@gitroll/tacitt-cli 0.6.10 → 0.6.11

package/dist/{query-By41gaKm.mjs → query-AMZerUh8.mjs}

@@ -1,10 +1,11 @@
-import { $ as createCleanup, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as removeNamedTemporarySpools, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as createTemporary, _ as processJourneyMetadata, a as scanReviewFields, at as windowsOwnerOnly, c as readSessionScanRecords, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as restrictToOwner, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, nt as makePrivateDirectory, o as createWorkPieces, ot as isWindowsAclFailure, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as openPrivateFile, s as readSessionScanFields, st as windowsAclCodes, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-3jvMvSQn.mjs";
-import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BHIwElNF.mjs";
-import { $t as safeField, Bt as sessionPeriodSchema, Dn as createStaticProcessor, Fn as entityDictionaryVersion, Ft as termTypeInfo, Gt as ownerProfileSchema, Kt as passportAddressSchema, Ot as privacyTermKey, Qt as safeCode, Sn as currentDetectorVersion, T as bLiteralTerms, Un as frameRecords, Wt as mergeOwnerProfile, Xt as ApplicationError, Zt as UnfinishedJourneyError, an as observeSource, ar as admitCustomTerm, c as textDigest, ir as createEntityMatcher, nn as reviewFamilies, or as admitGitName, qt as profileHasChoices, tn as familySelected, ur as ProcessingError, zt as filterInventoryByPeriod } from "./locate-Cwv6WH8n.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-D_DfY--2.mjs";
-import { $r as isClassifying, $t as searchScopeDigest, Ar as displayedScopeDigest, At as obsoleteJourney, B as createApplication, Br as staticReviewDigest, Bt as classificationPartition, Ct as sendActionSchema, Dt as sendStartSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, Gr as agentSourcesSchema, H as inspectionStartSchema, Ht as applyClassification, I as storedCredentialSchema, Jn as workDecisionDigest, Jr as sendReceiptSchema, K as inspectionQuerySchema, Kr as journeySendSchema, Ln as bTermMatcher, M as deviceAuthorizationSchema, N as deviceProfileScopeSchema, Nr as assertJourneyPrivacyReady, O as createAccount, P as profileUrlMatchesIdentity, Pr as privacyDecisionDigest, Qr as hasCompleteWorkDescription, St as replaceSensitiveTermsSchema, Tt as sendPrepareSchema, U as validateInspectionBatch, Ut as retireScanGeneration, V as inspectionCancelSchema, Vn as confirmedHideKinds, Vt as classificationWorks, Wn as journeyConfirmedHides, Wr as agentSourceSchema, Wt as newJourneyWork, Xn as workCorrectionBinding, Xr as sendResolutionSchema, Yr as sendReplaceResultSchema, Zr as sendSettingsSchema, Zt as journeySearchResultSchema, _ as changeJourney, _t as manualUploadStartSchema, ai as withReadingProgress, at as appendSensitiveTerms, ci as selectionBatchSchema, cr as scanSessionResourceSchema, di as producerVersion, dr as verifiedScanGitSeeds, dt as validateFailureLocation, ei as isIncludedWork, fr as scanExclusionResourceSchema, ft as manualUploadActionSchema, gt as manualUploadSchema, h as hideScopeDigest, ht as manualUploadPrepareSchema, j as accountProfileSchema, jr as requestedScope, k as renew, kt as currentJourneyAdapters, li as selectionSchema, lr as scanGitSeedsId, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mi as recommendParallelism, mt as manualUploadChoiceSchema, ni as isSelectedWork, nt as settingsQuerySchema, oi as commandSchema, qn as retireWorkDescription, qr as sendArtifactSchema, si as packageCommandSchema, sr as scanPreparationDigest, ti as isReadingComplete, tt as settingsBatchSchema, ur as scanGitSeedsResource, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yr as emptyPreparationFacts, yt as emptyTermsRevision, zr as hasCurrentStaticReview } from "./src-BqtdFVq7.mjs";
-import { _t as isCoordinationBusy } from "./heap-CM298Yu0.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-LPd8WEsN.mjs";
+import { $ as removeNamedTemporarySpools, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as createTemporary, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as decodeZstd, _ as processJourneyMetadata, a as scanReviewFields, at as restrictToOwner, c as readSessionScanRecords, ct as windowsAclCodes, et as createCleanup, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as openPrivateFile, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, o as createWorkPieces, ot as windowsOwnerOnly, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as makePrivateDirectory, s as readSessionScanFields, st as isWindowsAclFailure, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-DlVbGB32.mjs";
+import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BKsifhyv.mjs";
+import { $t as profileHasChoices, D as bLiteralTerms, Gt as filterInventoryByPeriod, Kt as sessionPeriodSchema, Mt as privacyTermKey, Nn as createStaticProcessor, On as currentDetectorVersion, Qt as passportAddressSchema, Vn as entityDictionaryVersion, Vt as termTypeInfo, Xt as mergeOwnerProfile, Yn as frameRecords, Zt as ownerProfileSchema, an as safeField, br as processingSite, cn as reviewFamilies, dn as observeSource, dr as admitCustomTerm, fr as admitGitName, gr as ProcessingError, in as safeCode, nn as ApplicationError, rn as UnfinishedJourneyError, sn as familySelected, u as textDigest, ur as createEntityMatcher, xr as siteFields } from "./locate-Cx52Zqxv.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-wZx_v0Ih.mjs";
+import { $r as sendReplaceResultSchema, An as scanGitSeedsResource, At as obsoleteJourney, B as createApplication, Bn as journeySearchResultSchema, Bt as classificationPartition, Ct as sendActionSchema, Dn as scanPreparationDigest, Dt as sendStartSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, H as inspectionStartSchema, Hn as searchScopeDigest, Ht as retireScanGeneration, I as storedCredentialSchema, Ir as assertJourneyPrivacyReady, Jr as agentSourceSchema, K as inspectionQuerySchema, Lr as privacyDecisionDigest, M as deviceAuthorizationSchema, Mn as scanExclusionResourceSchema, N as deviceProfileScopeSchema, Nr as displayedScopeDigest, O as createAccount, On as scanSessionResourceSchema, P as profileUrlMatchesIdentity, Pr as requestedScope, Qr as sendReceiptSchema, St as replaceSensitiveTermsSchema, Tt as sendPrepareSchema, U as validateInspectionBatch, Ur as hasCurrentStaticReview, Ut as newJourneyWork, V as inspectionCancelSchema, Vt as classificationWorks, Wr as staticReviewDigest, Xr as journeySendSchema, Yr as agentSourcesSchema, Zr as sendArtifactSchema, _ as changeJourney, _t as manualUploadStartSchema, ai