@gitroll/tacitt-cli 0.6.11 → 0.6.13

package/dist/{src-DlVbGB32.mjs → src-CP-K2PBv.mjs}

@@ -1,6 +1,6 @@
-import { $n as buildPlan, An as createDetectionSummary, Bn as cleanupImplementationVersion, C as createBAnalysisUnits, Cn as reviewRoles, Dn as bindInspection, En as createSessionPreparation, Gn as nativeField, Hn as nativeParserVersion, In as createReplacementKey, Jn as transformRecords, Kn as nativeItems, Ln as sessionNonce, Mn as walkNativeFields, N as bDuplicateShift, Rn as projectNativeRecord, Sn as mainReviewRole, Tn as renderNative, U as bDigest, Un as redactionImplementationVersion, Vn as entityDictionaryVersion, W as codePointLength, Xn as retainedMainTextNodes, Yn as frameRecords, Zn as validateProfile, ar as detectStatic, bn as processNativeRecord, br as processingSite, c as reviewDigest, cn as reviewFamilies, cr as jsonSpans, er as validatePlan, fn as sourceSnapshotId, gr as ProcessingError, hr as defaultDetectionLimits, in as safeCode, ir as resolveLimits, j as bBindingCap, lr as agentContextLocation, nn as ApplicationError, nr as defaultLimits, qn as nativeText, rr as recordPointerLimits, sn as familySelected, u as textDigest, un as sourceKey, ur as createEntityMatcher, vn as nativeSourceIdentitySchema, vr as fail$1, wn as createSentenceContext, xn as projectNativeReviewInput, xr as siteFields, yn as withMandatoryCustomTerms, yr as isProcessingCode, zn as parseNativeRecord } from "./locate-Cx52Zqxv.mjs";
-import { t as createZstdFrameCheck } from "./frame-Bq2zRh-i.mjs";
-import { Jr as agentSourceSchema, L as sourceIdentityEvidence, Pn as resolveSourceSelection, R as withSourceEvidence, _i as sourceChangePolicy, jt as metadataProcessingVersion, nr as bContainment, or as bWordBounded, ot as classifyAgentSetup, qr as agentSourcePathSegment, rr as bExceptionRanges, st as defaultAgentSetupInclusion, wi as staticCatalogRef, yi as approvedTreatmentSchema, z as agentSetupKey } from "./src-D1iONla3.mjs";
+import { $n as validateProfile, Bn as projectNativeRecord, Cn as projectNativeReviewInput, Cr as siteFields, D as bBindingCap, Dn as renderNative, En as createSentenceContext, Gn as redactionImplementationVersion, Hn as cleanupImplementationVersion, Jn as nativeItems, Mn as createDetectionSummary, On as createSessionPreparation, Pn as walkNativeFields, Qn as retainedMainTextNodes, Rn as createReplacementKey, Sn as processNativeRecord, Sr as processingSite, Tn as reviewRoles, Un as entityDictionaryVersion, Vn as parseNativeRecord, Wn as nativeParserVersion, X as bDigest, Xn as transformRecords, Yn as nativeText, Z as codePointLength, Zn as frameRecords, _r as defaultDetectionLimits, ar as recordPointerLimits, bn as nativeSourceIdentitySchema, br as fail$1, dr as agentContextLocation, f as textDigest, fn as sourceKey, fr as createEntityMatcher, in as ApplicationError, ir as defaultLimits, k as bDuplicateShift, kn as bindInspection, ln as familySelected, mn as sourceSnapshotId, nr as validatePlan, on as safeCode, or as resolveLimits, qn as nativeField, sr as detectStatic, tr as buildPlan, u as reviewDigest, un as reviewFamilies, ur as jsonSpans, vr as ProcessingError, w as createBAnalysisUnits, wn as mainReviewRole, xn as withMandatoryCustomTerms, xr as isProcessingCode, zn as sessionNonce } from "./locate-PLEyLYW-.mjs";
+import { t as createZstdFrameCheck } from "./frame-BPbypzmt.mjs";
+import { Bi as staticCatalogRef, Br as metadataProcessingVersion, Fi as approvedTreatmentSchema, Jr as agentSourceSchema, L as sourceIdentityEvidence, Mn as resolveSourceSelection, Ni as sourceChangePolicy, R as withSourceEvidence, Ti as replacementMarkerPattern, bi as bContainment, ot as classifyAgentSetup, qr as agentSourcePathSegment, st as defaultAgentSetupInclusion, wi as bWordBounded, xi as bExceptionRanges, z as agentSetupKey } from "./src-CttNuxOn.mjs";
 import { constants } from "node:fs";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, stat, unlink } from "node:fs/promises";
 import { execFile, fork, spawn } from "node:child_process";
@@ -11,11 +11,11 @@ import { Readable } from "node:stream";
 import { TextDecoder as TextDecoder$1, isDeepStrictEqual, promisify } from "node:util";
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import { setImmediate } from "node:timers/promises";
-import { ERR_UNSUPPORTED_FORMAT, Reader, TextReader, ZipReader, ZipWriter, configure } from "@zip.js/zip.js/index-native.js";
+import { ERR_UNSUPPORTED_FORMAT, Reader, TextReader, Uint8ArrayReader, ZipReader, ZipWriter, configure } from "@zip.js/zip.js/index-native.js";
 import "node:perf_hooks";
 import { availableParallelism, platform, tmpdir, totalmem } from "node:os";
 import { pipeline } from "node:stream/promises";
-import { constants as constants$1, crc32, createZstdDecompress } from "node:zlib";
+import { constants as constants$2, crc32, createZstdDecompress } from "node:zlib";
 import { parse } from "@decimalturn/toml-patch";
 //#region packages/file-privacy/src/windows/descriptor.ts
 const system = "S-1-5-18";
@@ -1874,11 +1874,11 @@ function description(value) {
 		sha256
 	};
 }
-function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summary) {
-	const manifest = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+function checkWorkspaceManifest(source, entries, bundleId, expectedPathHash, summary) {
+	const manifest = record$1(typeof source === "string" ? strictJson(source, manifestLimitBytes, manifestNodeLimit) : source);
 	const treatment = manifest["contentTreatment"];
 	const configured = treatment === "configured";
-	const configuredManifest = configured ? parseConfiguredManifest(text) : null;
+	const configuredManifest = typeof source !== "string" ? source : configured ? parseConfiguredManifest(source) : null;
 	if (configuredManifest) validateConfiguredManifest(configuredManifest);
 	const sourceWorkspaces = configuredManifest?.sourceWorkspaces ?? [record$1(manifest["workspace"])];
 	const workspaceIds = new Set(sourceWorkspaces.map((workspace) => string(workspace["id"])));
@@ -2443,7 +2443,7 @@ function parseAuditRow(value, sourceId, sourceSha256, ordinal) {
 		diagnostics
 	};
 }
-const location$1 = (pointer, subject) => `${subject}:${pointer}`;
+const location$2 = (pointer, subject) => `${subject}:${pointer}`;
 const child = (pointer, key) => `${pointer}/${String(key).replaceAll("~", "~0").replaceAll("/", "~1")}`;
 function outputLocations(text, signal) {
 	let root;
@@ -2462,7 +2462,7 @@ function outputLocations(text, signal) {
 	let bytes = 0;
 	function visit(node, pointer, subject) {
 		checkAbort(signal);
-		const key = location$1(pointer, subject);
+		const key = location$2(pointer, subject);
 		bytes += Buffer.byteLength(key);
 		if (bytes > maximumBytes) fail("ARTIFACT_INVALID_ARCHIVE");
 		locations.set(key, node);
@@ -2491,7 +2491,7 @@ function verifyCompanion(row, outputText, signal) {
 		if (!field.fieldId.startsWith(`${row.recordId}-f`) || match === null || Number(match[1]) >= maximumEntries || match[2] !== void 0 && Number(match[2]) >= maximumEntries || fields.has(field.fieldId)) fail("ARTIFACT_INVALID_ARCHIVE");
 		if (match?.[2] === void 0 && match?.[3] === void 0) originals.add(Number(match?.[1]));
 		if (field.pointer !== null) {
-			const key = location$1(field.pointer, field.subject);
+			const key = location$2(field.pointer, field.subject);
 			if (!locations.has(key) || referenced.has(key)) fail("ARTIFACT_INVALID_ARCHIVE");
 			referenced.add(key);
 		}
@@ -2505,7 +2505,7 @@ function verifyCompanion(row, outputText, signal) {
 		if (marker === null) continue;
 		const baseId = field.fieldId.replace(/-s\d+$|-k$/u, "");
 		const base = fields.get(baseId);
-		if (!sampled.has(baseId) || base === void 0 || field.subject !== "value" || (base.pointer === null ? field.pointer !== null : field.pointer !== (marker[2] === "k" ? child(base.pointer, "skeleton") : child(child(base.pointer, "segments"), marker[1] ?? "")) || locations.get(location$1(field.pointer, field.subject))?.kind !== "string")) fail("ARTIFACT_INVALID_ARCHIVE");
+		if (!sampled.has(baseId) || base === void 0 || field.subject !== "value" || (base.pointer === null ? field.pointer !== null : field.pointer !== (marker[2] === "k" ? child(base.pointer, "skeleton") : child(child(base.pointer, "segments"), marker[1] ?? "")) || locations.get(location$2(field.pointer, field.subject))?.kind !== "string")) fail("ARTIFACT_INVALID_ARCHIVE");
 	}
 	const synthetic = sampleLocations(row.bodies, fields, locations);
 	for (const key of locations.keys()) if (!referenced.has(key) && !synthetic.has(key)) fail("ARTIFACT_INVALID_ARCHIVE");
@@ -2643,37 +2643,31 @@ async function verifyConfiguredPart(part, entries, descriptions, signal) {
 //#endregion
 //#region packages/artifact/src/read/configured/workspace.ts
 /** Public primary facts are parsed independently; no source file is opened. */
-function workspaceSummary(text) {
-	const manifest = record$1(parseConfiguredManifest(text));
-	if (manifest["contentTreatment"] !== "configured" || manifest["formatVersion"] !== 5 || manifest["companionVersion"] !== 3) return fail("ARTIFACT_INVALID_MANIFEST");
+function workspaceSummary(input) {
+	const manifest = typeof input === "string" ? parseConfiguredManifest(input) : input;
 	return {
 		format: "sess-pilot-workspace-summary",
 		formatVersion: 1,
-		bundleId: string(manifest["bundleId"]),
-		counts: parseCounts(manifest["counts"]),
-		sessions: array(manifest["sessions"], (value) => {
-			const session = record$1(value);
-			const harness = session["harness"];
-			if (harness !== "claude" && harness !== "codex") return fail("ARTIFACT_INVALID_MANIFEST");
-			return {
-				sessionId: string(session["id"]),
-				scopeOrdinal: 0,
-				harness,
-				nativeSessionId: nullableString(session["sourceSessionId"]),
-				treatmentId: string(session["treatmentId"]),
-				sources: array(session["parts"], parseConfiguredPart).map((part, sourceOrdinal) => ({
-					sourceId: part.sourceId,
-					sourceOrdinal,
-					native: part.native
-				}))
-			};
-		})
+		bundleId: manifest.bundleId,
+		counts: manifest.counts,
+		sessions: manifest.sessions.map((session) => ({
+			sessionId: session.id,
+			scopeOrdinal: 0,
+			harness: session.harness,
+			nativeSessionId: session.sourceSessionId,
+			treatmentId: session.treatmentId,
+			sources: session.parts.map((part, sourceOrdinal) => ({
+				sourceId: part.sourceId,
+				sourceOrdinal,
+				native: part.native
+			}))
+		}))
 	};
 }
 /** Validate exact primary coverage and metadata before either native-data consumer runs. */
 async function readPrimaryMetadata(primaryEntries, primaryText, signal, only) {
-	const summary = workspaceSummary(primaryText);
 	const manifest = parseConfiguredManifest(primaryText);
+	const summary = workspaceSummary(manifest);
 	checkWorkspaceManifest(primaryText, primaryEntries, summary.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, summary);
 	for (const description of manifest.entries) {
 		checkAbort(signal);
@@ -2793,7 +2787,7 @@ async function* decodeZstd(source, signal) {
 	});
 	const decoded = createZstdDecompress({
 		chunkSize: sourceChunkBytes,
-		params: { [constants$1.ZSTD_d_windowLogMax]: 26 }
+		params: { [constants$2.ZSTD_d_windowLogMax]: 26 }
 	});
 	const cancellation = new AbortController();
 	const completion = pipeline(input, decoded, { signal: AbortSignal.any([signal, cancellation.signal]) }).then(() => void 0, (error) => error);
@@ -3251,7 +3245,11 @@ async function inspectInput(input, part, adapter, signal, overrides, complete =
 		checkNativeEvidence(part, identity);
 		return identity;
 	} catch (error) {
-		const failure = readingRecords ? recordError(error, part.id, records, signal) : error;
+		const named = complete && error instanceof ProcessingError && error.code === "PROCESSING_INVALID_RECORD" ? new ProcessingError(error.code, {
+			cause: error,
+			site: "captured-source-invalid-record"
+		}) : error;
+		const failure = readingRecords ? recordError(named, part.id, records, signal) : named;
 		cleanup.failed(failure);
 		if (signal.aborted) fail("ARTIFACT_ABORTED", { cause: failure });
 		throw failure;
@@ -3269,7 +3267,7 @@ async function inspectSourceIdentity(part, adapter, signal, overrides, observe)
 async function inspectCapturedSourceIdentity(part, captured, adapter, signal, overrides) {
 	return inspectInput(await openCapturedConfiguredSource(part, captured, signal), part, adapter, signal, overrides);
 }
-/** Ancestor publication waits for identity accumulated over every fixed captured record. */
+/** Frozen admission and ancestor publication use identity from every captured record. */
 async function inspectCompleteCapturedSourceIdentity(part, captured, adapter, signal, overrides, observe) {
 	return inspectInput(await openCapturedConfiguredSource(part, captured, signal), part, adapter, signal, overrides, true, observe);
 }
@@ -5588,17 +5586,20 @@ function matchFrozenOutput(input, checked) {
 	if (input.sha256 !== checked.sha256 || input.archiveBytes !== checked.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
 }
 async function checkFrozenOutput(input, signal) {
-	let manifestText = "";
+	let verified;
 	const checked = await checkWrittenArchive(input.path, input.identity, void 0, (text, entries) => {
 		const manifest = parseConfiguredManifest(text);
-		checkWorkspaceManifest(text, entries, manifest.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, workspaceSummary(text));
-		manifestText = text;
+		checkWorkspaceManifest(manifest, entries, manifest.bundleId, manifest.sourceWorkspaces.length === 1 ? manifest.sourceWorkspaces[0]?.pathHash ?? null : null, workspaceSummary(manifest));
+		verified = {
+			manifestText: text,
+			manifest
+		};
 	}, signal);
 	matchFrozenOutput(input, checked);
+	if (!verified) return fail("ARTIFACT_INVALID_MANIFEST");
 	return {
 		checked,
-		manifestText,
-		manifest: parseConfiguredManifest(manifestText)
+		...verified
 	};
 }
 /** Hold the exact verified descriptor; every entry is separately hashed before use. */
@@ -5711,13 +5712,6 @@ function addMaskSummary(a, b) {
 	return result;
 }
 //#endregion
-//#region packages/processing/src/session/marker.ts
-/**
-* One complete replacement marker as bindings and semantic markers write it. Group 1 names the
-* static method, or `semantic` for an AI-review span. Dependency-free so the browser can use it.
-*/
-const replacementMarkerPattern = /\[sp_[a-z0-9]{8,48}_([a-z][a-z0-9_]{0,47})_[a-f0-9]{24,64}\]/gu;
-//#endregion
 //#region packages/artifact/src/configured/output/spans.ts
 function scalarBoundary(text, offset) {
 	if (offset === 0 || offset === text.length) return true;
@@ -5803,6 +5797,9 @@ function indexOutputEdits(manifest, edits) {
 	}
 	return rows;
 }
+function rejectSemanticMarkerPrefix(text, markers) {
+	if (text.includes(markers.prefix)) fail("ARTIFACT_PROCESSING_MISMATCH");
+}
 /** Parse/walk even unchanged records so native call/result state stays in source order. */
 function createOutputRowEditor(adapter, part, edits, markers, signal, onApplied) {
 	const options = {
@@ -5826,7 +5823,7 @@ function createOutputRowEditor(adapter, part, edits, markers, signal, onApplied)
 			limits: recordLimits,
 			signal
 		})) {
-			if (field.text.includes(markers.prefix)) fail("ARTIFACT_PROCESSING_MISMATCH");
+			rejectSemanticMarkerPrefix(field.text, markers);
 			if (field.subject !== "value") continue;
 			const edit = pending.get(field.pointer);
 			if (!edit) continue;
@@ -5897,1182 +5894,1504 @@ function maskOutputField(field, spans, markers, evidence, onApplied) {
 	return changed;
 }
 //#endregion
-//#region packages/artifact/src/collection/identity-map.ts
-const maximumBundleIdentityMapBytes = 8388608;
-const maximumLocatorBytes = 16384;
-const maximumRemotes = 4096;
-const uuid$2 = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/;
-const digest$3 = /^[a-f0-9]{64}$/;
-function validBundleId(bundleId) {
-	if (!uuid$2.test(bundleId)) fail("ARTIFACT_INVALID_MANIFEST");
-}
-function boundedLocator(value) {
-	const result = string(value);
-	if (Buffer.byteLength(result) > maximumLocatorBytes) fail("ARTIFACT_METADATA_LIMIT");
-	return result;
-}
-function boundedHash(value) {
-	const result = string(value);
-	if (!digest$3.test(result)) fail("ARTIFACT_INVALID_MANIFEST");
-	return result;
-}
-function parseIdentityMap(value) {
-	const input = record$1(value);
-	keys(input, [
-		"format",
-		"formatVersion",
-		"bundleId",
-		"workspace"
-	]);
-	const bundleId = string(input["bundleId"]);
-	validBundleId(bundleId);
-	const workspace = record$1(input["workspace"]);
-	keys(workspace, [
-		"path",
-		"pathHash",
-		"remotes",
-		"primaryRemoteHash"
-	]);
-	const path = workspace["path"] === null ? null : boundedLocator(workspace["path"]);
-	const pathHash = workspace["pathHash"] === null ? null : boundedHash(workspace["pathHash"]);
-	if (path === null !== (pathHash === null)) fail("ARTIFACT_INVALID_MANIFEST");
-	const rawRemotes = workspace["remotes"];
-	if (!Array.isArray(rawRemotes)) return fail("ARTIFACT_INVALID_MANIFEST");
-	if (rawRemotes.length > maximumRemotes) fail("ARTIFACT_METADATA_LIMIT");
-	const remotes = rawRemotes.map((entry) => {
-		const remote = record$1(entry);
-		keys(remote, ["url", "hash"]);
-		return {
-			url: boundedLocator(remote["url"]),
-			hash: boundedHash(remote["hash"])
-		};
-	});
-	const primaryRemoteHash = nullableString(workspace["primaryRemoteHash"]);
-	if (primaryRemoteHash !== null) {
-		if (!digest$3.test(primaryRemoteHash) || !remotes.some((remote) => remote.hash === primaryRemoteHash)) fail("ARTIFACT_INVALID_MANIFEST");
+//#region packages/artifact/src/configured/output/family-carrier.ts
+/** Map decoded UTF-16 boundaries to complete JSON escape tokens in the original string. */
+function boundaries(text, span, value) {
+	const offsets = [span.start + 1];
+	let cursor = span.start + 1;
+	while (cursor < span.end - 1) {
+		cursor += text[cursor] === "\\" ? text[cursor + 1] === "u" ? 6 : 2 : 1;
+		offsets.push(cursor);
 	}
-	return {
-		format: literal(input["format"], "sess-pilot-bundle-identity-map"),
-		formatVersion: literal(input["formatVersion"], 1),
-		bundleId,
-		workspace: {
-			path,
-			pathHash,
-			remotes,
-			primaryRemoteHash
-		}
-	};
-}
-function encoded(map) {
-	const text = `${JSON.stringify(map)}\n`;
-	if (Buffer.byteLength(text) > 8388608) fail("ARTIFACT_METADATA_LIMIT");
-	return text;
-}
-function sameFileVersion$2(left, right) {
-	return right.isFile() && left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
-}
-async function identityDirectory(root) {
-	const directory = join(root, "identity");
-	if (await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	}) !== void 0 && process.platform === "win32") await restrictToOwner(directory, "directory");
-	const stat = await lstat(directory, { bigint: true });
-	const uid = process.getuid?.();
-	if (!stat.isDirectory() || (process.platform === "win32" ? !await windowsOwnerOnly(directory, "directory") : uid === void 0 || stat.uid !== BigInt(uid) || (stat.mode & 63n) !== 0n) || await realpath(directory) !== directory) fail("ARTIFACT_OUTPUT_UNSAFE");
-	return directory;
+	if (cursor !== span.end - 1 || offsets.length !== value.length + 1) fail("ARTIFACT_PROCESSING_MISMATCH");
+	return offsets;
 }
-/** Missing maps are recoverable from a current approval; malformed maps are not silently trusted. */
-async function readBundleIdentityMap(root, bundleId) {
-	validBundleId(bundleId);
-	const directory = await identityDirectory(root);
-	const path = join(directory, `b-${bundleId}.json`);
-	let before;
+/** One harness-declared JSON carrier layer; never interpret ordinary strings recursively. */
+function familyCarrierSpans(field, find, signal) {
+	const text = field.text;
+	if (![
+		"tool-call",
+		"tool-result",
+		"runtime"
+	].includes(field.origin.carrier) || !/^\s*[[{]/u.test(text)) return void 0;
 	try {
-		before = await lstat(path, { bigint: true });
+		parseNativeRecord(text, limits, signal);
 	} catch (error) {
-		if (filesystemCode(error) === "ENOENT") return null;
+		if (error instanceof ProcessingError && ["PROCESSING_INVALID_RECORD", "PROCESSING_KEY_COLLISION"].includes(error.code)) return void 0;
 		throw error;
 	}
-	const uid = process.getuid?.();
-	if (!before.isFile() || (process.platform === "win32" ? !await windowsOwnerOnly(path, "file") : uid === void 0 || before.uid !== BigInt(uid) || (before.mode & 63n) !== 0n)) fail("ARTIFACT_OUTPUT_UNSAFE");
-	if (before.size > BigInt(8388608)) fail("ARTIFACT_METADATA_LIMIT");
-	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-	try {
-		const opened = await handle.stat({ bigint: true });
-		if (!sameFileVersion$2(before, opened)) fail("ARTIFACT_IDENTITY_MISMATCH");
-		const bytes = Buffer.alloc(Number(opened.size));
-		let offset = 0;
-		while (offset < bytes.length) {
-			const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
-			if (bytesRead === 0) fail("ARTIFACT_INVALID_MANIFEST");
-			offset += bytesRead;
+	const root = jsonSpans(text, signal) ?? fail("ARTIFACT_PROCESSING_MISMATCH");
+	const spans = [];
+	const visit = (part) => {
+		checkAbort(signal);
+		if (part.fields) for (const [key, value] of part.fields) {
+			visit(part.keys?.get(key) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
+			visit(value);
 		}
-		if (!sameFileVersion$2(opened, await handle.stat({ bigint: true })) || !sameFileVersion$2(opened, await lstat(path, { bigint: true }))) fail("ARTIFACT_IDENTITY_MISMATCH");
-		let text;
-		try {
-			text = new TextDecoder$1("utf-8", { fatal: true }).decode(bytes);
-		} catch (error) {
-			return fail("ARTIFACT_INVALID_MANIFEST", { cause: error });
+		else if (part.items) for (const item of part.items) visit(item);
+		else if (typeof part.value === "string") {
+			const matches = find(part.value);
+			if (!matches.length) return;
+			const offsets = boundaries(text, part, part.value);
+			for (const match of matches) {
+				const start = offsets[match.start] ?? fail("ARTIFACT_PROCESSING_MISMATCH");
+				const end = offsets[match.end] ?? fail("ARTIFACT_PROCESSING_MISMATCH");
+				spans.push({
+					...match,
+					start,
+					end
+				});
+			}
+		} else {
+			const value = text.slice(part.start, part.end);
+			for (const match of find(value)) spans.push({
+				...match,
+				start: part.start + match.start,
+				end: part.start + match.end,
+				jsonScalar: {
+					start: part.start,
+					end: part.end
+				}
+			});
 		}
-		const map = parseIdentityMap(strictJson(text, maximumBundleIdentityMapBytes, 5e4));
-		if (map.bundleId !== bundleId) fail("ARTIFACT_INVALID_MANIFEST");
-		return map;
-	} finally {
-		await handle.close();
-	}
+	};
+	visit(root);
+	return spans;
 }
-/** Publish before the corresponding ZIP; retained maps are never removed automatically. */
-async function writeBundleIdentityMap(root, map) {
-	const validated = parseIdentityMap(map);
-	const text = encoded(validated);
-	const directory = await identityDirectory(root);
-	await syncDirectory(root);
-	const finalPath = join(directory, `b-${validated.bundleId}.json`);
-	const existing = await readBundleIdentityMap(root, validated.bundleId);
-	if (existing) {
-		if (encoded(existing) !== text) fail("ARTIFACT_DESTINATION_EXISTS");
-		return;
-	}
-	const tempPath = join(directory, `.sess-pilot-b-${randomUUID()}.part`);
-	const handle = await openPrivateFile(tempPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
+/** Never publish a carrier whose edited keys collide or whose JSON structure changed. */
+function validateFamilyCarrier(text, signal) {
 	try {
-		const stat = await handle.stat({ bigint: true });
-		const uid = process.getuid?.();
-		if (!stat.isFile() || (process.platform === "win32" ? !await windowsOwnerOnly(tempPath, "file") : uid === void 0 || stat.uid !== BigInt(uid) || (stat.mode & 63n) !== 0n)) fail("ARTIFACT_OUTPUT_UNSAFE");
-		await handle.writeFile(text);
-		await handle.sync();
-		try {
-			await link(tempPath, finalPath);
-		} catch (error) {
-			if (filesystemCode(error) !== "EEXIST") throw error;
-			const raced = await readBundleIdentityMap(root, validated.bundleId);
-			if (!raced || encoded(raced) !== text) fail("ARTIFACT_DESTINATION_EXISTS");
-		}
-		await syncDirectory(directory);
-	} finally {
-		await handle.close();
-		await unlink(tempPath);
+		parseNativeRecord(text, limits, signal);
+	} catch (error) {
+		if (error instanceof ProcessingError && ["PROCESSING_INVALID_RECORD", "PROCESSING_KEY_COLLISION"].includes(error.code)) fail("ARTIFACT_PROCESSING_MISMATCH", { cause: error });
+		throw error;
 	}
 }
 //#endregion
-//#region packages/artifact/src/collection/identity/hash.ts
-/** Hash the private canonical path under an OS-installation namespace. */
-function hashWorkspacePath(normalizedPath, environmentId) {
-	if (!/^[0-9a-f]{64}$/.test(environmentId)) throw new Error("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
-	return createHash("sha256").update("sess-pilot-workspace-path-v2\0").update(environmentId).update("\0").update(normalizedPath).digest("hex");
-}
-/** Keep the installation identifier out of the distributable bundle. */
-function installationEnvironmentId(kind, installationId) {
-	if (!kind || !installationId) throw new Error("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
-	return createHash("sha256").update("sess-pilot-workspace-environment-v2\0").update(kind).update("\0").update(installationId).digest("hex");
-}
-//#endregion
-//#region packages/artifact/src/collection/identity/wsl.ts
-async function isWsl() {
-	try {
-		return /microsoft|wsl/i.test(await readFile("/proc/sys/kernel/osrelease", "utf8"));
-	} catch {
-		return false;
-	}
+//#region packages/artifact/src/configured/output/family.ts
+/** The same bounded categorized dictionary is shared by all final-generation family parts. */
+function confirmedFamily(terms, exceptions) {
+	const categories = new Map(terms.map(({ term, category }) => [term, maskCategory(category)]));
+	if (categories.size !== terms.length) mismatch("duplicate-term");
+	const bounded = new Set(categories.keys());
+	return {
+		matcher: createEntityMatcher([...categories.keys()].map((value) => ({
+			kind: "custom-term",
+			value
+		}))),
+		categories,
+		bounded,
+		toolResultEscapes: bounded,
+		excepted: bExceptionRanges(exceptions)
+	};
+}
+/** A masked title never grows past a Work label (240), the Send title limit being 300. */
+const titleLimit = 240;
+const titleMask = 8;
+/**
+* Name fields use exactly the confirmed card-Hide matcher, without tool carrier escapes. Many
+* short hidden words can make the masked title longer than the limit (#125); then the whole
+* title is one mask, never the raw text.
