@gitroll/tacitt-cli 0.6.10 → 0.6.11

package/skills/tacitt/references/journey.md

@@ -5,7 +5,7 @@
 
 ## Start and consent
 
-Verify the exact paired CLI using [bootstrap](bootstrap.md). Obtain the actual configured destination from `account.status.configuration.passportApiUrl` (the welcome screen starts the run with sign-in; a run started by chat agreement can still classify and scan signed out, and sign-in is then asked at Send), then `journey.start` with destination, provider and a UUID idempotencyKey. Pass `period` only when the person's request names a date range of last activity; otherwise include all sessions without asking. Call it once, with the real model provider of this App as `provider`: a free-form name the panel shows, such as `Anthropic` in Claude Code or `OpenAI` in Codex, not checked against a list; never call it to probe validation, because a started journey stays current until it completes. If an unfinished journey must be given up (wrong label or destination, or the person wants to restart), ask the person in chat; on explicit agreement record `journey.respond {kind:"abandon"}`, then start again. Abandon is refused once any Work was sent; it cancels a Send that sent nothing, such as one waiting for sign-in. This does not authorize reading. Initialize the phase helper (`init` needs no consent), start the host with `journey.serve --detach` (it runs in its own process, outside your tool's background-task limit, and prints the panel `url` and the host's `pid`; record the pid, stop the host only by that pid, and it stops itself 30 minutes after the journey ends and the Tacitt profile has assessed the sent Works, at most 3 hours after the journey ends), open its `url` in the focused App browser, make that pane visible as [SKILL.md](../SKILL.md) describes for the host, and give the person the panel URL as a link in chat. The welcome screen explains original-text model access and asks the person to sign in with Google or GitHub (a signed-in person sees Continue); that sign-in records consent; [wait](#waiting-for-the-person) until the helper phase leaves `consent`. An explicit chat agreement instead is recorded with `journey.respond` consent. Never scan real sources merely because this document is being edited or tested.
+Verify the exact paired CLI using [bootstrap](bootstrap.md). Obtain the actual configured destination from `account.status.configuration.passportApiUrl` (the welcome screen starts the run with sign-in; a journey starts only after sign-in, except in a build with no sign-in client), then `journey.start` with destination, provider and a UUID idempotencyKey. Pass `period` only when the person's request names a date range of last activity; otherwise include all sessions without asking. Call it once, with the real model provider of this App as `provider`: a free-form name the panel shows, such as `Anthropic` in Claude Code or `OpenAI` in Codex, not checked against a list; never call it to probe validation, because a started journey stays current until it completes. If an unfinished journey must be given up (wrong label or destination, or the person wants to restart), ask the person in chat; on explicit agreement record `journey.respond {kind:"abandon"}`, then start again. Abandon is refused once any Work was sent; it cancels a Send that sent nothing, such as one waiting for sign-in. This does not authorize reading. Initialize the phase helper (`init` needs no consent), start the host with `journey.serve --detach` (it runs in its own process, outside your tool's background-task limit, and prints the panel `url` and the host's `pid`; record the pid, stop the host only by that pid, and it stops itself 30 minutes after the journey ends and the Tacitt profile has assessed the sent Works, at most 3 hours after the journey ends), open its `url` in the focused App browser, make that pane visible as [SKILL.md](../SKILL.md) describes for the host, and give the person the panel URL as a link in chat. The welcome screen explains original-text model access and asks the person to sign in with Google or GitHub (a signed-in person sees Continue); that sign-in records consent; [wait](#waiting-for-the-person) until the helper phase leaves `consent`. An explicit chat agreement instead is recorded with `journey.respond` consent while the person is signed in. While they are signed out, that call fails with `JOURNEY_SIGN_IN_REQUIRED` and records nothing: tell them to sign in on the welcome screen, which records the consent, and keep waiting. In a build with no sign-in client, Continue or a chat agreement alone records consent. Never scan real sources merely because this document is being edited or tested.
 
 ## Waiting for the person
 
@@ -15,23 +15,23 @@ Whenever the next step is the person's panel decision before Ready to send (cons
 
 ### Handing off at Ready to send
 
-At `ready-to-send`, `send` or `sending` the AI work is done: `await` returns at once, without waiting, with `handoff: {panel: {url, pid, started}, next: "end-turn"}`. Before it reports this, the helper runs `journey.serve --detach` with `{journeyId}` input through the paired CLI, which reuses the detached host that already serves the journey or starts one, so hosts that stop a turn's processes when it ends (Codex) keep the panel. When `started` is true the panel moved to a new URL: open it in the App browser and link it. Then end the turn at once with one chat line, roughly "Everything is reviewed. Press Send in the panel to package and upload; nothing more is needed here." Do not wait through `send` or `sending`, never ask for a chat reply and never say that nobody pressed Send. If `await` fails with `PANEL_HOST_DETACH_FAILED`, say in one line that the panel may stop when this turn ends and that running `/tacitt` again reopens it. A Work the person later moves out of Drop, or a failed Work they retry, needs reading again: the panel says to run `/tacitt` again, and the next run resumes from helper `status`.
+At `ready-to-send`, `send` or `sending` the AI work is done: `await` returns at once, without waiting, with `handoff: {panel: {url, pid, started}, next: "end-turn"}`. Before it reports this, the helper runs `journey.serve --detach` with `{journeyId}` input through the paired CLI, which reuses the detached host that already serves the journey or starts one, so hosts that stop a turn's processes when it ends (Codex) keep the panel. When `started` is true the panel moved to a new URL: open it in the App browser and link it. Then end the turn at once with one chat line, roughly "Everything is reviewed. Press Send in the panel to package and upload; nothing more is needed here." When the output has `leftOutSessions` (the sessions of Works whose read failed, printed only when above zero), the line starts with that count instead, roughly "N sessions could not be prepared and are not part of this Send; the panel lists them with a Retry. The rest is reviewed. Press Send in the panel to package and upload." Do not wait through `send` or `sending`, never ask for a chat reply and never say that nobody pressed Send. If `await` fails with `PANEL_HOST_DETACH_FAILED`, run helper `status` first; when it has `leftOutSessions`, say that count as above, then say in one line that the panel may stop when this turn ends and that running `/tacitt` again reopens it. A Work the person later moves out of Drop, or a failed Work they retry, needs reading again: the panel says to run `/tacitt` again, and the next run resumes from helper `status`.
 
 ## Scan scope
 
 After source consent, complete [remote-worker host consent and collection](remote-workers.md) before any classification freeze. Then follow the [classification protocol](classification.md) for freezing, deterministic routing, bounded evidence, worker publication, reconciliation and final metadata. Reconciliation starts immediately when unresolved-root judgments and requested evidence finish, while known metadata may still run. Once every known-project metadata answer exists, `ingest --stage classification` publishes the known Works while unresolved roots wait in one unread `Still being grouped` Work (`partial: true`); the complete proposal follows when its metadata is ready and keeps the scope confirmation. Use the [model policy](../SKILL.md#subagent-model-policy) throughout.
 
-A concise stage card explains the current next step and Public/Private/Drop meanings without claiming privacy scanning is complete before it runs. The panel lists compact Works with inline Public/Private/Drop dropdowns preselected from Agent recommendations or the latest explicit user choice. Descriptions also appear on the list; reasons stay in details, where the visibility dropdown sits beside the title and sessions are always expanded. Rendering a recommendation is not a user decision. As soon as the known Works (or the complete proposal) are ingested, record `scope-confirm` for the current revision and start the scan. Scope confirmation does not confirm Public: signed-in account facts seed confirmed Private, confirmed Public when every root session is already Public on the account (the panel says it came from the profile), suggested Public when any root is a new session, or Private with a visible mixed-access conflict; no history uses model recommendations, and signed-out journeys continue without inheritance. Model Public and partial account Public stay unconfirmed. Ask the person to choose visibility for each suggested-Public Work in the panel. Never choose Public on their behalf or through delegation; model Private may confirm immediately. Never confirm an older revision or quietly leave out unresolved roots: they stay in the `Still being grouped` Work until the complete proposal places them. A Work the complete proposal extends keeps the person's choices and is read again with its new sessions. The person may change Public/Private/Drop in the panel until Send, or ask the agent to edit classification before scanning starts. Drop stops that Work's scan (its read results stay); a Work moved out of Drop is read by a running `journey.prepare`, or run it again when the helper reports it unread.
+A concise stage card explains the current next step and Public/Private/Drop meanings without claiming privacy scanning is complete before it runs. The panel lists compact Works with inline Public/Private/Drop dropdowns preselected from Agent recommendations or the latest explicit user choice. Descriptions also appear on the list; reasons stay in details, where the visibility dropdown sits beside the title and sessions are always expanded. Rendering a recommendation is not a user decision. As soon as the known Works (or the complete proposal) are ingested, record `scope-confirm` for the current revision and start the scan. Scope confirmation does not confirm Public: signed-in account facts seed confirmed Private, confirmed Public when every root session is already Public on the account (the panel says it came from the profile), suggested Public when any root is a new session, or Private with a visible mixed-access conflict; no history uses model recommendations. A failed account read (`ACCOUNT_ACCESS_UNAVAILABLE`) or, in other journeys, a signed-out one (`ACCOUNT_SIGNED_OUT`) refuses `scope-confirm` and changes no Work: say so in one line, run `scope-confirm` once more as Retry, then wait for the person; there is no way to continue without the profile. Signed-out scope confirmation continues without inheritance only when the journey consent has no subject. This covers journeys started without a sign-in client or before sign-in was required. A caller with no client still stops consent that has a subject. Model Public and partial account Public stay unconfirmed. Ask the person to choose visibility for each suggested-Public Work in the panel. Never choose Public on their behalf or through delegation; model Private may confirm immediately. Never confirm an older revision or quietly leave out unresolved roots: they stay in the `Still being grouped` Work until the complete proposal places them. A Work the complete proposal extends keeps the person's choices and is read again with its new sessions. The person may change Public/Private/Drop in the panel until Send, or ask the agent to edit classification before scanning starts. Drop stops that Work's scan (its read results stay); a Work moved out of Drop is read by a running `journey.prepare`, or run it again when the helper reports it unread.
 