as isReadingComplete, ar as bTermMatcher, at as appendSensitiveTerms, di as packageCommandSchema, dt as validateFailureLocation, ei as sendResolutionSchema, fi as selectionBatchSchema, fr as journeyConfirmedHides, ft as manualUploadActionSchema, gr as workDecisionDigest, gt as manualUploadSchema, h as hideScopeDigest, hi as producerVersion, hr as retireWorkDescription, ht as manualUploadPrepareSchema, ii as isIncludedWork, j as accountProfileSchema, jn as verifiedScanGitSeeds, k as renew, kn as scanGitSeedsId, kt as currentJourneyAdapters, li as withReadingProgress, lr as confirmedHideKinds, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mt as manualUploadChoiceSchema, ni as hasCompleteWorkDescription, nt as settingsQuerySchema, oi as isSelectedWork, pi as selectionSchema, ri as isClassifying, ti as sendSettingsSchema, tt as settingsBatchSchema, ui as commandSchema, vi as recommendParallelism, vr as workCorrectionBinding, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yr as emptyPreparationFacts, yt as emptyTermsRevision, zn as applyClassification } from "./src-D1iONla3.mjs";
+import { vt as isCoordinationBusy } from "./heap-CV8Eca8V.mjs";
+import { d as checkOpenSource, h as openSource } from "./run-CaPktPhH.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-DdfF3zch.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -92,7 +93,7 @@ function permissionDiagnostic(error) {
 function startupFailure(error, platform = process.platform) {
 	const code = safeCode(error);
 	const permission = permissionDiagnostic(error);
-	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run `npx --yes @gitroll/tacitt-cli@latest` with your original options to start the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
+	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run the same command through `npx --yes @gitroll/tacitt-cli@latest` to use the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
 	return `${code}.${code === "OPERATION_FAILED" ? failureCause(error) : ""}${permission}${advice}\n`;
 }
 const safeJourneyId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
@@ -141,6 +142,7 @@ const businessCommands = [
 	"journey.findingImpact",
 	"journey.files",
 	"journey.prepare",
+	"review.reopenEmpty",
 	"review.terms",
 	"review.status",
 	"review.guidance",
@@ -342,13 +344,14 @@ function parseOptions(args, source = sourceCheckout) {
 }
 const fullHelp = `tacitt — review and package local session logs
 
-Usage: tacitt [--no-open] [--state-dir PATH] [--bundle-dir PATH] [--parallelism N]
-              [--since DATE] [--until DATE]
-       tacitt state dump [--state-dir PATH] [--output PATH]
-       tacitt status [--state-dir PATH]
+Usage: tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
        tacitt PROCEDURE [--input FILE|-] [--async] [--timeout-ms N]
        tacitt operation.get|operation.wait|operation.cancel ID [--timeout-ms N]
-       tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
+       tacitt state dump [--state-dir PATH] [--output PATH]
+       tacitt status [--state-dir PATH]
+
+Tacitt has three surfaces: the Skill (/tacitt in Claude Code, $tacitt in Codex), the Skill
+panel that the Skill opens, and the CLI commands below. Bare tacitt prints how to start the Skill.
 
 Business procedures (JSON output):
 ${Array.from(businessCommands).join("\n")}
@@ -372,12 +375,11 @@ Workspace ZIPs and collection indexes use the saved bundle library directory.
 Native Skill Send uploads only the confirmed primary artifacts to the configured Tacitt profile API.
 status prints safe workspace outcomes from the latest saved packaging operation.
 Private packaging error details stay in <state-dir>/diagnostics/ (up to 4 MiB).
-Sign in from the Web UI to link this tool to your GitRoll Identity account; the CLI contacts
+Sign in from the Skill panel to link this tool to your GitRoll Identity account; the CLI contacts
 only the Identity and profile API origins below, only when you ask, and keeps the issued
 token in <state-dir>/account/ (owner-only).
 
 Options:
-  --no-open                 Print the URL without opening a browser
   --agent CLIENT            skill.install only: codex, claude or all (default: all)
   --scope SCOPE             skill.install only: user or project (default: user)
   --cli-path PATH           skill.install only: bind an absolute installed package executable
@@ -388,10 +390,7 @@ Options:
   --claude-home PATH        Override the Claude configuration root
   --codex-home PATH         Override the Codex configuration root
   --overwrite-corrupted    Explicitly reset unusable control-plane state
-  --parallelism N          Configured packaging worker count (default: the Package dialog recommendation)
-  --since DATE              Manual: preselect only sessions last active on or after DATE
-  --until DATE              Manual: preselect only sessions last active on or before DATE
-                            (DATE: YYYY-MM-DD local day, inclusive, or an ISO timestamp)
+  --parallelism N          Preparation and packaging worker count (default: recommended for this computer)
   --identity-url URL        Identity origin for sign-in (default: ${accountDefaults.identityUrl})
   --identity-client-id ID   Public device client ID registered for this tool
   --profile-api-url URL     Profile API origin the token is checked against
@@ -617,12 +616,13 @@ async function scanRemoteDispatches(sessions, signal) {
 		const pending = /* @__PURE__ */ new Map();
 		for (const part of session.parts) {
 			signal.throwIfAborted();
-			if (part.representation !== "jsonl") throw new Error("REMOTE_SOURCE_FORMAT_UNSUPPORTED");
-			const file = await open(part.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+			const file = await openSource(part);
 			try {
-				const before = await file.stat({ bigint: true });
-				if (String(before.dev) !== part.snapshot.dev || String(before.ino) !== part.snapshot.ino || before.size !== BigInt(part.snapshot.size) || String(before.mtimeNs) !== part.snapshot.mtimeNs || String(before.ctimeNs) !== part.snapshot.ctimeNs) throw new Error("REMOTE_SOURCE_CHANGED");
-				if (!part.snapshot.size) continue;
+				if (!part.snapshot.size) {
+					if (part.representation === "jsonl.zst") throw new Error("ARTIFACT_PROCESSING_DECODE_FAILED");
+					await checkOpenSource(part, file);
+					continue;
+				}
 				const stream = file.createReadStream({
 					autoClose: false,
 					start: 0,
@@ -637,7 +637,7 @@ async function scanRemoteDispatches(sessions, signal) {
 					unreadableLines++;
 					cause ??= /* @__PURE__ */ new Error(`line ${location.line}, invalid UTF-8`);
