@gitroll/tacitt-cli 0.6.9 → 0.6.10

package/dist/{query-CfhcS4gd.mjs → query-By41gaKm.mjs}

@@ -1,10 +1,10 @@
-import { $ as createCleanup, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as removeNamedTemporarySpools, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as createTemporary, _ as processJourneyMetadata, a as scanReviewFields, at as windowsOwnerOnly, c as readSessionScanRecords, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as restrictToOwner, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, nt as makePrivateDirectory, o as createWorkPieces, ot as isWindowsAclFailure, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as openPrivateFile, s as readSessionScanFields, st as windowsAclCodes, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-V9GHLZQs.mjs";
-import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BQXssW46.mjs";
-import { $t as safeField, Bt as sessionPeriodSchema, Dn as createStaticProcessor, Fn as entityDictionaryVersion, Ft as termTypeInfo, Gt as ownerProfileSchema, Kt as passportAddressSchema, Ot as privacyTermKey, Qt as safeCode, Sn as currentDetectorVersion, T as bLiteralTerms, Un as frameRecords, Wt as mergeOwnerProfile, Xt as ApplicationError, Zt as UnfinishedJourneyError, an as observeSource, ar as admitCustomTerm, c as textDigest, ir as createEntityMatcher, nn as reviewFamilies, or as admitGitName, qt as profileHasChoices, tn as familySelected, ur as ProcessingError, zt as filterInventoryByPeriod } from "./locate-BWkblijS.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-BgsEnMsy.mjs";
-import { $ as settingsBatchSchema, $r as isReadingComplete, A as deviceAuthorizationSchema, B as inspectionStartSchema, Bt as classificationWorks, Ct as sendPrepareSchema, Dt as currentJourneyAdapters, Fn as bTermMatcher, Gn as retireWorkDescription, Gr as sendArtifactSchema, Hn as journeyConfirmedHides, Hr as agentSourceSchema, Ht as newJourneyWork, Jn as workCorrectionBinding, Jr as sendResolutionSchema, Kn as workDecisionDigest, Kr as sendReceiptSchema, Lr as hasCurrentStaticReview, M as profileUrlMatchesIdentity, Mr as privacyDecisionDigest, N as readAccountAvatarUrl, O as createAccount, Or as displayedScopeDigest, Ot as obsoleteJourney, P as storedCredentialSchema, Pt as applyClassification, Qr as isIncludedWork, R as createApplication, Rr as staticReviewDigest, St as sendChoiceSchema, Tt as sendStartSchema, Ur as agentSourcesSchema, V as validateInspectionBatch, Vt as retireScanGeneration, W as inspectionQuerySchema, Wr as journeySendSchema, Xr as hasCompleteWorkDescription, Yr as sendSettingsSchema, Yt as journeySearchResultSchema, Zr as isClassifying, Zt as searchScopeDigest, _ as changeJourney, _r as emptyPreparationFacts, _t as emptyTermsRevision, ai as packageCommandSchema, ar as scanPreparationDigest, bt as replaceSensitiveTermsSchema, cr as scanGitSeedsResource, ei as isSelectedWork, et as settingsQuerySchema, fi as recommendParallelism, ft as manualUploadChoiceSchema, h as hideScopeDigest, ht as manualUploadStartSchema, ii as commandSchema, j as deviceProfileScopeSchema, jr as assertJourneyPrivacyReady, k as accountProfileSchema, kr as requestedScope, li as producerVersion, lr as verifiedScanGitSeeds, lt as validateFailureLocation, m as activeJourneyTerms, mt as manualUploadSchema, oi as selectionBatchSchema, or as scanSessionResourceSchema, pt as manualUploadPrepareSchema, qr as sendReplaceResultSchema, ri as withReadingProgress, rt as appendSensitiveTerms, si as selectionSchema, sr as scanGitSeedsId, st as artifactFailureDetailSchema, ur as scanExclusionResourceSchema, ut as manualUploadActionSchema, wt as sendRequestSchema, xt as sendActionSchema, yt as normalizeSensitiveTerms, z as inspectionCancelSchema, zn as confirmedHideKinds, zt as classificationPartition } from "./src-DzKuzGVH.mjs";
-import { _t as isCoordinationBusy } from "./heap-Dt3-d27v.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-CODlN6zl.mjs";
+import { $ as createCleanup, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as removeNamedTemporarySpools, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as createTemporary, _ as processJourneyMetadata, a as scanReviewFields, at as windowsOwnerOnly, c as readSessionScanRecords, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as restrictToOwner, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, nt as makePrivateDirectory, o as createWorkPieces, ot as isWindowsAclFailure, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as openPrivateFile, s as readSessionScanFields, st as windowsAclCodes, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-3jvMvSQn.mjs";
+import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BHIwElNF.mjs";
+import { $t as safeField, Bt as sessionPeriodSchema, Dn as createStaticProcessor, Fn as entityDictionaryVersion, Ft as termTypeInfo, Gt as ownerProfileSchema, Kt as passportAddressSchema, Ot as privacyTermKey, Qt as safeCode, Sn as currentDetectorVersion, T as bLiteralTerms, Un as frameRecords, Wt as mergeOwnerProfile, Xt as ApplicationError, Zt as UnfinishedJourneyError, an as observeSource, ar as admitCustomTerm, c as textDigest, ir as createEntityMatcher, nn as reviewFamilies, or as admitGitName, qt as profileHasChoices, tn as familySelected, ur as ProcessingError, zt as filterInventoryByPeriod } from "./locate-Cwv6WH8n.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-D_DfY--2.mjs";
+import { $r as isClassifying, $t as searchScopeDigest, Ar as displayedScopeDigest, At as obsoleteJourney, B as createApplication, Br as staticReviewDigest, Bt as classificationPartition, Ct as sendActionSchema, Dt as sendStartSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, Gr as agentSourcesSchema, H as inspectionStartSchema, Ht as applyClassification, I as storedCredentialSchema, Jn as workDecisionDigest, Jr as sendReceiptSchema, K as inspectionQuerySchema, Kr as journeySendSchema, Ln as bTermMatcher, M as deviceAuthorizationSchema, N as deviceProfileScopeSchema, Nr as assertJourneyPrivacyReady, O as createAccount, P as profileUrlMatchesIdentity, Pr as privacyDecisionDigest, Qr as hasCompleteWorkDescription, St as replaceSensitiveTermsSchema, Tt as sendPrepareSchema, U as validateInspectionBatch, Ut as retireScanGeneration, V as inspectionCancelSchema, Vn as confirmedHideKinds, Vt as classificationWorks, Wn as journeyConfirmedHides, Wr as agentSourceSchema, Wt as newJourneyWork, Xn as workCorrectionBinding, Xr as sendResolutionSchema, Yr as sendReplaceResultSchema, Zr as sendSettingsSchema, Zt as journeySearchResultSchema, _ as changeJourney, _t