 ## Scan
 
-Run `journey.prepare` after scope confirmation to perform static processing only for selected Works; while grouping continues it waits and also prepares the Works the complete proposal publishes or extends. Keep this owned operation running and use `review.mjs next-packs` as each session publishes authenticated static receipts and review input, without waiting for the remaining sessions in its Work or creating ZIPs. Dispatch printed prompts verbatim, ingest completed answers and refill available slots within the shared sixteen-child ceiling across phases. The helper saves task files and repeatable batched requests; do not replace it with custom scripts.
+Run `journey.prepare` after scope confirmation to perform static processing only for selected Works; while grouping continues it waits and also prepares the Works the complete proposal publishes or extends. Use the compact `result:"receipt"` response for this owned preparation. Keep this operation running and use `review.mjs next-packs` as each session publishes authenticated static receipts and review input, without waiting for the remaining sessions in its Work or creating ZIPs. Dispatch printed prompts verbatim, ingest completed answers and refill available slots within the shared sixteen-child ceiling across phases. The helper saves task files and repeatable batched requests; do not replace it with custom scripts.
 
-To complete the AI scan stage independently, run the automatic loop: call `review.mjs ingest --run PRIVATE_RUN --agents auto --wait-ms 30000`, spawn one fresh native child per returned `packs[].prompt` with the pinned `agentProfile` (Claude Code: a subagent on the fast-tier model at low effort), then call the same command again while those children work. Do not wait for a whole wave; the command itself waits until a child publishes, new input arrives or a card batch comes due. Keep this loop tight: dispatch returned prompts and call the command again in the same turn, with no unrelated work in between, because idle slots directly extend the scan. It counts free AI slots within sixteen after outstanding scan packs, unacknowledged lost children and active or planned card children; background static processing uses separate CPU workers and never reduces AI slots. Pass `--card-agents N` for active card children so auto refill subtracts them from the same sixteen slots; for other stage children use explicit `--agents N` with the actual free count. Follow returned `ingested[].prompt`, `retryPrompt` or repair instructions before calling again. An unanswered pack becomes `lost` after 450 seconds without a draft, or 450 seconds without a change to its current draft. Stop or close each reported lost child, then pass `ingest --ack-lost ID[,ID...]`; the helper retains its slot until acknowledgement and generates a fresh replacement task. Lost notifications repeat until acknowledged, including after restart. Never redispatch the old task. When `cardBatch.ready` is true, dispatch at most `cardBatch.plannedAgents` [card drafting](#decision-cards) children in the same turn as scan refills, queueing the rest. The helper reserves one planned card slot by default; request more with `--planned-card-agents N` before scan refill. Call `review.mjs ingest --agents auto --card-agents N --wait-ms 0` immediately after dispatch and between Main-owned reconciliation steps; do not wait for the whole card batch before refilling scans. While `cardBatch.ready` is false, keep dispatching packs even when `cardBatch.uncovered` grows. Stop looping at `next: "done"`, `paused`, `report-blocked` or a repair. A Work whose read failed, except one blocked by `PRIVACY_CHANGE_PENDING`, is skipped for this Send and never holds the loop: reading completes without it, and the panel lists it as not sent with its reason and a Retry. Do not wait for a decision about it. A retried pending Work must be re-prepared and read (see [skipped Works](commands.md#scan-results)); no time box or pending-Work skip is allowed. All model privacy results include a disposition and reason. See [method](b-method.md).
+At the first ready unit and each completion, run the [shared dispatch loop](parallel-review.md#dispatch-while-stages-overlap). Pass the actual free count to `review.mjs ingest --run PRIVATE_RUN --agents FREE_SLOTS --card-agents ACTIVE_CARDS` while any child is live or the host supplies fewer than sixteen slots. Automatic capacity is for a verified empty pool with all sixteen slots free. Spawn one fresh native child per returned `packs[].prompt` using the pinned `agentProfile`; then check both queues again. When the only runnable work is already in flight, wait for a native completion for up to 30 seconds, then recount free host slots before ingesting. Background static processing uses separate CPU workers. Follow returned `ingested[].prompt`, `retryPrompt` or repair instructions before calling again. Bind every launched reader and report verified closure through the [reader recovery contract](parallel-review.md#recovery). Lost readers retain their slots until Main confirms closure. Accepted writes and pending repairs keep their recovery authority. A confirmed technical failure may release the remaining batches for a fresh attempt. Refused units remain visibly incomplete and receive no new reader. Launch independent work first, then handle ongoing repair. When `cardBatch.ready` is true, dispatch at most `cardBatch.plannedAgents` [card drafting](#decision-cards) children in the same turn as scan refills, queueing the rest. The helper reserves one planned card slot by default; request more with `--planned-card-agents N` before scan refill. Ingest with the actual remaining capacity immediately after dispatch and between bounded Main-owned reconciliation steps; do not wait for the whole card batch before refilling scans. While `cardBatch.ready` is false, keep dispatching packs even when `cardBatch.uncovered` grows. Handle `done` and `paused` at their normal boundaries. At `report-blocked`, report the unresolved units and follow the panel decision in `review-interrupted`. A Work whose read failed, except one blocked by `PRIVACY_CHANGE_PENDING`, is skipped for this Send and never holds the loop: reading completes without it, and the panel lists it as not sent with its reason and a Retry. Do not wait for a decision about it. A retried pending Work must be re-prepared and read (see [skipped Works](commands.md#scan-results)); no time box or pending-Work skip is allowed. All model privacy results include a disposition and reason. See [method](b-method.md).
 