 				};
-				const lines = frameRecords(numberedChunks(stream, location), "jsonl", 16777216, signal);
+				const lines = frameRecords(numberedChunks(part.representation === "jsonl.zst" ? decodeZstd(stream, signal) : stream, location), "jsonl", 16777216, signal);
 				try {
 					for await (const framed of skipLiveTail(lines, location, skipped)) {
 						signal.throwIfAborted();
@@ -671,11 +671,10 @@ async function scanRemoteDispatches(sessions, signal) {
 								end: end && end >= at ? end : at
 							}));
 							windows.push(...found);
-							pending.set(command.id, found);
+							if (found.length) pending.set(command.id, found);
 						}
 					}
-					const after = await file.stat({ bigint: true });
-					if (after.mtimeNs !== before.mtimeNs || after.size !== before.size) throw new Error("REMOTE_SOURCE_CHANGED");
+					await checkOpenSource(part, file);
 				} finally {
 					stream.destroy();
 				}
@@ -743,7 +742,10 @@ function createRemotePreflight(options) {
 				} catch (error) {
 					signal.throwIfAborted();
 					options.reportFailure(error);
-					state.failures.push("source-scan");
+					if (!state.failures.includes("source-scan")) state.failures.push("source-scan");
+					const reason = sourceFailureReason(error);
+					const counts = state.sourceFailureCounts ??= {};
+					counts[reason] = (counts[reason] ?? 0) + 1;
 				}
 				await saveRemoteState(options.stateDir, input.journeyId, state);
 			}
@@ -780,9 +782,23 @@ function result(state) {
 		})),
 		copied: state.copied.length,
 		failures: state.failures,
+		...state.sourceFailureCounts ? { sourceFailureCounts: state.sourceFailureCounts } : {},
 		...state.failures.some((failure) => ["source-lines-unreadable", "source-scan"].includes(failure)) ? { warning: state.failures.includes("source-scan") ? "Some remote sources could not be scanned; remote worker discovery may be incomplete." : "Some remote dispatch lines were unreadable; remote worker discovery may be incomplete." } : {}
 	};
 }
+function sourceFailureReason(error) {
+	if (!(error instanceof Error)) return "other";
+	if (error instanceof SyntaxError) return "invalid-json";
+	if (error.message === "SOURCE_CHANGED") return "source-changed";
+	if (error.message === "UNSAFE_SOURCE_PATH") return "source-inaccessible";
+	if (error.message === "ARTIFACT_PROCESSING_DECODE_FAILED") return "compressed-decode";
+	const code = "code" in error ? error.code : null;
+	if (code === "PROCESSING_LIMIT") return "record-limit";
+	if (code === "PROCESSING_INVALID_RECORD") return "invalid-utf8";
+	if (code === "ENOENT" || code === "ENOTDIR") return "source-missing";
+	if (code === "EACCES" || code === "EPERM" || code === "ELOOP") return "source-inaccessible";
+	return "other";
+}
 //#endregion
 //#region apps/cli/src/journey/confirmed-hides.ts
 /** The Work's explicit exception values; an occurrence inside one stays visible (ADR 0069). */
@@ -1144,7 +1160,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 		return state;
 	};
 	const guard = async (id) => {
-		if (!verified.has(id)) await current(id);
+		if (verified.has(id)) return;
+		const permission = await storage.preparationPermission(id);
+		if (permission && permission.destination !== destination) throw new ApplicationError("JOURNEY_DESTINATION_CHANGED");
+		if (permission) verified.add(id);
 	};
 	const readStatus = async (input) => {
 		await guard(input.journeyId);
@@ -1152,6 +1171,18 @@ function bindJourneyDestination(storage, destination, options = {}) {
 	};
 	return {
 		current,
+		async preparationState(id) {
+			await guard(id);
+			return storage.preparationState(id);
+		},
+		async preparationPermission(id) {
+			await guard(id);
+			return storage.preparationPermission(id);
+		},
+		async updatePreparation(input) {
+			await guard(input.journeyId);
+			return storage.updatePreparation(input);
+		},
 		readInventory: (input) => storage.readInventory({
 			...input,
 			expectedDestination: destination
@@ -1270,6 +1301,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 			await guard(input.journeyId);
 			return storage.submitReview(input);
 		},
+		async reopenEmpty(input) {
+			await guard(input.journeyId);
+			return storage.reopenEmpty(input);
+		},
 		async recordTerms(input) {
 			await guard(input.journeyId);
 			return storage.recordTerms(input);
@@ -1321,6 +1356,31 @@ function bindSendDestination(storage, destination) {
 	};
 }
 //#endregion
+//#region apps/cli/src/journey/prepare/update.ts
+/** Preparation owns only the changed Work rows, progress and package invalidation. */
+async function changePreparation(storage, journeyId, kind, change, attempts = Number.POSITIVE_INFINITY, clearPackageApproval = false) {
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		const before = await storage.preparationState(journeyId);
+		if (!before?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		const after = change(before);
+		const previous = new Map(before.works.map((work) => [work.id, work]));
+		const result = await storage.updatePreparation({
+			journeyId,
+			expectedRevision: before.revision,
+			requestKey: randomUUID(),
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			kind,
+			works: after.works.filter((work) => work !== previous.get(work.id)),
+			phase: after.phase,
+			readingComplete: after.readingComplete,
+			readingStartedAt: after.readingStartedAt,
+			clearPackageApproval: clearPackageApproval && before !== after
+		});
+		if (result.status !== "stale") return result.state;
+	}
+	throw new ApplicationError("REVISION_CONFLICT");
+}
+//#endregion
 //#region apps/cli/src/journey/works/metadata.ts
 /** Original classification fields remain durable; only the derived display cache is replaced. */
 const classificationMetadataInput = (work) => ({
@@ -1368,7 +1428,7 @@ async function prepareClassificationMetadata(storage, state, work, processing, s
 		fields: Object.values(raw).map((text) => ({ text }))
 	}, signal);
 	if (title === void 0 || projectName === void 0 || description === void 0 || reason === void 0) throw new ApplicationError("CORRUPTED_STATE");
-	await changeJourney(storage, state.journeyId, "snapshot", (before) => {
+	await changePreparation(storage, state.journeyId, "snapshot", (before) => {
 		const active = before.works.find((item) => item.id === work.id);
 		if (before.scope.status !== "confirmed" || !active || textDigest(JSON.stringify([
 			active.inputRevision,
@@ -1699,7 +1759,7 @@ async function isolateFailingRoots(storage, journeyId, work, error) {
 	});
 	if (roots.length === 0 || roots.length === work.rootSessionIds.length) return false;