as manualUploadStartSchema, ai as withReadingProgress, at as appendSensitiveTerms, ci as selectionBatchSchema, cr as scanSessionResourceSchema, di as producerVersion, dr as verifiedScanGitSeeds, dt as validateFailureLocation, ei as isIncludedWork, fr as scanExclusionResourceSchema, ft as manualUploadActionSchema, gt as manualUploadSchema, h as hideScopeDigest, ht as manualUploadPrepareSchema, j as accountProfileSchema, jr as requestedScope, k as renew, kt as currentJourneyAdapters, li as selectionSchema, lr as scanGitSeedsId, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mi as recommendParallelism, mt as manualUploadChoiceSchema, ni as isSelectedWork, nt as settingsQuerySchema, oi as commandSchema, qn as retireWorkDescription, qr as sendArtifactSchema, si as packageCommandSchema, sr as scanPreparationDigest, ti as isReadingComplete, tt as settingsBatchSchema, ur as scanGitSeedsResource, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yr as emptyPreparationFacts, yt as emptyTermsRevision, zr as hasCurrentStaticReview } from "./src-BqtdFVq7.mjs";
+import { _t as isCoordinationBusy } from "./heap-CM298Yu0.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-LPd8WEsN.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -3582,7 +3582,7 @@ function assertScope(journey, send) {
 	if (journey.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 	if (journey.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 	if (scopeDigest(journey) !== send.scopeDigest) throw new ApplicationError("SEND_SCOPE_INVALIDATED");
-	assertJourneyPrivacyReady(journey, true);
+	assertJourneyPrivacyReady(journey, true, { publicChoices: send.status !== "completed" });
 	for (const item of send.items) {
 		const work = journey.works.find((value) => value.id === item.workId);
 		if (!work || work.status !== "ready" || !hasCompleteWorkDescription(work) || !work.accessConfirmed || work.access !== item.access || work.artifact?.revision !== work.revision || work.artifact.sha256 !== item.artifact.sha256 || work.artifact.archiveBytes !== item.artifact.byteLength || work.artifact.bundleId !== item.artifact.bundleId) throw new ApplicationError("SCOPE_NOT_READY");
@@ -3867,31 +3867,32 @@ function createJourneyRenderer(options) {
 	async function renderScope(journeyId, works, signal) {
 		const workers = options.workers;
 		const size = workers ? workers.parallelism ?? renderWorkerCount() : 0;
-		if (!workers || works < 1 || size < 1) {
-			const retry = renderRetry(signal, Math.max(1, works));
-			return {
-				render: (workId) => render(journeyId, workId, signal, { retry }),
-				close: async () => void 0
-			};
-		}
-		const retry = renderRetry(signal, Math.min(works, size + 1));
-		const store = retry.store(storage);
+		if (!workers || works < 1 || size < 1) return {
+			render: (workId) => render(journeyId, workId, signal, { retry: renderRetry(signal, Math.max(1, Math.min(16, works))) }),
+			close: async () => void 0
+		};
 		const pool = createRenderWorkers(workers, size);
-		const session = batchedRenderSession(store, journeyId);
+		const session = batchedRenderSession(storage, journeyId);
 		let plan;
-		const readPlan = () => plan ??= readJourneyPlan(store, journeyId).catch((error) => {
+		const readPlan = () => plan ??= readJourneyPlan(storage, journeyId).catch((error) => {
 			plan = void 0;
 			throw error;
 		});
 		return {
 			concurrency: size + 1,
-			render: (workId) => render(journeyId, workId, signal, {
-				write: pool.write,
-				session,
-				plan: readPlan,
-				writeBase: pool.writeBase,
-				retry
-			}),
+			render: (workId) => {
+				const retry = renderRetry(signal, Math.min(16, works, size + 1));
+				return render(journeyId, workId, signal, {
+					write: pool.write,
+					session: {
+						current: () => retry.run(() => session.current()),
+						commit: (change) => retry.run(() => session.commit(change))
+					},
+					plan: () => retry.run(readPlan),
+					writeBase: pool.writeBase,
+					retry
+				});
+			},
 			close: pool.close
 		};
 	}
@@ -4691,7 +4692,7 @@ async function resolveChunkSessions(storage, state, works, signal) {
 * read and applied by the store against the current state, so scan writes in between do not
 * refuse it (BL-216).
 */
-function createClassificationProposal(storage) {
+function createClassificationProposal(storage, accountAccess) {
 	return async (input, signal) => {
 		signal.throwIfAborted();
 		const state = await storage.current(input.journeyId);
@@ -4785,9 +4786,14 @@ function createClassificationProposal(storage) {
 		};
 		const { works } = classificationWorks(state, prepared);
 		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
+		const access = late ? await accountAccess?.({
+			...state,
+			works
+		}, signal) : void 0;
 		return storage.commitClassification({
 			...prepared,
-			chunkSessions
+			chunkSessions,
+			...access ? { accountAccess: Object.fromEntries(access) } : {}
 		});
 	};
 }
@@ -5133,11 +5139,11 @@ function createJourneyClassification(storage, _processing) {
 //#endregion
 //#region apps/cli/src/journey/works/index.ts
 /** The journey local port's project catalog and project-type suggestions. */
-function createJourneyWorks(storage, processing, stateDir) {
+function createJourneyWorks(storage, processing, stateDir, accountAccess) {
 	return {
 		classificationSessions: createClassificationSessions(storage, processing, stateDir),
 		classificationRead: createClassificationReader(storage, stateDir),
-		classificationSubmit: createClassificationProposal(storage),
+		classificationSubmit: createClassificationProposal(storage, accountAccess),
 		catalog: createJourneyCatalog(storage, processing, stateDir),
 		classify: createJourneyClassification(storage, processing)
 	};
@@ -5231,6 +5237,46 @@ function protectedSourceText(field, hidden) {
 }
 //#endregion
 //#region apps/cli/src/journey/send-package.ts
+/** Explicit admission refusals must never become automatic packaging retries. */
+const packagingRefusalCodes = [
+	"ARTIFACT_INVALID_APPROVAL",
+	"ARTIFACT_IDENTITY_MISMATCH",
+	"CONFIRMATION_REQUIRED",
+	"INCOMPLETE_REVIEW",
+	"PRIVACY_CHANGE_PENDING",
+	"PRIVACY_UNCERTAIN",
+	"REVISION_CONFLICT",
+	"SCOPE_NOT_READY",
+	"JOURNEY_OBSOLETE",
+	"UNKNOWN_ITEM",
+	"UNKNOWN_WORKSPACE",
+	"OPERATION_CANCELED"
+];
+/**
+* Deterministic failures a later attempt cannot clear: the refusals above, the source refusals
+* preparation isolates per root, size limits, a missing source and a full disk. Every other code,
+* including Windows sharing or antivirus locks, retries until the saved request expires.
