@gitroll/tacitt-cli 0.6.9 → 0.6.11

package/dist/{query-CfhcS4gd.mjs → query-AMZerUh8.mjs}

@@ -1,10 +1,11 @@
-import { $ as createCleanup, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as removeNamedTemporarySpools, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as createTemporary, _ as processJourneyMetadata, a as scanReviewFields, at as windowsOwnerOnly, c as readSessionScanRecords, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as restrictToOwner, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, nt as makePrivateDirectory, o as createWorkPieces, ot as isWindowsAclFailure, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as openPrivateFile, s as readSessionScanFields, st as windowsAclCodes, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-V9GHLZQs.mjs";
-import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BQXssW46.mjs";
-import { $t as safeField, Bt as sessionPeriodSchema, Dn as createStaticProcessor, Fn as entityDictionaryVersion, Ft as termTypeInfo, Gt as ownerProfileSchema, Kt as passportAddressSchema, Ot as privacyTermKey, Qt as safeCode, Sn as currentDetectorVersion, T as bLiteralTerms, Un as frameRecords, Wt as mergeOwnerProfile, Xt as ApplicationError, Zt as UnfinishedJourneyError, an as observeSource, ar as admitCustomTerm, c as textDigest, ir as createEntityMatcher, nn as reviewFamilies, or as admitGitName, qt as profileHasChoices, tn as familySelected, ur as ProcessingError, zt as filterInventoryByPeriod } from "./locate-BWkblijS.mjs";
-import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-BgsEnMsy.mjs";
-import { $ as settingsBatchSchema, $r as isReadingComplete, A as deviceAuthorizationSchema, B as inspectionStartSchema, Bt as classificationWorks, Ct as sendPrepareSchema, Dt as currentJourneyAdapters, Fn as bTermMatcher, Gn as retireWorkDescription, Gr as sendArtifactSchema, Hn as journeyConfirmedHides, Hr as agentSourceSchema, Ht as newJourneyWork, Jn as workCorrectionBinding, Jr as sendResolutionSchema, Kn as workDecisionDigest, Kr as sendReceiptSchema, Lr as hasCurrentStaticReview, M as profileUrlMatchesIdentity, Mr as privacyDecisionDigest, N as readAccountAvatarUrl, O as createAccount, Or as displayedScopeDigest, Ot as obsoleteJourney, P as storedCredentialSchema, Pt as applyClassification, Qr as isIncludedWork, R as createApplication, Rr as staticReviewDigest, St as sendChoiceSchema, Tt as sendStartSchema, Ur as agentSourcesSchema, V as validateInspectionBatch, Vt as retireScanGeneration, W as inspectionQuerySchema, Wr as journeySendSchema, Xr as hasCompleteWorkDescription, Yr as sendSettingsSchema, Yt as journeySearchResultSchema, Zr as isClassifying, Zt as searchScopeDigest, _ as changeJourney, _r as emptyPreparationFacts, _t as emptyTermsRevision, ai as packageCommandSchema, ar as scanPreparationDigest, bt as replaceSensitiveTermsSchema, cr as scanGitSeedsResource, ei as isSelectedWork, et as settingsQuerySchema, fi as recommendParallelism, ft as manualUploadChoiceSchema, h as hideScopeDigest, ht as manualUploadStartSchema, ii as commandSchema, j as deviceProfileScopeSchema, jr as assertJourneyPrivacyReady, k as accountProfileSchema, kr as requestedScope, li as producerVersion, lr as verifiedScanGitSeeds, lt as validateFailureLocation, m as activeJourneyTerms, mt as manualUploadSchema, oi as selectionBatchSchema, or as scanSessionResourceSchema, pt as manualUploadPrepareSchema, qr as sendReplaceResultSchema, ri as withReadingProgress, rt as appendSensitiveTerms, si as selectionSchema, sr as scanGitSeedsId, st as artifactFailureDetailSchema, ur as scanExclusionResourceSchema, ut as manualUploadActionSchema, wt as sendRequestSchema, xt as sendActionSchema, yt as normalizeSensitiveTerms, z as inspectionCancelSchema, zn as confirmedHideKinds, zt as classificationPartition } from "./src-DzKuzGVH.mjs";
