schema, signal, body, method = "POST", key, timeoutMs = requestTimeoutMs$2) {
+	async function request(path, schema, signal, body, method = "POST", key, timeoutMs = requestTimeoutMs$2, checksumUpload = false) {
 		const token = await options.authorize();
 		signal.throwIfAborted();
 		const response = await requestFetch(new URL(path, base), {
@@ -10356,7 +10114,8 @@ function createJourneyOwnerClient(options) {
 				accept: "application/json",
 				authorization: `Bearer ${token}`,
 				...body === void 0 ? {} : { "content-type": "application/json" },
-				...key === void 0 ? {} : { "idempotency-key": key }
+				...key === void 0 ? {} : { "idempotency-key": key },
+				...checksumUpload ? { "upload-checksum": "sha256" } : {}
 			},
 			...body === void 0 ? {} : { body: JSON.stringify(body) },
 			credentials: "omit",
@@ -10387,6 +10146,9 @@ function createJourneyOwnerClient(options) {
 	const receipt = (id) => sendReceiptSchema.refine((value) => value.receiptId === id);
 	return {
 		subject: options.subject,
+		checkAgentSources(candidates, signal) {
+			return checkPublicAgentSources(candidates, requestFetch, signal);
+		},
 		async assertCurrent(signal) {
 			await options.authorize();
 			signal.throwIfAborted();
@@ -10411,14 +10173,21 @@ function createJourneyOwnerClient(options) {
 				membersDigest: preview.membersDigest
 			}, "PUT");
 		},
-		reserve(key, input, signal) {
-			return request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, input, "POST", key);
+		async reserve(key, input, signal, checksumUpload = true) {
+			const reserve = (body) => request("/me/work-bundles/uploads", sendReceiptSchema.refine((value) => receiptMatches(input, value)), signal, body, "POST", key, requestTimeoutMs$2, checksumUpload);
+			try {
+				return await reserve(input);
+			} catch (error) {
+				if (!(error instanceof JourneyRemoteError) || error.status !== 400 || error.code !== "invalid_request" || input.agentSources === void 0) throw error;
+				const { agentSources: _, ...withoutSources } = input;
+				return reserve(withoutSources);
+			}
 		},
 		complete(id, signal) {
 			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}/complete`, receipt(id), signal, {}, "POST", void 0, completeTimeoutMs);
 		},
-		status(id, signal) {
-			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}`, receipt(id), signal, void 0, "GET");
+		status(id, signal, checksumUpload = true) {
+			return request(`/me/work-bundles/uploads/${encodeURIComponent(id)}`, receipt(id), signal, void 0, "GET", void 0, requestTimeoutMs$2, checksumUpload);
 		},
 		async replace(keepWorkIds, signal) {
 			if (keepWorkIds.length === 0) throw new ApplicationError("INVALID_STATE");
@@ -10565,6 +10334,8 @@ async function resolveItem(item, bindingId, connection, signal, snapshot = false
 			resolution
 		}, settings, null, snapshot);
 	}
+	const agentSources = await connection.checkAgentSources?.(item.artifact.agentSources, signal);
+	signal.throwIfAborted();
 	return {
 		...item,
 		target,
@@ -10572,6 +10343,7 @@ async function resolveItem(item, bindingId, connection, signal, snapshot = false
 		status: "uploading",
 		error: null,
 		reservation: {
+			...agentSources?.length ? { agentSources } : {},
 			work,
 			target,
 			bundleId: item.artifact.bundleId,
@@ -10608,9 +10380,24 @@ async function perform(context, item, connection, signal) {
 	const auto = context.snapshot === true;
 	await guard();
 	if (item.settings && item.settingsConfirmed) return applySettings(item, connection, signal, guard, auto);
-	if (!item.reservation) return resolveItem(item, context.bindingId, connection, signal, auto, context.name);
-	if (!item.receipt) return observe(item, await connection.reserve(item.operationKey, item.reservation, signal), connection, signal, auto);