+*/
+const finalPackagingCodes = [
+	...packagingRefusalCodes,
+	...rootScanRefusals,
+	"ARTIFACT_ARCHIVE_LIMIT",
+	"ARTIFACT_ENTRY_LIMIT",
+	"ARTIFACT_FILESYSTEM_LIMIT",
+	"ARTIFACT_INDEX_LIMIT",
+	"ARTIFACT_METADATA_LIMIT",
+	"ARTIFACT_PART_LIMIT",
+	"ARTIFACT_SOURCE_MISSING",
+	"ARTIFACT_DISK_FULL",
+	"ARTIFACT_INVALID_APPROVAL",
+	"ARTIFACT_INVALID_ARCHIVE",
+	"ARTIFACT_INVALID_MANIFEST",
+	"ARTIFACT_OUTPUT_UNSAFE",
+	"ARTIFACT_PROCESSING_MISMATCH",
+	"ARTIFACT_QUOTA_EXCEEDED",
+	"ARTIFACT_SOURCE_UNSAFE",
+	"ARTIFACT_UNSAFE_REMOTE"
+];
 const packaged = (work) => work.status === "ready" && work.artifact?.revision === work.revision;
 /** One host-lifetime packaging batch per advance; persisted artifacts are its progress. */
 function createSendPackager(ports) {
@@ -5249,13 +5295,16 @@ function createSendPackager(ports) {
 			if (!current) throw new ApplicationError("UNKNOWN_ITEM");
 		}
 		const ready = (works, id) => works.some((work) => work.id === id && packaged(work));
-		const batch = workIds.filter((id) => !ready(current.works, id)).slice(0, 16);
+		const batch = workIds.filter((id) => !ready(current.works, id));
 		if (!batch.length) return true;
 		signal.throwIfAborted();
 		const result = await ports.render({
 			journeyId,
 			workIds: batch
 		}, signal);
+		const failures = result.renders?.filter((item) => item.status === "failed") ?? [];
+		const failure = failures.find((item) => packagingRefusalCodes.includes(item.code)) ?? failures.find((item) => finalPackagingCodes.includes(item.code)) ?? failures[0];
+		if (failure) throw new ApplicationError(failure.code);
 		if (batch.some((id) => !ready(result.works, id))) throw new Error("PACKAGING_FAILED");
 		return false;
 	};
@@ -5628,6 +5677,19 @@ async function classifyExit(child, startup, exited, busy) {
 }
 //#endregion
 //#region apps/cli/src/send-host.ts
+/**
+* The detached focused host (ADR 0227) drives a Send only for the store's current journey, the
+* check its timer makes, and only while `liveHost` verifies its process identity and URL.
+* Anything the CLI cannot confirm returns false, so the CLI keeps stepping as before.
+*/
+async function focusedHostAlive(stateDir, journeyId, currentJourneyId) {
+	try {
+		if (await currentJourneyId() !== journeyId) return false;
+		return (await liveHost(join(stateDir, "serve"), journeyId)).status === "alive";
+	} catch {
+		return false;
+	}
+}
 const recordSchema = z.object({
 	hostId: z.uuid(),
 	pid: z.number().int().positive()
@@ -6091,49 +6153,72 @@ var SessionContentConflict = class extends ApplicationError {
 		this.contentConflict = contentConflict;
 	}
 };
-/** Check the entire pending Send before admitting any session mutation. */
+/** Collect safe conflicts across the entire pending Send before any session mutation. */
 async function sessionAccessBlocked(dependencies, journeyId, items, inventory, signal) {
 	const sessions = dependencies.artifacts.sessionFacts ?? dependencies.artifacts.sessions;
-	if (!sessions) return false;
+	if (!sessions) return [];
+	const conflicts = /* @__PURE__ */ new Map();
+	const accountAccesses = /* @__PURE__ */ new Map();
+	function observe(item, access) {
+		const values = accountAccesses.get(item.workId) ?? /* @__PURE__ */ new Set();
+		values.add(access);
+		accountAccesses.set(item.workId, values);
+	}
+	function record(item, sessionKey, rule, account) {
+		if (account) observe(item, account.access);
+		const conflict = {
+			workId: item.workId,
+			sessionKey,
+			requestedAccess: item.access,
+			accountWorkId: account?.logicalWorkId ?? null,
+			accountAccess: account?.access ?? null,
+			rule
+		};
+		conflicts.set(JSON.stringify(conflict), conflict);
+	}
 	const requestedAccess = /* @__PURE__ */ new Map();
 	const requestedDigests = /* @__PURE__ */ new Map();
 	const contentAccess = /* @__PURE__ */ new Map();
-	const claimContent = (key, sha256, access) => {
-		const identity = JSON.stringify([key, sha256]);
-		const previous = contentAccess.get(identity);
-		if (previous !== void 0 && previous !== access) return true;
-		contentAccess.set(identity, access);
-		return false;
-	};
+	function claim(claims, identity, key, item, rule) {
+		const previous = claims.get(identity) ?? [];
+		for (const other of previous) {
+			if (other.access === item.access) continue;
+			record(item, key, rule);
+			record(other, key, rule);
+		}
+		if (!previous.some((other) => other.workId === item.workId)) previous.push(item);
+		claims.set(identity, previous);
+	}
+	const claimContent = (key, sha256, item) => claim(contentAccess, JSON.stringify([key, sha256]), key, item, "content-access");
 	for (const item of items) {
 		if (item.status === "blocked" || item.sessionAssembly) continue;
 		const keys = item.sessionMembership?.keys ?? (item.sessionUpload ? [item.sessionUpload.key] : []);
 		if (!keys.length) continue;
 		const destination = inventory.works.find((work) => work.logicalWorkId === item.workId);
 		if (destination?.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		if (destination) observe(item, destination.access);
 		for (const key of keys) {
-			const access = requestedAccess.get(key);
-			if (access !== void 0 && access !== item.access) return true;
-			requestedAccess.set(key, item.access);
-			const source = inventory.works.find((work) => work.sessions.some((entry) => entry.key === key));
-			if (source && source.logicalWorkId !== item.workId && source.access !== item.access) return true;
-			const sha256 = item.sessionMembership ? source?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
-			if (sha256 && claimContent(key, sha256, item.access)) return true;
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && (item.sessionMembership || entry.sha256 === sha256))) return true;
+			claim(requestedAccess, key, key, item, "requested-access");
+			const sources = inventory.works.filter((work) => work.sessions.some((entry) => entry.key === key));
+			for (const source of sources) observe(item, source.access);
+			for (const source of sources) if (source.logicalWorkId !== item.workId && source.access !== item.access) record(item, key, "held-elsewhere", source);
+			const sha256 = item.sessionMembership ? sources[0]?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
+			if (sha256) claimContent(key, sha256, item);
+			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && (item.sessionMembership || entry.sha256 === sha256))) record(item, key, "destination-access", destination);
 		}
 	}