 ## Decision cards
 
-Cards come while reading continues, in a few larger batches (ADR 0234, accepted). A batch is due when the review loop reports `cardBatch.ready` or the helper phase is `cards`. While reading continues, `cardBatch.ready` needs no batch still open and either 30 Pending values no published card covers that have waited 2 minutes, or 5 minutes since such values started waiting; the wait starts again after every batch. Once the journey has ten questions it waits for reading to complete, or for 200 such values, then one final batch extends the published cards. After reading, any uncovered value makes a batch due, so none reaches Send uncovered. Scan children receive the answered questions with their answers, so a value that fits one takes that answer instead of staying Pending. Run helper `tasks --stage cards`: it drafts only uncovered Pending values, at most 200 per batch; the rest wait for the next batch. Main may delegate internal drafting to bounded fresh native workers using the run's pinned fast-tier model and explicit low effort. Workers publish internal drafts covering each assigned Pending key exactly once; Main retains ingestion and global reconciliation ownership. These drafts are not browser cards. Card tasks include existing policies. Reuse an existing card ID with its question and options (trimmed text must match; option order may differ) for values extending that policy. An extend-only draft is accepted directly by `consolidate --stage cards`: when it returns `readyForIngest: true` with no tasks, ingest immediately, without another drafter, global reconciliation, confirmation or resolution. New keys take the current card answer in the CLI and inheritance is recorded; existing unticked keys keep their exceptions, which do not transfer to new keys of another type. A new question still requires review and an answer; unknown values are never presumed extensions. Reading and redaction still finish before upload (ADR 0251). When consolidation returns a global task, read its complete compact candidate catalog, including `existingCards` (published questions with the person's answer, if any). Assign every candidate either to a new question or, when it falls under an existing question's category and retention policy, to that card through `extend`; extended values take its answer at once. Create at most `newCardLimit` new questions (five per batch, ten for the journey), fewer when fewer distinct decisions suffice. Preserve meaningful privacy distinctions without splitting by individual values, technical types or batch boundaries. You choose the wording, option labels and examples; the panel only presents them. Give every new card a `suggestion` (hide or keep, with a short source naming the Work and, when known, the session) unless the evidence is evenly split; it is only a suggestion, never an answer. Final cards reference draft IDs through `sourceCardIds`, each exactly once. The CLI expands original term keys and validates complete disjoint coverage, so Main does not retranscribe keys. Publish the global task answer, rerun consolidation until `readyForIngest: true`, then `ingest --stage cards`, which appends the batch. `ingest` submits only values that are still open: a later scan pack may have hidden some since drafting, and a batch with no open value left is recorded as `skipped`. Each normalized value goes to one card, and a value the journey records as the person's own identity goes only to the card that asks about it. Never put the person's own identity and other people on one card: an own-identity question covers only values tied to the person's own signals, and a value you are unsure about goes with other people. Consolidation candidates carry `identity: "own"` or `"people"`; the helper splits a draft covering both, and refuses a final card that merges them with `CARD_IDENTITY_MIXED`. Common review or chat jargon (for example LGTM) and generic words are not privacy values: never use them as examples or as a question's subject, and cover them under the card that fits their context. Examples show short values, not sentences; the helper drops repeats that differ only in case, spacing, hyphens or underscores and cuts examples longer than 80 characters with an ellipsis. A batch the CLI still refuses (for example after a Drop) is retired: the next `tasks --stage cards` (with or without `--refresh` while reading continues) drafts the current uncovered Pending values. Oversized global input fails explicitly; never substitute per-batch publication.
+Cards come while reading continues, in a few larger batches (ADR 0234, accepted). A batch is due when the review loop reports `cardBatch.ready` or the helper phase is `cards`. While reading continues, `cardBatch.ready` needs no batch still open and either 30 Pending values no published card covers that have waited 2 minutes, or 5 minutes since such values started waiting; the wait starts again after every batch. Once the journey has ten questions it waits for reading to complete, or for 200 such values, then one final batch extends the published cards. After reading, any uncovered value makes a batch due, so none reaches Send uncovered. Scan children receive the answered questions with their answers, so a value that fits one takes that answer instead of staying Pending. Run helper `tasks --stage cards`: it drafts only uncovered Pending values, at most 200 per batch; the rest wait for the next batch. Main may delegate internal drafting to bounded fresh native workers using the run's pinned fast-tier model and explicit low effort. Workers publish internal drafts covering each assigned Pending key exactly once; Main retains ingestion and global reconciliation ownership. These drafts are not browser cards. Card tasks include existing policies. Reuse an existing card ID with its question and options (trimmed text must match; option order may differ) for values extending that policy. An extend-only draft is accepted directly by `consolidate --stage cards`: when it returns `readyForIngest: true` with no tasks, ingest immediately, without another drafter, global reconciliation, confirmation or resolution. New keys take the current card answer in the CLI and inheritance is recorded; existing unticked keys keep their exceptions, which do not transfer to new keys of another type. A new question still requires review and an answer; unknown values are never presumed extensions. Reading and redaction still finish before upload (ADR 0251). When consolidation returns a global task, use [read-only assistance during scanning](parallel-review.md#dispatch-while-stages-overlap) for substantial comparisons. Main reviews its complete compact candidate catalog, including `existingCards` (published questions with the person's answer, if any). Assign every candidate either to a new question or, when it falls under an existing question's category and retention policy, to that card through `extend`; extended values take its answer at once. Create at most `newCardLimit` new questions (five per batch, ten for the journey), fewer when fewer distinct decisions suffice. Preserve meaningful privacy distinctions without splitting by individual values, technical types or batch boundaries. You choose the wording, option labels and examples; the panel only presents them. Give every new card a `suggestion` (hide or keep, with a short source naming the Work and, when known, the session) unless the evidence is evenly split; it is only a suggestion, never an answer. Final cards reference draft IDs through `sourceCardIds`, each exactly once. The CLI expands original term keys and validates complete disjoint coverage, so Main does not retranscribe keys. Publish the global task answer, rerun consolidation until `readyForIngest: true`, then `ingest --stage cards`, which appends the batch. `ingest` submits only values that are still open: a later scan pack may have hidden some since drafting, and a batch with no open value left is recorded as `skipped`. Each normalized value goes to one card, and a value the journey records as the person's own identity goes only to the card that asks about it. Never put the person's own identity and other people on one card: an own-identity question covers only values tied to the person's own signals, and a value you are unsure about goes with other people. Consolidation candidates carry `identity: "own"` or `"people"`; the helper splits a draft covering both, and refuses a final card that merges them with `CARD_IDENTITY_MIXED`. Common review or chat jargon (for example LGTM) and generic words are not privacy values: never use them as examples or as a question's subject, and cover them under the card that fits their context. Examples show short values, not sentences; the helper drops repeats that differ only in case, spacing, hyphens or underscores and cuts examples longer than 80 characters with an ellipsis. A batch the CLI still refuses (for example after a Drop) is retired: the next `tasks --stage cards` (with or without `--refresh` while reading continues) drafts the current uncovered Pending values. Oversized global input fails explicitly; never substitute per-batch publication.
 
 Each card has contextual Hide/Keep rules and concise examples. The panel is English: write every card's question, option labels (`Hide`, `Keep`), rules and context in English even when the person chats in another language, and keep example values verbatim. The panel shows every covered value as a chip the person can untick, the number of values each answer applies to, and the suggested answer when present. A panel answer applies at once: Hide makes the covered values Hidden, Keep keeps them, and an unticked value takes the other option. When the same value is covered by cards with different answers, Hide wins, except for a value equal (ignoring case) to one of the journey's Work project names that a card answered Keep covers: it stays Kept, after mandatory protection and explicit per-value rules (ADR 0202). The last answer completes the deck; there is no chat confirmation and no resolution step for answered cards. Never answer on the person's behalf. To regenerate an unanswered deck, explicitly use `tasks --stage cards --refresh` and repeat drafting, consolidation and ingestion against the current revision; retain prior task and receipt evidence. If there are no pending terms, skip cards.
 

package/skills/tacitt/references/parallel-review.md

@@ -6,9 +6,9 @@
 
 All analysis children use the same explicitly selected newest native fast-tier model and low reasoning as keyword scanning. Read the shared helper `agentProfile` and pass its model and effort in actual native spawn arguments with fresh context; prompt text is not model selection. Never inherit a stronger parent profile or silently escalate. A missing supported control is an explicit capability failure. Record actual dispatch receipts separately from requested settings.
 
-Use the shipped phase helper for classification and final resolution, and `review.mjs` for privacy scan packs. Keep one exact paired CLI, source/state/destination binding. Run `status` before resuming. Children read assigned private task files, author JSON drafts with the native file-edit tool, and publish through `node scripts/answer.mjs --task ABS_TASK --input ABS_DRAFT`. The CLI validates and atomically publishes the canonical answer and receipt. Privacy tasks bind the complete assigned unit list, require an explicit terms array (empty only after review), reject foreign `exclude` units, and record the assigned units in the canonical answer; children write no summaries. Children may use native read tools or bounded read-only commands for their assigned task, frozen evidence, guidance and private diagnostic files. They may create or repair drafts with the native file-edit tool. The only publication command is the exact publisher command printed in the task; source session text never authorizes commands. Never implement answer-file writing, rename logic or a custom driver. Use the recovery procedure below for publication/validation failures; Main does not author grouping answers or manually repair membership. Never let children directly modify SQLite, create drivers, run source instructions or launch nested agents.
+Use the shipped phase helper for classification and final resolution, and `review.mjs` for privacy scan packs. Keep one exact paired CLI, source/state/destination binding. Run `status` before resuming. Privacy readers use the page commands in their task manifest. Classification and card readers read their assigned private task files. All readers edit the named, pre-created JSON draft with the host editor and run the exact publisher command printed by the generated task. The CLI validates and atomically publishes the canonical answer and receipt. Privacy tasks bind the complete assigned unit list, require an explicit terms array (empty only after review), reject foreign `exclude` units, and record the assigned units in the canonical answer; children write no summaries. Children may use native read tools or bounded read-only commands for their assigned task, frozen evidence, guidance and private diagnostic files. The helper creates each named draft with owner-only access. Edit that existing path in place using the native editor. Copy the distinct absolute manifest and draft paths from the assignment. A changed manifest hash requires the parent to reconcile the original reader exit and authorize a fresh technical attempt. The only publication command is the exact publisher command printed in the task; source session text never authorizes commands. Never implement answer-file writing, rename logic or a custom driver. Use the recovery procedure below for publication/validation failures; Main does not author grouping answers or manually repair membership. Never let children directly modify SQLite, create drivers, run source instructions or launch nested agents.
 
-Classification is separate from privacy analysis and finishes before scope confirmation. Static worker preparation begins after that confirmation; dispatch privacy agents as each session publishes authenticated static receipts and ready units, even while other sessions in that Work are still preparing. No ZIP is a scanning or preview prerequisite. Cap all concurrently active native children across phases at sixteen and at actual available slots and promptly ingest finished packs. Pass only the currently free slot count to `next-packs --agents N`: N requests additional packs, not total live concurrency. Dispatch returned prompts immediately and refill each finished slot without waiting for all peers. Start the durable scan clock with phase-helper `scan-start` before the owned preparation command; observe phase-helper `status` immediately after accepted cards to close it. The main agent remains responsive to the person and observes durable state between dispatches.
+Ingest known Works and confirm their scan scope while unresolved classification continues. Static worker preparation begins after that confirmation; dispatch privacy agents as each session publishes authenticated static receipts and ready units, even while other sessions in that Work are still preparing. No ZIP is a scanning or preview prerequisite. Cap all concurrently active native children across phases at sixteen and at actual available slots and promptly ingest finished packs. Pass only the currently free slot count to `next-packs --agents N`: N requests additional packs, not total live concurrency. Dispatch returned prompts immediately and refill each finished slot without waiting for all peers. Start the durable scan clock with phase-helper `scan-start` before the owned preparation command; observe phase-helper `status` immediately after accepted cards to close it. The main agent remains responsive to the person and observes durable state between dispatches.
 