-import { _t as isCoordinationBusy } from "./heap-Dt3-d27v.mjs";
-import { t as createAgentSetupPort } from "./agent-setup-CODlN6zl.mjs";
+import { $ as removeNamedTemporarySpools, B as parallelismLimits, C as readOriginalSearchFields, F as SessionWorkerError, G as processJourneyMetadataFields, H as privateJourneyDirectory, I as sessionWorkerFailure, K as staticMaskCategory, O as captureLogicalJourneySources, P as createSharedSessionPool, Q as createTemporary, R as defaultParallelism, T as createCollectionArtifacts, U as readLogicalJourneyFinalMasks, W as readConfiguredOutputInfo, Z as decodeZstd, _ as processJourneyMetadata, a as scanReviewFields, at as restrictToOwner, c as readSessionScanRecords, ct as windowsAclCodes, et as createCleanup, g as readCapturedOriginalRows, i as buildWorkScanBatches, it as openPrivateFile, j as runConfiguredSessionJob, k as capturedJourneyScope, l as scanPreparedSession, m as openConfiguredUpload, n as verifyPreparedSessionSources, o as createWorkPieces, ot as windowsOwnerOnly, p as configuredSessionUploads, q as readWorkspacePair, r as prepareSessionScans, rt as makePrivateDirectory, s as readSessionScanFields, st as isWindowsAclFailure, t as preparedScanConfiguration, v as readStaticSessionMasks, w as readConfiguredSearchFields, y as staticSessionJobs, z as gitSeedsProvider } from "./src-DlVbGB32.mjs";
+import { A as createExecutionPort, C as saveRemoteState, D as createPackagingProgressPort, E as exportDelivery, F as loadDeliveryResults, L as inBackgroundStoreLane, M as withStateMutex, N as createDeliveryService, O as createStore, P as preflight, R as isBackgroundStatusPoll, S as readRemoteState, T as collectRemoteWorkers, _ as staticBaseProduction, a as writeJourneyOutput, b as workApproval, c as mergeHideIndexTokens, f as writeJourneyBase, g as staticBaseInputs, h as staticSessions, l as packRenderHideIndex, m as saveStaticSession, o as createHideIndexTokens, p as readStaticResult, s as hideIndexTexts, t as journeyOutputJob, u as journeyBaseJob, v as readSelectedCaptures, w as journeyDirectory, x as isRemoteImport, y as prepareSourcePlan, z as retrySharingViolation } from "./job-BKsifhyv.mjs";
+import { $t as profileHasChoices, D as bLiteralTerms, Gt as filterInventoryByPeriod, Kt as sessionPeriodSchema, Mt as privacyTermKey, Nn as createStaticProcessor, On as currentDetectorVersion, Qt as passportAddressSchema, Vn as entityDictionaryVersion, Vt as termTypeInfo, Xt as mergeOwnerProfile, Yn as frameRecords, Zt as ownerProfileSchema, an as safeField, br as processingSite, cn as reviewFamilies, dn as observeSource, dr as admitCustomTerm, fr as admitGitName, gr as ProcessingError, in as safeCode, nn as ApplicationError, rn as UnfinishedJourneyError, sn as familySelected, u as textDigest, ur as createEntityMatcher, xr as siteFields } from "./locate-Cx52Zqxv.mjs";
+import { a as mainTextChunks, c as previewInWorker, i as nearestSortingRepository, l as createNativeAdapters, n as createProjectEvidenceCollector, o as mainTextFields, r as sortingRepositoryId, s as textChunks, t as createHarnesses, u as createGitNameSeedProvider } from "./src-wZx_v0Ih.mjs";