 	for (const item of items) {
 		if (item.sessionAssembly || item.sessionMembership || ["completed", "blocked"].includes(item.status)) continue;
 		const destination = inventory.works.find((work) => work.logicalWorkId === item.workId);
 		if (destination?.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		if (destination) observe(item, destination.access);
 		for await (const session of sessions(journeyId, item.artifact, signal)) {
 			const key = await sessionKeyFor(session);
 			const { workerIdentity: _, ...original } = session;
 			const legacyKey = session.workerIdentity ? await sessionKeyFor(original) : key;
-			if (claimContent(key, session.sha256, item.access) || legacyKey !== key && claimContent(legacyKey, session.sha256, item.access)) return true;
-			const otherAccess = requestedAccess.get(key);
-			if (otherAccess !== void 0 && otherAccess !== item.access) return true;
-			requestedAccess.set(key, item.access);
+			claimContent(key, session.sha256, item);
+			if (legacyKey !== key) claimContent(legacyKey, session.sha256, item);
+			claim(requestedAccess, key, key, item, "requested-access");
 			const otherDigest = requestedDigests.get(key);
 			if (otherDigest !== void 0 && otherDigest.sha256 !== session.sha256) throw new SessionContentConflict({
 				workIds: [.../* @__PURE__ */ new Set([...otherDigest.workIds, item.workId])],
@@ -6143,11 +6228,18 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 				sha256: session.sha256,
 				workIds: [.../* @__PURE__ */ new Set([...otherDigest?.workIds ?? [], item.workId])]
 			});
-			if (inventory.works.some((work) => work.logicalWorkId !== item.workId && work.access !== item.access && work.sessions.some((entry) => entry.key === key || entry.key === legacyKey && entry.sha256 === session.sha256))) return true;
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && entry.sha256 === session.sha256)) return true;
+			for (const work of inventory.works) for (const entry of work.sessions) {
+				if (entry.key !== key && !(entry.key === legacyKey && entry.sha256 === session.sha256)) continue;
+				observe(item, work.access);
+				if (work.logicalWorkId !== item.workId && work.access !== item.access) record(item, entry.key, "held-elsewhere", work);
+			}
+			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && entry.sha256 === session.sha256)) record(item, key, "destination-access", destination);
 		}
 	}
-	return false;
+	return [...conflicts.values()].map((conflict) => (accountAccesses.get(conflict.workId)?.size ?? 0) > 1 ? {
+		...conflict,
+		accountAccess: "mixed"
+	} : conflict);
 }
 /** Keep overlapping session ownership serial through membership, including retained members. */
 async function sessionIndependentItems(dependencies, journeyId, items, inventory, signal) {
@@ -6825,8 +6917,8 @@ async function put(context, item, receiptId, upload, connection, signal, guard)
 	await guard();
 	await context.upload(item.artifact, upload, signal);
 	const sent = withoutBusy(item);
-	await guard();
 	try {
+		await guard();
 		return observe(sent, await connection.complete(receiptId, signal), connection, signal, context.snapshot === true);
 	} catch (error) {
 		if (upload.headers !== void 0 && error instanceof JourneyRemoteError && error.code === "bundle_mismatch") return {
@@ -6956,13 +7048,14 @@ function isCode(error, code) {
 }
 /**
 * A step that ended without a definite answer and is safe to repeat: a request timeout or abort
-* that is not the Send's own cancellation, or a connection failure from `fetch`. The Work keeps
+* that is not the Send's own cancellation, or a connection failure from `fetch`: `fetch failed`
+* before the response, `terminated` when the socket resets while the body is read. The Work keeps
 * its state, so the next advance repeats the same idempotent step (ADR 0197).
 */
 function isInterrupted(error) {
 	if (!(error instanceof Error)) return false;
 	if (error.name === "TimeoutError" || error.name === "AbortError") return true;
-	return error instanceof TypeError && error.message === "fetch failed";
+	return error instanceof TypeError && (error.message === "fetch failed" || error.message === "terminated");
 }
 const sessionBackoffMs = (attempt) => 1e3 * 2 ** (attempt - 1);
 const zeroByteBackoffMs = (count) => [
@@ -7280,6 +7373,10 @@ function aggregate(send) {
 function awaitingPassport(send) {
 	return send.status === "completed" && send.items.some((item) => !["completed", "blocked"].includes(item.status));
 }
+/** The host continues confirmed uploads and unfinished Passport assessments without a panel. */
+function hostDrives(send) {
+	return awaitingPassport(send) || send.confirmedAt != null && ["sending", "waiting"].includes(send.status);
+}
 /** Explicit resume retries recoverable items and recaptures a pending sign-in or profile. */
 function resumeState(send) {
 	if (send.status !== "completed" && send.items.length && send.items.every((item) => item.status === "completed") && send.items.some((item) => !item.sessionAssembly)) return {
@@ -7304,18 +7401,23 @@ function resumeState(send) {
 		...send,
 		status: "sending",
 		error: null,
-		items: send.items.map((item) => item.status === "blocked" && [
-			"OPERATION_FAILED",
-			"UPLOAD_FAILED",
-			"SEND_REMOTE_REFUSED",
-			"SESSION_MOVE_ACCESS_REQUIRED",
-			"IDENTITY_UNAVAILABLE",
-			"ACCOUNT_SIGNED_OUT"
-		].includes(item.error ?? "") ? {
-			...item,
-			status: item.receipt ? item.receipt.state === "awaiting_upload" ? "uploading" : "assessing" : "ready",
-			error: null
-		} : item)
+		items: send.items.map((item) => {
+			const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
+			return item.status === "blocked" && [
+				"OPERATION_FAILED",
+				"COORDINATION_BUSY",
+				"UPLOAD_FAILED",
+				"SEND_REMOTE_REFUSED",
+				"SESSION_MOVE_ACCESS_REQUIRED",
+				"SESSION_MOVE_ACCESS_HELD",
+				"IDENTITY_UNAVAILABLE",
+				"ACCOUNT_SIGNED_OUT"
+			].includes(item.error ?? "") ? {
+				...current,
+				status: item.receipt ? item.receipt.state === "awaiting_upload" ? "uploading" : "assessing" : "ready",
+				error: null
+			} : item;
+		})
 	});
 	return profileRequired && !["blocked", "completed"].includes(next.status) ? {
 		...next,
@@ -7356,7 +7458,7 @@ async function writeProfile(connection, chosen, guard, signal, failure, captured
 		await guard();
 		return captured;
 	} catch (error) {
-		if (signal.aborted) throw error;
+		if (signal.aborted || safeCode(error) === "COORDINATION_BUSY") throw error;