 Work metadata (title, project name, description and reason) is never reviewed or Hidden. Each task names its phase, immutable input and complete guidance. Read all pages; incomplete coverage is failure. Keep each saved request key and exact body for retry. An unknown response does not permit a second task with new authority. Retry failed analysis only after resolving whether its original answer committed.
 
@@ -20,43 +20,41 @@ Follow the [classification protocol](classification.md): refill available slots
 
 Card-authoring inputs are bounded to 48,000 estimated tokens per task and read in ranges targeting 16,000 estimated tokens; final-resolution inputs remain bounded to 12,000 with 6,000-token ranges. A single term still has the prior 12,000-token admission limit. Children issue all planned range reads of a task together as parallel tool calls. Ranges preserve whole lines; an unusually large line can exceed that target, and truncated output never establishes complete review. Both task formats encode terms as one complete compact JSON object per line. Card drafting terms carry a short `ref`, type, value, reason, one short source excerpt and source count; drafts list `termRefs`, and the publisher maps refs back to exact term keys. Final-resolution tasks retain the confirmed answer, full guidance, assigned term fields, representative source evidence and total source count. Bounded fresh native workers may author internal card drafts using the same pinned fast-tier model and explicit low effort; Main must read the complete candidate catalog of each batch with the published `existingCards` and exclusively own global semantic reconciliation and ingestion. Internal drafts never publish separate browser decks; final-resolution subagents settle only their assigned keys. No task may omit keys to fit a budget or manufacture user rules.
 
-When a card batch becomes due, the scan helper reserves upcoming card children
-before refilling scans: `--planned-card-agents N` requests their count (default
-one), and `cardBatch.plannedAgents` returns the capacity available. Dispatch at
-most that many card children in the same turn as scan packs and queue remaining
-card tasks. Pass the actual active card count as `--card-agents N` with
-`--agents auto`, and call scan `ingest --wait-ms 0` at once after dispatch and
-between Main-owned reconciliation steps. Main retains global reconciliation and
-ingestion. Keep all card thresholds unchanged. Gather returns when the first slot
-frees; dispatch its replacement immediately without waiting for a wave.
+## Dispatch while stages overlap
+
+Main runs one dispatch loop across classification, scanning and card work. On each native completion, new input or preparation milestone, check receipts and ready tasks. Keep the existing classification priority for unresolved roots, requested evidence and reconciliation. Admit known Works as soon as their metadata is published. Continue launching ready privacy packs while grouping or its repairs run.
+
+1. Count native capacity across the whole tree, including a delegated Main, other live children and reservations awaiting launch. Use the smaller of the host's available slots and the space left under sixteen. Maintain one owner per task; publication alone does not prove child exit. Static preparation uses separate CPU workers.
+2. After allocating slots to other stage tasks, pass the remaining free count to `review.mjs ingest --agents FREE_SLOTS --card-agents ACTIVE_CARDS`. This single call ingests and refills. Use zero for ingestion only. Bare aggregate `ingest` and `--agents auto` infer capacity; use them only when all sixteen native slots are confirmed free and no launch is outstanding. While any child is live, use a bounded native completion wait, then recount and pass the numeric free count. Never infer a free slot from the configured maximum alone.
+3. For a due batch, request ready card capacity with `--planned-card-agents N`. The default reserves one slot. Open the due batch promptly. Once it is open the helper stops reserving for a new batch. If it produces fewer unowned drafts than planned, run ingest again immediately with the actual remaining capacity. When card drafts and privacy packs are both ready, advance both in the same dispatch when capacity permits. Keep request counts within the ready card backlog and give surplus capacity to ready work in the other stage. Launch at most `cardBatch.plannedAgents` card children alongside every returned privacy pack. On an already-open card batch, count its queued drafts explicitly before assigning remaining slots to scans. Recompute from the host at the next completion.
+4. If the complete global card catalog needs substantial analysis while other work is ready, assign one fresh pinned child the read-only comparison of all candidates against `existingCards`. Give it only the task's bounded catalog, existing policies and output schema. Ask for a proposal referencing candidate IDs, without canonical publication, CLI mutations or panel actions. Count this child in capacity. Main keeps refilling, reviews the complete catalog and proposal in bounded portions between dispatches, verifies every mapping and policy, then solely publishes the global answer and ingests it. For an extend-only batch already ready for ingestion, ingest immediately.
+5. Dispatch unowned ready work before tracing diagnostics, writing timing reports or waiting. Run ingest again without waiting after each dispatch and when a child exits. If only running children or new input can advance the journey, wait up to 30 seconds for the first change; return to both queues immediately.
+
 Call ingest at least every 60 seconds while any children run. An unanswered pack
 becomes lost after `LOST_PACK_TIMEOUT_MS` (450000 ms) without a current draft, or
 `DRAFT_HEARTBEAT_TIMEOUT_MS` (450000 ms) since the current draft last changed.
-A changing draft preserves the lease. Saved writes, published answers and repair
-work retain their existing recovery authority. A lost pack keeps its units and
-native slot until Main stops or closes the child and passes
-`ingest --ack-lost ID[,ID...]`. Acknowledgement is durable and idempotent, then
-releases owned units for a fresh task identity. `lost` and `freedSlots` repeat
-lost IDs only until acknowledgement, including after restart. These notifications
-never add capacity; `freeSlots` excludes unacknowledged lost children. Never ingest
-a late draft from a retired task; only its fresh replacement owns reissued units.
+A new page read or a changing draft preserves its lease. A timeout fences the old answer, but is not proof of native exit. `lost` keeps reporting its pack ID and native reader ID until closure. `freeSlots` excludes it; `freedSlots` does not announce a timeout as released capacity.
+
+On every spawn, immediately run `reader-start PACK --reader NATIVE_ID` with the host's receipt. For follow-up work on the same native reader, pass a unique `--turn TURN_ID` to both commands. A resumed reader may reuse its native ID only with a distinct turn after a durable pending repair; stale turn callbacks are rejected. On a confirmed host close/exit, report `reader-exit PACK --reader NATIVE_ID --result published|retry|refused`. Use `published` only for verified private publication. Use `retry` for an exited technical failure with no pending write. Use `refused` for a privacy or authorization refusal: never transfer that input to another reader. These commands operate on the private run with `--run PRIVATE_RUN`. No answer text or raw refusal belongs in status. Continue dispatching independent packs while a repair is pending.
 
 ## Recovery
 
+After a parent restart, compare `status.openPacks` with the host's native receipts. If binding was interrupted or an older lost pack has no mapping, bind its original reader ID and submit the verified exit, even if the pack is already marked lost. Do not guess its outcome from elapsed time. Use `ingest --ack-lost ID[,ID...] --agents FREE_SLOTS --card-agents ACTIVE_CARDS` only for unbound lost packs proven never spawned or technically closed without a recoverable native ID. Never use this technical retry for a known refusal. A known refusal without a host ID can be bound using a unique local reconciliation receipt recording its verified closure.
+
+Each technical reissue receives a fresh pack ID after the paired CLI has fenced the prior attempt. The first two failures requeue unfinished units; the third preserves them as visibly unreviewed. The panel offers Retry for exhausted units of that Work and pack, resetting their budget. A refused unit remains unreviewed until the person changes review scope/policy or drops that Work. When all remaining work is held, the active phase is `review-interrupted`: wait for the panel decision. Never mark coverage complete or continue to Send on these holds.
+
 1. Run helper `status`, inspect saved publication receipts and committed CLI results, and reconcile any in-flight native child before redispatch. A child final message without a valid publication receipt is not completion. If it stopped after a truncated read, resume the same child to read the remaining bounded ranges and publish; do not accept a reading-only handoff. A yielded `journey.prepare` process is still owned work, not permission to launch another.
 2. Distinguish unknown transport outcomes from definitive validation refusals. Replay an unknown business write with the exact saved key and body through the helper before freshness checks or refresh; never delete requests or create new authority to bypass it. If transport remains unavailable, preserve the pending operation and report the blocker without an unbounded retry loop. A known invalid response must not be blindly retried unchanged.
 3. Generated classification publishers use absolute task and draft paths with the exact paired executable, preserving task binding through directory aliases. For missing task, descriptor or draft diagnostics, verify that directory and filename before retrying; never infer a filesystem race from a mistyped path. For publication errors before ingestion, send actionable diagnostics to the original child to repair its complete draft and republish under the same task. After a definitive metadata-ingestion rejection, use the refresh procedure below instead of republishing against the old task. Preserve sensitive source-supported findings, original evidence and full coverage. Each repair must address a concrete diagnostic or add needed evidence. If a repair returns the same failure with no changed evidence or corrective action, stop that repair loop, report the exact unresolved blocker, and continue independent work. Semantic ambiguity requires the person's clarification; a deterministic helper failure requires technical recovery, not invented answers or human certification of mechanics.
-4. If the original child no longer exists, first establish from durable receipts that its answer is absent or definitively rejected and that no unknown business write remains. Then assign a fresh child the same current task authority, immutable inputs, pinned model/effort, previous draft and diagnostics. If a documented refresh has generated a replacement task, that new task/digest is the current authority; never reuse the superseded task. Do not duplicate a live worker or assign a new task/request key merely because a turn ended. Main retains dispatch and ingestion ownership and never repairs membership itself.
+4. If the original child no longer exists, first establish from durable receipts that its answer is absent or definitively rejected and that no unknown business write remains. For a recoverable classification or card task, assign a fresh child the same current task authority, immutable inputs, pinned model/effort, previous draft and diagnostics. For a privacy pack, record the confirmed reader exit and let the helper choose the fresh attempt or unresolved disposition. If a documented refresh has generated a replacement task, that new task/digest is the current authority; never reuse the superseded task. Do not duplicate a live worker or assign a new task/request key merely because a turn ended. Main retains dispatch and ingestion ownership and never repairs membership itself.
 5. Use only documented helper refresh for a definitive stale/rejected result or changed inputs. Retain old tasks, requests and receipts; reuse accepted results where the helper permits it. Refresh cannot bypass unknown writes, current human gates or immutable confirmed scope. Never restart the whole journey to test a later stage.
 