+*/
+function confirmedTitleSpans(text, family, signal = new AbortController().signal) {
+	const spans = familySpans(text, family, signal, false);
+	const masked = spans.reduce((length, span) => length - (span.end - span.start) + titleMask, text.length);
+	const [first] = spans;
+	return first && masked > titleLimit ? [{
+		start: 0,
+		end: text.length,
+		category: first.category
+	}] : spans;
 }
-//#endregion
-//#region packages/artifact/src/collection/identity/path.ts
-const execute$1 = promisify(execFile);
-const unavailable$1 = () => fail("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
-function pathPart(value) {
-	if (value.length === 0 || Buffer.byteLength(value, "utf8") > 16384 || Array.from(value).some((character) => {
-		const code = character.charCodeAt(0);
-		return code < 32 || code === 127;
-	})) return unavailable$1();
-	return value;
-}
-function wslUnc(path) {
-	const match = /^\\\\(?:wsl\.localhost|wsl\$)\\([^\\]+)(?:\\(.*))?$/i.exec(path);
-	if (!match) return null;
-	const distro = pathPart(match[1] ?? "").toLowerCase();
-	const remainder = (match[2] ?? "").replaceAll("\\", "/");
-	return `wsl:${encodeURIComponent(distro)}:${posix.normalize(`/${remainder}`)}`;
+/** Names the failed check in the private cause chain; it never carries session text. */
+const mismatch = (check) => fail("ARTIFACT_PROCESSING_MISMATCH", { cause: /* @__PURE__ */ new Error(`configured family hide check=${check}`) });
+/** Binds each family's main Hide literals to its main and worker data and metadata entries. */
+function indexFamilyHides(manifest, hides = []) {
+	const sessions = new Map(manifest.sessions.map((session) => [session.id, session]));
+	const parts = /* @__PURE__ */ new Map();
+	const bind = (id, family, main) => {
+		const session = sessions.get(id) ?? mismatch("unknown-session");
+		if (parts.has(session.metadataPath)) mismatch("duplicate-session");
+		if (session.parts.some((part) => part.native.role === "main") !== main) mismatch("session-role");
+		parts.set(session.metadataPath, family);
+		for (const part of session.parts) {
+			if (parts.has(part.dataPath)) mismatch("duplicate-part");
+			parts.set(part.dataPath, family);
+		}
+	};
+	const shared = /* @__PURE__ */ new Map();
+	for (const hide of hides) {
+		if (!hide.terms.length || !(hide.mainSessionIds.length + hide.workerSessionIds.length)) mismatch("empty-family");
+		const key = JSON.stringify([hide.terms, hide.exceptions ?? []]);
+		let family = shared.get(key);
+		if (!family) {
+			const categories = /* @__PURE__ */ new Map();
+			const bounded = /* @__PURE__ */ new Set();
+			const toolResultEscapes = /* @__PURE__ */ new Set();
+			for (const { term, category, bounded: whole, toolResultEscapes: escaped } of hide.terms) {
+				if (categories.has(term)) mismatch("duplicate-term");
+				categories.set(term, maskCategory(category));
+				if (whole) bounded.add(term);
+				if (escaped) toolResultEscapes.add(term);
+			}
+			family = {
+				matcher: createEntityMatcher([...categories.keys()].map((value) => ({
+					kind: "custom-term",
+					value
+				}))),
+				categories,
+				bounded,
+				toolResultEscapes,
+				excepted: bExceptionRanges(hide.exceptions ?? [])
+			};
+			shared.set(key, family);
+		}
+		for (const id of hide.mainSessionIds) bind(id, family, true);
+		for (const id of hide.workerSessionIds) bind(id, family, false);
+	}
+	return parts;
 }
-/** Canonical path is private input to the digest and is never written to the bundle. */
-function normalizeWindowsWorkspacePath(rawPath) {
-	pathPart(rawPath);
-	const normalized = win32.normalize(rawPath);
-	const wslPath = wslUnc(normalized);
-	if (wslPath !== null) return wslPath;
-	const drive = /^([a-zA-Z]):\\(.*)$/.exec(normalized);
-	if (drive) return `win-drive:${(drive[1] ?? "").toLowerCase()}:${posix.normalize(`/${(drive[2] ?? "").replaceAll("\\", "/")}`)}`;
-	const share = /^\\\\([^\\]+)\\([^\\]+)(?:\\(.*))?$/.exec(normalized);
-	if (share) {
-		const server = encodeURIComponent(pathPart(share[1] ?? "").toLowerCase());
-		const name = encodeURIComponent(pathPart(share[2] ?? "").toLowerCase());
-		const remainder = (share[3] ?? "").replaceAll("\\", "/");
-		return `win-unc:${server}/${name}:${posix.normalize(`/${remainder}`)}`;
+/** Disjoint literal hits outside existing markers; overlaps join under the highest category. */
+function familySpans(text, family, signal, toolResult) {
+	const markers = [...text.matchAll(markerPattern)].map((match) => ({
+		start: match.index,
+		end: match.index + match[0].length
+	}));
+	let kept;
+	const excepted = (range) => (kept ??= bContainment(family.excepted(text, signal)))(range);
+	const marked = (range) => {
+		let low = 0, high = markers.length;
+		while (low < high) {
+			const middle = low + high >> 1;
+			if ((markers[middle]?.end ?? Infinity) <= range.start) low = middle + 1;
+			else high = middle;
+		}
+		return (markers[low]?.start ?? Infinity) < range.end;
+	};
+	const hits = family.matcher.find(text, signal, 2e6).filter(({ range, entity }) => !marked(range) && (!family.bounded.has(entity.value) || bWordBounded(text, range.start, range.end, toolResult && family.toolResultEscapes.has(entity.value))) && !excepted(range)).map(({ range, entity }) => ({
+		...range,
+		category: family.categories.get(entity.value) ?? mismatch("unknown-term")
+	})).sort((left, right) => left.start - right.start || right.end - left.end);
+	const spans = [];
+	for (const hit of hits) {
+		const prior = spans.at(-1);
+		if (!prior || hit.start >= prior.end) {
+			spans.push(hit);
+			continue;
+		}
+		prior.end = Math.max(prior.end, hit.end);
+		if (categoryOrder.indexOf(hit.category) > categoryOrder.indexOf(prior.category)) prior.category = hit.category;
 	}
-	return unavailable$1();
+	return spans;
 }
-function normalizePosixWorkspacePath(rawPath) {
-	pathPart(rawPath);
-	if (!posix.isAbsolute(rawPath)) return unavailable$1();
-	return `posix:${posix.normalize(rawPath)}`;
+/**
+* Enum-like envelope values that native parsing interprets. Values inside an adapter-retained
+* body are free text; outside bodies these names (and IDs) never take family terms.
+*/
+const structuralNames = /* @__PURE__ */ new Set([
+	"type",
+	"role",
+	"name",
+	"subtype",
+	"stop_reason",
+	"status",
+	"kind",
+	"level",
+	"source",
+	"originator",
+	"mode",
+	"tool_name",
+	"toolName",
+	"function_name"
+]);
+const structural = (name) => name !== void 0 && (structuralNames.has(name) || /(?:^id|_id|Id|uuid|Uuid)$/u.test(name));
+/** Node IDs inside the adapter's retained bodies: the native free-text classification. */
+function bodyNodes(root, selection) {
+	const bodies = new Set(selection.edits.map((edit) => edit.nodeId));
+	const nodes = /* @__PURE__ */ new Set();
+	const visit = (node, inside) => {
+		const body = inside || bodies.has(node.id);
+		if (body) nodes.add(node.id);
+		if (node.kind === "array") for (const item of node.items) visit(item, body);
+		if (node.kind === "object") for (const property of node.properties) visit(property.value, body);
+	};
+	visit(root, false);
+	return nodes;
 }
-async function wslWindowsPath(rawPath, signal) {
-	checkAbort(signal);
-	pathPart(rawPath);
-	if (!posix.isAbsolute(rawPath)) return unavailable$1();
-	try {
-		const { stdout } = await execute$1("wslpath", ["-w", rawPath], {
-			encoding: "utf8",
-			maxBuffer: 32768,
-			timeout: 15e3,
-			windowsHide: true,
-			signal
-		});
-		checkAbort(signal);
-		return stdout.replace(/\r?\n$/, "");
-	} catch {
-		checkAbort(signal);
-		return unavailable$1();
-	}
+/** Exact, cheap check that any string value can match: one linear scan whatever the term count. */
+function mayMatch(root, family, signal) {
+	const values = [];
+	const visit = (node) => {
+		if (node.kind === "string") values.push(node.value);
+		else if (node.kind === "array") for (const item of node.items) visit(item);
+		else if (node.kind === "object") for (const property of node.properties) visit(property.value);
+	};
+	visit(root);
+	return family.matcher.hasCustomTerm(values.join("\0"), signal) || values.some((value) => /^\s*[[{]/u.test(value) && value.includes("\\"));
 }
-/** Translate Windows/WSL aliases lexically, including paths that no longer exist. */
-async function normalizeWorkspacePath(rawPath, signal) {
-	checkAbort(signal);
-	if (/^(?:[A-Za-z]:[\\/]|\\\\)/u.test(rawPath)) return normalizeWindowsWorkspacePath(rawPath);
-	if (platform() === "win32") {
-		const wslDrive = /^\/mnt\/([A-Za-z])(?:\/(.*))?$/u.exec(rawPath);
-		if (wslDrive) return normalizeWindowsWorkspacePath(`${wslDrive[1]}:\\${(wslDrive[2] ?? "").replaceAll("/", "\\")}`);
-		return normalizePosixWorkspacePath(rawPath);
+/** Masks family literals in unprotected, non-structural string values `skip` does not exclude. */
+function maskFamilyFields(text, root, annotations, family, markers, signal, onApplied, bodies, skip) {
+	const changes = /* @__PURE__ */ new Map();
+	const evidence = { bytes: 0 };
+	const recordLimits = recordPointerLimits(limits, Buffer.byteLength(text));
+	for (const field of walkNativeFields(root, annotations, {
+		recordId: digest$4(text),
+		limits: recordLimits,
+		signal
+	})) {
+		if (skip(field)) continue;
+		if (field.text.includes(markers.prefix)) mismatch("marker-prefix");
+		if (field.subject !== "value" || field.scalarKind !== "string" || field.field.protection || !bodies.has(field.nodeId) && structural(field.field.name)) continue;
+		const toolResult = field.origin.carrier === "tool-result";
+		const find = (value) => familySpans(value, family, signal, toolResult);
+		const raw = find(field.text);
+		const carrier = raw.length || field.text.includes("\\") ? familyCarrierSpans(field, find, signal) : void 0;
+		const spans = (carrier ?? raw).sort((left, right) => left.start - right.start);
+		if (!spans.length) continue;
+		const changed = maskOutputField({
+			pointer: field.pointer,
+			text: field.text,
+			sha256: digest$4(field.text)
+		}, spans, markers, evidence, onApplied);
+		if (carrier) validateFamilyCarrier(changed, signal);
+		changes.set(field.nodeId, changed);
 	}
-	if (platform() === "darwin") return normalizePosixWorkspacePath(rawPath);
-	if (platform() !== "linux") return unavailable$1();
-	const wsl = await isWsl();
+	return changes.size ? renderNative(root, changes, recordLimits, signal).text : text;
+}
+/**
+* Every row of a family part is parsed in order so native call/result state stays aligned.
+* Worker rows: every unprotected string value. Main rows: every one that is not a B review
+* field, which keeps its exact B decisions. Keys, roles, identities and tool links stay exact.
+*/
+function createFamilyHideEditor(adapter, part, family, markers, signal, onApplied) {
+	const options = {
+		sourceRole: part.native.role,
+		nativeSessionId: part.native.sessionId
+	};
+	const retention = adapter.retention(options);
+	return (text, reviewed = /* @__PURE__ */ new Set()) => {
+		checkAbort(signal);
+		const root = parseNativeRecord(text, limits, signal);
+		const selection = retention(root);
+		if (!mayMatch(root, family, signal)) return text;
+		return maskFamilyFields(text, root, adapter.annotations(root, options, selection), family, markers, signal, onApplied, bodyNodes(root, selection), (field) => reviewed.has(field.pointer));
+	};
+}
+/** Session metadata is never analysed; its unprotected text (such as a title) takes family terms. */
+function maskFamilyMetadata(text, family, markers, signal, onApplied) {
 	checkAbort(signal);
-	if (wsl) return normalizeWindowsWorkspacePath(await wslWindowsPath(rawPath, signal));
-	return normalizePosixWorkspacePath(rawPath);
+	const root = parseNativeRecord(text, limits, signal);
+	return maskFamilyFields(text, root, metadataAnnotations(root), family, markers, signal, onApplied, /* @__PURE__ */ new Set(), () => false);
 }
 //#endregion
-//#region packages/artifact/src/collection/identity/environment.ts
-const execute = promisify(execFile);
-const unavailable = () => fail("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
-async function run(file, args, signal) {
-	checkAbort(signal);
-	try {
-		const { stdout } = await execute(file, [...args], {
-			encoding: "utf8",
-			maxBuffer: 32768,
-			timeout: 15e3,
-			windowsHide: true,
-			signal
+//#region packages/artifact/src/configured/output/workspace-title.ts
+function createWorkspaceTitleMasker(request, manifest, markers, signal) {
+	const hides = request.metadata?.workspaceTitleHides;
+	const family = hides && {
+		...confirmedFamily(hides.terms, hides.exceptions),
+		bounded: new Set(hides.terms.filter((term) => term.bounded).map((term) => term.term))
+	};
+	const workspaces = new Map(manifest.sourceWorkspaces.map((item) => [item.metadataPath, item]));
+	return (text, entryPath, onApplied) => {
+		const workspace = workspaces.get(entryPath);
+		if (!workspace || !family) return text;
+		const metadata = validateConfiguredSourceMetadata(strictJson(text, metadataLimitBytes), workspace);
+		if (metadata.title.includes(markers.prefix)) fail("ARTIFACT_PROCESSING_MISMATCH");
+		const title = maskOutputField({
+			pointer: "/title",
+			text: metadata.title,
+			sha256: digest$4(metadata.title)
+		}, confirmedTitleSpans(metadata.title, family, signal), {
+			...markers,
+			marker: () => "[hidden]"
+		}, { bytes: 0 }, onApplied);
+		return JSON.stringify({
+			...metadata,
+			title
 		});
-		checkAbort(signal);
-		return stdout.trim();
-	} catch {
-		checkAbort(signal);
-		return unavailable();
-	}
+	};
 }
-function identifier(value, pattern) {
-	const id = value.trim().toLowerCase();
-	if (id.length > 128 || !pattern.test(id) || /^0+$/.test(id.replaceAll("-", ""))) return unavailable();
-	return id;
+//#endregion
+//#region packages/artifact/src/collection/identity-map.ts
+const maximumBundleIdentityMapBytes = 8388608;
+const maximumLocatorBytes = 16384;
+const maximumRemotes = 4096;
+const uuid$2 = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/;
+const digest$3 = /^[a-f0-9]{64}$/;
+function validBundleId(bundleId) {
+	if (!uuid$2.test(bundleId)) fail("ARTIFACT_INVALID_MANIFEST");
 }
-async function windowsInstallationId() {
-	const script = [
-		"$ErrorActionPreference='Stop'",
-		"$id=(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Cryptography').MachineGuid",
-		"if ([string]::IsNullOrWhiteSpace($id)) { exit 2 }",
-		"[Console]::Out.WriteLine($id)"
-	].join(";");
-	return identifier(await run("powershell.exe", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-EncodedCommand",
-		Buffer.from(script, "utf16le").toString("base64")
-	]), /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/);
+function boundedLocator(value) {
+	const result = string(value);
+	if (Buffer.byteLength(result) > maximumLocatorBytes) fail("ARTIFACT_METADATA_LIMIT");
+	return result;
 }
-async function linuxInstallationId() {
-	try {
-		return identifier(await readFile("/etc/machine-id", "utf8"), /^[0-9a-f]{32}$/);
-	} catch {
-		return unavailable();
-	}
+function boundedHash(value) {
+	const result = string(value);
+	if (!digest$3.test(result)) fail("ARTIFACT_INVALID_MANIFEST");
+	return result;
 }
-async function macInstallationId() {
-	const plist = await run("diskutil", [
-		"info",
-		"-plist",
-		"/"
+function parseIdentityMap(value) {
+	const input = record$1(value);
+	keys(input, [
+		"format",
+		"formatVersion",
+		"bundleId",
+		"workspace"
 	]);
-	const match = /<key>APFSVolumeGroupID<\/key>\s*<string>([0-9a-fA-F-]+)<\/string>/.exec(plist);
-	if (!match) return unavailable();
-	return identifier(match[1] ?? "", /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/);
-}
-async function installationId() {
-	if (platform() === "win32") return installationEnvironmentId("windows-installation", await windowsInstallationId());
-	if (platform() === "darwin") return installationEnvironmentId("macos-apfs-installation", await macInstallationId());
-	if (platform() === "linux") {
-		if (await isWsl()) return installationEnvironmentId("windows-installation", await windowsInstallationId());
-		return installationEnvironmentId("linux-installation", await linuxInstallationId());
-	}
-	return unavailable();
-}
-let installationPromise;
-function waitForInstallation(id, signal) {
-	if (!signal) return id;
-	checkAbort(signal);
-	return new Promise((resolve, reject) => {
-		const onAbort = () => reject(/* @__PURE__ */ new Error("ARTIFACT_ABORTED"));
-		signal.addEventListener("abort", onAbort, { once: true });
-		id.then((value) => {
-			signal.removeEventListener("abort", onAbort);
-			resolve(value);
-		}, (error) => {
-			signal.removeEventListener("abort", onAbort);
-			reject(error);
-		});
-	});
-}
-/** Same OS installation receives one stable namespace across process and state-dir changes. */
-async function resolveWorkspaceEnvironmentId(signal) {
-	checkAbort(signal);
-	if (!installationPromise) installationPromise = installationId().catch((error) => {
-		installationPromise = void 0;
-		throw error;
-	});
-	const id = await waitForInstallation(installationPromise, signal);
-	checkAbort(signal);
-	return id;
-}
-//#endregion
-//#region packages/artifact/src/collection/identity/remote.ts
-/** Versioned canonical form shared by archive producers and downstream consumers. */
-function canonicalRemote(value) {
-	const input = value.trim();
-	if (!input || Buffer.byteLength(input) > 16384) return fail("ARTIFACT_UNSAFE_REMOTE");
-	for (const character of input) {
-		const code = character.charCodeAt(0);
-		if (code < 32 || code === 127) return fail("ARTIFACT_UNSAFE_REMOTE");
-	}
-	if (input.startsWith("/") || /^[a-z]:[\\/]/i.test(input) || input.startsWith("\\\\")) return input.replaceAll("\\", "/");
-	const scp = /^[a-z][a-z0-9+.-]*:\/\//i.test(input) ? null : /^(?:[^@/\s]+@)?(\[[^\]]+\]|[^/:\s]+):([^:].*)$/.exec(input);
-	const candidate = scp?.[1] && scp[2] ? `ssh://${scp[1]}/${scp[2]}` : input;
-	let url;
-	try {
-		url = new URL(candidate);
-	} catch (error) {
-		return fail("ARTIFACT_UNSAFE_REMOTE", { cause: error });
-	}
-	if (![
-		"https:",
-		"http:",
-		"ssh:",
-		"git:",
-		"file:"
-	].includes(url.protocol)) fail("ARTIFACT_UNSAFE_REMOTE");
-	url.username = "";
-	url.password = "";
-	url.search = "";
-	url.hash = "";
-	url.hostname = url.hostname.toLowerCase();
-	if (url.protocol === "ssh:" && url.port === "22" || url.protocol === "git:" && url.port === "9418") url.port = "";
-	if (url.protocol !== "file:") {
-		if (!url.hostname) fail("ARTIFACT_UNSAFE_REMOTE");
-		url.pathname = url.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
-	}
-	return url.href;
-}
-function hashRemote(canonical) {
-	return createHash("sha256").update("sess-pilot/git-remote/v1\0").update(canonical).digest("hex");
-}
-//#endregion
-//#region packages/artifact/src/collection/identity/workspace.ts
-async function workspaceIdentity(workspace, signal) {
-	checkAbort(signal);
-	const pathHash = workspace.path === null ? null : hashWorkspacePath(await normalizeWorkspacePath(workspace.path, signal), await resolveWorkspaceEnvironmentId(signal));
-	const remotes = workspace.remotes.map((remote) => {
-		const url = canonicalRemote(remote);
+	const bundleId = string(input["bundleId"]);
+	validBundleId(bundleId);
+	const workspace = record$1(input["workspace"]);
+	keys(workspace, [
+		"path",
+		"pathHash",
+		"remotes",
+		"primaryRemoteHash"
+	]);
+	const path = workspace["path"] === null ? null : boundedLocator(workspace["path"]);
+	const pathHash = workspace["pathHash"] === null ? null : boundedHash(workspace["pathHash"]);
+	if (path === null !== (pathHash === null)) fail("ARTIFACT_INVALID_MANIFEST");
+	const rawRemotes = workspace["remotes"];
+	if (!Array.isArray(rawRemotes)) return fail("ARTIFACT_INVALID_MANIFEST");
+	if (rawRemotes.length > maximumRemotes) fail("ARTIFACT_METADATA_LIMIT");
+	const remotes = rawRemotes.map((entry) => {
+		const remote = record$1(entry);
+		keys(remote, ["url", "hash"]);
 		return {
-			url,
-			hash: hashRemote(url)
+			url: boundedLocator(remote["url"]),
+			hash: boundedHash(remote["hash"])
 		};
 	});
-	const primaryRemoteHash = workspace.primaryRemote ? hashRemote(canonicalRemote(workspace.primaryRemote.locator)) : null;
-	if (primaryRemoteHash !== null && !remotes.some((remote) => remote.hash === primaryRemoteHash)) fail("ARTIFACT_UNSAFE_REMOTE");
-	const challengeId = await readChallengeId(workspace.path, signal);
-	checkAbort(signal);
-	return {
-		title: workspace.title,
-		path: workspace.path,
-		pathHash,
-		remotes,
-		primaryRemoteHash,
-		challengeId
-	};
-}
-function workspaceMetadata(identity) {
-	return {
-		version: 3,
-		title: identity.title,
-		pathHash: identity.pathHash,
-		remoteHashes: identity.remotes.map((remote) => remote.hash),
-		primaryRemoteHash: identity.primaryRemoteHash
-	};
-}
-function bundleIdentityMap(bundleId, identity) {
+	const primaryRemoteHash = nullableString(workspace["primaryRemoteHash"]);
+	if (primaryRemoteHash !== null) {
+		if (!digest$3.test(primaryRemoteHash) || !remotes.some((remote) => remote.hash === primaryRemoteHash)) fail("ARTIFACT_INVALID_MANIFEST");
+	}
 	return {
-		format: "sess-pilot-bundle-identity-map",
-		formatVersion: 1,
+		format: literal(input["format"], "sess-pilot-bundle-identity-map"),
+		formatVersion: literal(input["formatVersion"], 1),
 		bundleId,
 		workspace: {
-			path: identity.path,
-			pathHash: identity.pathHash,
-			remotes: identity.remotes,
-			primaryRemoteHash: identity.primaryRemoteHash
+			path,
+			pathHash,
+			remotes,
+			primaryRemoteHash
 		}
 	};
 }
-//#endregion
-//#region packages/artifact/src/collection/producer/workspace-metadata.ts
-/** Workspace titles are emitted once, independently of per-session optional profiles. */
-async function configuredWorkspaceMetadata(identity, processing, signal, titlePlan, onMasks, replacementScope) {
-	const metadata = workspaceMetadata(identity);
-	const terms = processing.customTerms?.terms ?? [];
-	if (terms.length === 0 && titlePlan === void 0) return metadata;
-	const preparation = createSessionPreparation({
-		environment: processing.environment,
-		customTerms: terms,
-		...processing.staticExceptions === void 0 ? {} : { staticExceptions: processing.staticExceptions.values },
-		...processing.replacementKey === void 0 ? {} : { replacementKey: processing.replacementKey },
-		...replacementScope === void 0 ? {} : { replacementScope }
-	}, signal);
-	let bindings;
+function encoded(map) {
+	const text = `${JSON.stringify(map)}\n`;
+	if (Buffer.byteLength(text) > 8388608) fail("ARTIFACT_METADATA_LIMIT");
+	return text;
+}
+function sameFileVersion$2(left, right) {
+	return right.isFile() && left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+async function identityDirectory(root) {
+	const directory = join(root, "identity");
+	if (await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	}) !== void 0 && process.platform === "win32") await restrictToOwner(directory, "directory");
+	const stat = await lstat(directory, { bigint: true });
+	const uid = process.getuid?.();
+	if (!stat.isDirectory() || (process.platform === "win32" ? !await windowsOwnerOnly(directory, "directory") : uid === void 0 || stat.uid !== BigInt(uid) || (stat.mode & 63n) !== 0n) || await realpath(directory) !== directory) fail("ARTIFACT_OUTPUT_UNSAFE");