-	const receipt = await connection.status(item.receipt.receiptId, signal);
+	if (!item.reservation) {
+		const next = await resolveItem(item, context.bindingId, connection, signal, auto, context.name);
+		if (next.reservation) context.fresh?.set(item.workId, null);
+		return next;
+	}
+	if (!item.receipt) {
+		const reserved = await connection.reserve(item.operationKey, item.reservation, signal, context.checksumUploads !== false);
+		const next = await observe(item, reserved, connection, signal, auto);
+		if (context.fresh?.has(item.workId) && reserved.upload && next.status === "uploading") context.fresh.set(item.workId, {
+			receiptId: reserved.receiptId,
+			upload: reserved.upload
+		});
+		return next;
+	}
+	const fresh = context.fresh?.get(item.workId);
+	context.fresh?.delete(item.workId);
+	if (fresh?.receiptId === item.receipt.receiptId) return put(context, item, fresh.receiptId, fresh.upload, connection, signal, guard);
+	const receipt = await connection.status(item.receipt.receiptId, signal, context.checksumUploads !== false);
 	const observed = await observe(item, receipt, connection, signal, auto);
 	if (receipt.state !== "awaiting_upload") return withoutUpload(observed);
 	if (!receipt.upload) throw new ApplicationError("INVALID_STATE");
@@ -10629,15 +10416,23 @@ async function perform(context, item, connection, signal) {
 	}
 	const current = await connection.resolve(item.reservation.work, signal);
 	if (current.scopeVersion !== item.reservation.expectedScopeVersion || current.accessVersion !== item.reservation.expectedAccessVersion) return renewed(item, null);
+	return put(context, item, receipt.receiptId, receipt.upload, connection, signal, guard);
+}
+/** Uploads the bytes to the receipt's signed URL and completes it. */
+async function put(context, item, receiptId, upload, connection, signal, guard) {
 	await guard();
-	await context.upload(item.artifact, receipt.upload.uploadUrl, signal);
+	await context.upload(item.artifact, upload, signal);
 	await guard();
 	try {
-		return observe(item, await connection.complete(receipt.receiptId, signal), connection, signal, auto);
+		return observe(item, await connection.complete(receiptId, signal), connection, signal, context.snapshot === true);
 	} catch (error) {
+		if (upload.headers !== void 0 && error instanceof JourneyRemoteError && error.code === "bundle_mismatch") return {
+			...renewed(withoutUpload(item), null),
+			checksumUploadRefused: true
+		};
 		if (error instanceof Object) uploaded.set(error, {
 			...item,
-			uploadedReceiptId: receipt.receiptId
+			uploadedReceiptId: receiptId
 		});
 		throw error;
 	}
@@ -10705,14 +10500,16 @@ const confirmedSettings = (item) => item.settings !== null && item.settingsConfi
 * time (ADR 0214). Assessment checks change nothing and step up to three together; a confirmed
 * linked Settings change alters access versions, so it always steps alone.
 */
-function pickBatch(items) {
+function pickBatch(items, now = Date.now()) {
 	const uploading = items.find((item) => item.status === "uploading") ?? items.filter((item) => item.status === "ready").reduce((smallest, item) => !smallest || item.artifact.byteLength < smallest.artifact.byteLength ? item : smallest, void 0);
 	if (uploading) return [uploading];
 	const assessing = items.filter((item) => item.status === "assessing");
 	const first = assessing[0];
 	if (!first) return [];
 	if (confirmedSettings(first)) return [first];
-	return assessing.filter((item) => !confirmedSettings(item)).slice(0, 3);
+	const checks = assessing.filter((item) => !confirmedSettings(item));
+	const start = Math.floor(now / 1e3) * 3 % checks.length;
+	return [...checks.slice(start), ...checks.slice(0, start)].slice(0, 3);
 }
 function isCode(error, code) {
 	return error instanceof ApplicationError && error.code === code;