-Privacy task source fields are wrapped at Unicode code-point boundaries. Planned reads also impose a UTF-8 byte ceiling below the requested tool-output allowance, because dense punctuation can exceed the prose token estimate. Use the generated task and its planned ranges, not the full source receipt JSON; all planned source fields remain required.
+The generated privacy manifest lists an exact publisher command, an editable draft path and bounded page commands. Use every `--read` command for the assigned units. Check for truncation and verify the READ_RECEIPT footer before adding that page receipt to the draft. A complete result requires ordered receipts for each assigned unit, including a unit with zero findings. Submit through the manifest's paired publisher and verify its successful publication receipt.
 
 ## Input scope and static evaluation
 
-Read only the generated task and its exact read plan; never substitute raw batch
-JSON or source files. The CLI owns main-prose admission, exact compaction and complete source proof. Do not summarize, sample, deduplicate or rewrite assigned content yourself to reduce scan cost; only CLI-authenticated exact compaction may reduce repeated input while preserving every source occurrence.
-Report a truncated read as incomplete and use the supplied bounded ranges; never
-mark unobserved text reviewed. Output retention does not expand model input.
+Privacy readers read the generated manifest and use its page commands exclusively for assigned source. Classification and card readers follow the bounded ranges in their own task instructions. The CLI owns main-prose admission, exact compaction and complete source proof. Do not summarize, sample, deduplicate or rewrite assigned content yourself to reduce scan cost; only CLI-authenticated exact compaction may reduce repeated input while preserving every source occurrence.
+If a privacy page is truncated, repeat its bounded command with the specified tool output allowance. Report any remaining incomplete page with its identifier. Output retention does not expand model input.
 
 When the human requests a static-only measurement, run the pinned preparation
 operation and inspect its receipts without spawning privacy or card agents.
@@ -71,15 +69,11 @@ finished children have ended, including other stage workers and coordinators in
 the capacity limit; published answers alone do not prove a live child has ended.
 Zero slots performs ingestion only. Interrupted dispatch recovery returns no more
 than the requested slots and preserves the remaining reserved tasks. A pause,
-exhausted command budget, repair, partial answer or unknown write stops refill;
-follow the returned recovery instructions before dispatching. A later explicit
+exhausted command budget or unknown write stops refill. A repair or partial answer reserves its own slot while independent packs proceed. A later explicit
 `next-packs --agents FREE_SLOTS` remains available. Refill observes current input
 and guidance again; accepted results remain bound to existing source receipts.
 
-Privacy dispatch first fills each new pack to the existing 12,000 estimated-token
-read target before using another free native slot. Once those slots are occupied,
-append subsequent complete units to the least-loaded pack that still fits the
-90,000-token and 48-unit hard limits. Small inputs remain together to amortize
-instructions; one Work no longer monopolizes a pack while available slots stay
-idle. Unit text, source identity, necessary context and ordering within a pack
+Privacy dispatch assigns one complete ready unit per available slot before adding
+more units to the least-loaded pack that still fits the 90,000-token and 48-unit
+hard limits. Unit text, source identity, necessary context and ordering within a pack
 remain intact. This changes assignment only, not AI scope or the concurrency cap.

package/skills/tacitt/references/send.md

@@ -20,10 +20,10 @@ At `ready-to-send`, the person presses Send in the right panel; that one click n
 The panel shows the current stage and its next action, without navigable Review/Package/Send/Profile tabs. Account controls belong in the top-right avatar menu. Completion, once every included Work has acknowledged stored sessions and membership, presents the Visit your profile link and, while the profile still assesses, how many Works are assessed and which failed; do not add results/omitted detail disclosures beneath it (ADR 0233).
 
 1. The panel's single "Send N sessions" action approves the current decision digest (`package-confirm`) and invokes several-Work `journey.render`; the panel starts this in the background once Ready to send shows, and a click before it ends shows packaging progress as the first stage of Send (ADR 0213). Changed inputs invalidate approval. `send.prepare` binds the current journey revision, actual output digests and access. Show Public/Private, Drop, blocked and omitted Works before the click. A ZIP above 5 GiB remains blocked; zero sendable Works cannot start. Failed-read Works are omitted without waiting and listed with their reason and Retry; `PRIVACY_CHANGE_PENDING` still blocks recovery. Existing profile copies of omitted Works remain intact. Never split or omit silently.
-2. After packaging, the panel calls `send.start` only when the prepared included and omitted Works equal the ones the person saw when clicking; otherwise it shows the scope again for an explicit Send. Packaging completion, mounting or refreshing the panel never supplies this confirmation. Do not infer consent or click Send without explicit authorization for the displayed scope. The Skill journey has no local-files-only ending; that is the Manual flow.
+2. After packaging, the panel calls `send.start` only when the prepared included and omitted Works equal the ones the person saw when clicking; otherwise it shows the scope again for an explicit Send. Packaging completion, mounting or refreshing the panel never supplies this confirmation. Do not infer consent or click Send without explicit authorization for the displayed scope. The Skill journey has no local-files-only ending.
 3. If the account view cannot load, use Retry account to reload local status only. Do not start a new sign-in, switch accounts or recreate Send to recover a failed status read. If `sign-in`, the top-right account control starts the official device flow, opens the verification page in a new browser tab and shows the user code and link as fallback; Cancel sign-in is in the sign-in panel. The person completes official account authorization in the browser. Do not read passwords, tokens or account screenshots. After login, unchanged Send intent resumes automatically; no second identical Send is needed. For explicitly authorized CLI recovery, use `account.signIn --async` and its returned operation ID with `operation.get`/`operation.wait`; retain the same account and Send authority.
 4. Treat the progress bar as Work stages, not transferred bytes: each Work counts half once its sessions are stored and its membership is accepted, and fully once assessed. Uploaded Works can still be awaiting assembly or assessment. Keep queued, uploading, assessment and attention states distinct, including while paused or blocked. Do not report a stalled bar as a failed upload or invent an ETA. While active, the panel queries `send.get` and calls bounded `send.advance` for the current send ID when status permits. Durable revisions deduplicate concurrent callers. Preserve the Send's captured one-or-three transfer limit: reservation and ZIP PUT can overlap. A client FIFO serializes session completion and membership calls because they share the owner's global session revision. External writers can still cause fenced conflicts; the queue does not authorize rebasing. Up to three Works check assembly or assessment together (ADR 0244). Do not busy-loop; use journey events or a short bounded wait between unchanged remote status checks.
-5. Send compares approved local sessions with every page of the owner's completed inventory. Only new sessions or sessions whose bytes changed are uploaded. Unchanged Works upload no session bytes; moving a session updates membership without uploading unchanged bytes again. Send sets each selected Work's membership, then the server assembles the Work and runs the existing assessment flow. A removed Work stays blocked. A cross-access move or Work visibility change combined with content change blocks before upload; show the per-Work recovery buttons. Keep Private, as on your profile appears for Private account access; Make Public, as on your profile appears for Public account access and requires the person's panel click or conversation answer after the agent names the Work and asks, recorded with channel and time in `accessChoice`, with a warning that every session in the Work becomes Public, including new sessions. Leave out of this Send is always available; mixed account access offers only Leave out because neither choice matches. After changing a Work, Review a new Send and confirm it separately. Check again after changing your profile rechecks externally changed access. Do not ask the person to choose a target. A previously explicit Public choice need not be repeated, and neither does Public confirmed because every root session was already Public on the account, but every still-unconfirmed account or model Public suggestion needs the person's per-Work choice before Send. Send does not retire or hide earlier Works merely because they are absent locally or Dropped from this Send; do not promise global replacement.
+5. Send compares approved local sessions with every page of the owner's completed inventory. Only new sessions or sessions whose bytes changed are uploaded. Unchanged Works upload no session bytes; moving a session updates membership without uploading unchanged bytes again. Send sets each selected Work's membership, then the server assembles the Work and runs the existing assessment flow. A removed Work stays blocked. A cross-access move, or any difference between a Work's access and its access on the profile (even when the profile Work already holds every session), blocks before upload; Send never changes stored access. Show the per-Work recovery buttons. Keep Private, as on your profile appears for Private account access; Make Public, as on your profile appears for Public account access and requires the person's panel click or conversation answer after the agent names the Work and asks, recorded with channel and time in `accessChoice`, with a warning that every session in the Work becomes Public, including new sessions. Leave out of this Send is always available; mixed account access offers only Leave out because neither choice matches. After changing a Work, Review a new Send and confirm it separately. Check again after changing your profile rechecks externally changed access. Do not ask the person to choose a target. A previously explicit Public choice need not be repeated, and neither does Public confirmed because every root session was already Public on the account, but every still-unconfirmed account or model Public suggestion needs the person's per-Work choice before Send. Send does not retire or hide earlier Works merely because they are absent locally or Dropped from this Send; do not promise global replacement.
 6. Network failure preserves completed server sessions and durable Send progress; a timeout or lost connection shows as Connection interrupted and retries automatically, and the focused host continues a confirmed upload even when the panel is closed or reloaded. `send.resume` retries only unfinished work; do not create another Send just because a response was lost. If output/scope changed, prepare a new concrete scope and reconfirm it. Partial successes remain visible.
 7. Panel Pause and Resume actions use `send.pause` and `send.resume`. Pause remains available while an upload request is in flight and stops remaining unsubmitted work; it does not retract transmitted bytes or stop submitted assessments. Wait for the current request to settle before Resume becomes available. Resume queries completed session inventory and the current assembly/assessment state. A successfully completed session is not uploaded again after a crash, even if its local acknowledgement was lost. A failed or partial assessment is reported as such and never reopens the completed journey. Offer Review a new Send with separate confirmation, including unchanged scope, when recovery needs a fresh assembly or assessment.
 8. Finish once every included Work has acknowledged stored sessions and its exact membership request has been accepted: the Send is `completed` and the journey ends under ADR 0233. Assembly and assessment continue in the background and never delay that boundary. A session assembly scan ID proves neither profile inclusion nor a verified profile URL. Report successful assessment only when observed; do not invent a Profile result. Use a deployment-configured profile URL only when actually returned and verified. Report omitted or failed Works accurately. Finish at the browser Profile result; `journey.files {journeyId,workId}` gives verified absolute primary/companion paths only when the person asks for the packaged files. Do not hardcode a historical website hostname or call a ZIP acceptance response a completed report.
@@ -49,8 +49,13 @@ sessions have that access. Do not expose the other Work's title, path or ID.
 Local conflicting choices refer to another Work in this Send; legacy records
 without a count must not invent one. `SESSION_MOVE_ACCESS_HELD` means this Work
 waits for another Work's conflict and has no conflict details of its own. Resume
-clears the saved facts and checks again. Changing scope removes obsolete blocked
-item advice from the old Send; review and confirm a new Send after Drop.
+clears the saved facts and checks again. Changing scope removes the answered
+Work's blocked item, held items and local conflicts over the session the answered
+Work held. Other conflicts stay, with their choices, until each is answered. An
+item whose access differs from its Work's current access, or whose Work is gone,
+is answered even when `send.get` still lists it. Ask about each remaining Work,
+then review and confirm a new Send. Between choices the panel keeps Check again
+after changing your profile.
 