 	for (;;) {
-		const state = await storage.current(journeyId);
+		const state = await storage.preparationState(journeyId);
 		const current = state?.works.find((item) => item.id === work.id);
 		if (!state || state.phase === "paused" || state.pendingHideId || current?.inputRevision !== work.inputRevision || current.status !== "pending") return false;
 		if ((await storage.isolateRoots({
@@ -1801,7 +1861,7 @@ function scanFailureCode(reason) {
 }
 /** Resolve only the frozen inspection settings and captures; classification stays unchanged. */
 async function prepareScanContext(storage, journeyId, work, selected, processing, signal, workers) {
-	const current = await storage.current(journeyId);
+	const current = await storage.preparationState(journeyId);
 	if (!current?.consent || !current.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const active = current.works.find((item) => item.id === work.id);
 	if (current.scope.status !== "confirmed" || current.phase === "paused" || active?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
@@ -2127,7 +2187,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 				workspaceId: session.workspaceId,
 				sessionId: session.id,
 				...failure.sourcePartId ? { sourcePartId: failure.sourcePartId } : {}
-			});
+			}, void 0, failure.cause ?? new ApplicationError(scanFailureCode(failure.reason)));
 			const root = families.owners.get(failure.sessionId);
 			if (root) failures.set(root.id, failure.cause === void 0 ? scanFailureCode(failure.reason) : safeCode(failure.cause));
 		}
@@ -2153,7 +2213,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 		...proof,
 		rootSessionIds: excludedRoots
 	} : void 0;
-	await changeJourney(storage, plan.journeyId, "batch", (state) => {
+	await changePreparation(storage, plan.journeyId, "batch", (state) => {
 		const target = state.works.find((item) => item.id === work.id);
 		if (state.scope.status !== "confirmed" || state.phase === "paused" || target?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
 		if (target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2212,7 +2272,7 @@ async function observePreparation(storage, input, observation, operation) {
 //#endregion
 //#region apps/cli/src/journey/prepare/work.ts
 async function prepareJourneyWork(storage, plan, work, directory, processing, hooks, workers, onGeneration, onSubmitted) {
-	let state = await storage.current(plan.journeyId);
+	let state = await storage.preparationState(plan.journeyId);
 	if (!state?.consent || !state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	if (state.scope.status !== "confirmed" || state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 	const selected = workApproval(plan.approval, work.rootSessionIds);
@@ -2270,9 +2330,9 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 			context ??= await resolveContext();
 			return prepareScannedWork(storage, plan, work, directory, {
 				...hooks,
-				onFailureLocation(location, detail) {
+				onFailureLocation(location, detail, cause) {
 					observation.location(location);
-					hooks.onFailureLocation?.(location, detail);
+					hooks.onFailureLocation?.(location, detail, cause);
 				}
 			}, observation, context, onSubmitted);
 		});
@@ -2294,7 +2354,7 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 */
 async function prepareStaticWork(options) {
 	const { storage, journeyId, signal } = options;
-	const state = await storage.current(journeyId);
+	const state = await storage.preparationState(journeyId);
 	const work = state?.works.find((item) => item.id === options.workId);
 	if (!state?.snapshotId || !work || !isSelectedWork(work) || !work.rootSessionIds.length) return;
 	if (![
@@ -2366,7 +2426,7 @@ async function prepareStaticWork(options) {
 	if (failure) throw failure.error;
 	signal.throwIfAborted();
 	if (resources.length !== jobs.length) throw new ApplicationError("SCOPE_NOT_READY");
-	await changeJourney(storage, journeyId, "batch", (current) => {
+	await changePreparation(storage, journeyId, "batch", (current) => {
 		const target = current.works.find((item) => item.id === work.id);
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (current.snapshotId !== snapshotId || target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2403,7 +2463,7 @@ function observeJourneyPause(storage, journeyId, processing, onFailure, requireC
 	const closing = new AbortController();
 	async function readPermission() {
 		for (let attempt = 1;; attempt++) try {
-			return await storage.current(journeyId);
+			return await storage.preparationPermission(journeyId);
 		} catch (error) {
 			if (safeCode(error) !== "COORDINATION_BUSY" || attempt === 4) throw error;
 			onFailure(error);
@@ -2476,6 +2536,16 @@ const preparationFailureBindingsSchema = z.object({
 	workId: z.uuid(),
 	inputRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
 }).strict();
+/** Issue #59: the named fields are exactly what siteFields keeps, so no other text passes. */
+const siteShape = {
+	site: z.string().optional(),
+	harness: z.string().optional(),
+	harnessVersion: z.string().optional()
+};
+const onlySiteFields = (value) => {
+	const kept = siteFields(value);
+	return kept?.site === value.site && kept?.harness === value.harness && kept?.harnessVersion === value.harnessVersion;
+};
 const preparationSourceFailureSchema = z.object({
 	location: z.object({
 		workspaceId: z.uuid(),
@@ -2483,10 +2553,19 @@ const preparationSourceFailureSchema = z.object({
 		sourcePartId: z.uuid().optional()
 	}).strict(),
 	rootSessionId: z.uuid().nullable(),
-	detail: artifactFailureDetailSchema.nullable()
-}).strict().refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+	detail: artifactFailureDetailSchema.nullable(),
+	...siteShape
+}).strict().refine(onlySiteFields).refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+/** One count per refusal group over every reported source, unlike the bounded list. */
+const preparationFailureCountSchema = z.object({
+	code: z.string().regex(/^[A-Z_]{3,80}$/u).optional(),
+	...siteShape,
+	count: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).strict().refine(onlySiteFields);
 const preparationFailureContextSchema = preparationFailureBindingsSchema.extend({
 	sourceFailures: z.array(preparationSourceFailureSchema).max(16),
+	sourceFailureCounts: z.array(preparationFailureCountSchema).max(32),
+	/** The list or the counts left something out; the counts cover every source otherwise. */
 	truncated: z.boolean()
 }).refine((context) => Buffer.byteLength(JSON.stringify(context)) <= maximumPreparationContextBytes);
