@gitroll/tacitt-cli 0.6.10 → 0.6.12

package/dist/{query-By41gaKm.mjs → query-BYDcNKy2.mjs}

@@ -1,10 +1,11 @@
-import { $ as createCleanup, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as removeNamedTemporarySpools, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as createTemporary, _ as processJourneyMetadata, a as scanReviewFields, at as windowsOwnerOnly, c as readSessionScanRecords, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as restrictToOwner, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, nt as makePrivateDirectory, o as createWorkPieces, ot as isWindowsAclFailure, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as openPrivateFile, s as readSessionScanFields, st as windowsAclCodes, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-3jvMvSQn.mjs";
-import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BHIwElNF.mjs";
-import { $t as safeField, Bt as sessionPeriodSchema, Dn as createStaticProcessor, Fn as entityDictionaryVersion, Ft as termTypeInfo, Gt as ownerProfileSchema, Kt as passportAddressSchema, Ot as privacyTermKey, Qt as safeCode, Sn as currentDetectorVersion, T as bLiteralTerms, Un as frameRecords, Wt as mergeOwnerProfile, Xt as ApplicationError, Zt as UnfinishedJourneyError, an as observeSource, ar as admitCustomTerm, c as textDigest, ir as createEntityMatcher, nn as reviewFamilies, or as admitGitName, qt as profileHasChoices, tn as familySelected, ur as ProcessingError, zt as filterInventoryByPeriod } from "./locate-Cwv6WH8n.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-D_DfY--2.mjs";
-import { $r as isClassifying, $t as searchScopeDigest, Ar as displayedScopeDigest, At as obsoleteJourney, B as createApplication, Br as staticReviewDigest, Bt as classificationPartition, Ct as sendActionSchema, Dt as sendStartSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, Gr as agentSourcesSchema, H as inspectionStartSchema, Ht as applyClassification, I as storedCredentialSchema, Jn as workDecisionDigest, Jr as sendReceiptSchema, K as inspectionQuerySchema, Kr as journeySendSchema, Ln as bTermMatcher, M as deviceAuthorizationSchema, N as deviceProfileScopeSchema, Nr as assertJourneyPrivacyReady, O as createAccount, P as profileUrlMatchesIdentity, Pr as privacyDecisionDigest, Qr as hasCompleteWorkDescription, St as replaceSensitiveTermsSchema, Tt as sendPrepareSchema, U as validateInspectionBatch, Ut as retireScanGeneration, V as inspectionCancelSchema, Vn as confirmedHideKinds, Vt as classificationWorks, Wn as journeyConfirmedHides, Wr as agentSourceSchema, Wt as newJourneyWork, Xn as workCorrectionBinding, Xr as sendResolutionSchema, Yr as sendReplaceResultSchema, Zr as sendSettingsSchema, Zt as journeySearchResultSchema, _ as changeJourney, _t as manualUploadStartSchema, ai as withReadingProgress, at as appendSensitiveTerms, ci as selectionBatchSchema, cr as scanSessionResourceSchema, di as producerVersion, dr as verifiedScanGitSeeds, dt as validateFailureLocation, ei as isIncludedWork, fr as scanExclusionResourceSchema, ft as manualUploadActionSchema, gt as manualUploadSchema, h as hideScopeDigest, ht as manualUploadPrepareSchema, j as accountProfileSchema, jr as requestedScope, k as renew, kt as currentJourneyAdapters, li as selectionSchema, lr as scanGitSeedsId, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mi as recommendParallelism, mt as manualUploadChoiceSchema, ni as isSelectedWork, nt as settingsQuerySchema, oi as commandSchema, qn as retireWorkDescription, qr as sendArtifactSchema, si as packageCommandSchema, sr as scanPreparationDigest, ti as isReadingComplete, tt as settingsBatchSchema, ur as scanGitSeedsResource, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yr as emptyPreparationFacts, yt as emptyTermsRevision, zr as hasCurrentStaticReview } from "./src-BqtdFVq7.mjs";
-import { _t as isCoordinationBusy } from "./heap-CM298Yu0.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-LPd8WEsN.mjs";
+import { $ as decodeZstd, A as captureLogicalJourneySources, B as defaultParallelism, D as createCollectionArtifacts, E as readConfiguredSearchFields, G as readLogicalJourneyFinalMasks, H as parallelismLimits, I as createSharedSessionPool, J as staticMaskCategory, K as readConfiguredOutputInfo, L as SessionWorkerError, N as runConfiguredSessionJob, R as sessionWorkerFailure, T as readOriginalSearchFields, V as gitSeedsProvider, W as privateJourneyDirectory, Y as readWorkspacePair, a as prepareSessionScans, at as makePrivateDirectory, b as readStaticSessionMasks, c as createWorkPieces, ct as windowsOwnerOnly, d as scanPreparedSession, et as createTemporary, g as openConfiguredUpload, h as configuredSessionUploads, i as verifyPreparedSessionSources, j as capturedJourneyScope, l as readSessionScanFields, lt as isWindowsAclFailure, n as sessionExtensions, nt as createCleanup, o as buildWorkScanBatches, ot as openPrivateFile, q as processJourneyMetadataFields, r as preparedScanConfiguration, s as scanReviewFields, st as restrictToOwner, t as hasRetiredSessionMarker, tt as removeNamedTemporarySpools, u as readSessionScanRecords, ut as windowsAclCodes, v as readCapturedOriginalRows, x as staticSessionJobs, y as processJourneyMetadata } from "./src-DeNJ8vOD.mjs";
+import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-CBuIMTQ0.mjs";
+import { $t as profileHasChoices, D as bLiteralTerms, Gt as filterInventoryByPeriod, Kt as sessionPeriodSchema, Mt as privacyTermKey, Nn as createStaticProcessor, On as currentDetectorVersion, Qt as passportAddressSchema, Vn as entityDictionaryVersion, Vt as termTypeInfo, Xt as mergeOwnerProfile, Yn as frameRecords, Zt as ownerProfileSchema, an as safeField, br as processingSite, cn as reviewFamilies, dn as observeSource, dr as admitCustomTerm, fr as admitGitName, gr as ProcessingError, in as safeCode, nn as ApplicationError, rn as UnfinishedJourneyError, sn as familySelected, u as textDigest, ur as createEntityMatcher, xr as siteFields } from "./locate-D-ZaHpI0.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-CKQlTA2Z.mjs";
+import { An as scanExclusionResourceSchema, B as createApplication, Bt as newJourneyWork, Ci as withReadingProgress, Ct as sendActionSchema, Di as selectionSchema, Dn as scanGitSeedsId, Dt as sendStartSchema, Ei as selectionBatchSchema, En as scanSessionResourceSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, Fr as assertJourneyPrivacyReady, Gr as currentJourneyAdapters, H as inspectionStartSchema, I as storedCredentialSchema, Ir as privacyDecisionDigest, It as classificationPartition, Jr as obsoleteJourney, K as inspectionQuerySchema, Kr as hostDrives, Lt as classificationWorks, M as deviceAuthorizationSchema, Mi as recommendParallelism, Mr as displayedScopeDigest, N as deviceProfileScopeSchema, Nr as requestedScope, O as createAccount, On as scanGitSeedsResource, P as profileUrlMatchesIdentity, Rn as applyClassification, Rt as retireScanGeneration, Si as unfinishedPackagingCode, St as replaceSensitiveTermsSchema, Ti as packageCommandSchema, Tn as scanPreparationDigest, Tt as sendPrepareSchema, U as validateInspectionBatch, Ur as advanceStepsSend, V as inspectionCancelSchema, Vn as searchScopeDigest, Vr as nativeStartSchema, Zr as sendsOnNextAdvance, _ as changeJourney, _i as isIncludedWork, _r as workCorrectionBinding, _t as manualUploadStartSchema, at as appendSensitiveTerms, ci as journeySendSchema, cr as confirmedHideKinds, di as sendReplaceResultSchema, dr as journeyConfirmedHides, dt as validateFailureLocation, fi as sendResolutionSchema, ft as manualUploadActionSchema, gi as isClassifying, gt as manualUploadSchema, h as hideScopeDigest, hi as hasCompleteWorkDescription, hr as workDecisionDigest, ht as manualUploadPrepareSchema, ir as bTermMatcher, j as accountProfileSchema, k as renew, ki as producerVersion, kn as verifiedScanGitSeeds, li as sendArtifactSchema, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mi as sendSettingsSchema, mr as retireWorkDescription, mt as manualUploadChoiceSchema, ni as staticReviewDigest, nt as settingsQuerySchema, oi as agentSourceSchema, qr as itemAtPassport, ri as staticSessionId, si as agentSourcesSchema, ti as hasCurrentStaticReview, tt as settingsBatchSchema, ui as sendReceiptSchema, vi as isReadingComplete, vr as emptyPreparationFacts, wi as commandSchema, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yi as isSelectedWork, yt as emptyTermsRevision, zn as journeySearchResultSchema, zt as isolatedWorkId } from "./src-Do-qzuMn.mjs";
+import { vt as isCoordinationBusy } from "./heap-Blrat--4.mjs";
+import { d as checkOpenSource, h as openSource } from "./run-DQ9xyKSt.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-B12VbvN_.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -92,7 +93,7 @@ function permissionDiagnostic(error) {
 function startupFailure(error, platform = process.platform) {
 	const code = safeCode(error);
 	const permission = permissionDiagnostic(error);
-	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run `npx --yes @gitroll/tacitt-cli@latest` with your original options to start the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
+	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run the same command through `npx --yes @gitroll/tacitt-cli@latest` to use the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
 	return `${code}.${code === "OPERATION_FAILED" ? failureCause(error) : ""}${permission}${advice}\n`;
 }
 const safeJourneyId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
@@ -123,6 +124,7 @@ const businessCommands = [
 	"journey.classificationSessions",
 	"journey.classificationProgress",
 	"journey.classificationSubmit",
+	"journey.recoverIsolatedMetadata",
 	"journey.cardsRead",
 	"journey.cardsSubmit",
 	"journey.resolve",
@@ -141,6 +143,7 @@ const businessCommands = [
 	"journey.findingImpact",
 	"journey.files",
 	"journey.prepare",
+	"review.reopenEmpty",
 	"review.terms",
 	"review.status",
 	"review.guidance",
@@ -214,6 +217,23 @@ const accountDefaults = {
 	clientId: "BdSyvRSunWdXfJUdfvaKuAgoRjaZQpOZ",
 	passportApiUrl: "https://talent-api.catalyte.ai"
 };
+/** The web origin paired with each deployed Passport API; custom targets supply theirs. */
+function passportWebOrigin(apiUrl, configured) {
+	if (configured) {
+		const url = new URL(configured);
+		const local = [
+			"127.0.0.1",
+			"[::1]",
+			"localhost"
+		].includes(url.hostname);
+		if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error("INVALID_ARGUMENTS");
+		return url.origin;
+	}
+	return {
+		"https://talent-api.catalyte.ai": "https://talent.catalyte.ai",
+		"https://talent-api-dev.catalyte.ai": "https://talent-dev.catalyte.ai"
+	}[new URL(apiUrl).origin];
+}
 //#endregion
 //#region apps/cli/src/options.ts
 /** An HTTP(S) origin without path, query, credentials or fragment. */
@@ -333,6 +353,7 @@ function parseOptions(args, source = sourceCheckout) {
 		sessionPeriod: period.data,
 		identityUrl: readOrigin(parsed.values["identity-url"] ?? process.env["SESS_PILOT_IDENTITY_URL"] ?? accountDefaults.identityUrl),
 		identityClientId: identityClientId === "" ? null : identityClientId,
+		...process.env["SESS_PILOT_PASSPORT_WEB_ORIGIN"] ? { passportWebOrigin: readOrigin(process.env["SESS_PILOT_PASSPORT_WEB_ORIGIN"]) } : {},
 		passportApiUrl: readOrigin(parsed.values["profile-api-url"] ?? parsed.values["passport-api-url"] ?? process.env["SESS_PILOT_PROFILE_API_URL"] ?? process.env["SESS_PILOT_PASSPORT_API_URL"] ?? accountDefaults.passportApiUrl),
 		stateDir: resolve(parsed.values["state-dir"] ?? defaultState),
 		bundleDir: parsed.values["bundle-dir"] === void 0 ? void 0 : resolve(parsed.values["bundle-dir"]),
@@ -342,13 +363,14 @@ function parseOptions(args, source = sourceCheckout) {
 }
 const fullHelp = `tacitt — review and package local session logs
 
-Usage: tacitt [--no-open] [--state-dir PATH] [--bundle-dir PATH] [--parallelism N]
-              [--since DATE] [--until DATE]
-       tacitt state dump [--state-dir PATH] [--output PATH]
-       tacitt status [--state-dir PATH]
+Usage: tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
        tacitt PROCEDURE [--input FILE|-] [--async] [--timeout-ms N]
        tacitt operation.get|operation.wait|operation.cancel ID [--timeout-ms N]
-       tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
+       tacitt state dump [--state-dir PATH] [--output PATH]
+       tacitt status [--state-dir PATH]
+
+Tacitt has three surfaces: the Skill (/tacitt in Claude Code, $tacitt in Codex), the Skill
+panel that the Skill opens, and the CLI commands below. Bare tacitt prints how to start the Skill.
 
 Business procedures (JSON output):
 ${Array.from(businessCommands).join("\n")}
@@ -356,7 +378,8 @@ ${Array.from(businessCommands).join("\n")}
 Business commands invoke the shared Application directly without an HTTP server.
 journey.serve starts a focused confirmation host, emits JSON readiness, and waits until stopped.
 journey.serve --detach starts that host in its own process, prints its readiness with the host's
-pid, and exits; stop the host with that pid. A detached host already serving the journey is
+pid, and exits. The launcher verifies the release and process identity before reusing a panel.
+A detached host already serving the journey with the paired release is
 reused and reported with reused: true.
 It does not discover sessions or open a browser. The agent opens its private URL in the right pane.
 Workflow mutations require protocolVersion, runId and expectedRevision in JSON input.
@@ -372,12 +395,11 @@ Workspace ZIPs and collection indexes use the saved bundle library directory.
 Native Skill Send uploads only the confirmed primary artifacts to the configured Tacitt profile API.
 status prints safe workspace outcomes from the latest saved packaging operation.
 Private packaging error details stay in <state-dir>/diagnostics/ (up to 4 MiB).
-Sign in from the Web UI to link this tool to your GitRoll Identity account; the CLI contacts
+Sign in from the Skill panel to link this tool to your GitRoll Identity account; the CLI contacts
 only the Identity and profile API origins below, only when you ask, and keeps the issued
 token in <state-dir>/account/ (owner-only).
 
 Options:
-  --no-open                 Print the URL without opening a browser
   --agent CLIENT            skill.install only: codex, claude or all (default: all)
   --scope SCOPE             skill.install only: user or project (default: user)
   --cli-path PATH           skill.install only: bind an absolute installed package executable
@@ -388,10 +410,7 @@ Options:
   --claude-home PATH        Override the Claude configuration root
   --codex-home PATH         Override the Codex configuration root
   --overwrite-corrupted    Explicitly reset unusable control-plane state
-  --parallelism N          Configured packaging worker count (default: the Package dialog recommendation)
-  --since DATE              Manual: preselect only sessions last active on or after DATE
-  --until DATE              Manual: preselect only sessions last active on or before DATE
-                            (DATE: YYYY-MM-DD local day, inclusive, or an ISO timestamp)
+  --parallelism N          Preparation and packaging worker count (default: recommended for this computer)
   --identity-url URL        Identity origin for sign-in (default: ${accountDefaults.identityUrl})
   --identity-client-id ID   Public device client ID registered for this tool
   --profile-api-url URL     Profile API origin the token is checked against
@@ -617,12 +636,14 @@ async function scanRemoteDispatches(sessions, signal) {
 		const pending = /* @__PURE__ */ new Map();
 		for (const part of session.parts) {
 			signal.throwIfAborted();
-			if (part.representation !== "jsonl") throw new Error("REMOTE_SOURCE_FORMAT_UNSUPPORTED");
-			const file = await open(part.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+			const mode = part.representation === "jsonl" ? "append" : "snapshot";
+			const file = await openSource(part, mode);
 			try {
-				const before = await file.stat({ bigint: true });
-				if (String(before.dev) !== part.snapshot.dev || String(before.ino) !== part.snapshot.ino || before.size !== BigInt(part.snapshot.size) || String(before.mtimeNs) !== part.snapshot.mtimeNs || String(before.ctimeNs) !== part.snapshot.ctimeNs) throw new Error("REMOTE_SOURCE_CHANGED");
-				if (!part.snapshot.size) continue;
+				if (!part.snapshot.size) {
+					if (part.representation === "jsonl.zst") throw new Error("ARTIFACT_PROCESSING_DECODE_FAILED");
+					await checkOpenSource(part, file, mode);
+					continue;
+				}
 				const stream = file.createReadStream({
 					autoClose: false,
 					start: 0,
@@ -637,7 +658,7 @@ async function scanRemoteDispatches(sessions, signal) {
 					unreadableLines++;
 					cause ??= /* @__PURE__ */ new Error(`line ${location.line}, invalid UTF-8`);
 				};
-				const lines = frameRecords(numberedChunks(stream, location), "jsonl", 16777216, signal);
+				const lines = frameRecords(numberedChunks(part.representation === "jsonl.zst" ? decodeZstd(stream, signal) : stream, location), "jsonl", 16777216, signal);
 				try {
 					for await (const framed of skipLiveTail(lines, location, skipped)) {
 						signal.throwIfAborted();
@@ -671,11 +692,10 @@ async function scanRemoteDispatches(sessions, signal) {
 								end: end && end >= at ? end : at
 							}));
 							windows.push(...found);
-							pending.set(command.id, found);
+							if (found.length) pending.set(command.id, found);
 						}
 					}
-					const after = await file.stat({ bigint: true });
-					if (after.mtimeNs !== before.mtimeNs || after.size !== before.size) throw new Error("REMOTE_SOURCE_CHANGED");
+					await checkOpenSource(part, file, mode);
 				} finally {
 					stream.destroy();
 				}
@@ -743,7 +763,10 @@ function createRemotePreflight(options) {
 				} catch (error) {
 					signal.throwIfAborted();
 					options.reportFailure(error);
-					state.failures.push("source-scan");
+					if (!state.failures.includes("source-scan")) state.failures.push("source-scan");
+					const reason = sourceFailureReason(error);
+					const counts = state.sourceFailureCounts ??= {};
+					counts[reason] = (counts[reason] ?? 0) + 1;
 				}
 				await saveRemoteState(options.stateDir, input.journeyId, state);
 			}
@@ -780,9 +803,23 @@ function result(state) {
 		})),
 		copied: state.copied.length,
 		failures: state.failures,
+		...state.sourceFailureCounts ? { sourceFailureCounts: state.sourceFailureCounts } : {},
 		...state.failures.some((failure) => ["source-lines-unreadable", "source-scan"].includes(failure)) ? { warning: state.failures.includes("source-scan") ? "Some remote sources could not be scanned; remote worker discovery may be incomplete." : "Some remote dispatch lines were unreadable; remote worker discovery may be incomplete." } : {}
 	};
 }
+function sourceFailureReason(error) {
+	if (!(error instanceof Error)) return "other";
+	if (error instanceof SyntaxError) return "invalid-json";
+	if (error.message === "SOURCE_CHANGED") return "source-changed";
+	if (error.message === "UNSAFE_SOURCE_PATH") return "source-inaccessible";
+	if (error.message === "ARTIFACT_PROCESSING_DECODE_FAILED") return "compressed-decode";
+	const code = "code" in error ? error.code : null;
+	if (code === "PROCESSING_LIMIT") return "record-limit";
+	if (code === "PROCESSING_INVALID_RECORD") return "invalid-utf8";
+	if (code === "ENOENT" || code === "ENOTDIR") return "source-missing";
+	if (code === "EACCES" || code === "EPERM" || code === "ELOOP") return "source-inaccessible";
+	return "other";
+}
 //#endregion
 //#region apps/cli/src/journey/confirmed-hides.ts
 /** The Work's explicit exception values; an occurrence inside one stays visible (ADR 0069). */
@@ -1144,7 +1181,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 		return state;
 	};
 	const guard = async (id) => {
-		if (!verified.has(id)) await current(id);
+		if (verified.has(id)) return;
+		const permission = await storage.preparationPermission(id);
+		if (permission && permission.destination !== destination) throw new ApplicationError("JOURNEY_DESTINATION_CHANGED");
+		if (permission) verified.add(id);
 	};
 	const readStatus = async (input) => {
 		await guard(input.journeyId);
@@ -1152,6 +1192,22 @@ function bindJourneyDestination(storage, destination, options = {}) {
 	};
 	return {
 		current,
+		async readSendOutput(input) {
+			await guard(input.journeyId);
+			return storage.readSendOutput(input);
+		},
+		async preparationState(id) {
+			await guard(id);
+			return storage.preparationState(id);
+		},
+		async preparationPermission(id) {
+			await guard(id);
+			return storage.preparationPermission(id);
+		},
+		async updatePreparation(input) {
+			await guard(input.journeyId);
+			return storage.updatePreparation(input);
+		},
 		readInventory: (input) => storage.readInventory({
 			...input,
 			expectedDestination: destination
@@ -1205,6 +1261,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 			await guard(input.journeyId);
 			return storage.saveResource(input);
 		},
+		async receiptRevision(input) {
+			await guard(input.journeyId);
+			return storage.receiptRevision(input);
+		},
 		async commitClassification(input) {
 			await guard(input.journeyId);
 			return storage.commitClassification(input);
@@ -1270,6 +1330,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 			await guard(input.journeyId);
 			return storage.submitReview(input);
 		},
+		async reopenEmpty(input) {
+			await guard(input.journeyId);
+			return storage.reopenEmpty(input);
+		},
 		async recordTerms(input) {
 			await guard(input.journeyId);
 			return storage.recordTerms(input);
@@ -1305,10 +1369,29 @@ function bindJourneyDestination(storage, destination, options = {}) {
 	};
 }
 function bindSendDestination(storage, destination) {
+	const verified = /* @__PURE__ */ new Set();
+	async function verify(id) {
+		if (verified.has(id)) return;
+		const snapshot = await storage.loadSend(id);
+		if (!snapshot) throw new ApplicationError("UNKNOWN_ITEM");
+		check(snapshot.journey, destination);
+		verified.add(id);
+	}
 	return {
-		async loadSend(id, sendId) {
-			const result = await storage.loadSend(id, sendId);
-			if (result) check(result.journey, destination);
+		async isCurrentSend(id, sendId, revision) {
+			await verify(id);
+			return storage.isCurrentSend(id, sendId, revision);
+		},
+		async checkpointTransfer(input) {
+			await verify(input.journeyId);
+			return storage.checkpointTransfer(input);
+		},
+		async loadSend(id, sendId, observedRevision) {
+			const result = await storage.loadSend(id, sendId, verified.has(id) ? observedRevision : void 0);
+			if (result) {
+				check(result.journey, destination);
+				verified.add(result.journey.journeyId);
+			}
 			return result;
 		},
 		async commitSend(input) {
@@ -1321,6 +1404,32 @@ function bindSendDestination(storage, destination) {
 	};
 }
 //#endregion
+//#region apps/cli/src/journey/prepare/update.ts
+/** Preparation owns only the changed Work rows, progress and package invalidation. */
+async function changePreparation(storage, journeyId, kind, change, attempts = Number.POSITIVE_INFINITY, clearPackageApproval = false) {
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		const before = await storage.preparationState(journeyId);
+		if (!before?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		const after = change(before);
+		if (after === before) return before;
+		const previous = new Map(before.works.map((work) => [work.id, work]));
+		const result = await storage.updatePreparation({