 A Send blocked with `PASSPORT_ADDRESS_TAKEN`, `PASSPORT_ADDRESS_RESERVED` or `PASSPORT_ADDRESS_LIMIT` needs another address from the person (panel address card, or `profile-address` from their words in chat), then `send.resume`; the Send writes the profile again before any upload (ADR 0246).
 

package/skills/tacitt/scripts/INDEX.md

@@ -3,43 +3,43 @@
 > Audience: agents and maintainers
 > Ownership: contributor-maintained
 
-| Entry                                                                              | Kind                       | Responsibility                                                                                                                                                                                                                                                                                           |
-| ---------------------------------------------------------------------------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [INDEX.md](INDEX.md)                                                               | Directory index            | Lists executable helpers shipped with the exact Skill release.                                                                                                                                                                                                                                           |
-| [journey-scan-timing.d.mts](journey-scan-timing.d.mts)                             | Declaration                | Content-free scan observation interface for helper measurements and tests.                                                                                                                                                                                                                               |
-| [journey-scan-timing.mjs](journey-scan-timing.mjs)                                 | Runtime measurement        | Scope-bound scan wall clock plus content-free slot occupancy, ingest latency and preparation wait observations.                                                                                                                                                                                          |
-| [describe.mjs](describe.mjs)                                                       | Runtime                    | Binds proposed generated metadata, never Hidden, to the current decision/context.                                                                                                                                                                                                                        |
-| [local-cli.mjs](local-cli.mjs)                                                     | Read-only package verifier | Validates an explicit installed CLI identity and aggregate artifact digest without network or application-state access.                                                                                                                                                                                  |
-| [review.mjs](review.mjs)                                                           | Runtime                    | Session-ready scanning, immediate sixteen-slot refill, draft heartbeat and acknowledged lost-pack recovery, planned card capacity, outcome-reported preparation recovery and read-only status, metadata-gated questions, Track B-gated final preview and hash-bound answer recovery.                     |
-| [review.d.mts](review.d.mts)                                                       | Type declarations          | Types the review helper's exported task rendering, answer reading, per-Work progress and entry functions for tests.                                                                                                                                                                                      |
-| [local-cli.d.mts](local-cli.d.mts)                                                 | Type declarations          | Defines the shared installed-package binding used by the CLI and standalone verifier.                                                                                                                                                                                                                    |
-| [verify-cli.mjs](verify-cli.mjs)                                                   | Verification entry         | Checks a managed local receipt and its current package bytes before the Skill starts a journey.                                                                                                                                                                                                          |
-| [journey.mjs](journey.mjs)                                                         | Runtime                    | Phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.              |
-| [journey.d.mts](journey.d.mts)                                                     | Declaration                | Phase helper contract for integration tests.                                                                                                                                                                                                                                                             |
-| [journey-panel-host.mjs](journey-panel-host.mjs)                                   | Runtime                    | Runs the paired CLI's `journey.serve --detach` before the handoff so a detached host owns the panel (ADR 0227).                                                                                                                                                                                          |
-| [journey-panel-host.d.mts](journey-panel-host.d.mts)                               | Declaration                | Types the detached-host handoff for helper tests.                                                                                                                                                                                                                                                        |
-| [journey-state.mjs](journey-state.mjs)                                             | Runtime state              | Pending-Public-choice, confirmed-answer and static-finishing phase selection, skip and included rules (ADR 0236), card batch limits, threshold and wait clock (ADR 0234), input fingerprints and exact pending-write recovery including definite scope rejection, with affected-Pending-only resolution. |
-| [answer.mjs](answer.mjs)                                                           | CLI publisher              | Validates task-bound classification and privacy drafts, including required privacy unit coverage and reused-card policy with repair diagnostics, reports card issue paths without mutating validator errors, and atomically publishes canonical answers.                                                 |
-| [journey-tasks.mjs](journey-tasks.mjs)                                             | Task builder               | Exact rendered-token budgets, private drafts, a 200-value cap (ADR 0234), compact existing policies with bounded overhead (ADR 0251), and one-term-per-line card/resolution payloads with complete bounded read ranges.                                                                                  |
-| [journey-tasks.d.mts](journey-tasks.d.mts)                                         | Declaration                | Types task creation, rendered-token sizing, canonical answer metadata and batch answer reads.                                                                                                                                                                                                            |
-| [journey-classification.mjs](journey-classification.mjs)                           | Runtime                    | Batched known-project metadata, unknown-root grouping and bounded evidence, versioned checkpoints and generation progress.                                                                                                                                                                               |
-| [journey-consolidation.mjs](journey-consolidation.mjs)                             | Runtime                    | Builds proposed-name and stable-target candidate buckets, persists complete reconciliation input, and returns compact dispatch descriptors.                                                                                                                                                              |
-| [journey-classification-metadata.mjs](journey-classification-metadata.mjs)         | Runtime                    | Validates global reconciliation and creates hash-bound, token-bounded AI metadata tasks for new Works and Unsorted.                                                                                                                                                                                      |
-| [journey-classification-metadata.d.mts](journey-classification-metadata.d.mts)     | Declaration                | Types generated AI metadata tasks for final project groups and Unsorted.                                                                                                                                                                                                                                 |
-| [journey-consolidation-submit.mjs](journey-consolidation-submit.mjs)               | Runtime                    | Expands candidate assignments, applies per-root overrides, combines small topics into Unsorted, attaches known projects and checks exact root coverage.                                                                                                                                                  |
-| [journey-consolidation.d.mts](journey-consolidation.d.mts)                         | Declaration                | Consolidation helper contract for bounded evidence regression tests.                                                                                                                                                                                                                                     |
-| [journey-classification-tasks.mjs](journey-classification-tasks.mjs)               | Runtime                    | Original-root routing, capacity-balanced bounded tasks and unresolved-first ready ordering with stable assignments.                                                                                                                                                                                      |
-| [journey-classification-tasks.d.mts](journey-classification-tasks.d.mts)           | Declaration                | Types initial classification routing and catalog/evidence task generation for helper consumers and tests.                                                                                                                                                                                                |
-| [journey-classification-progress.mjs](journey-classification-progress.mjs)         | Runtime                    | Accepted-answer counters and fenced progress checkpoints.                                                                                                                                                                                                                                                |
-| [journey-state.d.mts](journey-state.d.mts)                                         | Declaration                | Journey state helper contracts used by typed recovery tests.                                                                                                                                                                                                                                             |
-| [journey-classification-validation.mjs](journey-classification-validation.mjs)     | Runtime                    | Shared root judgment, stable target identity, fixed project metadata, consolidation validation, target-preserving assignment expansion and the late check that an item joins only placed Works with one access record (ADR 0274).                                                                        |
-| [journey-classification-validation.d.mts](journey-classification-validation.d.mts) | Declaration                | Shared classification validator contracts.                                                                                                                                                                                                                                                               |
-| [journey-card-consolidation.mjs](journey-card-consolidation.mjs)                   | Runtime                    | Immutably merges matching existing-policy extensions without a second model task (ADR 0251); policy or identity mismatches fall back to digest-bound global review, with exact key coverage and five/ten question limits.                                                                                |
-| [journey-card-consolidation.d.mts](journey-card-consolidation.d.mts)               | Declaration                | Types global card generation, policy comparison, identity boundaries, answer validation and final key expansion.                                                                                                                                                                                         |
-| [journey-card-values.mjs](journey-card-values.mjs)                                 | Runtime                    | Settles a card publication against the current journey: only still-open values, one card per normalized value, own identity on its own card by the journey-wide own-value rule, distinct short examples.                                                                                                 |
-| [journey-card-values.d.mts](journey-card-values.d.mts)                             | Declaration                | Types card value settlement for helper tests.                                                                                                                                                                                                                                                            |
-| [review-stream-client.mjs](review-stream-client.mjs)                               | Runtime                    | Bounds requests and owned-child shutdown, permits retry only for explicit pre-request startup busy, and preserves unknown lost-write outcomes for receipt replay.                                                                                                                                        |
-| [review-stream-client.d.mts](review-stream-client.d.mts)                           | Type declarations          | Types the fixed request/shutdown limits, private lifecycle callbacks and review-stream client methods.                                                                                                                                                                                                   |
+| Entry                                                                              | Kind                       | Responsibility                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ---------------------------------------------------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [INDEX.md](INDEX.md)                                                               | Directory index            | Lists executable helpers shipped with the exact Skill release.                                                                                                                                                                                                                                                                                                                                                            |
+| [journey-scan-timing.d.mts](journey-scan-timing.d.mts)                             | Declaration                | Content-free scan observation interface for helper measurements and tests.                                                                                                                                                                                                                                                                                                                                                |
+| [journey-scan-timing.mjs](journey-scan-timing.mjs)                                 | Runtime measurement        | Scope-bound scan wall clock plus content-free slot occupancy, ingest latency and preparation wait observations.                                                                                                                                                                                                                                                                                                           |