+	return directory;
+}
+/** Missing maps are recoverable from a current approval; malformed maps are not silently trusted. */
+async function readBundleIdentityMap(root, bundleId) {
+	validBundleId(bundleId);
+	const directory = await identityDirectory(root);
+	const path = join(directory, `b-${bundleId}.json`);
+	let before;
 	try {
-		if (titlePlan) {
-			const seeds = await processing.gitNames(identity.path === null ? [] : [identity.path], signal);
-			for (const name of seeds.names) preparation.gitName(name);
+		before = await lstat(path, { bigint: true });
+	} catch (error) {
+		if (filesystemCode(error) === "ENOENT") return null;
+		throw error;
+	}
+	const uid = process.getuid?.();
+	if (!before.isFile() || (process.platform === "win32" ? !await windowsOwnerOnly(path, "file") : uid === void 0 || before.uid !== BigInt(uid) || (before.mode & 63n) !== 0n)) fail("ARTIFACT_OUTPUT_UNSAFE");
+	if (before.size > BigInt(8388608)) fail("ARTIFACT_METADATA_LIMIT");
+	const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const opened = await handle.stat({ bigint: true });
+		if (!sameFileVersion$2(before, opened)) fail("ARTIFACT_IDENTITY_MISMATCH");
+		const bytes = Buffer.alloc(Number(opened.size));
+		let offset = 0;
+		while (offset < bytes.length) {
+			const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+			if (bytesRead === 0) fail("ARTIFACT_INVALID_MANIFEST");
+			offset += bytesRead;
 		}
-		preparation.original(metadata.title, false);
-		bindings = preparation.finish();
-		const input = {
-			attemptId: "workspace-metadata",
-			sourceRef: "workspace-metadata",
-			unitId: "title",
-			text: metadata.title,
-			...onMasks ? { captureMasks: true } : {}
-		};
-		async function* units() {
-			yield input;
-		}
-		let title;
-		for await (const output of processing.processor.transform(units(), withMandatoryCustomTerms(titlePlan ?? buildPlan([], [])), signal, bindings.session)) {
-			if (title !== void 0 || output.unitId !== input.unitId || output.sourceRef !== input.sourceRef || output.attemptId !== input.attemptId) fail("ARTIFACT_PROCESSING_FAILED");
-			title = output.text;
-			onMasks?.(input.text, output);
+		if (!sameFileVersion$2(opened, await handle.stat({ bigint: true })) || !sameFileVersion$2(opened, await lstat(path, { bigint: true }))) fail("ARTIFACT_IDENTITY_MISMATCH");
+		let text;
+		try {
+			text = new TextDecoder$1("utf-8", { fatal: true }).decode(bytes);
+		} catch (error) {
+			return fail("ARTIFACT_INVALID_MANIFEST", { cause: error });
 		}
-		if (title === void 0) return fail("ARTIFACT_PROCESSING_FAILED");
-		return {
-			...metadata,
-			title
-		};
+		const map = parseIdentityMap(strictJson(text, maximumBundleIdentityMapBytes, 5e4));
+		if (map.bundleId !== bundleId) fail("ARTIFACT_INVALID_MANIFEST");
+		return map;
 	} finally {
-		bindings?.close();
-		preparation.close();
+		await handle.close();
 	}
 }
-//#endregion
-//#region packages/artifact/src/configured/journey/metadata-spans.ts
-/** Raw semantic boundaries expand over actual static replacements; static text is never restored. */
-function metadataOutputSpans(text, masks, semantic) {
-	if (!semantic) return [];
-	if (semantic.textSha256 !== createHash("sha256").update(text).digest("hex") || semantic.spans.length > 5e4) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const ordered = masks.toSorted((a, b) => a.inputRange.start - b.inputRange.start);
-	const map = (position, edge) => {
-		let delta = 0;
-		for (const mask of ordered) {
-			if (position <= mask.inputRange.start) break;
-			if (position < mask.inputRange.end) return edge === "start" ? mask.outputRange.start : mask.outputRange.end;
-			delta += mask.replacement.length - (mask.inputRange.end - mask.inputRange.start);
+/** Publish before the corresponding ZIP; retained maps are never removed automatically. */
+async function writeBundleIdentityMap(root, map) {
+	const validated = parseIdentityMap(map);
+	const text = encoded(validated);
+	const directory = await identityDirectory(root);
+	await syncDirectory(root);
+	const finalPath = join(directory, `b-${validated.bundleId}.json`);
+	const existing = await readBundleIdentityMap(root, validated.bundleId);
+	if (existing) {
+		if (encoded(existing) !== text) fail("ARTIFACT_DESTINATION_EXISTS");
+		return;
+	}
+	const tempPath = join(directory, `.sess-pilot-b-${randomUUID()}.part`);
+	const handle = await openPrivateFile(tempPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 384);
+	try {
+		const stat = await handle.stat({ bigint: true });
+		const uid = process.getuid?.();
+		if (!stat.isFile() || (process.platform === "win32" ? !await windowsOwnerOnly(tempPath, "file") : uid === void 0 || stat.uid !== BigInt(uid) || (stat.mode & 63n) !== 0n)) fail("ARTIFACT_OUTPUT_UNSAFE");
+		await handle.writeFile(text);
+		await handle.sync();
+		try {
+			await link(tempPath, finalPath);
+		} catch (error) {
+			if (filesystemCode(error) !== "EEXIST") throw error;
+			const raced = await readBundleIdentityMap(root, validated.bundleId);
+			if (!raced || encoded(raced) !== text) fail("ARTIFACT_DESTINATION_EXISTS");
 		}
-		return position + delta;
-	};
-	const mapped = semantic.spans.flatMap((span) => {
-		if (!Number.isSafeInteger(span.start) || !Number.isSafeInteger(span.end) || span.start < 0 || span.end <= span.start || span.end > text.length || !scalarBoundary(text, span.start) || !scalarBoundary(text, span.end)) fail("ARTIFACT_PROCESSING_MISMATCH");
-		const category = maskCategory(span.category);
-		const start = map(span.start, "start"), end = map(span.end, "end");
-		return start === end ? [] : [{
-			start,
-			end,
-			category
-		}];
-	}).sort((a, b) => a.start - b.start || b.end - a.end);
-	const result = [];
-	for (const span of mapped) {
-		const previous = result.at(-1);
-		if (previous && span.start < previous.end) {
-			const category = categoryOrder.indexOf(maskCategory(previous.category)) >= categoryOrder.indexOf(span.category) ? previous.category : span.category;
-			result[result.length - 1] = {
-				start: previous.start,
-				end: Math.max(previous.end, span.end),
-				category
-			};
-		} else result.push(span);
+		await syncDirectory(directory);
+	} finally {
+		await handle.close();
+		await unlink(tempPath);
 	}
-	return result;
 }
 //#endregion
-//#region packages/artifact/src/configured/journey/metadata-fields.ts
-/** This accepts private raw proposals once. Safe strings must never be re-ingested as originals. */
-async function processJourneyMetadataFields(request, signal = new AbortController().signal) {
-	const { workId, fields, processing, redactionPlan } = request;
-	if (!/^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/u.test(workId) || processing.staticExceptions !== void 0 && processing.staticExceptions.workId !== workId || fields.length > 16 || fields.some(({ text }) => !text.isWellFormed() || Buffer.byteLength(text) > 16384) || fields.reduce((sum, { text }) => sum + Buffer.byteLength(text), 0) > 65536) fail("ARTIFACT_INVALID_APPROVAL");
-	const results = [];
-	let bytes = 0;
-	for (const field of fields) {
-		checkAbort(signal);
-		if (field.semantic && field.processedSemantic) fail("ARTIFACT_INVALID_APPROVAL");
-		let staticMasks;
-		const output = await configuredWorkspaceMetadata({
-			title: field.text,
-			path: null,
-			pathHash: null,
-			remotes: [],
-			primaryRemoteHash: null,
-			challengeId: null
-		}, processing, signal, redactionPlan, (input, processed) => {
-			staticMasks = titleMasks(input, processed);
-		}, processing.replacementKey === void 0 ? void 0 : `work-metadata:${workId}`);
-		const masks = staticMasks ?? fail("ARTIFACT_PROCESSING_FAILED");
-		const spans = field.processedSemantic ? metadataOutputSpans(output.title, [], field.processedSemantic) : metadataOutputSpans(field.text, masks, field.semantic);
-		let text = output.title;
-		const transcripts = [];
-		if (spans.length) {
-			const markers = createSemanticMarkers(processing.replacementKey ?? fail("ARTIFACT_INVALID_APPROVAL"), workId);
-			try {
-				const inputSha256 = createHash("sha256").update(text).digest("hex");
-				const input = text;
-				text = replaceSemanticSpans(input, spans, markers, (span, replacement, start) => {
-					const contextStart = Math.max(0, span.start - 120);
-					transcripts.push({
-						pointer: "/title",
-						inputSha256,
-						inputRange: {
-							start: span.start,
-							end: span.end
-						},
-						outputRange: {
-							start,
-							end: start + replacement.length
-						},
-						replacement,
-						category: maskCategory(span.category),
-						context: {
-							start: contextStart,
-							text: input.slice(contextStart, Math.min(input.length, contextStart + 512, span.end + 120))
-						}
-					});
-				});
-			} finally {
-				markers.close();
-			}
-		}
-		bytes += Buffer.byteLength(text);
-		if (Buffer.byteLength(text) > 32768 || bytes > 65536) fail("ARTIFACT_METADATA_LIMIT");
-		const outputSha256 = createHash("sha256").update(text).digest("hex");
-		results.push({
-			text,
-			staticMasks: masks,
-			semanticTranscript: transcripts.map((item) => ({
-				...item,
-				outputSha256
-			}))
-		});
-	}
-	return results;
+//#region packages/artifact/src/collection/identity/hash.ts
+/** Hash the private canonical path under an OS-installation namespace. */
+function hashWorkspacePath(normalizedPath, environmentId) {
+	if (!/^[0-9a-f]{64}$/.test(environmentId)) throw new Error("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
+	return createHash("sha256").update("sess-pilot-workspace-path-v2\0").update(environmentId).update("\0").update(normalizedPath).digest("hex");
+}
+/** Keep the installation identifier out of the distributable bundle. */
+function installationEnvironmentId(kind, installationId) {
+	if (!kind || !installationId) throw new Error("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
+	return createHash("sha256").update("sess-pilot-workspace-environment-v2\0").update(kind).update("\0").update(installationId).digest("hex");
 }
 //#endregion
-//#region packages/artifact/src/configured/output/metadata.ts
-async function updateOutputWorkMetadata(text, manifest, request, signal, onTitleMasks) {
-	const work = parseConfiguredWorkMetadata(strictJson(text, metadataLimitBytes));
-	if (work.id !== manifest.work.id) fail("ARTIFACT_INVALID_MANIFEST");
-	const update = request.metadata;
-	if (!update) return text;
-	if ((update.titleSemantic || update.titleProcessedSemantic) && update.title === void 0) fail("ARTIFACT_INVALID_APPROVAL");
-	let title = work.title;
-	if (update.cachedTitle) {
-		if (update.title !== void 0 || update.titleSemantic || update.titleProcessedSemantic) fail("ARTIFACT_INVALID_APPROVAL");
-		const cached = update.cachedTitle;
-		const sha256 = createHash("sha256").update(cached.text).digest("hex");
-		if (sha256 !== cached.semantic.textSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
-		const markers = createSemanticMarkers(request.replacementKey, request.workId);
-		const transcripts = [];
-		try {
-			title = maskOutputField({
-				pointer: "/title",
-				text: cached.text,
-				sha256
-			}, cached.semantic.spans, markers, { bytes: 0 }, (value) => transcripts.push(value));
-		} finally {
-			markers.close();
-		}
-		onTitleMasks?.({
-			text: title,
-			staticMasks: cached.staticMasks,
-			semanticTranscript: transcripts
-		});
-	} else if (update.title !== void 0) {
-		if (!update.title.trim() || Buffer.byteLength(update.title) > 16384) fail("ARTIFACT_INVALID_APPROVAL");
-		const treatment = manifest.configuration.definitions.find((item) => item.id === manifest.sessions[0]?.treatmentId) ?? fail("ARTIFACT_INVALID_MANIFEST");
-		const metadata = (await processJourneyMetadataFields({
-			workId: manifest.work.id,
-			fields: [{
-				text: update.title,
-				...update.titleSemantic ? { semantic: update.titleSemantic } : {},
-				...update.titleProcessedSemantic ? { processedSemantic: update.titleProcessedSemantic } : {}
-			}],
-			processing: {
-				...request.processing,
-				replacementKey: request.replacementKey
-			},
-			redactionPlan: treatment.redactionPlan
-		}, signal))[0] ?? fail("ARTIFACT_PROCESSING_FAILED");
-		title = metadata.text;
-		onTitleMasks?.(metadata);
+//#region packages/artifact/src/collection/identity/wsl.ts
+async function isWsl() {
+	try {
+		return /microsoft|wsl/i.test(await readFile("/proc/sys/kernel/osrelease", "utf8"));
+	} catch {
+		return false;
 	}
-	const changed = parseConfiguredWorkMetadata({
-		...work,
-		title,
-		access: update.access ?? work.access
-	});
-	return JSON.stringify(changed);
 }
 //#endregion
-//#region packages/artifact/src/configured/output/read.ts
-async function verifiedMetadata(entry, description, signal) {
-	const text = await readMetadata(entry, signal);
-	if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
-	return strictJson(text, metadataLimitBytes);
+//#region packages/artifact/src/collection/identity/path.ts
+const execute$1 = promisify(execFile);
+const unavailable$1 = () => fail("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
+function pathPart(value) {
+	if (value.length === 0 || Buffer.byteLength(value, "utf8") > 16384 || Array.from(value).some((character) => {
+		const code = character.charCodeAt(0);
+		return code < 32 || code === 127;
+	})) return unavailable$1();
+	return value;
 }
-async function readConfiguredOutputInfo(input, signal = new AbortController().signal) {
-	const verified = await checkFrozenOutput(input, signal);
-	const archive = await openCheckedOutput(input, verified.checked, signal);
-	const cleanup = createCleanup();
-	try {
-		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
-		const path = verified.manifest.work.metadataPath;
-		const description = verified.manifest.entries.find((entry) => entry.entryPath === path) ?? fail("ARTIFACT_INVALID_MANIFEST");
-		const work = parseConfiguredWorkMetadata(await verifiedMetadata(archive.entries.get(path) ?? fail("ARTIFACT_INVALID_ARCHIVE"), description, signal));
-		if (work.id !== verified.manifest.work.id) fail("ARTIFACT_INVALID_MANIFEST");
-		const sources = [];
-		for (const source of verified.manifest.sourceWorkspaces) {
-			const metadata = validateConfiguredSourceMetadata(await verifiedMetadata(archive.entries.get(source.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), verified.manifest.entries.find((candidate) => candidate.entryPath === source.metadataPath) ?? fail("ARTIFACT_INVALID_MANIFEST"), signal), source);
-			sources.push({
-				id: source.id,
-				pathHash: metadata.pathHash,
-				remoteHashes: metadata.remoteHashes,
-				primaryRemoteHash: metadata.primaryRemoteHash,
-				...source.challengeId === void 0 ? {} : { challengeId: source.challengeId }
-			});
-		}
-		return {
-			manifest: verified.manifest,
-			work,
-			checked: verified.checked,
-			sources,
-			createdAt: verified.manifest.createdAt,
-			sessionCount: verified.manifest.sessions.length
-		};
-	} catch (error) {
-		cleanup.failed(error);
-		throw error;
-	} finally {
-		await cleanup.run(() => archive.close());
+function wslUnc(path) {
+	const match = /^\\\\(?:wsl\.localhost|wsl\$)\\([^\\]+)(?:\\(.*))?$/i.exec(path);
+	if (!match) return null;
+	const distro = pathPart(match[1] ?? "").toLowerCase();
+	const remainder = (match[2] ?? "").replaceAll("\\", "/");
+	return `wsl:${encodeURIComponent(distro)}:${posix.normalize(`/${remainder}`)}`;
+}
+/** Canonical path is private input to the digest and is never written to the bundle. */
+function normalizeWindowsWorkspacePath(rawPath) {
+	pathPart(rawPath);
+	const normalized = win32.normalize(rawPath);
+	const wslPath = wslUnc(normalized);
+	if (wslPath !== null) return wslPath;
+	const drive = /^([a-zA-Z]):\\(.*)$/.exec(normalized);
+	if (drive) return `win-drive:${(drive[1] ?? "").toLowerCase()}:${posix.normalize(`/${(drive[2] ?? "").replaceAll("\\", "/")}`)}`;
+	const share = /^\\\\([^\\]+)\\([^\\]+)(?:\\(.*))?$/.exec(normalized);
+	if (share) {
+		const server = encodeURIComponent(pathPart(share[1] ?? "").toLowerCase());
+		const name = encodeURIComponent(pathPart(share[2] ?? "").toLowerCase());
+		const remainder = (share[3] ?? "").replaceAll("\\", "/");
+		return `win-unc:${server}/${name}:${posix.normalize(`/${remainder}`)}`;
 	}
+	return unavailable$1();
 }
-/** Model-safe rows only: read a digest-bound static primary, never its original source. */
-async function* readConfiguredOutputRows(input, signal = new AbortController().signal) {
-	const verified = await checkFrozenOutput(input, signal);
-	const archive = await openCheckedOutput(input, verified.checked, signal);
-	const cleanup = createCleanup();
+function normalizePosixWorkspacePath(rawPath) {
+	pathPart(rawPath);
+	if (!posix.isAbsolute(rawPath)) return unavailable$1();
+	return `posix:${posix.normalize(rawPath)}`;
+}
+async function wslWindowsPath(rawPath, signal) {
+	checkAbort(signal);
+	pathPart(rawPath);
+	if (!posix.isAbsolute(rawPath)) return unavailable$1();
 	try {
-		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
-		const descriptions = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
-		for (const session of verified.manifest.sessions) for (const part of session.parts) {
-			const spool = await spoolFacts(archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), descriptions.get(part.dataPath) ?? fail("ARTIFACT_INVALID_MANIFEST"), signal);
-			const partCleanup = createCleanup();
-			try {
-				await archive.fence();
-				let recordIndex = 0;
-				for await (const text of spool.lines) {
-					checkAbort(signal);
-					if (recordIndex >= part.retainedRecordCount) fail("ARTIFACT_INVALID_ARCHIVE");
-					yield {
-						entryPath: part.dataPath,
-						recordIndex,
-						archiveSessionId: session.id,
-						sourceId: part.sourceId,
-						harness: session.harness,
-						native: part.native,
-						text,
-						rowSha256: createHash("sha256").update(text).digest("hex")
-					};
-					recordIndex++;
-				}
-				if (recordIndex !== part.retainedRecordCount) fail("ARTIFACT_INVALID_ARCHIVE");
-			} catch (error) {
-				partCleanup.failed(error);
-				throw error;
-			} finally {
-				await partCleanup.run(() => spool.lines.return(void 0), () => spool.close());
-			}
-		}
-	} catch (error) {
-		cleanup.failed(error);
-		throw error;
-	} finally {
-		await cleanup.run(() => archive.close());
+		const { stdout } = await execute$1("wslpath", ["-w", rawPath], {
+			encoding: "utf8",
+			maxBuffer: 32768,
+			timeout: 15e3,
+			windowsHide: true,
+			signal
+		});
+		checkAbort(signal);
+		return stdout.replace(/\r?\n$/, "");
+	} catch {
+		checkAbort(signal);
+		return unavailable$1();
+	}
+}
+/** Translate Windows/WSL aliases lexically, including paths that no longer exist. */
+async function normalizeWorkspacePath(rawPath, signal) {
+	checkAbort(signal);
+	if (/^(?:[A-Za-z]:[\\/]|\\\\)/u.test(rawPath)) return normalizeWindowsWorkspacePath(rawPath);
+	if (platform() === "win32") {
+		const wslDrive = /^\/mnt\/([A-Za-z])(?:\/(.*))?$/u.exec(rawPath);
+		if (wslDrive) return normalizeWindowsWorkspacePath(`${wslDrive[1]}:\\${(wslDrive[2] ?? "").replaceAll("/", "\\")}`);
+		return normalizePosixWorkspacePath(rawPath);
 	}
+	if (platform() === "darwin") return normalizePosixWorkspacePath(rawPath);
+	if (platform() !== "linux") return unavailable$1();
+	const wsl = await isWsl();
+	checkAbort(signal);
+	if (wsl) return normalizeWindowsWorkspacePath(await wslWindowsPath(rawPath, signal));
+	return normalizePosixWorkspacePath(rawPath);
 }
 //#endregion
-//#region packages/artifact/src/configured/review/parse.ts
-const digest$2 = (text) => createHash("sha256").update(text).digest("hex");
-const hash$6 = (value) => {
-	const text = string(value);
-	if (!/^[a-f0-9]{64}$/u.test(text)) fail("ARTIFACT_INVALID_MANIFEST");
-	return text;
-};
-const pointer$3 = (value) => {
-	const text = string(value);
-	if (!text.startsWith("/") || /~(?:[^01]|$)/u.test(text)) fail("ARTIFACT_INVALID_MANIFEST");
-	return text;
-};
-const range$2 = (value) => {
-	const v = record$1(value);
-	keys(v, ["start", "end"]);
-	const start = integer(v["start"]), end = integer(v["end"]);
-	if (end <= start) fail("ARTIFACT_INVALID_MANIFEST");
-	return {
-		start,
-		end
-	};
-};
-function checkedRanges(value, length) {
-	const ranges = array(value, range$2);
-	let end = 0;
-	for (const r of ranges) {
-		if (r.start < end || r.end > length) fail("ARTIFACT_INVALID_MANIFEST");
-		end = r.end;
+//#region packages/artifact/src/collection/identity/environment.ts
+const execute = promisify(execFile);
+const unavailable = () => fail("ARTIFACT_ENVIRONMENT_UNAVAILABLE");
+async function run(file, args, signal) {
+	checkAbort(signal);
+	try {
+		const { stdout } = await execute(file, [...args], {
+			encoding: "utf8",
+			maxBuffer: 32768,
+			timeout: 15e3,
+			windowsHide: true,
+			signal
+		});
+		checkAbort(signal);
+		return stdout.trim();
+	} catch {
+		checkAbort(signal);
+		return unavailable();
 	}
-	return ranges;
 }
-function rowRanges(value, fields) {
-	const ranges = array(value, (value) => value);
-	if (ranges.length !== fields.length) fail("ARTIFACT_INVALID_MANIFEST");
-	return ranges.map((value, index) => {
-		return checkedRanges(value, (fields[index] ?? fail("ARTIFACT_INVALID_MANIFEST")).text.length);
-	});
+function identifier(value, pattern) {
+	const id = value.trim().toLowerCase();
+	if (id.length > 128 || !pattern.test(id) || /^0+$/.test(id.replaceAll("-", ""))) return unavailable();
+	return id;
 }
-function mask(value) {
-	const v = record$1(value);
-	keys(v, [
-		"inputRange",
-		"outputRange",
-		"replacement",
-		"stepId",
-		"node",
-		"ruleId"
-	]);
-	const node = record$1(v["node"]);
-	keys(node, ["id", "version"]);
-	const output = record$1(v["outputRange"]);
-	keys(output, ["start", "end"]);
-	const start = integer(output["start"]), end = integer(output["end"]);
-	const replacement = string(v["replacement"]);
-	if (end < start || end - start !== replacement.length) fail("ARTIFACT_INVALID_MANIFEST");
-	return {
-		inputRange: range$2(v["inputRange"]),
-		outputRange: {
-			start,
-			end
-		},
-		replacement,
-		stepId: string(v["stepId"]),
-		node: {
-			id: string(node["id"]),
-			version: string(node["version"])
-		},
-		ruleId: string(v["ruleId"])
-	};
+async function windowsInstallationId() {
+	const script = [
+		"$ErrorActionPreference='Stop'",
+		"$id=(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Cryptography').MachineGuid",
+		"if ([string]::IsNullOrWhiteSpace($id)) { exit 2 }",
+		"[Console]::Out.WriteLine($id)"
+	].join(";");
+	return identifier(await run("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-EncodedCommand",
+		Buffer.from(script, "utf16le").toString("base64")
+	]), /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/);
 }
-function field(value) {
-	const v = record$1(value);
-	keys(v, [
-		"pointer",
-		"cleanedPointer",
-		"originalPointer",
-		...v["originalRange"] === void 0 ? [] : ["originalRange"],
-		...v["originalFieldHash"] === void 0 ? [] : ["originalFieldHash"],
-		...v["innerPointer"] === void 0 ? [] : ["innerPointer"],
-		...v["scalarKind"] === void 0 ? [] : ["scalarKind"],
-		"role",
-		"text",
-		"fieldHash",
-		"staticMasks",
-		"nonPathMasks",
-		"protectedRanges",