+import { $r as sendReplaceResultSchema, An as scanGitSeedsResource, At as obsoleteJourney, B as createApplication, Bn as journeySearchResultSchema, Bt as classificationPartition, Ct as sendActionSchema, Dn as scanPreparationDigest, Dt as sendStartSchema, Et as sendRequestSchema, F as readAccountAvatarUrl, H as inspectionStartSchema, Hn as searchScopeDigest, Ht as retireScanGeneration, I as storedCredentialSchema, Ir as assertJourneyPrivacyReady, Jr as agentSourceSchema, K as inspectionQuerySchema, Lr as privacyDecisionDigest, M as deviceAuthorizationSchema, Mn as scanExclusionResourceSchema, N as deviceProfileScopeSchema, Nr as displayedScopeDigest, O as createAccount, On as scanSessionResourceSchema, P as profileUrlMatchesIdentity, Pr as requestedScope, Qr as sendReceiptSchema, St as replaceSensitiveTermsSchema, Tt as sendPrepareSchema, U as validateInspectionBatch, Ur as hasCurrentStaticReview, Ut as newJourneyWork, V as inspectionCancelSchema, Vt as classificationWorks, Wr as staticReviewDigest, Xr as journeySendSchema, Yr as agentSourcesSchema, Zr as sendArtifactSchema, _ as changeJourney, _t as manualUploadStartSchema, ai as isReadingComplete, ar as bTermMatcher, at as appendSensitiveTerms, di as packageCommandSchema, dt as validateFailureLocation, ei as sendResolutionSchema, fi as selectionBatchSchema, fr as journeyConfirmedHides, ft as manualUploadActionSchema, gr as workDecisionDigest, gt as manualUploadSchema, h as hideScopeDigest, hi as producerVersion, hr as retireWorkDescription, ht as manualUploadPrepareSchema, ii as isIncludedWork, j as accountProfileSchema, jn as verifiedScanGitSeeds, k as renew, kn as scanGitSeedsId, kt as currentJourneyAdapters, li as withReadingProgress, lr as confirmedHideKinds, lt as artifactFailureDetailSchema, m as activeJourneyTerms, mt as manualUploadChoiceSchema, ni as hasCompleteWorkDescription, nt as settingsQuerySchema, oi as isSelectedWork, pi as selectionSchema, ri as isClassifying, ti as sendSettingsSchema, tt as settingsBatchSchema, ui as commandSchema, vi as recommendParallelism, vr as workCorrectionBinding, wt as sendChoiceSchema, xt as normalizeSensitiveTerms, yr as emptyPreparationFacts, yt as emptyTermsRevision, zn as applyClassification } from "./src-D1iONla3.mjs";
+import { vt as isCoordinationBusy } from "./heap-CV8Eca8V.mjs";
+import { d as checkOpenSource, h as openSource } from "./run-CaPktPhH.mjs";
+import { t as createAgentSetupPort } from "./agent-setup-DdfF3zch.mjs";
 import { t as workerMessageSchema } from "./messages-D3m3bhva.mjs";
 import { constants, write } from "node:fs";
 import { z } from "zod";
@@ -92,7 +93,7 @@ function permissionDiagnostic(error) {
 function startupFailure(error, platform = process.platform) {
 	const code = safeCode(error);
 	const permission = permissionDiagnostic(error);
-	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run `npx --yes @gitroll/tacitt-cli@latest` with your original options to start the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
+	const advice = code === "STATE_CLOSE_FAILED" ? " Keep the state directory intact and stop this CLI before retrying. Closing the state database could not be confirmed; state was not reset." : permission ? " Windows permissions could not be verified. Check that system Windows PowerShell can run and access the entry; retry after resolving the reported helper failure. Permissions were not established as unsafe." : code === "OBSOLETE_SCHEMA" ? " This control-plane database uses an older format. --overwrite-corrupted explicitly resets workflow progress, approvals and scan counts; source logs, completed ZIP files and private sensitive terms are retained." : code === "UNSAFE_STATE_PATH" ? platform === "win32" ? " State requires current-user ownership and a private Windows access