@gitroll/tacitt-cli 0.6.13 → 0.6.15

package/dist/web/index.html

@@ -6,7 +6,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="referrer" content="no-referrer" />
     <title>tacitt · Local session collection</title>
-    <script type="module" crossorigin src="./assets/index-BgDdPL1c.js"></script>
+    <script type="module" crossorigin src="./assets/index-XdWDOC5H.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-DzOozqms.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitroll/tacitt-cli",
-  "version": "0.6.13",
+  "version": "0.6.15",
   "description": "Private local session review and export for coding agents",
   "license": "UNLICENSED",
   "repository": {

package/skills/tacitt/INDEX.md

@@ -6,7 +6,7 @@
 <!-- index-entries
 ./ | Shipped skill | Workspace-scoped instructions for direct CLI and optional Web collaboration.
 INDEX.md | Documentation | Directory navigation.
-SKILL.md | Agent instructions | Supplies the managed release template, explicit fast/low worker policy and phase routing into classification, paired CLI scan reruns, consent gates, account-seeded access, person-only Public choices, privacy review and approved export.
+SKILL.md | Agent instructions | Supplies the managed release template, explicit fast/low worker policy and phase routing into classification, paired CLI scan reruns, consent gates, Retry-only formation account stop, account-seeded access, person-only Public choices, privacy review and approved export.
 -->
 
 The entry table is not committed: run `pnpm run write:indexes`, then open `INDEX.local.md` in this directory.

package/skills/tacitt/SKILL.md

@@ -14,7 +14,7 @@ Prepare the [exact paired CLI](references/bootstrap.md), then follow the [classi
 
 Before initializing the run, inspect the native host's actually available subagent models. Select the newest available supported native fast-tier model at explicit `low` reasoning, using fresh context for a newly delegated task; use the SAME exact model and effort for classification, bounded evidence, keyword/privacy scanning, internal card drafting and final resolution. Do not inherit the main agent's model or effort. On the currently documented Codex host this is `gpt-6-luna` with `reasoning_effort: "low"`; resolve availability again on a later host rather than assuming this dated example is universal. Use fresh-context children and pass the model/effort in the native spawn tool arguments, not just in a prompt. If the host cannot set the required profile, report that capability failure; do not silently switch model, raise effort or claim compliance.
 
-Initialize the shared phase/review run with `--model EXACT_NATIVE_MODEL --effort low`. Keep at most twenty-four native child agents active across all phases, further limited by actual available slots; a delegated coordinator also occupies a slot. Launch ready assignments up to available capacity together when the host supports parallel native spawns. Otherwise issue consecutive native spawns without waiting for results between launches. Every helper response returns the pinned `agentProfile`; use it for dispatch and record the actual spawn receipts and available slots. Helpers record requested settings, not proof that a model executed them. No global client configuration changes or extra API provider are needed.
+Initialize the shared phase/review run with `--model EXACT_NATIVE_MODEL --effort low`. Keep at most forty-eight native child agents active across all phases, further limited by actual available slots; a delegated coordinator also occupies a slot. Launch ready assignments up to available capacity together when the host supports parallel native spawns. Otherwise issue consecutive native spawns without waiting for results between launches. Every helper response returns the pinned `agentProfile`; use it for dispatch and record the actual spawn receipts and available slots. Helpers record requested settings, not proof that a model executed them. No global client configuration changes or extra API provider are needed.
 
 ## Coordinator ownership
 
@@ -22,6 +22,8 @@ The agent invoking this Skill is its Main coordinator, including when another ag
 
 ## Required order
 
+Before first Work formation, `journey.prepare` reads the account inventory once, across all pages, with `include=title,removedFromWork,unitAccess` and the shared 30-second bound. A failed or partial read stops before classification and forms no Work. On `ACCOUNT_WORKS_UNAVAILABLE`, say "Tacitt could not read your profile, so it cannot tell which Works are already Private there." On `ACCOUNT_SIGNED_OUT`, ask the person to sign in. The helper's `accountReadRecovery` offers Retry only: get the current journey revision and submit `{kind:"account-read"}` once, then wait if the read still fails. For the first formation of a journey, never continue classification without a successful read or offer to group without the profile. A journey that already has a formed snapshot from an earlier build continues under its existing rules with no formation read. Consent without a subject keeps the existing signed-out exception. A successful read stores account facts for the later rebuild slice; it does not yet change Work ids, titles, grouping, access or Send.
+
 For scan starts and reruns after scope confirmation, follow the [paired CLI background preparation, restart budget and prepare-outcome rules](references/commands.md#scan-results).
 
 The person decides in the panel; you keep the journey moving. Never ask the person to return to chat to confirm or continue, except for the explicit [remote-worker host consent](references/remote-workers.md) before classification freezes. Until Ready to send, while the next step is theirs, [wait inside this turn](references/journey.md#waiting-for-the-person); at Ready to send your turn ends.

package/skills/tacitt/references/INDEX.md

@@ -9,8 +9,8 @@ INDEX.md | Directory index | Locates the shipped native journey references.
 b-method.md | Method reference | Defines the dictionary method: analysed scope, the child answer, the ten term types and how the hidden set is applied.
 bootstrap.md | Skill reference | Verifies the exact paired CLI release and preserves installation boundaries.
 classification.md | Skill reference | Owns priority dispatch of unresolved/evidence tasks, authoritative task-pointer prompts, semantic evidence safeguards, bounded reconciliation, final metadata and full-coverage publication and unconfirmed Public suggestions.
-commands.md | Command reference | Supplies classification assignment and answer-publication, session review, decision-card, final-resolution, phase-helper, batched reader lifecycle events, explicit paired-CLI scan reruns, account inheritance, person-only Public choices and Send contracts.
-journey.md | Skill reference | Guides explicit consent, row-assigned classification, CLI-owned answer publication and same-child recovery, account-seeded scan scope, explicit Public choices, contextual cards, final resolution, preview and approved packaging.
+commands.md | Command reference | Supplies classification assignment and answer-publication, session review, decision-card, final-resolution, phase-helper, batched reader lifecycle events, explicit paired-CLI scan reruns, Retry-only formation reads, account inheritance, person-only Public choices and Send contracts.
+journey.md | Skill reference | Guides explicit consent, row-assigned classification, CLI-owned answer publication and same-child recovery, Retry-only formation reads, account-seeded scan scope, explicit Public choices, contextual cards, final resolution, preview and approved packaging.
 parallel-review.md | Review protocol | Runs the review helper loop: bounded current-provider analysis agents, CLI-published drafts, same-child repair, batched launches and exits, busy slots, durable replay and recovery.
 remote-workers.md | Collection protocol | Owns per-Send host consent, bounded remote worker import before freeze and disclosure of unreadable dispatch lines or collection failures.
 send.md | Send reference | Owns browser Send, owner login, scope confirmation, incremental session intent, concurrent transfers with serialized commits, narrow pre-upload access blocking, upload-bound completion, background assessment, fresh review recovery and deliberate upgrades.

package/skills/tacitt/references/bootstrap.md

@@ -110,7 +110,7 @@ the intended Skill; do not report native-client discovery without observing it.
 