@@ -10806,7 +10603,11 @@ async function advanceItems(host, signal) {
 			if (finished !== null) return finished;
 		}
 		if (!batch.length) return host.applied();
-		const results = await Promise.allSettled(batch.map((item) => stepItem(host.context(item), item, connection, signal)));
+		const checksumUploads = !send.items.some((item) => item.checksumUploadRefused);
+		const results = await Promise.allSettled(batch.map((item) => stepItem({
+			...host.context(item),
+			checksumUploads
+		}, item, connection, signal)));
 		const failures = results.flatMap((result) => result.status === "rejected" ? [result] : []);
 		if (failures.some(({ reason }) => isCode(reason, "REVISION_CONFLICT"))) return host.stale();
 		const first = failures[0];
@@ -10827,7 +10628,7 @@ async function advanceItems(host, signal) {
 			if (progressed) next.set(item.workId, progressed);
 			if (cause instanceof JourneyRemoteError && cause.status === 401 || isCode(cause, "ACCOUNT_SIGNED_OUT")) signIn = true;
 			else if (isCode(cause, "IDENTITY_REJECTED")) changed = true;
-			else if (isInterrupted(cause)) {
+			else if (isInterrupted(cause) || isTransientRefusal(cause)) {
 				host.failure("SEND_INTERRUPTED", cause);
 				error = "SEND_INTERRUPTED";
 			} else {
@@ -10935,8 +10736,9 @@ function withoutQuestions(send) {
 	};
 	return send.status === "review" ? aggregate(next) : next;
 }
-async function advanceSend(dependencies, address, signal) {
+async function advanceSend(dependencies, address, signal, chain) {
 	const snapshot = requireSend(await dependencies.storage.loadSend(address.journeyId, address.sendId));
+	if (chain) chain.revision = snapshot.send.revision;
 	if ((await dependencies.storage.loadSend(address.journeyId))?.send?.id !== snapshot.send.id) return {
 		...snapshot,
 		status: "stale"
@@ -10968,22 +10770,23 @@ async function advanceSend(dependencies, address, signal) {
 	return advanceItems({
 		send,
 		failure: dependencies.failure,
-		connect: dependencies.auth.connect,
+		connect: chain?.connect ?? dependencies.auth.connect,
 		profile: (connection, profileSignal) => prepareProfile(dependencies, snapshot, connection, profileSignal),
 		context: (item) => {
 			const binding = snapshot.journey.works.find((value) => value.id === item.workId)?.binding;
 			const retired = !item.receipt && binding?.sentBundleId === item.artifact.bundleId && binding.sentAccess === item.access;
 			return {
 				snapshot: true,
+				...chain ? { fresh: chain.fresh } : {},
 				active: async () => {
 					const current = requireSend(await dependencies.storage.loadSend(snapshot.journey.journeyId));
 					if (current.send.id !== snapshot.send.id || !sameItem(current.send.items, item) || current.send.status === "paused" || current.journey.phase === "paused") throw new ApplicationError("REVISION_CONFLICT");
 					assertScope(current.journey, current.send);
 				},
 				bindingId: binding?.subject === send.subject && !retired ? binding.bundleRecordId : void 0,
-				upload: async (artifact, uploadUrl, uploadSignal) => {
+				upload: async (artifact, upload, uploadSignal) => {
 					const started = performance.now();
-					await dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, uploadUrl, uploadSignal);
+					await dependencies.artifacts.upload(snapshot.journey.journeyId, artifact, upload, uploadSignal);
 					dependencies.uploaded?.(artifact.workId, artifact.byteLength, Math.round(performance.now() - started));
 				}
 			};
@@ -11029,6 +10832,14 @@ async function advanceSend(dependencies, address, signal) {
 		})
 	}, signal);
 }
+/**
+* A refusal Passport answers while it or Identity is briefly unavailable. It says nothing about
+* the Work, so the step is retried instead of blocking it (the 2026-11-01 recorded run blocked a
+* Work on one `identity_unavailable`).