 		if (error instanceof JourneyRemoteError && error.status === 409 && addressRefusals[error.code]) return {
 			status: "blocked",
 			error: addressRefusals[error.code] ?? null
@@ -7382,7 +7484,7 @@ async function captureProfile(connection, guard, signal, failure) {
 			parallelCompletes: parallelCompletes ? true : void 0
 		};
 	} catch (error) {
-		if (signal.aborted) throw error;
+		if (signal.aborted || safeCode(error) === "COORDINATION_BUSY") throw error;
 		if (error instanceof JourneyRemoteError && error.status === 401 || error instanceof ApplicationError && error.code === "ACCOUNT_SIGNED_OUT") return {
 			status: "sign-in",
 			error: null
@@ -7503,7 +7605,14 @@ async function advanceItems(host, signal) {
 				});
 				host.failure("SEND_SCOPE_BUSY", cause);
 				error = "SEND_SCOPE_BUSY";
-			} else if (isInterrupted(cause) || isTransientRefusal(cause)) {
+			} else if (isInterrupted(cause) || isTransientRefusal(cause) || safeCode(cause) === "COORDINATION_BUSY") {
+				if (safeCode(cause) === "COORDINATION_BUSY") {
+					const current = progressed ?? item;
+					next.set(item.workId, {
+						...current,
+						busyRefusals: (current.busyRefusals ?? 0) + 1
+					});
+				}
 				host.failure("SEND_INTERRUPTED", cause);
 				error = "SEND_INTERRUPTED";
 			} else {
@@ -7537,7 +7646,7 @@ async function advanceItems(host, signal) {
 			items
 		}));
 	} catch (error) {
-		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE"))) {
+		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE") || safeCode(error) === "COORDINATION_BUSY")) {
 			host.failure("SEND_INTERRUPTED", error);
 			return send.error === "SEND_INTERRUPTED" ? host.applied() : host.save({
 				...send,
@@ -7644,7 +7753,10 @@ async function advanceSend(dependencies, address, signal, chain) {
 			})
 		});
 		return blockSend({
-			send: snapshot.send,
+			send: safeCode(error) === "SEND_SCOPE_INVALIDATED" ? {
+				...snapshot.send,
+				items: snapshot.send.items.filter((item) => !["SESSION_MOVE_ACCESS_REQUIRED", "SESSION_MOVE_ACCESS_HELD"].includes(item.error ?? ""))
+			} : snapshot.send,
 			failure: dependencies.failure,
 			save
 		}, error, signal);
@@ -7670,18 +7782,41 @@ async function advanceSend(dependencies, address, signal, chain) {
 					if (!connection.sessions) throw new ApplicationError("INVALID_STATE");
 					if (!send.items.some((item) => item.status === "uploading" && !item.sessionAssembly && !item.receipt && !item.reservation)) return null;
 					const inventory = await connection.sessions.inventory(preflightSignal);
-					if (!await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal)) {
+					const conflicts = await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
+					if (conflicts.length === 0) {
 						independentItems = await sessionIndependentItems(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
 						return null;
 					}
 					await connection.assertCurrent(preflightSignal);
+					dependencies.failure("SESSION_MOVE_ACCESS_REQUIRED", {
+						code: "SESSION_MOVE_ACCESS_REQUIRED",
+						message: JSON.stringify({
+							conflicts: conflicts.length,
+							works: new Set(conflicts.map((conflict) => conflict.workId)).size,
+							rules: [...new Set(conflicts.map((conflict) => conflict.rule))].sort()
+						})
+					});
 					return save({
 						...send,
 						status: "blocked",
-						items: send.items.map((item) => item.sessionAssembly || item.status === "completed" ? item : {
-							...item,
-							status: "blocked",
-							error: "SESSION_MOVE_ACCESS_REQUIRED"
+						items: send.items.map((item) => {
+							if (item.sessionAssembly || item.status === "completed") return item;
+							const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
+							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
+							const conflict = itemConflicts[0];
+							if (!conflict) return {
+								...current,
+								status: "blocked",
+								error: "SESSION_MOVE_ACCESS_HELD"
+							};
+							const { workId: _, ...accessConflict } = conflict;
+							return {
+								...current,
+								status: "blocked",
+								error: "SESSION_MOVE_ACCESS_REQUIRED",
+								accessConflict,
+								accessConflictSessionCount: new Set(itemConflicts.map((entry) => entry.sessionKey)).size
+							};
 						})
 					});
 				},
@@ -7702,7 +7837,7 @@ async function advanceSend(dependencies, address, signal, chain) {
 					});
 					saving = pending.catch(() => void 0);
 					return pending;
-				}).then((result) => {
+				}).then(({ busyRefusals: _busy, ...result }) => {
 					fulfilled.add(item.workId);
 					return result;
 				})
@@ -8023,20 +8158,15 @@ function createManualUploader(dependencies) {
 			upload,
 			status: "applied"
 		};
-		const host = {
+		let bindings = [];
+		return advanceItems({
 			send: upload,
 			failure: dependencies.failure,
-			save: (next) => save(upload, next)
-		};
-		let bindings;
-		try {
-			bindings = await storage.bindings();
-		} catch (error) {
-			return blockSend(host, error, signal);
-		}
-		return advanceItems({
-			...host,
-			connect: dependencies.auth.connect,
+			save: (next) => save(upload, next),
+			connect: async (connectSignal) => {
+				bindings = await storage.bindings();
+				return dependencies.auth.connect(connectSignal);
+			},
 			profile: (connection, profileSignal) => captureProfile(connection, guard(upload), profileSignal, dependencies.failure),
 			context: (item) => ({
 				active: guard(upload, item),
@@ -9330,7 +9460,7 @@ async function requestSend(dependencies, raw, hostId, source) {
 			...current,
 			status: "stale"
 		};
-		assertJourneyPrivacyReady(current.journey);
+		assertJourneyPrivacyReady(current.journey, false, { publicChoices: true });
 		if (current.journey.pendingHideId || current.journey.phase === "paused") throw new ApplicationError("SCOPE_NOT_READY");
 		if (current.send && ([
 			"awaiting-packaging",
@@ -9452,6 +9582,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 	/** The serving host owns a pending request; another process leaves it unchanged. */
 	const pendingElsewhere = (send) => !host.serving && send?.request !== void 0 && !send.confirmedAt;
 	const progress = /* @__PURE__ */ new Map();
+	let packagingRetry;
 	const sessionFacts = createSessionFactsCache();
 	const running = /* @__PURE__ */ new Map();
 	const runKey = (address) => `${address.journeyId}:${address.sendId}`;