 ## Client concurrency setup
 
-The installer offers one default-No terminal question to save a setting of twenty-four
+The installer offers one default-No terminal question to save a setting of forty-eight
 concurrent subagents for the selected clients. It explains speed, concurrent usage,
 the user/project scope and restart. Explicit `--configure-agents` (JSON
 `configureAgents:true`) authorizes the same change; `--skip-agent-config` declines.

package/skills/tacitt/references/classification.md

@@ -73,6 +73,8 @@ Publish accepted completed-root progress at helper checkpoints while refilling s
 
 After scope confirmation, one item may hold roots of one published Work, plus roots still being grouped. It may join several published Works only when they have the same visibility record, as a Work and the blocked Work split from it do. Otherwise the helper stops with `CLASSIFICATION_LATE_SEVERAL_WORKS` before commit (CLI would refuse with `INVALID_SELECTION`) and prints one line per refused item, such as `items[0] joins Works <id>, <id>`, because the joined roots would take the first Work's visibility, Public included. Keep each published Work's roots in its own item, and keep any other root pending or in a new item.
 
+A rebuilt profile Work (`accountWork: true`, shown with its id and profile title) is a join target only through the catalog: a known project whose catalog entry carries `accountWorkId` is submitted by the helper as `{accountWorkId, rootSessionIds}`, with no description, project type or recommendation, and gets no description task (ADR 0276 slice H). Never name a rebuilt Work yourself and never put its roots in an item. The helper checks joins before commit and stops with `CLASSIFICATION_ACCOUNT_WORK_JOIN`, printing `items[<index>] joins Works <id>` per refused item; CLI also refuses a joined session the profile already lists (`INVALID_SELECTION`). Do not retry such a refusal by hand: report it and stop the classification step. Joining keeps the Work's title and visibility; a Public profile Work becomes a Public suggestion again for the person to confirm.
+
 ## One-shot workflow acceptance
 
 The human-approved acceptance bar is a complete Skill workflow with useful

package/skills/tacitt/references/commands.md

@@ -25,6 +25,7 @@ Consent arrives from the panel's Continue button (or, after an explicit chat agr
 - `journey.classificationSubmit`: `{journeyId,expectedRevision,idempotencyKey,items}`. Each item is `{projectName,description,projectType,rootSessionIds,recommendation:{access,reason}}`. Types are `work`, `side`, `coursework`, `personal`, `scratch`, `other`; access is `public`, `private`, `drop`. Cover every root exactly once, preserve families and merge matching project identities; matching names alone are not identity. Recommendations do not change access by themselves.
 - Apply explicit visibility using `{kind:"work-access",workId,access}` or `{kind:"works-access",workIds,access}`. Browser choices are already committed; never overwrite them with an older recommendation.
 - Before `scope-confirm`, an unchosen Work may store a placeholder `access`; the panel shows its recommendation. Scope confirmation preserves confirmed person choices and a delegate's Private choice. It seeds account access while signed in (`accessOrigin:"account"`): all Private confirms, every root held Public confirms with account proof, partial Public history stays a suggestion, and mixed starts Private with a visible conflict. No account history uses the model path. Model Public also stays `accessConfirmed:false`; model Private may confirm. The panel asks the person for every suggested-Public Work. A suggested Public Work requires that person's explicit visibility choice, including choosing the same displayed Public value. Never use delegation to confirm Public.
+- Before first formation, `journey.prepare` performs the all-or-nothing account read. `ACCOUNT_WORKS_UNAVAILABLE` or `ACCOUNT_SIGNED_OUT` stops before classification with no Work formed. Get the current revision and submit `{kind:"account-read"}` once as Retry; the helper returns this sole choice in `accountReadRecovery`. If Retry still fails, wait for the profile read (or sign-in) to recover; never continue without the profile. A successful formation read changes no Work grouping or visibility in slice A.
 - As soon as the known Works (an `ingest` result with `partial: true`) or the complete proposal is ingested, record `{kind:"scope-confirm"}` for scan scope. This does not confirm suggested Public (a Work whose every root session is already Public on the account is confirmed by that account history and needs no question); name each suggested-Public Work and ask the person to choose Public or Private, in the panel or conversation. `scope-confirm` reads the account inventory first (30 s bound). A failed read refuses it with `ACCOUNT_ACCESS_UNAVAILABLE`, and a signed-out read with `ACCOUNT_SIGNED_OUT`; each records `accountRead` and changes no Work, and only a later `scope-confirm` that reads the account confirms the scope (Retry; it decides nothing, so run it once without asking). A signed-out `scope-confirm` continues on the model path only when this journey has recorded consent without an account subject. That covers consent given before sign-in was required or in a build with no sign-in client. A calling process with no sign-in client cannot exempt consent that records a subject. After confirmation, `{kind:"account-read"}` reads the account again from the panel or chat: on a read it re-applies account access to Public Works while preserving confirmed person choices, every Private Work and every left-out Work; on a failure it records the status only. The view's `accountReadCurrent` is true only for a `read` under the account signed in now; while it is false and an included Work is suggested Public or Public by account proof, the panel shows a stop with Retry or Sign in in place of the Send button. Then `journey.prepare` runs selected Work static scans and, while grouping continues, waits for and prepares the Works the complete proposal publishes or extends. `journey.classificationSubmit` takes optional `pendingRootSessionIds` (roots still being grouped, kept in one unread Work) and, after confirmation, `expectedClassificationRevision` (the classification it completes) instead of a current `expectedRevision`. Visibility stays open until Send: Drop stops that Work's scan, and a Work moved out of Drop needs `journey.prepare` again.
 
