@gitroll/tacitt-cli 0.6.11 → 0.6.13

package/dist/{src-D1iONla3.mjs → src-CttNuxOn.mjs}

@@ -1,4 +1,4 @@
-import { $ as bTermSchema, A as indexBRanges, At as packageConfirmActionSchema, B as unownedBObligations, Bn as cleanupImplementationVersion, Bt as termOverrideValueSchema, C as createBAnalysisUnits, Ct as hidePlanResourceSchema, D as bLiteralTerms, Dt as cardsSubmitSchema, E as bLiteralAdmitted, Et as cardsConfirmActionSchema, F as bUnitFragments, Fn as staticOptions, Ft as emptyReviewCorrectionSchema, G as codePointSlice, H as bEvidenceReader, Ht as termTypeSchema, I as bAdoptedObligations, Jt as journeyProfileAddressActionSchema, K as createCodePointIndex, Kt as sessionPeriodSchema, Lt as reviewTermsInputSchema, M as bDuplicateMirror, Mt as privacyTermKey, Nn as createStaticProcessor, O as bLiterals, On as currentDetectorVersion, P as bLegacyBindings, Pn as staticDefaults, Q as bSessionDecisionSchema, Qn as orderProfile, R as bIssue, Rt as reviewTermsResultSchema, S as validateBReview, St as hidePlanInputSchema, T as validateBUnit, Tt as cardAnswerActionSchema, U as bDigest, Ut as termTypes, V as bAnchorKey, Vn as entityDictionaryVersion, Vt as termTypeInfo, W as codePointLength, Wt as deselectOutsidePeriod, X as bRetainedGroupSchema, Y as bRepresentationSchema, Yt as journeyProfileLinksActionSchema, Z as bReviewSubmissionSchema, Zn as validateProfile, _ as reviewFindingsDigest, _t as journeyInstructionInputSchema, a as reviewBatchChunks, ar as detectStatic, at as journeyAccessSchema, c as reviewDigest, cn as reviewFamilies, ct as journeyExceptionSchema, d as validateReview, dn as observeSource, dt as journeyPreferenceScopeSchema, en as respondProfileLinks, er as validatePlan, et as bAnchorSchema, f as findingReferenceKey, fn as sourceSnapshotId, ft as journeyProjectTypeSchema, g as reviewAlignmentSchema, gn as sourcePartSchema, gt as journeyGuidanceSchema, h as reviewAlignmentInputSchema, hr as defaultDetectionLimits, ht as reviewInterruptionSchema, i as compileBFindings, in as safeCode, it as consentedWithoutAccount, jn as gapReasons, jt as privacyResolveSchema, k as uncoveredBObligations, kn as inspectionSemanticVersions, kt as emptyJourneyPrivacy, l as reviewSubmitSchema, ln as sourceGraph, lt as journeyIdSchema, m as reviewAlignmentAuditSchema, mn as inventorySchema, mr as scalarBefore, mt as nativeJourneySchema, nn as ApplicationError, nt as bIdSchema, o as reviewBatchSchema, on as familyNeedsReview, ot as journeyChoiceSchema, pn as fileIdentitySchema, pr as scalarAfter, pt as journeyWorkTypeSchema, q as subtractBRanges, qt as emptyJourneyProfile, rn as UnfinishedJourneyError, rt as bMethod, s as reviewChunkSchema, sn as familySelected, sr as staticCategories, st as journeyDigestSchema, tn as classificationTitleMaskSchema, tr as copyData, tt as bCountSchema, u as textDigest, un as sourceKey, ur as createEntityMatcher, ut as journeyKindSchema, v as validateReviewAlignment, vn as nativeSourceIdentitySchema, vt as delegatedDecisionSchema, w as validateBFields, wt as journeyConfigurationSchema, x as validateBClassification, xt as hideConfirmSchema, y as semanticFindingSchema, yt as journeyDescribeSchema, z as bOverlaps, zt as termAssessmentSchema } from "./locate-Cx52Zqxv.mjs";
+import { $ as createCodePointIndex, $n as validateProfile, A as bLegacyBindings, An as currentDetectorVersion, B as bIssue, Bt as reviewTermsResultSchema, C as validateBReview, Ct as hideConfirmSchema, Dt as cardAnswerActionSchema, E as validateBUnit, Et as journeyConfigurationSchema, F as bLiterals, Fn as createStaticProcessor, G as bReviewSubmissionSchema, Gt as termTypes, H as unownedBObligations, Hn as cleanupImplementationVersion, Ht as termOverrideValueSchema, I as uncoveredBObligations, In as staticDefaults, J as bAnchorKey, Jt as sessionPeriodSchema, K as bSessionDecisionSchema, Kt as deselectOutsidePeriod, L as indexBRanges, Ln as staticOptions, Lt as emptyReviewCorrectionSchema, M as semanticFindingSchema, Mt as packageConfirmActionSchema, N as bLiteralAdmitted, Nn as gapReasons, Nt as privacyResolveSchema, O as bDuplicateMirror, Ot as cardsConfirmActionSchema, P as bLiteralTerms, Pt as privacyTermKey, Q as codePointSlice, R as bAdoptedObligations, S as validateBClassification, T as validateBFields, Tt as hidePlanResourceSchema, U as bRepresentationSchema, Un as entityDictionaryVersion, Ut as termTypeInfo, V as bOverlaps, Vt as termAssessmentSchema, W as bRetainedGroupSchema, Wt as termTypeSchema, X as bDigest, Xt as journeyProfileAddressActionSchema, Y as bEvidenceReader, Yt as emptyJourneyProfile, Z as codePointLength, Zt as journeyProfileLinksActionSchema, _ as reviewAlignmentInputSchema, _r as defaultDetectionLimits, _t as reviewInterruptionSchema, an as UnfinishedJourneyError, at as bMethod, b as validateReviewAlignment, bn as nativeSourceIdentitySchema, bt as delegatedDecisionSchema, c as reviewBatchSchema, cn as familyNeedsReview, ct as journeyChoiceSchema, d as reviewSubmitSchema, dn as sourceGraph, dt as journeyIdSchema, er as orderProfile, et as subtractBRanges, f as textDigest, fn as sourceKey, fr as createEntityMatcher, ft as journeyKindSchema, g as reviewAlignmentAuditSchema, gn as inventorySchema, gr as scalarBefore, gt as nativeJourneySchema, hn as fileIdentitySchema, hr as scalarAfter, ht as journeyWorkTypeSchema, in as ApplicationError, it as bIdSchema, j as bUnitFragments, jn as inspectionSemanticVersions, jt as emptyJourneyPrivacy, kt as cardsSubmitSchema, l as reviewChunkSchema, ln as familySelected, lr as staticCategories, lt as journeyDigestSchema, m as findingReferenceKey, mn as sourceSnapshotId, mt as journeyProjectTypeSchema, nn as respondProfileLinks, nr as validatePlan, nt as bAnchorSchema, o as compileBFindings, on as safeCode, ot as consentedWithoutAccount, p as validateReview, pn as observeSource, pt as journeyPreferenceScopeSchema, q as bTermSchema, rn as classificationTitleMaskSchema, rr as copyData, rt as bCountSchema, s as reviewBatchChunks, sr as detectStatic, st as journeyAccessSchema, u as reviewDigest, un as reviewFamilies, ut as journeyExceptionSchema, v as reviewAlignmentSchema, vn as sourcePartSchema, vt as journeyGuidanceSchema, w as createBAnalysisUnits, wt as hidePlanInputSchema, xt as journeyDescribeSchema, y as reviewFindingsDigest, yt as journeyInstructionInputSchema, zt as reviewTermsInputSchema } from "./locate-PLEyLYW-.mjs";
 import { z } from "zod";
 import { createHash, createHmac, createSecretKey, randomUUID } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -1199,100 +1199,439 @@ function requireSelecting(run) {
 	if (run.phase !== "selecting") throw new ApplicationError("INVALID_TRANSITION");
 }
 //#endregion
-//#region packages/application/src/journey/placement/readiness.ts
-function hasCompleteWorkDescription(work) {
-	return work.placement === "placed" && !!work.description.trim() && work.classificationRecommendation !== null;
-}
+//#region packages/processing/src/session/marker.ts
 /**
-* Dropped Works are not AI-read; a Work emptied by repartition has nothing left to read, and
-* roots classification has not grouped yet are read once they join a Work (E2).
+* One complete replacement marker as bindings and semantic markers write it. Group 1 names the
+* static method, or `semantic` for an AI-review span. Dependency-free so the browser can use it.
 */
-function isSelectedWork(work) {
-	return work.access !== "drop" && work.rootSessionIds.length > 0 && work.placement !== "classifying";
+const replacementMarkerPattern = /\[sp_[a-z0-9]{8,48}_([a-z][a-z0-9_]{0,47})_[a-f0-9]{24,64}\]/gu;
+//#endregion
+//#region packages/application/src/journey/b/matches.ts
+function bDictionaryHits(fields, literals, signal = new AbortController().signal) {
+	const matcher = createEntityMatcher([...new Set(literals.map((part) => part.term))].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	const hits = [];
+	for (const field of fields) {
+		const index = createCodePointIndex(field.text);
+		const base = field.start ?? 0;
+		for (const match of matcher.find(field.text, signal, 1e5)) {
+			if (hits.length >= 1e6) throw new ApplicationError("PROCESSING_LIMIT");
+			const body = {
+				fieldId: field.id,
+				fieldHash: field.fieldHash,
+				recordId: field.recordId,
+				start: base + index.codePointOffset(match.range.start),
+				end: base + index.codePointOffset(match.range.end),
+				exactQuote: field.text.slice(match.range.start, match.range.end),
+				term: match.entity.value
+			};
+			hits.push({
+				...body,
+				digest: bDigest(JSON.stringify(body))
+			});
+		}
+	}
+	return [...new Map(hits.map((hit) => [hit.digest, hit])).values()];
 }
-/** Classification published some Works and is still grouping the remaining roots (E2). */
-function isClassifying(state) {
-	return state.works.some((work) => work.placement === "classifying");
+function unclassifiedBHits(hits, literals, negative) {
+	const issues = [];
+	const positiveFields = new Map([...Map.groupBy(literals, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
+	const negativeFields = new Map([...Map.groupBy(negative, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
+	for (const hit of hits) {
+		const positive = positiveFields.get(hit.fieldId)?.relation(hit).covers ?? false;
+		const negative = negativeFields.get(hit.fieldId)?.relation(hit);
+		if (!positive && !negative?.covers || positive && negative?.overlaps) issues.push(bIssue(positive ? "CONFLICTING_PRIVACY_DECISIONS" : "UNCLASSIFIED_MATCH", hit));
+	}
+	return issues;
 }
-/**
-* A Work whose read failed: it is skipped for this Send without a decision (ADR 0236). It holds no
-* reading, card, packaging or Send gate and is never sent; Retry or a move out of Drop reads it
-* again. A pending Hide also blocks the Works it changes, but those wait for its recovery and are
-* not skipped. The Skill helpers mirror this rule in `journey-state.mjs`.
-*/
-function isSkippedWork(work) {
-	return work.status === "blocked" && !work.blockedCodes.includes("PRIVACY_CHANGE_PENDING") && currentReviewInterruptions(work).length === 0;
+const bSpacedWord = (value) => /[\p{L}\p{N}_]/u.test(value) && !/[\p{sc=Han}\p{sc=Hiragana}\p{sc=Katakana}\p{sc=Thai}\p{sc=Lao}\p{sc=Khmer}\p{sc=Myanmar}]/u.test(value);
+/** In decoded tool text an odd backslash run escapes its following n, r or t. */
+function afterEscapedSpace(text, start) {
+	const letter = text[start - 1];
+	if (letter !== "n" && letter !== "r" && letter !== "t") return false;
+	let index = start - 2;
+	while (index >= 0 && text[index] === "\\") index--;
+	return (start - 2 - index) % 2 === 1;
 }
-/** A selected Work that is not skipped (ADR 0236). */
-function isIncludedWork(work) {
-	return isSelectedWork(work) && !isSkippedWork(work);
+/** A confirmed Hide value matches only where it does not run into a neighbouring word (ADR 0069). */
+function bWordBounded(text, start, end, toolResultEscapes = false) {
+	return !(bSpacedWord(scalarBefore(text, start)) && bSpacedWord(scalarAfter(text, start)) && !(toolResultEscapes && afterEscapedSpace(text, start)) || bSpacedWord(scalarBefore(text, end)) && bSpacedWord(scalarAfter(text, end)));
 }
 /**
-* ADR 0274: Public needs a recorded choice: the person's panel click or named conversation
-* answer (origin `explicit`), or, under ADR 0275, the account proof that every root was already
-* Public (origin and channel `account`). A Public Work stored before `accessChoice` existed is
-* still pending. Mirrored by `phaseOf` in the Skill's `journey-state.mjs` and by the panel's
-* `WorkAccess`.
+* Occurrences of a Work's explicit exceptions, matched like Hide everywhere: exact NFC values
+* over complete graphemes. A confirmed Hide value inside one stays visible there.
 */
-function hasPublicChoice(work) {
-	if (work.access !== "public") return true;
-	if (!work.accessConfirmed || !work.accessChoice) return false;
-	return work.accessChoice.channel === "account" ? work.accessOrigin === "account" : work.accessOrigin === "explicit";
-}
-/** ADR 0277 slice 2 display projection. Send consent remains a separate gate. */
-function publicSource(work) {
-	if (!isIncludedWork(work) || work.access !== "public" || work.accountAccessConflict) return null;
-	if (!hasPublicChoice(work)) return "suggestion";
-	return work.accessChoice?.channel === "account" ? "account" : "choice";
+function bExceptionRanges(values) {
+	const matcher = createEntityMatcher([...new Set([...values].map((value) => value.normalize("NFC")))].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	return (text, signal = new AbortController().signal) => matcher.find(text, signal, 1e5).filter(({ range, entity }) => text.slice(range.start, range.end).normalize("NFC") === entity.value).map(({ range }) => range);
 }
-function selectedWorks(state) {
-	return state.works.filter(isSelectedWork);
+/** Whether a range lies inside one of `ranges`: a prefix maximum of ends, O(log n) per query. */
+function bContainment(ranges) {
+	const sorted = ranges.toSorted((a, b) => a.start - b.start);
+	const reach = [];
+	for (const [index, range] of sorted.entries()) reach.push(Math.max(range.end, reach[index - 1] ?? range.end));
+	return (range) => {
+		let low = 0, high = sorted.length;
+		while (low < high) {
+			const middle = low + high >> 1;
+			if ((sorted[middle]?.start ?? Infinity) <= range.start) low = middle + 1;
+			else high = middle;
+		}
+		return low > 0 && (reach[low - 1] ?? -1) >= range.end;
+	};
 }
-/** Categories found only in Dropped Works are neither asked nor counted. */
-function unselectedGroupIds(state) {
-	const selected = new Set(selectedWorks(state).flatMap((work) => work.groupIds));
-	return new Set(state.works.filter((work) => !isSelectedWork(work)).flatMap((work) => work.groupIds).filter((id) => !selected.has(id)));
+/**
+* Word-bounded, exact, case-sensitive NFC occurrences of the terms, in UTF-16 coordinates,
+* except where an explicit exception occurrence contains one.