control list. Repair permissions explicitly or use a private --state-dir." : " State requires current-user ownership, directory mode 0700 and file mode 0600. Repair permissions explicitly or use a private --state-dir." : ["CORRUPTED_STATE", "RESET_INCOMPLETE"].includes(code) ? " Inspect state first; --overwrite-corrupted explicitly resets only control-plane state." : code === "UNSUPPORTED_SCHEMA" ? " Stop this CLI, then run the same command through `npx --yes @gitroll/tacitt-cli@latest` to use the latest release. If you use the Skill, run `npx --yes @gitroll/tacitt-cli@latest skill.install`, then start a fresh conversation and invoke $tacitt in Codex or /tacitt in Claude Code. State was not reset." : code === "STATE_LAYOUT_INVALID" ? " Keep the state directory intact for inspection. Its storage layout cannot be recovered automatically; --overwrite-corrupted does not bypass this check." : code === "DEV_REQUIRES_SOURCE_CHECKOUT" ? " --dev serves the repository UI through Vite and only works from a source checkout; run without --dev." : code === "ARTIFACT_OUTPUT_UNSAFE" ? " Use a writable private --bundle-dir or repair the configured bundle library. The saved directory was not changed." : code === "STATE_IN_USE" ? " Another tacitt process still has this state open. Stop the other tacitt process and retry; state was not reset." : error instanceof UnfinishedJourneyError ? unfinishedJourneyAdvice(error) : " Run --help for usage.";
 	return `${code}.${code === "OPERATION_FAILED" ? failureCause(error) : ""}${permission}${advice}\n`;
 }
 const safeJourneyId = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
@@ -141,6 +142,7 @@ const businessCommands = [
 	"journey.findingImpact",
 	"journey.files",
 	"journey.prepare",
+	"review.reopenEmpty",
 	"review.terms",
 	"review.status",
 	"review.guidance",
@@ -342,13 +344,14 @@ function parseOptions(args, source = sourceCheckout) {
 }
 const fullHelp = `tacitt — review and package local session logs
 
-Usage: tacitt [--no-open] [--state-dir PATH] [--bundle-dir PATH] [--parallelism N]
-              [--since DATE] [--until DATE]
-       tacitt state dump [--state-dir PATH] [--output PATH]
-       tacitt status [--state-dir PATH]
+Usage: tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
        tacitt PROCEDURE [--input FILE|-] [--async] [--timeout-ms N]
        tacitt operation.get|operation.wait|operation.cancel ID [--timeout-ms N]
-       tacitt skill.install [--agent codex|claude|all] [--scope user|project] [--cli-path PATH]
+       tacitt state dump [--state-dir PATH] [--output PATH]
+       tacitt status [--state-dir PATH]
+
+Tacitt has three surfaces: the Skill (/tacitt in Claude Code, $tacitt in Codex), the Skill
+panel that the Skill opens, and the CLI commands below. Bare tacitt prints how to start the Skill.
 
 Business procedures (JSON output):
 ${Array.from(businessCommands).join("\n")}
@@ -372,12 +375,11 @@ Workspace ZIPs and collection indexes use the saved bundle library directory.
 Native Skill Send uploads only the confirmed primary artifacts to the configured Tacitt profile API.
 status prints safe workspace outcomes from the latest saved packaging operation.
 Private packaging error details stay in <state-dir>/diagnostics/ (up to 4 MiB).
-Sign in from the Web UI to link this tool to your GitRoll Identity account; the CLI contacts
+Sign in from the Skill panel to link this tool to your GitRoll Identity account; the CLI contacts
 only the Identity and profile API origins below, only when you ask, and keeps the issued
 token in <state-dir>/account/ (owner-only).