-		...v["customRanges"] === void 0 ? [] : ["customRanges"]
+async function linuxInstallationId() {
+	try {
+		return identifier(await readFile("/etc/machine-id", "utf8"), /^[0-9a-f]{32}$/);
+	} catch {
+		return unavailable();
+	}
+}
+async function macInstallationId() {
+	const plist = await run("diskutil", [
+		"info",
+		"-plist",
+		"/"
 	]);
-	const role = v["role"];
-	if (role !== "user" && role !== "assistant" && role !== "tool-output") return fail("ARTIFACT_INVALID_MANIFEST");
-	const text = string(v["text"]), fieldHash = hash$6(v["fieldHash"]);
-	const scalarKind = v["scalarKind"];
-	if (scalarKind !== void 0 && scalarKind !== "literal" && scalarKind !== "structure" && scalarKind !== "container") return fail("ARTIFACT_INVALID_MANIFEST");
-	if (digest$2(text) !== fieldHash) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const result = {
-		pointer: pointer$3(v["pointer"]),
-		cleanedPointer: pointer$3(v["cleanedPointer"]),
-		originalPointer: pointer$3(v["originalPointer"]),
-		...v["originalRange"] === void 0 ? {} : { originalRange: range$2(v["originalRange"]) },
-		...v["originalFieldHash"] === void 0 ? {} : { originalFieldHash: hash$6(v["originalFieldHash"]) },
-		...v["innerPointer"] === void 0 ? {} : { innerPointer: pointer$3(v["innerPointer"]) },
-		...scalarKind === void 0 ? {} : { scalarKind },
-		role,
-		text,
-		fieldHash,
-		staticMasks: array(v["staticMasks"], mask),
-		nonPathMasks: array(v["nonPathMasks"], mask),
-		protectedRanges: array(v["protectedRanges"], range$2),
-		...v["customRanges"] === void 0 ? {} : { customRanges: array(v["customRanges"], range$2) }
-	};
-	if ([...result.staticMasks, ...result.nonPathMasks].some((m) => m.inputRange.end > text.length) || result.protectedRanges.some((r) => r.end > text.length) || result.customRanges?.some((r) => r.end > text.length) || result.originalRange === void 0 !== (result.originalFieldHash === void 0) || result.scalarKind === "structure" && (result.innerPointer !== void 0 || result.staticMasks.length > 0 || result.nonPathMasks.length > 0 || result.protectedRanges.length > 0 || (result.customRanges?.length ?? 0) > 0) || result.originalRange !== void 0 && (result.innerPointer !== void 0 || result.scalarKind !== void 0 || result.originalRange.end - result.originalRange.start !== text.length)) fail("ARTIFACT_INVALID_MANIFEST");
-	return result;
+	const match = /<key>APFSVolumeGroupID<\/key>\s*<string>([0-9a-fA-F-]+)<\/string>/.exec(plist);
+	if (!match) return unavailable();
+	return identifier(match[1] ?? "", /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/);
 }
-function parsePrivateReviewRow(text) {
-	const v = record$1(strictJson(text, 67108864));
-	keys(v, [
-		"entryPath",
-		"recordIndex",
-		"sourcePartId",
-		"sourceRecordIndex",
-		"archiveSessionId",
-		"outputSha256",
-		"cleanedText",
-		"fields",
-		"aiRanges"
-	]);
-	const parsedFields = array(v["fields"], field);
-	return {
-		entryPath: string(v["entryPath"]),
-		recordIndex: integer(v["recordIndex"]),
-		sourcePartId: string(v["sourcePartId"]),
-		sourceRecordIndex: integer(v["sourceRecordIndex"]),
-		archiveSessionId: string(v["archiveSessionId"]),
-		outputSha256: hash$6(v["outputSha256"]),
-		cleanedText: string(v["cleanedText"]),
-		fields: parsedFields,
-		aiRanges: rowRanges(v["aiRanges"], parsedFields)
-	};
+async function installationId() {
+	if (platform() === "win32") return installationEnvironmentId("windows-installation", await windowsInstallationId());
+	if (platform() === "darwin") return installationEnvironmentId("macos-apfs-installation", await macInstallationId());
+	if (platform() === "linux") {
+		if (await isWsl()) return installationEnvironmentId("windows-installation", await windowsInstallationId());
+		return installationEnvironmentId("linux-installation", await linuxInstallationId());
+	}
+	return unavailable();
 }
-function parsePrivateReviewManifest(text, entries, primary) {
-	const v = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
-	keys(v, [
-		"format",
-		"version",
-		"bundleId",
-		"workId",
-		"primary",
-		"entries",
-		"rows"
-	]);
-	const bound = record$1(v["primary"]);
-	keys(bound, ["sha256", "archiveBytes"]);
-	if (v["bundleId"] !== primary.manifest.bundleId || v["workId"] !== primary.manifest.work.id || bound["sha256"] !== primary.sha256 || bound["archiveBytes"] !== primary.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const descriptions = array(v["entries"], (value) => {
-		const e = record$1(value);
-		keys(e, [
-			"entryPath",
-			"kind",
-			"representation",
-			"byteLength",
-			"sha256",
-			"rows"
-		]);
-		return {
-			entryPath: string(e["entryPath"]),
-			kind: literal(e["kind"], "facts"),
-			representation: literal(e["representation"], "jsonl"),
-			byteLength: integer(e["byteLength"]),
-			sha256: hash$6(e["sha256"]),
-			rows: integer(e["rows"])
-		};
+let installationPromise;
+function waitForInstallation(id, signal) {
+	if (!signal) return id;
+	checkAbort(signal);
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(/* @__PURE__ */ new Error("ARTIFACT_ABORTED"));
+		signal.addEventListener("abort", onAbort, { once: true });
+		id.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
 	});
-	const expected = new Set(primary.manifest.sessions.flatMap((s) => s.parts.map((p) => `${p.dataPath}.review.jsonl`)));
-	let rows = 0;
-	for (const d of descriptions) {
-		const e = entries.get(d.entryPath);
-		if (!expected.delete(d.entryPath) || !e || e.compressionMethod !== 8 || e.uncompressedSize !== d.byteLength || d.byteLength > maximumPartBytes) fail("ARTIFACT_INVALID_ARCHIVE");
-		rows += d.rows;
-	}
-	if (expected.size || entries.size !== descriptions.length + 1 || rows !== integer(v["rows"])) fail("ARTIFACT_INVALID_ARCHIVE");
-	return {
-		format: literal(v["format"], "sess-pilot-private-b-review"),
-		version: literal(v["version"], 2),
-		bundleId: primary.manifest.bundleId,
-		workId: primary.manifest.work.id,
-		primary: {
-			sha256: primary.sha256,
-			archiveBytes: primary.archiveBytes
-		},
-		entries: descriptions,
-		rows
-	};
+}
+/** Same OS installation receives one stable namespace across process and state-dir changes. */
+async function resolveWorkspaceEnvironmentId(signal) {
+	checkAbort(signal);
+	if (!installationPromise) installationPromise = installationId().catch((error) => {
+		installationPromise = void 0;
+		throw error;
+	});
+	const id = await waitForInstallation(installationPromise, signal);
+	checkAbort(signal);
+	return id;
 }
 //#endregion
-//#region packages/artifact/src/configured/review/native.ts
-const reviewLimits = {
-	...defaultLimits,
-	maxRecordBytes: maximumRecordBytes,
-	maxUnitBytes: maximumRecordBytes,
-	maxOutputRecordBytes: maximumRecordBytes
-};
-function reviewNative(text, signal) {
-	return parseNativeRecord(text, reviewLimits, signal);
+//#region packages/artifact/src/collection/identity/remote.ts
+/** Versioned canonical form shared by archive producers and downstream consumers. */
+function canonicalRemote(value) {
+	const input = value.trim();
+	if (!input || Buffer.byteLength(input) > 16384) return fail("ARTIFACT_UNSAFE_REMOTE");
+	for (const character of input) {
+		const code = character.charCodeAt(0);
+		if (code < 32 || code === 127) return fail("ARTIFACT_UNSAFE_REMOTE");
+	}
+	if (input.startsWith("/") || /^[a-z]:[\\/]/i.test(input) || input.startsWith("\\\\")) return input.replaceAll("\\", "/");
+	const scp = /^[a-z][a-z0-9+.-]*:\/\//i.test(input) ? null : /^(?:[^@/\s]+@)?(\[[^\]]+\]|[^/:\s]+):([^:].*)$/.exec(input);
+	const candidate = scp?.[1] && scp[2] ? `ssh://${scp[1]}/${scp[2]}` : input;
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch (error) {
+		return fail("ARTIFACT_UNSAFE_REMOTE", { cause: error });
+	}
+	if (![
+		"https:",
+		"http:",
+		"ssh:",
+		"git:",
+		"file:"
+	].includes(url.protocol)) fail("ARTIFACT_UNSAFE_REMOTE");
+	url.username = "";
+	url.password = "";
+	url.search = "";
+	url.hash = "";
+	url.hostname = url.hostname.toLowerCase();
+	if (url.protocol === "ssh:" && url.port === "22" || url.protocol === "git:" && url.port === "9418") url.port = "";
+	if (url.protocol !== "file:") {
+		if (!url.hostname) fail("ARTIFACT_UNSAFE_REMOTE");
+		url.pathname = url.pathname.replace(/\/+$/, "").replace(/\.git$/, "");
+	}
+	return url.href;
 }
-function emptyNativeStructure(node) {
-	if (node.kind === "literal") return false;
-	if (node.kind === "string") return node.value.length === 0;
-	return node.kind === "array" ? node.items.every(emptyNativeStructure) : node.properties.every((property) => emptyNativeStructure(property.value));
+function hashRemote(canonical) {
+	return createHash("sha256").update("sess-pilot/git-remote/v1\0").update(canonical).digest("hex");
 }
-function nativePointer(root, pointer) {
-	let node = root;
-	if (pointer === "") return node;
-	if (!pointer.startsWith("/") || /~(?:[^01]|$)/u.test(pointer)) fail("ARTIFACT_PROCESSING_MISMATCH");
-	for (const key of pointer.slice(1).split("/").map((part) => part.replaceAll("~1", "/").replaceAll("~0", "~"))) node = (node.kind === "object" ? node.properties.find((property) => property.key.value === key)?.value : node.kind === "array" && /^(?:0|[1-9]\d*)$/u.test(key) ? node.items[Number(key)] : void 0) ?? fail("ARTIFACT_PROCESSING_MISMATCH");
-	return node;
+//#endregion
+//#region packages/artifact/src/collection/identity/workspace.ts
+async function workspaceIdentity(workspace, signal) {
+	checkAbort(signal);
+	const pathHash = workspace.path === null ? null : hashWorkspacePath(await normalizeWorkspacePath(workspace.path, signal), await resolveWorkspaceEnvironmentId(signal));
+	const remotes = workspace.remotes.map((remote) => {
+		const url = canonicalRemote(remote);
+		return {
+			url,
+			hash: hashRemote(url)
+		};
+	});
+	const primaryRemoteHash = workspace.primaryRemote ? hashRemote(canonicalRemote(workspace.primaryRemote.locator)) : null;
+	if (primaryRemoteHash !== null && !remotes.some((remote) => remote.hash === primaryRemoteHash)) fail("ARTIFACT_UNSAFE_REMOTE");
+	const challengeId = await readChallengeId(workspace.path, signal);
+	checkAbort(signal);
+	return {
+		title: workspace.title,
+		path: workspace.path,
+		pathHash,
+		remotes,
+		primaryRemoteHash,
+		challengeId
+	};
 }
-/** Exact numeric-array lexemes for grouped geography, including targets decoded from native strings. */
-function nativeContainerText(node, signal) {
-	if (node.kind !== "array") return void 0;
-	const numeric = (value) => {
-		signal.throwIfAborted();
-		return value.kind === "array" ? value.items.every(numeric) : value.kind === "literal" && Number.isFinite(Number(value.raw));
+function workspaceMetadata(identity) {
+	return {
+		version: 3,
+		title: identity.title,
+		pathHash: identity.pathHash,
+		remoteHashes: identity.remotes.map((remote) => remote.hash),
+		primaryRemoteHash: identity.primaryRemoteHash
 	};
-	return numeric(node) ? renderNative(node, /* @__PURE__ */ new Map(), reviewLimits, signal).text : void 0;
 }
-//#endregion
-//#region packages/artifact/src/configured/review/read.ts
-async function checkPrivateReviewProjection(file, primary, signal) {
-	const output = await checkFrozenOutput(primary, signal);
-	let manifest;
+function bundleIdentityMap(bundleId, identity) {
 	return {
-		checked: await checkWrittenArchive(file.path, file.identity, void 0, (text, entries) => {
-			manifest = parsePrivateReviewManifest(text, entries, {
-				manifest: output.manifest,
-				sha256: primary.sha256,
-				archiveBytes: primary.archiveBytes
-			});
-		}, signal),
-		manifest: manifest ?? fail("ARTIFACT_INVALID_ARCHIVE"),
-		output: output.manifest
+		format: "sess-pilot-bundle-identity-map",
+		formatVersion: 1,
+		bundleId,
+		workspace: {
+			path: identity.path,
+			pathHash: identity.pathHash,
+			remotes: identity.remotes,
+			primaryRemoteHash: identity.primaryRemoteHash
+		}
 	};
 }
-/** Internal reconstruction iterator; callers exposing model input must use the field-only iterator. */
-async function* readPrivateReviewRows(request, signal) {
-	const { projection, primary } = request;
-	const verified = await checkPrivateReviewProjection(projection, primary, signal);
-	if (projection.primarySha256 !== primary.sha256 || projection.rows !== verified.manifest.rows) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const archive = await openCheckedOutput(projection, verified.checked, signal);
-	const output = readConfiguredOutputRows(primary, signal);
-	const parts = new Map(verified.output.sessions.flatMap((session) => session.parts.map((part) => [part.dataPath, {
-		part,
-		sessionId: session.id
-	}])));
-	let next = await output.next();
-	const cleanup = createCleanup();
+//#endregion
+//#region packages/artifact/src/collection/producer/workspace-metadata.ts
+/** Workspace titles are emitted once, independently of per-session optional profiles. */
+async function configuredWorkspaceMetadata(identity, processing, signal, titlePlan, onMasks, replacementScope) {
+	const metadata = workspaceMetadata(identity);
+	const terms = processing.customTerms?.terms ?? [];
+	if (terms.length === 0 && titlePlan === void 0) return metadata;
+	const preparation = createSessionPreparation({
+		environment: processing.environment,
+		customTerms: terms,
+		...processing.staticExceptions === void 0 ? {} : { staticExceptions: processing.staticExceptions.values },
+		...processing.replacementKey === void 0 ? {} : { replacementKey: processing.replacementKey },
+		...replacementScope === void 0 ? {} : { replacementScope }
+	}, signal);
+	let bindings;
 	try {
-		for (const description of verified.manifest.entries) {
-			const spool = await spoolFacts(archive.entries.get(description.entryPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), description, signal);
-			const partCleanup = createCleanup();
-			let rows = 0, last = -1;
-			try {
-				for await (const text of spool.lines) {
-					const row = parsePrivateReviewRow(text), part = parts.get(row.entryPath);
-					if (!part || part.part.native.role !== "main" || row.archiveSessionId !== part.sessionId || `${row.entryPath}.review.jsonl` !== description.entryPath || row.recordIndex <= last || row.recordIndex >= part.part.retainedRecordCount || row.sourceRecordIndex >= part.part.recordCount) fail("ARTIFACT_INVALID_ARCHIVE");
-					while (!next.done && (next.value.entryPath !== row.entryPath || next.value.recordIndex < row.recordIndex)) next = await output.next();
-					if (next.done || next.value.entryPath !== row.entryPath || next.value.recordIndex !== row.recordIndex || next.value.rowSha256 !== row.outputSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
-					const root = reviewNative(row.cleanedText, signal), actual = reviewNative(next.value.text, signal), seen = /* @__PURE__ */ new Set();
-					for (const field of row.fields) {
-						const key = JSON.stringify([field.pointer, field.innerPointer ?? null]);
-						if (seen.has(key)) fail("ARTIFACT_PROCESSING_MISMATCH");
-						seen.add(key);
-						let source = nativePointer(root, field.cleanedPointer);
-						const target = nativePointer(actual, field.pointer), nativeLiteral = field.scalarKind === "literal" && field.innerPointer === void 0;
-						if (field.scalarKind === "container" && field.innerPointer === void 0 ? nativeContainerText(source, signal) === void 0 || !["array", "string"].includes(target.kind) : nativeLiteral ? source.kind !== "literal" || !["literal", "string"].includes(target.kind) : source.kind !== "string" || target.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
-						if (field.scalarKind === "structure") {
-							if (source.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
-							const structure = reviewNative(source.value, signal);
-							if (!["object", "array"].includes(structure.kind) || !emptyNativeStructure(structure)) fail("ARTIFACT_PROCESSING_MISMATCH");
-						}
-						if (field.innerPointer !== void 0) {
-							if (source.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
-							source = nativePointer(reviewNative(source.value, signal), field.innerPointer);
-						}
-						const text = field.scalarKind === "container" ? nativeContainerText(source, signal) : field.scalarKind === "literal" ? source.kind === "literal" ? source.raw : void 0 : source.kind === "string" ? source.value : void 0;
-						if (text === void 0 || text !== field.text || createHash("sha256").update(text).digest("hex") !== field.fieldHash) fail("ARTIFACT_PROCESSING_MISMATCH");
-					}
-					rows++;
-					last = row.recordIndex;
-					yield row;
-				}
-				if (rows !== description.rows) fail("ARTIFACT_INVALID_ARCHIVE");
-			} catch (error) {
-				partCleanup.failed(error);
-				throw error;
-			} finally {
-				await partCleanup.run(() => spool.lines.return(void 0), () => spool.close());
-			}
-			await archive.fence();
+		if (titlePlan) {
+			const seeds = await processing.gitNames(identity.path === null ? [] : [identity.path], signal);
+			for (const name of seeds.names) preparation.gitName(name);
 		}
-	} catch (error) {
-		cleanup.failed(error);
-		throw error;
+		preparation.original(metadata.title, false);
+		bindings = preparation.finish();
+		const input = {
+			attemptId: "workspace-metadata",
+			sourceRef: "workspace-metadata",
+			unitId: "title",
+			text: metadata.title,
+			...onMasks ? { captureMasks: true } : {}
+		};
+		async function* units() {
+			yield input;
+		}
+		let title;
+		for await (const output of processing.processor.transform(units(), withMandatoryCustomTerms(titlePlan ?? buildPlan([], [])), signal, bindings.session)) {
+			if (title !== void 0 || output.unitId !== input.unitId || output.sourceRef !== input.sourceRef || output.attemptId !== input.attemptId) fail("ARTIFACT_PROCESSING_FAILED");
+			title = output.text;
+			onMasks?.(input.text, output);
+		}
+		if (title === void 0) return fail("ARTIFACT_PROCESSING_FAILED");
+		return {
+			...metadata,
+			title
+		};
 	} finally {
-		await cleanup.run(() => output.return(void 0), () => archive.close());
+		bindings?.close();
+		preparation.close();
 	}
 }
 //#endregion
-//#region packages/artifact/src/configured/review/rules.ts
-const generic = /* @__PURE__ */ new Set([
-	"src",
-	"lib",
-	"test",
-	"tests",
-	"docs",
-	"README.md",
-	"package.json",
-	"pnpm-lock.yaml",
-	"index.ts",
-	"main.ts",
-	"index.js",
-	".claude.json",
-	".codex",
-	"config.toml"
-]);
-/** Dipper B v6.2 component policy, translated to native UTF-16 coordinates. */
-function componentPaths(text, fullPath = false) {
-	const found = [];
-	for (const match of text.matchAll(/(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)[^\r\n"'`<>[\];|]+/gu)) {
-		let raw = match[0];
-		const separator = raw.includes("\\") ? "\\" : "/";
-		raw = (raw.split(/\s+(?:&&|\|\||--\w|(?:and|then|with|to|from|is)\s)/u)[0] ?? "").replace(/[.,):\s]+$/u, "");
-		const quoted = [
-			"\"",
-			"'",
-			"`"
-		].includes(text[match.index - 1] ?? ""), bracketed = /\[(?:project|workspace):\s*$/u.test(text.slice(0, match.index));
-		if (!quoted && !bracketed && !fullPath) {
-			const token = `Desktop${separator}Folders`;
-			raw = (raw.replace(`Desktop Folders${separator}`, token).split(/\s/u)[0] ?? "").replace(token, `Desktop Folders${separator}`);
-		}
-		const root = /^(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)/u.exec(raw)?.[0];
-		if (!root) continue;
-		const parts = raw.slice(root.length).split(separator);
-		if (!parts[0] || /\s/u.test(parts[0])) continue;
-		let offset = root.length;
-		const coords = parts.map((value) => {
-			const range = {
-				value,
-				start: match.index + offset,
-				end: match.index + offset + value.length
-			};
-			offset += value.length + separator.length;
-			return range;
-		});
-		const first = coords[0];
-		if (!first) continue;
-		const components = [{
-			start: first.start,
-			end: first.end
-		}];
-		let project = -1;
-		if (parts.length > 1) {
-			if ([
-				"Desktop",
-				"Desktop Folders",
-				"Documents",
-				"Projects",
-				"workspace",
-				"workspaces",
-				"repos",
-				"code"
-			].includes(parts[1] ?? "")) project = parts.length > 2 ? 2 : -1;
-			else if (!(parts[1] ?? "").startsWith(".")) project = 1;
-		}
-		for (let index = 1; index < coords.length; index++) {
-			const value = coords[index];
-			if (!value?.value || index === 1 && project === 2) continue;
-			if (index === project || !generic.has(value.value)) components.push({
-				start: value.start,
-				end: value.end
-			});
+//#region packages/artifact/src/configured/journey/metadata-spans.ts
+/** Raw semantic boundaries expand over actual static replacements; static text is never restored. */
+function metadataOutputSpans(text, masks, semantic) {
+	if (!semantic) return [];
+	if (semantic.textSha256 !== createHash("sha256").update(text).digest("hex") || semantic.spans.length > 5e4) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const ordered = masks.toSorted((a, b) => a.inputRange.start - b.inputRange.start);
+	const map = (position, edge) => {
+		let delta = 0;
+		for (const mask of ordered) {
+			if (position <= mask.inputRange.start) break;
+			if (position < mask.inputRange.end) return edge === "start" ? mask.outputRange.start : mask.outputRange.end;
+			delta += mask.replacement.length - (mask.inputRange.end - mask.inputRange.start);
 		}
-		found.push({
-			start: match.index,
-			end: match.index + raw.length,
-			components
-		});
-	}
-	return found;
-}
-/** Only isolated low-information values inside an explicitly marked CLI example section. */
-function helpSentinels(text) {
-	if (!/^Usage:/mu.test(text) || !/^Examples:/mu.test(text)) return [];
-	const begin = text.indexOf("Examples:"), end = text.indexOf("\nOptions:", begin), zone = text.slice(begin, end < 0 ? text.length : end), result = [];
-	for (const match of zone.matchAll(/\b(?:API_KEY|api_key|TOKEN|password)=(xxx|\.\.\.|<API_KEY>|<TOKEN>)(?=\s|$)/gu)) {
-		const value = match[1];
-		if (!value) continue;
-		const start = begin + match.index + match[0].lastIndexOf(value);
-		result.push({
+		return position + delta;
+	};
+	const mapped = semantic.spans.flatMap((span) => {
+		if (!Number.isSafeInteger(span.start) || !Number.isSafeInteger(span.end) || span.start < 0 || span.end <= span.start || span.end > text.length || !scalarBoundary(text, span.start) || !scalarBoundary(text, span.end)) fail("ARTIFACT_PROCESSING_MISMATCH");
+		const category = maskCategory(span.category);
+		const start = map(span.start, "start"), end = map(span.end, "end");
+		return start === end ? [] : [{
 			start,
-			end: start + value.length
-		});
+			end,
+			category
+		}];
+	}).sort((a, b) => a.start - b.start || b.end - a.end);
+	const result = [];
+	for (const span of mapped) {
+		const previous = result.at(-1);
+		if (previous && span.start < previous.end) {
+			const category = categoryOrder.indexOf(maskCategory(previous.category)) >= categoryOrder.indexOf(span.category) ? previous.category : span.category;
+			result[result.length - 1] = {
+				start: previous.start,
+				end: Math.max(previous.end, span.end),
+				category
+			};
+		} else result.push(span);
 	}
 	return result;
 }
 //#endregion
-//#region packages/artifact/src/configured/review/ranges.ts
-function staticSpan(mask) {