 /** Invalid diagnostic input must never prevent the independent original-error write. */
@@ -2506,16 +2585,19 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 	let context;
 	let families;
 	const roots = new Set(rootSessionIds);
+	const counted = [];
 	try {
 		const parsed = preparationFailureBindingsSchema.safeParse(bindings);
 		if (parsed.success) context = {
 			...parsed.data,
 			sourceFailures: [],
+			sourceFailureCounts: [],
 			truncated: false
 		};
 	} catch {}
 	return {
-		report(location, detail) {
+		/** `cause` contributes only its code and the fixed site fields (siteFields), never text. */
+		report(location, detail, cause) {
 			if (!context) return;
 			try {
 				const checked = validateFailureLocation(inventory, location);
@@ -2527,11 +2609,20 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 					sessionId: root.id
 				}))) return;
 				if (checked.sessionId === void 0 && !inventory.sessions.some((session) => session.workspaceId === checked.workspaceId && roots.has(families?.owners.get(session.id)?.id ?? ""))) return;
+				const named = processingSite(cause);
+				if (!counted.some((seen) => contains(seen, checked) || contains(checked, seen))) {
+					counted.push(checked);
+					context = countFailure(context, {
+						...cause === void 0 ? {} : { code: safeCode(cause) },
+						...named
+					});
+				}
 				const facts = artifactFailureDetailSchema.safeParse(detail);
 				const parsed = preparationSourceFailureSchema.safeParse({
 					location: checked,
 					rootSessionId: root?.id ?? null,
-					detail: facts.success ? facts.data : null
+					detail: facts.success ? facts.data : null,
+					...named
 				});
 				if (!parsed.success) return;
 				const entry = parsed.data;
@@ -2556,13 +2647,50 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 		}
 	};
 }
+/** Adds one source to its (code, site, harness, version) group; a group past the bound truncates. */
+function countFailure(context, group) {
+	const same = JSON.stringify({
+		...group,
+		count: 0
+	});
+	const index = context.sourceFailureCounts.findIndex((entry) => JSON.stringify({
+		...entry,
+		count: 0
+	}) === same);
+	if (index < 0 && context.sourceFailureCounts.length >= 32) return {
+		...context,
+		truncated: true
+	};
+	const next = {
+		...context,
+		sourceFailureCounts: index < 0 ? [...context.sourceFailureCounts, {
+			...group,
+			count: 1
+		}] : context.sourceFailureCounts.map((entry, at) => at === index ? {
+			...entry,
+			count: entry.count + 1
+		} : entry)
+	};
+	return readPreparationFailureContext(next) ? next : {
+		...context,
+		truncated: true
+	};
+}
 //#endregion
 //#region apps/cli/src/journey/prepare.ts
+const pendingSelected = (work) => work.status === "pending" && isSelectedWork(work);
+/** A retried Work is pending even if a previous generation produced a static receipt. */
+function initialScanWorks(state, scanRequested) {
+	if (!scanRequested || state.scope.status !== "confirmed") return [];
+	const selected = state.works.filter(isSelectedWork);
+	if (!selected.some(pendingSelected)) return selected;
+	return selected.filter((work) => work.status === "pending" || ["reading", "review"].includes(work.status) && !hasCurrentStaticReview(state, work));
+}
 function createJourneyPreparation(options) {
 	return async (journeyId, signal) => {
 		const { storage } = options;
 		if (signal?.aborted) throw new ApplicationError("OPERATION_CANCELED");
-		const current = await storage.current(journeyId);
+		const current = await storage.preparationState(journeyId);
 		if (!current?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 		if (obsoleteJourney(current)) throw new ApplicationError("JOURNEY_OBSOLETE");
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
@@ -2585,10 +2713,11 @@ function createJourneyPreparation(options) {
 				terms: []
 			};
 			const plan = await prepareSourcePlan(storage, options.harnesses, journeyId, terms, abort.signal, current.period, options.stateDir);
-			const initial = await storage.current(journeyId);
+			const initial = await storage.preparationState(journeyId);
 			if (!initial?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			const formed = initial.snapshotId ? [] : namedJourneyWorks(formJourneyWorks(plan.approval, options.processing.environment), options.processing, abort.signal);
-			const state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
+			let state;
+			if (!initial.snapshotId) state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
 				...before,
 				snapshotId: before.snapshotId ?? textDigest(JSON.stringify(plan)),
 				...before.snapshotId ? {} : {
@@ -2596,17 +2725,22 @@ function createJourneyPreparation(options) {
 					reviewMethod: "dictionary"
 				},
 				works: before.snapshotId ? before.works : formed,
-				phase: before.phase === "paused" ? "paused" : !before.snapshotId || before.works.some((work) => work.status === "pending" && isSelectedWork(work)) ? "processing" : before.phase
+				phase: before.phase !== "paused" && (!before.snapshotId || before.works.some(pendingSelected)) ? "processing" : before.phase
 			}));
+			else if (initial.phase !== "processing" && initial.phase !== "paused" && initial.works.some(pendingSelected)) state = await changePreparation(storage, journeyId, "snapshot", (before) => before.phase !== "paused" && before.works.some(pendingSelected) ? {
+				...before,
+				phase: "processing"
+			} : before);
+			else state = initial;
 			if (!state.works.length) throw new ApplicationError("INVALID_SELECTION");
 			if (!scanRequested) await captureSortingScope(storage, journeyId, workApproval(plan.approval, state.works.flatMap((work) => work.rootSessionIds)), directory, abort.signal);
-			const scanWorks = scanRequested && state.scope.status === "confirmed" ? state.works : [];
+			const scanWorks = initialScanWorks(state, scanRequested);
 			if (scanWorks.length) run = await runWorkers(options.workers);
 			const frozen = state;
 			const blockedForRetry = new Set(state.works.filter((work) => work.status === "blocked").map((work) => `${work.id}:${work.inputRevision}`));
 			const deferredForHide = /* @__PURE__ */ new Set();
 			const blockWork = async (work, error) => {
-				const blocked = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const blocked = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					if (before.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 					if (before.phase === "sending" || before.phase === "completed") return before;
 					return withReadingProgress({
@@ -2645,7 +2779,7 @@ function createJourneyPreparation(options) {