 
 Options:
-  --no-open                 Print the URL without opening a browser
   --agent CLIENT            skill.install only: codex, claude or all (default: all)
   --scope SCOPE             skill.install only: user or project (default: user)
   --cli-path PATH           skill.install only: bind an absolute installed package executable
@@ -388,10 +390,7 @@ Options:
   --claude-home PATH        Override the Claude configuration root
   --codex-home PATH         Override the Codex configuration root
   --overwrite-corrupted    Explicitly reset unusable control-plane state
-  --parallelism N          Configured packaging worker count (default: the Package dialog recommendation)
-  --since DATE              Manual: preselect only sessions last active on or after DATE
-  --until DATE              Manual: preselect only sessions last active on or before DATE
-                            (DATE: YYYY-MM-DD local day, inclusive, or an ISO timestamp)
+  --parallelism N          Preparation and packaging worker count (default: recommended for this computer)
   --identity-url URL        Identity origin for sign-in (default: ${accountDefaults.identityUrl})
   --identity-client-id ID   Public device client ID registered for this tool
   --profile-api-url URL     Profile API origin the token is checked against
@@ -617,12 +616,13 @@ async function scanRemoteDispatches(sessions, signal) {
 		const pending = /* @__PURE__ */ new Map();
 		for (const part of session.parts) {
 			signal.throwIfAborted();
-			if (part.representation !== "jsonl") throw new Error("REMOTE_SOURCE_FORMAT_UNSUPPORTED");
-			const file = await open(part.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+			const file = await openSource(part);
 			try {
-				const before = await file.stat({ bigint: true });
-				if (String(before.dev) !== part.snapshot.dev || String(before.ino) !== part.snapshot.ino || before.size !== BigInt(part.snapshot.size) || String(before.mtimeNs) !== part.snapshot.mtimeNs || String(before.ctimeNs) !== part.snapshot.ctimeNs) throw new Error("REMOTE_SOURCE_CHANGED");
-				if (!part.snapshot.size) continue;
+				if (!part.snapshot.size) {
+					if (part.representation === "jsonl.zst") throw new Error("ARTIFACT_PROCESSING_DECODE_FAILED");
+					await checkOpenSource(part, file);
+					continue;
+				}
 				const stream = file.createReadStream({
 					autoClose: false,
 					start: 0,
@@ -637,7 +637,7 @@ async function scanRemoteDispatches(sessions, signal) {
 					unreadableLines++;
 					cause ??= /* @__PURE__ */ new Error(`line ${location.line}, invalid UTF-8`);
 				};
-				const lines = frameRecords(numberedChunks(stream, location), "jsonl", 16777216, signal);
+				const lines = frameRecords(numberedChunks(part.representation === "jsonl.zst" ? decodeZstd(stream, signal) : stream, location), "jsonl", 16777216, signal);
 				try {
 					for await (const framed of skipLiveTail(lines, location, skipped)) {
 						signal.throwIfAborted();
@@ -671,11 +671,10 @@ async function scanRemoteDispatches(sessions, signal) {
 								end: end && end >= at ? end : at
 							}));
 							windows.push(...found);
-							pending.set(command.id, found);
+							if (found.length) pending.set(command.id, found);
 						}
 					}
-					const after = await file.stat({ bigint: true });
-					if (after.mtimeNs !== before.mtimeNs || after.size !== before.size) throw new Error("REMOTE_SOURCE_CHANGED");
+					await checkOpenSource(part, file);
 				} finally {
 					stream.destroy();
 				}
@@ -743,7 +742,10 @@ function createRemotePreflight(options) {
 				} catch (error) {
 					signal.throwIfAborted();
 					options.reportFailure(error);
-					state.failures.push("source-scan");
+					if (!state.failures.includes("source-scan")) state.failures.push("source-scan");
+					const reason = sourceFailureReason(error);
+					const counts = state.sourceFailureCounts ??= {};
+					counts[reason] = (counts[reason] ?? 0) + 1;
 				}
 				await saveRemoteState(options.stateDir, input.journeyId, state);
 			}
@@ -780,9 +782,23 @@ function result(state) {
 		})),
 		copied: state.copied.length,
 		failures: state.failures,