+*/
+function bTermMatcher(terms, exceptions = []) {
+	const matcher = createEntityMatcher([...new Set(terms)].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	const excepted = bExceptionRanges(exceptions);
+	return (text, signal = new AbortController().signal) => {
+		const hits = matcher.find(text, signal, 1e5).filter(({ range }) => bWordBounded(text, range.start, range.end));
+		const kept = hits.length ? bContainment(excepted(text, signal)) : () => false;
+		return hits.filter(({ range }) => !kept(range)).map(({ range, entity }) => ({
+			...range,
+			term: entity.value
+		}));
+	};
 }
-/** Every root without batches is covered by an empty-input or explicit exclusion proof. */
-function hasCertifiedNoBatchReview(work, snapshotId) {
-	const proofs = [work.emptyReview, work.excludedReview].filter((proof) => proof !== void 0);
-	if (!proofs.length || proofs.some((proof) => proof.snapshotId !== snapshotId || proof.inputRevision !== work.inputRevision)) return false;
-	const roots = proofs.flatMap((proof) => proof.rootSessionIds);
-	return roots.length === work.rootSessionIds.length && new Set(roots).size === roots.length && work.rootSessionIds.every((id) => roots.includes(id));
+/** Dictionary hits that a confirmed Hide value masks at render, so they need no classification. */
+function bMaskedHits(fields, terms) {
+	const byId = new Map(fields.map((field) => [field.id, {
+		text: field.text,
+		index: createCodePointIndex(field.text),
+		base: field.start ?? 0
+	}]));
+	return (hit) => {
+		const field = byId.get(hit.fieldId);
+		return !!field && terms.has(hit.term) && bWordBounded(field.text, field.index.offset(hit.start - field.base), field.index.offset(hit.end - field.base));
+	};
 }
-/** A reused Work ID cannot carry an old input generation's failed review forward. */
-function currentReviewInterruptions(work) {
-	return (work.reviewInterruptions ?? []).filter((item) => item.inputRevision === work.inputRevision);
+//#endregion
+//#region packages/application/src/journey/terms/groups.ts
+const keyPrefix = "type:";
+const termGroupKey = (type) => `${keyPrefix}${type}`;
+/** RFC 9562 UUID version 5 of `name` in the `namespace` UUID. */
+function uuidV5(namespace, name) {
+	const bytes = createHash("sha1").update(Buffer.from(namespace.replaceAll("-", ""), "hex")).update(name, "utf8").digest().subarray(0, 16);
+	bytes.writeUInt8(bytes.readUInt8(6) & 15 | 80, 6);
+	bytes.writeUInt8(bytes.readUInt8(8) & 63 | 128, 8);
+	const hex = bytes.toString("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-/** Reading completes over included Works once the person has confirmed the scan scope. */
-function isReadingComplete(state) {
-	return state.scope.status === "confirmed" && state.works.length > 0 && !isClassifying(state) && state.works.filter(isIncludedWork).every((work) => currentReviewInterruptions(work).length === 0 && work.status !== "pending" && work.status !== "blocked" && (work.totalBatches > 0 || hasCertifiedNoBatchReview(work, state.snapshotId)) && work.completedBatches === work.totalBatches);
+/** Deterministic: every reader and writer of a journey names a type's group alike. */
+const termGroupId = (journeyId, type) => uuidV5(journeyId, type);
+/** The term type a group answers, or null for any other category. */
+function termGroupType(group) {
+	if (!group.key.startsWith(keyPrefix)) return null;
+	const parsed = termTypeSchema.safeParse(group.key.slice(5));
+	return parsed.success ? parsed.data : null;
 }
-/** Recompute completion after a selection or reading change without leaving a paused/send phase. */
-function withReadingProgress(state) {
-	const readingComplete = isReadingComplete(state);
-	const phase = state.phase === "paused" || !state.snapshotId ? state.phase : readingComplete ? state.phase === "processing" ? "review" : state.phase : state.phase === "review" || state.phase === "ready" ? "processing" : state.phase;
+const typeGroup = (state, type) => state.groups.find((group) => termGroupType(group) === type);
+function newTypeGroup(state, type, preference) {
+	const info = termTypeInfo[type];
+	const base = {
+		id: termGroupId(state.journeyId, type),
+		kind: info.kind,
+		key: termGroupKey(type),
+		label: info.label,
+		condition: info.condition,
+		count: 0,
+		preferenceScope: null,
+		representative: null
+	};
+	if (!info.asked) return {
+		...base,
+		belief: .97,
+		choice: "hide",
+		confirmed: true,
+		origin: "policy"
+	};
+	if (state.questionsPaused) return {
+		...base,
+		belief: .97,
+		choice: "hide",
+		confirmed: false,
+		origin: "paused"
+	};
 	return {
-		...state,
-		readingComplete,
-		phase
+		...base,
+		belief: preference === null ? .5 : preference === "hide" ? .97 : .03,
+		choice: preference,
+		confirmed: false,
+		origin: preference === null ? "model" : "preference"
 	};
 }
+/**
+* One group per type with at least one dictionary value, `count` its distinct values. Existing
+* groups keep their identity and answer; other groups are unchanged.
+*/
+function syncTermGroups(state, counts, preference) {
+	const groups = state.groups.map((group) => {
+		const type = termGroupType(group);
+		return type === null ? group : {
+			...group,
+			count: counts.get(type) ?? group.count
+		};
+	});
+	for (const type of termTypes) {
+		const count = counts.get(type) ?? 0;
+		if (count === 0 || groups.some((group) => termGroupType(group) === type)) continue;
+		groups.push({
+			...newTypeGroup(state, type, preference(termGroupKey(type))),
+			count
+		});
+	}
+	return groups;
+}
 //#endregion
-//#region packages/application/src/journey/send/model.ts
-const count$13 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
-const access = z.enum(["public", "private"]);
-const sendSourceSchema = z.object({
-	id: z.string().regex(/^w[0-9]{6,}$/u),
-	pathHash: journeyDigestSchema.nullable(),
-	remoteHashes: z.array(journeyDigestSchema),
-	primaryRemoteHash: journeyDigestSchema.nullable(),
-	challengeId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u).optional()
-}).strict();
-function agentSourcePathSegment(value) {
-	return /^[A-Za-z0-9.][A-Za-z0-9._-]*$/u.test(value) && value !== "." && value !== "..";
+//#region packages/application/src/journey/review/confirmed-hides.ts
+/** Kinds from lowest to highest mask priority. */
+const confirmedHideKinds = [
+	"internal",
+	"identity",
+	"private",
+	"credentials"
+];
+const kinds = confirmedHideKinds;
+const rank$1 = (kind) => kinds.indexOf(kind);
+/**
+* ADR 0086: a type's values are hidden unless its group is answered Keep; before an answer the
+* default is Hide. Credentials and contact details are always hidden (D06).
+*/
+function typeHides(state, type) {
+	const group = typeGroup(state, type);
+	return !termTypeInfo[type].asked || !group?.confirmed || group.choice !== "keep";
 }
-/** Local candidates become public only after anonymous upload-time evidence checks. */
+/** B review (superseded by ADR 0086): IDs of the categories confirmed as Hide. */
+const confirmedHideGroupIds = (state) => state.groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => group.id);
+const overrideKey = (state) => (state.valueOverrides ?? []).map((item) => JSON.stringify([
+	item.type,
+	item.value,
+	item.choice
+])).toSorted();
+/**
+* Identifies the hidden set (ADR 0079, 0086). The dictionary only grows and a type's group
+* counts its distinct values, so each type's count and Hide answer, with the value overrides,
+* name exactly one hidden set.
+*/
+function confirmedHideKey(state) {
+	return createHash("sha256").update(JSON.stringify({
+		types: termTypes.map((type) => [
+			type,
+			typeGroup(state, type)?.count ?? 0,
+			typeHides(state, type)
+		]),
+		overrides: overrideKey(state),
+		terms: state.privacy.terms.filter((term) => term.disposition === "hidden").map((term) => [term.type, term.value]).toSorted((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+	})).digest("hex");
+}
+/** Whether two states hold the same value overrides. */
+const sameValueOverrides = (left, right) => JSON.stringify(overrideKey(left)) === JSON.stringify(overrideKey(right));
+/**
+* A preparation's waived hits stay waived only while every category recorded for them is still a
+* confirmed Hide; otherwise render may no longer mask them, so the session needs reconciliation.
+*/
+function maskedHitsStale(maskedHits, hiding) {
+	const current = new Set(hiding);
+	return !!maskedHits?.some((hit) => hit.groupIds.some((id) => !current.has(id)));
+}
+/**
+* ADR 0086 hidden set: values of types not answered Keep, minus Keep overrides, plus Hide
+* overrides, plus every value of an always-hidden type. A value of several types takes the
+* highest mask kind among the types hiding it.
+*/
+function dictionaryHides(state, terms) {
+	const overrides = state.valueOverrides ?? [];
+	const kept = new Set(overrides.flatMap((item) => item.choice === "keep" ? [item.value] : []));
+	const hidden = /* @__PURE__ */ new Map();
+	const add = (value, type) => {
+		const prior = hidden.get(value);
+		const kind = termTypeInfo[type].kind;
+		hidden.set(value, {
+			kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
+			groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], termGroupId(state.journeyId, type)])].sort()
+		});
+	};
+	const all = [...terms];
+	const hiddenValues = new Set(state.privacy.terms.filter((item) => item.disposition === "hidden").map((item) => item.value));
+	for (const term of all) if (hiddenValues.has(term.value) && !kept.has(term.value)) add(term.value, term.type);
+	for (const item of overrides) if (item.choice === "hide") add(item.value, item.type);
+	for (const term of all) if (!termTypeInfo[term.type].asked) add(term.value, term.type);
+	for (const value of state.rememberedHides ?? []) if (!hidden.has(value) && !kept.has(value)) add(value, "projects");
+	return hidden;
+}
+/** The journey's current hidden set, applied to every selected Work (ADR 0086, D03). */
+async function journeyConfirmedHides(reader, state) {
+	return dictionaryHides(state, [...await reader.journeyTerms({ journeyId: state.journeyId }), ...state.privacy.terms]);
+}
+function confirmedHideTerms(groups, records) {
+	const confirmed = new Map(groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => [group.id, group]));
+	const fields = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const assigned = new Map(record.assignments.map((item) => [item.findingId, item.groupId]));
+		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
+		for (const finding of record.findings) {
+			const group = confirmed.get(assigned.get(finding.id) ?? "");
+			const chunk = chunks.get(finding.chunkId);
+			if (!group || !chunk || finding.class !== "gray") continue;
+			const key = JSON.stringify([chunk.fieldId, chunk.fieldHash]);
+			fields.set(key, [...fields.get(key) ?? [], {
+				start: chunk.offset + finding.start,
+				end: chunk.offset + finding.end,
+				text: chunk.text.slice(finding.start, finding.end),
+				split: [finding.start === 0, finding.end === chunk.text.length],
+				group
+			}]);
+		}
+	}
+	const terms = /* @__PURE__ */ new Map();
+	const add = (text, groupIds, kind) => {
+		for (const term of bLiteralTerms(text)) {
+			const prior = terms.get(term);
+			terms.set(term, {
+				kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
+				groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], ...groupIds])].sort()
+			});
+		}
+	};
+	for (const spans of fields.values()) {
+		let open;
+		for (const span of spans.toSorted((a, b) => a.start - b.start || b.end - a.end)) {
+			if (open && span.split[0] && span.start === open.end) {
+				open.text += span.text;
+				open.end = span.end;
+				open.groupIds.push(span.group.id);
+			} else {
+				if (open) add(open.text, open.groupIds, open.kind);
+				open = {
+					end: span.end,
+					text: span.text,
+					groupIds: [span.group.id],
+					kind: span.group.kind
+				};
+			}
+			if (!span.split[1]) {
+				add(open.text, open.groupIds, open.kind);
+				open = void 0;
+			}
+		}
+		if (open) add(open.text, open.groupIds, open.kind);
+	}
+	return terms;
+}
+//#endregion
+//#region packages/application/src/journey/placement/readiness.ts
+function hasCompleteWorkDescription(work) {
+	return work.placement === "placed" && !!work.description.trim() && work.classificationRecommendation !== null;
+}
+/** Explain why a requested Work still has no usable output after rendering. */
+function unfinishedPackagingCode(work) {
+	if (!work) return "REVISION_CONFLICT";
+	if (work.renderFailure?.revision === work.revision) return work.renderFailure.code;
+	if (!hasCompleteWorkDescription(work)) return "WORK_METADATA_INCOMPLETE";
+	if (!work.accessConfirmed) return "CONFIRMATION_REQUIRED";
+	return "PACKAGING_FAILED";
+}
+/**
+* Dropped Works are not AI-read; a Work emptied by repartition has nothing left to read, and
+* roots classification has not grouped yet are read once they join a Work (E2).
+*/
+function isSelectedWork(work) {
+	return work.access !== "drop" && work.rootSessionIds.length > 0 && work.placement !== "classifying";
+}
+/** Classification published some Works and is still grouping the remaining roots (E2). */
+function isClassifying(state) {
+	return state.works.some((work) => work.placement === "classifying");
+}
+/**
+* A Work whose read failed: it is skipped for this Send without a decision (ADR 0236). It holds no
+* reading, card, packaging or Send gate and is never sent; Retry or a move out of Drop reads it
+* again. A pending Hide also blocks the Works it changes, but those wait for its recovery and are
+* not skipped. The Skill helpers mirror this rule in `journey-state.mjs`.