 ## Remote worker collection
@@ -57,6 +58,19 @@ Ingest and `next-packs` list `blockedWorks[]` only while one exists.
 Phase-helper `status` and `await` also print `leftOutSessions`, the number of root sessions in
 those Works, only when it is above zero; say it in chat before the review is complete, Ready
 to send or nothing is left to send.
+They also print `accountFormation: {leftOutSessions, heldBackSessions}` when formation kept
+sessions out of every Work because of the person's profile (ADR 0276). Say each nonzero count
+once in the journey, never a session or Work name: "N sessions are left out because you
+removed their Work on your profile." and "N sessions stay in their Works on your profile and
+are not sent this time." (singular: "1 session is left out because you removed its Work on
+your profile.", "1 session stays in its Work on your profile and is not sent this time.").
+When every session is already on the profile, left out or held back, `journey.prepare` fails with
+`ACCOUNT_NOTHING_TO_SEND` and the helper phase is `nothing-to-send` with `accountFormation`: say
+the counts once and that nothing is left to send this time, then end the turn. Running `/tacitt`
+again reads the profile again.
+Works with `accountWork: true` are the person's profile Works rebuilt with their profile title;
+classification never groups or describes them. A new session whose project already has such a
+Work joins it instead of forming another (ADR 0276 slice H): see the classification reference.
 When no selected Work is left (every one skipped or Dropped), the helper phase is
 `nothing-to-send`: there is no Send, and `await` waits for a Retry or a move out of Drop.
 When the person asks to retry, respond
@@ -172,11 +186,11 @@ exhausted command budget or unknown write stops refill. Known repairs and partia
 `next-packs --agents FREE_SLOTS` remains available. Refill observes current input
 and guidance again; accepted results remain bound to existing source receipts.
 
-For native orchestration, use automatic refill only when all twenty-four host slots are free with no pending launches. While any child is live, wait on native completion and pass the current numeric free count. An answer can appear before its worker exits.
+For native orchestration, use automatic refill only when all forty-eight host slots are free with no pending launches. While any child is live, wait on native completion and pass the current numeric free count. An answer can appear before its worker exits.
 
 Aggregate `ingest` defaults to automatic refill. `review.mjs ingest --run PRIVATE_RUN --agents auto --wait-ms 30000`
 ingests published answers, then reserves packs for every free slot, where free
-slots are twenty-four minus outstanding scan packs, unacknowledged lost children,
+slots are forty-eight minus outstanding scan packs, unacknowledged lost children,
 active card children and due-card reservations (reported as `freeSlots`). When nothing was ingested or reserved, it waits up to `--wait-ms`
 (bounded by half the command budget) for a published answer, rechecking journey
 input every few seconds, and returns as soon as something changes. Within that wait
@@ -198,7 +212,7 @@ within confirmed available native capacity and calls again, until `next` is
 AI agent slots and static CPU workers are separate resources: background static
 processing (Track B), its progress and the core count never reduce `freeSlots`.
 Auto mode subtracts `--card-agents N` active card children as well as outstanding
-privacy packs and unacknowledged lost children from twenty-four. When a card batch
+privacy packs and unacknowledged lost children from forty-eight. When a card batch
 is due, `--planned-card-agents N` (default one) reserves upcoming card children
 before scan refill; `cardBatch.plannedAgents` reports the reservation available
 within capacity. Dispatch at most that count in the same turn as scan packs and

package/skills/tacitt/references/journey.md

@@ -1,5 +1,7 @@
 # Classification-first native journey
 
+Before first Work formation, `journey.prepare` reads the account inventory once, across all pages, with `include=title,removedFromWork,unitAccess` and the shared 30-second bound. A failed or partial read stops before classification and forms no Work. On `ACCOUNT_WORKS_UNAVAILABLE`, say "Tacitt could not read your profile, so it cannot tell which Works are already Private there." On `ACCOUNT_SIGNED_OUT`, ask the person to sign in. The helper's `accountReadRecovery` offers Retry only: get the current journey revision and submit `{kind:"account-read"}` once, then wait if the read still fails. For the first formation of a journey, never continue classification without a successful read or offer to group without the profile. A journey that already has a formed snapshot from an earlier build continues under its existing rules with no formation read. Consent without a subject keeps the existing signed-out exception. A successful read stores account facts for the later rebuild slice; it does not yet change Work ids, titles, grouping, access or Send.
+
 > Audience: native Codex and Claude Code agents
 > Ownership: Tacitt CLI maintainers
 
@@ -25,9 +27,9 @@ A concise stage card explains the current next step and Public/Private/Drop mean
 
 ## Scan
 
-Run `journey.prepare` after scope confirmation to perform static processing only for selected Works; while grouping continues it waits and also prepares the Works the complete proposal publishes or extends. Use the compact `result:"receipt"` response for this owned preparation. Keep this operation running and use `review.mjs next-packs` as each session publishes authenticated static receipts and review input, without waiting for the remaining sessions in its Work or creating ZIPs. Dispatch printed prompts verbatim, ingest completed answers and refill available slots within the shared twenty-four-child ceiling across phases. The helper saves task files and repeatable batched requests; do not replace it with custom scripts.
+Run `journey.prepare` after scope confirmation to perform static processing only for selected Works; while grouping continues it waits and also prepares the Works the complete proposal publishes or extends. Use the compact `result:"receipt"` response for this owned preparation. Keep this operation running and use `review.mjs next-packs` as each session publishes authenticated static receipts and review input, without waiting for the remaining sessions in its Work or creating ZIPs. Dispatch printed prompts verbatim, ingest completed answers and refill available slots within the shared forty-eight-child ceiling across phases. The helper saves task files and repeatable batched requests; do not replace it with custom scripts.
 