+		...state.sourceFailureCounts ? { sourceFailureCounts: state.sourceFailureCounts } : {},
 		...state.failures.some((failure) => ["source-lines-unreadable", "source-scan"].includes(failure)) ? { warning: state.failures.includes("source-scan") ? "Some remote sources could not be scanned; remote worker discovery may be incomplete." : "Some remote dispatch lines were unreadable; remote worker discovery may be incomplete." } : {}
 	};
 }
+function sourceFailureReason(error) {
+	if (!(error instanceof Error)) return "other";
+	if (error instanceof SyntaxError) return "invalid-json";
+	if (error.message === "SOURCE_CHANGED") return "source-changed";
+	if (error.message === "UNSAFE_SOURCE_PATH") return "source-inaccessible";
+	if (error.message === "ARTIFACT_PROCESSING_DECODE_FAILED") return "compressed-decode";
+	const code = "code" in error ? error.code : null;
+	if (code === "PROCESSING_LIMIT") return "record-limit";
+	if (code === "PROCESSING_INVALID_RECORD") return "invalid-utf8";
+	if (code === "ENOENT" || code === "ENOTDIR") return "source-missing";
+	if (code === "EACCES" || code === "EPERM" || code === "ELOOP") return "source-inaccessible";
+	return "other";
+}
 //#endregion
 //#region apps/cli/src/journey/confirmed-hides.ts
 /** The Work's explicit exception values; an occurrence inside one stays visible (ADR 0069). */
@@ -1144,7 +1160,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 		return state;
 	};
 	const guard = async (id) => {
-		if (!verified.has(id)) await current(id);
+		if (verified.has(id)) return;
+		const permission = await storage.preparationPermission(id);
+		if (permission && permission.destination !== destination) throw new ApplicationError("JOURNEY_DESTINATION_CHANGED");
+		if (permission) verified.add(id);
 	};
 	const readStatus = async (input) => {
 		await guard(input.journeyId);
@@ -1152,6 +1171,18 @@ function bindJourneyDestination(storage, destination, options = {}) {
 	};
 	return {
 		current,
+		async preparationState(id) {
+			await guard(id);
+			return storage.preparationState(id);
+		},
+		async preparationPermission(id) {
+			await guard(id);
+			return storage.preparationPermission(id);
+		},
+		async updatePreparation(input) {
+			await guard(input.journeyId);
+			return storage.updatePreparation(input);
+		},
 		readInventory: (input) => storage.readInventory({
 			...input,
 			expectedDestination: destination
@@ -1270,6 +1301,10 @@ function bindJourneyDestination(storage, destination, options = {}) {
 			await guard(input.journeyId);
 			return storage.submitReview(input);
 		},
+		async reopenEmpty(input) {
+			await guard(input.journeyId);
+			return storage.reopenEmpty(input);
+		},
 		async recordTerms(input) {
 			await guard(input.journeyId);
 			return storage.recordTerms(input);
@@ -1321,6 +1356,31 @@ function bindSendDestination(storage, destination) {
 	};
 }
 //#endregion
+//#region apps/cli/src/journey/prepare/update.ts
+/** Preparation owns only the changed Work rows, progress and package invalidation. */
+async function changePreparation(storage, journeyId, kind, change, attempts = Number.POSITIVE_INFINITY, clearPackageApproval = false) {
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		const before = await storage.preparationState(journeyId);
+		if (!before?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
+		const after = change(before);
+		const previous = new Map(before.works.map((work) => [work.id, work]));
+		const result = await storage.updatePreparation({
+			journeyId,
+			expectedRevision: before.revision,
+			requestKey: randomUUID(),
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			kind,
+			works: after.works.filter((work) => work !== previous.get(work.id)),
+			phase: after.phase,
+			readingComplete: after.readingComplete,
+			readingStartedAt: after.readingStartedAt,
+			clearPackageApproval: clearPackageApproval && before !== after
+		});
+		if (result.status !== "stale") return result.state;
+	}
+	throw new ApplicationError("REVISION_CONFLICT");
+}
+//#endregion
 //#region apps/cli/src/journey/works/metadata.ts