+*/
+function isSkippedWork(work) {
+	return work.status === "blocked" && !work.blockedCodes.includes("PRIVACY_CHANGE_PENDING") && currentReviewInterruptions(work).length === 0;
+}
+/** A selected Work that is not skipped (ADR 0236). */
+function isIncludedWork(work) {
+	return isSelectedWork(work) && !isSkippedWork(work);
+}
+/**
+* ADR 0274: Public needs a recorded choice: the person's panel click or named conversation
+* answer (origin `explicit`), or, under ADR 0275, the account proof that every root was already
+* Public (origin and channel `account`). A Public Work stored before `accessChoice` existed is
+* still pending. Mirrored by `phaseOf` in the Skill's `journey-state.mjs` and by the panel's
+* `WorkAccess`.
+*/
+function hasPublicChoice(work) {
+	if (work.access !== "public") return true;
+	if (!work.accessConfirmed || !work.accessChoice) return false;
+	return work.accessChoice.channel === "account" ? work.accessOrigin === "account" : work.accessOrigin === "explicit";
+}
+/** ADR 0277 slice 2 display projection. Send consent remains a separate gate. */
+function publicSource(work) {
+	if (!isIncludedWork(work) || work.access !== "public" || work.accountAccessConflict) return null;
+	if (!hasPublicChoice(work)) return "suggestion";
+	return work.accessChoice?.channel === "account" ? "account" : "choice";
+}
+function selectedWorks(state) {
+	return state.works.filter(isSelectedWork);
+}
+/** Categories found only in Dropped Works are neither asked nor counted. */
+function unselectedGroupIds(state) {
+	const selected = new Set(selectedWorks(state).flatMap((work) => work.groupIds));
+	return new Set(state.works.filter((work) => !isSelectedWork(work)).flatMap((work) => work.groupIds).filter((id) => !selected.has(id)));
+}
+/** Every root without batches is covered by an empty-input or explicit exclusion proof. */
+function hasCertifiedNoBatchReview(work, snapshotId) {
+	const proofs = [work.emptyReview, work.excludedReview].filter((proof) => proof !== void 0);
+	if (!proofs.length || proofs.some((proof) => proof.snapshotId !== snapshotId || proof.inputRevision !== work.inputRevision)) return false;
+	const roots = proofs.flatMap((proof) => proof.rootSessionIds);
+	return roots.length === work.rootSessionIds.length && new Set(roots).size === roots.length && work.rootSessionIds.every((id) => roots.includes(id));
+}
+/** A reused Work ID cannot carry an old input generation's failed review forward. */
+function currentReviewInterruptions(work) {
+	return (work.reviewInterruptions ?? []).filter((item) => item.inputRevision === work.inputRevision);
+}
+/** Reading completes over included Works once the person has confirmed the scan scope. */
+function isReadingComplete(state) {
+	return state.scope.status === "confirmed" && state.works.length > 0 && !isClassifying(state) && state.works.filter(isIncludedWork).every((work) => currentReviewInterruptions(work).length === 0 && work.status !== "pending" && work.status !== "blocked" && (work.totalBatches > 0 || hasCertifiedNoBatchReview(work, state.snapshotId)) && work.completedBatches === work.totalBatches);
+}
+/** Recompute completion after a selection or reading change without leaving a paused/send phase. */
+function withReadingProgress(state) {
+	const readingComplete = isReadingComplete(state);
+	const phase = state.phase === "paused" || !state.snapshotId ? state.phase : readingComplete ? state.phase === "processing" ? "review" : state.phase : state.phase === "review" || state.phase === "ready" ? "processing" : state.phase;
+	return {
+		...state,
+		readingComplete,
+		phase
+	};
+}
+//#endregion
+//#region packages/application/src/journey/send/model.ts
+const count$13 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const access = z.enum(["public", "private"]);
+const sendSourceSchema = z.object({
+	id: z.string().regex(/^w[0-9]{6,}$/u),
+	pathHash: journeyDigestSchema.nullable(),
+	remoteHashes: z.array(journeyDigestSchema),
+	primaryRemoteHash: journeyDigestSchema.nullable(),
+	challengeId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u).optional()
+}).strict();
+function agentSourcePathSegment(value) {
+	return /^[A-Za-z0-9.][A-Za-z0-9._-]*$/u.test(value) && value !== "." && value !== "..";
+}
+/** Local candidates become public only after anonymous upload-time evidence checks. */
 const agentSourceSchema = z.object({
 	kind: z.enum(["skill", "mcp"]),
 	name: z.string().regex(/^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,199}$/u),
@@ -1443,6 +1782,19 @@ const sendUploadInputSchema = z.object({
 	expectedScopeVersion: count$13
 }).strict();
 const savedSendReceiptSchema = sendReceiptSchema.omit({ upload: true });
+const sendSessionUploadSchema = z.object({
+	key: journeyDigestSchema,
+	sha256: journeyDigestSchema,
+	/** Byte-started transport/server errors charged to this Send. */
+	attempt: count$13.optional(),
+	/** Transient failures used only to schedule capped zero-byte retries. */
+	retryCount: count$13.optional(),
+	bytesAttempted: count$13.optional(),
+	bytesAcknowledged: count$13.optional(),
+	contentLength: count$13.optional(),
+	bytesSent: count$13.optional(),
+	nextAttemptAt: z.iso.datetime().optional()
+}).strict();
 const sendItemSchema = z.object({
 	workId: journeyIdSchema,
 	title: z.string(),
@@ -1471,22 +1823,13 @@ const sendItemSchema = z.object({
 	* uploads through staging (ADR 0231).
 	*/
 	checksumUploadRefused: z.literal(true).optional(),
+	/** Selected session ZIPs confirmed by inventory or completion during this traversal. */
+	storedSessions: count$13.optional(),
 	/** Write-ahead upload intent; completion probes recover an unacknowledged blob PUT. */
-	sessionUpload: z.object({
-		key: journeyDigestSchema,
-		sha256: journeyDigestSchema,
-		/** Byte-started transport/server failures charged to this Send. */
-		attempt: count$13.optional(),
-		/** Transient failures used only to schedule capped zero-byte retries. */
-		retryCount: count$13.optional(),
-		bytesAttempted: count$13.optional(),
-		bytesAcknowledged: count$13.optional(),
-		contentLength: count$13.optional(),
-		bytesSent: count$13.optional(),
-		nextAttemptAt: z.iso.datetime().optional()
-	}).strict().nullable().optional(),
+	sessionUpload: sendSessionUploadSchema.nullable().optional(),
 	/** Local key-rule marker; current membership replays need no artifact migration inspection. */
 	sessionMembershipKeyVersion: z.literal(2).optional(),
+	sessionMembershipMetadataVersion: z.literal(1).optional(),
 	/** Exact write-ahead membership request; never rebase it after an uncertain PUT. */
 	sessionMembership: z.object({
 		workId: journeyIdSchema,
@@ -1658,19 +2001,34 @@ function hasCurrentStaticReview(state, work) {
 }
 //#endregion
 //#region packages/application/src/journey/privacy/record.ts
-/** Merge independently reviewed occurrences into one journey-wide decision. */
-function mergePrivacyTerms(state, incoming) {
-	const terms = new Map(state.privacy.terms.map((term) => [privacyTermKey(term), term]));
+/** Only a stored human rule or an explicitly delegated category choice can settle a reader proposal. */
+function currentTermRules(state) {
 	const overrides = /* @__PURE__ */ new Map();
 	for (const item of state.valueOverrides ?? []) {
 		const value = item.value.normalize("NFC");
 		if (!overrides.has(value)) overrides.set(value, item);
 	}
+	const categories = new Map(state.groups.filter((group) => group.origin === "preference" || group.confirmed && (group.origin === "explicit" || group.origin === "delegate")).map((group) => [group.key, group.choice]));
+	const remembered = new Set(state.rememberedHides ?? []);
+	function choice(term) {
+		const value = term.value.normalize("NFC");
+		return overrides.get(value)?.choice ?? (remembered.has(value) ? "hide" : categories.get(`type:${term.type}`));
+	}
+	return {
+		overrides,
+		choice
+	};
+}
+/** Merge independently reviewed occurrences into one journey-wide decision. */
+function mergePrivacyTerms(state, incoming) {
+	const terms = new Map(state.privacy.terms.map((term) => [privacyTermKey(term), term]));
+	const rules = currentTermRules(state);
+	const overrides = rules.overrides;
 	for (const term of incoming) {
-		const key = privacyTermKey(term), prior = terms.get(key);
-		const override = overrides.get(term.value.normalize("NFC"));
-		const preference = state.groups.find((group) => group.key === `type:${term.type}` && group.origin === "preference");
-		const disposition = !termTypeInfo[term.type].asked ? "hidden" : override ? override.choice === "hide" ? "hidden" : "keep" : preference?.choice ? preference.choice === "hide" ? "hidden" : "keep" : prior?.disposition === "hidden" || term.disposition === "hidden" ? "hidden" : prior && prior.disposition !== term.disposition ? "pending" : term.disposition;
+		const key = privacyTermKey(term);
+		const prior = terms.get(key);
+		const choice = rules.choice(term);
+		const disposition = !termTypeInfo[term.type].asked || choice === "hide" ? "hidden" : choice === "keep" ? "keep" : prior?.disposition === "hidden" || term.disposition === "hidden" ? "hidden" : "pending";
 		const sources = [...new Map([...prior?.sources ?? [], ...term.sources].map((source) => [JSON.stringify(source.kind === "session" ? [
 			source.workId,
 			source.batchId,
@@ -1680,7 +2038,7 @@ function mergePrivacyTerms(state, incoming) {
 			...term,
 			disposition,
 			sources,
-			reason: prior && prior.disposition !== term.disposition ? disposition === "pending" ? "Conflicting scan judgments require a contextual decision." : disposition === "hidden" ? "A Hidden judgment for this keyword takes precedence." : term.reason : term.reason
+			reason: term.disposition === "keep" && disposition === "pending" ? "A current decision is required to keep this value." : choice && term.disposition !== disposition ? "The current value or category decision applies." : prior && prior.disposition !== term.disposition ? disposition === "pending" ? "Conflicting scan judgments require a contextual decision." : disposition === "hidden" ? "A Hidden judgment for this keyword takes precedence." : term.reason : term.reason
 		});
 	}
 	const values = Map.groupBy([...terms.values()], (term) => term.value.normalize("NFC"));
@@ -1715,34 +2073,125 @@ function activePrivacyTerms(state) {
 	return state.works.some((work) => work.access !== "drop" && work.rootSessionIds.length > 0) ? state.privacy.terms : [];
 }
 //#endregion
-//#region packages/application/src/journey/policy/commands.ts
-const journeyFindingReferenceSchema = z.object({
-	batchId: journeyIdSchema,
-	findingId: journeyIdSchema
-}).strict();
-/** Exact original values as `journey.groupItems` lists them; never trimmed or normalized. */
-const journeyExactValuesSchema = z.array(z.string().min(1).max(240)).min(1).max(256);
-const partFields = {
-	groupId: journeyIdSchema,
-	groupKey: z.string().trim().min(1).max(120),
-	label: z.string().trim().min(1).max(120),
-	condition: z.string().trim().min(1).max(1e3),
-	choice: journeyChoiceSchema.nullable()
-};
-const journeyGroupPartSchema = z.object({
-	...partFields,
-	members: z.array(journeyFindingReferenceSchema).min(1).max(1e4)
-}).strict();
-/** A split part names its members exactly, by exact value, or as the rest of the group. */
-const journeySplitPartSchema = z.union([
-	journeyGroupPartSchema,
-	z.object({
-		...partFields,
-		values: journeyExactValuesSchema
-	}).strict(),
-	z.object({
-		...partFields,
-		rest: z.literal(true)
+//#region packages/application/src/export/versions.ts
+/** Current built-in admission, annotation and retention contracts; implementations share these. */
+const nativeAdapterVersions = Object.freeze({
+	claude: "claude-native-export-v19",
+	codex: "codex-native-export-v16"
+});
+/** Shared metadata annotation/preparation semantics, independent of serialization formats. */
+const metadataProcessingVersion = "metadata-annotations-v1";
+//#endregion
+//#region packages/application/src/journey/adapters.ts
+/** The adapter contracts a Journey's snapshot is prepared under. */
+const currentJourneyAdapters = () => ({
+	claude: `${nativeAdapterVersions.claude}/main-prose-source-scan-v3`,
+	codex: `${nativeAdapterVersions.codex}/main-prose-source-scan-v3`
+});
+/**
+* An unfinished snapshot frozen under other adapter contracts (absent: an earlier release), or
+* read by B review instead of dictionary review (ADR 0086), cannot render its Works (ADR 0076).
+* A new scan replaces it unless a Work was sent or a Send may have reached Passport, which the
+* store keeps for the person to finish (ADR 0284).
+*/
+function obsoleteJourney(state) {
+	return state.phase !== "completed" && state.snapshotId !== null && (state.adapters?.claude !== currentJourneyAdapters().claude || state.adapters.codex !== currentJourneyAdapters().codex || state.reviewMethod !== "dictionary");
+}
+/** A receipt or persisted session mutation intent means a Send may have reached Passport. */
+function sendReachedPassport(send) {
+	return send.items.some((item) => item.receipt || item.previousReceipts.length || item.sessionUpload !== void 0 || item.sessionMembership || item.sessionAssembly);
+}
+/**
+* ADR 0284: Passport acknowledged this Send's Work: this Send's receipt for it is past
+* `awaiting_upload`, or its session membership is acknowledged. An `awaiting_upload` receipt is
+* an empty reservation, and a reservation, a session upload intent or a membership intent is saved
+* before the call it announces, so none of them shows that anything left.
+*/
+function itemAtPassport(item) {
+	return Boolean(item.receipt && item.receipt.state !== "awaiting_upload" || item.sessionAssembly);
+}
+/**
+* The Works the next advance steps without the person to send something: an upload, a
+* completion or a confirmed access change. `pickBatch` selects upload work by this; a Work being
+* assessed is only read, and the other states wait on the person or have ended.