@@ -9551,27 +9682,49 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const pendingError = pending ? await requestError(dependencies, pending, hostId, signal) : null;
 			if (pending && (pendingError || !requestMatches(pending, snapshot.journey))) return block(snapshot, pending, pendingError ?? "REVISION_CONFLICT");
 			const draft = await draftSend(snapshot.journey, dependencies, signal);
+			let observed = false;
 			const recover = snapshot.send && [
 				"blocked",
 				"paused",
 				"completed"
 			].includes(snapshot.send.status) && snapshot.send.items.some((item) => sendRecoveryCodes.includes(item.error ?? ""));
-			if (recover && snapshot.send) {
+			if (recover || dependencies.artifacts.sessions) {
 				const connection = await dependencies.auth.connect(signal);
-				if (!connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
-				if (snapshot.send.subject !== null && snapshot.send.subject !== connection.subject) throw new ApplicationError("IDENTITY_REJECTED");
+				if (connection && draft.subject !== connection.subject) return {
+					...snapshot,
+					status: "stale"
+				};
+				if (recover && !connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
+				if (recover && snapshot.send?.subject && snapshot.send.subject !== connection?.subject) throw new ApplicationError("IDENTITY_REJECTED");
 				const sessions = dependencies.artifacts.sessions;
-				const remote = connection.sessions;
-				if (sessions && remote) {
-					const inventory = await remote.inventory(signal);
-					for (const item of draft.items) {
-						const current = inventory.works.find((work) => work.logicalWorkId === item.workId);
+				const remote = connection?.sessions;
+				if (sessions && remote && connection) {
+					const inventory = await remote.inventory(signal).catch((error) => {
+						if (signal.aborted || recover) throw error;
+						dependencies.failure("SEND_INTERRUPTED", error);
+						return null;
+					});
+					observed = inventory !== null;
+					try {
+						const conflicts = inventory ? await sessionAccessBlocked(dependencies, input.journeyId, draft.items, inventory, signal) : [];
+						for (const item of draft.items) {
+							const conflict = conflicts.find((entry) => entry.workId === item.workId && entry.accountAccess !== null) ?? conflicts.find((entry) => entry.workId === item.workId);
+							if (conflict) {
+								const { workId: _, ...accessConflict } = conflict;
+								item.accessConflict = accessConflict;
+							}
+						}
+					} catch (error) {
+						if (!(error instanceof SessionContentConflict) && !(error instanceof ApplicationError && error.code === "WORK_REMOVED")) throw error;
+					}
+					for (const item of inventory && recover && snapshot.send ? draft.items : []) {
+						const current = inventory?.works.find((work) => work.logicalWorkId === item.workId);
 						const assembly = await remote.assembly(item.workId, signal);
 						const selected = createSessionKeys();
 						for await (const session of sessions(input.journeyId, item.artifact, signal)) await selected.add(session);
 						const currentKeys = current?.sessions.map((session) => session.key) ?? [];
 						item.recoveryReview = {
-							previousSendId: snapshot.send.id,
+							previousSendId: snapshot.send?.id ?? draft.id,
 							revision: assembly?.revision ?? 0,
 							currentAccess: current?.access ?? null,
 							currentKeys,
@@ -9581,6 +9734,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 					await connection.assertCurrent(signal);
 				}
 			}
+			for (const item of observed ? [] : draft.items) {
+				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access)?.accessConflict;
+				if (previous && !item.accessConflict) item.accessConflict = previous;
+			}
 			const canReuseExistingSend = !(snapshot.send?.confirmedAt && ["blocked", "paused"].includes(snapshot.send.status)) && !recover && snapshot.send && scopeDigest(snapshot.journey) === snapshot.send.scopeDigest && snapshot.send.subject === draft.subject;
 			const next = pending ? {
 				...draft,
@@ -9589,6 +9746,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 				request: pending.request
 			} : canReuseExistingSend && snapshot.send ? {
 				...snapshot.send,
+				...snapshot.send.confirmedAt === null ? { items: draft.items } : {},
 				revision: snapshot.send.revision + 1
 			} : draft;
 			const result = await dependencies.storage.commitSend({
@@ -9619,7 +9777,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const authorizationError = await requestError(dependencies, snapshot.send, hostId, signal);
 			if (snapshot.send.request && !snapshot.send.confirmedAt && (authorizationError || !requestMatches(snapshot.send, snapshot.journey))) return block(snapshot, snapshot.send, authorizationError ?? "REVISION_CONFLICT");
 			assertScope(snapshot.journey, snapshot.send);
-			if (!sameIds$1(input.confirmedWorkIds, snapshot.send.items.map((item) => item.workId)) || !sameIds$1(input.confirmedOmittedWorkIds, snapshot.send.omitted.map((item) => item.workId)) || input.scopeDigest !== snapshot.send.scopeDigest || snapshot.send.items.length === 0) throw new ApplicationError("CONFIRMATION_REQUIRED");
+			if (!sameIds$1(input.confirmedWorkIds, snapshot.send.items.map((item) => item.workId)) || !sameIds$1(input.confirmedOmittedWorkIds, snapshot.send.omitted.map((item) => item.workId)) || input.scopeDigest !== snapshot.send.scopeDigest || snapshot.send.items.length === 0 || snapshot.send.items.some((item) => item.accessConflict !== void 0)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			if (snapshot.send.confirmedAt !== null) return saveStart(snapshot.send);
 			const connection = await dependencies.auth.connect(signal);
 			if (snapshot.send.request && (connection?.subject ?? null) !== snapshot.send.request.subject) return saveSend(dependencies, snapshot, {
@@ -9728,6 +9886,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 					...snapshot,
 					status: "applied"
 				};
+				if (!host.serving && hostDrives(snapshot.send) && await host.focused?.(address.journeyId)) return {
+					...snapshot,
+					status: "applied"
+				};
 				const authorizationError = await requestError(dependencies, snapshot.send, hostId, lifetime);
 				if (authorizationError) return block(snapshot, snapshot.send, authorizationError);
 				if (snapshot.send.request && !snapshot.send.confirmedAt && ["awaiting-packaging", "prepared"].includes(snapshot.send.status)) {
@@ -9742,10 +9904,52 @@ function createJourneySender(dependencies, phases = 3, host = {
 						error: "REVISION_CONFLICT"
 					});