 				abort.signal.throwIfAborted();
 				let resumed = false;
 				let deferred = false;
-				const committed = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const committed = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					resumed = false;
 					deferred = false;
 					const target = before.works.find((item) => item.id === work.id);
@@ -2654,17 +2788,13 @@ function createJourneyPreparation(options) {
 					deferred = !resumed;
 					return withReadingProgress({
 						...before,
-						privacy: {
-							...before.privacy,
-							packageApproval: null
-						},
 						works: before.works.map((item) => item.id === work.id ? {
 							...item,
 							status: resumed ? work.status : "pending",
 							blockedCodes: []
 						} : item)
 					});
-				}, 100);
+				}, 100, true);
 				if (deferred && committed.pendingHideId && committed.works.some((item) => generation(item) === generation(work) && item.status === "pending")) deferredForHide.add(generation(work));
 				return resumed;
 			};
@@ -2684,7 +2814,7 @@ function createJourneyPreparation(options) {
 			};
 			/** D2: the person dropped this Work while it was prepared; the other Works go on. */
 			const droppedMidScan = async (workId) => {
-				const now = await storage.current(journeyId);
+				const now = await storage.preparationState(journeyId);
 				const work = now?.works.find((item) => item.id === workId);
 				return Boolean(now && now.phase !== "paused" && now.scope.status === "confirmed" && work && !isSelectedWork(work));
 			};
@@ -2693,7 +2823,7 @@ function createJourneyPreparation(options) {
 			/** True when failing roots left the Work, which is then prepared again (ADR 0188). */
 			const prepareWorkAttempt = async (planned, onSubmitted, releaseRead) => {
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId) ?? frozen;
+				const latest = await storage.preparationState(journeyId) ?? frozen;
 				abort.signal.throwIfAborted();
 				if (latest.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 				let work = latest.works.find((item) => item.id === planned.id);
@@ -2717,7 +2847,7 @@ function createJourneyPreparation(options) {
 						signal: abort.signal,
 						onTemporary: async () => {},
 						onPhase: async () => {},
-						onFailureLocation: (location) => failures.report(location),
+						onFailureLocation: (location, _detail, cause) => failures.report(location, void 0, cause),
 						onTiming: (timing) => options.onTiming?.(planned.id, timing)
 					}, run.workers, (revised) => {
 						work = revised;
@@ -2745,7 +2875,7 @@ function createJourneyPreparation(options) {
 						readRetries.set(generation(work), attempt + 1);
 						return prepareWorkOnce(planned, onSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase === "sending" || now?.phase === "completed") return false;
 					if (blockedCodes(error, code).includes("PRIVACY_CHANGE_PENDING")) {
 						if (work) await blockWork(work, error);
@@ -2775,7 +2905,7 @@ function createJourneyPreparation(options) {
 			const staticWork = async (planned, passSubmitted) => {
 				await passSubmitted;
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId);
+				const latest = await storage.preparationState(journeyId);
 				abort.signal.throwIfAborted();
 				if (!latest?.consent || latest.phase === "paused" || latest.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
 				const work = latest.works.find((item) => item.id === planned.id);
@@ -2803,7 +2933,7 @@ function createJourneyPreparation(options) {
 						staticRetries.set(generation(work), attempt + 1);
 						return staticWork(planned, passSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase !== "sending" && now?.phase !== "completed" && (attempt >= retryLimit || blockedCodes(error, safeCode(error)).includes("PRIVACY_CHANGE_PENDING"))) await blockWork(work, error);
 				}
 			};
@@ -2881,7 +3011,7 @@ function createJourneyPreparation(options) {
 				for (;;) {
 					abort.signal.throwIfAborted();
 					const settled = workSettled.promise;
-					const latest = await storage.current(journeyId);
+					const latest = await storage.preparationState(journeyId);
 					if (!latest || latest.phase === "paused" || latest.scope.status !== "confirmed") return [];
 					for (const work of latest.works) if (work.status === "blocked") blockedForRetry.add(generation(work));
 					const ready = latest.works.filter((work) => isSelectedWork(work) && [
@@ -2902,7 +3032,8 @@ function createJourneyPreparation(options) {
 				}
 			};
 			try {
-				for (let batch = scanWorks; batch.length && !fatal; batch = await later()) {
+				const firstBatch = scanRequested && !scanWorks.length && isClassifying(state) ? await later() : scanWorks;
+				for (let batch = firstBatch; batch.length && !fatal; batch = await later()) {
 					if (!run.workers && !run.pool) run = await runWorkers(options.workers);
 					await pass(batch);
 				}
@@ -2921,7 +3052,7 @@ function createJourneyPreparation(options) {
 			});
 			if (fatal) throw fatal.error;
 			abort.signal.throwIfAborted();
-			const result = await storage.current(journeyId);
+			const result = await storage.preparationState(journeyId);
 			await stopObserving();
 			abort.signal.throwIfAborted();
 			if (!result?.consent || result.phase === "paused" || scanRequested && result.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
@@ -4786,14 +4917,18 @@ function createClassificationProposal(storage, accountAccess) {
 		};
 		const { works } = classificationWorks(state, prepared);
 		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
-		const access = late ? await accountAccess?.({
+		const read = late ? await accountAccess?.({
 			...state,
 			works
 		}, signal) : void 0;
+		const sameAccount = read?.status === "read" && state.accountRead?.status === "read" && state.accountRead.subject === read.subject;
 		return storage.commitClassification({
 			...prepared,
 			chunkSessions,
-			...access ? { accountAccess: Object.fromEntries(access) } : {}
+			...sameAccount ? {
+				accountAccess: Object.fromEntries(read.access),
+				accountSubject: read.subject
+			} : read ? { accountRead: read.status === "read" ? "unavailable" : read.status } : {}
 		});
 	};
 }
@@ -6204,7 +6339,7 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 			for (const source of sources) if (source.logicalWorkId !== item.workId && source.access !== item.access) record(item, key, "held-elsewhere", source);
 			const sha256 = item.sessionMembership ? sources[0]?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
 			if (sha256) claimContent(key, sha256, item);