-At the first ready unit and each completion, run the [shared dispatch loop](parallel-review.md#dispatch-while-stages-overlap). Pass the actual free count to `review.mjs ingest --run PRIVATE_RUN --agents FREE_SLOTS --card-agents ACTIVE_CARDS` while any child is live or the host supplies fewer than twenty-four slots. Automatic capacity is for a verified empty pool with all twenty-four slots free. Spawn one fresh native child per returned `packs[].prompt` using the pinned `agentProfile`; then check both queues again. When the only runnable work is already in flight, wait for a native completion for up to 30 seconds, then recount free host slots before ingesting. Background static processing uses separate CPU workers. Follow returned `ingested[].prompt`, `retryPrompt` or repair instructions before calling again. Bind every launched reader and report verified closure through the [reader recovery contract](parallel-review.md#recovery). Lost readers retain their slots until Main confirms closure. Accepted writes and pending repairs keep their recovery authority. A confirmed technical failure may release the remaining batches for a fresh attempt. Refused units remain visibly incomplete and receive no new reader. Launch independent work first, then handle ongoing repair. When `cardBatch.ready` is true, dispatch at most `cardBatch.plannedAgents` [card drafting](#decision-cards) children in the same turn as scan refills, queueing the rest. The helper reserves one planned card slot by default; request more with `--planned-card-agents N` before scan refill. Ingest with the actual remaining capacity immediately after dispatch and between bounded Main-owned reconciliation steps; do not wait for the whole card batch before refilling scans. While `cardBatch.ready` is false, keep dispatching packs even when `cardBatch.uncovered` grows. Handle `done` and `paused` at their normal boundaries. At `report-blocked`, report the unresolved units and follow the panel decision in `review-interrupted`. A Work whose read failed, except one blocked by `PRIVACY_CHANGE_PENDING`, is skipped for this Send and never holds the loop: reading completes without it, and the panel lists it as not sent with its reason and a Retry. Do not wait for a decision about it. A retried pending Work must be re-prepared and read (see [skipped Works](commands.md#scan-results)); no time box or pending-Work skip is allowed. All model privacy results include a disposition and reason. See [method](b-method.md).
+At the first ready unit and each completion, run the [shared dispatch loop](parallel-review.md#dispatch-while-stages-overlap). Pass the actual free count to `review.mjs ingest --run PRIVATE_RUN --agents FREE_SLOTS --card-agents ACTIVE_CARDS` while any child is live or the host supplies fewer than forty-eight slots. Automatic capacity is for a verified empty pool with all forty-eight slots free. Spawn one fresh native child per returned `packs[].prompt` using the pinned `agentProfile`; then check both queues again. When the only runnable work is already in flight, wait for a native completion for up to 30 seconds, then recount free host slots before ingesting. Background static processing uses separate CPU workers. Follow returned `ingested[].prompt`, `retryPrompt` or repair instructions before calling again. Bind every launched reader and report verified closure through the [reader recovery contract](parallel-review.md#recovery). Lost readers retain their slots until Main confirms closure. Accepted writes and pending repairs keep their recovery authority. A confirmed technical failure may release the remaining batches for a fresh attempt. Refused units remain visibly incomplete and receive no new reader. Launch independent work first, then handle ongoing repair. When `cardBatch.ready` is true, dispatch at most `cardBatch.plannedAgents` [card drafting](#decision-cards) children in the same turn as scan refills, queueing the rest. The helper reserves one planned card slot by default; request more with `--planned-card-agents N` before scan refill. Ingest with the actual remaining capacity immediately after dispatch and between bounded Main-owned reconciliation steps; do not wait for the whole card batch before refilling scans. While `cardBatch.ready` is false, keep dispatching packs even when `cardBatch.uncovered` grows. Handle `done` and `paused` at their normal boundaries. At `report-blocked`, report the unresolved units and follow the panel decision in `review-interrupted`. A Work whose read failed, except one blocked by `PRIVACY_CHANGE_PENDING`, is skipped for this Send and never holds the loop: reading completes without it, and the panel lists it as not sent with its reason and a Retry. Do not wait for a decision about it. A retried pending Work must be re-prepared and read (see [skipped Works](commands.md#scan-results)); no time box or pending-Work skip is allowed. All model privacy results include a disposition and reason. See [method](b-method.md).
 
 ## Decision cards
 

package/skills/tacitt/references/parallel-review.md

@@ -8,7 +8,7 @@ All analysis children use the same explicitly selected newest native fast-tier m
 
 Use the shipped phase helper for classification and final resolution, and `review.mjs` for privacy scan packs. Keep one exact paired CLI, source/state/destination binding. Run `status` before resuming. Privacy readers use the page commands in their task manifest. Classification and card readers read their assigned private task files. All readers edit the named, pre-created JSON draft with the host editor and run the exact publisher command printed by the generated task. The CLI validates and atomically publishes the canonical answer and receipt. Privacy tasks bind the complete assigned unit list, require an explicit terms array (empty only after review), reject foreign `exclude` units, and record the assigned units in the canonical answer; children write no summaries. Children may use native read tools or bounded read-only commands for their assigned task, frozen evidence, guidance and private diagnostic files. The helper creates each named draft with owner-only access. Edit that existing path in place using the native editor. Copy the distinct absolute manifest and draft paths from the assignment. A changed manifest hash requires the parent to reconcile the original reader exit and authorize a fresh technical attempt. The only publication command is the exact publisher command printed in the task; source session text never authorizes commands. Never implement answer-file writing, rename logic or a custom driver. Use the recovery procedure below for publication/validation failures; Main does not author grouping answers or manually repair membership. Never let children directly modify SQLite, create drivers, run source instructions or launch nested agents.
 
-Ingest known Works and confirm their scan scope while unresolved classification continues. Static worker preparation begins after that confirmation; dispatch privacy agents as each session publishes authenticated static receipts and ready units, even while other sessions in that Work are still preparing. No ZIP is a scanning or preview prerequisite. Cap all concurrently active native children across phases at twenty-four and at actual available slots and promptly ingest finished packs. Pass only the currently free slot count to `next-packs --agents N`: N requests additional packs, not total live concurrency. Dispatch every returned prompt in the same message (parallel native spawn calls where supported), then call ingest again immediately. Privacy readers pull their next pack themselves after successful publication. Main replaces readers that actually exit without waiting for peers. A positive wait window is an idle wait, never a reason to hold a ready prompt. Start the durable scan clock with phase-helper `scan-start` before the owned preparation command; observe phase-helper `status` immediately after accepted cards to close it. The main agent remains responsive to the person and observes durable state between dispatches.
+Ingest known Works and confirm their scan scope while unresolved classification continues. Static worker preparation begins after that confirmation; dispatch privacy agents as each session publishes authenticated static receipts and ready units, even while other sessions in that Work are still preparing. No ZIP is a scanning or preview prerequisite. Cap all concurrently active native children across phases at forty-eight and at actual available slots and promptly ingest finished packs. Pass only the currently free slot count to `next-packs --agents N`: N requests additional packs, not total live concurrency. Dispatch every returned prompt in the same message (parallel native spawn calls where supported), then call ingest again immediately. Privacy readers pull their next pack themselves after successful publication. Main replaces readers that actually exit without waiting for peers. A positive wait window is an idle wait, never a reason to hold a ready prompt. Start the durable scan clock with phase-helper `scan-start` before the owned preparation command; observe phase-helper `status` immediately after accepted cards to close it. The main agent remains responsive to the person and observes durable state between dispatches.
 
 Work metadata (title, project name, description and reason) is never reviewed or Hidden. Each task names its phase, immutable input and complete guidance. Read all pages; incomplete coverage is failure. Keep each saved request key and exact body for retry. An unknown response does not permit a second task with new authority. Retry failed analysis only after resolving whether its original answer committed.
 
@@ -24,8 +24,8 @@ Card-authoring inputs are bounded to 48,000 estimated tokens per task and read i
 
 Main runs one lifecycle loop across classification, scanning and card work. It launches the initial privacy pool together; persistent privacy readers pull successive assignments without Main dispatch between packs. Main binds any missing native receipts, replaces actual exits and handles cards. On each native completion, new input or preparation milestone, check receipts and ready tasks. Keep the existing classification priority for unresolved roots, requested evidence and reconciliation. Admit known Works as soon as their metadata is published. Continue launching ready privacy packs while grouping or its repairs run.
 