 					if (snapshot.send.status === "awaiting-packaging") {
-						if (await dependencies.package?.(address.journeyId, snapshot.send.request.included.map((item) => item.workId), lifetime, snapshot.send.request.source) === false) return {
-							...await load(address),
+						if (packagingRetry?.key !== key) packagingRetry = void 0;
+						if (packagingRetry && Date.parse(dependencies.now()) < packagingRetry.after) return {
+							...snapshot,
 							status: "applied"
 						};
+						let packaged;
+						try {
+							packaged = await dependencies.package?.(address.journeyId, snapshot.send.request.included.map((item) => item.workId), lifetime, snapshot.send.request.source);
+						} catch (cause) {
+							lifetime.throwIfAborted();
+							const code = cause instanceof ApplicationError ? cause.code : safeCode(cause);
+							if (packagingRefusalCodes.includes(code)) throw cause;
+							dependencies.failure(code, cause);
+							snapshot = await load(address);
+							if (snapshot.send.status !== "awaiting-packaging") return {
+								...snapshot,
+								status: "stale"
+							};
+							const error = await requestError(dependencies, snapshot.send, hostId, lifetime);
+							if (error || !requestMatches(snapshot.send, snapshot.journey)) return block(snapshot, snapshot.send, error ?? "REVISION_CONFLICT");
+							if (finalPackagingCodes.includes(code)) {
+								packagingRetry = void 0;
+								return block(snapshot, snapshot.send, code);
+							}
+							const failures = Math.min((packagingRetry?.failures ?? 0) + 1, 5);
+							packagingRetry = {
+								key,
+								failures,
+								after: Date.parse(dependencies.now()) + Math.min(2e3 * 2 ** (failures - 1), 3e4)
+							};
+							return saveSend(dependencies, snapshot, {
+								...snapshot.send,
+								error: code
+							});
+						}
+						packagingRetry = void 0;
+						if (packaged === false) {
+							snapshot = await load(address);
+							return snapshot.send.error ? saveSend(dependencies, snapshot, {
+								...snapshot.send,
+								error: null
+							}) : {
+								...snapshot,
+								status: "applied"
+							};
+						}
 						snapshot = await load(address);
 						if (snapshot.send.status !== "awaiting-packaging") return {
 							...snapshot,
@@ -9759,6 +9963,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 						if (prepared.status === "stale" || prepared.send?.status !== "prepared") return prepared;
 						snapshot = requireSend(prepared);
 					}
+					if (snapshot.send.items.some((item) => item.accessConflict)) return saveSend(dependencies, snapshot, {
+						...snapshot.send,
+						request: void 0
+					});
 					if (!requestMatches(snapshot.send, snapshot.journey) || !requestedItemsMatch(snapshot.send, snapshot.journey)) return saveSend(dependencies, snapshot, {
 						...snapshot.send,
 						status: "blocked",
@@ -9796,10 +10004,6 @@ function createJourneySender(dependencies, phases = 3, host = {
 }
 //#endregion
 //#region apps/cli/src/account/journey/auth.ts
-/** An access token this close to expiry is renewed first, so a step never starts on it. */
-const renewBeforeMs = 12e4;
-const renewTimeoutMs = 3e4;
-const renewals = /* @__PURE__ */ new WeakMap();
 /** Reuses the existing device sign-in credential; a token is never returned to the panel or Agent. */
 function createJourneySendAuth(account, requestFetch) {
 	/**
@@ -9826,39 +10030,11 @@ function createJourneySendAuth(account, requestFetch) {
 			return value;
 		})).credential?.refreshToken) await expire(accessToken);
 	}
-	function renew(credential) {
-		const running = renewals.get(account);
-		if (running) return running;
-		const renewing = (async () => {
-			try {
-				const token = await account.identity.refresh(credential.refreshToken, AbortSignal.timeout(renewTimeoutMs));
-				if (!token) {
-					await expire(credential.accessToken);
-					return null;
-				}
-				return (await account.credentials.update((value) => {
-					if (value.credential?.refreshToken === credential.refreshToken) value.credential = {
-						...value.credential,
-						accessToken: token.accessToken,
-						refreshToken: token.refreshToken ?? credential.refreshToken,
-						scope: token.scope,
-						issuedAt: account.now(),
-						expiresAt: token.expiresAt
-					};
-					return value;
-				})).credential;
-			} finally {
-				renewals.delete(account);
-			}
-		})();
-		renewals.set(account, renewing);
-		return renewing;
-	}
 	async function current() {
 		const credential = (await account.credentials.update((value) => value)).credential;
 		if (!credential || credential.identityUrl !== account.configuration.identityUrl || credential.clientId !== account.configuration.clientId) return null;
 		const left = Date.parse(credential.expiresAt) - Date.parse(account.now());
-		if (Number.isFinite(left) && left > renewBeforeMs) return credential;
+		if (Number.isFinite(left) && left > 12e4) return credential;
 		const { refreshToken } = credential;
 		if (!refreshToken) {
 			if (Number.isFinite(left) && left > 0) return credential;
@@ -9866,7 +10042,7 @@ function createJourneySendAuth(account, requestFetch) {
 			return null;
 		}
 		try {
-			return await renew({
+			return await renew(account, {
 				...credential,
 				refreshToken
 			});
@@ -9916,6 +10092,100 @@ function createJourneySendAuth(account, requestFetch) {
 	};
 }
 //#endregion
+//#region apps/cli/src/account/journey/account-access.ts
+/** Current and legacy upload keys of every part of one local session. */
+async function keysOf(session) {
+	const keys = [];
+	for (const part of session.parts.length ? session.parts : [void 0]) {
+		const native = part?.nativeEvidence?.identity;
+		const identity = {
+			harness: session.harness,
+			nativeSessionId: native?.sessionId ?? session.sourceSessionId,
+			...part?.harnessRelativePath ? { relativePath: part.harnessRelativePath } : {},
+			...session.harness === "claude" && native?.role === "worker" ? { workerIdentity: { agentId: native.agentId } } : {}
+		};
+		const { workerIdentity: _, ...original } = identity;
+		keys.push([await sessionKeyFor(identity), await sessionKeyFor(original)]);
+	}
+	return keys;
+}
+/**
+* Compare frozen identities with the same hashed keys used by session uploads. A Work sends each
+* root's whole family (`members`, from `reviewFamilies`), so uniform Public is `public-all` only
+* when every part of every member is held; any key without history keeps it `public` (ADR 0275).