-	return {
-		...mask.inputRange,
-		category: staticMaskCategory(mask.node.id),
-		causes: [{
-			kind: "static",
-			range: mask.inputRange,
-			stepId: mask.stepId,
-			node: mask.node,
-			ruleId: mask.ruleId
-		}]
-	};
-}
-/** These are deterministic B rules, independent of a model's occurrence decisions. */
-function policySpan(range, nodeId, ruleId) {
-	return {
-		...range,
-		category: staticMaskCategory(nodeId),
-		causes: [{
-			kind: "static",
-			range,
-			node: {
-				id: nodeId,
-				version: "sesspilot-b-v1"
-			},
-			stepId: "sesspilot-b-v1",
-			ruleId
-		}]
-	};
-}
-function subtract(input, retained) {
-	return input.flatMap((range) => {
+//#region packages/artifact/src/configured/journey/metadata-fields.ts
+/** This accepts private raw proposals once. Safe strings must never be re-ingested as originals. */
+async function processJourneyMetadataFields(request, signal = new AbortController().signal) {
+	const { workId, fields, processing, redactionPlan } = request;
+	if (!/^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/u.test(workId) || processing.staticExceptions !== void 0 && processing.staticExceptions.workId !== workId || fields.length > 16 || fields.some(({ text }) => !text.isWellFormed() || Buffer.byteLength(text) > 16384) || fields.reduce((sum, { text }) => sum + Buffer.byteLength(text), 0) > 65536) fail("ARTIFACT_INVALID_APPROVAL");
+	const results = [];
+	let bytes = 0;
+	for (const field of fields) {
+		checkAbort(signal);
+		if (field.semantic && field.processedSemantic) fail("ARTIFACT_INVALID_APPROVAL");
+		let staticMasks;
+		const output = await configuredWorkspaceMetadata({
+			title: field.text,
+			path: null,
+			pathHash: null,
+			remotes: [],
+			primaryRemoteHash: null,
+			challengeId: null
+		}, processing, signal, redactionPlan, (input, processed) => {
+			staticMasks = titleMasks(input, processed);
+		}, processing.replacementKey === void 0 ? void 0 : `work-metadata:${workId}`);
+		const masks = staticMasks ?? fail("ARTIFACT_PROCESSING_FAILED");
+		const spans = field.processedSemantic ? metadataOutputSpans(output.title, [], field.processedSemantic) : metadataOutputSpans(field.text, masks, field.semantic);
+		let text = output.title;
+		const transcripts = [];
+		if (spans.length) {
+			const markers = createSemanticMarkers(processing.replacementKey ?? fail("ARTIFACT_INVALID_APPROVAL"), workId);
+			try {
+				const inputSha256 = createHash("sha256").update(text).digest("hex");
+				const input = text;
+				text = replaceSemanticSpans(input, spans, markers, (span, replacement, start) => {
+					const contextStart = Math.max(0, span.start - 120);
+					transcripts.push({
+						pointer: "/title",
+						inputSha256,
+						inputRange: {
+							start: span.start,
+							end: span.end
+						},
+						outputRange: {
+							start,
+							end: start + replacement.length
+						},
+						replacement,
+						category: maskCategory(span.category),
+						context: {
+							start: contextStart,
+							text: input.slice(contextStart, Math.min(input.length, contextStart + 512, span.end + 120))
+						}
+					});
+				});
+			} finally {
+				markers.close();
+			}
+		}
+		bytes += Buffer.byteLength(text);
+		if (Buffer.byteLength(text) > 32768 || bytes > 65536) fail("ARTIFACT_METADATA_LIMIT");
+		const outputSha256 = createHash("sha256").update(text).digest("hex");
+		results.push({
+			text,
+			staticMasks: masks,
+			semanticTranscript: transcripts.map((item) => ({
+				...item,
+				outputSha256
+			}))
+		});
+	}
+	return results;
+}
+//#endregion
+//#region packages/artifact/src/configured/output/metadata.ts
+async function updateOutputWorkMetadata(text, manifest, request, signal, onTitleMasks) {
+	const work = parseConfiguredWorkMetadata(strictJson(text, metadataLimitBytes));
+	if (work.id !== manifest.work.id) fail("ARTIFACT_INVALID_MANIFEST");
+	const update = request.metadata;
+	if (!update) return text;
+	if ((update.titleSemantic || update.titleProcessedSemantic) && update.title === void 0) fail("ARTIFACT_INVALID_APPROVAL");
+	let title = work.title;
+	if (update.cachedTitle) {
+		if (update.title !== void 0 || update.titleSemantic || update.titleProcessedSemantic) fail("ARTIFACT_INVALID_APPROVAL");
+		const cached = update.cachedTitle;
+		const sha256 = createHash("sha256").update(cached.text).digest("hex");
+		if (sha256 !== cached.semantic.textSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
+		const markers = createSemanticMarkers(request.replacementKey, request.workId);
+		const transcripts = [];
+		try {
+			rejectSemanticMarkerPrefix(cached.text, markers);
+			title = maskOutputField({
+				pointer: "/title",
+				text: cached.text,
+				sha256
+			}, cached.semantic.spans, {
+				...markers,
+				marker: () => "[hidden]"
+			}, { bytes: 0 }, (value) => transcripts.push(value));
+		} finally {
+			markers.close();
+		}
+		onTitleMasks?.({
+			text: title,
+			staticMasks: cached.staticMasks,
+			semanticTranscript: transcripts
+		});
+	} else if (update.title !== void 0) {
+		if (!update.title.trim() || Buffer.byteLength(update.title) > 16384) fail("ARTIFACT_INVALID_APPROVAL");
+		const treatment = manifest.configuration.definitions.find((item) => item.id === manifest.sessions[0]?.treatmentId) ?? fail("ARTIFACT_INVALID_MANIFEST");
+		const metadata = (await processJourneyMetadataFields({
+			workId: manifest.work.id,
+			fields: [{
+				text: update.title,
+				...update.titleSemantic ? { semantic: update.titleSemantic } : {},
+				...update.titleProcessedSemantic ? { processedSemantic: update.titleProcessedSemantic } : {}
+			}],
+			processing: {
+				...request.processing,
+				replacementKey: request.replacementKey
+			},
+			redactionPlan: treatment.redactionPlan
+		}, signal))[0] ?? fail("ARTIFACT_PROCESSING_FAILED");
+		title = metadata.text;
+		onTitleMasks?.(metadata);
+	}
+	const changed = parseConfiguredWorkMetadata({
+		...work,
+		title,
+		access: update.access ?? work.access
+	});
+	return JSON.stringify(changed);
+}
+//#endregion
+//#region packages/artifact/src/configured/output/read.ts
+async function verifiedMetadata(entry, description, signal) {
+	const text = await readMetadata(entry, signal);
+	if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
+	return strictJson(text, metadataLimitBytes);
+}
+async function readConfiguredOutputInfo(input, signal = new AbortController().signal) {
+	const verified = await checkFrozenOutput(input, signal);
+	const archive = await openCheckedOutput(input, verified.checked, signal);
+	const cleanup = createCleanup();
+	try {
+		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
+		const path = verified.manifest.work.metadataPath;
+		const description = verified.manifest.entries.find((entry) => entry.entryPath === path) ?? fail("ARTIFACT_INVALID_MANIFEST");
+		const work = parseConfiguredWorkMetadata(await verifiedMetadata(archive.entries.get(path) ?? fail("ARTIFACT_INVALID_ARCHIVE"), description, signal));
+		if (work.id !== verified.manifest.work.id) fail("ARTIFACT_INVALID_MANIFEST");
+		const sources = [];
+		for (const source of verified.manifest.sourceWorkspaces) {
+			const metadata = validateConfiguredSourceMetadata(await verifiedMetadata(archive.entries.get(source.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), verified.manifest.entries.find((candidate) => candidate.entryPath === source.metadataPath) ?? fail("ARTIFACT_INVALID_MANIFEST"), signal), source);
+			sources.push({
+				id: source.id,
+				pathHash: metadata.pathHash,
+				remoteHashes: metadata.remoteHashes,
+				primaryRemoteHash: metadata.primaryRemoteHash,
+				...source.challengeId === void 0 ? {} : { challengeId: source.challengeId }
+			});
+		}
+		return {
+			manifest: verified.manifest,
+			work,
+			checked: verified.checked,
+			sources,
+			createdAt: verified.manifest.createdAt,
+			sessionCount: verified.manifest.sessions.length
+		};
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(() => archive.close());
+	}
+}
+/** Model-safe rows only: read a digest-bound static primary, never its original source. */
+async function* readConfiguredOutputRows(input, signal = new AbortController().signal) {
+	const verified = await checkFrozenOutput(input, signal);
+	const archive = await openCheckedOutput(input, verified.checked, signal);
+	const cleanup = createCleanup();
+	try {
+		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
+		const descriptions = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
+		for (const session of verified.manifest.sessions) for (const part of session.parts) {
+			const spool = await spoolFacts(archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), descriptions.get(part.dataPath) ?? fail("ARTIFACT_INVALID_MANIFEST"), signal);
+			const partCleanup = createCleanup();
+			try {
+				await archive.fence();
+				let recordIndex = 0;
+				for await (const text of spool.lines) {
+					checkAbort(signal);
+					if (recordIndex >= part.retainedRecordCount) fail("ARTIFACT_INVALID_ARCHIVE");
+					yield {
+						entryPath: part.dataPath,
+						recordIndex,
+						archiveSessionId: session.id,
+						sourceId: part.sourceId,
+						harness: session.harness,
+						native: part.native,
+						text,
+						rowSha256: createHash("sha256").update(text).digest("hex")
+					};
+					recordIndex++;
+				}
+				if (recordIndex !== part.retainedRecordCount) fail("ARTIFACT_INVALID_ARCHIVE");
+			} catch (error) {
+				partCleanup.failed(error);
+				throw error;
+			} finally {
+				await partCleanup.run(() => spool.lines.return(void 0), () => spool.close());
+			}
+		}
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(() => archive.close());
+	}
+}
+//#endregion
+//#region packages/artifact/src/configured/review/parse.ts
+const digest$2 = (text) => createHash("sha256").update(text).digest("hex");
+const hash$6 = (value) => {
+	const text = string(value);
+	if (!/^[a-f0-9]{64}$/u.test(text)) fail("ARTIFACT_INVALID_MANIFEST");
+	return text;
+};
+const pointer$3 = (value) => {
+	const text = string(value);
+	if (!text.startsWith("/") || /~(?:[^01]|$)/u.test(text)) fail("ARTIFACT_INVALID_MANIFEST");
+	return text;
+};
+const range$2 = (value) => {
+	const v = record$1(value);
+	keys(v, ["start", "end"]);
+	const start = integer(v["start"]), end = integer(v["end"]);
+	if (end <= start) fail("ARTIFACT_INVALID_MANIFEST");
+	return {
+		start,
+		end
+	};
+};
+function checkedRanges(value, length) {
+	const ranges = array(value, range$2);
+	let end = 0;
+	for (const r of ranges) {
+		if (r.start < end || r.end > length) fail("ARTIFACT_INVALID_MANIFEST");
+		end = r.end;
+	}
+	return ranges;
+}
+function rowRanges(value, fields) {
+	const ranges = array(value, (value) => value);
+	if (ranges.length !== fields.length) fail("ARTIFACT_INVALID_MANIFEST");
+	return ranges.map((value, index) => {
+		return checkedRanges(value, (fields[index] ?? fail("ARTIFACT_INVALID_MANIFEST")).text.length);
+	});
+}
+function mask(value) {
+	const v = record$1(value);
+	keys(v, [
+		"inputRange",
+		"outputRange",
+		"replacement",
+		"stepId",
+		"node",
+		"ruleId"
+	]);
+	const node = record$1(v["node"]);
+	keys(node, ["id", "version"]);
+	const output = record$1(v["outputRange"]);
+	keys(output, ["start", "end"]);
+	const start = integer(output["start"]), end = integer(output["end"]);
+	const replacement = string(v["replacement"]);
+	if (end < start || end - start !== replacement.length) fail("ARTIFACT_INVALID_MANIFEST");
+	return {
+		inputRange: range$2(v["inputRange"]),
+		outputRange: {
+			start,
+			end
+		},
+		replacement,
+		stepId: string(v["stepId"]),
+		node: {
+			id: string(node["id"]),
+			version: string(node["version"])
+		},
+		ruleId: string(v["ruleId"])
+	};
+}
+function field(value) {
+	const v = record$1(value);
+	keys(v, [
+		"pointer",
+		"cleanedPointer",
+		"originalPointer",
+		...v["originalRange"] === void 0 ? [] : ["originalRange"],
+		...v["originalFieldHash"] === void 0 ? [] : ["originalFieldHash"],
+		...v["innerPointer"] === void 0 ? [] : ["innerPointer"],
+		...v["scalarKind"] === void 0 ? [] : ["scalarKind"],
+		"role",
+		"text",
+		"fieldHash",
+		"staticMasks",
+		"nonPathMasks",
+		"protectedRanges",
+		...v["customRanges"] === void 0 ? [] : ["customRanges"]
+	]);
+	const role = v["role"];
+	if (role !== "user" && role !== "assistant" && role !== "tool-output") return fail("ARTIFACT_INVALID_MANIFEST");
+	const text = string(v["text"]), fieldHash = hash$6(v["fieldHash"]);
+	const scalarKind = v["scalarKind"];
+	if (scalarKind !== void 0 && scalarKind !== "literal" && scalarKind !== "structure" && scalarKind !== "container") return fail("ARTIFACT_INVALID_MANIFEST");
+	if (digest$2(text) !== fieldHash) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const result = {
+		pointer: pointer$3(v["pointer"]),
+		cleanedPointer: pointer$3(v["cleanedPointer"]),
+		originalPointer: pointer$3(v["originalPointer"]),
+		...v["originalRange"] === void 0 ? {} : { originalRange: range$2(v["originalRange"]) },
+		...v["originalFieldHash"] === void 0 ? {} : { originalFieldHash: hash$6(v["originalFieldHash"]) },
+		...v["innerPointer"] === void 0 ? {} : { innerPointer: pointer$3(v["innerPointer"]) },
+		...scalarKind === void 0 ? {} : { scalarKind },
+		role,
+		text,
+		fieldHash,
+		staticMasks: array(v["staticMasks"], mask),
+		nonPathMasks: array(v["nonPathMasks"], mask),
+		protectedRanges: array(v["protectedRanges"], range$2),
+		...v["customRanges"] === void 0 ? {} : { customRanges: array(v["customRanges"], range$2) }
+	};
+	if ([...result.staticMasks, ...result.nonPathMasks].some((m) => m.inputRange.end > text.length) || result.protectedRanges.some((r) => r.end > text.length) || result.customRanges?.some((r) => r.end > text.length) || result.originalRange === void 0 !== (result.originalFieldHash === void 0) || result.scalarKind === "structure" && (result.innerPointer !== void 0 || result.staticMasks.length > 0 || result.nonPathMasks.length > 0 || result.protectedRanges.length > 0 || (result.customRanges?.length ?? 0) > 0) || result.originalRange !== void 0 && (result.innerPointer !== void 0 || result.scalarKind !== void 0 || result.originalRange.end - result.originalRange.start !== text.length)) fail("ARTIFACT_INVALID_MANIFEST");
+	return result;
+}
+function parsePrivateReviewRow(text) {
+	const v = record$1(strictJson(text, 67108864));
+	keys(v, [
+		"entryPath",
+		"recordIndex",
+		"sourcePartId",
+		"sourceRecordIndex",
+		"archiveSessionId",
+		"outputSha256",
+		"cleanedText",
+		"fields",
+		"aiRanges"
+	]);
+	const parsedFields = array(v["fields"], field);
+	return {
+		entryPath: string(v["entryPath"]),
+		recordIndex: integer(v["recordIndex"]),
+		sourcePartId: string(v["sourcePartId"]),
+		sourceRecordIndex: integer(v["sourceRecordIndex"]),
+		archiveSessionId: string(v["archiveSessionId"]),
+		outputSha256: hash$6(v["outputSha256"]),
+		cleanedText: string(v["cleanedText"]),
+		fields: parsedFields,
+		aiRanges: rowRanges(v["aiRanges"], parsedFields)
+	};
+}
+function parsePrivateReviewManifest(text, entries, primary) {
+	const v = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	keys(v, [
+		"format",
+		"version",
+		"bundleId",
+		"workId",
+		"primary",
+		"entries",
+		"rows"
+	]);
+	const bound = record$1(v["primary"]);
+	keys(bound, ["sha256", "archiveBytes"]);
+	if (v["bundleId"] !== primary.manifest.bundleId || v["workId"] !== primary.manifest.work.id || bound["sha256"] !== primary.sha256 || bound["archiveBytes"] !== primary.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const descriptions = array(v["entries"], (value) => {
+		const e = record$1(value);
+		keys(e, [
+			"entryPath",
+			"kind",
+			"representation",
+			"byteLength",
+			"sha256",
+			"rows"
+		]);
+		return {
+			entryPath: string(e["entryPath"]),
+			kind: literal(e["kind"], "facts"),
+			representation: literal(e["representation"], "jsonl"),
+			byteLength: integer(e["byteLength"]),
+			sha256: hash$6(e["sha256"]),
+			rows: integer(e["rows"])
+		};
+	});
+	const expected = new Set(primary.manifest.sessions.flatMap((s) => s.parts.map((p) => `${p.dataPath}.review.jsonl`)));
+	let rows = 0;
+	for (const d of descriptions) {
+		const e = entries.get(d.entryPath);
+		if (!expected.delete(d.entryPath) || !e || e.compressionMethod !== 8 || e.uncompressedSize !== d.byteLength || d.byteLength > maximumPartBytes) fail("ARTIFACT_INVALID_ARCHIVE");
+		rows += d.rows;
+	}
+	if (expected.size || entries.size !== descriptions.length + 1 || rows !== integer(v["rows"])) fail("ARTIFACT_INVALID_ARCHIVE");
+	return {
+		format: literal(v["format"], "sess-pilot-private-b-review"),
+		version: literal(v["version"], 2),
+		bundleId: primary.manifest.bundleId,
+		workId: primary.manifest.work.id,
+		primary: {
+			sha256: primary.sha256,
+			archiveBytes: primary.archiveBytes
+		},
+		entries: descriptions,
+		rows
+	};
+}
+//#endregion
+//#region packages/artifact/src/configured/review/native.ts
+const reviewLimits = {
+	...defaultLimits,
+	maxRecordBytes: maximumRecordBytes,
+	maxUnitBytes: maximumRecordBytes,
+	maxOutputRecordBytes: maximumRecordBytes
+};
+function reviewNative(text, signal) {
+	return parseNativeRecord(text, reviewLimits, signal);
+}
+function emptyNativeStructure(node) {
+	if (node.kind === "literal") return false;
+	if (node.kind === "string") return node.value.length === 0;
+	return node.kind === "array" ? node.items.every(emptyNativeStructure) : node.properties.every((property) => emptyNativeStructure(property.value));
+}
+function nativePointer(root, pointer) {
+	let node = root;
+	if (pointer === "") return node;
+	if (!pointer.startsWith("/") || /~(?:[^01]|$)/u.test(pointer)) fail("ARTIFACT_PROCESSING_MISMATCH");
+	for (const key of pointer.slice(1).split("/").map((part) => part.replaceAll("~1", "/").replaceAll("~0", "~"))) node = (node.kind === "object" ? node.properties.find((property) => property.key.value === key)?.value : node.kind === "array" && /^(?:0|[1-9]\d*)$/u.test(key) ? node.items[Number(key)] : void 0) ?? fail("ARTIFACT_PROCESSING_MISMATCH");
+	return node;
+}
+/** Exact numeric-array lexemes for grouped geography, including targets decoded from native strings. */
+function nativeContainerText(node, signal) {
+	if (node.kind !== "array") return void 0;
+	const numeric = (value) => {
+		signal.throwIfAborted();
+		return value.kind === "array" ? value.items.every(numeric) : value.kind === "literal" && Number.isFinite(Number(value.raw));
+	};
+	return numeric(node) ? renderNative(node, /* @__PURE__ */ new Map(), reviewLimits, signal).text : void 0;
+}
+//#endregion
+//#region packages/artifact/src/configured/review/read.ts
+async function checkPrivateReviewProjection(file, primary, signal) {
+	const output = await checkFrozenOutput(primary, signal);
+	let manifest;
+	return {
+		checked: await checkWrittenArchive(file.path, file.identity, void 0, (text, entries) => {
+			manifest = parsePrivateReviewManifest(text, entries, {
+				manifest: output.manifest,
+				sha256: primary.sha256,
+				archiveBytes: primary.archiveBytes
+			});
+		}, signal),
+		manifest: manifest ?? fail("ARTIFACT_INVALID_ARCHIVE"),
+		output: output.manifest
+	};
+}
+/** Internal reconstruction iterator; callers exposing model input must use the field-only iterator. */
+async function* readPrivateReviewRows(request, signal) {
+	const { projection, primary } = request;
+	const verified = await checkPrivateReviewProjection(projection, primary, signal);
+	if (projection.primarySha256 !== primary.sha256 || projection.rows !== verified.manifest.rows) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const archive = await openCheckedOutput(projection, verified.checked, signal);
+	const output = readConfiguredOutputRows(primary, signal);
+	const parts = new Map(verified.output.sessions.flatMap((session) => session.parts.map((part) => [part.dataPath, {
+		part,
+		sessionId: session.id
+	}])));
+	let next = await output.next();
+	const cleanup = createCleanup();
+	try {
+		for (const description of verified.manifest.entries) {
+			const spool = await spoolFacts(archive.entries.get(description.entryPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), description, signal);
+			const partCleanup = createCleanup();
+			let rows = 0, last = -1;
+			try {
+				for await (const text of spool.lines) {
+					const row = parsePrivateReviewRow(text), part = parts.get(row.entryPath);
+					if (!part || part.part.native.role !== "main" || row.archiveSessionId !== part.sessionId || `${row.entryPath}.review.jsonl` !== description.entryPath || row.recordIndex <= last || row.recordIndex >= part.part.retainedRecordCount || row.sourceRecordIndex >= part.part.recordCount) fail("ARTIFACT_INVALID_ARCHIVE");
+					while (!next.done && (next.value.entryPath !== row.entryPath || next.value.recordIndex < row.recordIndex)) next = await output.next();
+					if (next.done || next.value.entryPath !== row.entryPath || next.value.recordIndex !== row.recordIndex || next.value.rowSha256 !== row.outputSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
+					const root = reviewNative(row.cleanedText, signal), actual = reviewNative(next.value.text, signal), seen = /* @__PURE__ */ new Set();
+					for (const field of row.fields) {
+						const key = JSON.stringify([field.pointer, field.innerPointer ?? null]);
+						if (seen.has(key)) fail("ARTIFACT_PROCESSING_MISMATCH");
+						seen.add(key);
+						let source = nativePointer(root, field.cleanedPointer);
+						const target = nativePointer(actual, field.pointer), nativeLiteral = field.scalarKind === "literal" && field.innerPointer === void 0;
+						if (field.scalarKind === "container" && field.innerPointer === void 0 ? nativeContainerText(source, signal) === void 0 || !["array", "string"].includes(target.kind) : nativeLiteral ? source.kind !== "literal" || !["literal", "string"].includes(target.kind) : source.kind !== "string" || target.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
+						if (field.scalarKind === "structure") {
+							if (source.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
+							const structure = reviewNative(source.value, signal);
+							if (!["object", "array"].includes(structure.kind) || !emptyNativeStructure(structure)) fail("ARTIFACT_PROCESSING_MISMATCH");
+						}
+						if (field.innerPointer !== void 0) {
+							if (source.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
+							source = nativePointer(reviewNative(source.value, signal), field.innerPointer);
+						}
+						const text = field.scalarKind === "container" ? nativeContainerText(source, signal) : field.scalarKind === "literal" ? source.kind === "literal" ? source.raw : void 0 : source.kind === "string" ? source.value : void 0;
+						if (text === void 0 || text !== field.text || createHash("sha256").update(text).digest("hex") !== field.fieldHash) fail("ARTIFACT_PROCESSING_MISMATCH");
+					}
+					rows++;
+					last = row.recordIndex;
+					yield row;
+				}
+				if (rows !== description.rows) fail("ARTIFACT_INVALID_ARCHIVE");
+			} catch (error) {
+				partCleanup.failed(error);
+				throw error;
+			} finally {
+				await partCleanup.run(() => spool.lines.return(void 0), () => spool.close());
+			}
+			await archive.fence();