+*/
+function sendsOnNextAdvance(item) {
+	return item.status === "uploading" || item.status === "ready";
+}
+/**
+* A completed Send that Passport has not finished with: a Work is still assessed or reapplied
+* (ADR 0233). A blocked Work waits on the person's Retry, not on Passport.
+*/
+function awaitingPassport(send) {
+	return send.status === "completed" && send.items.some((item) => !["completed", "blocked"].includes(item.status));
+}
+/**
+* Whether an advance steps this Send's Works at all. `advanceSend` returns early exactly when this
+* is false: the person paused the journey, the Send is unconfirmed, paused or prepared, or it is
+* completed with every Work settled. A blocked Send is stepped only to re-check its scope.
+*/
+function advanceStepsSend(journey, send) {
+	return journey.phase !== "paused" && send.confirmedAt !== null && send.status !== "paused" && send.status !== "prepared" && !(send.status === "completed" && send.items.every((item) => item.status === "completed" || item.status === "blocked"));
+}
+/**
+* Whether a Send in each state is stepped without the person once `advanceStepsSend` holds.
+* Every status is listed, so a new one fails the type check until it is classified. Unconfirmed
+* requests and the person's pause, refusal, sign-in and review decisions stay explicit.
+*/
+const drivenWithoutPerson = {
+	"awaiting-packaging": false,
+	prepared: false,
+	"sign-in": false,
+	review: false,
+	paused: false,
+	blocked: false,
+	sending: true,
+	waiting: true,
+	completed: true
+};
+/**
+* The one decision whether the advance steps a Send without the person: the detached host's
+* timer drives exactly these Sends, and a CLI step defers to a live host for them (ADR 0271).
+*/
+function hostDrives(journey, send) {
+	return advanceStepsSend(journey, send) && drivenWithoutPerson[send.status];
+}
+/**
+* ADR 0284: a Work at Passport still owes Passport something that this Send's next advance sends
+* without the person. An obsolete journey gives way unless its current Send owes.
+*/
+function sendOwesPassport(journey, send) {
+	return hostDrives(journey, send) && send.items.some((item) => itemAtPassport(item) && sendsOnNextAdvance(item));
+}
+//#endregion
+//#region packages/application/src/journey/policy/commands.ts
+const journeyFindingReferenceSchema = z.object({
+	batchId: journeyIdSchema,
+	findingId: journeyIdSchema
+}).strict();
+/** Exact original values as `journey.groupItems` lists them; never trimmed or normalized. */
+const journeyExactValuesSchema = z.array(z.string().min(1).max(240)).min(1).max(256);
+const partFields = {
+	groupId: journeyIdSchema,
+	groupKey: z.string().trim().min(1).max(120),
+	label: z.string().trim().min(1).max(120),
+	condition: z.string().trim().min(1).max(1e3),
+	choice: journeyChoiceSchema.nullable()
+};
+const journeyGroupPartSchema = z.object({
+	...partFields,
+	members: z.array(journeyFindingReferenceSchema).min(1).max(1e4)
+}).strict();
+/** A split part names its members exactly, by exact value, or as the rest of the group. */
+const journeySplitPartSchema = z.union([
+	journeyGroupPartSchema,
+	z.object({
+		...partFields,
+		values: journeyExactValuesSchema
+	}).strict(),
+	z.object({
+		...partFields,
+		rest: z.literal(true)
 	}).strict()
 ]);
 const journeySplitActionSchema = z.object({
@@ -2067,6 +2516,7 @@ const nativeRespondSchema = z.object({
 const nativeEventsSchema = z.object({
 	journeyId: journeyIdSchema,
 	after: z.number().int().nonnegative(),
+	changesOnly: z.boolean().optional(),
 	waitMs: z.number().int().min(0).max(3e4).default(0)
 }).strict();
 //#endregion
@@ -2141,6 +2591,58 @@ function assertPublicChoices(state) {
 function assertJourneyStaticReady(state) {
 	if (state.works.some((work) => work.access !== "drop" && work.rootSessionIds.length > 0 && !isSkippedWork(work) && !hasCurrentStaticReview(state, work))) throw new ApplicationError("SCOPE_NOT_READY");
 }
+/** Check a proposed or stored Keep against the current structured decisions. An answered
+* card covers its actual members, including the opposite choice for an unticked member. */
+function keepAuthority(state) {
+	const rules = currentTermRules(state);
+	const { keep, hide } = answeredValues(state);
+	const mandatory = new Set(state.privacy.terms.filter((term) => !termTypeInfo[term.type].asked).map((term) => term.value.normalize("NFC")));
+	const own = workProjectNames(state);
+	return (term) => {
+		const value = term.value.normalize("NFC");
+		if (mandatory.has(value)) return "hidden";
+		const override = rules.overrides.get(value);
+		if (override) return override.choice === "keep" ? "keep" : "hidden";
+		if (keep.has(value) && own.has(value.toLowerCase())) return "keep";
+		if (hide.has(value)) return "hidden";
+		if (keep.has(value)) return "keep";
+		const choice = rules.choice(term);
+		return choice === "keep" ? "keep" : choice === "hide" ? "hidden" : "pending";
+	};
+}
+const reconciledKeeps = /* @__PURE__ */ new WeakMap();
+/** Recover unresolved visibility in a stored unfinished journey without repeating source reads. */
+function reconcileReaderKeeps(state) {
+	if (state.phase === "completed") return state;
+	const cached = reconciledKeeps.get(state);
+	if (cached) return cached;
+	let result = state;
+	if (state.privacy.terms.some((term) => term.disposition === "keep")) {
+		const authority = keepAuthority(state);
+		let changed = false;
+		const terms = state.privacy.terms.map((term) => {
+			if (term.disposition !== "keep") return term;
+			const disposition = authority(term);
+			if (disposition === "keep") return term;
+			changed = true;
+			return {
+				...term,
+				disposition,
+				reason: "Current privacy decisions require review of this value."
+			};
+		});
+		if (changed) result = {
+			...retirePrivacyArtifacts(state),
+			privacy: {
+				...state.privacy,
+				terms,
+				packageApproval: null
+			}
+		};
+	}
+	reconciledKeeps.set(state, result);
+	return result;
+}
 /**
 * Cards need only Track A, AI review and metadata; this final gate also needs Track B.
 * `publicChoices` defaults to `packaging`: the Send click checks it before packaging, and the
@@ -2149,7 +2651,7 @@ function assertJourneyStaticReady(state) {
 function assertJourneyPrivacyReady(state, packaging = false, { publicChoices = packaging } = {}) {
 	assertJourneyScanned(state);
 	if (publicChoices) assertPublicChoices(state);
-	if (activePrivacyTerms(state).some((term) => term.disposition === "pending") || state.privacy.cards.length > 0 && (state.privacy.cards.some((card) => !card.answer) || state.privacy.confirmedAnswersRevision !== state.privacy.answersRevision)) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (reconcileReaderKeeps(state) !== state || activePrivacyTerms(state).some((term) => term.disposition === "pending") || state.privacy.cards.length > 0 && (state.privacy.cards.some((card) => !card.answer) || state.privacy.confirmedAnswersRevision !== state.privacy.answersRevision)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	assertJourneyStaticReady(state);
 	if (packaging && state.privacy.packageApproval !== privacyDecisionDigest(state)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 }
@@ -2169,7 +2671,7 @@ function ownIdentityValues(state) {
 }
 /**
 * D3: a batch covers only Pending values no card covers yet. Values added to an existing card
-* take its answer at once when the person already answered it.
+* take its answer, except new literals on an answered Keep card arrive Hidden off-card.
 */
 function appendDecisionCards(state, input) {
 	assertCardsAllowed(state);
@@ -2196,12 +2698,27 @@ function appendDecisionCards(state, input) {
 			if (term?.type === "people" && ownCard && !ownValues.has(identityValue(term.value))) throw new ApplicationError("INVALID_SELECTION", "cards.append.other-person");
 		}
 	}
-	const additions = new Map(extend.map((item) => [item.cardId, item.termKeys]));
-	const inherited = new Map(extend.flatMap((item) => item.termKeys.map((key) => [key, item.cardId])));
+	const keepCards = state.privacy.cards.filter((card) => card.answer?.optionId === "keep");
+	const keptValues = new Set(keepCards.flatMap((card) => card.termKeys.flatMap((key) => {
+		const term = terms.get(key);
+		return term?.disposition === "keep" && !card.answer?.excludedTermKeys?.includes(key) ? [term.value.normalize("NFC")] : [];
+	})));
+	const diverted = new Set(extend.flatMap((item) => keepCards.some((card) => card.id === item.cardId) ? item.termKeys.filter((key) => !keptValues.has(terms.get(key)?.value.normalize("NFC") ?? "")) : []));
+	const joined = extend.map((item) => ({
+		...item,
+		termKeys: item.termKeys.filter((key) => !diverted.has(key))
+	}));
+	const additions = new Map(joined.map((item) => [item.cardId, item.termKeys]));
+	const inherited = new Map(joined.flatMap((item) => item.termKeys.map((key) => [key, item.cardId])));
 	return applyCardAnswers({
 		...retirePrivacyArtifacts(state),
 		privacy: {
 			...state.privacy,
+			terms: state.privacy.terms.map((term) => diverted.has(privacyTermKey(term)) ? {
+				...term,
+				disposition: "hidden",
+				reason: "Found after you answered Keep on its card; hidden."
+			} : term),
 			cards: [...state.privacy.cards.map((card) => {
 				const added = additions.get(card.id);
 				if (!added) return card;
@@ -2264,11 +2781,14 @@ function resolvePrivacyTerms(state, input) {
 			terms
 		}
 	}), (term) => term.value.normalize("NFC")).values()) if (same.some((term) => term.disposition === "pending") && input.resolutions.some((item) => item.value.normalize("NFC") === same[0]?.value.normalize("NFC"))) throw new ApplicationError("INVALID_SELECTION");
+	const normalized = normalizeValues(state, terms);
+	const canKeep = keepAuthority(state);
+	if (normalized.some((term) => resolutions.has(privacyTermKey(term)) && term.disposition === "keep" && canKeep(term) !== "keep")) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	return {
 		...retirePrivacyArtifacts(state),
 		privacy: {
 			...state.privacy,
-			terms: normalizeValues(state, terms),
+			terms: normalized,
 			packageApproval: null
 		}
 	};
@@ -2281,6 +2801,34 @@ function answeredKeys(state, optionId) {
 		return card.answer.optionId === optionId ? card.termKeys.filter((key) => !excluded.has(key)) : [...excluded];
 	}));
 }
+/**
+* Values the person hid with their own panel answer, still on that card and Hidden now; the next
+* journey hides them on arrival (issue #126). Never sent anywhere.