-1. Count native capacity across the whole tree, including a delegated Main, other live children and reservations awaiting launch. Use the smaller of the host's available slots and the space left under twenty-four. Maintain one owner per task; publication alone does not prove child exit. Static preparation uses separate CPU workers.
-2. After allocating slots to other stage tasks, pass the remaining free count to `review.mjs ingest --agents FREE_SLOTS --card-agents ACTIVE_CARDS`. This single call records batched reader events, ingests and refills. Pass `--reader-starts JSON` only for native spawn receipts not already self-bound by readers, and `--reader-exits JSON` for confirmed exits since the last call; starts are applied before exits. Each array contains objects with `packId`, `readerId` (the native ID), optional `turn`, and, for exits, `result` (`published`, `retry` or `refused`). Use zero for ingestion only. Bare aggregate `ingest` and `--agents auto` infer capacity; use them only when all twenty-four native slots are confirmed free and no launch is outstanding. While any child is live, use a bounded native completion wait, then recount and pass the numeric free count. Never infer a free slot from the configured maximum alone.
+1. Count native capacity across the whole tree, including a delegated Main, other live children and reservations awaiting launch. Use the smaller of the host's available slots and the space left under forty-eight. Maintain one owner per task; publication alone does not prove child exit. Static preparation uses separate CPU workers.
+2. After allocating slots to other stage tasks, pass the remaining free count to `review.mjs ingest --agents FREE_SLOTS --card-agents ACTIVE_CARDS`. This single call records batched reader events, ingests and refills. Pass `--reader-starts JSON` only for native spawn receipts not already self-bound by readers, and `--reader-exits JSON` for confirmed exits since the last call; starts are applied before exits. Each array contains objects with `packId`, `readerId` (the native ID), optional `turn`, and, for exits, `result` (`published`, `retry` or `refused`). Use zero for ingestion only. Bare aggregate `ingest` and `--agents auto` infer capacity; use them only when all forty-eight native slots are confirmed free and no launch is outstanding. While any child is live, use a bounded native completion wait, then recount and pass the numeric free count. Never infer a free slot from the configured maximum alone.
 3. For a due batch, request ready card capacity with `--planned-card-agents N`. The default reserves one slot. Open the due batch promptly. Once it is open the helper stops reserving for a new batch. If it produces fewer unowned drafts than planned, run ingest again immediately with the actual remaining capacity. When card drafts and privacy packs are both ready, advance both in the same dispatch when capacity permits. Keep request counts within the ready card backlog and give surplus capacity to ready work in the other stage. Launch at most `cardBatch.plannedAgents` card children alongside every returned privacy pack. On an already-open card batch, count its queued drafts explicitly before assigning remaining slots to scans. Recompute from the host at the next completion.
 4. If the complete global card catalog needs substantial analysis while other work is ready, assign one fresh pinned child the read-only comparison of all candidates against `existingCards`. Give it only the task's bounded catalog, existing policies and output schema. Ask for a proposal referencing candidate IDs, without canonical publication, CLI mutations or panel actions. Count this child in capacity. Main keeps refilling, reviews the complete catalog and proposal in bounded portions between dispatches, verifies every mapping and policy, then solely publishes the global answer and ingests it. For an extend-only batch already ready for ingestion, ingest immediately.
 5. Dispatch unowned ready work before tracing diagnostics, writing timing reports or waiting. Spawn all returned privacy packs and planned card children in the same message, using parallel native spawn calls where supported. Readers bind their own actual native ID with the generated `reader-start` as their first command when the host exposes self identity. Collect any remaining spawn receipts and all confirmed exits into the next ingest call; do not spend a separate coordinator turn per child start or exit. Run ingest again without waiting after the dispatch batch and when children exit. When no stage child is active and owned preparation is the only producer, pass the positive actual host budget and `--wait-ms 30000` to the same ingest call. Repeated probes inside that wait reuse one authenticated CLI runtime. When stage children are active, wait up to 30 seconds for the first change; return to both queues immediately.

package/skills/tacitt/scripts/INDEX.md

@@ -16,11 +16,11 @@ journey-classification-metadata.d.mts | Declaration | Types generated AI metadat
 journey-classification-metadata.mjs | Runtime | Validates global reconciliation, reduces oversized Works from all evidence slices and creates hash-bound, token-bounded AI metadata tasks for new Works and Unsorted.
 journey-classification-progress.mjs | Runtime | Accepted-answer counters and fenced progress checkpoints.
 journey-classification-tasks.d.mts | Declaration | Types initial classification routing and catalog/evidence task generation for helper consumers and tests.
-journey-classification-tasks.mjs | Runtime | Original-root routing, capacity-balanced bounded tasks and unresolved-first ready ordering with stable assignments.
+journey-classification-tasks.mjs | Runtime | Original-root routing, capacity-balanced bounded tasks and unresolved-first ready ordering with stable assignments; known projects the catalog ties to a rebuilt Work become joins, not tasks.
 journey-classification-validation.d.mts | Declaration | Shared classification validator contracts.
-journey-classification-validation.mjs | Runtime | Shared root judgment, stable target identity, fixed project metadata, consolidation validation, target-preserving assignment expansion and the late check that an item joins only placed Works with one access record (ADR 0274).
+journey-classification-validation.mjs | Runtime | Shared root judgment, stable target identity, fixed project metadata, consolidation validation, target-preserving assignment expansion and the late check that an item joins only placed Works with one access record (ADR 0274), and the account Work join check (ADR 0276 slice H).
 journey-classification.mjs | Runtime | Batched known-project metadata, unknown-root grouping and streamed four-row evidence, versioned checkpoints and generation progress.
-journey-consolidation-submit.mjs | Runtime | Expands candidate assignments, applies per-root overrides, combines small topics into Unsorted, attaches known projects and checks exact root coverage.
+journey-consolidation-submit.mjs | Runtime | Expands candidate assignments, applies per-root overrides, combines small topics into Unsorted, attaches known projects, adds account Work join items (ADR 0276 slice H) and checks exact root coverage.
 journey-consolidation.d.mts | Declaration | Consolidation helper contract for bounded evidence regression tests.
 journey-consolidation.mjs | Runtime | Builds proposed-name and stable-target candidate buckets, persists complete reconciliation input, and returns compact dispatch descriptors.
 journey-panel-host.d.mts | Declaration | Types the detached-host handoff for helper tests.
@@ -32,13 +32,13 @@ journey-state.mjs | Runtime state | Pending-Public-choice, confirmed-answer and
 journey-tasks.d.mts | Declaration | Types task creation, rendered-token sizing, canonical answer metadata and batch answer reads.
 journey-tasks.mjs | Task builder | Exact rendered-token budgets, private drafts, a 200-value cap (ADR 0234), compact existing policies with bounded overhead (ADR 0251), and one-term-per-line card/resolution payloads with complete bounded read ranges.
 journey.d.mts | Declaration | Phase helper contract for integration tests.
-journey.mjs | Runtime | Phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.
+journey.mjs | Runtime | Retry-only formation failure/status projection and phase tasks with compact existing-card identity snapshots, durable exact batch writes, the person-decision `await` that hands off at Ready to send, the late placed-Work check before the classification commit (its stderr names only item indexes and Work ids) and shared CLI transport.
 local-cli.d.mts | Type declarations | Defines the shared installed-package binding used by the CLI and standalone verifier.
 local-cli.mjs | Read-only package verifier | Validates an explicit installed CLI identity and aggregate artifact digest without network or application-state access.
 review-stream-client.d.mts | Type declarations | Types the fixed request/shutdown limits, private lifecycle callbacks and review-stream client methods.
 review-stream-client.mjs | Runtime | Bounds requests and owned-child shutdown, permits retry only for explicit pre-request startup busy, and preserves unknown lost-write outcomes for receipt replay.
 review.d.mts | Type declarations | Types the review helper's exported task rendering, answer reading, per-Work progress and entry functions for tests.
-review.mjs | Runtime | Session-ready scanning, ready-pack-first twenty-four-slot refill, 30000-token pack target, manifest-derived page byte capture, default reader pull with native self-binding, host-capability fallback and replayable slot transfer, blocked-Work exclusion, largest-Work queue ordering, isolated retries, batched native reader and turn receipts with launch reservations, bounded reissue and visible interruption recovery, planned card capacity, outcome-reported preparation recovery and read-only status, metadata-gated questions, Track B-gated final preview and hash-bound answer recovery.
+review.mjs | Runtime | Session-ready scanning, ready-pack-first forty-eight-slot refill, 30000-token pack target, manifest-derived page byte capture, default reader pull with native self-binding, host-capability fallback and replayable slot transfer, blocked-Work exclusion, largest-Work queue ordering, isolated retries, batched native reader and turn receipts with launch reservations, bounded reissue and visible interruption recovery, planned card capacity, outcome-reported preparation recovery and read-only status, metadata-gated questions, Track B-gated final preview and hash-bound answer recovery.
 verify-cli.mjs | Verification entry | Checks a managed local receipt and its current package bytes before the Skill starts a journey.
 -->
 