+			journeyId,
+			expectedRevision: before.revision,
+			requestKey: randomUUID(),
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			kind,
+			works: after.works.filter((work) => work !== previous.get(work.id)),
+			phase: after.phase,
+			readingComplete: after.readingComplete,
+			readingStartedAt: after.readingStartedAt,
+			clearPackageApproval: clearPackageApproval && before !== after
+		});
+		if (result.status !== "stale") return result.state;
+	}
+	throw new ApplicationError("REVISION_CONFLICT");
+}
+//#endregion
 //#region apps/cli/src/journey/works/metadata.ts
 /** Original classification fields remain durable; only the derived display cache is replaced. */
 const classificationMetadataInput = (work) => ({
@@ -1329,7 +1438,7 @@ const classificationMetadataInput = (work) => ({
 	description: work.description,
 	reason: work.classificationRecommendation?.reason ?? work.reason
 });
-async function prepareClassificationMetadata(storage, state, work, processing, signal, plan) {
+async function processedClassificationMetadata(storage, state, work, processing, signal, plan) {
 	if (state.scope.status !== "confirmed") throw new ApplicationError("CONFIRMATION_REQUIRED");
 	if (work.classificationMetadata && (work.explicitTitleId || work.suggestion)) return;
 	const identity = classificationMetadataInput(work);
@@ -1368,7 +1477,20 @@ async function prepareClassificationMetadata(storage, state, work, processing, s
 		fields: Object.values(raw).map((text) => ({ text }))
 	}, signal);
 	if (title === void 0 || projectName === void 0 || description === void 0 || reason === void 0) throw new ApplicationError("CORRUPTED_STATE");
-	await changeJourney(storage, state.journeyId, "snapshot", (before) => {
+	return {
+		digest,
+		title: title.text,
+		projectName: projectName.text,
+		description: description.text,
+		reason: reason.text,
+		titleOriginalSha256: textDigest(raw.title),
+		titleStaticMasks: [...title.staticMasks]
+	};
+}
+async function prepareClassificationMetadata(storage, state, work, processing, signal, plan) {
+	const metadata = await processedClassificationMetadata(storage, state, work, processing, signal, plan);
+	if (!metadata) return;
+	await changePreparation(storage, state.journeyId, "snapshot", (before) => {
 		const active = before.works.find((item) => item.id === work.id);
 		if (before.scope.status !== "confirmed" || !active || textDigest(JSON.stringify([
 			active.inputRevision,
@@ -1376,20 +1498,12 @@ async function prepareClassificationMetadata(storage, state, work, processing, s
 			active.suggestion?.id,
 			active.explicitTitleId,
 			before.exceptions.filter((item) => item.workId === active.id)
-		])) !== digest) throw new ApplicationError("REVISION_CONFLICT");
+		])) !== metadata.digest) throw new ApplicationError("REVISION_CONFLICT");
 		return {
 			...before,
 			works: before.works.map((item) => item.id === work.id ? {
 				...item,
-				classificationMetadata: {
-					digest,
-					title: title.text,
-					projectName: projectName.text,
-					description: description.text,
-					reason: reason.text,
-					titleOriginalSha256: textDigest(raw.title),
-					titleStaticMasks: [...title.staticMasks]
-				}
+				classificationMetadata: metadata
 			} : item)
 		};
 	});
@@ -1699,7 +1813,7 @@ async function isolateFailingRoots(storage, journeyId, work, error) {
 	});
 	if (roots.length === 0 || roots.length === work.rootSessionIds.length) return false;
 	for (;;) {
-		const state = await storage.current(journeyId);
+		const state = await storage.preparationState(journeyId);
 		const current = state?.works.find((item) => item.id === work.id);
 		if (!state || state.phase === "paused" || state.pendingHideId || current?.inputRevision !== work.inputRevision || current.status !== "pending") return false;
 		if ((await storage.isolateRoots({
@@ -1801,7 +1915,7 @@ function scanFailureCode(reason) {
 }
 /** Resolve only the frozen inspection settings and captures; classification stays unchanged. */
 async function prepareScanContext(storage, journeyId, work, selected, processing, signal, workers) {
-	const current = await storage.current(journeyId);
+	const current = await storage.preparationState(journeyId);
 	if (!current?.consent || !current.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const active = current.works.find((item) => item.id === work.id);
 	if (current.scope.status !== "confirmed" || current.phase === "paused" || active?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
@@ -2127,7 +2241,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 				workspaceId: session.workspaceId,
 				sessionId: session.id,
 				...failure.sourcePartId ? { sourcePartId: failure.sourcePartId } : {}
-			});
+			}, void 0, failure.cause ?? new ApplicationError(scanFailureCode(failure.reason)));
 			const root = families.owners.get(failure.sessionId);
 			if (root) failures.set(root.id, failure.cause === void 0 ? scanFailureCode(failure.reason) : safeCode(failure.cause));
 		}
@@ -2153,7 +2267,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 		...proof,
 		rootSessionIds: excludedRoots
 	} : void 0;
-	await changeJourney(storage, plan.journeyId, "batch", (state) => {
+	await changePreparation(storage, plan.journeyId, "batch", (state) => {
 		const target = state.works.find((item) => item.id === work.id);
 		if (state.scope.status !== "confirmed" || state.phase === "paused" || target?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
 		if (target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2212,7 +2326,7 @@ async function observePreparation(storage, input, observation, operation) {
 //#endregion
 //#region apps/cli/src/journey/prepare/work.ts
 async function prepareJourneyWork(storage, plan, work, directory, processing, hooks, workers, onGeneration, onSubmitted) {
-	let state = await storage.current(plan.journeyId);
+	let state = await storage.preparationState(plan.journeyId);
 	if (!state?.consent || !state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	if (state.scope.status !== "confirmed" || state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 	const selected = workApproval(plan.approval, work.rootSessionIds);
@@ -2270,9 +2384,9 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 			context ??= await resolveContext();
 			return prepareScannedWork(storage, plan, work, directory, {
 				...hooks,
-				onFailureLocation(location, detail) {
+				onFailureLocation(location, detail, cause) {
 					observation.location(location);
-					hooks.onFailureLocation?.(location, detail);
+					hooks.onFailureLocation?.(location, detail, cause);
 				}
 			}, observation, context, onSubmitted);
 		});
@@ -2294,7 +2408,7 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 */
 async function prepareStaticWork(options) {
 	const { storage, journeyId, signal } = options;
-	const state = await storage.current(journeyId);
+	const state = await storage.preparationState(journeyId);
 	const work = state?.works.find((item) => item.id === options.workId);
 	if (!state?.snapshotId || !work || !isSelectedWork(work) || !work.rootSessionIds.length) return;
 	if (![
@@ -2366,7 +2480,7 @@ async function prepareStaticWork(options) {
 	if (failure) throw failure.error;
 	signal.throwIfAborted();
 	if (resources.length !== jobs.length) throw new ApplicationError("SCOPE_NOT_READY");
-	await changeJourney(storage, journeyId, "batch", (current) => {
+	await changePreparation(storage, journeyId, "batch", (current) => {
 		const target = current.works.find((item) => item.id === work.id);
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (current.snapshotId !== snapshotId || target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2403,7 +2517,7 @@ function observeJourneyPause(storage, journeyId, processing, onFailure, requireC
 	const closing = new AbortController();
 	async function readPermission() {
 		for (let attempt = 1;; attempt++) try {
-			return await storage.current(journeyId);
+			return await storage.preparationPermission(journeyId);
 		} catch (error) {
 			if (safeCode(error) !== "COORDINATION_BUSY" || attempt === 4) throw error;
 			onFailure(error);
@@ -2476,6 +2590,16 @@ const preparationFailureBindingsSchema = z.object({
 	workId: z.uuid(),
 	inputRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
 }).strict();
+/** Issue #59: the named fields are exactly what siteFields keeps, so no other text passes. */
+const siteShape = {
+	site: z.string().optional(),
+	harness: z.string().optional(),
+	harnessVersion: z.string().optional()
+};
+const onlySiteFields = (value) => {
+	const kept = siteFields(value);
+	return kept?.site === value.site && kept?.harness === value.harness && kept?.harnessVersion === value.harnessVersion;
+};
 const preparationSourceFailureSchema = z.object({
 	location: z.object({
 		workspaceId: z.uuid(),
@@ -2483,10 +2607,19 @@ const preparationSourceFailureSchema = z.object({
 		sourcePartId: z.uuid().optional()
 	}).strict(),
 	rootSessionId: z.uuid().nullable(),
-	detail: artifactFailureDetailSchema.nullable()
-}).strict().refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+	detail: artifactFailureDetailSchema.nullable(),
+	...siteShape
+}).strict().refine(onlySiteFields).refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+/** One count per refusal group over every reported source, unlike the bounded list. */
+const preparationFailureCountSchema = z.object({
+	code: z.string().regex(/^[A-Z_]{3,80}$/u).optional(),
+	...siteShape,
+	count: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).strict().refine(onlySiteFields);
 const preparationFailureContextSchema = preparationFailureBindingsSchema.extend({
 	sourceFailures: z.array(preparationSourceFailureSchema).max(16),
+	sourceFailureCounts: z.array(preparationFailureCountSchema).max(32),
+	/** The list or the counts left something out; the counts cover every source otherwise. */
 	truncated: z.boolean()
 }).refine((context) => Buffer.byteLength(JSON.stringify(context)) <= maximumPreparationContextBytes);
 /** Invalid diagnostic input must never prevent the independent original-error write. */
@@ -2506,16 +2639,19 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 	let context;
 	let families;
 	const roots = new Set(rootSessionIds);
+	const counted = [];
 	try {
 		const parsed = preparationFailureBindingsSchema.safeParse(bindings);
 		if (parsed.success) context = {
 			...parsed.data,
 			sourceFailures: [],
+			sourceFailureCounts: [],
 			truncated: false
 		};
 	} catch {}
 	return {
-		report(location, detail) {
+		/** `cause` contributes only its code and the fixed site fields (siteFields), never text. */
+		report(location, detail, cause) {
 			if (!context) return;
 			try {
 				const checked = validateFailureLocation(inventory, location);
@@ -2527,11 +2663,20 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 					sessionId: root.id
 				}))) return;
 				if (checked.sessionId === void 0 && !inventory.sessions.some((session) => session.workspaceId === checked.workspaceId && roots.has(families?.owners.get(session.id)?.id ?? ""))) return;
+				const named = processingSite(cause);
+				if (!counted.some((seen) => contains(seen, checked) || contains(checked, seen))) {
+					counted.push(checked);
+					context = countFailure(context, {
+						...cause === void 0 ? {} : { code: safeCode(cause) },
+						...named
+					});
+				}
 				const facts = artifactFailureDetailSchema.safeParse(detail);
 				const parsed = preparationSourceFailureSchema.safeParse({
 					location: checked,
 					rootSessionId: root?.id ?? null,
-					detail: facts.success ? facts.data : null
+					detail: facts.success ? facts.data : null,
+					...named
 				});
 				if (!parsed.success) return;
 				const entry = parsed.data;
@@ -2556,13 +2701,50 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 		}
 	};
 }
+/** Adds one source to its (code, site, harness, version) group; a group past the bound truncates. */
+function countFailure(context, group) {
+	const same = JSON.stringify({
+		...group,
+		count: 0
+	});
+	const index = context.sourceFailureCounts.findIndex((entry) => JSON.stringify({
+		...entry,
+		count: 0
+	}) === same);
+	if (index < 0 && context.sourceFailureCounts.length >= 32) return {
+		...context,
+		truncated: true
+	};
+	const next = {
+		...context,
+		sourceFailureCounts: index < 0 ? [...context.sourceFailureCounts, {
+			...group,
+			count: 1
+		}] : context.sourceFailureCounts.map((entry, at) => at === index ? {
+			...entry,
+			count: entry.count + 1
+		} : entry)
+	};
+	return readPreparationFailureContext(next) ? next : {
+		...context,
+		truncated: true
+	};
+}
 //#endregion
 //#region apps/cli/src/journey/prepare.ts
+const pendingSelected = (work) => work.status === "pending" && isSelectedWork(work);
+/** A retried Work is pending even if a previous generation produced a static receipt. */
+function initialScanWorks(state, scanRequested) {
+	if (!scanRequested || state.scope.status !== "confirmed") return [];
+	const selected = state.works.filter(isSelectedWork);
+	if (!selected.some(pendingSelected)) return selected;
+	return selected.filter((work) => work.status === "pending" || ["reading", "review"].includes(work.status) && !hasCurrentStaticReview(state, work));
+}
 function createJourneyPreparation(options) {
 	return async (journeyId, signal) => {
 		const { storage } = options;
 		if (signal?.aborted) throw new ApplicationError("OPERATION_CANCELED");
-		const current = await storage.current(journeyId);
+		const current = await storage.preparationState(journeyId);
 		if (!current?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 		if (obsoleteJourney(current)) throw new ApplicationError("JOURNEY_OBSOLETE");
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
@@ -2585,10 +2767,11 @@ function createJourneyPreparation(options) {
 				terms: []
 			};
 			const plan = await prepareSourcePlan(storage, options.harnesses, journeyId, terms, abort.signal, current.period, options.stateDir);
-			const initial = await storage.current(journeyId);
+			const initial = await storage.preparationState(journeyId);
 			if (!initial?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			const formed = initial.snapshotId ? [] : namedJourneyWorks(formJourneyWorks(plan.approval, options.processing.environment), options.processing, abort.signal);
-			const state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
+			let state;
+			if (!initial.snapshotId) state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
 				...before,
 				snapshotId: before.snapshotId ?? textDigest(JSON.stringify(plan)),
 				...before.snapshotId ? {} : {
@@ -2596,17 +2779,22 @@ function createJourneyPreparation(options) {
 					reviewMethod: "dictionary"
 				},
 				works: before.snapshotId ? before.works : formed,
-				phase: before.phase === "paused" ? "paused" : !before.snapshotId || before.works.some((work) => work.status === "pending" && isSelectedWork(work)) ? "processing" : before.phase
+				phase: before.phase !== "paused" && (!before.snapshotId || before.works.some(pendingSelected)) ? "processing" : before.phase
 			}));
+			else if (initial.phase !== "processing" && initial.phase !== "paused" && initial.works.some(pendingSelected)) state = await changePreparation(storage, journeyId, "snapshot", (before) => before.phase !== "paused" && before.works.some(pendingSelected) ? {
+				...before,
+				phase: "processing"
+			} : before);
+			else state = initial;
 			if (!state.works.length) throw new ApplicationError("INVALID_SELECTION");
 			if (!scanRequested) await captureSortingScope(storage, journeyId, workApproval(plan.approval, state.works.flatMap((work) => work.rootSessionIds)), directory, abort.signal);
-			const scanWorks = scanRequested && state.scope.status === "confirmed" ? state.works : [];
+			const scanWorks = initialScanWorks(state, scanRequested);
 			if (scanWorks.length) run = await runWorkers(options.workers);
 			const frozen = state;
 			const blockedForRetry = new Set(state.works.filter((work) => work.status === "blocked").map((work) => `${work.id}:${work.inputRevision}`));
 			const deferredForHide = /* @__PURE__ */ new Set();
 			const blockWork = async (work, error) => {
-				const blocked = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const blocked = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					if (before.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 					if (before.phase === "sending" || before.phase === "completed") return before;
 					return withReadingProgress({
@@ -2645,7 +2833,7 @@ function createJourneyPreparation(options) {
 				abort.signal.throwIfAborted();
 				let resumed = false;
 				let deferred = false;
-				const committed = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const committed = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					resumed = false;
 					deferred = false;
 					const target = before.works.find((item) => item.id === work.id);
@@ -2654,17 +2842,13 @@ function createJourneyPreparation(options) {
 					deferred = !resumed;
 					return withReadingProgress({
 						...before,
-						privacy: {
-							...before.privacy,
-							packageApproval: null
-						},
 						works: before.works.map((item) => item.id === work.id ? {
 							...item,
 							status: resumed ? work.status : "pending",
 							blockedCodes: []
 						} : item)
 					});
-				}, 100);
+				}, 100, true);
 				if (deferred && committed.pendingHideId && committed.works.some((item) => generation(item) === generation(work) && item.status === "pending")) deferredForHide.add(generation(work));
 				return resumed;
 			};
@@ -2684,7 +2868,7 @@ function createJourneyPreparation(options) {
 			};
 			/** D2: the person dropped this Work while it was prepared; the other Works go on. */
 			const droppedMidScan = async (workId) => {
-				const now = await storage.current(journeyId);
+				const now = await storage.preparationState(journeyId);
 				const work = now?.works.find((item) => item.id === workId);
 				return Boolean(now && now.phase !== "paused" && now.scope.status === "confirmed" && work && !isSelectedWork(work));
 			};
@@ -2693,7 +2877,7 @@ function createJourneyPreparation(options) {
 			/** True when failing roots left the Work, which is then prepared again (ADR 0188). */
 			const prepareWorkAttempt = async (planned, onSubmitted, releaseRead) => {
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId) ?? frozen;
+				const latest = await storage.preparationState(journeyId) ?? frozen;
 				abort.signal.throwIfAborted();
 				if (latest.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 				let work = latest.works.find((item) => item.id === planned.id);
@@ -2717,7 +2901,7 @@ function createJourneyPreparation(options) {
 						signal: abort.signal,
 						onTemporary: async () => {},
 						onPhase: async () => {},
-						onFailureLocation: (location) => failures.report(location),
+						onFailureLocation: (location, _detail, cause) => failures.report(location, void 0, cause),
 						onTiming: (timing) => options.onTiming?.(planned.id, timing)
 					}, run.workers, (revised) => {
 						work = revised;
@@ -2745,7 +2929,7 @@ function createJourneyPreparation(options) {
 						readRetries.set(generation(work), attempt + 1);
 						return prepareWorkOnce(planned, onSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase === "sending" || now?.phase === "completed") return false;
 					if (blockedCodes(error, code).includes("PRIVACY_CHANGE_PENDING")) {
 						if (work) await blockWork(work, error);
@@ -2775,7 +2959,7 @@ function createJourneyPreparation(options) {
 			const staticWork = async (planned, passSubmitted) => {
 				await passSubmitted;
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId);
+				const latest = await storage.preparationState(journeyId);
 				abort.signal.throwIfAborted();
 				if (!latest?.consent || latest.phase === "paused" || latest.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
 				const work = latest.works.find((item) => item.id === planned.id);
@@ -2803,7 +2987,7 @@ function createJourneyPreparation(options) {
 						staticRetries.set(generation(work), attempt + 1);
 						return staticWork(planned, passSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase !== "sending" && now?.phase !== "completed" && (attempt >= retryLimit || blockedCodes(error, safeCode(error)).includes("PRIVACY_CHANGE_PENDING"))) await blockWork(work, error);
 				}
 			};
@@ -2881,7 +3065,7 @@ function createJourneyPreparation(options) {
 				for (;;) {
 					abort.signal.throwIfAborted();
 					const settled = workSettled.promise;
-					const latest = await storage.current(journeyId);
+					const latest = await storage.preparationState(journeyId);
 					if (!latest || latest.phase === "paused" || latest.scope.status !== "confirmed") return [];
 					for (const work of latest.works) if (work.status === "blocked") blockedForRetry.add(generation(work));
 					const ready = latest.works.filter((work) => isSelectedWork(work) && [
@@ -2902,7 +3086,8 @@ function createJourneyPreparation(options) {
 				}
 			};
 			try {
-				for (let batch = scanWorks; batch.length && !fatal; batch = await later()) {
+				const firstBatch = scanRequested && !scanWorks.length && isClassifying(state) ? await later() : scanWorks;
+				for (let batch = firstBatch; batch.length && !fatal; batch = await later()) {
 					if (!run.workers && !run.pool) run = await runWorkers(options.workers);
 					await pass(batch);
 				}
@@ -2921,7 +3106,7 @@ function createJourneyPreparation(options) {
 			});
 			if (fatal) throw fatal.error;
 			abort.signal.throwIfAborted();
-			const result = await storage.current(journeyId);
+			const result = await storage.preparationState(journeyId);
 			await stopObserving();
 			abort.signal.throwIfAborted();
 			if (!result?.consent || result.phase === "paused" || scanRequested && result.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
@@ -3059,14 +3244,15 @@ async function readJourneyPlan(storage, journeyId) {
 async function finalKeywordDictionary(storage, state, sessionIds, plan) {
 	if (!state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const dictionary = /* @__PURE__ */ new Map();
-	const add = (term, kind, bounded) => {
+	const add = (term, kind, bounded, toolResultEscapes = false) => {
 		const prior = dictionary.get(term);
 		dictionary.set(term, {
 			kind: prior && confirmedHideKinds.indexOf(prior.kind) > confirmedHideKinds.indexOf(kind) ? prior.kind : kind,
-			bounded: bounded && (prior?.bounded ?? true)
+			bounded: bounded && (prior?.bounded ?? true),
+			...toolResultEscapes || prior?.toolResultEscapes ? { toolResultEscapes: true } : {}
 		});
 	};
-	for (const [term, { kind }] of await journeyConfirmedHides(storage, state)) add(term, kind, true);
+	for (const [term, { kind }] of await journeyConfirmedHides(storage, state)) add(term, kind, true, true);
 	for (const value of (await activeJourneyTerms(storage, state)).terms) {
 		const admitted = admitCustomTerm(value);
 		if (admitted) add(admitted.value, "private", false);
@@ -3172,10 +3358,11 @@ function createFamilyHides() {
 				families.set(sessionId, terms);
 			}
 			const members = (root, role) => sessions.filter((session) => session.role === role && session.rootSessionId === root).map((session) => session.archiveSessionId);
-			const all = [...confirmed].map(([term, { kind, bounded }]) => ({
+			const all = [...confirmed].map(([term, { kind, bounded, toolResultEscapes }]) => ({
 				term,
 				category: kind,