+*/
+function rememberedHideValues(state) {
+	const keys = new Set(state.privacy.cards.flatMap((card) => {
+		if (card.answer?.optionId !== "hide" || card.answer.source !== "panel") return [];
+		const excluded = new Set(card.answer.excludedTermKeys ?? []);
+		return card.termKeys.filter((key) => !excluded.has(key));
+	}));
+	return [...new Set(state.privacy.terms.filter((term) => term.disposition === "hidden" && keys.has(privacyTermKey(term))).map((term) => term.value.normalize("NFC")))];
+}
+function answeredValues(state) {
+	const keepKeys = answeredKeys(state, "keep");
+	const hideKeys = answeredKeys(state, "hide");
+	const keep = /* @__PURE__ */ new Set();
+	const hide = /* @__PURE__ */ new Set();
+	for (const term of state.privacy.terms) {
+		const key = privacyTermKey(term);
+		const value = term.value.normalize("NFC");
+		if (keepKeys.has(key)) keep.add(value);
+		if (hideKeys.has(key)) hide.add(value);
+	}
+	return {
+		keep,
+		hide
+	};
+}
 /** One NFC value has one outcome across term types, cards and per-value rules. */
 function normalizeValues(state, input) {
 	const active = activePrivacyTerms({
@@ -2290,17 +2838,8 @@ function normalizeValues(state, input) {
 			terms: input
 		}
 	});
-	const overrides = /* @__PURE__ */ new Map();
-	for (const item of state.valueOverrides ?? []) {
-		const value = item.value.normalize("NFC");
-		if (!overrides.has(value)) overrides.set(value, item);
-	}
-	const cardValues = (optionId) => {
-		const keys = answeredKeys(state, optionId);
-		return new Set(state.privacy.terms.filter((term) => keys.has(privacyTermKey(term))).map((term) => term.value.normalize("NFC")));
-	};
-	const hideCardValues = cardValues("hide");
-	const keepCardValues = cardValues("keep");
+	const { overrides } = currentTermRules(state);
+	const { keep: keepCardValues, hide: hideCardValues } = answeredValues(state);
 	const ownNames = workProjectNames(state);
 	const normalized = /* @__PURE__ */ new Map();
 	for (const same of Map.groupBy(active, (term) => term.value.normalize("NFC")).values()) {
@@ -2372,6 +2911,7 @@ function respondPrivacy(state, action, source) {
 				rule: [option.rule, action.rule?.trim()].filter(Boolean).join("\n"),
 				additionalRule: action.rule?.trim() ?? "",
 				remember: action.remember,
+				source,
 				...excluded.length ? { excludedTermKeys: excluded } : {}
 			}
 		});
@@ -2404,6 +2944,7 @@ function respondPrivacy(state, action, source) {
 		};
 	}
 	if (action.kind === "package-confirm") {
+		if (obsoleteJourney(state)) throw new ApplicationError("JOURNEY_OBSOLETE");
 		assertPublicChoices(state);
 		assertJourneyPrivacyReady(state);
 		return {
@@ -2552,7 +3093,9 @@ const journeyClassificationReadSchema = z.object({
 	journeyId: journeyIdSchema,
 	workId: journeyIdSchema,
 	rootSessionId: z.string().min(1).max(128).optional(),
-	cursor: classificationCursorSchema.optional()
+	cursor: classificationCursorSchema.optional(),
+	/** Classification-only prefix; omitted callers retain full capture verification. */
+	limit: z.number().int().min(1).max(8).optional()
 }).strict();
 const journeyClassificationSubmitSchema = z.object({
 	journeyId: journeyIdSchema,
@@ -2579,6 +3122,12 @@ const journeyClassificationSubmitSchema = z.object({
 	*/
 	expectedClassificationRevision: count$10.optional()
 }).strict();
+/** Restore only the split families that can be proven against the accepted original proposal. */
+const isolatedMetadataRecoverySchema = z.object({
+	proposal: journeyClassificationSubmitSchema,
+	workIds: z.array(journeyIdSchema).min(1).max(1e3),
+	idempotencyKey: journeyIdSchema
+}).strict();
 const journeyClassificationSessionsSchema = z.object({
 	journeyId: journeyIdSchema,
 	workId: journeyIdSchema,
@@ -2716,401 +3265,86 @@ const correctionReportSchema = z.object({
 	groupId: journeyIdSchema,
 	kind: journeyKindSchema,
 	reason: z.string().trim().min(1).max(1e3),
-	anchors: z.array(correctionAnchorSchema).min(1).max(256)
-}).strict();
-const reviewCorrectSchema = z.object({
-	journeyId: journeyIdSchema,
-	expectedRevision: z.number().int().nonnegative(),
-	idempotencyKey: journeyIdSchema,
-	report: correctionReportSchema
-}).strict();
-/** Immutable private report receipt; the only place where correction quotes are retained. */
-const correctionReportResourceSchema = z.object({
-	journeyId: journeyIdSchema,
-	kind: z.literal("correction-report"),
-	id: journeyIdSchema,
-	requestHash: journeyDigestSchema,
-	at: z.iso.datetime(),
-	snapshotId: journeyDigestSchema,
-	batchDigest: journeyDigestSchema,
-	decisionDigest: journeyDigestSchema,
-	report: correctionReportSchema
-}).strict();
-const correctionAuditSchema = z.object({
-	reportId: journeyIdSchema,
-	action: z.enum([
-		"report",
-		"hide",
-		"dismiss"
-	]),
-	actor: z.enum([
-		"observer",
-		"human",
-		"delegate"
-	]),
-	authorityId: journeyIdSchema.nullable(),
-	decisionDigest: journeyDigestSchema
-}).strict();
-//#endregion
-//#region packages/application/src/journey/correction/binding.ts
-function workCorrections(state, workId) {
-	return (state.corrections ?? []).filter((item) => item.workId === workId);
-}
-/** Binds rendered output and generated metadata to every correction disposition of the Work. */
-function workCorrectionBinding(state, workId) {
-	const corrections = workCorrections(state, workId);
-	return corrections.length ? corrections.map(({ id, groupId, inputRevision, batchId, status, disposition }) => ({
-		id,
-		groupId,
-		inputRevision,
-		batchId,
-		status,
-		choice: disposition?.choice ?? null,
-		decisionDigest: disposition?.decisionDigest ?? null
-	})) : null;
-}
-//#endregion
-//#region packages/application/src/journey/placement/decisions.ts
-function workPrivacyDecisions(state, work) {
-	return state.groups.filter((group) => work.groupIds.includes(group.id)).map(({ id, key, kind, label, condition, choice, confirmed }) => ({
-		id,
-		key,
-		kind,
-		label,
-		condition,
-		choice,
-		confirmed
-	})).sort((a, b) => a.id.localeCompare(b.id));
-}
-/** Corrections are additive under an unchanged Hide group, so they bind metadata review too. */
-function workDecisionDigest(state, work) {
-	const decisions = workPrivacyDecisions(state, work);
-	const corrections = workCorrectionBinding(state, work.id);
-	return textDigest(JSON.stringify(corrections ? {
-		decisions,
-		corrections
-	} : decisions));
-}
-/** Retire generated text until it is reviewed; the processed project name keeps rows distinct. */
-function retireWorkDescription(work) {
-	return {
-		...work,
-		suggestion: null
-	};
-}
-//#endregion
-//#region packages/application/src/journey/terms/groups.ts
-const keyPrefix = "type:";
-const termGroupKey = (type) => `${keyPrefix}${type}`;
-/** RFC 9562 UUID version 5 of `name` in the `namespace` UUID. */
-function uuidV5(namespace, name) {
-	const bytes = createHash("sha1").update(Buffer.from(namespace.replaceAll("-", ""), "hex")).update(name, "utf8").digest().subarray(0, 16);
-	bytes.writeUInt8(bytes.readUInt8(6) & 15 | 80, 6);
-	bytes.writeUInt8(bytes.readUInt8(8) & 63 | 128, 8);
-	const hex = bytes.toString("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-/** Deterministic: every reader and writer of a journey names a type's group alike. */
-const termGroupId = (journeyId, type) => uuidV5(journeyId, type);
-/** The term type a group answers, or null for any other category. */
-function termGroupType(group) {
-	if (!group.key.startsWith(keyPrefix)) return null;
-	const parsed = termTypeSchema.safeParse(group.key.slice(5));
-	return parsed.success ? parsed.data : null;
-}
-const typeGroup = (state, type) => state.groups.find((group) => termGroupType(group) === type);
-function newTypeGroup(state, type, preference) {
-	const info = termTypeInfo[type];
-	const base = {
-		id: termGroupId(state.journeyId, type),
-		kind: info.kind,
-		key: termGroupKey(type),
-		label: info.label,
-		condition: info.condition,
-		count: 0,
-		preferenceScope: null,
-		representative: null
-	};
-	if (!info.asked) return {
-		...base,
-		belief: .97,
-		choice: "hide",
-		confirmed: true,
-		origin: "policy"
-	};
-	if (state.questionsPaused) return {
-		...base,
-		belief: .97,
-		choice: "hide",
-		confirmed: false,
-		origin: "paused"
-	};
-	return {
-		...base,
-		belief: preference === null ? .5 : preference === "hide" ? .97 : .03,
-		choice: preference,
-		confirmed: false,
-		origin: preference === null ? "model" : "preference"
-	};
-}
-/**
-* One group per type with at least one dictionary value, `count` its distinct values. Existing
-* groups keep their identity and answer; other groups are unchanged.
-*/
-function syncTermGroups(state, counts, preference) {
-	const groups = state.groups.map((group) => {
-		const type = termGroupType(group);
-		return type === null ? group : {
-			...group,
-			count: counts.get(type) ?? group.count
-		};
-	});
-	for (const type of termTypes) {
-		const count = counts.get(type) ?? 0;
-		if (count === 0 || groups.some((group) => termGroupType(group) === type)) continue;
-		groups.push({
-			...newTypeGroup(state, type, preference(termGroupKey(type))),
-			count
-		});
-	}
-	return groups;
-}
-//#endregion
-//#region packages/application/src/journey/review/confirmed-hides.ts
-/** Kinds from lowest to highest mask priority. */
-const confirmedHideKinds = [
-	"internal",
-	"identity",
-	"private",
-	"credentials"
-];
-const kinds = confirmedHideKinds;
-const rank$1 = (kind) => kinds.indexOf(kind);
-/**
-* ADR 0086: a type's values are hidden unless its group is answered Keep; before an answer the
-* default is Hide. Credentials and contact details are always hidden (D06).
-*/
-function typeHides(state, type) {
-	const group = typeGroup(state, type);
-	return !termTypeInfo[type].asked || !group?.confirmed || group.choice !== "keep";
-}
-/** B review (superseded by ADR 0086): IDs of the categories confirmed as Hide. */
-const confirmedHideGroupIds = (state) => state.groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => group.id);
-const overrideKey = (state) => (state.valueOverrides ?? []).map((item) => JSON.stringify([
-	item.type,
-	item.value,
-	item.choice
-])).toSorted();
-/**
-* Identifies the hidden set (ADR 0079, 0086). The dictionary only grows and a type's group
-* counts its distinct values, so each type's count and Hide answer, with the value overrides,
-* name exactly one hidden set.
-*/
-function confirmedHideKey(state) {
-	return createHash("sha256").update(JSON.stringify({
-		types: termTypes.map((type) => [
-			type,
-			typeGroup(state, type)?.count ?? 0,
-			typeHides(state, type)
-		]),
-		overrides: overrideKey(state),
-		terms: state.privacy.terms.filter((term) => term.disposition === "hidden").map((term) => [term.type, term.value]).toSorted((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
-	})).digest("hex");
-}
-/** Whether two states hold the same value overrides. */
-const sameValueOverrides = (left, right) => JSON.stringify(overrideKey(left)) === JSON.stringify(overrideKey(right));
-/**
-* A preparation's waived hits stay waived only while every category recorded for them is still a
-* confirmed Hide; otherwise render may no longer mask them, so the session needs reconciliation.
-*/
-function maskedHitsStale(maskedHits, hiding) {
-	const current = new Set(hiding);
-	return !!maskedHits?.some((hit) => hit.groupIds.some((id) => !current.has(id)));
-}
-/**
-* ADR 0086 hidden set: values of types not answered Keep, minus Keep overrides, plus Hide
-* overrides, plus every value of an always-hidden type. A value of several types takes the
-* highest mask kind among the types hiding it.
-*/
-function dictionaryHides(state, terms) {
-	const overrides = state.valueOverrides ?? [];
-	const kept = new Set(overrides.flatMap((item) => item.choice === "keep" ? [item.value] : []));
-	const hidden = /* @__PURE__ */ new Map();
-	const add = (value, type) => {
-		const prior = hidden.get(value);
-		const kind = termTypeInfo[type].kind;
-		hidden.set(value, {
-			kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
-			groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], termGroupId(state.journeyId, type)])].sort()
-		});
-	};
-	const all = [...terms];
-	const hiddenValues = new Set(state.privacy.terms.filter((item) => item.disposition === "hidden").map((item) => item.value));
-	for (const term of all) if (hiddenValues.has(term.value) && !kept.has(term.value)) add(term.value, term.type);
-	for (const item of overrides) if (item.choice === "hide") add(item.value, item.type);
-	for (const term of all) if (!termTypeInfo[term.type].asked) add(term.value, term.type);
-	return hidden;
-}
-/** The journey's current hidden set, applied to every selected Work (ADR 0086, D03). */
-async function journeyConfirmedHides(reader, state) {
-	return dictionaryHides(state, [...await reader.journeyTerms({ journeyId: state.journeyId }), ...state.privacy.terms]);
-}
-function confirmedHideTerms(groups, records) {
-	const confirmed = new Map(groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => [group.id, group]));
-	const fields = /* @__PURE__ */ new Map();
-	for (const record of records) {
-		const assigned = new Map(record.assignments.map((item) => [item.findingId, item.groupId]));
-		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
-		for (const finding of record.findings) {
-			const group = confirmed.get(assigned.get(finding.id) ?? "");
-			const chunk = chunks.get(finding.chunkId);
-			if (!group || !chunk || finding.class !== "gray") continue;
-			const key = JSON.stringify([chunk.fieldId, chunk.fieldHash]);
-			fields.set(key, [...fields.get(key) ?? [], {
-				start: chunk.offset + finding.start,
-				end: chunk.offset + finding.end,
-				text: chunk.text.slice(finding.start, finding.end),
-				split: [finding.start === 0, finding.end === chunk.text.length],
-				group
-			}]);
-		}
-	}
-	const terms = /* @__PURE__ */ new Map();
-	const add = (text, groupIds, kind) => {
-		for (const term of bLiteralTerms(text)) {
-			const prior = terms.get(term);
-			terms.set(term, {
-				kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
-				groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], ...groupIds])].sort()
-			});
-		}
-	};
-	for (const spans of fields.values()) {
-		let open;
-		for (const span of spans.toSorted((a, b) => a.start - b.start || b.end - a.end)) {
-			if (open && span.split[0] && span.start === open.end) {
-				open.text += span.text;
-				open.end = span.end;
-				open.groupIds.push(span.group.id);
-			} else {
-				if (open) add(open.text, open.groupIds, open.kind);
-				open = {
-					end: span.end,
-					text: span.text,
-					groupIds: [span.group.id],
-					kind: span.group.kind
-				};
-			}
-			if (!span.split[1]) {
-				add(open.text, open.groupIds, open.kind);
-				open = void 0;
-			}
-		}
-		if (open) add(open.text, open.groupIds, open.kind);
-	}
-	return terms;
-}
-//#endregion
-//#region packages/application/src/journey/b/matches.ts
-function bDictionaryHits(fields, literals, signal = new AbortController().signal) {
-	const matcher = createEntityMatcher([...new Set(literals.map((part) => part.term))].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	const hits = [];
-	for (const field of fields) {
-		const index = createCodePointIndex(field.text);
-		const base = field.start ?? 0;
-		for (const match of matcher.find(field.text, signal, 1e5)) {
-			if (hits.length >= 1e6) throw new ApplicationError("PROCESSING_LIMIT");
-			const body = {
-				fieldId: field.id,
-				fieldHash: field.fieldHash,
-				recordId: field.recordId,
-				start: base + index.codePointOffset(match.range.start),
-				end: base + index.codePointOffset(match.range.end),
-				exactQuote: field.text.slice(match.range.start, match.range.end),
-				term: match.entity.value
-			};
-			hits.push({
-				...body,
-				digest: bDigest(JSON.stringify(body))
-			});
-		}
-	}
-	return [...new Map(hits.map((hit) => [hit.digest, hit])).values()];
-}
-function unclassifiedBHits(hits, literals, negative) {
-	const issues = [];
-	const positiveFields = new Map([...Map.groupBy(literals, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
-	const negativeFields = new Map([...Map.groupBy(negative, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
-	for (const hit of hits) {
-		const positive = positiveFields.get(hit.fieldId)?.relation(hit).covers ?? false;
-		const negative = negativeFields.get(hit.fieldId)?.relation(hit);
-		if (!positive && !negative?.covers || positive && negative?.overlaps) issues.push(bIssue(positive ? "CONFLICTING_PRIVACY_DECISIONS" : "UNCLASSIFIED_MATCH", hit));
-	}
-	return issues;
-}
-const bSpacedWord = (value) => /[\p{L}\p{N}_]/u.test(value) && !/[\p{sc=Han}\p{sc=Hiragana}\p{sc=Katakana}\p{sc=Thai}\p{sc=Lao}\p{sc=Khmer}\p{sc=Myanmar}]/u.test(value);
-/** A confirmed Hide value matches only where it does not run into a neighbouring word (ADR 0069). */
-function bWordBounded(text, start, end) {
-	return !(bSpacedWord(scalarBefore(text, start)) && bSpacedWord(scalarAfter(text, start)) || bSpacedWord(scalarBefore(text, end)) && bSpacedWord(scalarAfter(text, end)));
+	anchors: z.array(correctionAnchorSchema).min(1).max(256)
+}).strict();
+const reviewCorrectSchema = z.object({
+	journeyId: journeyIdSchema,
+	expectedRevision: z.number().int().nonnegative(),
+	idempotencyKey: journeyIdSchema,
+	report: correctionReportSchema
+}).strict();
+/** Immutable private report receipt; the only place where correction quotes are retained. */
+const correctionReportResourceSchema = z.object({
+	journeyId: journeyIdSchema,
+	kind: z.literal("correction-report"),
+	id: journeyIdSchema,
+	requestHash: journeyDigestSchema,
+	at: z.iso.datetime(),
+	snapshotId: journeyDigestSchema,
+	batchDigest: journeyDigestSchema,
+	decisionDigest: journeyDigestSchema,
+	report: correctionReportSchema
+}).strict();
+const correctionAuditSchema = z.object({
+	reportId: journeyIdSchema,
+	action: z.enum([
+		"report",
+		"hide",
+		"dismiss"
+	]),
+	actor: z.enum([
+		"observer",
+		"human",
+		"delegate"
+	]),
+	authorityId: journeyIdSchema.nullable(),
+	decisionDigest: journeyDigestSchema
+}).strict();
+//#endregion
+//#region packages/application/src/journey/correction/binding.ts
+function workCorrections(state, workId) {
+	return (state.corrections ?? []).filter((item) => item.workId === workId);
 }
-/**
-* Occurrences of a Work's explicit exceptions, matched like Hide everywhere: exact NFC values
-* over complete graphemes. A confirmed Hide value inside one stays visible there.