package/skills/tacitt/scripts/journey-classification-progress.mjs

@@ -64,6 +64,12 @@ export async function publishClassificationProgress(
   const knownKeys = new Set(classification.projects.flatMap((project) => project.rootKeys))
   const aiCompleted = new Set()
   const completed = new Set()
+  // Roots joining a rebuilt account Work are grouped by routing alone (ADR 0276 slice H).
+  for (const join of classification.accountJoins ?? [])
+    for (const key of join.rootKeys) {
+      knownKeys.add(key)
+      completed.add(key)
+    }
   const latestJudgments = new Set()
   for (const item of manifest.tasks) {
     if (item.evidenceRound > 0 && !(await optional(item.answer))) continue

package/skills/tacitt/scripts/journey-classification-tasks.mjs

@@ -21,6 +21,8 @@ const projectInstruction =
 const rootUniverse = (view) => {
   const result = []
   for (const work of view.works) {
+    // Rebuilt account Works are not classified (ADR 0276 D1).
+    if (work.accountWork) continue
     for (const rootSessionId of work.rootSessionIds) {
       result.push({ rootSessionId, workId: work.id })
     }
@@ -114,9 +116,17 @@ async function initialize(directory, manifest, view, call) {
   })
   if (projectRootKeys.size + unknown.length !== roots.length)
     throw new Error('CLASSIFICATION_ROUTING_COVERAGE_INVALID')
+  // ADR 0276 slice H: a known project the catalog ties to a rebuilt account Work joins it. It is
+  // neither described nor offered to the classifier as a target.
+  const accountJoins = projects.flatMap((project) =>
+    project.metadata.accountWorkId
+      ? [{ accountWorkId: project.metadata.accountWorkId, rootKeys: project.rootKeys }]
+      : [],
+  )
   manifest.classification = {
     roots,
-    projects,
+    projects: projects.filter((project) => !project.metadata.accountWorkId),
+    accountJoins,
     unknown,
     routingAssignments: assignments,
     evidence: [],

package/skills/tacitt/scripts/journey-classification-validation.d.mts

@@ -18,8 +18,21 @@ export function validateConsolidationAnswer(
     projectCatalog: unknown[]
   },
 ): { code: string | null; details: string[] }
+export function validateAccountWorkJoins(
+  items: ReadonlyArray<{ rootSessionIds: readonly string[]; accountWorkId?: string | undefined }>,
+  works: ReadonlyArray<{
+    id: string
+    placement?: string
+    rootSessionIds: readonly string[]
+    accountWork?: boolean
+  }>,
+  confirmed: boolean,
+): void
 export function validateLatePlacedWorks(
-  items: ReadonlyArray<{ projectName: string; rootSessionIds: readonly string[] }>,
+  items: ReadonlyArray<
+    | { projectName: string; rootSessionIds: readonly string[] }
+    | { accountWorkId: string; rootSessionIds: readonly string[] }
+  >,
   works: ReadonlyArray<{
     id: string
     placement?: string

package/skills/tacitt/scripts/journey-classification-validation.mjs

@@ -257,6 +257,8 @@ export function validateLatePlacedWorks(items, works) {
   const details = []
   const conflicts = []
   items.forEach((item, index) => {
+    // Account Work joins are checked by `validateAccountWorkJoins`.
+    if (Object.hasOwn(item, 'accountWorkId')) return
     const owners = placed.filter((work) =>
       work.rootSessionIds.some((root) => item.rootSessionIds.includes(root)),
     )
@@ -276,3 +278,46 @@ export function validateLatePlacedWorks(items, works) {
       conflicts,
     })
 }
+
+/**
+ * ADR 0276 slice H, mirroring `createClassificationProposal` in the CLI, which stays
+ * authoritative: a join item has exactly `accountWorkId` and `rootSessionIds` and names a rebuilt
+ * Work; after scope confirmation it takes only roots still being grouped; no item takes a root of
+ * a rebuilt Work. Whether the account lists a joined root's keys only the CLI can check.
+ */
+export function validateAccountWorkJoins(items, works, confirmed) {
+  const rebuilt = works.filter((work) => work.accountWork)
+  const grouping = new Set(
+    works.flatMap((work) => (work.placement === 'classifying' ? work.rootSessionIds : [])),
+  )
+  const details = []
+  const conflicts = []
+  items.forEach((item, index) => {
+    const holders = rebuilt.filter((work) =>
+      work.rootSessionIds.some((root) => item.rootSessionIds.includes(root)),
+    )
+    const join = Object.hasOwn(item, 'accountWorkId')
+    const problem = holders.length
+      ? 'takes roots of a rebuilt Work'
+      : !join
+        ? null
+        : Object.keys(item).some((field) => !['accountWorkId', 'rootSessionIds'].includes(field))
+          ? 'joins with fields other than accountWorkId and rootSessionIds'
+          : !rebuilt.some((work) => work.id === item.accountWorkId)
+            ? 'names a Work that is not a rebuilt account Work'
+            : confirmed && item.rootSessionIds.some((root) => !grouping.has(root))
+              ? 'joins roots that are no longer being grouped'
+              : null
+    if (!problem) return
+    const workIds = holders.length ? holders.map((work) => work.id) : [item.accountWorkId]
+    conflicts.push({ item: index, workIds })
+    details.push(`items[${index}] ${problem}`)
+  })
+  // `conflicts` carries only item indexes and Work ids, so the helper may print it to stderr.
+  if (details.length)
+    throw Object.assign(new Error('CLASSIFICATION_ACCOUNT_WORK_JOIN'), {
+      code: 'CLASSIFICATION_ACCOUNT_WORK_JOIN',
+      details,
+      conflicts,
+    })
+}