-				...bounded ? { bounded: true } : {}
+				...bounded ? { bounded: true } : {},
+				...bounded && toolResultEscapes ? { toolResultEscapes: true } : {}
 			}));
 			return [...families].flatMap(([root, terms]) => {
 				const auto = terms.size ? all.filter(({ term }) => !terms.has(term)) : all;
@@ -3433,8 +3620,10 @@ function createRenderWorkers(workers, size) {
 			if (result.kind !== "journey-base") throw new Error("ARTIFACT_PROCESSING_FAILED");
 			return result.base;
 		} catch (error) {
-			await removeNamedTemporarySpools(named).catch((cleanup) => workers.onFallback?.(cleanup));
-			if (error instanceof SessionWorkerError) throw new ApplicationError(error.message, void 0, { cause: error });
+			if (error instanceof SessionWorkerError) {
+				await removeNamedTemporarySpools(named).catch((cleanup) => workers.onFallback?.(cleanup));
+				throw new ApplicationError(error.message, void 0, { cause: error });
+			}
 			if (signal.aborted) throw error;
 			workers.onFallback?.(error);
 			return pool.serial(() => writeJourneyBase(work, signal));
@@ -3677,6 +3866,7 @@ function createJourneyRenderer(options) {
 	async function admit(workId, session) {
 		const state = await session.current();
 		if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		if (state.phase === "completed" && state.outputVersion !== 1) throw new ApplicationError("SCOPE_NOT_READY");
 		assertJourneyPrivacyReady(state, true);
 		if (obsoleteJourney(state)) throw new ApplicationError("JOURNEY_OBSOLETE");
 		if (state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
@@ -4685,6 +4875,22 @@ async function resolveChunkSessions(storage, state, works, signal) {
 }
 //#endregion
 //#region apps/cli/src/journey/works/proposal.ts
+/** Materialize exactly the Work families accepted by classification, preserving first-name spelling. */
+function groupedClassificationItems(items) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = projectNameKey(item.projectName);
+		const prior = merged.get(key);
+		if (prior) {
+			if (prior.description !== item.description || prior.projectType !== item.projectType || JSON.stringify(prior.recommendation) !== JSON.stringify(item.recommendation)) throw new ApplicationError("INVALID_SELECTION");
+			merged.set(key, {
+				...prior,
+				rootSessionIds: [...prior.rootSessionIds, ...item.rootSessionIds]
+			});
+		} else merged.set(key, item);
+	}
+	return [...merged.values()];
+}
 /**
 * One atomic root partition; recommendations have no access authority. Roots still being grouped
 * wait in one unread Work while the other Works are confirmed and read; the submission that
@@ -4724,21 +4930,9 @@ function createClassificationProposal(storage, accountAccess) {
 		if (plan?.kind !== "plan") throw new ApplicationError("SCOPE_NOT_READY");
 		const roots = new Set(state.works.flatMap((work) => work.rootSessionIds));
 		const seen = /* @__PURE__ */ new Set();
-		const merged = /* @__PURE__ */ new Map();
-		for (const item of input.items) {
-			for (const root of item.rootSessionIds) {
-				if (!roots.has(root) || seen.has(root)) throw new ApplicationError("INVALID_SELECTION");
-				seen.add(root);
-			}
-			const key = projectNameKey(item.projectName);
-			const prior = merged.get(key);
-			if (prior) {
-				if (prior.description !== item.description || prior.projectType !== item.projectType || JSON.stringify(prior.recommendation) !== JSON.stringify(item.recommendation)) throw new ApplicationError("INVALID_SELECTION");
-				merged.set(key, {
-					...prior,
-					rootSessionIds: [...prior.rootSessionIds, ...item.rootSessionIds]
-				});
-			} else merged.set(key, item);
+		for (const item of input.items) for (const root of item.rootSessionIds) {
+			if (!roots.has(root) || seen.has(root)) throw new ApplicationError("INVALID_SELECTION");
+			seen.add(root);
 		}
 		const pending = input.pendingRootSessionIds ?? [];
 		for (const root of pending) {
@@ -4758,7 +4952,7 @@ function createClassificationProposal(storage, accountAccess) {
 			return [...new Set(sessions.map((session) => session.workspaceId))];
 		};
 		const items = [];
-		for (const item of merged.values()) {
+		for (const item of groupedClassificationItems(input.items)) {
 			signal.throwIfAborted();
 			items.push({
 				...item,
@@ -4786,14 +4980,114 @@ function createClassificationProposal(storage, accountAccess) {
 		};
 		const { works } = classificationWorks(state, prepared);
 		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
-		const access = late ? await accountAccess?.({
+		const read = late ? await accountAccess?.({
 			...state,
 			works
 		}, signal) : void 0;
+		const sameAccount = read?.status === "read" && state.accountRead?.status === "read" && state.accountRead.subject === read.subject;
 		return storage.commitClassification({
 			...prepared,
 			chunkSessions,
-			...access ? { accountAccess: Object.fromEntries(access) } : {}
+			...sameAccount ? {
+				accountAccess: Object.fromEntries(read.access),
+				accountSubject: read.subject
+			} : read ? { accountRead: read.status === "read" ? "unavailable" : read.status } : {}
+		});
+	};
+}
+//#endregion
+//#region apps/cli/src/journey/works/recover-isolated.ts
+/** Match the entire original family partition, including other isolated siblings of this parent. */
+function approvedItem(state, child, items) {
+	const matches = items.filter((item) => child.rootSessionIds.every((id) => item.rootSessionIds.includes(id)));
+	const item = matches[0];
+	if (matches.length !== 1 || !item) throw new ApplicationError("INVALID_SELECTION");
+	const parents = state.works.filter((work) => work.projectName === item.projectName && work.description === item.description && work.classificationRecommendation?.access === item.recommendation.access && work.classificationRecommendation.reason === item.recommendation.reason);
+	const parent = parents[0];
+	if (parents.length !== 1 || !parent) throw new ApplicationError("INVALID_SELECTION");
+	const siblingIds = new Set(Array.from({ length: state.works.length + 1 }, (_, i) => isolatedWorkId(parent.id, i)));
+	if (!siblingIds.has(child.id)) throw new ApplicationError("INVALID_SELECTION");
+	const roots = state.works.filter((w) => w.id === parent.id || siblingIds.has(w.id)).flatMap((w) => w.rootSessionIds);
+	if (roots.length !== item.rootSessionIds.length || new Set(roots).size !== roots.length || !roots.every((root) => item.rootSessionIds.includes(root))) throw new ApplicationError("INVALID_SELECTION");
+	return item;
+}
+/** Repair the missing classification only, using its immutable receipt and the ordinary static metadata policy. */
+function createIsolatedMetadataRecovery(storage, processing) {
+	return async (input, signal) => {
+		const { proposal, workIds, idempotencyKey } = input;
+		const journeyId = proposal.journeyId;
+		const hash = textDigest(JSON.stringify(input));
+		const state = await storage.current();
+		if (!state || state.journeyId !== journeyId) throw new ApplicationError("UNKNOWN_ITEM");
+		if (await storage.receiptRevision({
+			journeyId,
+			key: idempotencyKey,
+			hash
+		}) !== null) return {
+			status: "replayed",
+			state
+		};
+		const accepted = await storage.receiptRevision({
+			journeyId,
+			key: proposal.idempotencyKey,
+			hash: textDigest(JSON.stringify(proposal))
+		});
+		if (accepted === null || accepted !== state.classificationRevision) throw new ApplicationError("REVISION_CONFLICT");
+		if (!state.consent || state.scope.status !== "confirmed" || state.abandonedAt || !state.readingComplete || state.pendingHideId || !["ready", "review"].includes(state.phase)) throw new ApplicationError("SCOPE_NOT_READY");
+		if (new Set(workIds).size !== workIds.length || proposal.pendingRootSessionIds?.length) throw new ApplicationError("INVALID_SELECTION");
+		const plan = (await storage.resources({
+			journeyId,
+			kind: "plan",
+			id: "plan"
+		}))[0];
+		if (plan?.kind !== "plan") throw new ApplicationError("SCOPE_NOT_READY");
+		const recovered = /* @__PURE__ */ new Map();
+		const families = groupedClassificationItems(proposal.items);
+		for (const id of workIds) {
+			signal.throwIfAborted();
+			const work = state.works.find((w) => w.id === id);
+			if (!work || !work.createdByPlacement || work.placement !== "placed" || work.description || work.classificationRecommendation || work.suggestion || work.explicitTitleId || work.titleOrigin !== "model" || !work.rootSessionIds.length || !work.accessConfirmed || work.access === "drop" || work.status !== "review" || !work.artifact || work.artifact.revision !== work.revision || work.completedBatches !== work.totalBatches) throw new ApplicationError("INVALID_SELECTION");
+			const item = approvedItem(state, work, families);
+			const restored = {
+				...work,
+				description: item.description,
+				classificationRecommendation: item.recommendation,
+				reason: item.recommendation.reason,
+				projectType: work.projectType ?? {
+					type: item.projectType,
+					reason: item.recommendation.reason,
+					origin: "model"
+				},
+				artifact: null,
+				revision: work.revision + 1
+			};
+			const metadata = await processedClassificationMetadata(storage, state, restored, processing, signal, plan);
+			if (!metadata || !hasCompleteWorkDescription(restored)) throw new ApplicationError("INVALID_SELECTION");
+			recovered.set(id, {
+				...restored,
+				classificationMetadata: metadata
+			});
+		}
+		signal.throwIfAborted();
+		return storage.commit({
+			expectedRevision: state.revision,
+			requestKey: idempotencyKey,
+			requestHash: hash,
+			state: {
+				...state,
+				phase: "review",
+				works: state.works.map((w) => recovered.get(w.id) ?? w),
+				privacy: {
+					...state.privacy,
+					packageApproval: null
+				}
+			},
+			event: {
+				journeyId,
+				kind: "snapshot",
+				source: "system",
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			}
 		});
 	};
 }
@@ -5141,6 +5435,7 @@ function createJourneyClassification(storage, _processing) {
 /** The journey local port's project catalog and project-type suggestions. */
 function createJourneyWorks(storage, processing, stateDir, accountAccess) {
 	return {
+		recoverIsolatedMetadata: createIsolatedMetadataRecovery(storage, processing),
 		classificationSessions: createClassificationSessions(storage, processing, stateDir),
 		classificationRead: createClassificationReader(storage, stateDir),
 		classificationSubmit: createClassificationProposal(storage, accountAccess),
@@ -5259,6 +5554,8 @@ const packagingRefusalCodes = [
 */
 const finalPackagingCodes = [
 	...packagingRefusalCodes,
+	"WORK_METADATA_INCOMPLETE",
+	"PACKAGING_FAILED",
 	...rootScanRefusals,
 	"ARTIFACT_ARCHIVE_LIMIT",
 	"ARTIFACT_ENTRY_LIMIT",
@@ -5294,22 +5591,45 @@ function createSendPackager(ports) {
 			current = await ports.current(journeyId);
 			if (!current) throw new ApplicationError("UNKNOWN_ITEM");
 		}
-		const ready = (works, id) => works.some((work) => work.id === id && packaged(work));
-		const batch = workIds.filter((id) => !ready(current.works, id));
+		const ready = new Set(current.works.filter(packaged).map((work) => work.id));
+		const batch = workIds.filter((id) => !ready.has(id));
 		if (!batch.length) return true;
+		const selected = new Set(batch);
+		if (current.works.some((work) => selected.has(work.id) && !hasCompleteWorkDescription(work))) throw new ApplicationError("WORK_METADATA_INCOMPLETE");
 		signal.throwIfAborted();
 		const result = await ports.render({
 			journeyId,
 			workIds: batch
 		}, signal);
-		const failures = result.renders?.filter((item) => item.status === "failed") ?? [];
-		const failure = failures.find((item) => packagingRefusalCodes.includes(item.code)) ?? failures.find((item) => finalPackagingCodes.includes(item.code)) ?? failures[0];
-		if (failure) throw new ApplicationError(failure.code);
-		if (batch.some((id) => !ready(result.works, id))) throw new Error("PACKAGING_FAILED");
+		const works = new Map(result.works.map((work) => [work.id, work]));
+		const failures = new Map(result.renders?.filter((item) => item.status === "failed").map((item) => [item.workId, item.code]));
+		for (const id of batch) {
+			const work = works.get(id);
+			if ((!work || !packaged(work)) && !failures.has(id)) failures.set(id, unfinishedPackagingCode(work));
+		}
+		const codes = [...failures.values()];
+		const failure = codes.find((code) => packagingRefusalCodes.includes(code)) ?? codes.find((code) => finalPackagingCodes.includes(code)) ?? codes[0];
+		if (failure) throw new ApplicationError(failure);
 		return false;
 	};
 }
 //#endregion
+//#region apps/cli/src/package-identity.ts
+/** Release identity stays independent of producer/processing format versions. */
+const packageIdentity = Object.freeze(z.object({
+	name: z.literal("@gitroll/tacitt-cli"),
+	version: z.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/)
+}).parse(JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"))));
+//#endregion
+//#region apps/cli/skills/tacitt/scripts/journey-panel-host.mjs
+/** Only the host's canonical browser bootstrap may be handed to a fresh browser. */
+function focusedPanelUrl(value, journeyId) {
+	if (typeof value !== "string") return null;
+	const url = URL.parse(value);
+	if (!url || url.href !== value || url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port || url.username || url.password || !/^\/session-[a-f0-9]{16}\/$/u.test(url.pathname) || url.searchParams.size !== 2 || url.searchParams.get("view") !== "skill" || url.searchParams.get("journey") !== journeyId || !/^#token=[A-Za-z0-9_-]{43}$/u.test(url.hash)) return null;
+	return url;
+}
+//#endregion
 //#region apps/cli/src/serve-process.ts
 const execute = promisify(execFile);
 /** OS process creation identity, independent of PID recycling. */
@@ -5374,8 +5694,14 @@ const recordSchema$1 = z.object({
 	journeyId: z.string(),
 	pid: z.number().int().positive(),
 	log: z.string(),
+	version: z.string().optional(),
+	currentKeepAuthority: z.boolean().optional(),
+	outputVersion: z.number().int().optional(),
 	processStart: z.string().optional()
 });
+function enforcesPrivacy(record) {
+	return record?.currentKeepAuthority && record.outputVersion === 1;
+}
 const recordPath$1 = (directory, journeyId) => join(directory, `${journeyId}.host.json`);
 function running(pid) {
 	try {
@@ -5386,19 +5712,18 @@ function running(pid) {
 	}
 }
 /** Only verified absence admits a replacement; transport failure is inconclusive. */
-async function liveHost(directory, journeyId) {
+async function liveHost(directory, journeyId, strictRecord = false) {
 	let record;
 	try {
 		const parsed = recordSchema$1.safeParse(JSON.parse(await readFile(recordPath$1(directory, journeyId), "utf8")));
-		if (!parsed.success || parsed.data.journeyId !== journeyId) return { status: "dead" };
+		if (!parsed.success || parsed.data.journeyId !== journeyId) return { status: strictRecord ? "unknown" : "dead" };
 		record = parsed.data;
 	} catch (error) {
-		if (error instanceof SyntaxError || error instanceof Error && "code" in error && error.code === "ENOENT") return { status: "dead" };
+		if (!strictRecord && error instanceof SyntaxError || error instanceof Error && "code" in error && error.code === "ENOENT") return { status: "dead" };
 		process.stderr.write("HOST_RECORD_UNAVAILABLE\n");
 		return { status: "unknown" };
 	}
-	const state = running(record.pid);
-	if (state === "dead") return { status: "dead" };
+	if (running(record.pid) === "dead") return { status: "dead" };
 	if (record.processStart !== void 0) try {
 		if (await processStart(record.pid) !== record.processStart) return { status: "dead" };
 	} catch {
@@ -5408,19 +5733,37 @@ async function liveHost(directory, journeyId) {
 			record
 		};
 	}
-	else if (state === "unknown") return { status: "dead" };
 	if (!record.url) return {
 		status: "unknown",
 		record
 	};
+	if (!record.processStart) return {
+		status: "unknown",
+		record
+	};
+	if (record.version !== packageIdentity.version || !enforcesPrivacy(record)) return {
+		status: "obsolete",
+		record
+	};
+	const url = focusedPanelUrl(record.url, journeyId);
+	if (!url) return {
+		status: "obsolete",
+		record
+	};
+	url.hash = "";
 	try {
-		await fetch(record.url, { signal: AbortSignal.timeout(2e3) });
-		return {
+		return (await fetch(url, {
+			method: "HEAD",
+			redirect: "manual",
+			signal: AbortSignal.timeout(2e3)
+		})).ok ? {
 			status: "alive",
 			record
+		} : {
+			status: "unknown",
+			record
 		};
-	} catch (error) {
-		if (record.processStart === void 0 && loopbackRefused(record.url, error)) return { status: "dead" };
+	} catch {
 		process.stderr.write("HOST_PROBE_UNAVAILABLE\n");
 		return {
 			status: "unknown",
@@ -5428,16 +5771,57 @@ async function liveHost(directory, journeyId) {
 		};
 	}
 }
-function loopbackRefused(url, error) {
-	const host = URL.parse(url)?.hostname;
-	if (host !== "127.0.0.1" && host !== "[::1]" && host !== "localhost") return false;
-	if (!(error instanceof Error)) return false;
-	if ("code" in error && error.code === "ECONNREFUSED") return true;
-	if (error instanceof AggregateError) return error.errors.length > 0 && error.errors.every((item) => loopbackRefused(url, item));
-	return loopbackRefused(url, error.cause);
+/** Called only while the launch mutex is held. Never start alongside an old owner. */
+async function relinquish(record) {
+	const sameOwner = async () => running(record.pid) !== "dead" && await processStart(record.pid) === record.processStart;
+	try {
+		if (!await sameOwner()) return true;
+		process.kill(record.pid, "SIGTERM");
+		const deadline = Date.now() + 1e4;
+		while (Date.now() < deadline) {
+			if (!await sameOwner()) return true;
+			await setTimeout$1(100);
+		}
+	} catch {
+		if (running(record.pid) === "dead") return true;
+	}
+	process.stderr.write("HOST_REPLACEMENT_PENDING: the previous panel host has not confirmed shutdown. Retry the handoff.\n");
+	return false;
+}
+/** A previous sender cannot observe a new policy by reusing its cached approval.
+* Only a live, PID-and-birth-verified owner may be signalled. */
+async function fenceUnapprovedSendHost(stateDir, journey) {
+	if (journey?.phase !== "sending" || journey.privacy.packageApproval !== null) return;
+	const directory = join(stateDir, "serve");
+	const status = await liveHost(directory, journey.journeyId, true);
+	if (status.status === "dead" || enforcesPrivacy(status.record)) return;
+	await withStateMutex(directory, async () => {
+		const current = await liveHost(directory, journey.journeyId, true);
+		if (current.status === "dead" || enforcesPrivacy(current.record)) return;
+		if (current.status !== "obsolete" || !await relinquish(current.record)) throw new ApplicationError("HOST_REPLACEMENT_PENDING");
+	});
+}
+/** Best-effort cleanup before an obsolete journey can lose its current ID. */
+async function relinquishObsoleteHost(stateDir, journeyId) {
+	const directory = join(stateDir, "serve");
+	try {
+		await readFile(recordPath$1(directory, journeyId), "utf8");
+		await withStateMutex(directory, async () => {
+			const current = await liveHost(directory, journeyId);
+			if (current.status === "obsolete" && current.record.version !== packageIdentity.version) await relinquish(current.record);
+		});
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		process.stderr.write("HOST_REPLACEMENT_PENDING: obsolete journey host cleanup failed.\n");
+	}
 }
 function reuse(existing) {
 	if (existing.status === "dead") return false;
+	if (existing.status === "obsolete") {
+		process.stderr.write("HOST_REPLACEMENT_PENDING: retry the handoff.\n");
+		process.exitCode = 1;
+		return true;
+	}
 	if (existing.status === "alive") process.stdout.write(`${JSON.stringify({
 		ok: true,
 		event: "ready",
@@ -5499,7 +5883,12 @@ async function serveDetached(args, stateDir, journeyId) {
 					recursive: true,
 					force: true
 				});
-				if (reuse(current)) return;
+				if (current.status === "obsolete") {
+					if (!await relinquish(current.record)) {
+						process.exitCode = 1;
+						return;
+					}
+				} else if (reuse(current)) return;
 				let retries = 0;
 				let delay = 500;
 				for (;;) {
@@ -5563,6 +5952,11 @@ async function startHost(args, directory, journeyId, deadline) {
 		await output.close();
 		throw error;
 	}
+	let ready;
+	child.on("message", (message) => {
+		const parsed = readySchema.safeParse(message);
+		if (parsed.success) ready ??= parsed.data.result;
+	});
 	let exited = null;
 	child.once("exit", (code) => exited = code ?? 1);
 	let spawnFailure;
@@ -5578,6 +5972,9 @@ async function startHost(args, directory, journeyId, deadline) {
 			identity = await processStart(child.pid);
 			await publishRecord(directory, id, {
 				url: "",
+				version: packageIdentity.version,
+				currentKeepAuthority: true,
+				outputVersion: 1,
 				journeyId,
 				pid: child.pid,
 				processStart: identity,
@@ -5605,7 +6002,8 @@ async function startHost(args, directory, journeyId, deadline) {
 			deadline
 		}, () => ({
 			exited,
-			spawnFailure
+			spawnFailure,
+			ready
 		}));
 	} finally {
 		if (child.connected) child.disconnect();
@@ -5618,29 +6016,27 @@ async function publishRecord(directory, id, record) {
 }
 async function readStartup(log) {
 	let busy = false;
-	let ready;
 	for (const line of (await readFile(log, "utf8")).split("\n")) try {
 		const parsed = JSON.parse(line);
 		const failure = failureSchema.safeParse(parsed);
 		if (failure.success) busy = failure.data.error.code === "COORDINATION_BUSY";
-		const value = readySchema.safeParse(parsed);
-		if (value.success) ready ??= value.data.result;
 	} catch {}
-	return {
-		busy,
-		ready
-	};
+	return { busy };
 }
 async function waitForReady(child, startup, state) {
 	let busy = false;
 	while (Date.now() < startup.deadline) {
 		const failure = state().spawnFailure;
 		if (failure) throw new Error("HOST_START_FAILED", { cause: failure });
-		const observed = await readStartup(startup.log);
-		busy = observed.busy;
-		if (observed.ready?.journeyId === startup.journeyId && child.pid !== void 0) {
+		busy = (await readStartup(startup.log)).busy;
+		const ready = state().ready;
+		if (ready?.journeyId === startup.journeyId && child.pid !== void 0) {
+			if (!focusedPanelUrl(ready.url, startup.journeyId)) throw new Error("INVALID_PANEL_URL");
 			const record = {
-				...observed.ready,
+				...ready,
+				version: packageIdentity.version,
+				currentKeepAuthority: true,
+				outputVersion: 1,
 				pid: child.pid,
 				processStart: startup.identity,
 				log: startup.log
@@ -5725,357 +6121,61 @@ async function readSendHost(stateDir) {
 	}
 }
 //#endregion
-//#region apps/cli/src/account/journey/remote-error.ts
-const refusalSchema = z.object({
-	error: z.string(),
-	preview: sendSettingsSchema.nullable().optional(),
-	resolution: sendResolutionSchema.optional(),
-	/** `unknown_keep_work_ids`: the kept IDs Passport did not accept (ADR 0204). */
-	workIds: z.array(z.string()).optional()
-});
-var JourneyRemoteError = class extends Error {
-	retryAfter;
-	status;
-	code;
-	details;
-	constructor(status, code, details, options, retryAfter) {
-		super(code, options);
-		this.name = "JourneyRemoteError";
-		this.retryAfter = retryAfter;
-		this.status = status;
-		this.code = code;
-		this.details = details;
-	}
-};
-//#endregion
-//#region apps/cli/src/account/journey/session-transport.ts
-/** Session requests allow ten minutes for response headers and response-body inactivity. */
-const sessionRequestTimeoutMs = 6e5;
-/**
-* Node 24 bundles undici but does not expose its Agent as a public built-in module.