-*/
-function bExceptionRanges(values) {
-	const matcher = createEntityMatcher([...new Set([...values].map((value) => value.normalize("NFC")))].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	return (text, signal = new AbortController().signal) => matcher.find(text, signal, 1e5).filter(({ range, entity }) => text.slice(range.start, range.end).normalize("NFC") === entity.value).map(({ range }) => range);
+/** Binds rendered output and generated metadata to every correction disposition of the Work. */
+function workCorrectionBinding(state, workId) {
+	const corrections = workCorrections(state, workId);
+	return corrections.length ? corrections.map(({ id, groupId, inputRevision, batchId, status, disposition }) => ({
+		id,
+		groupId,
+		inputRevision,
+		batchId,
+		status,
+		choice: disposition?.choice ?? null,
+		decisionDigest: disposition?.decisionDigest ?? null
+	})) : null;
 }
-/** Whether a range lies inside one of `ranges`: a prefix maximum of ends, O(log n) per query. */
-function bContainment(ranges) {
-	const sorted = ranges.toSorted((a, b) => a.start - b.start);
-	const reach = [];
-	for (const [index, range] of sorted.entries()) reach.push(Math.max(range.end, reach[index - 1] ?? range.end));
-	return (range) => {
-		let low = 0, high = sorted.length;
-		while (low < high) {
-			const middle = low + high >> 1;
-			if ((sorted[middle]?.start ?? Infinity) <= range.start) low = middle + 1;
-			else high = middle;
-		}
-		return low > 0 && (reach[low - 1] ?? -1) >= range.end;
-	};
+//#endregion
+//#region packages/application/src/journey/placement/decisions.ts
+function workPrivacyDecisions(state, work) {
+	return state.groups.filter((group) => work.groupIds.includes(group.id)).map(({ id, key, kind, label, condition, choice, confirmed }) => ({
+		id,
+		key,
+		kind,
+		label,
+		condition,
+		choice,
+		confirmed
+	})).sort((a, b) => a.id.localeCompare(b.id));
 }
-/**
-* Word-bounded, exact, case-sensitive NFC occurrences of the terms, in UTF-16 coordinates,
-* except where an explicit exception occurrence contains one.
-*/
-function bTermMatcher(terms, exceptions = []) {
-	const matcher = createEntityMatcher([...new Set(terms)].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	const excepted = bExceptionRanges(exceptions);
-	return (text, signal = new AbortController().signal) => {
-		const hits = matcher.find(text, signal, 1e5).filter(({ range }) => bWordBounded(text, range.start, range.end));
-		const kept = hits.length ? bContainment(excepted(text, signal)) : () => false;
-		return hits.filter(({ range }) => !kept(range)).map(({ range, entity }) => ({
-			...range,
-			term: entity.value
-		}));
-	};
+/** Corrections are additive under an unchanged Hide group, so they bind metadata review too. */
+function workDecisionDigest(state, work) {
+	const decisions = workPrivacyDecisions(state, work);
+	const corrections = workCorrectionBinding(state, work.id);
+	return textDigest(JSON.stringify(corrections ? {
+		decisions,
+		corrections
+	} : decisions));
 }
-/** Dictionary hits that a confirmed Hide value masks at render, so they need no classification. */
-function bMaskedHits(fields, terms) {
-	const byId = new Map(fields.map((field) => [field.id, {
-		text: field.text,
-		index: createCodePointIndex(field.text),
-		base: field.start ?? 0
-	}]));
-	return (hit) => {
-		const field = byId.get(hit.fieldId);
-		return !!field && terms.has(hit.term) && bWordBounded(field.text, field.index.offset(hit.start - field.base), field.index.offset(hit.end - field.base));
+/** Retire generated text until it is reviewed; the processed project name keeps rows distinct. */
+function retireWorkDescription(work) {
+	return {
+		...work,
+		suggestion: null
 	};
 }
 const segmenter = new Intl.Segmenter("und", { granularity: "grapheme" });
@@ -3126,6 +3360,14 @@ const maximumHideIndexTokens = 2e6;
 * has too many such positions to list.
 */
 function addHideIndexTokens(text, add) {
+	let complete = ordinaryTokens(text, add);
+	if (text.includes("\\")) {
+		if (/^\s*[[{]/u.test(text) && text.includes("\\u")) return false;
+		for (const [, word] of text.matchAll(/\\[nrt]([\p{L}\p{N}\p{M}_]+)/gu)) if (word) complete = ordinaryTokens(word, add) && complete;
+	}
+	return complete;
+}
+function ordinaryTokens(text, add) {
 	let complete = true;
 	let from = 0;
 	for (const { index } of text.matchAll(/[^\p{ASCII}]+/gu)) {
@@ -3340,8 +3582,9 @@ function memberChange(previous, next) {
 	return counts.every((count) => count >= 0) ? "additions" : counts.every((count) => count <= 0) ? "removals" : "other";
 }
 /**
-* Whether a Work's output may change with the delta (Work metadata is never masked, so a
-* generated description never retires on its own). Without a delta that covers this exact change every Work is affected, as ADR 0069 first decided, except when
+* Whether a Work's output may change with the delta (generated descriptions remain unmasked
+* and never retire output on their own; titles are covered by the output index). Without a
+* delta that covers this exact change every Work is affected, as ADR 0069 first decided, except when
 * members were only removed: no value is then added, so nothing can be under-hidden, and an
 * output may keep masking a value that left its category until it is rendered again.
 */
@@ -3944,6 +4187,40 @@ const journeyPreparationProgressSchema = z.object({
 	capturedBytes: preparationCountSchema
 }).strict();
 //#endregion
+//#region packages/application/src/journey/inventory/progress.ts
+/** State-only gate: the scope is confirmed and a selected Work still waits for preparation. */
+function preparationInProgress(state) {
+	return state.consent !== null && state.snapshotId !== null && state.scope.status === "confirmed" && state.works.some((work) => work.status === "pending" && isSelectedWork(work));
+}
+/**
+* Capture counts cover only the selected Works' frozen parts, so Dropped Works never hold the
+* total open. Captured bytes can end below the frozen size at a complete record boundary.
+* Current Works are the pending selected Works whose newest attempt has no settlement, in
+* Work order; several prepare at once.
+*/
+function projectPreparationProgress(state, families, captures, starts, settlements) {
+	const selected = state.works.filter(isSelectedWork);
+	const sizes = /* @__PURE__ */ new Map();
+	for (const id of selected.flatMap((work) => work.rootSessionIds)) {
+		const members = families.members.get(id);
+		if (!members) throw new ApplicationError("CORRUPTED_STATE");
+		for (const part of members.flatMap((session) => session.parts)) sizes.set(part.id, part.snapshot.size);
+	}
+	const captured = captures.filter((resource) => sizes.has(resource.partId));
+	const settled = new Set(settlements.map((item) => item.id));
+	return {
+		currentWorkIds: selected.filter((work) => {
+			if (work.status !== "pending") return false;
+			const newest = starts.filter((start) => start.workId === work.id && start.inputRevision === work.inputRevision).reduce((latest, start) => !latest || start.sequence > latest.sequence ? start : latest, void 0);
+			return newest !== void 0 && !settled.has(newest.id);
+		}).map((work) => work.id),
+		targetParts: sizes.size,
+		capturedParts: captured.length,
+		targetBytes: [...sizes.values()].reduce((sum, size) => sum + size, 0),
+		capturedBytes: captured.reduce((sum, resource) => sum + resource.bytes, 0)
+	};
+}
+//#endregion
 //#region packages/application/src/source/resolve.ts
 /** Queue-based ancestry resolution cannot leak deep descendants through a recursion cutoff. */
 function resolveParts(inventory, route) {
@@ -4646,7 +4923,7 @@ const sessionReconcileResultSchema = z.object({
 //#endregion
 //#region packages/application/src/journey/review/attempt-model.ts
 /**
-* At most twenty small-model analysis agents run at once (D12, raised on 2026-10-20). One agent receives at most
+* At most twenty-four small-model analysis agents run at once (raised on 2026-11-14). One agent receives at most
 * 240,000 code points and 48 units; attempts dispatched with the same `packId` share one agent.
 */
 const reviewAgentCodePoints = 24e4;
@@ -4857,6 +5134,31 @@ const journeyCaptureSchema = z.object({
 	source: sourcePartSchema
 }).strict();
 const base = { journeyId: journeyIdSchema };
+const journeyOutputSchema = z.object({
+	...base,
+	kind: z.literal("output"),
+	workId: journeyIdSchema,
+	revision: z.number().int().positive(),
+	bundleId: journeyIdSchema,
+	decisionDigest: journeyDigestSchema,
+	primary: journeyFileSchema,
+	companion: journeyFileSchema,
+	finalMaskLedger: journeyFileSchema.extend({
+		primarySha256: journeyDigestSchema,
+		basePrimarySha256: journeyDigestSchema,
+		workId: journeyIdSchema,
+		inputRevision: z.number().int().positive(),
+		decisionDigest: journeyDigestSchema,
+		occurrences: z.number().int().nonnegative(),
+		contributors: z.number().int().nonnegative(),
+		categories: z.object({
+			identity: z.number().int().nonnegative(),
+			credentials: z.number().int().nonnegative(),
+			internal: z.number().int().nonnegative(),
+			private: z.number().int().nonnegative()
+		}).strict()
+	}).strict()
+}).strict();
 const journeyResourceSchema = z.discriminatedUnion("kind", [
 	z.object({
 		...base,
@@ -4976,31 +5278,7 @@ const journeyResourceSchema = z.discriminatedUnion("kind", [
 			bundleSourceId: z.string().min(1)
 		}).strict())
 	}).strict(),
-	z.object({
-		...base,
-		kind: z.literal("output"),
-		workId: journeyIdSchema,
-		revision: z.number().int().positive(),
-		bundleId: journeyIdSchema,
-		decisionDigest: journeyDigestSchema,
-		primary: journeyFileSchema,
-		companion: journeyFileSchema,
-		finalMaskLedger: journeyFileSchema.extend({
-			primarySha256: journeyDigestSchema,
-			basePrimarySha256: journeyDigestSchema,
-			workId: journeyIdSchema,
-			inputRevision: z.number().int().positive(),
-			decisionDigest: journeyDigestSchema,
-			occurrences: z.number().int().nonnegative(),
-			contributors: z.number().int().nonnegative(),
-			categories: z.object({
-				identity: z.number().int().nonnegative(),
-				credentials: z.number().int().nonnegative(),
-				internal: z.number().int().nonnegative(),
-				private: z.number().int().nonnegative()
-			}).strict()
-		}).strict()
-	}).strict()
+	journeyOutputSchema
 ]);
 const journeyResourceQuerySchema = z.union([
 	z.object({
@@ -5057,40 +5335,37 @@ const journeyResourceQuerySchema = z.union([
 	}).strict()
 ]);
 //#endregion
-//#region packages/application/src/journey/inventory/progress.ts
-/** State-only gate: the scope is confirmed and a selected Work still waits for preparation. */
-function preparationInProgress(state) {
-	return state.consent !== null && state.snapshotId !== null && state.scope.status === "confirmed" && state.works.some((work) => work.status === "pending" && isSelectedWork(work));
-}
-/**
-* Capture counts cover only the selected Works' frozen parts, so Dropped Works never hold the
-* total open. Captured bytes can end below the frozen size at a complete record boundary.
-* Current Works are the pending selected Works whose newest attempt has no settlement, in
-* Work order; several prepare at once.