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && (item.sessionMembership || entry.sha256 === sha256))) record(item, key, "destination-access", destination);
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
 	}
 	for (const item of items) {
@@ -6233,7 +6368,7 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 				observe(item, work.access);
 				if (work.logicalWorkId !== item.workId && work.access !== item.access) record(item, entry.key, "held-elsewhere", work);
 			}
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && entry.sha256 === session.sha256)) record(item, key, "destination-access", destination);
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
 	}
 	return [...conflicts.values()].map((conflict) => (accountAccesses.get(conflict.workId)?.size ?? 0) > 1 ? {
@@ -7276,8 +7411,10 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 			break;
 		}
 	}
+	const ownKeys = /* @__PURE__ */ new Set();
 	for await (const session of sessions(journeyId, item.artifact, signal)) {
 		const identity = await keys.add(session);
+		ownKeys.add(identity.key);
 		if (recoverLegacy && (identity.legacyKey !== pending?.key || session.sha256 !== pending?.sha256)) continue;
 		const key = recoverLegacy && pending ? pending.key : identity.key;
 		if (stored.get(key)?.sha256 === session.sha256) {
@@ -7303,13 +7440,23 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 	const assembly = await remote.assembly(item.workId, signal);
 	const current = (await remote.inventory(signal)).works.find((work) => work.logicalWorkId === item.workId);
 	if (current && current.access !== item.access) {
-		const resolution = await connection.resolve(resolveInput(item, context.bindingId), signal);
-		const [candidate] = resolution.candidates;
-		if (resolution.status === "blocked" || candidate?.access === "removed") throw new ApplicationError("WORK_REMOVED");
-		if (resolution.status !== "matched" || resolution.logicalWorkId !== item.workId || resolution.candidates.length !== 1 || !candidate || context.bindingId !== void 0 && candidate.bindingId !== context.bindingId) throw new ApplicationError("INVALID_STATE");
-		const settings = await connection.preview(candidate.workId, item.access, signal);
+		if (current.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		const [ownKey] = ownKeys;
+		if (!ownKey) throw new ApplicationError("INVALID_STATE");
 		await guard();
-		await connection.confirm(settings, signal);
+		return {
+			...item,
+			status: "blocked",
+			error: "SESSION_MOVE_ACCESS_REQUIRED",
+			accessConflict: {
+				sessionKey: ownKey,
+				requestedAccess: item.access,
+				accountWorkId: current.logicalWorkId,
+				accountAccess: current.access,
+				rule: "destination-access"
+			},
+			accessConflictSessionCount: ownKeys.size
+		};
 	}
 	await guard();
 	return {
@@ -7752,10 +7899,21 @@ async function advanceSend(dependencies, address, signal, chain) {
 				error: "SEND_SCOPE_CHANGED"
 			})
 		});
+		const invalidated = safeCode(error) === "SEND_SCOPE_INVALIDATED";
+		const answered = (item) => {
+			const work = snapshot.journey.works.find((work) => work.id === item.workId);
+			return !work || work.access !== item.access;
+		};
+		const answeredSessions = new Set(snapshot.send.items.flatMap((item) => item.error === "SESSION_MOVE_ACCESS_REQUIRED" && item.accessConflict && answered(item) ? [item.accessConflict.sessionKey] : []));
 		return blockSend({
-			send: safeCode(error) === "SEND_SCOPE_INVALIDATED" ? {
+			send: invalidated ? {
 				...snapshot.send,
-				items: snapshot.send.items.filter((item) => !["SESSION_MOVE_ACCESS_REQUIRED", "SESSION_MOVE_ACCESS_HELD"].includes(item.error ?? ""))
+				items: snapshot.send.items.filter((item) => {
+					if (item.error === "SESSION_MOVE_ACCESS_HELD") return false;
+					if (item.error !== "SESSION_MOVE_ACCESS_REQUIRED") return true;
+					if (item.accessConflict?.accountAccess === null && answeredSessions.has(item.accessConflict.sessionKey)) return false;
+					return !answered(item);
+				})
 			} : snapshot.send,
 			failure: dependencies.failure,
 			save
@@ -7803,7 +7961,7 @@ async function advanceSend(dependencies, address, signal, chain) {
 							if (item.sessionAssembly || item.status === "completed") return item;
 							const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
 							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
-							const conflict = itemConflicts[0];
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
 							if (!conflict) return {
 								...current,
 								status: "blocked",
@@ -9708,10 +9866,12 @@ function createJourneySender(dependencies, phases = 3, host = {
 					try {
 						const conflicts = inventory ? await sessionAccessBlocked(dependencies, input.journeyId, draft.items, inventory, signal) : [];
 						for (const item of draft.items) {
-							const conflict = conflicts.find((entry) => entry.workId === item.workId && entry.accountAccess !== null) ?? conflicts.find((entry) => entry.workId === item.workId);
+							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
 							if (conflict) {
 								const { workId: _, ...accessConflict } = conflict;
 								item.accessConflict = accessConflict;
+								item.accessConflictSessionCount = new Set(itemConflicts.map((entry) => entry.sessionKey)).size;
 							}
 						}
 					} catch (error) {
@@ -9735,8 +9895,11 @@ function createJourneySender(dependencies, phases = 3, host = {
 				}
 			}
 			for (const item of observed ? [] : draft.items) {
-				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access)?.accessConflict;
-				if (previous && !item.accessConflict) item.accessConflict = previous;
+				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access);
+				if (previous?.accessConflict && !item.accessConflict) {
+					item.accessConflict = previous.accessConflict;
+					item.accessConflictSessionCount = previous.accessConflictSessionCount;
+				}
 			}
 			const canReuseExistingSend = !(snapshot.send?.confirmedAt && ["blocked", "paused"].includes(snapshot.send.status)) && !recover && snapshot.send && scopeDigest(snapshot.journey) === snapshot.send.scopeDigest && snapshot.send.subject === draft.subject;
 			const next = pending ? {
@@ -10093,6 +10256,27 @@ function createJourneySendAuth(account, requestFetch) {
 }
 //#endregion
 //#region apps/cli/src/account/journey/account-access.ts
+/**
+* Whole scope-confirm account read: identity, every inventory page and a token refresh. A 203-Work,
+* 1,400-session account took 2.3 to 3.4 s for its pages plus a refresh, past the earlier 5 s
+* (issue #53). On expiry the read is `unavailable` (ADR 0277 section 5).