-* Reuse its dispatcher through the versioned compatibility symbol, without changing
-* global transport policy. Constructing Request initializes undici without any I/O.
-* Fail closed if a future runtime removes this bridge; never fall back to five minutes.
-*/
-function runtimeSessionDispatcher() {
-	new Request("https://session-transport.invalid");
-	const dispatcher = Reflect.get(globalThis, Symbol.for("undici.globalDispatcher.1"));
-	if (typeof dispatcher !== "object" || dispatcher === null || !("dispatch" in dispatcher) || typeof dispatcher.dispatch !== "function") throw new ApplicationError("SESSION_TRANSPORT_UNAVAILABLE");
-	const dispatch = dispatcher.dispatch.bind(dispatcher);
-	return { dispatch(options, handler) {
-		return dispatch(options, handler);
-	} };
-}
-/** Per-request overrides reach undici's parser; AbortSignal alone does not change these. */
-function sessionDispatcher(delegate = runtimeSessionDispatcher(), timeoutMs = sessionRequestTimeoutMs) {
-	return { dispatch(options, handler) {
-		return delegate.dispatch({
-			...options,
-			headersTimeout: timeoutMs,
-			bodyTimeout: timeoutMs
-		}, handler);
-	} };
+//#region apps/cli/src/journey/send-extension.ts
+function selectionKey({ output, extension, identities }) {
+	return hash$1([
+		output.journeyId,
+		output.workId,
+		output.primary.sha256,
+		output.finalMaskLedger.sha256,
+		identities,
+		extension
+	]);
 }
-//#endregion
-//#region apps/cli/src/journey/send-sessions.ts
-/** Build upload identities from frozen local metadata and bytes from the final primary only. */
-async function* sessionArtifacts(storage, find, journeyId, artifact, signal) {
-	const output = await find(journeyId, artifact.workId, artifact.revision);
-	if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-	const base = (await storage.resources({
-		journeyId,
-		kind: "base"
-	})).find((item) => item.kind === "base" && item.workId === artifact.workId && item.inputRevision === output.finalMaskLedger.inputRevision && item.primary.sha256 === output.finalMaskLedger.basePrimarySha256);
-	const plan = (await storage.resources({
-		journeyId,
-		kind: "plan"
-	})).find((item) => item.kind === "plan");
-	if (base?.kind !== "base" || plan?.kind !== "plan") throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-	const identities = base.sessions.map((binding) => {
-		const session = plan.approval.inventory.sessions.find((item) => item.id === binding.applicationSessionId);
-		const part = session?.parts[0];
-		const lastAt = session?.lastInteractionAt ?? session?.createdAt;
-		if (!session || !part || !lastAt || !Number.isFinite(Date.parse(lastAt))) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-		const nativeId = part.nativeEvidence?.identity?.sessionId ?? session.sourceSessionId;
-		const path = part.harnessRelativePath ?? "";
-		if (!path && !nativeId?.trim() || isAbsolute(path) || path.includes("\\") || path.split("/").some((segment) => segment === ".." || segment === ".")) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-		return {
-			archiveSessionId: binding.archiveSessionId,
-			relativePath: path,
-			lastAt: new Date(lastAt).toISOString()
-		};
-	});
-	for await (const session of configuredSessionUploads(output.primary, identities, signal)) yield {
-		...session,
-		async upload(upload, uploadSignal, onProgress) {
-			await find(journeyId, artifact.workId, artifact.revision);
-			const url = new URL(upload.uploadUrl);
-			if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
-			const dispatcher = sessionDispatcher();
-			let bytes = 0;
-			const progressFailure = {};
-			const request = {
-				method: "PUT",
-				body: session.stream().pipeThrough(new TransformStream({ async transform(chunk, controller) {
-					bytes += chunk.byteLength;
-					try {
-						await onProgress?.(bytes);
-					} catch (cause) {
-						progressFailure.error = { cause };
-						throw cause;
-					}
-					controller.enqueue(chunk);
-				} })),
-				signal: uploadSignal,
-				dispatcher,
-				redirect: "error",
-				credentials: "omit",
-				referrerPolicy: "no-referrer",
-				headers: {
-					"content-type": "application/zip",
-					"content-length": String(session.byteLength),
-					...upload.headers
-				},
-				duplex: "half"
-			};
-			const response = await fetch(url, request).catch((error) => {
-				if (progressFailure.error) throw progressFailure.error.cause;
-				throw error;
+/** Sender-local cache. Its only values are archive IDs already covered by a scope-bound proof. */
+function createSendExtensionSelection() {
+	const cache = /* @__PURE__ */ new Map();
+	return async function select(storage, descriptor, signal) {
+		const { output, identities, extension } = descriptor;
+		if (!extension) return /* @__PURE__ */ new Set();
+		const key = selectionKey(descriptor);
+		const prior = cache.get(key);
+		if (prior) return prior;
+		const bindings = /* @__PURE__ */ new Map();
+		for (const binding of extension.sources) {
+			const location = JSON.stringify([binding.session, binding.source]);
+			if (bindings.has(location)) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			bindings.set(location, binding.part);
+		}
+		const dates = new Map(identities.map((item) => [item.archiveSessionId, item.lastAt]));
+		const proof = await sessionExtensions({
+			primary: output.primary,
+			ledger: output.finalMaskLedger,
+			groups: extension.groups,
+			sourceFor: (session, source) => bindings.get(JSON.stringify([session, source])),
+			lastAt: (session) => dates.get(session) ?? ""
+		}, signal);
+		if (!proof) return /* @__PURE__ */ new Set();
+		if (proof.retired.size) for (const work of extension.outputs) {
+			const { output: candidate } = await storage.readSendOutput({
+				journeyId: output.journeyId,
+				workId: work.workId,
+				revision: work.revision,
+				sessions: false
 			});
-			await response.body?.cancel();
-			if (!response.ok) throw new JourneyRemoteError(response.status, "UPLOAD_FAILED", null, void 0, response.headers.get("retry-after") ?? void 0);
-		}
-	};
-}
-/** Own one live upload iterator; advancing it releases the preceding session ZIP. */
-async function prepareSessionArtifacts(storage, find, journeyId, artifact, signal) {
-	const source = sessionArtifacts(storage, find, journeyId, artifact, signal);
-	let closed = false;
-	async function* iterate() {
-		try {
-			yield* source;
-		} finally {
-			closed = true;
-		}
-	}
-	const items = iterate();
-	return {
-		items,
-		async close() {
-			if (closed) return;
-			closed = true;
-			await items.return(void 0);
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/journey/send-artifacts.ts
-function createJourneySendArtifacts(storage) {
-	async function find(journeyId, workId, revision) {
-		const state = await storage.current(journeyId);
-		if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
-		assertJourneyPrivacyReady(state, true);
-		if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
-		const work = state.works.find((item) => item.id === workId);
-		if (!work?.artifact || work.revision !== revision || work.artifact.revision !== revision) throw new ApplicationError("REVISION_CONFLICT");
-		const output = (await storage.resources({
-			journeyId,
-			kind: "output"
-		})).find((item) => item.kind === "output" && item.workId === workId && item.revision === revision);
-		if (output?.kind !== "output" || output.primary.sha256 !== work.artifact.sha256) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-		return output;
-	}
-	return {
-		prepareSessions: (journeyId, artifact, signal) => prepareSessionArtifacts(storage, find, journeyId, artifact, signal),
-		sessions: (journeyId, artifact, signal) => sessionArtifacts(storage, find, journeyId, artifact, signal),
-		async describe(journey, work, signal) {
-			const output = await find(journey.journeyId, work.id, work.revision);
-			const info = await readConfiguredOutputInfo(output.primary, signal);
-			if (info.work.id !== work.id || info.work.access !== work.access) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			let agentSources = [];
-			try {
-				const base = (await storage.resources({
-					journeyId: journey.journeyId,
-					kind: "base"
-				})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === output.finalMaskLedger.inputRevision && item.primary.sha256 === output.finalMaskLedger.basePrimarySha256);
-				if (base?.kind === "base") {
-					const included = new Set(base.sessions.map((item) => item.applicationSessionId));
-					const resources = await storage.resources({
-						journeyId: journey.journeyId,
-						kind: "static-session"
-					});
-					const unique = /* @__PURE__ */ new Map();
-					for (const resource of resources) {
-						if (resource.kind !== "static-session" || resource.workId !== work.id || resource.inputRevision !== base.inputRevision || !included.has(resource.sessionId)) continue;
-						for (const candidate of resource.agentSources ?? []) {
-							const parsed = agentSourceSchema.safeParse(candidate);
-							if (parsed.success && unique.size < 500) unique.set(JSON.stringify(parsed.data), parsed.data);
-						}
-					}
-					agentSources = [...unique.values()];
-				}
-			} catch {
-				console.error("AGENT_SOURCES_METADATA_UNAVAILABLE");
-			}
-			return sendArtifactSchema.parse({
-				...agentSources.length === 0 ? {} : { agentSources },
-				workId: work.id,
-				revision: work.revision,
-				bundleId: info.manifest.bundleId,
-				createdAt: info.createdAt,
-				title: info.work.title,
-				sessionCount: info.sessionCount,
-				grouping: info.manifest.work.grouping,
-				sources: info.sources,
-				byteLength: output.primary.archiveBytes,
-				sha256: output.primary.sha256
-			});
-		},
-		async upload(journeyId, artifact, upload, signal) {
-			const output = await find(journeyId, artifact.workId, artifact.revision);
-			if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-			await putPrimary(output.primary, artifact.byteLength, upload, signal);
-		}
-	};
-}
-/**
-* Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. A
-* checksum upload also sends the SHA-256 header the URL signs, so storage refuses other bytes.
-*/
-async function putPrimary(primary, byteLength, upload, signal) {
-	const url = new URL(upload.uploadUrl);
-	if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
-	const source = await openConfiguredUpload(primary, signal);
-	const cleanup = createCleanup();
-	try {
-		const request = {
-			method: "PUT",
-			body: source.stream,
-			signal,
-			redirect: "error",
-			headers: {
-				"Content-Type": "application/zip",
-				"Content-Length": String(byteLength),
-				...upload.headers
-			},
-			duplex: "half"
-		};
-		const result = await fetch(url, request);
-		await result.body?.cancel();
-		if (!result.ok) throw new ApplicationError("UPLOAD_FAILED");
-	} catch (error) {
-		cleanup.failed(error);
-		throw error;
-	} finally {
-		await cleanup.run(() => source.close());
-	}
-}
-//#endregion
-//#region apps/cli/src/account/journey/session-facts-cache.ts
-const keyFor = (journeyId, artifact) => JSON.stringify([
-	journeyId,
-	artifact.workId,
-	artifact.revision,
-	artifact.sha256
-]);
-/** Sender-owned facts only. In-flight computations never enter the bounded cache. */
-function createSessionFactsCache(limit = 256) {
-	const facts = /* @__PURE__ */ new Map();
-	let owner = "";
-	let generation = 0;
-	let allowed = /* @__PURE__ */ new Set();
-	return {
-		retain(journeyId, send) {
-			const nextOwner = JSON.stringify([journeyId, send?.id]);
-			const ended = !send || [
-				"completed",
-				"blocked",
-				"prepared"
-			].includes(send.status);
-			if (owner !== nextOwner || ended) {
-				facts.clear();
-				generation += 1;
-			}
-			owner = nextOwner;
-			allowed = new Set(ended || !send ? [] : send.items.filter((item) => !item.sessionAssembly && item.status !== "completed").map((item) => keyFor(journeyId, item.artifact)));
-			for (const key of facts.keys()) if (!allowed.has(key)) facts.delete(key);
-		},
-		async get(journeyId, artifact, signal, compute) {
-			signal.throwIfAborted();
-			const key = keyFor(journeyId, artifact);
-			const cached = facts.get(key);
-			if (cached) return cached;
-			const started = generation;
-			const items = await compute();
-			signal.throwIfAborted();
-			if (started === generation && allowed.has(key)) {
-				facts.set(key, items);
-				while (facts.size > limit) {
-					const oldest = facts.keys().next().value;
-					if (oldest === void 0) break;
-					facts.delete(oldest);
-				}
-			}
-			return items;
-		}
-	};
-}
-//#endregion
-//#region apps/cli/src/account/journey/session-preparation.ts
-/** Shared facts retain no bytes; only upload steps acquire phase-local live iterators. */
-function createSessionPreparation(dependencies, facts) {
-	const prepare = dependencies.artifacts.prepareSessions;
-	const prepared = [];
-	const sessions = async function* (journeyId, artifact, signal) {
-		if (!prepare) {
-			const original = dependencies.artifacts.sessions;
-			if (original) yield* original(journeyId, artifact, signal);
-			return;
-		}
-		const result = await prepare(journeyId, artifact, signal);
-		prepared.push(result);
-		for await (const item of result.items) {
-			signal.throwIfAborted();
-			yield item;
-		}
-	};
-	const sessionFacts = async function* (journeyId, artifact, signal) {
-		const items = await facts.get(journeyId, artifact, signal, async () => {
-			const original = dependencies.artifacts.sessionFacts ?? dependencies.artifacts.sessions;
-			const items = [];
-			if (original) for await (const item of original(journeyId, artifact, signal)) {
-				const { workerIdentity, nativeSessionId, relativePath, harness, lastAt, metadata, sha256, byteLength, crc32 } = item;
-				items.push({
-					...workerIdentity ? { workerIdentity } : {},
-					nativeSessionId,
-					relativePath,
-					harness,
-					lastAt,
-					metadata,
-					sha256,
-					byteLength,
-					crc32
-				});
-			}
-			return items;
-		});
-		for (const item of items) {
-			signal.throwIfAborted();
-			yield item;
-		}
-	};
-	return {
-		dependencies: {
-			...dependencies,
-			artifacts: {
-				...dependencies.artifacts,
-				sessions,
-				sessionFacts
-			}
-		},
-		async close() {
-			await createCleanup().run(...prepared.map((result) => () => result.close()));
+			if (candidate.primary.sha256 !== work.sha256 || candidate.bundleId !== work.bundleId) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			const omitted = candidate.workId === output.workId ? proof.omitted : /* @__PURE__ */ new Set();
+			if (await hasRetiredSessionMarker(candidate.primary, omitted, proof.retired, signal)) return /* @__PURE__ */ new Set();
 		}
+		if (selectionKey(await storage.readSendOutput({
+			journeyId: output.journeyId,
+			workId: output.workId,
+			revision: output.revision,
+			sessions: true
+		})) !== key) throw new ApplicationError("REVISION_CONFLICT");
+		if (cache.size >= 32) cache.clear();
+		cache.set(key, proof.omitted);
+		return proof.omitted;
 	};
 }
 //#endregion
@@ -6144,15 +6244,86 @@ function createSessionKeys() {
 	};
 }
 //#endregion
-//#region apps/cli/src/account/journey/session-access.ts
+//#region apps/cli/src/account/journey/session-content-claims.ts
 /** Safe facts for a local preflight conflict; no paths or session content escape. */
 var SessionContentConflict = class extends ApplicationError {
 	contentConflict;
-	constructor(contentConflict) {
+	affectedWorkIds;
+	constructor(contentConflict, affectedWorkIds) {
 		super("SESSION_CONTENT_CONFLICT");
 		this.contentConflict = contentConflict;
+		this.affectedWorkIds = affectedWorkIds;
 	}
 };
+function sessionContentClaims(items, inventory) {
+	const requestedDigests = /* @__PURE__ */ new Map();
+	const divergent = /* @__PURE__ */ new Set();
+	const contentOwners = /* @__PURE__ */ new Map();
+	const savedUploads = /* @__PURE__ */ new Map();
+	const owners = /* @__PURE__ */ new Map();
+	const holdings = /* @__PURE__ */ new Map();
+	function hold(key, workId) {
+		const byKey = owners.get(key) ?? /* @__PURE__ */ new Set();
+		const byWork = holdings.get(workId) ?? /* @__PURE__ */ new Set();
+		byKey.add(workId);
+		byWork.add(key);
+		owners.set(key, byKey);
+		holdings.set(workId, byWork);
+	}
+	const byId = new Map(items.map((item) => [item.workId, item]));
+	for (const work of inventory.works) if (byId.has(work.logicalWorkId)) for (const stored of work.sessions) hold(stored.key, work.logicalWorkId);
+	for (const item of items) {
+		if (item.sessionUpload) {
+			hold(item.sessionUpload.key, item.workId);
+			const claims = savedUploads.get(item.sessionUpload.key) ?? /* @__PURE__ */ new Map();
+			claims.set(item.workId, item.sessionUpload.sha256);
+			savedUploads.set(item.sessionUpload.key, claims);
+		}
+		for (const key of item.sessionMembership?.keys ?? []) hold(key, item.workId);
+	}
+	return {
+		observe(key, sha256, item) {
+			hold(key, item.workId);
+			const requestedBy = contentOwners.get(key) ?? /* @__PURE__ */ new Set();
+			requestedBy.add(item.workId);
+			contentOwners.set(key, requestedBy);
+			for (const [owner, sha] of savedUploads.get(key) ?? []) if (owner !== item.workId && byId.get(owner)?.access === item.access && sha !== sha256) divergent.add(key);
+			const otherDigest = requestedDigests.get(key);
+			if (otherDigest !== void 0 && otherDigest !== sha256) divergent.add(key);
+			requestedDigests.set(key, sha256);
+		},
+		requireIndependent() {
+			for (const [key, claims] of savedUploads) {
+				for (const access of ["private", "public"]) if (new Set([...claims].filter(([id]) => byId.get(id)?.access === access).map(([, sha]) => sha)).size > 1) divergent.add(key);
+				if (!divergent.has(key)) continue;
+				const requestedBy = contentOwners.get(key) ?? /* @__PURE__ */ new Set();
+				for (const owner of claims.keys()) requestedBy.add(owner);
+				contentOwners.set(key, requestedBy);
+			}
+			const [first] = divergent;
+			if (first) {
+				const affected = /* @__PURE__ */ new Set();
+				const pending = [...divergent];
+				const visited = new Set(pending);
+				for (const key of pending) for (const workId of owners.get(key) ?? []) {
+					if (affected.has(workId)) continue;
+					affected.add(workId);
+					for (const owned of holdings.get(workId) ?? []) if (!visited.has(owned)) {
+						visited.add(owned);
+						pending.push(owned);
+					}
+				}
+				if (items.some((item) => affected.has(item.workId) && !["blocked", "completed"].includes(item.status) && !item.sessionAssembly)) throw new SessionContentConflict({
+					workIds: items.filter((item) => contentOwners.get(first)?.has(item.workId)).map((item) => item.workId),
+					sessionKey: first
+				}, affected);
+			}
+		}
+	};
+}
+//#endregion
+//#region apps/cli/src/account/journey/session-access.ts
+const passportSessionPartByteLimit = 5 * 1024 ** 3 - 128 * 1024 ** 2;
 /** Collect safe conflicts across the entire pending Send before any session mutation. */
 async function sessionAccessBlocked(dependencies, journeyId, items, inventory, signal) {
 	const sessions = dependencies.artifacts.sessionFacts ?? dependencies.artifacts.sessions;
@@ -6177,7 +6348,7 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 		conflicts.set(JSON.stringify(conflict), conflict);
 	}
 	const requestedAccess = /* @__PURE__ */ new Map();
-	const requestedDigests = /* @__PURE__ */ new Map();
+	const content = sessionContentClaims(items, inventory);
 	const contentAccess = /* @__PURE__ */ new Map();
 	function claim(claims, identity, key, item, rule) {
 		const previous = claims.get(identity) ?? [];
@@ -6204,38 +6375,42 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 			for (const source of sources) if (source.logicalWorkId !== item.workId && source.access !== item.access) record(item, key, "held-elsewhere", source);
 			const sha256 = item.sessionMembership ? sources[0]?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
 			if (sha256) claimContent(key, sha256, item);
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && (item.sessionMembership || entry.sha256 === sha256))) record(item, key, "destination-access", destination);
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
 	}
 	for (const item of items) {
-		if (item.sessionAssembly || item.sessionMembership || ["completed", "blocked"].includes(item.status)) continue;
+		if (item.sessionAssembly || item.sessionMembership || item.status === "completed" || item.status === "blocked" && item.error !== "SESSION_CONTENT_CONFLICT") continue;
 		const destination = inventory.works.find((work) => work.logicalWorkId === item.workId);
 		if (destination?.access === "removed") throw new ApplicationError("WORK_REMOVED");
 		if (destination) observe(item, destination.access);
+		const selected = createSessionKeys();
+		const measured = /* @__PURE__ */ new Set();
+		let partBytes = 0;
+		let partCount = 0;
 		for await (const session of sessions(journeyId, item.artifact, signal)) {
-			const key = await sessionKeyFor(session);
-			const { workerIdentity: _, ...original } = session;
-			const legacyKey = session.workerIdentity ? await sessionKeyFor(original) : key;
+			const identity = await selected.add(session);
+			const key = identity.key;
+			const legacyKey = identity.legacyKey ?? key;
+			if (!measured.has(key)) {
+				measured.add(key);
+				partCount += session.metadata.parts.length;
+				for (const part of session.metadata.parts) partBytes += part.byteLength;
+			}
+			content.observe(key, session.sha256, item);
+			if (item.status === "blocked") continue;
 			claimContent(key, session.sha256, item);
 			if (legacyKey !== key) claimContent(legacyKey, session.sha256, item);
 			claim(requestedAccess, key, key, item, "requested-access");
-			const otherDigest = requestedDigests.get(key);
-			if (otherDigest !== void 0 && otherDigest.sha256 !== session.sha256) throw new SessionContentConflict({
-				workIds: [.../* @__PURE__ */ new Set([...otherDigest.workIds, item.workId])],
-				sessionKey: key
-			});
-			requestedDigests.set(key, {
-				sha256: session.sha256,
-				workIds: [.../* @__PURE__ */ new Set([...otherDigest?.workIds ?? [], item.workId])]
-			});
 			for (const work of inventory.works) for (const entry of work.sessions) {
 				if (entry.key !== key && !(entry.key === legacyKey && entry.sha256 === session.sha256)) continue;
 				observe(item, work.access);
 				if (work.logicalWorkId !== item.workId && work.access !== item.access) record(item, entry.key, "held-elsewhere", work);
 			}
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && entry.sha256 === session.sha256)) record(item, key, "destination-access", destination);
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
+		if (selected.membership(destination?.sessions ?? []).length > 1e3 || partCount > 1e4 || partBytes > passportSessionPartByteLimit) throw new ApplicationError("WORK_SESSION_CAPACITY_EXCEEDED");
 	}
+	content.requireIndependent();
 	return [...conflicts.values()].map((conflict) => (accountAccesses.get(conflict.workId)?.size ?? 0) > 1 ? {
 		...conflict,
 		accountAccess: "mixed"
@@ -6261,23 +6436,261 @@ async function sessionIndependentItems(dependencies, journeyId, items, inventory
 	return independent;
 }
 //#endregion
-//#region apps/cli/src/account/journey/receipt.ts
-function acceptReceipt(item, receipt) {
-	if (receipt.logicalWorkId !== item.workId || receipt.bundleId !== item.artifact.bundleId || receipt.outputRevision !== item.artifact.revision || receipt.sha256 !== item.artifact.sha256 || receipt.byteLength !== item.artifact.byteLength || receipt.access !== item.access || item.receipt !== null && (receipt.receiptId !== item.receipt.receiptId || receipt.scanId !== item.receipt.scanId || receipt.bindingId !== item.receipt.bindingId) || item.target?.kind === "existing" && receipt.bindingId !== item.target.bindingId) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
-	const { upload: _upload, ...saved } = receipt;
-	const success = receipt.state === "succeeded" && receipt.assessmentState === "succeeded" && receipt.passportIncluded && receipt.effectiveAccess === item.access;
-	const failure = [
-		"failed",
-		"partial",
-		"superseded"
-	].includes(receipt.state) || receipt.state === "succeeded" && !success;
+//#region apps/cli/src/account/journey/remote-error.ts
+const refusalSchema = z.object({
+	error: z.string(),
+	preview: sendSettingsSchema.nullable().optional(),
+	resolution: sendResolutionSchema.optional(),
+	/** `unknown_keep_work_ids`: the kept IDs Passport did not accept (ADR 0204). */
+	workIds: z.array(z.string()).optional()
+});
+var JourneyRemoteError = class extends Error {
+	retryAfter;
+	status;
+	code;
+	details;
+	constructor(status, code, details, options, retryAfter) {
+		super(code, options);
+		this.name = "JourneyRemoteError";
+		this.retryAfter = retryAfter;
+		this.status = status;
+		this.code = code;
+		this.details = details;
+	}
+};
+//#endregion
+//#region apps/cli/src/account/journey/session-transport.ts
+/** Session requests allow ten minutes for response headers and response-body inactivity. */
+const sessionRequestTimeoutMs = 6e5;
+/**
+* Node 24 bundles undici but does not expose its Agent as a public built-in module.