-*/
-function projectPreparationProgress(state, plan, captures, starts, settlements) {
-	const families = reviewFamilies(plan.approval.inventory);
-	const selected = state.works.filter(isSelectedWork);
-	const sizes = /* @__PURE__ */ new Map();
-	for (const id of selected.flatMap((work) => work.rootSessionIds)) {
-		const members = families.members.get(id);
-		if (!members) throw new ApplicationError("CORRUPTED_STATE");
-		for (const part of members.flatMap((session) => session.parts)) sizes.set(part.id, part.snapshot.size);
-	}
-	const captured = captures.filter((resource) => sizes.has(resource.capture.partId));
-	const settled = new Set(settlements.map((item) => item.id));
-	return {
-		currentWorkIds: selected.filter((work) => {
-			if (work.status !== "pending") return false;
-			const newest = starts.filter((start) => start.workId === work.id && start.inputRevision === work.inputRevision).reduce((latest, start) => !latest || start.sequence > latest.sequence ? start : latest, void 0);
-			return newest !== void 0 && !settled.has(newest.id);
-		}).map((work) => work.id),
-		targetParts: sizes.size,
-		capturedParts: captured.length,
-		targetBytes: [...sizes.values()].reduce((sum, size) => sum + size, 0),
-		capturedBytes: captured.reduce((sum, resource) => sum + resource.capture.facts.byteLength, 0)
-	};
-}
+//#region packages/application/src/journey/send/port.ts
+/** Storage validates current package approval before releasing one Work's frozen descriptor. */
+const sendOutputQuerySchema = z.object({
+	journeyId: z.uuid(),
+	workId: z.uuid(),
+	revision: z.number().int().positive(),
+	sessions: z.boolean()
+}).strict();
+const sendOutputSchema = z.object({
+	output: journeyOutputSchema,
+	extension: z.object({
+		approval: z.string(),
+		groups: z.array(z.array(z.string())),
+		sources: z.array(z.object({
+			session: z.string(),
+			source: z.string(),
+			part: sourcePartSchema
+		})),
+		outputs: z.array(z.object({
+			workId: z.uuid(),
+			revision: z.number().int(),
+			sha256: z.string(),
+			bundleId: z.string()
+		}))
+	}).strict().optional(),
+	identities: z.array(z.object({
+		archiveSessionId: z.string(),
+		relativePath: z.string(),
+		lastAt: z.iso.datetime()
+	}).strict())
+}).strict();
 //#endregion
 //#region packages/application/src/journey/policy/port.ts
 const journeyPolicyRespondSchema = z.object({
@@ -5224,6 +5499,14 @@ function newJourneyWork(id, projectName, rootSessionIds, sourceWorkspaceIds, pla
 		binding: null
 	};
 }
+/** Stable blocked Work IDs per parent, so later failing roots join one instead of multiplying. */
+function isolatedWorkId(parentId, ordinal) {
+	const bytes = createHash("sha256").update(`isolated-roots:${parentId}:${ordinal}`).digest().subarray(0, 16);
+	bytes[6] = (bytes[6] ?? 0) & 15 | 64;
+	bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+	const hex = bytes.toString("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
 //#endregion
 //#region packages/application/src/journey/scan-generation.ts
 /** Retire one scan generation while preserving the person's confirmed classification. */
@@ -5890,6 +6173,7 @@ function respondToJourney(state, action, source, now, decision, preferenceScope,
 				reason: action.reason
 			}];
 		} else {
+			if (source !== "panel") throw new ApplicationError("CONFIRMATION_REQUIRED");
 			if (previous?.reason !== "retry-exhausted") throw new ApplicationError("INVALID_TRANSITION");
 			nextHolds = holds.filter((item) => item.packId !== action.packId);
 		}
@@ -6001,7 +6285,7 @@ function answeredRule(card) {
 /** A dispatch without a pack ID is its own analysis agent. */
 const agentKey = (attemptId, packId) => packId === void 0 ? `attempt:${attemptId}` : `pack:${packId}`;
 /**
-* Refuses a dispatch that would run more than twenty agents at once, or give one agent more than
+* Refuses a dispatch that would run more than twenty-four agents at once, or give one agent more than
 * 240,000 code points or 48 units. A full reservation (repair or reconciliation) fills an agent,
 * so it always runs alone.
 */
@@ -6020,7 +6304,7 @@ function assertAgentCapacity(open, dispatches, attemptId, packId, budgetCodePoin
 	}
 	const key = agentKey(attemptId, packId);
 	const agent = agents.get(key);
-	if (agent === void 0 && agents.size >= 16 || (agent?.codePoints ?? 0) + budgetCodePoints > 24e4 || (agent?.units ?? 0) + 1 > 48) throw new ApplicationError("OPERATION_CONFLICT");
+	if (agent === void 0 && agents.size >= 24 || (agent?.codePoints ?? 0) + budgetCodePoints > 24e4 || (agent?.units ?? 0) + 1 > 48) throw new ApplicationError("OPERATION_CONFLICT");
 }
 //#endregion
 //#region packages/application/src/journey/review/attempt.ts
@@ -6282,30 +6566,6 @@ async function readGroupItems(storage, value) {
 	};
 }
 //#endregion
-//#region packages/application/src/export/versions.ts
-/** Current built-in admission, annotation and retention contracts; implementations share these. */
-const nativeAdapterVersions = Object.freeze({
-	claude: "claude-native-export-v19",
-	codex: "codex-native-export-v16"
-});
-/** Shared metadata annotation/preparation semantics, independent of serialization formats. */
-const metadataProcessingVersion = "metadata-annotations-v1";
-//#endregion
-//#region packages/application/src/journey/adapters.ts
-/** The adapter contracts a Journey's snapshot is prepared under. */
-const currentJourneyAdapters = () => ({
-	claude: `${nativeAdapterVersions.claude}/main-prose-source-scan-v2`,
-	codex: `${nativeAdapterVersions.codex}/main-prose-source-scan-v2`
-});
-/**
-* An unfinished snapshot frozen under other adapter contracts (absent: an earlier release), or
-* read by B review instead of dictionary review (ADR 0086), cannot render its Works (ADR 0076).
-* A new scan replaces it unless it holds a Send, which the store keeps for the person to finish.
-*/
-function obsoleteJourney(state) {
-	return state.phase !== "completed" && state.snapshotId !== null && (state.adapters?.claude !== currentJourneyAdapters().claude || state.adapters.codex !== currentJourneyAdapters().codex || state.reviewMethod !== "dictionary");
-}
-//#endregion
 //#region packages/application/src/journey/correction/anchors.ts
 /** Exact frozen-field validation only: no fuzzy relocation, context ownership or other unit. */
 function locateCorrectionAnchors(batch, anchors) {
@@ -6650,6 +6910,25 @@ async function sessionReviewStatus(storage, value) {
 }
 //#endregion
 //#region packages/application/src/journey/service.ts
+/** Display uses the same bounded literal/exception matcher without depending on artifact I/O. */
+function presentedTitle(text, terms, exceptions) {
+	const markers = [...text.matchAll(replacementMarkerPattern)].map((match) => ({
+		start: match.index,
+		end: match.index + match[0].length
+	}));
+	const spans = [];
+	for (const hit of bTermMatcher(terms, exceptions)(text).sort((left, right) => left.start - right.start || right.end - left.end)) {
+		if (markers.some((marker) => marker.start < hit.end && marker.end > hit.start)) continue;
+		const previous = spans.at(-1);
+		if (previous && hit.start < previous.end) previous.end = Math.max(previous.end, hit.end);
+		else spans.push({
+			start: hit.start,
+			end: hit.end
+		});
+	}
+	for (const span of spans.toReversed()) text = text.slice(0, span.start) + "[hidden]" + text.slice(span.end);
+	return text;
+}
 function digest$1(value) {
 	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
 }
@@ -6658,8 +6937,9 @@ function digest$1(value) {
 * quotes stay out. The agent reads override values from `journey.get` and the guidance.
 */
 function journeyView(state, now) {
-	const { exceptions, instructions, corrections, valueOverrides, consent, accountRead, ...safe } = state;
+	const { exceptions, instructions, corrections, valueOverrides, consent, accountRead, rememberedHides: _remembered, ...safe } = state;
 	const terms = activePrivacyTerms(state);
+	const hidden = dictionaryHides(state, state.privacy.terms);
 	return {
 		...safe,
 		consent: consent && {
@@ -6680,15 +6960,17 @@ function journeyView(state, now) {
 			const localTitle = work.suggestion || work.explicitTitleId ? work.title : work.classificationMetadata?.title ?? work.title;
 			const imagesOmitted = hasCurrentStaticReview(state, work) ? work.staticReview?.imagesOmitted ?? 0 : 0;
 			const source = publicSource(work);
+			const title = work.titleOrigin === "explicit" ? localTitle : presentedTitle(localTitle, hidden.keys(), state.exceptions.filter((item) => item.workId === work.id).map((item) => item.value));
 			if (!work.classificationMetadata) return {
 				...work,
+				title,
 				localTitle,
 				imagesOmitted,
 				publicSource: source
 			};
 			const metadata = work.classificationMetadata;
 			const displayed = {
-				title: work.suggestion || work.explicitTitleId ? work.title : metadata.title,
+				title,
 				projectName: metadata.projectName,
 				description: work.suggestion ? work.description : metadata.description,
 				reason: work.suggestion ? work.reason : metadata.reason
@@ -6786,7 +7068,7 @@ async function joinRender(port, journeyId, workId, run, signal, retryConflict =
 }
 function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).toISOString(), local) {
 	/** Callers present after their write is durable, so a concurrent commit must not turn it into an error. */
-	async function present(committed) {
+	async function present(committed, includePreparationProgress = true) {
 		let state = committed;
 		for (let attempt = 1;; attempt++) {
 			const view = journeyView(state, now());
@@ -6806,7 +7088,7 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 					review: null
 				};
 			}
-			const preparationProgress = preparationInProgress(state) ? await storage.readPreparationProgress({ journeyId: state.journeyId }) : null;
+			const preparationProgress = includePreparationProgress && preparationInProgress(state) ? await storage.readPreparationProgress({ journeyId: state.journeyId }) : null;
 			const classificationProgress = state.consent && state.snapshotId ? (await storage.resources({
 				journeyId: state.journeyId,
 				kind: "classification-progress",
@@ -6865,8 +7147,8 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 		const query = nativeGetSchema.parse(input);
 		const state = await storage.current(query.journeyId);
 		if (!state) return null;
-		const view = await present(state);
-		return audience === "agent" && state.valueOverrides ? {
+		const view = await present(state, audience !== "review-helper");
+		return audience !== "panel" && state.valueOverrides ? {
 			...view,
 			valueOverrides: state.valueOverrides
 		} : view;
@@ -6933,6 +7215,7 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			};
 		};
 		if (current && current.phase !== "completed" && !current.abandonedAt && !obsoleteJourney(current)) return resume(current);
+		const carried = current && !current.abandonedAt && obsoleteJourney(current) ? (current.instructions ?? []).filter((item) => item.actor === "human") : [];
 		const state = {
 			formatVersion: 10,
 			classificationRevision: null,
@@ -6961,6 +7244,7 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			exceptions: [],
 			adapters: currentJourneyAdapters(),
 			lastEvent: 0,
+			...carried.length ? { instructions: carried } : {},
 			...input.period?.since || input.period?.until ? { period: input.period } : {}
 		};
 		const result = await storage.commit({
@@ -7142,7 +7426,7 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			const rows = await storage.events(input.journeyId, input.after);
 			if (rows.length || Date.now() >= deadline) return {
 				events: rows,
-				state: await get({ journeyId: input.journeyId })
+				state: rows.length || !input.changesOnly ? await get({ journeyId: input.journeyId }) : null
 			};
 			await setTimeout$1(Math.min(1e3, Math.max(0, deadline - Date.now())), void 0, { signal });
 		}
@@ -7445,6 +7729,14 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			if (!local) throw new ApplicationError("INVALID_TRANSITION");
 			return local.works.classificationRead(journeyClassificationReadSchema.parse(value), signal);
 		},
+		recoverIsolatedMetadata: async (value, signal = new AbortController().signal) => {
+			if (!local) throw new ApplicationError("INVALID_TRANSITION");
+			const result = await local.works.recoverIsolatedMetadata(isolatedMetadataRecoverySchema.parse(value), signal);
+			return {
+				...result,
+				state: await present(result.state)
+			};
+		},
 		classificationSubmit: async (value, signal = new AbortController().signal) => {
 			if (!local) throw new ApplicationError("INVALID_TRANSITION");
 			const result = await local.works.classificationSubmit(journeyClassificationSubmitSchema.parse(value), signal);
@@ -7577,7 +7869,8 @@ function safeJourneySender(sender, now) {
 		async get(input) {
 			const result = await sender.get({
 				journeyId: input.journeyId,
-				...input.sendId ? { sendId: input.sendId } : {}
+				...input.sendId ? { sendId: input.sendId } : {},
+				...input.observedRevision !== void 0 ? { observedRevision: input.observedRevision } : {}
 			});
 			return result ? safe(result) : null;
 		},
@@ -7605,6 +7898,8 @@ function safeJourneySender(sender, now) {
 		async advance(input, signal = new AbortController().signal) {
 			return safe(await sender.advance(input, signal));
 		},
+		uploadAssessments: (input) => sender.uploadAssessments(input),
+		ownedPassport: (input, signal = new AbortController().signal) => sender.ownedPassport(input, signal),
 		ownerProfile: (signal = new AbortController().signal) => sender.ownerProfile(signal),
 		addressTaken: (input, signal = new AbortController().signal) => sender.addressTaken(input, signal),
 		saveSentProfile: (input, signal = new AbortController().signal) => sender.saveSentProfile(input, signal)
@@ -14050,4 +14345,4 @@ function equivalenceDuplicates(batch) {
 	return bindings.sort();
 }
 //#endregion