+		}
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(() => output.return(void 0), () => archive.close());
+	}
+}
+//#endregion
+//#region packages/artifact/src/configured/review/rules.ts
+const generic = /* @__PURE__ */ new Set([
+	"src",
+	"lib",
+	"test",
+	"tests",
+	"docs",
+	"README.md",
+	"package.json",
+	"pnpm-lock.yaml",
+	"index.ts",
+	"main.ts",
+	"index.js",
+	".claude.json",
+	".codex",
+	"config.toml"
+]);
+/** Dipper B v6.2 component policy, translated to native UTF-16 coordinates. */
+function componentPaths(text, fullPath = false) {
+	const found = [];
+	for (const match of text.matchAll(/(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)[^\r\n"'`<>[\];|]+/gu)) {
+		let raw = match[0];
+		const separator = raw.includes("\\") ? "\\" : "/";
+		raw = (raw.split(/\s+(?:&&|\|\||--\w|(?:and|then|with|to|from|is)\s)/u)[0] ?? "").replace(/[.,):\s]+$/u, "");
+		const quoted = [
+			"\"",
+			"'",
+			"`"
+		].includes(text[match.index - 1] ?? ""), bracketed = /\[(?:project|workspace):\s*$/u.test(text.slice(0, match.index));
+		if (!quoted && !bracketed && !fullPath) {
+			const token = `Desktop${separator}Folders`;
+			raw = (raw.replace(`Desktop Folders${separator}`, token).split(/\s/u)[0] ?? "").replace(token, `Desktop Folders${separator}`);
+		}
+		const root = /^(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)/u.exec(raw)?.[0];
+		if (!root) continue;
+		const parts = raw.slice(root.length).split(separator);
+		if (!parts[0] || /\s/u.test(parts[0])) continue;
+		let offset = root.length;
+		const coords = parts.map((value) => {
+			const range = {
+				value,
+				start: match.index + offset,
+				end: match.index + offset + value.length
+			};
+			offset += value.length + separator.length;
+			return range;
+		});
+		const first = coords[0];
+		if (!first) continue;
+		const components = [{
+			start: first.start,
+			end: first.end
+		}];
+		let project = -1;
+		if (parts.length > 1) {
+			if ([
+				"Desktop",
+				"Desktop Folders",
+				"Documents",
+				"Projects",
+				"workspace",
+				"workspaces",
+				"repos",
+				"code"
+			].includes(parts[1] ?? "")) project = parts.length > 2 ? 2 : -1;
+			else if (!(parts[1] ?? "").startsWith(".")) project = 1;
+		}
+		for (let index = 1; index < coords.length; index++) {
+			const value = coords[index];
+			if (!value?.value || index === 1 && project === 2) continue;
+			if (index === project || !generic.has(value.value)) components.push({
+				start: value.start,
+				end: value.end
+			});
+		}
+		found.push({
+			start: match.index,
+			end: match.index + raw.length,
+			components
+		});
+	}
+	return found;
+}
+/** Only isolated low-information values inside an explicitly marked CLI example section. */
+function helpSentinels(text) {
+	if (!/^Usage:/mu.test(text) || !/^Examples:/mu.test(text)) return [];
+	const begin = text.indexOf("Examples:"), end = text.indexOf("\nOptions:", begin), zone = text.slice(begin, end < 0 ? text.length : end), result = [];
+	for (const match of zone.matchAll(/\b(?:API_KEY|api_key|TOKEN|password)=(xxx|\.\.\.|<API_KEY>|<TOKEN>)(?=\s|$)/gu)) {
+		const value = match[1];
+		if (!value) continue;
+		const start = begin + match.index + match[0].lastIndexOf(value);
+		result.push({
+			start,
+			end: start + value.length
+		});
+	}
+	return result;
+}
+//#endregion
+//#region packages/artifact/src/configured/review/ranges.ts
+function staticSpan(mask) {
+	return {
+		...mask.inputRange,
+		category: staticMaskCategory(mask.node.id),
+		causes: [{
+			kind: "static",
+			range: mask.inputRange,
+			stepId: mask.stepId,
+			node: mask.node,
+			ruleId: mask.ruleId
+		}]
+	};
+}
+/** These are deterministic B rules, independent of a model's occurrence decisions. */
+function policySpan(range, nodeId, ruleId) {
+	return {
+		...range,
+		category: staticMaskCategory(nodeId),
+		causes: [{
+			kind: "static",
+			range,
+			node: {
+				id: nodeId,
+				version: "sesspilot-b-v1"
+			},
+			stepId: "sesspilot-b-v1",
+			ruleId
+		}]
+	};
+}
+function subtract(input, retained) {
+	return input.flatMap((range) => {
 		let pieces = [range];
 		for (const keep of retained) pieces = pieces.flatMap((piece) => keep.end <= piece.start || keep.start >= piece.end ? [piece] : [{
 			...piece,
@@ -7172,497 +7491,269 @@ function reviewSpans(field, edit) {
 			};
 		} else merged.push(range);
 	}
-	return merged;
-}
-//#endregion
-//#region packages/artifact/src/configured/review/provenance.ts
-const hash$5 = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-/** Final positions come from reconstruction; original causes keep their actual scope and stage. */
-function reconstructedContributors(input) {
-	const { row, field, span, transcript, coordinates, context } = input;
-	const contributors = /* @__PURE__ */ new Map();
-	for (const cause of span.causes) {
-		const localRange = {
-			start: Math.max(cause.range.start, span.start),
-			end: Math.min(cause.range.end, span.end)
-		};
-		if (localRange.end <= localRange.start) continue;
-		const inputRange = coordinates(localRange);
-		if (cause.kind === "semantic" || cause.kind === "correction") {
-			const source = {
-				...transcript,
-				inputRange,
-				context: context(inputRange),
-				category: maskCategory(cause.category)
-			};
-			const id = hash$5([
-				row.entryPath,
-				row.recordIndex,
-				cause.kind,
-				source
-			]);
-			contributors.set(id, {
-				id,
-				kind: cause.kind,
-				category: source.category,
-				source
-			});
-		} else {
-			const source = {
-				entryPath: row.entryPath,
-				recordIndex: row.recordIndex,
-				sourcePartId: row.sourcePartId,
-				sourceRecordIndex: row.sourceRecordIndex,
-				archiveSessionId: row.archiveSessionId,
-				mask: {
-					stepId: cause.stepId,
-					node: cause.node,
-					ruleId: cause.ruleId,
-					inputRange,
-					outputRange: transcript.outputRange,
-					replacement: transcript.replacement,
-					fieldId: hash$5([
-						row.sourcePartId,
-						row.sourceRecordIndex,
-						field.originalPointer,
-						field.innerPointer ?? null
-					]),
-					subject: "value",
-					originalPointer: field.originalPointer,
-					outputPointer: transcript.pointer,
-					sourceRange: field.innerPointer === void 0 ? {
-						start: (field.originalRange?.start ?? 0) + localRange.start,
-						end: (field.originalRange?.start ?? 0) + localRange.end
-					} : null,
-					inputSha256: transcript.inputSha256,
-					outputSha256: transcript.outputSha256,
-					context: context(inputRange)
-				}
-			};
-			const id = hash$5([
-				row.entryPath,
-				row.recordIndex,
-				"static",
-				source.mask
-			]);
-			contributors.set(id, {
-				id,
-				kind: "static",
-				category: staticMaskCategory(cause.node.id),
-				source
-			});
-		}
-	}
-	if (!contributors.size) fail("ARTIFACT_PROCESSING_MISMATCH");
-	return [...contributors.values()];
-}
-//#endregion
-//#region packages/artifact/src/configured/review/render.ts
-const hash$4 = (text) => createHash("sha256").update(text).digest("hex");
-const address = (pointer, inner) => JSON.stringify([pointer, inner ?? null]);
-/** Offsets in the same lossless serialization used by renderNative, including escaped JSON strings. */
-function stringOffsets(root, changes) {
-	const offsets = /* @__PURE__ */ new Map();
-	let offset = 0;
-	const visit = (node) => {
-		const changed = changes.get(node.id);
-		if (node.kind === "string" || changed !== void 0) {
-			offsets.set(node.id, offset + 1);
-			offset += JSON.stringify(changed ?? (node.kind === "string" ? node.value : "")).length;
-		} else if (node.kind === "literal") {
-			offsets.set(node.id, offset);
-			offset += node.raw.length;
-		} else if (node.kind === "array") {
-			offsets.set(node.id, offset);
-			offset++;
-			node.items.forEach((child, index) => {
-				if (index) offset++;
-				visit(child);
-			});
-			offset++;
-		} else {
-			offset++;
-			node.properties.forEach((property, index) => {
-				if (index) offset++;
-				offset += JSON.stringify(property.key.value).length + 1;
-				visit(property.value);
-			});
-			offset++;
-		}
-	};
-	visit(root);
-	return offsets;
-}
-const encodedLength = (text) => JSON.stringify(text).length - 2;
-/** Restore verified untouched scalar lexemes without round-tripping through JS numbers. */
-function restoreLiterals(root, literals) {
-	const raw = literals.get(root.id);
-	if (raw !== void 0) return {
-		id: root.id,
-		kind: "literal",
-		raw
-	};
-	if (root.kind === "array") return {
-		...root,
-		items: root.items.map((node) => restoreLiterals(node, literals))
-	};
-	if (root.kind === "object") return {
-		...root,
-		properties: root.properties.map((entry) => ({
-			...entry,
-			value: restoreLiterals(entry.value, literals)
-		}))
-	};
-	return root;
-}
-/** Rewrite only admitted value leaves; every other byte comes from the verified static base. */
-function renderReviewRow(row, before, edits, markers, signal) {
-	if (hash$4(before) !== row.outputSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const raw = reviewNative(row.cleanedText, signal), actual = reviewNative(before, signal);
-	const pending = /* @__PURE__ */ new Map();
-	for (const edit of edits) {
-		const key = address(edit.pointer, edit.innerPointer);
-		if (pending.has(key)) fail("ARTIFACT_PROCESSING_MISMATCH");
-		pending.set(key, edit);
-	}
-	const groups = /* @__PURE__ */ new Map();
-	for (const field of row.fields) groups.set(field.pointer, [...groups.get(field.pointer) ?? [], field]);
-	const changes = /* @__PURE__ */ new Map(), literals = /* @__PURE__ */ new Map(), transcripts = [], replaced = [];
-	for (const [pointer, fields] of groups) {
-		const first = fields[0] ?? fail("ARTIFACT_PROCESSING_MISMATCH"), original = nativePointer(raw, first.cleanedPointer), target = nativePointer(actual, pointer), nativeLiteral = first.scalarKind === "literal" && first.innerPointer === void 0, nativeContainer = first.scalarKind === "container" && first.innerPointer === void 0;
-		if (nativeContainer ? nativeContainerText(original, signal) === void 0 || !["array", "string"].includes(target.kind) : nativeLiteral ? original.kind !== "literal" || !["literal", "string"].includes(target.kind) : original.kind !== "string" || target.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
-		const inner = first.innerPointer === void 0 ? void 0 : original.kind === "string" ? reviewNative(original.value, signal) : fail("ARTIFACT_PROCESSING_MISMATCH");
-		const innerChanges = /* @__PURE__ */ new Map(), pieces = [];
-		for (const field of fields) {
-			if (field.cleanedPointer !== first.cleanedPointer || field.innerPointer === void 0 !== (first.innerPointer === void 0)) fail("ARTIFACT_PROCESSING_MISMATCH");
-			const source = inner && field.innerPointer !== void 0 ? nativePointer(inner, field.innerPointer) : original;
-			const sourceValue = field.scalarKind === "container" ? nativeContainerText(source, signal) : field.scalarKind === "literal" ? source.kind === "literal" ? source.raw : void 0 : source.kind === "string" ? source.value : void 0;
-			if (sourceValue === void 0 || sourceValue !== field.text || hash$4(sourceValue) !== field.fieldHash) return fail("ARTIFACT_PROCESSING_MISMATCH");
-			const key = address(field.pointer, field.innerPointer), edit = pending.get(key);
-			pending.delete(key);
-			const spans = reviewSpans(field, edit), causes = new Map(spans.map((span) => [span.start, span])), items = [];
-			const changed = replaceSemanticSpans(field.text, spans, markers, (span, replacement, start) => items.push({
-				inputRange: {
-					start: span.start,
-					end: span.end
-				},
-				outputRange: {
-					start,
-					end: start + replacement.length
-				},
-				replacement,
-				category: maskCategory(span.category),
-				span: causes.get(span.start) ?? fail("ARTIFACT_PROCESSING_MISMATCH")
-			}));
-			pieces.push({
-				node: source.id,
-				field,
-				source: sourceValue,
-				changed,
-				items
-			});
-			if (inner && changed !== sourceValue) innerChanges.set(source.id, changed);
-		}
-		const sourceText = inner ? renderNative(inner, /* @__PURE__ */ new Map(), reviewLimits, signal).text : nativeContainer ? nativeContainerText(original, signal) ?? fail("ARTIFACT_PROCESSING_MISMATCH") : original.kind === "string" ? original.value : original.kind === "literal" ? original.raw : fail("ARTIFACT_PROCESSING_MISMATCH");
-		const changed = inner ? renderNative(inner, innerChanges, reviewLimits, signal).text : pieces[0]?.changed ?? fail("ARTIFACT_PROCESSING_MISMATCH");
-		const sourceOffsets = inner ? stringOffsets(inner, /* @__PURE__ */ new Map()) : void 0, outputOffsets = inner ? stringOffsets(inner, innerChanges) : void 0;
-		const inputSha256 = hash$4(sourceText), outputSha256 = hash$4(changed), context = createSentenceContext(sourceText);
-		for (const piece of pieces) for (const item of piece.items) {
-			const coordinates = (range) => sourceOffsets ? {
-				start: (sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.source.slice(0, range.start)),
-				end: (sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.source.slice(0, range.end))
-			} : range;
-			const inputRange = coordinates(item.inputRange);
-			const start = outputOffsets ? (outputOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(piece.changed.slice(0, item.outputRange.start)) : item.outputRange.start;
-			const { span, ...applied } = item;
-			const transcript = {
-				...applied,
-				pointer,
-				inputSha256,
-				outputSha256,
-				inputRange,
-				outputRange: {
-					start,
-					end: start + item.replacement.length
-				},
-				context: context(inputRange)
-			};
-			transcripts.push({
-				...transcript,
-				contributors: reconstructedContributors({
-					row,
-					field: piece.field,
-					span,
-					transcript,
-					coordinates,
-					context
-				})
-			});
-		}
-		if (nativeContainer && changed === sourceText) {
-			if (nativeContainerText(target, signal) !== sourceText) fail("ARTIFACT_PROCESSING_MISMATCH");
-		} else if (nativeLiteral && changed === sourceText) literals.set(target.id, sourceText);
-		else changes.set(target.id, changed);
-		replaced.push(pointer);
-	}
-	if (pending.size) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const restored = literals.size ? restoreLiterals(actual, literals) : actual;
-	return {
-		text: renderNative(restored, changes, reviewLimits, signal).text,
-		transcripts,
-		replaced
-	};
-}
-//#endregion
-//#region packages/artifact/src/configured/output/family-carrier.ts
-/** Map decoded UTF-16 boundaries to complete JSON escape tokens in the original string. */
-function boundaries(text, span, value) {
-	const offsets = [span.start + 1];
-	let cursor = span.start + 1;
-	while (cursor < span.end - 1) {
-		cursor += text[cursor] === "\\" ? text[cursor + 1] === "u" ? 6 : 2 : 1;
-		offsets.push(cursor);
-	}
-	if (cursor !== span.end - 1 || offsets.length !== value.length + 1) fail("ARTIFACT_PROCESSING_MISMATCH");
-	return offsets;
-}
-/** One harness-declared JSON carrier layer; never interpret ordinary strings recursively. */
-function familyCarrierSpans(field, find, signal) {
-	const text = field.text;
-	if (![
-		"tool-call",
-		"tool-result",
-		"runtime"
-	].includes(field.origin.carrier) || !/^\s*[[{]/u.test(text)) return void 0;
-	try {
-		parseNativeRecord(text, limits, signal);
-	} catch (error) {
-		if (error instanceof ProcessingError && ["PROCESSING_INVALID_RECORD", "PROCESSING_KEY_COLLISION"].includes(error.code)) return void 0;
-		throw error;
-	}
-	const root = jsonSpans(text, signal) ?? fail("ARTIFACT_PROCESSING_MISMATCH");
-	const spans = [];
-	const visit = (part) => {
-		checkAbort(signal);
-		if (part.fields) for (const [key, value] of part.fields) {
-			visit(part.keys?.get(key) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
-			visit(value);
-		}
-		else if (part.items) for (const item of part.items) visit(item);
-		else if (typeof part.value === "string") {
-			const matches = find(part.value);
-			if (!matches.length) return;
-			const offsets = boundaries(text, part, part.value);
-			for (const match of matches) {
-				const start = offsets[match.start] ?? fail("ARTIFACT_PROCESSING_MISMATCH");
-				const end = offsets[match.end] ?? fail("ARTIFACT_PROCESSING_MISMATCH");
-				spans.push({
-					...match,
-					start,
-					end
-				});
-			}
+	return merged;
+}
+//#endregion
+//#region packages/artifact/src/configured/review/provenance.ts
+const hash$5 = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** Final positions come from reconstruction; original causes keep their actual scope and stage. */
+function reconstructedContributors(input) {
+	const { row, field, span, transcript, coordinates, context } = input;
+	const contributors = /* @__PURE__ */ new Map();
+	for (const cause of span.causes) {
+		const localRange = {
+			start: Math.max(cause.range.start, span.start),
+			end: Math.min(cause.range.end, span.end)
+		};
+		if (localRange.end <= localRange.start) continue;
+		const inputRange = coordinates(localRange);
+		if (cause.kind === "semantic" || cause.kind === "correction") {
+			const source = {
+				...transcript,
+				inputRange,
+				context: context(inputRange),
+				category: maskCategory(cause.category)
+			};
+			const id = hash$5([
+				row.entryPath,
+				row.recordIndex,
+				cause.kind,
+				source
+			]);
+			contributors.set(id, {
+				id,
+				kind: cause.kind,
+				category: source.category,
+				source
+			});
 		} else {
-			const value = text.slice(part.start, part.end);
-			for (const match of find(value)) spans.push({
-				...match,
-				start: part.start + match.start,
-				end: part.start + match.end,
-				jsonScalar: {
-					start: part.start,
-					end: part.end
+			const source = {
+				entryPath: row.entryPath,
+				recordIndex: row.recordIndex,
+				sourcePartId: row.sourcePartId,
+				sourceRecordIndex: row.sourceRecordIndex,
+				archiveSessionId: row.archiveSessionId,
+				mask: {
+					stepId: cause.stepId,
+					node: cause.node,
+					ruleId: cause.ruleId,
+					inputRange,
+					outputRange: transcript.outputRange,
+					replacement: transcript.replacement,
+					fieldId: hash$5([
+						row.sourcePartId,
+						row.sourceRecordIndex,
+						field.originalPointer,
+						field.innerPointer ?? null
+					]),
+					subject: "value",
+					originalPointer: field.originalPointer,
+					outputPointer: transcript.pointer,
+					sourceRange: field.innerPointer === void 0 ? {
+						start: (field.originalRange?.start ?? 0) + localRange.start,
+						end: (field.originalRange?.start ?? 0) + localRange.end
+					} : null,
+					inputSha256: transcript.inputSha256,
+					outputSha256: transcript.outputSha256,
+					context: context(inputRange)
 				}
+			};
+			const id = hash$5([
+				row.entryPath,
+				row.recordIndex,
+				"static",
+				source.mask
+			]);
+			contributors.set(id, {
+				id,
+				kind: "static",
+				category: staticMaskCategory(cause.node.id),
+				source
 			});
 		}
-	};
-	visit(root);
-	return spans;
-}
-/** Never publish a carrier whose edited keys collide or whose JSON structure changed. */
-function validateFamilyCarrier(text, signal) {
-	try {
-		parseNativeRecord(text, limits, signal);
-	} catch (error) {
-		if (error instanceof ProcessingError && ["PROCESSING_INVALID_RECORD", "PROCESSING_KEY_COLLISION"].includes(error.code)) fail("ARTIFACT_PROCESSING_MISMATCH", { cause: error });
-		throw error;
 	}
+	if (!contributors.size) fail("ARTIFACT_PROCESSING_MISMATCH");
+	return [...contributors.values()];
 }
 //#endregion
-//#region packages/artifact/src/configured/output/family.ts
-/** Names the failed check in the private cause chain; it never carries session text. */
-const mismatch = (check) => fail("ARTIFACT_PROCESSING_MISMATCH", { cause: /* @__PURE__ */ new Error(`configured family hide check=${check}`) });
-/** Binds each family's main Hide literals to its main and worker data and metadata entries. */
-function indexFamilyHides(manifest, hides = []) {
-	const sessions = new Map(manifest.sessions.map((session) => [session.id, session]));
-	const parts = /* @__PURE__ */ new Map();
-	const bind = (id, family, main) => {
-		const session = sessions.get(id) ?? mismatch("unknown-session");
-		if (parts.has(session.metadataPath)) mismatch("duplicate-session");
-		if (session.parts.some((part) => part.native.role === "main") !== main) mismatch("session-role");
-		parts.set(session.metadataPath, family);
-		for (const part of session.parts) {
-			if (parts.has(part.dataPath)) mismatch("duplicate-part");
-			parts.set(part.dataPath, family);
-		}
-	};
-	const shared = /* @__PURE__ */ new Map();
-	for (const hide of hides) {
-		if (!hide.terms.length || !(hide.mainSessionIds.length + hide.workerSessionIds.length)) mismatch("empty-family");
-		const key = JSON.stringify([hide.terms, hide.exceptions ?? []]);
-		let family = shared.get(key);
-		if (!family) {
-			const categories = /* @__PURE__ */ new Map();
-			const bounded = /* @__PURE__ */ new Set();
-			for (const { term, category, bounded: whole } of hide.terms) {
-				if (categories.has(term)) mismatch("duplicate-term");
-				categories.set(term, maskCategory(category));
-				if (whole) bounded.add(term);
-			}
-			family = {
-				matcher: createEntityMatcher([...categories.keys()].map((value) => ({
-					kind: "custom-term",
-					value
-				}))),
-				categories,
-				bounded,
-				excepted: bExceptionRanges(hide.exceptions ?? [])
-			};
-			shared.set(key, family);
-		}
-		for (const id of hide.mainSessionIds) bind(id, family, true);
-		for (const id of hide.workerSessionIds) bind(id, family, false);
-	}
-	return parts;
-}
-/** Disjoint literal hits outside existing markers; overlaps join under the highest category. */
-function familySpans(text, family, signal) {
-	const markers = [...text.matchAll(markerPattern)].map((match) => ({
-		start: match.index,
-		end: match.index + match[0].length
-	}));
-	let kept;
-	const excepted = (range) => (kept ??= bContainment(family.excepted(text, signal)))(range);
-	const marked = (range) => {
-		let low = 0, high = markers.length;
-		while (low < high) {
-			const middle = low + high >> 1;
-			if ((markers[middle]?.end ?? Infinity) <= range.start) low = middle + 1;
-			else high = middle;
-		}
-		return (markers[low]?.start ?? Infinity) < range.end;
-	};
-	const hits = family.matcher.find(text, signal, 2e6).filter(({ range, entity }) => !marked(range) && (!family.bounded.has(entity.value) || bWordBounded(text, range.start, range.end)) && !excepted(range)).map(({ range, entity }) => ({
-		...range,
-		category: family.categories.get(entity.value) ?? mismatch("unknown-term")
-	})).sort((left, right) => left.start - right.start || right.end - left.end);
-	const spans = [];
-	for (const hit of hits) {
-		const prior = spans.at(-1);
-		if (!prior || hit.start >= prior.end) {
-			spans.push(hit);
-			continue;
-		}
-		prior.end = Math.max(prior.end, hit.end);
-		if (categoryOrder.indexOf(hit.category) > categoryOrder.indexOf(prior.category)) prior.category = hit.category;
-	}
-	return spans;
-}
-/**
-* Enum-like envelope values that native parsing interprets. Values inside an adapter-retained
-* body are free text; outside bodies these names (and IDs) never take family terms.