+* Reuse its dispatcher through the versioned compatibility symbol, without changing
+* global transport policy. Constructing Request initializes undici without any I/O.
+* Fail closed if a future runtime removes this bridge; never fall back to five minutes.
+*/
+function runtimeSessionDispatcher() {
+	new Request("https://session-transport.invalid");
+	const dispatcher = Reflect.get(globalThis, Symbol.for("undici.globalDispatcher.1"));
+	if (typeof dispatcher !== "object" || dispatcher === null || !("dispatch" in dispatcher) || typeof dispatcher.dispatch !== "function") throw new ApplicationError("SESSION_TRANSPORT_UNAVAILABLE");
+	const dispatch = dispatcher.dispatch.bind(dispatcher);
+	return { dispatch(options, handler) {
+		return dispatch(options, handler);
+	} };
+}
+/** Per-request overrides reach undici's parser; AbortSignal alone does not change these. */
+function sessionDispatcher(delegate = runtimeSessionDispatcher(), timeoutMs = sessionRequestTimeoutMs) {
+	return { dispatch(options, handler) {
+		return delegate.dispatch({
+			...options,
+			headersTimeout: timeoutMs,
+			bodyTimeout: timeoutMs
+		}, handler);
+	} };
+}
+//#endregion
+//#region apps/cli/src/journey/send-sessions.ts
+/** Build upload identities from frozen local metadata and bytes from the final primary only. */
+async function sessionInputs(storage, journeyId, artifact, signal, select) {
+	const query = {
+		journeyId,
+		workId: artifact.workId,
+		revision: artifact.revision
+	};
+	const descriptor = await storage.readSendOutput({
+		...query,
+		sessions: true
+	});
+	const { output, identities } = descriptor;
+	if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
 	return {
-		...item,
-		receipt: saved,
-		status: success ? "completed" : failure ? "blocked" : receipt.state === "awaiting_upload" ? "uploading" : "assessing",
-		error: failure ? receipt.state === "succeeded" ? "PASSPORT_NOT_CURRENT" : "ASSESSMENT_INCOMPLETE" : null
+		output,
+		identities,
+		omitted: await select(storage, descriptor, signal)
+	};
+}
+async function* sessionFacts(storage, journeyId, artifact, signal, select = createSendExtensionSelection()) {
+	const { output, identities, omitted } = await sessionInputs(storage, journeyId, artifact, signal, select);
+	yield* configuredSessionUploads(output.primary, identities, signal, "facts", omitted, (bytes) => {
+		if (bytes > passportSessionPartByteLimit) throw new ApplicationError("WORK_SESSION_CAPACITY_EXCEEDED");
+	});
+}
+async function* sessionArtifacts(storage, journeyId, artifact, signal, select = createSendExtensionSelection()) {
+	const { output, identities, omitted } = await sessionInputs(storage, journeyId, artifact, signal, select);
+	for await (const session of configuredSessionUploads(output.primary, identities, signal, "upload", omitted)) yield {
+		...session,
+		async upload(upload, uploadSignal, onProgress) {
+			await storage.readSendOutput({
+				journeyId,
+				workId: artifact.workId,
+				revision: artifact.revision,
+				sessions: false
+			});
+			const url = new URL(upload.uploadUrl);
+			if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
+			const dispatcher = sessionDispatcher();
+			let bytes = 0;
+			const progressFailure = {};
+			const request = {
+				method: "PUT",
+				body: session.stream().pipeThrough(new TransformStream({ async transform(chunk, controller) {
+					bytes += chunk.byteLength;
+					try {
+						await onProgress?.(bytes);
+					} catch (cause) {
+						progressFailure.error = { cause };
+						throw cause;
+					}
+					controller.enqueue(chunk);
+				} })),
+				signal: uploadSignal,
+				dispatcher,
+				redirect: "error",
+				credentials: "omit",
+				referrerPolicy: "no-referrer",
+				headers: {
+					"content-type": "application/zip",
+					"content-length": String(session.byteLength),
+					...upload.headers
+				},
+				duplex: "half"
+			};
+			const response = await fetch(url, request).catch((error) => {
+				if (progressFailure.error) throw progressFailure.error.cause;
+				throw error;
+			});
+			await response.body?.cancel();
+			if (!response.ok) throw new JourneyRemoteError(response.status, "UPLOAD_FAILED", null, void 0, response.headers.get("retry-after") ?? void 0);
+		}
+	};
+}
+/** Own one live upload iterator; advancing it releases the preceding session ZIP. */
+async function prepareSessionArtifacts(storage, journeyId, artifact, signal, select = createSendExtensionSelection()) {
+	const source = sessionArtifacts(storage, journeyId, artifact, signal, select);
+	let closed = false;
+	async function* iterate() {
+		try {
+			yield* source;
+		} finally {
+			closed = true;
+		}
+	}
+	const items = iterate();
+	return {
+		items,
+		async close() {
+			if (closed) return;
+			closed = true;
+			await items.return(void 0);
+		}
+	};
+}
+//#endregion
+//#region apps/cli/src/journey/send-artifacts.ts
+function createJourneySendArtifacts(storage) {
+	const selection = createSendExtensionSelection();
+	return {
+		sessionFacts: (journeyId, artifact, signal) => sessionFacts(storage, journeyId, artifact, signal, selection),
+		prepareSessions: (journeyId, artifact, signal) => prepareSessionArtifacts(storage, journeyId, artifact, signal, selection),
+		sessions: (journeyId, artifact, signal) => sessionArtifacts(storage, journeyId, artifact, signal, selection),
+		async describe(journey, work, signal) {
+			const { output } = await storage.readSendOutput({
+				journeyId: journey.journeyId,
+				workId: work.id,
+				revision: work.revision,
+				sessions: false
+			});
+			const info = await readConfiguredOutputInfo(output.primary, signal);
+			if (info.work.id !== work.id || info.work.access !== work.access) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			let agentSources = [];
+			try {
+				const base = (await storage.resources({
+					journeyId: journey.journeyId,
+					kind: "base",
+					id: `${work.id}:${output.finalMaskLedger.inputRevision}`
+				})).find((item) => item.kind === "base" && item.workId === work.id && item.inputRevision === output.finalMaskLedger.inputRevision && item.primary.sha256 === output.finalMaskLedger.basePrimarySha256);
+				if (base?.kind === "base") {
+					const ids = base.sessions.map((item) => staticSessionId({
+						workId: work.id,
+						inputRevision: base.inputRevision,
+						sessionId: item.applicationSessionId
+					}));
+					const included = new Set(base.sessions.map((item) => item.applicationSessionId));
+					const resources = ids.length ? await storage.resources({
+						journeyId: journey.journeyId,
+						kind: "static-session",
+						ids
+					}) : [];
+					const unique = /* @__PURE__ */ new Map();
+					for (const resource of resources) {
+						if (resource.kind !== "static-session" || resource.workId !== work.id || resource.inputRevision !== base.inputRevision || !included.has(resource.sessionId)) continue;
+						for (const candidate of resource.agentSources ?? []) {
+							const parsed = agentSourceSchema.safeParse(candidate);
+							if (parsed.success && unique.size < 500) unique.set(JSON.stringify(parsed.data), parsed.data);
+						}
+					}
+					agentSources = [...unique.values()];
+				}
+			} catch {
+				console.error("AGENT_SOURCES_METADATA_UNAVAILABLE");
+			}
+			return sendArtifactSchema.parse({
+				...agentSources.length === 0 ? {} : { agentSources },
+				workId: work.id,
+				revision: work.revision,
+				bundleId: info.manifest.bundleId,
+				createdAt: info.createdAt,
+				title: info.work.title,
+				sessionCount: info.sessionCount,
+				grouping: info.manifest.work.grouping,
+				sources: info.sources,
+				byteLength: output.primary.archiveBytes,
+				sha256: output.primary.sha256
+			});
+		},
+		async upload(journeyId, artifact, upload, signal) {
+			const { output } = await storage.readSendOutput({
+				journeyId,
+				workId: artifact.workId,
+				revision: artifact.revision,
+				sessions: false
+			});
+			if (output.bundleId !== artifact.bundleId || output.primary.sha256 !== artifact.sha256 || output.primary.archiveBytes !== artifact.byteLength || artifact.byteLength > 5368709120) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+			await putPrimary(output.primary, artifact.byteLength, upload, signal);
+		}
 	};
 }
+/**
+* Stream a verified primary to a signed HTTPS URL; shared by native Send and Manual upload. A
+* checksum upload also sends the SHA-256 header the URL signs, so storage refuses other bytes.
+*/
+async function putPrimary(primary, byteLength, upload, signal) {
+	const url = new URL(upload.uploadUrl);
+	if (url.protocol !== "https:" || url.username || url.password || url.hash) throw new ApplicationError("INVALID_ARGUMENTS");
+	const source = await openConfiguredUpload(primary, signal);
+	const cleanup = createCleanup();
+	try {
+		const request = {
+			method: "PUT",
+			body: source.stream,
+			signal,
+			redirect: "error",
+			headers: {
+				"Content-Type": "application/zip",
+				"Content-Length": String(byteLength),
+				...upload.headers
+			},
+			duplex: "half"
+		};
+		const result = await fetch(url, request);
+		await result.body?.cancel();
+		if (!result.ok) throw new ApplicationError("UPLOAD_FAILED");
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(() => source.close());
+	}
+}
 //#endregion
 //#region apps/cli/src/account/journey/protocol.ts
 /** Owner responses contain only bounded metadata, never archive contents. */
@@ -6385,6 +6798,7 @@ async function checkPublicAgentSources(candidates, requestFetch = fetch, signal)
 //#region apps/cli/src/account/journey/session-schema.ts
 const digest = z.string().regex(/^[0-9a-f]{64}$/u);
 const stored = z.strictObject({
+	metadataSha256: digest.nullable(),
 	key: digest,
 	sessionKey: z.string().regex(/^sess-pilot\/[^/]+\/[^/]+\/[^/]+$/u).nullable(),
 	sha256: digest,
@@ -6483,20 +6897,24 @@ function createSessionClient(request) {
 			let next = null;
 			const seen = /* @__PURE__ */ new Set();
 			const sessions = /* @__PURE__ */ new Map();
-			let value;
+			let access;
 			do {
 				const query = new URLSearchParams({ limit: "500" });
 				if (next !== null) query.set("cursor", next);
-				const page = await request(`/me/works/${encodeURIComponent(id)}/sessions?${query}`, work.extend({ nextCursor: cursor }).refine((item) => item.logicalWorkId === id), signal, void 0, "GET");
+				const page = await request(`/me/works/${encodeURIComponent(id)}/sessions?${query}`, work.extend({ nextCursor: cursor }).refine((item) => item.logicalWorkId === id), signal, void 0, "GET").catch((error) => {
+					if (next === null && error instanceof JourneyRemoteError && error.status === 404 && error.code === "not_found") return null;
+					throw error;
+				});
+				if (!page) return null;
 				for (const session of page.sessions) sessions.set(session.key, session);
-				value = {
-					logicalWorkId: page.logicalWorkId,
-					access: page.access,
-					sessions: [...sessions.values()]
-				};
+				access = page.access;
 				next = continuation(seen, page.nextCursor);
 			} while (next !== null);
-			return value;
+			return {
+				logicalWorkId: id,
+				access,
+				sessions: [...sessions.values()]
+			};
 		},
 		reserve: (input, signal) => request("/me/sessions/reserve", reserve, signal, input),
 		complete: (input, signal) => mutate(signal, () => request("/me/sessions/complete", z.strictObject({ state: z.literal("stored") }), signal, input, "POST", void 0, sessionRequestTimeoutMs, false, 200, "session")),
@@ -6617,6 +7035,21 @@ function createJourneyOwnerClient(options) {
 			const { headers } = await requestWithHeaders("/me/profile", publicProfileSchema, signal);
 			return { parallelCompletes: (headers.get("passport-capabilities") ?? "").split(",").some((token) => token.trim() === "parallel-completes") };
 		},
+		async ownedPassport(signal) {
+			const webOrigin = passportWebOrigin(options.apiUrl, options.webOrigin);
+			if (!webOrigin) throw new ApplicationError("ACCOUNT_PROFILE_UNAVAILABLE");
+			try {
+				const result = await request("/me/passport", z.strictObject({ publicId: sendReceiptSchema.shape.publicId }), signal, void 0, "GET");
+				return new URL("/" + result.publicId, webOrigin).href;
+			} catch (error) {
+				if (error instanceof JourneyRemoteError && error.status === 404 && error.code === "passport not found") {
+					await options.authorize();
+					signal.throwIfAborted();
+					return null;
+				}
+				throw error;
+			}
+		},
 		readProfile(signal) {
 			return request("/me/profile", ownerProfileSchema, signal, void 0, "GET");
 		},
@@ -6817,40 +7250,259 @@ async function resolveItem(item, bindingId, connection, signal, snapshot = false
 		status: "target",
 		error: null
 	};
-	if (!target) throw new ApplicationError("INVALID_STATE");
-	const targetId = target.kind === "existing" ? target.bindingId : null;
-	const candidate = resolution.candidates.find((value) => value.bindingId === targetId);
-	if (candidate && candidate.access !== item.access) {
-		const settings = await connection.preview(candidate.workId, item.access, signal);
-		return askSettings({
-			...item,
-			target,
-			resolution
-		}, settings, null, snapshot);
-	}
-	const agentSources = await connection.checkAgentSources?.(item.artifact.agentSources, signal);
-	signal.throwIfAborted();
+	if (!target) throw new ApplicationError("INVALID_STATE");
+	const targetId = target.kind === "existing" ? target.bindingId : null;
+	const candidate = resolution.candidates.find((value) => value.bindingId === targetId);
+	if (candidate && candidate.access !== item.access) {
+		const settings = await connection.preview(candidate.workId, item.access, signal);
+		return askSettings({
+			...item,
+			target,
+			resolution
+		}, settings, null, snapshot);
+	}
+	const agentSources = await connection.checkAgentSources?.(item.artifact.agentSources, signal);
+	signal.throwIfAborted();
+	return {
+		...item,
+		target,
+		resolution,
+		status: "uploading",
+		error: null,
+		reservation: {
+			...agentSources?.length ? { agentSources } : {},
+			work,
+			target,
+			bundleId: item.artifact.bundleId,
+			createdAt: item.artifact.createdAt,
+			title: item.artifact.title,
+			sessionCount: item.artifact.sessionCount,
+			access: item.access,
+			outputRevision: item.artifact.revision,
+			byteLength: item.artifact.byteLength,
+			sha256: item.artifact.sha256,
+			expectedAccessVersion: resolution.accessVersion,
+			expectedScopeVersion: resolution.scopeVersion
+		}
+	};
+}
+/** Keep only the current Send's pending assessment IDs. New arrivals wait behind unpolled peers. */
+function createAssessmentPoll() {
+	let owner = null;
+	let sendId;
+	let pending = [];
+	return (send, works) => {
+		const byId = new Map(works.map((work) => [work.workId, work]));
+		if (send.subject !== owner || send.id !== sendId) pending = [];
+		owner = send.subject;
+		sendId = send.id;
+		const order = new Set(pending.filter((id) => byId.has(id)));
+		for (const id of byId.keys()) order.add(id);
+		pending = [...order];
+		const selected = pending.splice(0, 3);
+		pending.push(...selected);
+		return selected.flatMap((id) => byId.get(id) ?? []);
+	};
+}
+const confirmedSettings = (item) => item.settings !== null && item.settingsConfirmed;
+const started = (item) => Number(item.status === "uploading");
+/**
+* Works that share a workspace path or a git remote: once one completes, Passport offers it as
+* the other's candidate, so the other's target no longer resolves the same (ADR 0235).
+*/
+function related(left, right) {
+	return left.artifact.sources.some((one) => right.artifact.sources.some((other) => one.pathHash !== null && one.pathHash === other.pathHash || one.remoteHashes.some((hash) => other.remoteHashes.includes(hash))));
+}
+/**
+* The Works one advance steps together. Upload work comes before assessment checks: up to three
+* Works, started uploads first, then the largest ZIP, so the slowest Work starts earliest.
+* Completing an upload moves the owner's scope version, which Passport accepts while a Work's
+* own target resolves the same (ADR 0235). A Work related to one already picked waits for the
+* next batch. A reserved Work whose target would not survive that steps alone, and so does a
+* confirmed linked Settings change, which moves the access version every reservation carries,
+* once no upload has started. Assessment checks change nothing and step up to three together.
+*/
+function pickBatch(items, limit, poll) {
+	const uploads = items.filter(sendsOnNextAdvance).toSorted((left, right) => started(right) - started(left) || right.artifact.byteLength - left.artifact.byteLength);
+	const alone = uploads.find((item) => item.status === "uploading" && item.reservation !== null && item.resolution !== null && !keepsTarget(item.resolution, item.reservation)) ?? (uploads[0] && confirmedSettings(uploads[0]) ? uploads[0] : void 0);
+	if (alone) return [alone];
+	if (uploads.length) return uploads.filter((item) => !confirmedSettings(item)).reduce((batch, item) => batch.length < limit && !batch.some((picked) => related(picked, item)) ? [...batch, item] : batch, []);
+	const assessing = items.filter((item) => item.status === "assessing");
+	const first = assessing[0];
+	if (!first) return [];
+	if (confirmedSettings(first)) return [first];
+	const checks = assessing.filter((item) => !confirmedSettings(item));
+	return poll ? poll(checks) : checks.slice(0, 3);
+}
+function isCode(error, code) {
+	return error instanceof ApplicationError && error.code === code;
+}
+/**
+* A step that ended without a definite answer and is safe to repeat: a request timeout or abort
+* that is not the Send's own cancellation, or a connection failure from `fetch`: `fetch failed`
+* before the response, `terminated` when the socket resets while the body is read. The Work keeps
+* its state, so the next advance repeats the same idempotent step (ADR 0197).