-export { validateDetectionSummary as $, hideKeyId as $n, sendReplaceResultSchema as $r, journeyResourceSchema as $t, renewBeforeMs as A, scanGitSeedsResource as An, journeyPreviewSchema as Ar, obsoleteJourney as At, createApplication as B, journeySearchResultSchema as Bn, nativeRespondSchema as Br, classificationPartition as Bt, rebindReviewOverlay as C, selectFrozenConfiguration as Ci, mergeBRepair as Cn, preparationStartSchema as Cr, sendActionSchema as Ct, staticallyHiddenFindings as D, scanPreparationDigest as Dn, journeyClassificationSessionsSchema as Dr, sendStartSchema as Dt, guardedFindingText as E, scanCanonicalResourceSchema as En, validatePreparationFacts as Er, sendRequestSchema as Et, readAccountAvatarUrl as F, journeyInventoryQuerySchema as Fn, applyCardAnswers as Fr, journeyGuidance as Ft, validateInspectionRequest as G, journeyEventSchema as Gn, staticSessionId as Gr, journeyContextQuerySchema as Gt, inspectionStartSchema as H, searchScopeDigest as Hn, mergePrivacyTerms as Hr, retireScanGeneration as Ht, storedCredentialSchema as I, journeyInventoryReadSchema as In, assertJourneyPrivacyReady as Ir, journeyBatchReadSchema as It, validateInspectionFence as J, readConfirmedHideChange as Jn, agentSourceSchema as Jr, hideFinishSchema as Jt, inspectionQuerySchema as K, confirmedHideAdditions as Kn, staticSessionResourceSchema as Kr, journeyContextSchema as Kt, sourceIdentityEvidence as L, journeyInventorySchema as Ln, privacyDecisionDigest as Lr, journeyReviewStorageQuerySchema as Lt, deviceAuthorizationSchema as M, scanExclusionResourceSchema as Mn, journeyRenderSchema as Mr, nativeAdapterVersions as Mt, deviceProfileScopeSchema as N, validateScanExclusion as Nn, displayedScopeDigest as Nr, attemptBudgetCodePoints as Nt, createAccount as O, scanSessionResourceSchema as On, journeyFindingImpactSchema as Or, settleCorrections as Ot, profileUrlMatchesIdentity as P, resolveSourceSelection as Pn, requestedScope as Pr, validateAttemptAppend as Pt, validateInspectionContribution as Q, addHideIndexTokens as Qn, sendReceiptSchema as Qr, journeyResourceQuerySchema as Qt, withSourceEvidence as R, journeyPreparationProgressSchema as Rn, nativeEventsSchema as Rr, applyClassificationProposal as Rt, rebindReviewAlignment as S, freezeConfiguration as Si, bReviewDigest as Sn, preparationSettlementSchema as Sr, replaceSensitiveTermsSchema as St, reviewBatchReuse as T, scanAliasResourceSchema as Tn, preparationUpdateSchema as Tr, sendPrepareSchema as Tt, validateInspectionBatch as U, journeyCommitResultSchema as Un, hasCurrentStaticReview as Ur, newJourneyWork as Ut, inspectionCancelSchema as V, journeySearchSaveSchema as Vn, retryReviewActionSchema as Vr, classificationWorks as Vt, validateInspectionBatches as W, journeyCommitSchema as Wn, staticReviewDigest as Wr, reviewCompileSchema as Wt, validateInspectionInputs as X, settleConfirmedHides as Xn, journeySendSchema as Xr, journeyPolicyRespondSchema as Xt, validateInspectionHead as Y, renderedHideValue as Yn, agentSourcesSchema as Yr, hidePublishSchema as Yt, validateInspectionQuery as Z, termHideAdditions as Zn, sendArtifactSchema as Zr, projectPreparationProgress as Zt, changeJourney as _, sourceChangePolicy as _i, reviewCandidateInputSchema as _n, workPrivacyDecisions as _r, manualUploadStartSchema as _t, bCrossSegmentReviewSchema as a, isReadingComplete as ai, reviewAttemptsResultSchema as an, bTermMatcher as ar, appendSensitiveTerms as at, isGenericPublicTerm as b, effectiveTreatmentSchema as bi, reviewRepairResourceSchema as bn, preparationBeginSchema as br, maximumTermsFileBytes as bt, reconstructBFields as c, selectedWorks as ci, sessionReconciliationResourceSchema as cn, confirmedHideKey as cr, maximumAgentSetupSessions as ct, resolveGroupSplit as d, packageCommandSchema as di, sessionReviewInputSchema as dn, dictionaryHides as dr, validateFailureLocation as dt, sendResolutionSchema as ei, journeyIsolateSchema as en, maximumHideIndexTokens as er, inspectionInputs as et, selectedValueMembers as f, selectionBatchSchema as fi, sessionReviewQuerySchema as fn, journeyConfirmedHides as fr, manualUploadActionSchema as ft, semanticGroupKey as g, stateSchema as gi, sessionUsefulnessResourceSchema as gn, workDecisionDigest as gr, manualUploadSchema as gt, hideScopeDigest as h, producerVersion as hi, sessionUsefulnessInputSchema as hn, retireWorkDescription as hr, manualUploadPrepareSchema as ht, validateBCrossSegmentReview as i, isIncludedWork as ii, reviewAttemptsQuerySchema as in, bMaskedHits as ir, reviewInventory as it, accountProfileSchema as j, verifiedScanGitSeeds as jn, journeyRenderInputSchema as jr, metadataProcessingVersion as jt, renew as k, scanGitSeedsId as kn, journeyFindingsSchema as kr, currentJourneyAdapters as kt, chooseCheapPlacement as l, withReadingProgress as li, sessionRereadInputSchema as ln, confirmedHideKinds as lr, artifactFailureDetailSchema as lt, activeJourneyTerms as m, gitMetadataBudgetBytes as mi, sessionReviewStatusSchema as mn, syncTermGroups as mr, manualUploadChoiceSchema as mt, scanBatchEquivalenceDigest as n, hasCompleteWorkDescription as ni, sortingApplySchema as nn, bContainment as nr, settingsQuerySchema as nt, bRereadDigest as o, isSelectedWork as oi, sessionReconcileInputSchema as on, bWordBounded as or, classifyAgentSetup as ot, splitSelectorValues as p, selectionSchema as pi, sessionReviewResourceSchema as pn, maskedHitsStale as pr, manualUploadBindingSchema as pt, validateInspectionClaim as q, confirmedHideDeltaSchema as qn, agentSourcePathSegment as qr, hideBeginSchema as qt, locateTermEvidence as r, isClassifying as ri, reviewAttemptResourceSchema as rn, bExceptionRanges as rr, readWorkspaceOutcomes as rt, reconcileBSession as s, isSkippedWork as si, sessionReconcileResultSchema as sn, confirmedHideGroupIds as sr, defaultAgentSetupInclusion as st, scanBatchContextDigest as t, sendSettingsSchema as ti, journeyPlaceSchema as tn, packHideIndex as tr, settingsBatchSchema as tt, reviseGroupMembership as u, commandSchema as ui, sessionRereadResourceSchema as un, confirmedHideTerms as ur, resolveFailureLocation as ut, projectJourneyInventory as v, recommendParallelism as vi, reviewCandidateResourceSchema as vn, workCorrectionBinding as vr, candidateSortAvailable as vt, rebindReviewSubmit as w, staticCatalogRef as wi, planBRepair as wn, preparationStateSchema as wr, sendChoiceSchema as wt, bReviewScope as x, defaultScopedSettings as xi, reviewTransportBytes as xn, preparationPermissionSchema as xr, normalizeSensitiveTerms as xt, preparationScope as y, approvedTreatmentSchema as yi, reviewRepairInputSchema as yn, emptyPreparationFacts as yr, emptyTermsRevision as yt, agentSetupKey as z, applyClassification as zn, nativeGetSchema as zr, classificationCommitSchema as zt };
+export { validateDetectionSummary as $, maximumHideIndexTokens as $n, sendReplaceResultSchema as $r, journeyPlaceSchema as $t, renewBeforeMs as A, gitMetadataBudgetBytes as Ai, scanExclusionResourceSchema as An, retryReviewActionSchema as Ar, validateAttemptAppend as At, createApplication as B, staticCatalogRef as Bi, journeySearchSaveSchema as Bn, metadataProcessingVersion as Br, newJourneyWork as Bt, rebindReviewOverlay as C, bTermMatcher as Ci, scanAliasResourceSchema as Cn, privacyDecisionDigest as Cr, sendActionSchema as Ct, staticallyHiddenFindings as D, packageCommandSchema as Di, scanGitSeedsId as Dn, nativeGetSchema as Dr, sendStartSchema as Dt, guardedFindingText as E, commandSchema as Ei, scanSessionResourceSchema as En, nativeEventsSchema as Er, sendRequestSchema as Et, readAccountAvatarUrl as F, approvedTreatmentSchema as Fi, journeyInventoryReadSchema as Fn, itemAtPassport as Fr, classificationCommitSchema as Ft, validateInspectionRequest as G, confirmedHideAdditions as Gn, staticSessionId as Gr, hideFinishSchema as Gt, inspectionStartSchema as H, journeyCommitResultSchema as Hn, mergePrivacyTerms as Hr, journeyContextQuerySchema as Ht, storedCredentialSchema as I, effectiveTreatmentSchema as Ii, journeyInventorySchema as In, obsoleteJourney as Ir, classificationPartition as It, validateInspectionFence as J, renderedHideValue as Jn, agentSourceSchema as Jr, sendOutputQuerySchema as Jt, inspectionQuerySchema as K, confirmedHideDeltaSchema as Kn, staticSessionResourceSchema as Kr, hidePublishSchema as Kt, sourceIdentityEvidence as L, defaultScopedSettings as Li, journeyPreparationProgressSchema as Ln, sendOwesPassport as Lr, classificationWorks as Lt, deviceAuthorizationSchema as M, stateSchema as Mi, resolveSourceSelection as Mn, awaitingPassport as Mr, journeyBatchReadSchema as Mt, deviceProfileScopeSchema as N, sourceChangePolicy as Ni, projectPreparationProgress as Nn, currentJourneyAdapters as Nr, journeyReviewStorageQuerySchema as Nt, createAccount as O, selectionBatchSchema as Oi, scanGitSeedsResource as On, nativeRespondSchema as Or, settleCorrections as Ot, profileUrlMatchesIdentity as P, recommendParallelism as Pi, journeyInventoryQuerySchema as Pn, hostDrives as Pr, applyClassificationProposal as Pt, validateInspectionContribution as Q, hideKeyId as Qn, sendReceiptSchema as Qr, journeyIsolateSchema as Qt, withSourceEvidence as R, freezeConfiguration as Ri, applyClassification as Rn, sendReachedPassport as Rr, retireScanGeneration as Rt, rebindReviewAlignment as S, bMaskedHits as Si, planBRepair as Sn, assertJourneyPrivacyReady as Sr, replaceSensitiveTermsSchema as St, reviewBatchReuse as T, replacementMarkerPattern as Ti, scanPreparationDigest as Tn, rememberedHideValues as Tr, sendPrepareSchema as Tt, validateInspectionBatch as U, journeyCommitSchema as Un, hasCurrentStaticReview as Ur, journeyContextSchema as Ut, inspectionCancelSchema as V, searchScopeDigest as Vn, nativeAdapterVersions as Vr, reviewCompileSchema as Vt, validateInspectionBatches as W, journeyEventSchema as Wn, staticReviewDigest as Wr, hideBeginSchema as Wt, validateInspectionInputs as X, termHideAdditions as Xn, journeySendSchema as Xr, journeyResourceQuerySchema as Xt, validateInspectionHead as Y, settleConfirmedHides as Yn, agentSourcesSchema as Yr, sendOutputSchema as Yt, validateInspectionQuery as Z, addHideIndexTokens as Zn, sendArtifactSchema as Zr, journeyResourceSchema as Zt, changeJourney as _, journeyConfirmedHides as _i, reviewRepairInputSchema as _n, journeyRenderInputSchema as _r, manualUploadStartSchema as _t, bCrossSegmentReviewSchema as a, isIncludedWork as ai, sessionReconcileResultSchema as an, emptyPreparationFacts as ar, appendSensitiveTerms as at, isGenericPublicTerm as b, bContainment as bi, bReviewDigest as bn, requestedScope as br, maximumTermsFileBytes as bt, reconstructBFields as c, isSkippedWork as ci, sessionRereadResourceSchema as cn, preparationSettlementSchema as cr, maximumAgentSetupSessions as ct, resolveGroupSplit as d, withReadingProgress as di, sessionReviewResourceSchema as dn, preparationUpdateSchema as dr, validateFailureLocation as dt, sendResolutionSchema as ei, sortingApplySchema as en, packHideIndex as er, inspectionInputs as et, selectedValueMembers as f, confirmedHideGroupIds as fi, sessionReviewStatusSchema as fn, validatePreparationFacts as fr, manualUploadActionSchema as ft, semanticGroupKey as g, dictionaryHides as gi, reviewCandidateResourceSchema as gn, journeyPreviewSchema as gr, manualUploadSchema as gt, hideScopeDigest as h, confirmedHideTerms as hi, reviewCandidateInputSchema as hn, journeyFindingsSchema as hr, manualUploadPrepareSchema as ht, validateBCrossSegmentReview as i, isClassifying as ii, sessionReconcileInputSchema as in, workCorrectionBinding as ir, reviewInventory as it, accountProfileSchema as j, producerVersion as ji, validateScanExclusion as jn, advanceStepsSend as jr, journeyGuidance as jt, renew as k, selectionSchema as ki, verifiedScanGitSeeds as kn, nativeStartSchema as kr, attemptBudgetCodePoints as kt, chooseCheapPlacement as l, selectedWorks as li, sessionReviewInputSchema as ln, preparationStartSchema as lr, artifactFailureDetailSchema as lt, activeJourneyTerms as m, confirmedHideKinds as mi, sessionUsefulnessResourceSchema as mn, journeyFindingImpactSchema as mr, manualUploadChoiceSchema as mt, scanBatchEquivalenceDigest as n, sendSettingsSchema as ni, reviewAttemptsQuerySchema as nn, workDecisionDigest as nr, settingsQuerySchema as nt, bRereadDigest as o, isReadingComplete as oi, sessionReconciliationResourceSchema as on, preparationBeginSchema as or, classifyAgentSetup as ot, splitSelectorValues as p, confirmedHideKey as pi, sessionUsefulnessInputSchema as pn, journeyClassificationSessionsSchema as pr, manualUploadBindingSchema as pt, validateInspectionClaim as q, readConfirmedHideChange as qn, agentSourcePathSegment as qr, journeyPolicyRespondSchema as qt, locateTermEvidence as r, hasCompleteWorkDescription as ri, reviewAttemptsResultSchema as rn, workPrivacyDecisions as rr, readWorkspaceOutcomes as rt, reconcileBSession as s, isSelectedWork as si, sessionRereadInputSchema as sn, preparationPermissionSchema as sr, defaultAgentSetupInclusion as st, scanBatchContextDigest as t, sendSessionUploadSchema as ti, reviewAttemptResourceSchema as tn, retireWorkDescription as tr, settingsBatchSchema as tt, reviseGroupMembership as u, unfinishedPackagingCode as ui, sessionReviewQuerySchema as un, preparationStateSchema as ur, resolveFailureLocation as ut, projectJourneyInventory as v, maskedHitsStale as vi, reviewRepairResourceSchema as vn, journeyRenderSchema as vr, candidateSortAvailable as vt, rebindReviewSubmit as w, bWordBounded as wi, scanCanonicalResourceSchema as wn, reconcileReaderKeeps as wr, sendChoiceSchema as wt, bReviewScope as x, bExceptionRanges as xi, mergeBRepair as xn, applyCardAnswers as xr, normalizeSensitiveTerms as xt, preparationScope as y, syncTermGroups as yi, reviewTransportBytes as yn, displayedScopeDigest as yr, emptyTermsRevision as yt, agentSetupKey as z, selectFrozenConfiguration as zi, journeySearchResultSchema as zn, sendsOnNextAdvance as zr, isolatedWorkId as zt };