-*/
-const structuralNames = /* @__PURE__ */ new Set([
-	"type",
-	"role",
-	"name",
-	"subtype",
-	"stop_reason",
-	"status",
-	"kind",
-	"level",
-	"source",
-	"originator",
-	"mode",
-	"tool_name",
-	"toolName",
-	"function_name"
-]);
-const structural = (name) => name !== void 0 && (structuralNames.has(name) || /(?:^id|_id|Id|uuid|Uuid)$/u.test(name));
-/** Node IDs inside the adapter's retained bodies: the native free-text classification. */
-function bodyNodes(root, selection) {
-	const bodies = new Set(selection.edits.map((edit) => edit.nodeId));
-	const nodes = /* @__PURE__ */ new Set();
-	const visit = (node, inside) => {
-		const body = inside || bodies.has(node.id);
-		if (body) nodes.add(node.id);
-		if (node.kind === "array") for (const item of node.items) visit(item, body);
-		if (node.kind === "object") for (const property of node.properties) visit(property.value, body);
-	};
-	visit(root, false);
-	return nodes;
-}
-/** Exact, cheap check that any string value can match: one linear scan whatever the term count. */
-function mayMatch(root, family, signal) {
-	const values = [];
+//#region packages/artifact/src/configured/review/render.ts
+const hash$4 = (text) => createHash("sha256").update(text).digest("hex");
+const address = (pointer, inner) => JSON.stringify([pointer, inner ?? null]);
+/** Offsets in the same lossless serialization used by renderNative, including escaped JSON strings. */
+function stringOffsets(root, changes) {
+	const offsets = /* @__PURE__ */ new Map();
+	let offset = 0;
 	const visit = (node) => {
-		if (node.kind === "string") values.push(node.value);
-		else if (node.kind === "array") for (const item of node.items) visit(item);
-		else if (node.kind === "object") for (const property of node.properties) visit(property.value);
+		const changed = changes.get(node.id);
+		if (node.kind === "string" || changed !== void 0) {
+			offsets.set(node.id, offset + 1);
+			offset += JSON.stringify(changed ?? (node.kind === "string" ? node.value : "")).length;
+		} else if (node.kind === "literal") {
+			offsets.set(node.id, offset);
+			offset += node.raw.length;
+		} else if (node.kind === "array") {
+			offsets.set(node.id, offset);
+			offset++;
+			node.items.forEach((child, index) => {
+				if (index) offset++;
+				visit(child);
+			});
+			offset++;
+		} else {
+			offset++;
+			node.properties.forEach((property, index) => {
+				if (index) offset++;
+				offset += JSON.stringify(property.key.value).length + 1;
+				visit(property.value);
+			});
+			offset++;
+		}
 	};
 	visit(root);
-	return family.matcher.hasCustomTerm(values.join("\0"), signal) || values.some((value) => /^\s*[[{]/u.test(value) && value.includes("\\"));
+	return offsets;
 }
-/** Masks family literals in unprotected, non-structural string values `skip` does not exclude. */
-function maskFamilyFields(text, root, annotations, family, markers, signal, onApplied, bodies, skip) {
-	const changes = /* @__PURE__ */ new Map();
-	const evidence = { bytes: 0 };
-	const recordLimits = recordPointerLimits(limits, Buffer.byteLength(text));
-	for (const field of walkNativeFields(root, annotations, {
-		recordId: digest$4(text),
-		limits: recordLimits,
-		signal
-	})) {
-		if (skip(field)) continue;
-		if (field.text.includes(markers.prefix)) mismatch("marker-prefix");
-		if (field.subject !== "value" || field.scalarKind !== "string" || field.field.protection || !bodies.has(field.nodeId) && structural(field.field.name)) continue;
-		const raw = familySpans(field.text, family, signal);
-		const carrier = raw.length || field.text.includes("\\") ? familyCarrierSpans(field, (value) => familySpans(value, family, signal), signal) : void 0;
-		const spans = (carrier ?? raw).sort((left, right) => left.start - right.start);
-		if (!spans.length) continue;
-		const changed = maskOutputField({
-			pointer: field.pointer,
-			text: field.text,
-			sha256: digest$4(field.text)
-		}, spans, markers, evidence, onApplied);
-		if (carrier) validateFamilyCarrier(changed, signal);
-		changes.set(field.nodeId, changed);
-	}
-	return changes.size ? renderNative(root, changes, recordLimits, signal).text : text;
+const encodedLength = (text) => JSON.stringify(text).length - 2;
+/** Absolute JSON string-content coordinates. Fixed-size checkpoints bound both the work
+* per lookup and retained memory, including out-of-order overlapping contributor ranges. */
+function encodedOffset(text, base) {
+	const stride = 1024;
+	const offsets = [base];
+	const boundary = (block) => {
+		const at = block * stride;
+		return scalarBoundary(text, at) ? at : at - 1;
+	};
+	return (position) => {
+		const block = Math.floor(position / stride);
+		while (offsets.length <= block) {
+			const next = offsets.length;
+			offsets.push((offsets[next - 1] ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(text.slice(boundary(next - 1), boundary(next))));
+		}
+		return (offsets[block] ?? fail("ARTIFACT_PROCESSING_MISMATCH")) + encodedLength(text.slice(boundary(block), position));
+	};
 }
-/**
-* Every row of a family part is parsed in order so native call/result state stays aligned.
-* Worker rows: every unprotected string value. Main rows: every one that is not a B review
-* field, which keeps its exact B decisions. Keys, roles, identities and tool links stay exact.
-*/
-function createFamilyHideEditor(adapter, part, family, markers, signal, onApplied) {
-	const options = {
-		sourceRole: part.native.role,
-		nativeSessionId: part.native.sessionId
+/** Restore verified untouched scalar lexemes without round-tripping through JS numbers. */
+function restoreLiterals(root, literals) {
+	const raw = literals.get(root.id);
+	if (raw !== void 0) return {
+		id: root.id,
+		kind: "literal",
+		raw
 	};
-	const retention = adapter.retention(options);
-	return (text, reviewed = /* @__PURE__ */ new Set()) => {
-		checkAbort(signal);
-		const root = parseNativeRecord(text, limits, signal);
-		const selection = retention(root);
-		if (!mayMatch(root, family, signal)) return text;
-		return maskFamilyFields(text, root, adapter.annotations(root, options, selection), family, markers, signal, onApplied, bodyNodes(root, selection), (field) => reviewed.has(field.pointer));
+	if (root.kind === "array") return {
+		...root,
+		items: root.items.map((node) => restoreLiterals(node, literals))
+	};
+	if (root.kind === "object") return {
+		...root,
+		properties: root.properties.map((entry) => ({
+			...entry,
+			value: restoreLiterals(entry.value, literals)
+		}))
 	};
+	return root;
 }
-/** Session metadata is never analysed; its unprotected text (such as a title) takes family terms. */
-function maskFamilyMetadata(text, family, markers, signal, onApplied) {
-	checkAbort(signal);
-	const root = parseNativeRecord(text, limits, signal);
-	return maskFamilyFields(text, root, metadataAnnotations(root), family, markers, signal, onApplied, /* @__PURE__ */ new Set(), () => false);
+/** Rewrite only admitted value leaves; every other byte comes from the verified static base. */
+function renderReviewRow(row, before, edits, markers, signal) {
+	if (hash$4(before) !== row.outputSha256) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const raw = reviewNative(row.cleanedText, signal), actual = reviewNative(before, signal);
+	const pending = /* @__PURE__ */ new Map();
+	for (const edit of edits) {
+		const key = address(edit.pointer, edit.innerPointer);
+		if (pending.has(key)) fail("ARTIFACT_PROCESSING_MISMATCH");
+		pending.set(key, edit);
+	}
+	const groups = /* @__PURE__ */ new Map();
+	for (const field of row.fields) groups.set(field.pointer, [...groups.get(field.pointer) ?? [], field]);
+	const changes = /* @__PURE__ */ new Map(), literals = /* @__PURE__ */ new Map(), transcripts = [], replaced = [];
+	for (const [pointer, fields] of groups) {
+		const first = fields[0] ?? fail("ARTIFACT_PROCESSING_MISMATCH"), original = nativePointer(raw, first.cleanedPointer), target = nativePointer(actual, pointer), nativeLiteral = first.scalarKind === "literal" && first.innerPointer === void 0, nativeContainer = first.scalarKind === "container" && first.innerPointer === void 0;
+		if (nativeContainer ? nativeContainerText(original, signal) === void 0 || !["array", "string"].includes(target.kind) : nativeLiteral ? original.kind !== "literal" || !["literal", "string"].includes(target.kind) : original.kind !== "string" || target.kind !== "string") return fail("ARTIFACT_PROCESSING_MISMATCH");
+		const inner = first.innerPointer === void 0 ? void 0 : original.kind === "string" ? reviewNative(original.value, signal) : fail("ARTIFACT_PROCESSING_MISMATCH");
+		const innerChanges = /* @__PURE__ */ new Map(), pieces = [];
+		for (const field of fields) {
+			if (field.cleanedPointer !== first.cleanedPointer || field.innerPointer === void 0 !== (first.innerPointer === void 0)) fail("ARTIFACT_PROCESSING_MISMATCH");
+			const source = inner && field.innerPointer !== void 0 ? nativePointer(inner, field.innerPointer) : original;
+			const sourceValue = field.scalarKind === "container" ? nativeContainerText(source, signal) : field.scalarKind === "literal" ? source.kind === "literal" ? source.raw : void 0 : source.kind === "string" ? source.value : void 0;
+			if (sourceValue === void 0 || sourceValue !== field.text || hash$4(sourceValue) !== field.fieldHash) return fail("ARTIFACT_PROCESSING_MISMATCH");
+			const key = address(field.pointer, field.innerPointer), edit = pending.get(key);
+			pending.delete(key);
+			const spans = reviewSpans(field, edit), causes = new Map(spans.map((span) => [span.start, span])), items = [];
+			const changed = replaceSemanticSpans(field.text, spans, markers, (span, replacement, start) => items.push({
+				inputRange: {
+					start: span.start,
+					end: span.end
+				},
+				outputRange: {
+					start,
+					end: start + replacement.length
+				},
+				replacement,
+				category: maskCategory(span.category),
+				span: causes.get(span.start) ?? fail("ARTIFACT_PROCESSING_MISMATCH")
+			}));
+			pieces.push({
+				node: source.id,
+				field,
+				source: sourceValue,
+				changed,
+				items
+			});
+			if (inner && changed !== sourceValue) innerChanges.set(source.id, changed);
+		}
+		const sourceText = inner ? renderNative(inner, /* @__PURE__ */ new Map(), reviewLimits, signal).text : nativeContainer ? nativeContainerText(original, signal) ?? fail("ARTIFACT_PROCESSING_MISMATCH") : original.kind === "string" ? original.value : original.kind === "literal" ? original.raw : fail("ARTIFACT_PROCESSING_MISMATCH");
+		const changed = inner ? renderNative(inner, innerChanges, reviewLimits, signal).text : pieces[0]?.changed ?? fail("ARTIFACT_PROCESSING_MISMATCH");
+		const sourceOffsets = inner ? stringOffsets(inner, /* @__PURE__ */ new Map()) : void 0, outputOffsets = inner ? stringOffsets(inner, innerChanges) : void 0;
+		const inputSha256 = hash$4(sourceText), outputSha256 = hash$4(changed), context = createSentenceContext(sourceText);
+		for (const piece of pieces) {
+			if (!piece.items.length) continue;
+			const inputOffset = sourceOffsets && encodedOffset(piece.source, sourceOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
+			const outputOffset = outputOffsets && encodedOffset(piece.changed, outputOffsets.get(piece.node) ?? fail("ARTIFACT_PROCESSING_MISMATCH"));
+			const coordinates = (range) => inputOffset ? {
+				start: inputOffset(range.start),
+				end: inputOffset(range.end)
+			} : range;
+			for (const item of piece.items) {
+				const inputRange = coordinates(item.inputRange);
+				const start = outputOffset ? outputOffset(item.outputRange.start) : item.outputRange.start;
+				const { span, ...applied } = item;
+				const transcript = {
+					...applied,
+					pointer,
+					inputSha256,
+					outputSha256,
+					inputRange,
+					outputRange: {
+						start,
+						end: start + item.replacement.length
+					},
+					context: context(inputRange)
+				};
+				transcripts.push({
+					...transcript,
+					contributors: reconstructedContributors({
+						row,
+						field: piece.field,
+						span,
+						transcript,
+						coordinates,
+						context
+					})
+				});
+			}
+		}
+		if (nativeContainer && changed === sourceText) {
+			if (nativeContainerText(target, signal) !== sourceText) fail("ARTIFACT_PROCESSING_MISMATCH");
+		} else if (nativeLiteral && changed === sourceText) literals.set(target.id, sourceText);
+		else changes.set(target.id, changed);
+		replaced.push(pointer);
+	}
+	if (pending.size) fail("ARTIFACT_PROCESSING_MISMATCH");
+	const restored = literals.size ? restoreLiterals(actual, literals) : actual;
+	return {
+		text: renderNative(restored, changes, reviewLimits, signal).text,
+		transcripts,
+		replaced
+	};
 }
 //#endregion
 //#region packages/artifact/src/configured/output/transform.ts
@@ -7686,6 +7777,7 @@ async function createOutputTransform(request, manifest, markers, signal) {
 		session,
 		part
 	}])));
+	const workspaceTitle = createWorkspaceTitleMasker(request, manifest, markers, signal);
 	return {
 		families,
 		async metadata(text, entryPath) {
@@ -7695,7 +7787,7 @@ async function createOutputTransform(request, manifest, markers, signal) {
 			return {
 				text: family ? maskFamilyMetadata(text, family, markers, signal, (value) => transcripts.push(value)) : entryPath === manifest.work.metadataPath ? await updateOutputWorkMetadata(text, manifest, request, signal, (value) => {
 					title = value;
-				}) : text,
+				}) : workspaceTitle(text, entryPath, (value) => transcripts.push(value)),
 				transcripts: title?.semanticTranscript ?? transcripts,
 				titleMasks: title?.staticMasks
 			};
@@ -9844,7 +9936,16 @@ function createSessionWorkerPool(url, size, heapMb = workerHeapMb) {
 		stopping = Promise.all(slots.map(async (slot) => {
 			try {
 				await slot.process.close();
-				if (slot.task) await removeStoppedSpools(slot.task.spoolPaths);
+				if (slot.task) {
+					if (requestKind(slot.task) === "journey-base") {
+						await removeNamedTemporarySpools(slot.task.spoolPaths);
+						for (const path of slot.task.spoolPaths) try {
+							await unlink(path);
+						} catch (error) {
+							if (filesystemCode(error) !== "ENOENT") throw error;
+						}
+					} else await removeStoppedSpools(slot.task.spoolPaths);
+				}
 			} finally {
 				slot.task?.reject(blame(slot));
 				slot.task = void 0;
@@ -9885,6 +9986,10 @@ function createSessionWorkerPool(url, size, heapMb = workerHeapMb) {
 				}
 				task.spoolPaths.add(message.path);
 				task.onSpool?.(message.path);
+				if (!closed) slot.process.send({
+					kind: "spool-owned",
+					path: message.path
+				});
 			} else if (message.kind === "result") {
 				const requestedKind = requestKind(task);
 				if ((requestedKind === "render" || requestedKind === "capture" || requestedKind === "scan" || requestedKind === "journey-output" || requestedKind === "journey-output-shard" || requestedKind === "journey-output-verify" || requestedKind === "journey-base") && message.result.kind !== requestedKind) {
@@ -15312,9 +15417,35 @@ async function processJourneyMetadata(request, signal = new AbortController().si
 }
 //#endregion
 //#region packages/artifact/src/configured/journey/original.ts
-/** Verify the complete frozen source into an unlinked private spool before yielding originals. */
+/** Fully verify before yielding by default; classification prefixes explicitly opt into early close. */
 async function* readCapturedOriginalRows(source, options, signal = new AbortController().signal) {
 	const directory = await privateJourneyDirectory(options.directory);
+	if (options.verification === "classification-prefix") {
+		const cleanup = createCleanup();
+		const input = await openCapturedFile(source.capture.source, source.capture.path, source.capture.facts, signal);
+		try {
+			let recordIndex = 0;
+			const limits = resolveLimits();
+			for await (const text of frameRecords(input.chunks, "jsonl", limits.maxRecordBytes, signal)) {
+				parseNativeRecord(text, limits, signal);
+				yield {
+					harness: source.harness,
+					sessionId: source.sessionId,
+					sourcePartId: source.capture.partId,
+					recordIndex: recordIndex++,
+					rowSha256: createHash("sha256").update(text).digest("hex"),
+					text
+				};
+			}
+			await input.finish();
+		} catch (error) {
+			cleanup.failed(error);
+			throw error;
+		} finally {
+			await cleanup.run(() => input.close());
+		}
+		return;
+	}
 	const temporary = await createTemporary({
 		outputDir: directory,
 		keepTemp: false
@@ -15473,7 +15604,7 @@ async function sessionFileFacts(file, size, signal) {
 /** Verify bounded final redacted bytes before starting a second ZIP codec. */
 async function sessionPart(entry, expected, signal) {
 	if (expected.byteLength > 268435456 || entry.uncompressedSize !== expected.byteLength) fail("ARTIFACT_PART_LIMIT");
-	const file = await sessionFile();
+	const scratch = expected.byteLength <= 65536 ? { bytes: new Uint8Array(expected.byteLength) } : { file: await sessionFile() };
 	let size = 0;
 	const digest = createHash("sha256");
 	let crc = 0;
@@ -15483,11 +15614,14 @@ async function sessionPart(entry, expected, signal) {
 			if (size + bytes.byteLength > expected.byteLength) fail("ARTIFACT_PART_LIMIT");
 			digest.update(bytes);
 			crc = crc32(bytes, crc);
-			let offset = 0;
-			while (offset < bytes.byteLength) {
-				const result = await file.write(bytes, offset, bytes.byteLength - offset, size + offset);
-				if (!result.bytesWritten) fail("ARTIFACT_IO_FAILED");
-				offset += result.bytesWritten;
+			if (scratch.bytes) scratch.bytes.set(bytes, size);
+			else {
+				let offset = 0;
+				while (offset < bytes.byteLength) {
+					const { bytesWritten } = await scratch.file.write(bytes, offset, bytes.byteLength - offset, size + offset);
+					if (!bytesWritten) fail("ARTIFACT_IO_FAILED");
+					offset += bytesWritten;
+				}
 			}
 			size += bytes.byteLength;
 		} }), {
@@ -15495,55 +15629,93 @@ async function sessionPart(entry, expected, signal) {
 			checkSignature: true
 		});
 		if (size !== expected.byteLength || digest.digest("hex") !== expected.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
+		const reader = scratch.bytes ? new Uint8ArrayReader(scratch.bytes) : new FileReader(scratch.file, size, 262144, true, signal);
 		return {
-			file,
+			file: scratch.file,
+			reader,
 			crc32: crc
 		};
 	} catch (error) {
 		const cleanup = createCleanup();
 		cleanup.failed(error);
-		await cleanup.run(() => file.close());
+		const { file } = scratch;
+		if (file) await cleanup.run(() => file.close());
 		throw error;
 	}
 }
 //#endregion
 //#region packages/artifact/src/configured/output/sessions.ts
-/** Each yielded spool stays open until the caller advances or closes this iterator. */
-async function* configuredSessionUploads(input, identities, signal) {
+async function* configuredSessionUploads(input, identities, signal, mode = "upload", omitted = /* @__PURE__ */ new Set(), checkMinimumBytes) {
 	const verified = await checkFrozenOutput(input, signal);
 	const archive = await openCheckedOutput(input, verified.checked, signal);
 	const cleanup = createCleanup();
 	try {
 		if (archive.manifestText !== verified.manifestText) fail("ARTIFACT_PROCESSING_MISMATCH");
 		const descriptions = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
+		const byId = new Map(identities.map((identity) => [identity.archiveSessionId, identity]));
+		if (byId.size !== identities.length) fail("ARTIFACT_IDENTITY_MISMATCH");
+		if (checkMinimumBytes) {
+			const measured = /* @__PURE__ */ new Set();
+			let bytes = 0;
+			for (const session of verified.manifest.sessions) {
+				if (omitted.has(session.id)) continue;
+				if (!byId.has(session.id)) fail("ARTIFACT_IDENTITY_MISMATCH");
+				for (const part of session.parts) {
+					const entry = descriptions.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+					if (measured.has(entry.sha256)) continue;
+					measured.add(entry.sha256);
+					bytes += entry.byteLength;
+				}
+			}
+			checkMinimumBytes(bytes);
+		}
+		const workspaces = new Map(verified.manifest.sourceWorkspaces.map((workspace) => [workspace.id, workspace]));
+		const workspaceFacts = /* @__PURE__ */ new Map();
 		for (const session of verified.manifest.sessions) {
 			signal.throwIfAborted();
-			const identity = identities.find((item) => item.archiveSessionId === session.id) ?? fail("ARTIFACT_IDENTITY_MISMATCH");
-			const workspace = verified.manifest.sourceWorkspaces.find((item) => item.id === session.workspaceId) ?? fail("ARTIFACT_INVALID_MANIFEST");
-			const entry = archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
-			const description = descriptions.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
-			const text = await readMetadata(entry, signal);
-			if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
-			const { version: _, ...facts } = validateConfiguredSourceMetadata(strictJson(text, metadataLimitBytes), workspace);
+			if (omitted.has(session.id)) continue;
+			const identity = byId.get(session.id) ?? fail("ARTIFACT_IDENTITY_MISMATCH");
+			const workspace = workspaces.get(session.workspaceId) ?? fail("ARTIFACT_INVALID_MANIFEST");
+			let facts = workspaceFacts.get(workspace.id);
+			if (!facts) {
+				const entry = archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const description = descriptions.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const text = await readMetadata(entry, signal);
+				if (Buffer.byteLength(text) !== description.byteLength || createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
+				const { version: _, ...validated } = validateConfiguredSourceMetadata(strictJson(text, metadataLimitBytes), workspace);
+				facts = validated;
+				workspaceFacts.set(workspace.id, facts);
+			}
 			const native = session.parts[0]?.native;
 			const nativeSessionId = native?.sessionId ?? session.sourceSessionId;