+*/
+function isInterrupted(error) {
+	if (!(error instanceof Error)) return false;
+	if (error.name === "TimeoutError" || error.name === "AbortError") return true;
+	return error instanceof TypeError && (error.message === "fetch failed" || error.message === "terminated");
+}
+//#endregion
+//#region apps/cli/src/account/journey/session-facts-cache.ts
+const keyFor = (journeyId, artifact) => JSON.stringify([
+	journeyId,
+	artifact.workId,
+	artifact.revision,
+	artifact.sha256
+]);
+/** Sender-owned facts only. In-flight computations never enter the bounded cache. */
+function createSessionFactsCache(limit = 256) {
+	const facts = /* @__PURE__ */ new Map();
+	let owner = "";
+	let generation = 0;
+	let allowed = /* @__PURE__ */ new Set();
+	return {
+		retain(journeyId, send) {
+			const nextOwner = JSON.stringify([journeyId, send?.id]);
+			const ended = !send || [
+				"completed",
+				"blocked",
+				"prepared"
+			].includes(send.status);
+			if (owner !== nextOwner || ended) {
+				facts.clear();
+				generation += 1;
+			}
+			owner = nextOwner;
+			allowed = new Set(ended || !send ? [] : send.items.filter((item) => !item.sessionAssembly && item.status !== "completed").map((item) => keyFor(journeyId, item.artifact)));
+			for (const key of facts.keys()) if (!allowed.has(key)) facts.delete(key);
+		},
+		async get(journeyId, artifact, signal, compute) {
+			signal.throwIfAborted();
+			const key = keyFor(journeyId, artifact);
+			const cached = facts.get(key);
+			if (cached) return cached;
+			const started = generation;
+			const items = await compute();
+			signal.throwIfAborted();
+			if (started === generation && allowed.has(key)) {
+				facts.set(key, items);
+				while (facts.size > limit) {
+					const oldest = facts.keys().next().value;
+					if (oldest === void 0) break;
+					facts.delete(oldest);
+				}
+			}
+			return items;
+		}
+	};
+}
+//#endregion
+//#region apps/cli/src/account/journey/session-preparation.ts
+/** Shared facts retain no bytes; only upload steps acquire phase-local live iterators. */
+function createSessionPreparation(dependencies, facts) {
+	const prepare = dependencies.artifacts.prepareSessions;
+	const prepared = [];
+	const sessions = async function* (journeyId, artifact, signal) {
+		if (!prepare) {
+			const original = dependencies.artifacts.sessions;
+			if (original) yield* original(journeyId, artifact, signal);
+			return;
+		}
+		const result = await prepare(journeyId, artifact, signal);
+		prepared.push(result);
+		for await (const item of result.items) {
+			signal.throwIfAborted();
+			yield item;
+		}
+	};
+	const sessionFacts = async function* (journeyId, artifact, signal) {
+		const items = await facts.get(journeyId, artifact, signal, async () => {
+			const original = dependencies.artifacts.sessionFacts ?? dependencies.artifacts.sessions;
+			const items = [];
+			if (original) for await (const item of original(journeyId, artifact, signal)) {
+				const { workerIdentity, nativeSessionId, relativePath, harness, lastAt, metadata, sha256, byteLength, crc32 } = item;
+				items.push({
+					...workerIdentity ? { workerIdentity } : {},
+					nativeSessionId,
+					relativePath,
+					harness,
+					lastAt,
+					metadata,
+					sha256,
+					byteLength,
+					crc32
+				});
+			}
+			return items;
+		});
+		for (const item of items) {
+			signal.throwIfAborted();
+			yield item;
+		}
+	};
+	return {
+		dependencies: {
+			...dependencies,
+			artifacts: {
+				...dependencies.artifacts,
+				sessions,
+				sessionFacts
+			}
+		},
+		async close() {
+			await createCleanup().run(...prepared.map((result) => () => result.close()));
+		}
+	};
+}
+//#endregion
+//#region apps/cli/src/account/journey/session-metadata.ts
+/** The owner API uses this exact tuple; object key insertion order is not a wire dependency. */
+function sessionMetadataSha256(metadata) {
+	return createHash("sha256").update(JSON.stringify([
+		metadata.workspace.title,
+		metadata.workspace.pathHash,
+		metadata.workspace.remoteHashes,
+		metadata.workspace.primaryRemoteHash,
+		metadata.sourceSessionId,
+		metadata.harness,
+		metadata.lastAt,
+		metadata.parts.map((part) => [
+			part.path,
+			part.byteLength,
+			part.sha256,
+			part.crc32,
+			[
+				part.native.role,
+				part.native.sessionId,
+				part.native.agentId,
+				part.native.dispatchParentSessionId,
+				part.native.fork ? [
+					part.native.fork.parentSessionId,
+					part.native.fork.position.kind,
+					part.native.fork.position.value
+				] : null
+			]
+		])
+	])).digest("hex");
+}
+//#endregion
+//#region apps/cli/src/account/journey/receipt.ts
+function acceptReceipt(item, receipt) {
+	if (receipt.logicalWorkId !== item.workId || receipt.bundleId !== item.artifact.bundleId || receipt.outputRevision !== item.artifact.revision || receipt.sha256 !== item.artifact.sha256 || receipt.byteLength !== item.artifact.byteLength || receipt.access !== item.access || item.receipt !== null && (receipt.receiptId !== item.receipt.receiptId || receipt.scanId !== item.receipt.scanId || receipt.bindingId !== item.receipt.bindingId) || item.target?.kind === "existing" && receipt.bindingId !== item.target.bindingId) throw new ApplicationError("ARTIFACT_IDENTITY_MISMATCH");
+	const { upload: _upload, ...saved } = receipt;
+	const success = receipt.state === "succeeded" && receipt.assessmentState === "succeeded" && receipt.passportIncluded && receipt.effectiveAccess === item.access;
+	const failure = [
+		"failed",
+		"partial",
+		"superseded"
+	].includes(receipt.state) || receipt.state === "succeeded" && !success;
 	return {
 		...item,
-		target,
-		resolution,
-		status: "uploading",
-		error: null,
-		reservation: {
-			...agentSources?.length ? { agentSources } : {},
-			work,
-			target,
-			bundleId: item.artifact.bundleId,
-			createdAt: item.artifact.createdAt,
-			title: item.artifact.title,
-			sessionCount: item.artifact.sessionCount,
-			access: item.access,
-			outputRevision: item.artifact.revision,
-			byteLength: item.artifact.byteLength,
-			sha256: item.artifact.sha256,
-			expectedAccessVersion: resolution.accessVersion,
-			expectedScopeVersion: resolution.scopeVersion
-		}
+		receipt: saved,
+		status: success ? "completed" : failure ? "blocked" : receipt.state === "awaiting_upload" ? "uploading" : "assessing",
+		error: failure ? receipt.state === "succeeded" ? "PASSPORT_NOT_CURRENT" : "ASSESSMENT_INCOMPLETE" : null
 	};
 }
 //#endregion
@@ -7012,51 +7664,6 @@ function renewed(item, error) {
 		error
 	};
 }
-const confirmedSettings = (item) => item.settings !== null && item.settingsConfirmed;
-const started = (item) => Number(item.status === "uploading");
-/**
-* Works that share a workspace path or a git remote: once one completes, Passport offers it as
-* the other's candidate, so the other's target no longer resolves the same (ADR 0235).
-*/
-function related(left, right) {
-	return left.artifact.sources.some((one) => right.artifact.sources.some((other) => one.pathHash !== null && one.pathHash === other.pathHash || one.remoteHashes.some((hash) => other.remoteHashes.includes(hash))));
-}
-/**
-* The Works one advance steps together. Upload work comes before assessment checks: up to three
-* Works, started uploads first, then the largest ZIP, so the slowest Work starts earliest.
-* Completing an upload moves the owner's scope version, which Passport accepts while a Work's
-* own target resolves the same (ADR 0235). A Work related to one already picked waits for the
-* next batch. A reserved Work whose target would not survive that steps alone, and so does a
-* confirmed linked Settings change, which moves the access version every reservation carries,
-* once no upload has started. Assessment checks change nothing and step up to three together.
-*/
-function pickBatch(items, now, limit) {
-	const uploads = items.filter((item) => item.status === "uploading" || item.status === "ready").toSorted((left, right) => started(right) - started(left) || right.artifact.byteLength - left.artifact.byteLength);
-	const alone = uploads.find((item) => item.status === "uploading" && item.reservation !== null && item.resolution !== null && !keepsTarget(item.resolution, item.reservation)) ?? (uploads[0] && confirmedSettings(uploads[0]) ? uploads[0] : void 0);
-	if (alone) return [alone];
-	if (uploads.length) return uploads.filter((item) => !confirmedSettings(item)).reduce((batch, item) => batch.length < limit && !batch.some((picked) => related(picked, item)) ? [...batch, item] : batch, []);
-	const assessing = items.filter((item) => item.status === "assessing");
-	const first = assessing[0];
-	if (!first) return [];
-	if (confirmedSettings(first)) return [first];
-	const checks = assessing.filter((item) => !confirmedSettings(item));
-	const start = Math.floor(now / 1e3) * 3 % checks.length;
-	return [...checks.slice(start), ...checks.slice(0, start)].slice(0, 3);
-}
-function isCode(error, code) {
-	return error instanceof ApplicationError && error.code === code;
-}
-/**
-* A step that ended without a definite answer and is safe to repeat: a request timeout or abort
-* that is not the Send's own cancellation, or a connection failure from `fetch`: `fetch failed`
-* before the response, `terminated` when the socket resets while the body is read. The Work keeps
-* its state, so the next advance repeats the same idempotent step (ADR 0197).
-*/
-function isInterrupted(error) {
-	if (!(error instanceof Error)) return false;
-	if (error.name === "TimeoutError" || error.name === "AbortError") return true;
-	return error instanceof TypeError && (error.message === "fetch failed" || error.message === "terminated");
-}
 const sessionBackoffMs = (attempt) => 1e3 * 2 ** (attempt - 1);
 const zeroByteBackoffMs = (count) => [
 	15e3,
@@ -7071,7 +7678,7 @@ function retryDelay(error, fallback, now) {
 	return Number.isFinite(delay) ? Math.max(fallback, delay) : fallback;
 }
 /** Reconcile retained intents; only byte-started failures charge the durable budget. */
-async function attemptSession({ dependencies, original, session, key, remote, signal, guard, checkpoint }) {
+async function attemptSession({ dependencies, original, countCompletion, session, key, remote, signal, guard, checkpoint }) {
 	const previous = original.sessionUpload?.key === key && original.sessionUpload.sha256 === session.sha256 ? original.sessionUpload : null;
 	let failures = previous?.attempt ?? 0;
 	let retryCount = previous?.retryCount ?? 0;
@@ -7124,12 +7731,12 @@ async function attemptSession({ dependencies, original, session, key, remote, si
 					lastReported = Date.now();
 				}
 			});
-			await guard();
-			await remote.complete({
-				...input,
-				metadata: session.metadata
-			}, signal);
 		}
+		await guard();
+		await remote.complete({
+			...input,
+			metadata: session.metadata
+		}, signal);
 	};
 	try {
 		if (previous === null) await reserveUploadComplete();
@@ -7143,6 +7750,10 @@ async function attemptSession({ dependencies, original, session, key, remote, si
 			if (failures >= 3) throw new ApplicationError("SESSION_UPLOAD_EXHAUSTED");
 			await reserveUploadComplete();
 		}
+		if (countCompletion) item = {
+			...item,
+			storedSessions: (original.storedSessions ?? 0) + 1
+		};
 		transfer.bytesAcknowledged = session.byteLength;
 		await guard();
 		await save();
@@ -7182,6 +7793,7 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 	if (!item.sessionAssembly && (item.status !== "uploading" || item.receipt || item.reservation)) return {
 		...item,
 		receipt: null,
+		storedSessions: item.sessionMembership ? item.storedSessions : 0,
 		reservation: null,
 		target: null,
 		previousReceipts: item.receipt ? [...item.previousReceipts, item.receipt] : item.previousReceipts,
@@ -7215,7 +7827,7 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 		const intent = item.sessionMembership;
 		const assembly = await remote.assembly(intent.workId, signal);
 		const conflict = async () => {
-			const current = await remote.inventory(signal);
+			const current = await remote.work(intent.workId, signal);
 			const revision = await remote.assembly(intent.workId, signal);
 			await guard();
 			return {
@@ -7224,7 +7836,7 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 				error: "SESSION_MEMBERSHIP_CONFLICT",
 				membershipConflict: {
 					revision: revision?.revision ?? 0,
-					keys: current.works.find((work) => work.logicalWorkId === intent.workId)?.sessions.map((session) => session.key) ?? []
+					keys: current?.sessions.map((session) => session.key) ?? []
 				}
 			};
 		};
@@ -7241,7 +7853,7 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 			const { workId, ...input } = intent;
 			const result = await remote.membership(workId, input, signal);
 			await guard();
-			if (migrate) {
+			if (migrate || item.sessionMembershipMetadataVersion !== 1) {
 				const { sessionMembership: _, ...rest } = item;
 				return {
 					...rest,
@@ -7259,6 +7871,7 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 				error: null
 			};
 		} catch (error) {
+			if (error instanceof JourneyRemoteError && error.status === 413 && error.code === "work_session_capacity_exceeded") throw new ApplicationError("WORK_SESSION_CAPACITY_EXCEEDED");
 			if (error instanceof JourneyRemoteError && error.status === 409) return conflict();
 			throw error;
 		}
@@ -7276,20 +7889,31 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 			break;
 		}
 	}
+	const ownKeys = /* @__PURE__ */ new Set();
+	if (!recoverLegacy) item = {
+		...item,
+		storedSessions: 0
+	};
 	for await (const session of sessions(journeyId, item.artifact, signal)) {
 		const identity = await keys.add(session);
+		ownKeys.add(identity.key);
 		if (recoverLegacy && (identity.legacyKey !== pending?.key || session.sha256 !== pending?.sha256)) continue;
 		const key = recoverLegacy && pending ? pending.key : identity.key;
-		if (stored.get(key)?.sha256 === session.sha256) {
+		if (stored.get(key)?.sha256 === session.sha256 && stored.get(key)?.metadataSha256 === sessionMetadataSha256(session.metadata)) {
 			if (recoverLegacy) return {
 				...item,
 				sessionUpload: null
 			};
+			item = {
+				...item,
+				storedSessions: (item.storedSessions ?? 0) + 1
+			};
 			continue;
 		}
 		item = await attemptSession({
 			dependencies,
 			original: item,
+			countCompletion: !recoverLegacy,
 			session,
 			key,
 			remote,
@@ -7301,21 +7925,32 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 	}
 	await guard();
 	const assembly = await remote.assembly(item.workId, signal);
-	const current = (await remote.inventory(signal)).works.find((work) => work.logicalWorkId === item.workId);
+	const current = await remote.work(item.workId, signal);
 	if (current && current.access !== item.access) {
-		const resolution = await connection.resolve(resolveInput(item, context.bindingId), signal);
-		const [candidate] = resolution.candidates;
-		if (resolution.status === "blocked" || candidate?.access === "removed") throw new ApplicationError("WORK_REMOVED");
-		if (resolution.status !== "matched" || resolution.logicalWorkId !== item.workId || resolution.candidates.length !== 1 || !candidate || context.bindingId !== void 0 && candidate.bindingId !== context.bindingId) throw new ApplicationError("INVALID_STATE");
-		const settings = await connection.preview(candidate.workId, item.access, signal);
+		if (current.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		const [ownKey] = ownKeys;
+		if (!ownKey) throw new ApplicationError("INVALID_STATE");
 		await guard();
-		await connection.confirm(settings, signal);
+		return {
+			...item,
+			status: "blocked",
+			error: "SESSION_MOVE_ACCESS_REQUIRED",
+			accessConflict: {
+				sessionKey: ownKey,
+				requestedAccess: item.access,
+				accountWorkId: current.logicalWorkId,
+				accountAccess: current.access,
+				rule: "destination-access"
+			},
+			accessConflictSessionCount: ownKeys.size
+		};
 	}
 	await guard();
 	return {
 		...item,
 		sessionUpload: null,
 		sessionMembershipKeyVersion: 2,
+		sessionMembershipMetadataVersion: 1,
 		sessionMembership: {
 			workId: item.workId,
 			expectedRevision: assembly?.revision ?? 0,
@@ -7358,6 +7993,35 @@ async function saveSend(dependencies, snapshot, next, action, expectedJourneyRev
 		at: dependencies.now()
 	});
 }
+/** This transaction changes only the supplied transfer fields and durable cursor. */
+async function saveTransfer(dependencies, current, workId, patch) {
+	const progress = await dependencies.storage.checkpointTransfer({
+		journeyId: current.journey.journeyId,
+		sendId: current.send.id,
+		workId,
+		expectedJourneyRevision: current.journey.revision,
+		expectedSendRevision: current.send.revision,
+		requestKey: randomUUID(),
+		at: dependencies.now(),
+		...patch
+	});
+	if (progress.status !== "applied") throw new ApplicationError("REVISION_CONFLICT");
+	return {
+		journey: {
+			...current.journey,
+			revision: progress.revision,
+			lastEvent: progress.lastEvent
+		},
+		send: {
+			...current.send,
+			revision: progress.sendRevision,
+			items: current.send.items.map((item) => item.workId === workId ? {
+				...item,
+				...patch
+			} : item)
+		}
+	};
+}
 function aggregate(send) {
 	if (send.status === "paused") return send;
 	const statuses = send.items.map((item) => item.status);
@@ -7366,17 +8030,6 @@ function aggregate(send) {
 		status: statuses.length === 0 ? "blocked" : statuses.every((status) => status === "completed") ? "completed" : statuses.some((status) => status === "target" || status === "settings") ? "review" : statuses.some((status) => status === "ready" || status === "uploading") ? "sending" : statuses.some((status) => status === "assessing") ? "waiting" : "blocked"
 	};
 }
-/**
-* A completed Send that Passport has not finished with: a Work is still assessed or reapplied
-* (ADR 0233). A blocked Work waits on the person's Retry, not on Passport.
-*/
-function awaitingPassport(send) {
-	return send.status === "completed" && send.items.some((item) => !["completed", "blocked"].includes(item.status));
-}
-/** The host continues confirmed uploads and unfinished Passport assessments without a panel. */
-function hostDrives(send) {
-	return awaitingPassport(send) || send.confirmedAt != null && ["sending", "waiting"].includes(send.status);
-}
 /** Explicit resume retries recoverable items and recaptures a pending sign-in or profile. */
 function resumeState(send) {
 	if (send.status !== "completed" && send.items.length && send.items.every((item) => item.status === "completed") && send.items.some((item) => !item.sessionAssembly)) return {
@@ -7505,15 +8158,126 @@ async function captureProfile(connection, guard, signal, failure) {
 	}
 }
 //#endregion
+//#region apps/cli/src/account/journey/remote-guard.ts
+/**
+* The class of every method. Adding a method to either remote without classifying it here fails
+* the type check, and the guarded remote exposes only the methods named below.
+*/
+const connectionClasses = {
+	assertCurrent: "read",
+	syncProfile: "profile-sync",
+	readProfile: "read",
+	addressTaken: "read",
+	status: "read",
+	checkAgentSources: "agent-sources-check",
+	resolve: "work-resolve",
+	preview: "settings-preview",
+	confirm: "settings-confirm",
+	reserve: "work-reserve",
+	complete: "work-complete",
+	replace: "works-replace",
+	saveProfile: "profile-save",
+	ownedPassport: "read"
+};
+const sessionClasses = {
+	inventory: "read",
+	assessment: "read",
+	work: "session-work",
+	assembly: "session-assembly",
+	reserve: "session-reserve",
+	complete: "session-complete",
+	membership: "session-membership"
+};
+/**
+* The one place that decides whether a Send-path call may send something about the person's
+* work (ADR 0284). Rules of this kind belong here, never in a caller; `mutation` is for the
+* rules to come.
+*/
+function assertMayLeave(scope, mutation) {
+	if (!mayLeave(scope, mutation)) throw new ApplicationError("JOURNEY_OBSOLETE");
+}
+/** `assertMayLeave` as a question, for a caller that must skip what the guard would refuse. */
+function mayLeave(scope, _mutation) {
+	const atPassport = scope.item ? itemAtPassport(scope.item) : scope.send?.items.some(itemAtPassport) ?? false;
+	return !(scope.journey && obsoleteJourney(scope.journey) && !atPassport);
+}
+/**
+* The remote a Send uses, closed by default: it holds only the methods classified above. A read
+* passes through; every other method asks `assertMayLeave` first. A refusal rejects like a failed
+* remote call, so the advance blocks only that Work.