 /** Original classification fields remain durable; only the derived display cache is replaced. */
 const classificationMetadataInput = (work) => ({
@@ -1368,7 +1428,7 @@ async function prepareClassificationMetadata(storage, state, work, processing, s
 		fields: Object.values(raw).map((text) => ({ text }))
 	}, signal);
 	if (title === void 0 || projectName === void 0 || description === void 0 || reason === void 0) throw new ApplicationError("CORRUPTED_STATE");
-	await changeJourney(storage, state.journeyId, "snapshot", (before) => {
+	await changePreparation(storage, state.journeyId, "snapshot", (before) => {
 		const active = before.works.find((item) => item.id === work.id);
 		if (before.scope.status !== "confirmed" || !active || textDigest(JSON.stringify([
 			active.inputRevision,
@@ -1699,7 +1759,7 @@ async function isolateFailingRoots(storage, journeyId, work, error) {
 	});
 	if (roots.length === 0 || roots.length === work.rootSessionIds.length) return false;
 	for (;;) {
-		const state = await storage.current(journeyId);
+		const state = await storage.preparationState(journeyId);
 		const current = state?.works.find((item) => item.id === work.id);
 		if (!state || state.phase === "paused" || state.pendingHideId || current?.inputRevision !== work.inputRevision || current.status !== "pending") return false;
 		if ((await storage.isolateRoots({
@@ -1801,7 +1861,7 @@ function scanFailureCode(reason) {
 }
 /** Resolve only the frozen inspection settings and captures; classification stays unchanged. */
 async function prepareScanContext(storage, journeyId, work, selected, processing, signal, workers) {
-	const current = await storage.current(journeyId);
+	const current = await storage.preparationState(journeyId);
 	if (!current?.consent || !current.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const active = current.works.find((item) => item.id === work.id);
 	if (current.scope.status !== "confirmed" || current.phase === "paused" || active?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
@@ -2127,7 +2187,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 				workspaceId: session.workspaceId,
 				sessionId: session.id,
 				...failure.sourcePartId ? { sourcePartId: failure.sourcePartId } : {}
-			});
+			}, void 0, failure.cause ?? new ApplicationError(scanFailureCode(failure.reason)));
 			const root = families.owners.get(failure.sessionId);
 			if (root) failures.set(root.id, failure.cause === void 0 ? scanFailureCode(failure.reason) : safeCode(failure.cause));
 		}
@@ -2153,7 +2213,7 @@ async function prepareScannedWork(storage, plan, work, directory, hooks, observa
 		...proof,
 		rootSessionIds: excludedRoots
 	} : void 0;
-	await changeJourney(storage, plan.journeyId, "batch", (state) => {
+	await changePreparation(storage, plan.journeyId, "batch", (state) => {
 		const target = state.works.find((item) => item.id === work.id);
 		if (state.scope.status !== "confirmed" || state.phase === "paused" || target?.access === "drop") throw new ApplicationError("OPERATION_CANCELED");
 		if (target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2212,7 +2272,7 @@ async function observePreparation(storage, input, observation, operation) {
 //#endregion
 //#region apps/cli/src/journey/prepare/work.ts
 async function prepareJourneyWork(storage, plan, work, directory, processing, hooks, workers, onGeneration, onSubmitted) {
-	let state = await storage.current(plan.journeyId);
+	let state = await storage.preparationState(plan.journeyId);
 	if (!state?.consent || !state.snapshotId) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	if (state.scope.status !== "confirmed" || state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 	const selected = workApproval(plan.approval, work.rootSessionIds);
@@ -2270,9 +2330,9 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 			context ??= await resolveContext();
 			return prepareScannedWork(storage, plan, work, directory, {
 				...hooks,
-				onFailureLocation(location, detail) {
+				onFailureLocation(location, detail, cause) {
 					observation.location(location);
-					hooks.onFailureLocation?.(location, detail);