 			if (!nativeSessionId?.trim() && !identity.relativePath) fail("ARTIFACT_IDENTITY_MISMATCH");
 			const metadata = {
-				workspace: facts,
+				workspace: {
+					...facts,
+					remoteHashes: [...facts.remoteHashes]
+				},
 				sourceSessionId: nativeSessionId,
 				harness: session.harness,
 				lastAt: identity.lastAt,
 				parts: []
 			};
-			const file = await sessionFile();
+			const file = mode === "upload" ? await sessionFile() : null;
 			const sessionCleanup = createCleanup();
 			try {
 				let size = 0;
-				const sink = fileWriter(file, signal, (bytes) => {
+				const limit = (bytes) => {
 					if (bytes > 5 * 1024 ** 3) fail("ARTIFACT_ARCHIVE_LIMIT");
 					size = bytes;
-				}, false);
-				const zip = new ZipWriter(sink.writable, {
+				};
+				const digest = createHash("sha256");
+				let checksum = 0;
+				const writable = file ? fileWriter(file, signal, limit, false).writable : new WritableStream({ write(bytes) {
+					signal.throwIfAborted();
+					limit(size + bytes.byteLength);
+					digest.update(bytes);
+					checksum = crc32(bytes, checksum);
+				} });
+				const zip = new ZipWriter(writable, {
 					useWebWorkers: false,
 					useCompressionStream: true,
 					bufferedWrite: false,
@@ -15559,24 +15731,30 @@ async function* configuredSessionUploads(input, identities, signal) {
 					const partCleanup = createCleanup();
 					try {
 						const path = `p${String(index + 1).padStart(6, "0")}.jsonl`;
-						await zip.add(path, new FileReader(prepared.file, expected.byteLength, 262144, true, signal), { signal });
+						await zip.add(path, prepared.reader, { signal });
 						metadata.parts.push({
 							path,
 							byteLength: expected.byteLength,
 							sha256: expected.sha256,
-							crc32: prepared.crc32
+							crc32: prepared.crc32,
+							native: part.native
 						});
 					} catch (error) {
 						partCleanup.failed(error);
 						throw error;
 					} finally {
-						await partCleanup.run(() => prepared.file.close());
+						const { file } = prepared;
+						if (file) await partCleanup.run(() => file.close());
 					}
 				}
 				await zip.close();
 				if (zip.warnings?.length) fail("ARTIFACT_INVALID_ARCHIVE");
 				if (size > 5 * 1024 ** 3) fail("ARTIFACT_ARCHIVE_LIMIT");
-				const content = await sessionFileFacts(file, size, signal);
+				const content = file ? await sessionFileFacts(file, size, signal) : {
+					byteLength: size,
+					sha256: digest.digest("hex"),
+					crc32: checksum
+				};
 				await archive.fence();
 				yield {
 					...content,
@@ -15586,13 +15764,13 @@ async function* configuredSessionUploads(input, identities, signal) {
 					relativePath: identity.relativePath,
 					harness: session.harness,
 					lastAt: identity.lastAt,
-					stream: () => new FileReader(file, size, 262144, true, signal).createReadable()
+					...file ? { stream: () => new FileReader(file, size, 262144, true, signal).createReadable() } : {}
 				};
 			} catch (error) {
 				sessionCleanup.failed(error);
 				throw error;
 			} finally {
-				await sessionCleanup.run(() => file.close());
+				if (file) await sessionCleanup.run(() => file.close());
 			}
 		}
 	} catch (error) {
@@ -16361,7 +16539,7 @@ const maxChunks = 8e4;
 function batchLoad(body) {
 	return Math.max(body.chunks.length / maxChunks, (body.duplicates?.length ?? 0) / maxChunks, Buffer.byteLength(JSON.stringify(body)) / maxTransportBytes);
 }
-function location(context, fieldId, part) {
+function location$1(context, fieldId, part) {
 	const source = context.locations.get(fieldId);
 	if (!source) throw new ApplicationError("CORRUPTED_STATE");
 	const native = reviewSource(source);
@@ -16400,7 +16578,7 @@ function reviewBatchBody(context, unit, ordinal) {
 	};
 	const chunks = unit.fragments.map((part) => ({
 		id: chunkId(part.fieldId, part),
-		...location(context, part.fieldId, part),
+		...location$1(context, part.fieldId, part),
 		core: part.core,
 		offset: part.utf16Start,
 		text: part.text,
@@ -16420,7 +16598,7 @@ function reviewBatchBody(context, unit, ordinal) {
 				utf16Start: part.utf16Start + shift.utf16,
 				utf16End: part.utf16End + shift.utf16
 			};
-			const { displayMasks, ...own } = location(context, duplicate.fieldId, copy);
+			const { displayMasks, ...own } = location$1(context, duplicate.fieldId, copy);
 			const hash = fieldHash(duplicate.fieldId);
 			return {
 				id: chunkId(duplicate.fieldId, copy),
@@ -16910,7 +17088,7 @@ async function prepareSessionScans(request, signal) {
 			const opened = await openSourceCapture(request.captures.get(part.path) ?? fail("ARTIFACT_SOURCE_CHANGED"));
 			const cleanup = createCleanup();
 			try {
-				return await inspectCapturedSourceIdentity(part, opened, adapter, currentSignal, limits);
+				return await (part.nativeEvidence?.identity?.role === "main" ? inspectCapturedSourceIdentity : inspectCompleteCapturedSourceIdentity)(part, opened, adapter, currentSignal, limits);
 			} catch (error) {
 				cleanup.failed(error);
 				throw error;
@@ -17011,4 +17189,277 @@ async function verifyPreparedSessionSources(prepared, input, signal) {
 	}
 }
 //#endregion
-export { removeNamedTemporarySpools as $, renderJobDigest as A, parallelismLimits as B, readOriginalSearchFields as C, prepareCollectionProduction as D, checkReusableBundle as E, SessionWorkerError as F, processJourneyMetadataFields as G, privateJourneyDirectory as H, sessionWorkerFailure as I, listAgentSetup as J, staticMaskCategory as K, privateCollectionDirectory as L, readCollectionIndex as M, parseCollectionWorkspaceSummary as N, captureLogicalJourneySources as O, createSharedSessionPool as P, createTemporary as Q, defaultParallelism as R, readPrivateReviewPayload as S, createCollectionArtifacts as T, readLogicalJourneyFinalMasks as U, writeLogicalJourneyOutput as V, readConfiguredOutputInfo as W, createInspectionProcessor as X, createConfiguredPreviewStream as Y, decodeZstd as Z, processJourneyMetadata as _, scanReviewFields as a, restrictToOwner as at, writeLogicalJourneyBase as b, readSessionScanRecords as c, windowsAclCodes as ct, verifyOutputShard as d, createCleanup as et, writeOutputShard as f, readCapturedOriginalRows as g, captureConfiguredSessionJob as h, buildWorkScanBatches as i, openPrivateFile as it, runConfiguredSessionJob as j, capturedJourneyScope as k, scanPreparedSession as l, openConfiguredUpload as m, verifyPreparedSessionSources as n, exclusiveLock as nt, createWorkPieces as o, windowsOwnerOnly as ot, configuredSessionUploads as p, readWorkspacePair as q, prepareSessionScans as r, makePrivateDirectory as rt, readSessionScanFields as s, isWindowsAclFailure as st, preparedScanConfiguration as t, safeError as tt, runConfiguredScanJob as u, readStaticSessionMasks as v, readConfiguredSearchFields as w, writePrivateReviewPayload as x, staticSessionJobs as y, gitSeedsProvider as z };
+//#region packages/artifact/src/configured/output/session-mask-equivalence.ts
+const exactMarker = new RegExp("^(?:" + replacementMarkerPattern.source + ")$", "u");
+function sessionMaskProof(row) {
+	const lineage = row.contributors.map((item) => {
+		const { inputRange, context } = item.kind === "static" ? item.source.mask : item.source;
+		const quote = context.text.slice(inputRange.start - context.start, inputRange.end - context.start);
+		const basis = item.kind === "static" ? [
+			item.source.sourceRecordIndex,
+			item.source.mask.originalPointer,
+			item.source.mask.sourceRange,
+			item.source.mask.inputSha256,
+			item.source.mask.stepId,
+			item.source.mask.node.id,
+			item.source.mask.node.version,
+			item.source.mask.ruleId
+		] : [item.source.pointer];
+		return JSON.stringify([
+			item.kind,
+			item.category,
+			basis,
+			inputRange.start,
+			inputRange.end,
+			quote
+		]);
+	}).sort();
+	const first = row.contributors[0];
+	return {
+		pointer: row.pointer,
+		subject: row.subject,
+		start: row.outputRange.start,
+		end: row.outputRange.end,
+		replacement: row.replacement,
+		lineage: createHash("sha256").update(JSON.stringify([row.category, lineage])).digest("hex"),
+		mayRename: row.subject === "value" && exactMarker.test(row.replacement) && row.contributors.length === 1 && first?.kind === "static" && first.source.sourceRecordIndex !== null && first.source.mask.sourceRange !== null && first.source.mask.originalPointer !== null && first.source.mask.outputPointer === row.pointer && first.source.mask.subject === row.subject && first.source.mask.replacement === row.replacement
+	};
+}
+const location = (mask) => JSON.stringify([
+	mask.pointer,
+	mask.subject,
+	mask.start,
+	mask.end
+]);
+/** Both ledgers have already been independently joined to their own frozen output by the verifier. */
+function compareSessionRows(leftText, rightText, leftMasks, rightMasks) {
+	if (leftMasks.length !== rightMasks.length) return null;
+	const rightByLocation = new Map(rightMasks.map((mask) => [location(mask), mask]));
+	if (rightByLocation.size !== rightMasks.length) return null;
+	const changes = /* @__PURE__ */ new Map();
+	const aliases = /* @__PURE__ */ new Map();
+	const reverse = /* @__PURE__ */ new Map();
+	for (const left of leftMasks) {
+		const key = location(left);
+		const right = rightByLocation.get(key);
+		if (!right || left.lineage !== right.lineage) return null;
+		rightByLocation.delete(key);
+		if (left.replacement === right.replacement) continue;
+		if (!left.mayRename || !right.mayRename || left.start < 0 || left.end - left.start !== left.replacement.length || right.replacement.length !== left.replacement.length) return null;
+		const prior = aliases.get(left.replacement);
+		const inverse = reverse.get(right.replacement);
+		if (prior !== void 0 && prior !== right.replacement || inverse !== void 0 && inverse !== left.replacement) return null;
+		aliases.set(left.replacement, right.replacement);
+		reverse.set(right.replacement, left.replacement);
+		const masks = changes.get(left.pointer) ?? [];
+		masks.push(left);
+		changes.set(left.pointer, masks);
+	}
+	if (!aliases.size) return leftText === rightText ? { aliases: [] } : null;
+	const limits = {
+		...defaultLimits,
+		maxRecordBytes: maximumRecordBytes
+	};
+	let tree;
+	try {
+		tree = parseNativeRecord(leftText, limits, new AbortController().signal);
+	} catch {
+		return null;
+	}
+	const changedCount = [...changes.values()].reduce((sum, field) => sum + field.length, 0);
+	function authenticOccurrences(root, destination) {
+		let used = 0;
+		const markers = destination ? reverse : aliases;
+		function check(node, pointer) {
+			if (node.kind === "array") return node.items.every((item, i) => check(item, pointer + "/" + i));
+			if (node.kind === "object") return node.properties.every(({ key, value }) => {
+				for (const found of key.value.matchAll(replacementMarkerPattern)) if (markers.has(found[0])) return false;
+				return check(value, pointer + "/" + key.value.replaceAll("~", "~0").replaceAll("/", "~1"));
+			});
+			if (node.kind !== "string") return true;
+			const expected = new Map((changes.get(pointer) ?? []).map((mask) => [mask.start, mask]));
+			for (const found of node.value.matchAll(replacementMarkerPattern)) {
+				if (!markers.has(found[0])) continue;
+				const mask = expected.get(found.index);
+				if (!mask || (destination ? aliases.get(mask.replacement) : mask.replacement) !== found[0]) return false;
+				expected.delete(found.index);
+				used++;
+			}
+			return expected.size === 0;
+		}
+		return check(root, "") && used === changedCount;
+	}
+	if (!authenticOccurrences(tree, false)) return null;
+	for (const winner of aliases.values()) if (aliases.has(winner)) return null;
+	let replaced = 0;
+	const renamed = leftText.replace(replacementMarkerPattern, (marker) => {
+		const mapped = aliases.get(marker);
+		if (!mapped) return marker;
+		replaced++;
+		return mapped;
+	});
+	if (changedCount !== replaced || renamed !== rightText) return null;
+	try {
+		if (!authenticOccurrences(parseNativeRecord(rightText, limits, new AbortController().signal), true)) return null;
+	} catch {
+		return null;
+	}
+	return { aliases: [...aliases] };
+}
+//#endregion
+//#region packages/artifact/src/configured/output/session-source-prefix.ts
+/**
+* Both parts come from the verified frozen primary. The caller locates longerSource through
+* its base source binding. A copied log may have a different path or inode from its ancestor.
+*/
+async function sessionSourcePrefix(short, long, longerSource, signal) {
+	checkAbort(signal);
+	if (!short.native.sessionId?.trim() || !["main", "worker"].includes(short.native.role) || !isDeepStrictEqual(short.native, long.native) || short.source.representation !== long.source.representation || short.source.byteLength > long.source.byteLength || short.recordCount > long.recordCount || short.retainedRecordCount > long.retainedRecordCount) return false;
+	if (short.source.byteLength === long.source.byteLength) return short.source.sha256 === long.source.sha256 && short.recordCount === long.recordCount;
+	if (long.source.representation !== "jsonl" || !longerSource || longerSource.representation !== "jsonl" || longerSource.snapshot.size !== long.source.byteLength || short.source.byteLength === 0 || short.recordCount === long.recordCount) return false;
+	try {
+		checkNativeEvidence(longerSource, long.native);
+		const input = await openConfiguredSource(longerSource, signal, void 0, "stable-prefix");
+		try {
+			const prefix = createHash("sha256");
+			let remaining = short.source.byteLength;
+			let endsAtRecord = false;
+			for await (const chunk of input.chunks) {
+				const take = Math.min(remaining, chunk.byteLength);
+				if (take === 0) continue;
+				prefix.update(chunk.subarray(0, take));
+				remaining -= take;
+				if (remaining === 0) endsAtRecord = chunk[take - 1] === 10;
+			}
+			const full = await input.finish();
+			return remaining === 0 && endsAtRecord && prefix.digest("hex") === short.source.sha256 && full.sha256 === long.source.sha256 && full.byteLength === long.source.byteLength;
+		} finally {
+			await input.close();
+		}
+	} catch (error) {
+		checkAbort(signal);
+		if ([
+			"ARTIFACT_SOURCE_CHANGED",
+			"ARTIFACT_SOURCE_MISSING",
+			"ARTIFACT_SOURCE_UNSAFE",
+			"ARTIFACT_SOURCE_UNREADABLE",
+			"ARTIFACT_SOURCE_TRUNCATED"
+		].includes(safeError(error).message)) return false;
+		throw error;
+	}
+}
+//#endregion
+//#region packages/artifact/src/configured/output/session-extension.ts
+/** Choose an entire already-approved variant. No edited or reconstructed bytes enter transport. */
+async function sessionExtensions(input, signal) {
+	const verified = await checkFrozenOutput(input.primary, signal);
+	const { manifest } = verified;
+	const sessions = new Map(manifest.sessions.map((session) => [session.id, session]));
+	const groups = input.groups.map((group) => group.map((id) => sessions.get(id) ?? fail("ARTIFACT_IDENTITY_MISMATCH")));
+	const paths = new Set(groups.flat().flatMap((session) => session.parts.map((part) => part.dataPath)));
+	const masks = /* @__PURE__ */ new Map();
+	for await (const row of readLogicalJourneyFinalMasks({
+		ledger: input.ledger,
+		primary: input.primary
+	}, signal, paths)) {
+		const entry = masks.get(row.entryPath) ?? /* @__PURE__ */ new Map();
+		if (!masks.has(row.entryPath)) masks.set(row.entryPath, entry);
+		const list = entry.get(row.recordIndex) ?? [];
+		list.push(sessionMaskProof(row));
+		entry.set(row.recordIndex, list);
+	}
+	const archive = await openCheckedOutput(input.primary, verified.checked, signal);
+	const omitted = /* @__PURE__ */ new Set();
+	const aliases = /* @__PURE__ */ new Map();
+	try {
+		for (const group of groups) {
+			const score = (s) => s.parts.reduce((sum, p) => sum + p.retainedRecordCount, 0);
+			const sorted = group.toSorted((a, b) => score(b) - score(a) || Date.parse(input.lastAt(b.id)) - Date.parse(input.lastAt(a.id)) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+			const winner = sorted[0];
+			if (!winner) continue;
+			for (const shorter of sorted.slice(1)) {
+				if (shorter.workspaceId !== winner.workspaceId || shorter.harness !== winner.harness || shorter.treatmentId !== winner.treatmentId || shorter.sourceSessionId !== winner.sourceSessionId || shorter.parts.length !== winner.parts.length || Date.parse(input.lastAt(shorter.id)) > Date.parse(input.lastAt(winner.id))) return null;
+				for (const [index, part] of shorter.parts.entries()) {
+					const long = winner.parts[index];
+					if (!long || part.retainedRecordCount > long.retainedRecordCount || !await sessionSourcePrefix(part, long, input.sourceFor(winner.id, long.sourceId), signal)) return null;
+					if (!await compareParts(archive, manifest, part, long, masks, aliases, signal)) return null;
+				}
+				omitted.add(shorter.id);
+			}
+		}
+		for (const value of aliases.values()) if (aliases.has(value)) return null;
+		await archive.fence();
+		return {
+			omitted,
+			retired: new Set(aliases.keys())
+		};
+	} finally {
+		await archive.close();
+	}
+}
+async function compareParts(archive, manifest, short, long, masks, aliases, signal) {
+	const cleanup = createCleanup();
+	const spools = [];
+	try {
+		for (const part of [short, long]) {
+			const entry = archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+			const expected = manifest.entries.find((d) => d.entryPath === part.dataPath) ?? fail("ARTIFACT_INVALID_MANIFEST");
+			spools.push(await spoolFacts(entry, expected, signal));
+		}
+		const [a, b] = spools;
+		if (!a || !b) return fail("ARTIFACT_INVALID_ARCHIVE");
+		let count = 0;
+		for await (const row of a.lines) {
+			const match = await b.lines.next();
+			if (match.done) return false;
+			const proof = compareSessionRows(row, match.value, masks.get(short.dataPath)?.get(count) ?? [], masks.get(long.dataPath)?.get(count) ?? []);
+			if (!proof) return false;
+			for (const [old, chosen] of proof.aliases) {
+				if (aliases.has(old) && aliases.get(old) !== chosen) return false;
+				aliases.set(old, chosen);
+			}
+			count++;
+		}
+		if (count !== short.retainedRecordCount) return false;
+		for await (const _ of b.lines) count++;
+		return count === long.retainedRecordCount;
+	} catch (error) {
+		cleanup.failed(error);
+		throw error;
+	} finally {
+		await cleanup.run(...spools.flatMap((s) => [() => s.lines.return(void 0), () => s.close()]));
+	}
+}
+/** Matches complete decoded marker spellings, including Unicode escape spellings in native JSON. */
+function refersToRetiredMarker(text, retired) {
+	let candidate = text;
+	for (let depth = 0; /\\u[\da-f]{4}/iu.test(candidate); depth++) {
+		if (depth >= 8) return true;
+		candidate = candidate.replace(/\\+u([\da-f]{4})/giu, (_, digits) => String.fromCharCode(Number.parseInt(digits, 16)));
+	}
+	for (const match of candidate.matchAll(replacementMarkerPattern)) if (retired.has(match[0])) return true;
+	return false;
+}
+/** Search all kept uploaded fields of a confirmed Work before retiring an alias in another session. */
+async function hasRetiredSessionMarker(primary, omitted, retired, signal) {
+	if (!retired.size) return false;
+	const verified = await checkFrozenOutput(primary, signal);
+	const archive = await openCheckedOutput(primary, verified.checked, signal);
+	try {
+		const entries = new Map(verified.manifest.entries.map((entry) => [entry.entryPath, entry]));
+		for (const workspace of verified.manifest.sourceWorkspaces) if (refersToRetiredMarker(await readOutputJson(archive.entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), entries.get(workspace.metadataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE"), signal), retired)) return true;
+		for (const session of verified.manifest.sessions) {
+			if (omitted.has(session.id)) continue;
+			for (const part of session.parts) {
+				const entry = archive.entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				const expected = entries.get(part.dataPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
+				for await (const row of entryLines(entry, expected, signal)) if (refersToRetiredMarker(row, retired)) return true;
+			}
+		}
+		return false;
+	} finally {
+		await archive.close();
+	}
+}
+//#endregion
+export { createConfiguredPreviewStream as $, captureLogicalJourneySources as A, defaultParallelism as B, writePrivateReviewPayload as C, createCollectionArtifacts as D, readConfiguredSearchFields as E, parseCollectionWorkspaceSummary as F, readLogicalJourneyFinalMasks as G, parallelismLimits as H, createSharedSessionPool as I, confirmedFamily as J, readConfiguredOutputInfo as K, SessionWorkerError as L, renderJobDigest as M, runConfiguredSessionJob as N, checkReusableBundle as O, readCollectionIndex as P, listAgentSetup as Q, sessionWorkerFailure as R, writeLogicalJourneyBase as S, readOriginalSearchFields as T, writeLogicalJourneyOutput as U, gitSeedsProvider as V, privateJourneyDirectory as W, staticMaskCategory as X, confirmedTitleSpans as Y, readWorkspacePair as Z, captureConfiguredSessionJob as _, prepareSessionScans as a, safeError as at, readStaticSessionMasks as b, createWorkPieces as c, openPrivateFile as ct, scanPreparedSession as d, isWindowsAclFailure as dt, createInspectionProcessor as et, runConfiguredScanJob as f, windowsAclCodes as ft, openConfiguredUpload as g, configuredSessionUploads as h, verifyPreparedSessionSources as i, createCleanup as it, capturedJourneyScope as j, prepareCollectionProduction as k, readSessionScanFields as l, restrictToOwner as lt, writeOutputShard as m, sessionExtensions as n, createTemporary as nt, buildWorkScanBatches as o, exclusiveLock as ot, verifyOutputShard as p, processJourneyMetadataFields as q, preparedScanConfiguration as r, removeNamedTemporarySpools as rt, scanReviewFields as s, makePrivateDirectory as st, hasRetiredSessionMarker as t, decodeZstd as tt, readSessionScanRecords as u, windowsOwnerOnly as ut, readCapturedOriginalRows as v, readPrivateReviewPayload as w, staticSessionJobs as x, processJourneyMetadata as y, privateCollectionDirectory as z };