+*/
+function guardSendRemote(connection, scope) {
+	const through = (kind, call) => kind === "read" ? call : (...args) => guardedSendMutation(scope, kind, () => call(...args));
+	const work = connectionClasses;
+	const { sessions, checkAgentSources } = connection;
+	return {
+		subject: connection.subject,
+		assertCurrent: through(work.assertCurrent, connection.assertCurrent),
+		syncProfile: through(work.syncProfile, connection.syncProfile),
+		readProfile: through(work.readProfile, connection.readProfile),
+		addressTaken: through(work.addressTaken, connection.addressTaken),
+		status: through(work.status, connection.status),
+		resolve: through(work.resolve, connection.resolve),
+		preview: through(work.preview, connection.preview),
+		confirm: through(work.confirm, connection.confirm),
+		reserve: through(work.reserve, connection.reserve),
+		complete: through(work.complete, connection.complete),
+		replace: through(work.replace, connection.replace),
+		saveProfile: through(work.saveProfile, connection.saveProfile),
+		ownedPassport: through(work.ownedPassport, connection.ownedPassport),
+		...checkAgentSources ? { checkAgentSources: through(work.checkAgentSources, checkAgentSources) } : {},
+		...sessions ? { sessions: {
+			inventory: through(sessionClasses.inventory, sessions.inventory),
+			assessment: through(sessionClasses.assessment, sessions.assessment),
+			work: through(sessionClasses.work, sessions.work),
+			assembly: through(sessionClasses.assembly, sessions.assembly),
+			reserve: through(sessionClasses.reserve, sessions.reserve),
+			complete: through(sessionClasses.complete, sessions.complete),
+			membership: through(sessionClasses.membership, sessions.membership)
+		} } : {}
+	};
+}
+/** A guarded call that is not a remote method: the byte upload to a signed address. */
+function guardSendCall(scope, mutation, call) {
+	return guardedSendMutation(scope, mutation, call);
+}
+/** Each session's byte upload to a signed address asks the guard too (ADR 0284). */
+function guardSessionUploads(sessions, scope) {
+	return async function* (journeyId, artifact, signal) {
+		for await (const session of sessions(journeyId, artifact, signal)) yield {
+			...session,
+			upload: (upload, uploadSignal, progress) => guardedSendMutation(scope, "session-upload", () => session.upload(upload, uploadSignal, progress))
+		};
+	};
+}
+/** Named so a test can tell a guarded call from one that bypassed the guard. */
+function guardedSendMutation(scope, mutation, call) {
+	try {
+		assertMayLeave(scope, mutation);
+	} catch (error) {
+		return Promise.reject(error);
+	}
+	return call();
+}
+//#endregion
 //#region apps/cli/src/account/journey/advance.ts
 /** A Work Passport is done with: assessed, or stopped unless Resume retries it. */
 const settled = (item) => ["completed", "blocked"].includes(item.status);
+/** The byte upload to a signed address is a guarded call too (ADR 0284). */
+function guardedContext(context, scope, checksumUploads) {
+	const upload = context.upload;
+	return {
+		...context,
+		checksumUploads,
+		upload: (artifact, signed, signal) => guardSendCall(scope, "work-upload", () => upload(artifact, signed, signal))
+	};
+}
 /** Stored state equality: key order and explicit undefined fields do not count. */
 const sameJson = (left, right) => isDeepStrictEqual(JSON.parse(JSON.stringify(left)), JSON.parse(JSON.stringify(right)));
 /** The stored Send still holds exactly this Work state, whatever else changed meanwhile. */
 function sameItem(items, item) {
 	const current = items.find((value) => value.workId === item.workId);
-	return current !== void 0 && sameJson(current, item);
+	return current === item || current !== void 0 && sameJson(current, item);
 }
 /** Shared sign-in, account and per-item rules for native Send and Manual upload. */
 async function advanceItems(host, signal) {
@@ -7555,7 +8319,7 @@ async function advanceItems(host, signal) {
 			});
 		}
 		if (send.subject === null || send.status === "sign-in") {
-			const { parallelCompletes: captured, ...profile } = await host.profile(connection, signal);
+			const { parallelCompletes: captured, ...profile } = await host.profile(guardSendRemote(connection, host.scope(null)), signal);
 			const parallelCompletes = send.subject === null ? captured : send.parallelCompletes && captured;
 			const prepared = {
 				...send,
@@ -7566,17 +8330,16 @@ async function advanceItems(host, signal) {
 			else delete prepared.parallelCompletes;
 			return host.save(prepared.status === "sending" ? aggregate(prepared) : prepared);
 		}
-		const blocked = await host.preflight?.(connection, signal);
+		const blocked = await host.preflight?.(guardSendRemote(connection, host.scope(null)), signal);
 		if (blocked) return blocked;
-		const batch = host.batch?.() ?? pickBatch(send.items, Date.now(), send.parallelCompletes ? 3 : 1);
+		const batch = host.batch?.() ?? pickBatch(send.items, send.parallelCompletes ? 3 : 1, host.poll?.bind(void 0, send));
 		if (!batch.length) return host.applied();
 		const busy = Math.max(0, ...batch.map((item) => item.busyRefusals ?? 0));
 		if (busy) await wait(busyDelay(busy), signal);
 		const checksumUploads = !send.items.some((item) => item.checksumUploadRefused);
-		const results = await Promise.allSettled(batch.map((item) => (host.step ?? stepItem)({
-			...host.context(item),
-			checksumUploads
-		}, item, connection, signal)));
+		const run = (item) => (host.step ?? stepItem)(guardedContext(host.context(item), host.scope(item), checksumUploads), item, guardSendRemote(connection, host.scope(item)), signal);
+		const refill = host.refill;
+		const results = refill && batch.length > 3 ? await runSessionQueue(batch, run, () => refill(guardSendRemote(connection, host.scope(null)), signal), signal) : await Promise.allSettled(batch.map(run));
 		const failures = results.flatMap((result) => result.status === "rejected" ? [result] : []);
 		if (failures.some(({ reason }) => isCode(reason, "REVISION_CONFLICT") || isCode(reason, "SEND_SCOPE_INVALIDATED"))) return host.stale();
 		const first = failures[0];
@@ -7587,7 +8350,7 @@ async function advanceItems(host, signal) {
 		const next = /* @__PURE__ */ new Map();
 		for (const [index, result] of results.entries()) {
 			const item = batch[index];
-			if (!item) continue;
+			if (!item || !result) continue;
 			if (result.status === "fulfilled") {
 				next.set(item.workId, result.value);
 				continue;
@@ -7656,6 +8419,44 @@ async function advanceItems(host, signal) {
 		return blockSend(host, error, signal);
 	}
 }
+/** Every queued Work was admitted as independent at preflight. Recheck delayed slots before use. */
+async function runSessionQueue(batch, run, admit, signal) {
+	const results = [];
+	let next = 0;
+	let stopped = false;
+	let admission;
+	async function worker() {
+		while (!stopped && next < batch.length) {
+			const index = next++;
+			const item = batch[index];
+			if (!item) return;
+			try {
+				if (index >= 3) {
+					admission ??= admit().finally(() => {
+						admission = void 0;
+					});
+					if (!await admission) stopped = true;
+					if (stopped) return;
+				}
+				signal.throwIfAborted();
+				const value = await run(item);
+				results[index] = {
+					status: "fulfilled",
+					value
+				};
+				if (value.status === "blocked") stopped = true;
+			} catch (reason) {
+				stopped = true;
+				results[index] = {
+					status: "rejected",
+					reason
+				};
+			}
+		}
+	}
+	await Promise.all(Array.from({ length: 3 }, worker));
+	return results;
+}
 /** An unexpected failure blocks the whole send with a safe code; abort keeps propagating. */
 function blockSend(host, error, signal) {
 	if (signal.aborted) throw error;
@@ -7699,35 +8500,47 @@ function completeAtUpload(send, sessions) {
 }
 async function advanceSend(dependencies, address, signal, chain) {
 	let snapshot = requireSend(await dependencies.storage.loadSend(address.journeyId, address.sendId));
-	const sessionFacts = chain?.sessionFacts ?? createSessionFactsCache();
+	const sessionFacts = chain.sessionFacts;
 	sessionFacts.retain(address.journeyId, snapshot.send);
-	if (chain) chain.revision = snapshot.send.revision;
+	chain.revision = snapshot.send.revision;
 	if ((await dependencies.storage.loadSend(address.journeyId))?.send?.id !== snapshot.send.id) return {
 		...snapshot,
 		status: "stale"
 	};
 	const completed = snapshot.send.status === "completed";
-	if (snapshot.journey.phase === "paused" || !snapshot.send.confirmedAt || ["paused", "prepared"].includes(snapshot.send.status) || completed && snapshot.send.items.every(settled)) return {
+	if (!advanceStepsSend(snapshot.journey, snapshot.send)) return {
 		...snapshot,
 		status: "applied"
 	};
 	const checkpoints = /* @__PURE__ */ new Map();
 	const fulfilled = /* @__PURE__ */ new Set();
 	let saving = Promise.resolve();
+	let validated;
 	async function active(item) {
-		const current = requireSend(await dependencies.storage.loadSend(address.journeyId));
-		if (current.send.id !== snapshot.send.id || !sameItem(current.send.items, checkpoints.get(item.workId) ?? item) || current.send.status === "paused" || current.journey.phase === "paused") throw new ApplicationError("REVISION_CONFLICT");
-		assertScope(current.journey, current.send);
+		const observed = snapshot;
+		const isCurrent = (candidate) => dependencies.storage.isCurrentSend(address.journeyId, candidate.send.id, candidate.journey.revision);
+		let current = observed;
+		if (!await isCurrent(observed)) {
+			current = requireSend(await dependencies.storage.loadSend(address.journeyId));
+			if (current.send.id !== observed.send.id || !await isCurrent(current)) throw new ApplicationError("REVISION_CONFLICT");
+		}
+		if (!sameItem(current.send.items, checkpoints.get(item.workId) ?? item) || current.send.status === "paused" || current.journey.phase === "paused") throw new ApplicationError("REVISION_CONFLICT");
+		if (current !== validated) {
+			assertScope(current.journey, current.send);
+			validated = current;
+		}
 		return current;
 	}
 	const save = (proposed) => {
 		const next = {
 			...proposed,
+			error: proposed.status === "blocked" && !proposed.error && proposed.contentConflict && proposed.items.some((item) => item.error === "SESSION_CONTENT_CONFLICT") ? "SESSION_CONTENT_CONFLICT" : proposed.error,
 			items: proposed.items.map((item) => {
 				const checkpoint = checkpoints.get(item.workId);
 				return checkpoint && !fulfilled.has(item.workId) ? {
 					...checkpoint,
 					...item,
+					...checkpoint.storedSessions !== void 0 ? { storedSessions: checkpoint.storedSessions } : {},
 					sessionUpload: checkpoint.sessionUpload
 				} : item;
 			})
@@ -7743,6 +8556,7 @@ async function advanceSend(dependencies, address, signal, chain) {
 	const send = withoutQuestions(snapshot.send);
 	try {
 		assertScope(snapshot.journey, snapshot.send);
+		validated = snapshot;
 	} catch (error) {
 		if (completed) return save({
 			...snapshot.send,
@@ -7752,10 +8566,21 @@ async function advanceSend(dependencies, address, signal, chain) {
 				error: "SEND_SCOPE_CHANGED"
 			})
 		});
+		const invalidated = safeCode(error) === "SEND_SCOPE_INVALIDATED";
+		const answered = (item) => {
+			const work = snapshot.journey.works.find((work) => work.id === item.workId);
+			return !work || work.access !== item.access;
+		};
+		const answeredSessions = new Set(snapshot.send.items.flatMap((item) => item.error === "SESSION_MOVE_ACCESS_REQUIRED" && item.accessConflict && answered(item) ? [item.accessConflict.sessionKey] : []));
 		return blockSend({
-			send: safeCode(error) === "SEND_SCOPE_INVALIDATED" ? {
+			send: invalidated ? {
 				...snapshot.send,
-				items: snapshot.send.items.filter((item) => !["SESSION_MOVE_ACCESS_REQUIRED", "SESSION_MOVE_ACCESS_HELD"].includes(item.error ?? ""))
+				items: snapshot.send.items.filter((item) => {
+					if (item.error === "SESSION_MOVE_ACCESS_HELD") return false;
+					if (item.error !== "SESSION_MOVE_ACCESS_REQUIRED") return true;
+					if (item.accessConflict?.accountAccess === null && answeredSessions.has(item.accessConflict.sessionKey)) return false;
+					return !answered(item);
+				})
 			} : snapshot.send,
 			failure: dependencies.failure,
 			save
@@ -7767,24 +8592,83 @@ async function advanceSend(dependencies, address, signal, chain) {
 	};
 	if (send !== snapshot.send) return save(send);
 	let independentItems = [];
+	let queuedIds = [];
 	const preparation = createSessionPreparation(dependencies, sessionFacts);
+	const sessionStepDependencies = (item) => {
+		const { artifacts } = preparation.dependencies;
+		if (!artifacts.sessions) return preparation.dependencies;
+		const scope = {
+			journey: snapshot.journey,
+			send: snapshot.send,
+			item
+		};
+		return {
+			...preparation.dependencies,
+			artifacts: {
+				...artifacts,
+				sessions: guardSessionUploads(artifacts.sessions, scope)
+			}
+		};
+	};
+	let queueActive = false;
+	async function readAdmission(connection, currentItems, signal) {
+		if (!connection.sessions) throw new ApplicationError("INVALID_STATE");
+		const inventory = await connection.sessions.inventory(signal);
+		const conflicts = await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, currentItems, inventory, signal);
+		return {
+			conflicts,
+			independent: conflicts.length ? [] : await sessionIndependentItems(preparation.dependencies, snapshot.journey.journeyId, currentItems, inventory, signal)
+		};
+	}
+	let stopObservation;
 	const cleanup = createCleanup();
 	try {
 		return await advanceItems({
 			send,
+			poll: chain.poll,
 			failure: dependencies.failure,
 			...usesSessionSend(dependencies, send) ? {
 				batch: () => {
 					const limit = send.parallelCompletes ? 3 : 1;
-					return independentItems.length ? pickBatch(independentItems, Date.now(), limit) : pickBatch(send.items, Date.now(), limit);
+					const candidates = independentItems.length ? independentItems : send.items;
+					const planned = pickBatch(candidates, limit === 3 && independentItems.length ? candidates.length : limit, (works) => chain.poll(send, works));
+					queueActive = limit === 3 && planned.length > limit && planned.some((item) => item.status === "uploading") && planned.every((item) => !item.busyRefusals && !item.sessionUpload?.nextAttemptAt);
+					if (queueActive) queuedIds = planned.map((item) => item.workId);
+					return queueActive ? planned : planned.slice(0, limit);
 				},
 				preflight: async (connection, preflightSignal) => {
 					if (!connection.sessions) throw new ApplicationError("INVALID_STATE");
-					if (!send.items.some((item) => item.status === "uploading" && !item.sessionAssembly && !item.receipt && !item.reservation)) return null;
-					const inventory = await connection.sessions.inventory(preflightSignal);
-					const conflicts = await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
-					if (conflicts.length === 0) {
-						independentItems = await sessionIndependentItems(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
+					const checked = send.items.filter((item) => mayLeave({
+						journey: snapshot.journey,
+						send: snapshot.send,
+						item
+					}, "session-membership"));
+					if (!checked.some((item) => item.status === "uploading" && !item.sessionAssembly && !item.receipt && !item.reservation)) return null;
+					let admission;
+					try {
+						admission = await readAdmission(connection, checked, preflightSignal);
+					} catch (error) {
+						if (!(error instanceof SessionContentConflict)) throw error;
+						await connection.assertCurrent(preflightSignal);
+						dependencies.failure(error.code, error);
+						const items = send.items.map((item) => error.affectedWorkIds.has(item.workId) && !["completed", "blocked"].includes(item.status) && !item.sessionAssembly ? {
+							...item,
+							status: "blocked",
+							error: error.code
+						} : item);
+						const next = aggregate({
+							...send,
+							items,
+							contentConflict: error.contentConflict
+						});
+						return save({
+							...next,
+							error: next.status === "blocked" ? error.code : null
+						});
+					}
+					const { conflicts, independent } = admission;
+					if (!conflicts.length) {
+						independentItems = independent;
 						return null;
 					}
 					await connection.assertCurrent(preflightSignal);
@@ -7803,7 +8687,8 @@ async function advanceSend(dependencies, address, signal, chain) {
 							if (item.sessionAssembly || item.status === "completed") return item;
 							const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
 							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
-							const conflict = itemConflicts[0];
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
+							if (item.status === "blocked" && item.error === "SESSION_CONTENT_CONFLICT") return item;
 							if (!conflict) return {
 								...current,
 								status: "blocked",
@@ -7820,35 +8705,74 @@ async function advanceSend(dependencies, address, signal, chain) {
 						})
 					});
 				},
-				step: (context, item, connection, stepSignal) => stepSessionWork(preparation.dependencies, snapshot.journey.journeyId, context, item, connection, stepSignal, (next) => {
-					const pending = saving.then(async () => {
-						const current = await active(item);
-						if (current.send.revision !== snapshot.send.revision || current.journey.revision !== snapshot.journey.revision) throw new ApplicationError("REVISION_CONFLICT");
-						stepSignal.throwIfAborted();
-						const result = await saveSend(dependencies, current, {
-							...current.send,
-							items: current.send.items.map((value) => value.workId === next.workId ? next : value)
-						});
-						if (result.status === "stale") throw new ApplicationError("REVISION_CONFLICT");
-						snapshot = requireSend(result);
-						const saved = snapshot.send.items.find((value) => value.workId === next.workId);
-						if (!saved) throw new ApplicationError("INVALID_STATE");
-						checkpoints.set(next.workId, saved);
+				refill: async (connection, refillSignal) => {
+					let checked;
+					try {
+						checked = await readAdmission(connection, snapshot.send.items, refillSignal);
+					} catch {
+						refillSignal.throwIfAborted();
+						return false;
+					}
+					return !checked.conflicts.length && queuedIds.every((workId) => {
+						return snapshot.send.items.find((entry) => entry.workId === workId)?.sessionAssembly || checked.independent.some((entry) => entry.workId === workId);
 					});
-					saving = pending.catch(() => void 0);
-					return pending;
-				}).then(({ busyRefusals: _busy, ...result }) => {
+				},
+				step: async (context, item, connection, stepSignal) => {
+					if (!stopObservation && (item.status === "ready" || item.status === "uploading")) stopObservation = dependencies.observeUpload?.(connection, () => snapshot.send, stepSignal);
+					const checkpoint = (next, transfer = false) => {
+						const pending = saving.then(async () => {
+							const current = await active(item);
+							if (current.send.revision !== snapshot.send.revision || current.journey.revision !== snapshot.journey.revision) throw new ApplicationError("REVISION_CONFLICT");
+							stepSignal.throwIfAborted();
+							if (transfer && next.sessionUpload) {
+								snapshot = await saveTransfer(dependencies, current, next.workId, {
+									sessionUpload: next.sessionUpload,
+									...next.storedSessions === void 0 ? {} : { storedSessions: next.storedSessions }
+								});
+								validated = snapshot;
+							} else {
+								const result = await saveSend(dependencies, current, {
+									...current.send,
+									items: current.send.items.map((value) => value.workId === next.workId ? next : value)
+								});
+								if (result.status === "stale") throw new ApplicationError("REVISION_CONFLICT");
+								snapshot = requireSend(result);
+							}
+							const saved = snapshot.send.items.find((value) => value.workId === next.workId);
+							if (!saved) throw new ApplicationError("INVALID_STATE");
+							checkpoints.set(next.workId, saved);
+						});
+						saving = pending.catch(() => void 0);
+						return pending;
+					};
+					const step = (current) => stepSessionWork(sessionStepDependencies(current), snapshot.journey.journeyId, context, current, connection, stepSignal, (next) => checkpoint(next, true));
+					let result = await step(item);
+					if (queueActive && item.status === "ready" && result.status === "uploading" && mayLeave({
+						journey: snapshot.journey,
+						send: snapshot.send,
+						item: result
+					}, "session-reserve")) {
+						await checkpoint(result);
+						result = await step(result);
+					}
+					if (queueActive && !sameJson(result, checkpoints.get(item.workId) ?? item)) await checkpoint(result);
 					fulfilled.add(item.workId);
-					return result;
-				})
+					const { busyRefusals: _busy, ...finished } = result;
+					return finished;
+				}
 			} : {},
-			connect: chain?.connect ?? dependencies.auth.connect,
+			connect: chain.connect,
+			scope: (item) => ({
+				journey: snapshot.journey,
+				send: snapshot.send,
+				item
+			}),
 			profile: (connection, profileSignal) => prepareProfile(dependencies, snapshot, connection, profileSignal),
 			context: (item) => {
 				const binding = snapshot.journey.works.find((value) => value.id === item.workId)?.binding;
 				return {
 					snapshot: true,
-					...chain ? { fresh: chain.fresh } : {},
+					fresh: chain.fresh,
 					active: async () => {
 						await active(item);
 					},
@@ -7874,6 +8798,7 @@ async function advanceSend(dependencies, address, signal, chain) {
 		cleanup.failed(error);
 		throw error;
 	} finally {
+		stopObservation?.();
 		await cleanup.run(() => preparation.close());
 	}
 }
@@ -7944,6 +8869,7 @@ function pathHash(item) {
 /** Manual upload: native Send's commands and recovery rules over one completed result's ZIPs. */
 function createManualUploader(dependencies) {
 	const { storage } = dependencies;
+	const poll = createAssessmentPoll();
 	const running = /* @__PURE__ */ new Map();
 	function save(prior, next, action) {
 		return storage.commit({
@@ -8082,7 +9008,11 @@ function createManualUploader(dependencies) {
 				error: null
 			};
 			if (connection) try {
-				profile = await captureProfile(connection, guard(upload), signal, dependencies.failure);
+				profile = await captureProfile(guardSendRemote(connection, {
+					journey: null,
+					send: upload,
+					item: null
+				}), guard(upload), signal, dependencies.failure);
 			} catch (error) {
 				if (error instanceof ApplicationError && error.code === "REVISION_CONFLICT") return save(upload, upload, input);
 				throw error;
@@ -8161,12 +9091,18 @@ function createManualUploader(dependencies) {
 		let bindings = [];
 		return advanceItems({
 			send: upload,
+			poll,
 			failure: dependencies.failure,
 			save: (next) => save(upload, next),
 			connect: async (connectSignal) => {
 				bindings = await storage.bindings();
 				return dependencies.auth.connect(connectSignal);
 			},
+			scope: (item) => ({
+				journey: null,
+				send: upload,
+				item
+			}),
 			profile: (connection, profileSignal) => captureProfile(connection, guard(upload), profileSignal, dependencies.failure),
 			context: (item) => ({
 				active: guard(upload, item),
@@ -9383,6 +10319,7 @@ function createJourneyFiles(storage) {
 	return async (journeyId, workId, signal) => {
 		const state = await storage.current(journeyId);
 		if (!state?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		if (state.phase === "completed" && state.outputVersion !== 1) throw new ApplicationError("SCOPE_NOT_READY");
 		assertJourneyPrivacyReady(state, true);
 		if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		const work = state.works.find((item) => item.id === workId);
@@ -9417,6 +10354,7 @@ function createJourneyFiles(storage) {
 const sendRecoveryCodes = [
 	"SESSION_MEMBERSHIP_CONFLICT",
 	"SESSION_UPLOAD_EXHAUSTED",
+	"WORK_SESSION_CAPACITY_EXCEEDED",
 	"LEGACY_SEND_RECOVERY_REQUIRED",
 	"ASSESSMENT_INCOMPLETE",
 	"SESSION_PUBLICATION_FENCE_REQUIRED"
@@ -9472,10 +10410,14 @@ async function requestSend(dependencies, raw, hostId, source) {
 		if (!hostId) throw new ApplicationError("INVALID_TRANSITION");
 		const included = current.journey.works.filter(isIncludedWork);
 		if (!sameIds$1(input.included.map((work) => work.workId), included.map((work) => work.id)) || !input.included.every((item) => included.some((work) => work.id === item.workId && work.access === item.access && work.accessConfirmed)) || !sameIds$1(input.omittedWorkIds, current.journey.works.filter((work) => !isIncludedWork(work)).map((work) => work.id))) throw new ApplicationError("CONFIRMATION_REQUIRED");
-		if (!binding) binding = {
-			subject: (await dependencies.auth.connect(new AbortController().signal))?.subject ?? null,
-			at: dependencies.now()
-		};
+		if (!binding) {
+			const connection = await dependencies.auth.connect(new AbortController().signal);
+			if (!connection) throw new ApplicationError(dependencies.auth.configured ? "ACCOUNT_SIGNED_OUT" : "ACCOUNT_NOT_CONFIGURED");
+			binding = {
+				subject: connection.subject,
+				at: dependencies.now()
+			};
+		}
 		const { subject, at } = binding;
 		const result = await dependencies.storage.commitSend({
 			journeyId: input.journeyId,
@@ -9537,10 +10479,11 @@ async function requestError(dependencies, send, hostId, signal) {
 * next phase exactly as between advances. The advance returns after three phases or once no
 * picked Work is mid-upload, so later Works continue from the caller's next advance.