+*/
+function isTransientRefusal(error) {
+	return error instanceof JourneyRemoteError && (error.status >= 500 || error.status === 429 || error.code === "identity_unavailable");
+}
 //#endregion
 //#region apps/cli/src/account/journey/decisions.ts
 function decide(item, input) {
@@ -11299,10 +11110,10 @@ function createManualUploader(dependencies) {
 				active: guard(upload, item),
 				name: item.title,
 				bindingId: bindings.find((value) => value.subject === upload.subject && value.pathHash === pathHash(item))?.bundleRecordId,
-				upload: (artifact, uploadUrl, uploadSignal) => {
+				upload: (artifact, signedUpload, uploadSignal) => {
 					const slot = upload.slots[item.workId];
 					if (slot === void 0) throw new ApplicationError("ARTIFACT_MISSING");
-					return dependencies.artifacts.upload(upload.resultId, slot, artifact, uploadUrl, uploadSignal);
+					return dependencies.artifacts.upload(upload.resultId, slot, artifact, signedUpload, uploadSignal);
 				}
 			}),
 			applied: () => ({
@@ -11372,10 +11183,10 @@ function createManualUploadArtifacts(application) {
 				})
 			};
 		},
-		async upload(resultId, slot, artifact, uploadUrl, signal) {
+		async upload(resultId, slot, artifact, upload, signal) {
 			const { row, primary } = await find(resultId, slot);
 			if (row.bundleId !== artifact.bundleId || primary.sha256 !== artifact.sha256 || primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			await putPrimary(primary, artifact.byteLength, uploadUrl, signal);
+			await putPrimary(primary, artifact.byteLength, upload, signal);
 		}
 	};
 }
@@ -12538,13 +12349,42 @@ function createJourneyFiles(storage) {
 		};
 	};
 }
+/**
+* One advance carries the Work being uploaded through its phases with one verified connection,
+* instead of one phase per panel round trip, and uploads a receipt it just resolved and reserved
+* without reading it again (ADR 0229). Each phase is still fenced and saved on its own, so Pause, a
+* revision change or a failure stops the chain at the next phase exactly as between advances.
+* The advance returns once that Work leaves its upload phases, so the next Work starts from the
+* caller's next advance as before.
+*/
+async function advanceWork(dependencies, address, signal, phases = 3) {
+	let connection;
+	const chain = {
+		fresh: /* @__PURE__ */ new Map(),
+		async connect(connectSignal) {
+			if (connection === void 0) connection = await dependencies.auth.connect(connectSignal);
+			return connection;
+		}
+	};
+	let result = await advanceSend(dependencies, address, signal, chain);
+	for (let phase = 1; phase < phases && uploading(result, chain.revision); phase += 1) result = await advanceSend(dependencies, address, signal, chain);
+	return result;
+}
+/** The phase saved progress and left its Work mid-upload, with nothing else to report. */
+function uploading(result, before) {
+	const send = result.send;
+	return result.status === "applied" && send !== null && before !== void 0 && send.revision > before && send.status === "sending" && send.error === null && pickBatch(send.items)[0]?.status === "uploading";
+}
 //#endregion
 //#region apps/cli/src/account/journey/send.ts
 function sameIds(left, right) {
 	return left.length === right.length && new Set(left).size === left.length && left.every((id) => right.includes(id));
 }
-/** Durable, bounded orchestration; native chat and panel use the same commands. */
-function createJourneySender(dependencies) {
+/**
+* Durable, bounded orchestration; native chat and panel use the same commands. One advance runs
+* at most `phases` upload phases of one Work (ADR 0229); tests pass 1 to observe each phase.
+*/
+function createJourneySender(dependencies, phases = 3) {
 	const running = /* @__PURE__ */ new Map();
 	const runKey = (address) => `${address.journeyId}:${address.sendId}`;
 	const load = async (address) => {
@@ -12657,7 +12497,7 @@ function createJourneySender(dependencies) {
 			const current = running.get(key);
 			if (current) return current.result;
 			const stop = new AbortController();
-			const result = advanceSend(dependencies, address, AbortSignal.any([signal, stop.signal])).catch(async (error) => {
+			const result = advanceWork(dependencies, address, AbortSignal.any([signal, stop.signal]), phases).catch(async (error) => {
 				if (!stop.signal.aborted || signal.aborted) throw error;
 				return {
 					...requireSend(await dependencies.storage.loadSend(address.journeyId, address.sendId)),