+*/
+async function accountAccessForRoots(state, roots, inventory, members) {
+	const sessions = new Map(roots.map((session) => [session.id, session]));
+	const held = /* @__PURE__ */ new Map();
+	for (const work of inventory.works) for (const session of work.sessions) {
+		const access = held.get(session.key) ?? /* @__PURE__ */ new Set();
+		access.add(work.access);
+		held.set(session.key, access);
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const work of state.works) {
+		const access = /* @__PURE__ */ new Set();
+		let known = 0;
+		let unknown = 0;
+		for (const id of work.rootSessionIds) {
+			const root = sessions.get(id);
+			if (!root) throw new ApplicationError("CORRUPTED_STATE");
+			for (const session of members.get(id) ?? [root]) for (const [key, legacyKey] of await keysOf(session)) {
+				const values = /* @__PURE__ */ new Set([...held.get(key) ?? [], ...held.get(legacyKey) ?? []]);
+				if (!values.size) {
+					unknown++;
+					continue;
+				}
+				known++;
+				for (const value of values) access.add(value);
+			}
+		}
+		if (!known) continue;
+		const uniform = access.size === 1;
+		result.set(work.id, uniform && access.has("private") ? "private" : uniform && access.has("public") ? unknown === 0 ? "public-all" : "public" : "mixed");
+	}
+	return result;
+}
+/** Existing authenticated owner ports supply inventory; signed-out scope confirmation stays local. */
+function createAccountAccess(storage, auth) {
+	return async (state, signal) => {
+		const controller = new AbortController();
+		const boundedSignal = AbortSignal.any([signal, controller.signal]);
+		let timer;
+		let onAbort = () => {};
+		const stopped = new Promise((_resolve, reject) => {
+			onAbort = () => reject(/* @__PURE__ */ new Error("ACCOUNT_ACCESS_CANCELLED"));
+			boundedSignal.addEventListener("abort", onAbort, { once: true });
+			if (boundedSignal.aborted) onAbort();
+			timer = setTimeout(() => controller.abort(), 5e3);
+		});
+		const read = async () => {
+			boundedSignal.throwIfAborted();
+			const connection = await auth.connect(boundedSignal);
+			if (!connection?.sessions) return /* @__PURE__ */ new Map();
+			const plan = (await storage.resources({
+				journeyId: state.journeyId,
+				kind: "plan"
+			}))[0];
+			if (plan?.kind !== "plan") throw new ApplicationError("SCOPE_NOT_READY");
+			const inventory = await connection.sessions.inventory(boundedSignal);
+			const access = await accountAccessForRoots(state, plan.approval.inventory.sessions, inventory, reviewFamilies(plan.approval.inventory).members);
+			await connection.assertCurrent(boundedSignal);
+			return access;
+		};
+		try {
+			return await Promise.race([read(), stopped]);
+		} catch {
+			console.error("ACCOUNT_ACCESS_UNAVAILABLE: using model access");
+			return /* @__PURE__ */ new Map();
+		} finally {
+			clearTimeout(timer);
+			boundedSignal.removeEventListener("abort", onAbort);
+			controller.abort();
+		}
+	};
+}
+//#endregion
 //#region apps/cli/src/operation/protocol.ts
 const sourceExclusionReasonSchema = z.enum([
 	"guardian-excluded",
@@ -10511,6 +10781,9 @@ async function readJson(response, where) {
 			}
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		if (error instanceof ApplicationError) throw error;
+		throw unavailable(`${where} body read failed`, error);
 	} finally {
 		reader.releaseLock();
 	}
@@ -11545,6 +11818,8 @@ async function compose(options, callbacks, bundles) {
 			onFatal: fatalStore.fail
 		});
 		const account = createAccount(accountPorts);
+		const sendAuth = createJourneySendAuth(accountPorts);
+		const accountAccess = createAccountAccess(journeyStorage, sendAuth);
 		const application = createApplication({
 			sessionPeriod: options.sessionPeriod,
 			journeySender: createJourneySender({
@@ -11561,7 +11836,7 @@ async function compose(options, callbacks, bundles) {
 					}
 				}),
 				artifacts: createJourneySendArtifacts(journeyStorage),
-				auth: createJourneySendAuth(accountPorts),
+				auth: sendAuth,
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
 				failure: (code, cause) => diagnostics.onFailure(code, cause),
 				sessionTransfer: (workId, transfer) => diagnostics.onActivity({
@@ -11584,18 +11859,22 @@ async function compose(options, callbacks, bundles) {
 					phases: { upload: elapsedMs },
 					volumes: { bytes }
 				})
-			}, void 0, sendHost),
+			}, void 0, sendHost.serving ? sendHost : {
+				...sendHost,
+				focused: (journeyId) => focusedHostAlive(stateDir, journeyId, async () => (await journeyStorage.current())?.journeyId)
+			}),
 			manualUploader: createManualUploader({
 				storage: store.manualUpload,
 				artifacts: createManualUploadArtifacts({ getDeliverySources: () => application.getDeliverySources() }),
-				auth: createJourneySendAuth(accountPorts),
+				auth: sendAuth,
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
 				failure: (code, cause) => diagnostics.onFailure(code, cause)
 			}),
 			journeyLocal: {
+				accountAccess,
 				titles: createJourneyTitles(journeyStorage, processing),
 				describe: createJourneyDescription(journeyStorage, processing),
-				works: createJourneyWorks(journeyStorage, processing, stateDir),
+				works: createJourneyWorks(journeyStorage, processing, stateDir, accountAccess),
 				hide: createJourneyHide({
 					storage: journeyStorage,
 					execution,
@@ -12064,4 +12343,4 @@ async function cancelOperation(runtime, id) {
 	return readOperation(runtime, id);
 }
 //#endregion
-export { permissionDiagnostic as _, readAgentPresence as a, executorRequestSchema as c, guardDetachedStartup as d, createRenderActivity as f, longCommands as g, businessCommands as h, invoke as i, awaitingPassport as l, parseOptions as m, readOperation as n, createRuntime as o, helpText as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, serveDetached as u, startupFailure as v, traceStartup as y };
+export { longCommands as _, readAgentPresence as a, traceStartup as b, executorRequestSchema as c, serveDetached as d, guardDetachedStartup as f, businessCommands as g, parseOptions as h, invoke as i, awaitingPassport as l, helpText as m, readOperation as n, createRuntime as o, createRenderActivity as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, hostDrives as u, permissionDiagnostic as v, startupFailure as y };