 */
-async function advanceWork(dependencies, address, signal, phases = 3, sessionFacts = createSessionFactsCache()) {
+async function advanceWork(dependencies, address, signal, phases = 3, sessionFacts = createSessionFactsCache(), poll = createAssessmentPoll()) {
 	let connection;
 	const chain = {
 		sessionFacts,
+		poll,
 		fresh: /* @__PURE__ */ new Map(),
 		async connect(connectSignal) {
 			if (connection === void 0) connection = await dependencies.auth.connect(connectSignal);
@@ -9555,7 +10498,102 @@ async function advanceWork(dependencies, address, signal, phases = 3, sessionFac
 /** The phase saved progress and left its Work mid-upload, with nothing else to report. */
 function uploading(result, before) {
 	const send = result.send;
-	return result.status === "applied" && send !== null && before !== void 0 && send.revision > before && send.status === "sending" && send.error === null && pickBatch(send.items, Date.now(), send.parallelCompletes ? 3 : 1)[0]?.status === "uploading";
+	return result.status === "applied" && send !== null && before !== void 0 && send.revision > before && send.status === "sending" && send.error === null && pickBatch(send.items, send.parallelCompletes ? 3 : 1)[0]?.status === "uploading";
+}
+//#endregion
+//#region apps/cli/src/account/journey/upload-observer.ts
+const intervalMs = 15e3;
+const budget = 3;
+/** A tab polls only the in-flight upload owner's read capability. No store or upload-slot acquisition. */
+function createUploadObserver() {
+	let active;
+	let retained = "";
+	let cursor = 0;
+	let next = 0;
+	let reading;
+	const observations = /* @__PURE__ */ new Map();
+	function start(connection, current, signal) {
+		const send = current();
+		const scope = JSON.stringify([
+			send.journeyId,
+			send.id,
+			send.subject
+		]);
+		if (scope !== retained) {
+			observations.clear();
+			cursor = 0;
+			next = 0;
+			retained = scope;
+		}
+		const stop = new AbortController();
+		const flight = {
+			connection,
+			current,
+			signal: AbortSignal.any([signal, stop.signal])
+		};
+		active = flight;
+		return () => {
+			stop.abort();
+			if (active === flight) active = void 0;
+		};
+	}
+	function accepted(send) {
+		return send.items.filter((item) => item.status === "assessing" && item.sessionAssembly);
+	}
+	async function refresh(flight) {
+		const remote = flight.connection.sessions;
+		if (!remote) return;
+		const items = accepted(flight.current());
+		if (!items.length) return;
+		const startAt = cursor % items.length;
+		const selected = [...items.slice(startAt), ...items.slice(0, startAt)].slice(0, budget);
+		const signal = AbortSignal.any([flight.signal, AbortSignal.timeout(8e3)]);
+		for (const item of selected) {
+			const revision = item.sessionAssembly?.revision;
+			if (revision === void 0 || signal.aborted) break;
+			cursor = (cursor + 1) % items.length;
+			let state = "unavailable";
+			try {
+				const assembly = await remote.assembly(item.workId, signal);
+				if (assembly?.revision === revision) {
+					if (assembly.error) state = "failed";
+					else if (assembly.completedRevision !== revision || !assembly.scanId) state = "assembling";
+					else state = await remote.assessment(assembly.scanId, signal);
+				}
+			} catch {
+				state = "unavailable";
+			}
+			if (flight.signal.aborted || active !== flight) return;
+			observations.set(item.workId, {
+				workId: item.workId,
+				revision,
+				checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				state
+			});
+		}
+	}
+	async function read(address) {
+		const flight = active;
+		if (!flight || flight.signal.aborted) return [];
+		const send = flight.current();
+		if (send.journeyId !== address.journeyId || send.id !== address.sendId || send.subject !== flight.connection.subject || send.status !== "sending") return [];
+		if (!reading && Date.now() >= next) {
+			next = Date.now() + intervalMs;
+			reading = refresh(flight).finally(() => {
+				reading = void 0;
+			});
+		}
+		await reading;
+		if (active !== flight || flight.signal.aborted) return [];
+		return accepted(flight.current()).flatMap((item) => {
+			const value = observations.get(item.workId);
+			return value && value.revision === item.sessionAssembly?.revision ? [value] : [];
+		});
+	}
+	return {
+		start,
+		read
+	};
 }
 //#endregion
 //#region apps/cli/src/account/journey/send.ts
@@ -9583,7 +10621,9 @@ function createJourneySender(dependencies, phases = 3, host = {
 	const pendingElsewhere = (send) => !host.serving && send?.request !== void 0 && !send.confirmedAt;
 	const progress = /* @__PURE__ */ new Map();
 	let packagingRetry;
+	const observer = createUploadObserver();
 	const sessionFacts = createSessionFactsCache();
+	const poll = createAssessmentPoll();
 	const running = /* @__PURE__ */ new Map();
 	const runKey = (address) => `${address.journeyId}:${address.sendId}`;
 	const load = async (address) => {
@@ -9593,12 +10633,14 @@ function createJourneySender(dependencies, phases = 3, host = {
 		return latest;
 	};
 	const sender = {
+		uploadAssessments: observer.read,
 		scopeValid(snapshot) {
 			return !snapshot.send || (snapshot.send.request && !snapshot.send.confirmedAt ? requestMatches(snapshot.send, snapshot.journey) : scopeDigest(snapshot.journey) === snapshot.send.scopeDigest);
 		},
 		request: (input, source = "conversation") => requestSend(dependencies, input, hostId, source),
 		async get(address) {
-			const snapshot = await dependencies.storage.loadSend(address.journeyId, address.sendId);
+			const snapshot = await dependencies.storage.loadSend(address.journeyId, address.sendId, address.observedRevision);
+			if (!snapshot && address.observedRevision !== void 0) return null;
 			sessionFacts.retain(address.journeyId, snapshot?.send ?? null);
 			if (host.serving && !address.sendId && snapshot?.send?.request && !snapshot.send.confirmedAt && snapshot.send.status !== "blocked") {
 				const error = await requestError(dependencies, snapshot.send, hostId, new AbortController().signal);
@@ -9626,6 +10668,18 @@ function createJourneySender(dependencies, phases = 3, host = {
 				}
 			};
 		},
+		/** Link for the current native Send's authenticated owner, independent of Work assessment. */
+		async ownedPassport(address, signal) {
+			const { send } = await load(address);
+			if (!send.confirmedAt || send.status !== "completed" || !send.subject || !send.items.length || !send.items.every((item) => item.sessionAssembly)) throw new ApplicationError("INVALID_TRANSITION");
+			const connection = await dependencies.auth.connect(signal);
+			if (!connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
+			if (connection.subject !== send.subject) throw new ApplicationError("IDENTITY_REJECTED");
+			const url = await connection.ownedPassport(signal);
+			await load(address);
+			await connection.assertCurrent(signal);
+			return { url };
+		},
 		/** The owner's current address, links and account email; null while signed out. */
 		async ownerProfile(signal) {
 			const connection = await dependencies.auth.connect(signal);
@@ -9656,8 +10710,12 @@ function createJourneySender(dependencies, phases = 3, host = {
 			if (!connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
 			if (latest.send.subject !== connection.subject) throw new ApplicationError("IDENTITY_REJECTED");
 			try {
-				const current = await connection.readProfile(signal);
-				await connection.saveProfile(mergeOwnerProfile(current.profile, chosen), signal);
+				const remote = guardSendRemote(connection, {
+					...latest,
+					item: null
+				});
+				const current = await remote.readProfile(signal);
+				await remote.saveProfile(mergeOwnerProfile(current.profile, chosen), signal);
 			} catch (error) {
 				if (signal.aborted || error instanceof ApplicationError) throw error;
 				const code = error instanceof JourneyRemoteError && error.status === 409 ? addressRefusals[error.code] : void 0;
@@ -9708,10 +10766,12 @@ function createJourneySender(dependencies, phases = 3, host = {
 					try {
 						const conflicts = inventory ? await sessionAccessBlocked(dependencies, input.journeyId, draft.items, inventory, signal) : [];
 						for (const item of draft.items) {
-							const conflict = conflicts.find((entry) => entry.workId === item.workId && entry.accountAccess !== null) ?? conflicts.find((entry) => entry.workId === item.workId);
+							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
 							if (conflict) {
 								const { workId: _, ...accessConflict } = conflict;
 								item.accessConflict = accessConflict;
+								item.accessConflictSessionCount = new Set(itemConflicts.map((entry) => entry.sessionKey)).size;
 							}
 						}
 					} catch (error) {
@@ -9719,7 +10779,12 @@ function createJourneySender(dependencies, phases = 3, host = {
 					}
 					for (const item of inventory && recover && snapshot.send ? draft.items : []) {
 						const current = inventory?.works.find((work) => work.logicalWorkId === item.workId);
-						const assembly = await remote.assembly(item.workId, signal);
+						const earlier = snapshot.send?.items.find((value) => value.workId === item.workId);
+						const assembly = await guardSendRemote(connection, {
+							journey: snapshot.journey,
+							send: snapshot.send,
+							item: earlier ?? item
+						}).sessions?.assembly(item.workId, signal);
 						const selected = createSessionKeys();
 						for await (const session of sessions(input.journeyId, item.artifact, signal)) await selected.add(session);
 						const currentKeys = current?.sessions.map((session) => session.key) ?? [];
@@ -9735,8 +10800,11 @@ function createJourneySender(dependencies, phases = 3, host = {
 				}
 			}
 			for (const item of observed ? [] : draft.items) {
-				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access)?.accessConflict;
-				if (previous && !item.accessConflict) item.accessConflict = previous;
+				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access);
+				if (previous?.accessConflict && !item.accessConflict) {
+					item.accessConflict = previous.accessConflict;
+					item.accessConflictSessionCount = previous.accessConflictSessionCount;
+				}
 			}
 			const canReuseExistingSend = !(snapshot.send?.confirmedAt && ["blocked", "paused"].includes(snapshot.send.status)) && !recover && snapshot.send && scopeDigest(snapshot.journey) === snapshot.send.scopeDigest && snapshot.send.subject === draft.subject;
 			const next = pending ? {
@@ -9792,7 +10860,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 				error: null
 			};
 			if (connection) try {
-				profile = await prepareProfile(dependencies, snapshot, connection, signal);
+				profile = await prepareProfile(dependencies, snapshot, guardSendRemote(connection, {
+					...snapshot,
+					item: null
+				}), signal);
 			} catch (error) {
 				if (error instanceof ApplicationError && error.code === "REVISION_CONFLICT") return saveStart(snapshot.send);
 				throw error;
@@ -9868,6 +10939,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const stop = new AbortController();
 			const transferDependencies = {
 				...dependencies,
+				...host.serving ? { observeUpload: observer.start } : {},
 				sessionTransfer: (workId, transfer) => {
 					progress.set(`${key}:${workId}`, transfer);
 					dependencies.sessionTransfer?.(workId, transfer);
@@ -9876,7 +10948,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const lifetime = AbortSignal.any([signal, stop.signal]);
 			const result = (async () => {
 				const currentSnapshot = await dependencies.storage.loadSend(address.journeyId);
-				if (!currentSnapshot?.send) return advanceWork(transferDependencies, address, lifetime, phases, sessionFacts);
+				if (!currentSnapshot?.send) return advanceWork(transferDependencies, address, lifetime, phases, sessionFacts, poll);
 				let snapshot = requireSend(currentSnapshot);
 				if (snapshot.send.id !== address.sendId) return {
 					...snapshot,
@@ -9886,7 +10958,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 					...snapshot,
 					status: "applied"
 				};
-				if (!host.serving && hostDrives(snapshot.send) && await host.focused?.(address.journeyId)) return {
+				if (!host.serving && hostDrives(snapshot.journey, snapshot.send) && await host.focused?.(address.journeyId)) return {
 					...snapshot,
 					status: "applied"
 				};
@@ -9982,7 +11054,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 						confirmedOmittedWorkIds: snapshot.send.omitted.map((item) => item.workId)
 					}, lifetime);
 				}
-				return advanceWork(transferDependencies, address, lifetime, phases, sessionFacts);
+				return advanceWork(transferDependencies, address, lifetime, phases, sessionFacts, poll);
 			})().catch(async (error) => {
 				if (!stop.signal.aborted || signal.aborted) throw error;
 				return {
@@ -10079,6 +11151,7 @@ function createJourneySendAuth(account, requestFetch) {
 			if (verified.identityId !== credential.identityId) throw new ApplicationError("IDENTITY_REJECTED");
 			return createJourneyOwnerClient({
 				apiUrl: account.configuration.passportApiUrl,
+				...account.configuration.passportWebOrigin ? { webOrigin: account.configuration.passportWebOrigin } : {},
 				subject: verified.identityId,
 				fetch: ownerFetch,
 				async authorize() {
@@ -10093,6 +11166,27 @@ function createJourneySendAuth(account, requestFetch) {
 }
 //#endregion
 //#region apps/cli/src/account/journey/account-access.ts
+/**
+* Whole scope-confirm account read: identity, every inventory page and a token refresh. A 203-Work,
+* 1,400-session account took 2.3 to 3.4 s for its pages plus a refresh, past the earlier 5 s
+* (issue #53). On expiry the read is `unavailable` (ADR 0277 section 5).
+*/
+const accountReadBoundMs = 3e4;
+const ownerBodyErrors = /* @__PURE__ */ new Set(["OWNER_EMPTY_RESPONSE", "OWNER_RESPONSE_LIMIT"]);
+/** Why the read failed, from error types and codes only; messages are never logged. */
+function failureClass(error, depth = 0) {
+	if (!(error instanceof Error)) return "other";
+	if (error.name === "TimeoutError") return "timeout";
+	if (isCode(error, "ACCOUNT_SIGNED_OUT") || isCode(error, "IDENTITY_REJECTED")) return "signed-out";
+	if (error instanceof JourneyRemoteError) {
+		if (error.status === 401 || error.status === 403) return "signed-out";
+		return error.status >= 500 || error.status === 429 ? "network" : "protocol";
+	}
+	if (isCode(error, "IDENTITY_UNAVAILABLE") && isInterrupted(error.cause)) return failureClass(error.cause, 1);
+	if (isCode(error, "IDENTITY_UNAVAILABLE") || error instanceof SyntaxError || ownerBodyErrors.has(error.message)) return "protocol";
+	if (isInterrupted(error)) return "network";
+	return depth === 0 && error.cause !== void 0 ? failureClass(error.cause, 1) : "other";
+}
 /** Current and legacy upload keys of every part of one local session. */
 async function keysOf(session) {
 	const keys = [];
@@ -10146,9 +11240,13 @@ async function accountAccessForRoots(state, roots, inventory, members) {
 	}
 	return result;
 }
-/** Existing authenticated owner ports supply inventory; signed-out scope confirmation stays local. */
+/**
+* Existing authenticated owner ports supply inventory. The result is three-way (ADR 0277 section
+* 5): a caller stops on `signed-out` or `unavailable` instead of using model access.
+*/
 function createAccountAccess(storage, auth) {
 	return async (state, signal) => {
+		const started = Date.now();
 		const controller = new AbortController();
 		const boundedSignal = AbortSignal.any([signal, controller.signal]);
 		let timer;
@@ -10157,12 +11255,12 @@ function createAccountAccess(storage, auth) {
 			onAbort = () => reject(/* @__PURE__ */ new Error("ACCOUNT_ACCESS_CANCELLED"));
 			boundedSignal.addEventListener("abort", onAbort, { once: true });
 			if (boundedSignal.aborted) onAbort();
-			timer = setTimeout(() => controller.abort(), 5e3);
+			timer = setTimeout(() => controller.abort(), accountReadBoundMs);
 		});
 		const read = async () => {
 			boundedSignal.throwIfAborted();
 			const connection = await auth.connect(boundedSignal);
-			if (!connection?.sessions) return /* @__PURE__ */ new Map();
+			if (!connection?.sessions) return { status: "signed-out" };
 			const plan = (await storage.resources({
 				journeyId: state.journeyId,
 				kind: "plan"
@@ -10171,13 +11269,24 @@ function createAccountAccess(storage, auth) {
 			const inventory = await connection.sessions.inventory(boundedSignal);
 			const access = await accountAccessForRoots(state, plan.approval.inventory.sessions, inventory, reviewFamilies(plan.approval.inventory).members);
 			await connection.assertCurrent(boundedSignal);
-			return access;
+			return {
+				status: "read",
+				subject: connection.subject,
+				access
+			};
 		};
 		try {
 			return await Promise.race([read(), stopped]);
-		} catch {
-			console.error("ACCOUNT_ACCESS_UNAVAILABLE: using model access");
-			return /* @__PURE__ */ new Map();
+		} catch (error) {
+			if (error instanceof ApplicationError && ![
+				"ACCOUNT_SIGNED_OUT",
+				"IDENTITY_REJECTED",
+				"IDENTITY_UNAVAILABLE",
+				"CREDENTIAL_STORE_FAILED"
+			].includes(error.code)) throw error;
+			const reason = signal.aborted ? "cancelled" : controller.signal.aborted ? "timeout" : failureClass(error);
+			console.error(`ACCOUNT_ACCESS_UNAVAILABLE: account read failed (class=${reason} elapsedMs=${Date.now() - started})`);
+			return { status: reason === "signed-out" ? "signed-out" : "unavailable" };
 		} finally {
 			clearTimeout(timer);
 			boundedSignal.removeEventListener("abort", onAbort);
@@ -10965,8 +12074,10 @@ function createPassportConnection(options) {
 //#region apps/cli/src/account/index.ts
 /** Composes the concrete Identity client, credential file and backend check for the account. */
 function createAccountPorts(options) {
+	const webOrigin = passportWebOrigin(options.passportApiUrl, options.passportWebOrigin);
 	return {
 		configuration: {
+			...webOrigin ? { passportWebOrigin: webOrigin } : {},
 			identityUrl: options.identityUrl,
 			clientId: options.clientId,
 			passportApiUrl: options.passportApiUrl
@@ -11313,7 +12424,8 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 				code: safeCode(error),
 				at: (/* @__PURE__ */ new Date()).toISOString(),
 				stage,
-				...operationId ? { operationId } : {}
+				...operationId ? { operationId } : {},
+				...processingSite(error)
 			};
 			summary(diagnostic);
 			if (closed) {
@@ -11349,14 +12461,18 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 			}
 		},
 		onDiagnostic(diagnostic, error) {
-			summary(diagnostic);
+			const named = {
+				...diagnostic,
+				...processingSite(error)
+			};
+			summary(named);
 			if (closed) {
-				unavailable(diagnostic);
+				unavailable(named);
 				return;
 			}
 			try {
 				local.logger.error({
-					...diagnostic,
+					...named,
 					error: errorDetail(error)
 				});
 			} catch {
@@ -11815,6 +12931,7 @@ async function compose(options, callbacks, bundles) {
 			identityUrl: options.identityUrl,
 			clientId: options.identityClientId,
 			passportApiUrl: options.passportApiUrl,
+			...options.passportWebOrigin ? { passportWebOrigin: options.passportWebOrigin } : {},
 			onFatal: fatalStore.fail
 		});
 		const account = createAccount(accountPorts);
@@ -11872,6 +12989,13 @@ async function compose(options, callbacks, bundles) {
 			}),
 			journeyLocal: {
 				accountAccess,
+				async accountState() {
+					const view = await account.status();
+					return {
+						configured: view.configuration.clientId !== null,
+						subject: view.state === "signed-in" ? view.identityId : null
+					};
+				},
 				titles: createJourneyTitles(journeyStorage, processing),
 				describe: createJourneyDescription(journeyStorage, processing),
 				works: createJourneyWorks(journeyStorage, processing, stateDir, accountAccess),
@@ -12104,7 +13228,7 @@ const delivery = z.object({
 	output: z.string().min(1).max(4096)
 });
 /** `signal` carries the process's SIGINT/SIGTERM to long procedures such as journey.prepare. */
-async function invoke(runtime, command, value, signal) {
+async function invoke(runtime, command, value, signal, getAudience = "agent") {
 	const app = runtime.application;
 	markAgentPresence(runtime.stateDir, value);
 	switch (command) {
@@ -12115,15 +13239,37 @@ async function invoke(runtime, command, value, signal) {
 		case "send.start": return app.journeySend?.start(sendStartSchema.parse(value));
 		case "send.respond": return app.journeySend?.respond(sendChoiceSchema.parse(value));
 		case "send.pause": return app.journeySend?.pause(sendActionSchema.parse(value));
-		case "send.resume": return app.journeySend?.resume(sendActionSchema.parse(value));
-		case "send.advance": return app.journeySend?.advance(sendAddress.parse(value));
-		case "journey.start": return app.journey?.start(value);
-		case "journey.get": return app.journey?.get(value ?? {}, "agent");
+		case "send.resume": {
+			const input = sendActionSchema.parse(value);
+			const current = await runtime.store.journey?.current(input.journeyId);
+			await fenceUnapprovedSendHost(runtime.stateDir, current);
+			return app.journeySend?.resume(input);
+		}
+		case "send.advance": {
+			const input = sendAddress.parse(value);
+			const current = await runtime.store.journey?.current(input.journeyId);
+			await fenceUnapprovedSendHost(runtime.stateDir, current);
+			return app.journeySend?.advance(input);
+		}
+		case "journey.start": {
+			const input = nativeStartSchema.parse(value);
+			const current = await runtime.store.journey?.current();
+			await fenceUnapprovedSendHost(runtime.stateDir, current);
+			if (current && obsoleteJourney(current)) await relinquishObsoleteHost(runtime.stateDir, current.journeyId);
+			return app.journey?.start(input);
+		}
+		case "journey.get": {
+			const result = await app.journey?.get(value ?? {}, getAudience);
+			await fenceUnapprovedSendHost(runtime.stateDir, result);
+			if (result?.obsolete) await relinquishObsoleteHost(runtime.stateDir, result.journeyId);
+			return result;
+		}
 		case "journey.groupItems": return app.journey?.groupItems(value);
 		case "journey.inventory": return app.journey?.inventory(value);
 		case "journey.classificationSessions": return app.journey?.classificationSessions(value);
 		case "journey.classificationProgress": return app.journey?.classificationProgress(value);
 		case "journey.classificationRead": return app.journey?.classificationRead(value);
+		case "journey.recoverIsolatedMetadata": return app.journey?.recoverIsolatedMetadata(value, signal);
 		case "journey.classificationSubmit": return app.journey?.classificationSubmit(value);
 		case "journey.cardsRead": return app.journey?.cardsRead(value);
 		case "journey.cardsSubmit": return app.journey?.cardsSubmit(value);
@@ -12143,7 +13289,14 @@ async function invoke(runtime, command, value, signal) {
 		case "journey.findingImpact": return app.journey?.findingImpact(value);
 		case "journey.preview": return app.journey?.preview(value);
 		case "journey.files": return app.journey?.files(value);
-		case "journey.prepare": return app.journey?.prepare(value, signal);
+		case "journey.prepare": {
+			const input = z.object({
+				journeyId: z.uuid(),
+				result: z.literal("receipt").optional()
+			}).strict().parse(value);
+			return input.result === "receipt" ? app.journey?.prepareReceipt({ journeyId: input.journeyId }, signal) : app.journey?.prepare({ journeyId: input.journeyId }, signal);
+		}
+		case "review.reopenEmpty": return app.journey?.reopenEmpty(value);
 		case "review.terms": return app.journey?.terms(value);
 		case "review.status": return app.journey?.reviewStatus(value);
 		case "review.guidance": return app.journey?.guidance(value);
@@ -12343,4 +13496,4 @@ async function cancelOperation(runtime, id) {
 	return readOperation(runtime, id);
 }
 //#endregion
-export { longCommands as _, readAgentPresence as a, traceStartup as b, executorRequestSchema as c, serveDetached as d, guardDetachedStartup as f, businessCommands as g, parseOptions as h, invoke as i, awaitingPassport as l, helpText as m, readOperation as n, createRuntime as o, createRenderActivity as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, hostDrives as u, permissionDiagnostic as v, startupFailure as y };
+export { permissionDiagnostic as _, readAgentPresence as a, executorRequestSchema as c, packageIdentity as d, createRenderActivity as f, longCommands as g, businessCommands as h, invoke as i, serveDetached as l, parseOptions as m, readOperation as n, createRuntime as o, helpText as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, guardDetachedStartup as u, startupFailure as v, traceStartup as y };