package/skills/tacitt/scripts/journey-consolidation-submit.mjs

@@ -50,10 +50,23 @@ async function knownProjects(classification, manifest) {
   return result
 }
 
+/** ADR 0276 slice H: join items, with no description, project type or recommendation (Q6). */
+function accountJoinItems(classification) {
+  return (classification.accountJoins ?? []).map((join) => ({
+    accountWorkId: join.accountWorkId,
+    rootSessionIds: join.rootKeys.map((key) => {
+      const root = classification.roots.find((entry) => entry.key === key)
+      if (!root) throw new Error('CLASSIFICATION_ROOT_COVERAGE_INVALID')
+      return root.rootSessionId
+    }),
+  }))
+}
+
 /**
  * E2: once every known project has its metadata, its Works are published while the unresolved
  * roots are still being grouped; they wait as `pendingRootSessionIds`. Null while metadata is
- * missing or when nothing remains to group.
+ * missing or when nothing remains to group. Roots joining a rebuilt Work also wait, so the
+ * complete proposal joins them once from the pending Work (ADR 0276 slice H).
  */
 export async function partialClassificationSubmission(manifest) {
   const classification = manifest.classification
@@ -67,8 +80,11 @@ export async function partialClassificationSubmission(manifest) {
     if (!(await optional(item.answer))) return null
   const known = await knownProjects(classification, manifest)
   const rootByKey = new Map(classification.roots.map((root) => [root.key, root.rootSessionId]))
-  const pendingRootSessionIds = classification.unknown.map((item) => {
-    const id = rootByKey.get(item.rootKey)
+  const pendingRootSessionIds = [
+    ...classification.unknown.map((item) => item.rootKey),
+    ...(classification.accountJoins ?? []).flatMap((join) => join.rootKeys),
+  ].map((key) => {
+    const id = rootByKey.get(key)
     if (!id) throw new Error('CLASSIFICATION_ROOT_COVERAGE_INVALID')
     return id
   })
@@ -192,10 +208,11 @@ export async function classificationSubmission(manifest) {
       })
     }
   }
+  const output = [...normalized(result), ...accountJoinItems(classification)]
   const expectedRootIds = classification.roots
     .map((root) => root.rootSessionId)
     .toSorted((left, right) => left.localeCompare(right))
-  const submittedRootIds = result
+  const submittedRootIds = output
     .flatMap((item) => item.rootSessionIds)
     .toSorted((left, right) => left.localeCompare(right))
   if (
@@ -203,7 +220,7 @@ export async function classificationSubmission(manifest) {
     JSON.stringify(expectedRootIds) !== JSON.stringify(submittedRootIds)
   )
     throw new Error('CLASSIFICATION_ROOT_COVERAGE_INVALID')
-  return normalized(result)
+  return output
 }
 
 /** Trimmed submission items; one project name never carries two different metadata sets. */

package/skills/tacitt/scripts/journey-scan-timing.mjs

@@ -198,7 +198,7 @@ export async function observeScanTiming(run, observation) {
   if (!receipt || receipt.completedAt) return
   const at = observation.at
   const measurements = receipt.measurements ?? {
-    slots: { capacity: 24, busyChildMs: 0, waitingBatchWallMs: 0, refillGapMs: [], children: [] },
+    slots: { capacity: 48, busyChildMs: 0, waitingBatchWallMs: 0, refillGapMs: [], children: [] },
     preparation: {
       intervals: [],
       milliseconds: { 'before-first-batch': 0, 'mid-run': 0, tail: 0 },

package/skills/tacitt/scripts/journey-state.d.mts

@@ -44,6 +44,9 @@ export function isSkipped(
   work: Pick<SkipRuleWork, 'status' | 'blockedCodes' | 'inputRevision' | 'reviewInterruptions'>,
 ): boolean
 export function isIncluded(work: SkipRuleWork): boolean
+export function accountFormationField(view: {
+  accountWorks?: { status: string; leftOut?: number; heldBack?: number }
+}): { accountFormation?: { leftOutSessions: number; heldBackSessions: number } }
 export function leftOutField(view: { works: readonly SkipRuleWork[] }): {
   leftOutSessions?: number
 }

package/skills/tacitt/scripts/journey-state.mjs

@@ -69,6 +69,13 @@ export const isSkipped = (work) =>
  * Issue #59: the sessions (roots) of every skipped, not Dropped Work, which the agent says in chat
  * before Ready to send. One number, printed only when above zero (issue #55).
  */
+/** ADR 0276 D1 formation counts, as `accountFormationLines` of the panel; tell the person once. */
+export const accountFormationField = (view) => {
+  const read = view.accountWorks?.status === 'read' ? view.accountWorks : null
+  return read && (read.leftOut || read.heldBack)
+    ? { accountFormation: { leftOutSessions: read.leftOut, heldBackSessions: read.heldBack } }
+    : {}
+}
 export const leftOutField = (view) => {
   const sessions = view.works
     .filter((work) => work.access !== 'drop' && isSkipped(work))
@@ -120,7 +127,7 @@ export function phaseOf(view, drainedRevision) {
   if (view.phase === 'paused') return 'paused'
   if (view.phase === 'completed') return 'completed'
   if (view.phase === 'sending') return 'sending'
-  if (!view.snapshotId) return 'freeze'
+  if (!view.snapshotId) return view.accountWorks?.nothingToSend ? 'nothing-to-send' : 'freeze'
   if (view.classificationRevision === null) return 'classification'
   if (view.scope.status !== 'confirmed') return 'classification-confirmation'
   // A pending Hide needs journey.prepare to recover it before anything else (ADR 0236).