+| [describe.mjs](describe.mjs)                                                       | Runtime                    | Binds proposed generated metadata, never Hidden, to the current decision/context.                                                                                                                                                                                                                                                                                                                                         |
+| [local-cli.mjs](local-cli.mjs)                                                     | Read-only package verifier | Validates an explicit installed CLI identity and aggregate artifact digest without network or application-state access.                                                                                                                                                                                                                                                                                                   |
+| [review.mjs](review.mjs)                                                           | Runtime                    | Session-ready scanning, immediate sixteen-slot refill, native reader and turn receipts, bounded reissue and visible interruption recovery, planned card capacity, outcome-reported preparation recovery and read-only status, metadata-gated questions, Track B-gated final preview and hash-bound answer recovery.                                                                                                       |
+| [review.d.mts](review.d.mts)                                                       | Type declarations          | Types the review helper's exported task rendering, answer reading, per-Work progress and entry functions for tests.                                                                                                                                                                                                                                                                                                       |
+| [local-cli.d.mts](local-cli.d.mts)                                                 | Type declarations          | Defines the shared installed-package binding used by the CLI and standalone verifier.                                                                                                                                                                                                                                                                                                                                     |
+| [verify-cli.mjs](verify-cli.mjs)                                                   | Verification entry         | Checks a managed local receipt and its current package bytes before the Skill starts a journey.                                                                                                                                                                                                                                                                                                                           |
+| [journey.mjs](journey.mjs)                                                         | Runtime                    | Phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.                                                                                                                               |
+| [journey.d.mts](journey.d.mts)                                                     | Declaration                | Phase helper contract for integration tests.                                                                                                                                                                                                                                                                                                                                                                              |
+| [journey-panel-host.mjs](journey-panel-host.mjs)                                   | Runtime                    | Runs the paired CLI's `journey.serve --detach` before the handoff so a detached host owns the panel (ADR 0227).                                                                                                                                                                                                                                                                                                           |
+| [journey-panel-host.d.mts](journey-panel-host.d.mts)                               | Declaration                | Types the detached-host handoff for helper tests.                                                                                                                                                                                                                                                                                                                                                                         |
+| [journey-state.mjs](journey-state.mjs)                                             | Runtime state              | Pending-Public-choice, confirmed-answer and static-finishing phase selection, skip and included rules (ADR 0236), the left-out session count (issue #59), card batch limits, threshold and wait clock (ADR 0234), input fingerprints and exact pending-write recovery including definite scope rejection, with affected-Pending-only resolution. Reads the host Public source projection with older-view choice fallback. |
+| [answer.mjs](answer.mjs)                                                           | CLI publisher              | Validates task-bound classification and privacy drafts, including required privacy unit coverage and reused-card policy with repair diagnostics, reports card issue paths without mutating validator errors, and atomically publishes canonical answers.                                                                                                                                                                  |
+| [journey-tasks.mjs](journey-tasks.mjs)                                             | Task builder               | Exact rendered-token budgets, private drafts, a 200-value cap (ADR 0234), compact existing policies with bounded overhead (ADR 0251), and one-term-per-line card/resolution payloads with complete bounded read ranges.                                                                                                                                                                                                   |
+| [journey-tasks.d.mts](journey-tasks.d.mts)                                         | Declaration                | Types task creation, rendered-token sizing, canonical answer metadata and batch answer reads.                                                                                                                                                                                                                                                                                                                             |
+| [journey-classification.mjs](journey-classification.mjs)                           | Runtime                    | Batched known-project metadata, unknown-root grouping and bounded evidence, versioned checkpoints and generation progress.                                                                                                                                                                                                                                                                                                |
+| [journey-consolidation.mjs](journey-consolidation.mjs)                             | Runtime                    | Builds proposed-name and stable-target candidate buckets, persists complete reconciliation input, and returns compact dispatch descriptors.                                                                                                                                                                                                                                                                               |
+| [journey-classification-metadata.mjs](journey-classification-metadata.mjs)         | Runtime                    | Validates global reconciliation, reduces oversized Works from all evidence slices and creates hash-bound, token-bounded AI metadata tasks for new Works and Unsorted.                                                                                                                                                                                                                                                     |
+| [journey-classification-metadata.d.mts](journey-classification-metadata.d.mts)     | Declaration                | Types generated AI metadata tasks for final project groups and Unsorted.                                                                                                                                                                                                                                                                                                                                                  |
+| [journey-consolidation-submit.mjs](journey-consolidation-submit.mjs)               | Runtime                    | Expands candidate assignments, applies per-root overrides, combines small topics into Unsorted, attaches known projects and checks exact root coverage.                                                                                                                                                                                                                                                                   |
+| [journey-consolidation.d.mts](journey-consolidation.d.mts)                         | Declaration                | Consolidation helper contract for bounded evidence regression tests.                                                                                                                                                                                                                                                                                                                                                      |
+| [journey-classification-tasks.mjs](journey-classification-tasks.mjs)               | Runtime                    | Original-root routing, capacity-balanced bounded tasks and unresolved-first ready ordering with stable assignments.                                                                                                                                                                                                                                                                                                       |
+| [journey-classification-tasks.d.mts](journey-classification-tasks.d.mts)           | Declaration                | Types initial classification routing and catalog/evidence task generation for helper consumers and tests.                                                                                                                                                                                                                                                                                                                 |
+| [journey-classification-progress.mjs](journey-classification-progress.mjs)         | Runtime                    | Accepted-answer counters and fenced progress checkpoints.                                                                                                                                                                                                                                                                                                                                                                 |
+| [journey-state.d.mts](journey-state.d.mts)                                         | Declaration                | Journey state helper contracts used by typed recovery tests. Declares the optional projected Public source for compatibility.                                                                                                                                                                                                                                                                                             |
+| [journey-classification-validation.mjs](journey-classification-validation.mjs)     | Runtime                    | Shared root judgment, stable target identity, fixed project metadata, consolidation validation, target-preserving assignment expansion and the late check that an item joins only placed Works with one access record (ADR 0274).                                                                                                                                                                                         |
+| [journey-classification-validation.d.mts](journey-classification-validation.d.mts) | Declaration                | Shared classification validator contracts.                                                                                                                                                                                                                                                                                                                                                                                |
+| [journey-card-consolidation.mjs](journey-card-consolidation.mjs)                   | Runtime                    | Immutably merges matching existing-policy extensions without a second model task (ADR 0251); policy or identity mismatches fall back to digest-bound global review, with exact key coverage and five/ten question limits.                                                                                                                                                                                                 |
+| [journey-card-consolidation.d.mts](journey-card-consolidation.d.mts)               | Declaration                | Types global card generation, policy comparison, identity boundaries, answer validation and final key expansion.                                                                                                                                                                                                                                                                                                          |
+| [journey-card-values.mjs](journey-card-values.mjs)                                 | Runtime                    | Settles a card publication against the current journey: only still-open values, one card per normalized value, own identity on its own card by the journey-wide own-value rule, distinct short examples.                                                                                                                                                                                                                  |
+| [journey-card-values.d.mts](journey-card-values.d.mts)                             | Declaration                | Types card value settlement for helper tests.                                                                                                                                                                                                                                                                                                                                                                             |
+| [review-stream-client.mjs](review-stream-client.mjs)                               | Runtime                    | Bounds requests and owned-child shutdown, permits retry only for explicit pre-request startup busy, and preserves unknown lost-write outcomes for receipt replay.                                                                                                                                                                                                                                                         |
+| [review-stream-client.d.mts](review-stream-client.d.mts)                           | Type declarations          | Types the fixed request/shutdown limits, private lifecycle callbacks and review-stream client methods.                                                                                                                                                                                                                                                                                                                    |
 