+*/
+const accountReadBoundMs = 3e4;
+const ownerBodyErrors = /* @__PURE__ */ new Set(["OWNER_EMPTY_RESPONSE", "OWNER_RESPONSE_LIMIT"]);
+/** Why the read failed, from error types and codes only; messages are never logged. */
+function failureClass(error, depth = 0) {
+	if (!(error instanceof Error)) return "other";
+	if (error.name === "TimeoutError") return "timeout";
+	if (isCode(error, "ACCOUNT_SIGNED_OUT") || isCode(error, "IDENTITY_REJECTED")) return "signed-out";
+	if (error instanceof JourneyRemoteError) {
+		if (error.status === 401 || error.status === 403) return "signed-out";
+		return error.status >= 500 || error.status === 429 ? "network" : "protocol";
+	}
+	if (isCode(error, "IDENTITY_UNAVAILABLE") && isInterrupted(error.cause)) return failureClass(error.cause, 1);
+	if (isCode(error, "IDENTITY_UNAVAILABLE") || error instanceof SyntaxError || ownerBodyErrors.has(error.message)) return "protocol";
+	if (isInterrupted(error)) return "network";
+	return depth === 0 && error.cause !== void 0 ? failureClass(error.cause, 1) : "other";
+}
 /** Current and legacy upload keys of every part of one local session. */
 async function keysOf(session) {
 	const keys = [];
@@ -10146,9 +10330,13 @@ async function accountAccessForRoots(state, roots, inventory, members) {
 	}
 	return result;
 }
-/** Existing authenticated owner ports supply inventory; signed-out scope confirmation stays local. */
+/**
+* Existing authenticated owner ports supply inventory. The result is three-way (ADR 0277 section
+* 5): a caller stops on `signed-out` or `unavailable` instead of using model access.
+*/
 function createAccountAccess(storage, auth) {
 	return async (state, signal) => {
+		const started = Date.now();
 		const controller = new AbortController();
 		const boundedSignal = AbortSignal.any([signal, controller.signal]);
 		let timer;
@@ -10157,12 +10345,12 @@ function createAccountAccess(storage, auth) {
 			onAbort = () => reject(/* @__PURE__ */ new Error("ACCOUNT_ACCESS_CANCELLED"));
 			boundedSignal.addEventListener("abort", onAbort, { once: true });
 			if (boundedSignal.aborted) onAbort();
-			timer = setTimeout(() => controller.abort(), 5e3);
+			timer = setTimeout(() => controller.abort(), accountReadBoundMs);
 		});
 		const read = async () => {
 			boundedSignal.throwIfAborted();
 			const connection = await auth.connect(boundedSignal);
-			if (!connection?.sessions) return /* @__PURE__ */ new Map();
+			if (!connection?.sessions) return { status: "signed-out" };
 			const plan = (await storage.resources({
 				journeyId: state.journeyId,
 				kind: "plan"
@@ -10171,13 +10359,24 @@ function createAccountAccess(storage, auth) {
 			const inventory = await connection.sessions.inventory(boundedSignal);
 			const access = await accountAccessForRoots(state, plan.approval.inventory.sessions, inventory, reviewFamilies(plan.approval.inventory).members);
 			await connection.assertCurrent(boundedSignal);
-			return access;
+			return {
+				status: "read",
+				subject: connection.subject,
+				access
+			};
 		};
 		try {
 			return await Promise.race([read(), stopped]);
-		} catch {
-			console.error("ACCOUNT_ACCESS_UNAVAILABLE: using model access");
-			return /* @__PURE__ */ new Map();
+		} catch (error) {
+			if (error instanceof ApplicationError && ![
+				"ACCOUNT_SIGNED_OUT",
+				"IDENTITY_REJECTED",
+				"IDENTITY_UNAVAILABLE",
+				"CREDENTIAL_STORE_FAILED"
+			].includes(error.code)) throw error;
+			const reason = signal.aborted ? "cancelled" : controller.signal.aborted ? "timeout" : failureClass(error);
+			console.error(`ACCOUNT_ACCESS_UNAVAILABLE: account read failed (class=${reason} elapsedMs=${Date.now() - started})`);
+			return { status: reason === "signed-out" ? "signed-out" : "unavailable" };
 		} finally {
 			clearTimeout(timer);
 			boundedSignal.removeEventListener("abort", onAbort);
@@ -11313,7 +11512,8 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 				code: safeCode(error),
 				at: (/* @__PURE__ */ new Date()).toISOString(),
 				stage,
-				...operationId ? { operationId } : {}
+				...operationId ? { operationId } : {},
+				...processingSite(error)
 			};
 			summary(diagnostic);
 			if (closed) {
@@ -11349,14 +11549,18 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 			}
 		},
 		onDiagnostic(diagnostic, error) {
-			summary(diagnostic);
+			const named = {
+				...diagnostic,
+				...processingSite(error)
+			};
+			summary(named);
 			if (closed) {
-				unavailable(diagnostic);
+				unavailable(named);
 				return;
 			}
 			try {
 				local.logger.error({
-					...diagnostic,
+					...named,
 					error: errorDetail(error)
 				});
 			} catch {
@@ -11872,6 +12076,13 @@ async function compose(options, callbacks, bundles) {
 			}),
 			journeyLocal: {
 				accountAccess,
+				async accountState() {
+					const view = await account.status();
+					return {
+						configured: view.configuration.clientId !== null,
+						subject: view.state === "signed-in" ? view.identityId : null
+					};
+				},
 				titles: createJourneyTitles(journeyStorage, processing),
 				describe: createJourneyDescription(journeyStorage, processing),
 				works: createJourneyWorks(journeyStorage, processing, stateDir, accountAccess),
@@ -12143,7 +12354,14 @@ async function invoke(runtime, command, value, signal) {
 		case "journey.findingImpact": return app.journey?.findingImpact(value);
 		case "journey.preview": return app.journey?.preview(value);
 		case "journey.files": return app.journey?.files(value);
-		case "journey.prepare": return app.journey?.prepare(value, signal);
+		case "journey.prepare": {
+			const input = z.object({
+				journeyId: z.uuid(),
+				result: z.literal("receipt").optional()
+			}).strict().parse(value);
+			return input.result === "receipt" ? app.journey?.prepareReceipt({ journeyId: input.journeyId }, signal) : app.journey?.prepare({ journeyId: input.journeyId }, signal);
+		}
+		case "review.reopenEmpty": return app.journey?.reopenEmpty(value);
 		case "review.terms": return app.journey?.terms(value);
 		case "review.status": return app.journey?.reviewStatus(value);
 		case "review.guidance": return app.journey?.guidance(value);