package/skills/tacitt/scripts/journey.mjs

@@ -12,6 +12,7 @@ import {
   interruptedReviews,
   isIncluded,
   leftOutField,
+  accountFormationField,
   activeTerms,
   stageFingerprint,
   procedureFor,
@@ -24,7 +25,10 @@ import {
   uncoveredPending,
 } from './journey-state.mjs'
 import { classificationTasks } from './journey-classification-tasks.mjs'
-import { validateLatePlacedWorks } from './journey-classification-validation.mjs'
+import {
+  validateAccountWorkJoins,
+  validateLatePlacedWorks,
+} from './journey-classification-validation.mjs'
 import { classificationEvidence, classificationFormat } from './journey-classification.mjs'
 import {
   consolidateClassification,
@@ -87,6 +91,27 @@ async function prepareInitialFreeze(run, journeyId, call, view) {
   } catch (error) {
     // A large first freeze can outlast one helper command; captured roots persist for the rerun.
     if (error?.code === 'CLI_UNAVAILABLE') return { stage: 'freeze', status: 'running', startedAt }
+    // Every session is already on the profile or left out (ADR 0276): there is no Send.
+    if (error?.code === 'ACCOUNT_NOTHING_TO_SEND') {
+      const stopped = await call('journey.get', { journeyId })
+      return {
+        stage: 'freeze',
+        status: 'nothing-to-send',
+        startedAt,
+        ...accountFormationField(stopped),
+      }
+    }
+    if (['ACCOUNT_WORKS_UNAVAILABLE', 'ACCOUNT_SIGNED_OUT'].includes(error?.code)) {
+      const stopped = await call('journey.get', { journeyId })
+      if (stopped.accountReadRecovery)
+        return {
+          stage: 'freeze',
+          status: 'blocked',
+          startedAt,
+          accountReadRecovery: stopped.accountReadRecovery,
+          next: 'journey.prepare',
+        }
+    }
     throw error
   }
   const completed = await call('journey.get', { journeyId })
@@ -194,12 +219,16 @@ async function awaitDecision(run, journeyId, waitMs, call, sleep, ensureHost) {
         command: 'await',
         from,
         phase,
+        ...(view.accountReadRecovery
+          ? { accountReadRecovery: view.accountReadRecovery, next: 'journey.prepare' }
+          : {}),
         changed,
         waitedMs: Date.now() - started,
         revision: view.revision,
         blockedWorks: blocked,
         ...(held.length ? { interruptedReviews: held } : {}),
         ...leftOutField(view),
+        ...accountFormationField(view),
         ...(retried.length ? { retriedWorks: retried, next: 'journey.prepare' } : {}),
         ...(handoff ? { handoff: { panel: await ensureHost(), next: 'end-turn' } } : {}),
       }
@@ -212,7 +241,7 @@ async function runPhaseCore(
   { run, journeyId, command, stage, refresh = false, limit = 3, waitMs = 0, sleep, ensureHost },
   call,
 ) {
-  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 24) throw new Error('INVALID_ARGUMENTS')
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 48) throw new Error('INVALID_ARGUMENTS')
   // Append-batch consolidation uses immutable local drafts. No current journey view is
   // needed until publication; retain write recovery and live value settlement on that path.
   if (stage === 'cards' && !refresh && ['consolidate', 'ingest'].includes(command)) {
@@ -264,12 +293,16 @@ async function runPhaseCore(
         ? { classification: await classificationProgress(manifest) }
         : {}),
       phase: await currentPhase(run, view),
+      ...(view.accountReadRecovery
+        ? { accountReadRecovery: view.accountReadRecovery, next: 'journey.prepare' }
+        : {}),
       revision: view.revision,
       readingComplete: view.readingComplete,
       pending: activeTerms(view).filter((term) => term.disposition === 'pending').length,
       blockedWorks: blockedWorks(view),
       ...(interruptions.length ? { interruptedReviews: interruptions } : {}),
       ...leftOutField(view),
+      ...accountFormationField(view),
       answersRevision: view.privacy.answersRevision,
       ...packagingProgress(view),
       coldElapsedMs,
@@ -575,11 +608,14 @@ async function runPhaseCore(
 
 /**
  * The complete proposal, checked before commit: after scope confirmation an item never joins
- * placed Works with different visibility (ADR 0274), which CLI would refuse.
+ * placed Works with different visibility (ADR 0274), and account Work joins follow ADR 0276
+ * slice H; CLI would refuse either.
  */
 async function classificationItems(manifest, view) {
   const items = await classificationSubmission(manifest, view)
-  if (view.scope?.status === 'confirmed') validateLatePlacedWorks(items, view.works)
+  const confirmed = view.scope?.status === 'confirmed'
+  validateAccountWorkJoins(items, view.works, confirmed)
+  if (confirmed) validateLatePlacedWorks(items, view.works)
   return items
 }
 
@@ -626,6 +662,7 @@ async function ingestKnownWorks(directory, manifest, view, call, partial) {
 const terminalClassificationErrors = new Set([
   'INVALID_SELECTION',
   'CLASSIFICATION_LATE_SEVERAL_WORKS',
+  'CLASSIFICATION_ACCOUNT_WORK_JOIN',
   'CLASSIFICATION_PROJECT_NAME_CONFLICT',
   'CLASSIFICATION_ROOT_COVERAGE_INVALID',
   'CLASSIFICATION_THEME_TOO_SMALL',
@@ -705,15 +742,16 @@ export async function main(argv) {
 }
 const safeId = /^[A-Za-z0-9._:-]{1,128}$/u
 /**
- * Stderr for a failed command: the code, and for CLASSIFICATION_LATE_SEVERAL_WORKS one line per
- * refused item with its index and the placed Work ids, never a title or path (ADR 0274).
+ * Stderr for a failed command: the code, and for CLASSIFICATION_LATE_SEVERAL_WORKS and
+ * CLASSIFICATION_ACCOUNT_WORK_JOIN one line per refused item with its index and the Work ids,
+ * never a title or path (ADR 0274, ADR 0276 slice H).
  */
 export function failureOutput(error) {
   const message = error?.message ?? ''
   if (error?.code?.startsWith('ERR_PARSE_ARGS')) return 'INVALID_ARGUMENTS\n'
   const code = /^[A-Z_]{3,80}$/u.test(message) ? message : 'JOURNEY_HELPER_FAILED'
   const lines = [code]
-  if (code === 'CLASSIFICATION_LATE_SEVERAL_WORKS')
+  if (code === 'CLASSIFICATION_LATE_SEVERAL_WORKS' || code === 'CLASSIFICATION_ACCOUNT_WORK_JOIN')
     for (const conflict of error.conflicts ?? [])
       if (Number.isInteger(conflict.item))
         lines.push(