 `review.mjs` also owns bounded ingest-and-refill stream reuse and slot-limited recovery of reserved packs.
 

package/skills/tacitt/scripts/answer.mjs

@@ -1,8 +1,14 @@
-import { readFile } from 'node:fs/promises'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve } from 'node:path'
-import { hash, optional, save } from './journey-state.mjs'
+import { hash, openTaskDraft, optional, save, taskDraftPath } from './journey-state.mjs'
 import { pathToFileURL } from 'node:url'
-import { readAnswer, validatePrivacyAnswer, withUnlockedJourneyCli } from './review.mjs'
+import {
+  draftTermIndices,
+  readAnswer,
+  validatePrivacyAnswer,
+  verifyPackCoverage,
+  withUnlockedJourneyCli,
+} from './review.mjs'
 import { publishClassificationProgress } from './journey-classification-progress.mjs'
 import { sameCardPolicy, validateCardConsolidation } from './journey-card-consolidation.mjs'
 import {
@@ -45,11 +51,43 @@ async function validator() {
 }
 
 async function publish(args) {
-  if (args.length !== 4 || args[0] !== '--task' || args[2] !== '--input') throw new Error('USAGE')
+  const readPage = args[2] === '--read' && args.length === 5
+  if (args[0] !== '--task' || (!readPage && (args.length !== 4 || args[2] !== '--input')))
+    throw new Error('USAGE')
   const taskPath = resolve(args[1]),
     draftPath = resolve(args[3]),
     descriptorPath = taskPath.replace(/\.md$/u, '.publish.json')
   if (descriptorPath === taskPath) throw new Error('TASK_PATH')
+  if (readPage) {
+    const ref = args[3]
+    const ordinal = args[4]
+    if (!/^U[1-9]\d*$/u.test(ref) || !/^[1-9]\d*$/u.test(ordinal)) throw new Error('PAGE_RANGE')
+    const manifest = await readInput(taskPath, 'TASK', 'utf8')
+    const lines = manifest.split('\n')
+    const prefix = 'Page digest ' + ref + '/' + ordinal + ' '
+    const start = lines.findLastIndex((line) => line.startsWith('Coverage attempt: '))
+    const line = start < 0 ? null : lines.slice(start + 1).find((item) => item.startsWith(prefix))
+    if (!line) throw new Error('PAGE_RANGE')
+    const output = await readInput(
+      join(taskPath.replace(/\.md$/u, '.pages'), ref + '-' + ordinal),
+      'PAGE',
+      'utf8',
+    )
+    const { createHash } = await import('node:crypto')
+    const receipt = /\nREAD_RECEIPT ([a-f0-9]{64})\n$/u.exec(output)?.[1]
+    if (!receipt || createHash('sha256').update(output).digest('hex') !== line.slice(prefix.length))
+      throw new Error('SOURCE_BINDING')
+    await new Promise((done, reject) =>
+      process.stdout.write(output, (error) => (error ? reject(error) : done())),
+    )
+    // A new page is a heartbeat; repeated reads of the same page cannot renew a lost reader.
+    const directory = taskPath.replace(/\.md$/u, '.reads')
+    await mkdir(directory, { recursive: true, mode: 0o700 })
+    await writeFile(join(directory, receipt), '', { flag: 'wx', mode: 0o600 }).catch((error) => {
+      if (error.code !== 'EEXIST') throw error
+    })
+    return
+  }
   const descriptor = JSON.parse(await readInput(descriptorPath, 'DESCRIPTOR', 'utf8'))
   if (
     descriptor.version !== 1 ||
@@ -77,7 +115,26 @@ async function publish(args) {
       throw new Error('TASK_INPUT')
     if (hash(taskInput) !== descriptor.inputHash) throw new Error('INPUT_HASH')
   }
-  const draft = await readInput(draftPath, 'DRAFT')
+  if (descriptor.kind === 'privacy') {
+    const sourceHash = createHash('sha256').update(JSON.stringify(descriptor.source)).digest('hex')
+    if (
+      sourceHash !== descriptor.sourceHash ||
+      !taskText.includes(`\nSOURCE_HASH\n${sourceHash}\n`)
+    )
+      throw new Error('SOURCE_BINDING')
+  }
+  if (draftPath !== taskDraftPath(taskPath)) throw new Error('DRAFT_PATH')
+  const file = await openTaskDraft(taskPath).catch((error) => {
+    if (error.code === 'ENOENT') throw new Error('DRAFT_NOT_FOUND')
+    if (error.code === 'ELOOP') throw new Error('DRAFT_PATH')
+    throw error
+  })
+  let draft
+  try {
+    draft = await file.readFile()
+  } finally {
+    await file.close()
+  }
   const maxDraftBytes = descriptor.kind === 'privacy' ? MAX_PRIVACY_DRAFT_BYTES : MAX_DRAFT_BYTES
   if (draft.length === 0 || draft.length > maxDraftBytes) throw new Error('DRAFT_SIZE')
   let answer
@@ -94,25 +151,22 @@ async function publish(args) {
     if (at < 0) throw new Error('TASK_INPUT')
     const refs = JSON.parse(taskText.slice(at + marker.length))
     if (JSON.stringify(refs) !== JSON.stringify(descriptor.unitRefs)) throw new Error('BINDING')
+    const { resolvePrivacySources } = await validator()
+    answer.terms = resolvePrivacySources(answer.terms, descriptor.source)
     validatePrivacyAnswer(answer, refs)
-    // The canonical answer covers every assigned unit (ADR 0178).
-    answer = { ...answer, units: refs }
-    const sourceHash = createHash('sha256').update(JSON.stringify(descriptor.source)).digest('hex')
-    if (
-      sourceHash !== descriptor.sourceHash ||
-      !taskText.includes(`\nSOURCE_HASH\n${sourceHash}\n`)
-    )
-      throw new Error('SOURCE_BINDING')
+    const coverage = await verifyPackCoverage(taskPath, answer, true)
+    answer = { ...answer, units: coverage.refs, attemptId: coverage.attemptId }
     const { locateTerms } = await validator()
     const terms = readAnswer([answer]).terms
     const { unlocatedIndices } = locateTerms(descriptor.source, terms)
     if (unlocatedIndices.length) {
       const diagnosticPath = taskPath.replace(/\.md$/u, '.publish-rejected.json')
-      await save(diagnosticPath, { taskHash, terms, unlocatedIndices })
+      const draftIndices = draftTermIndices(answer.terms, terms, unlocatedIndices)
+      await save(diagnosticPath, { taskHash, draftIndices, unlocatedIndices })
       throw new Error('INVALID_REVIEW_SPAN', {
         cause: [
           `normalized terms[${unlocatedIndices.slice(0, 32).join(',')}] are absent from review fields or are not admitted literals`,
-          `read the private normalized terms and complete failing indices at ${diagnosticPath}; repair the draft before publishing`,
+          `read the original draft indices and normalized indices at ${diagnosticPath}; repair the draft before publishing`,
         ],
       })
     }
@@ -249,6 +303,10 @@ async function publish(args) {
       answer.evidenceRootKeys.some((key) => !keys.includes(key))
     )
       diagnostics.push('evidenceRootKeys must be unique assigned roots')
+    else if (taskInput.evidenceRound === 1 && answer.evidenceRootKeys.length)
+      diagnostics.push(
+        'This is the final evidence round. Set evidenceRootKeys to [] and record remaining uncertainty in groupingBasis.',
+      )
     if (diagnostics.length) throw new Error('INVALID_CLASSIFICATION_ANSWER', { cause: diagnostics })
   } else if (Array.isArray(taskInput.projects)) {
     const diagnostics = []