+					hooks.onFailureLocation?.(location, detail, cause);
 				}
 			}, observation, context, onSubmitted);
 		});
@@ -2294,7 +2354,7 @@ async function prepareJourneyWork(storage, plan, work, directory, processing, ho
 */
 async function prepareStaticWork(options) {
 	const { storage, journeyId, signal } = options;
-	const state = await storage.current(journeyId);
+	const state = await storage.preparationState(journeyId);
 	const work = state?.works.find((item) => item.id === options.workId);
 	if (!state?.snapshotId || !work || !isSelectedWork(work) || !work.rootSessionIds.length) return;
 	if (![
@@ -2366,7 +2426,7 @@ async function prepareStaticWork(options) {
 	if (failure) throw failure.error;
 	signal.throwIfAborted();
 	if (resources.length !== jobs.length) throw new ApplicationError("SCOPE_NOT_READY");
-	await changeJourney(storage, journeyId, "batch", (current) => {
+	await changePreparation(storage, journeyId, "batch", (current) => {
 		const target = current.works.find((item) => item.id === work.id);
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 		if (current.snapshotId !== snapshotId || target?.inputRevision !== work.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
@@ -2403,7 +2463,7 @@ function observeJourneyPause(storage, journeyId, processing, onFailure, requireC
 	const closing = new AbortController();
 	async function readPermission() {
 		for (let attempt = 1;; attempt++) try {
-			return await storage.current(journeyId);
+			return await storage.preparationPermission(journeyId);
 		} catch (error) {
 			if (safeCode(error) !== "COORDINATION_BUSY" || attempt === 4) throw error;
 			onFailure(error);
@@ -2476,6 +2536,16 @@ const preparationFailureBindingsSchema = z.object({
 	workId: z.uuid(),
 	inputRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
 }).strict();
+/** Issue #59: the named fields are exactly what siteFields keeps, so no other text passes. */
+const siteShape = {
+	site: z.string().optional(),
+	harness: z.string().optional(),
+	harnessVersion: z.string().optional()
+};
+const onlySiteFields = (value) => {
+	const kept = siteFields(value);
+	return kept?.site === value.site && kept?.harness === value.harness && kept?.harnessVersion === value.harnessVersion;
+};
 const preparationSourceFailureSchema = z.object({
 	location: z.object({
 		workspaceId: z.uuid(),
@@ -2483,10 +2553,19 @@ const preparationSourceFailureSchema = z.object({
 		sourcePartId: z.uuid().optional()
 	}).strict(),
 	rootSessionId: z.uuid().nullable(),
-	detail: artifactFailureDetailSchema.nullable()
-}).strict().refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+	detail: artifactFailureDetailSchema.nullable(),
+	...siteShape
+}).strict().refine(onlySiteFields).refine(({ location, rootSessionId, detail }) => (location.sessionId === void 0 ? rootSessionId === null && location.sourcePartId === void 0 : rootSessionId !== null) && (detail === null || location.sourcePartId !== void 0));
+/** One count per refusal group over every reported source, unlike the bounded list. */
+const preparationFailureCountSchema = z.object({
+	code: z.string().regex(/^[A-Z_]{3,80}$/u).optional(),
+	...siteShape,
+	count: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).strict().refine(onlySiteFields);
 const preparationFailureContextSchema = preparationFailureBindingsSchema.extend({
 	sourceFailures: z.array(preparationSourceFailureSchema).max(16),
+	sourceFailureCounts: z.array(preparationFailureCountSchema).max(32),
+	/** The list or the counts left something out; the counts cover every source otherwise. */
 	truncated: z.boolean()
 }).refine((context) => Buffer.byteLength(JSON.stringify(context)) <= maximumPreparationContextBytes);
 /** Invalid diagnostic input must never prevent the independent original-error write. */
@@ -2506,16 +2585,19 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 	let context;
 	let families;
 	const roots = new Set(rootSessionIds);
+	const counted = [];
 	try {
 		const parsed = preparationFailureBindingsSchema.safeParse(bindings);
 		if (parsed.success) context = {
 			...parsed.data,
 			sourceFailures: [],
+			sourceFailureCounts: [],
 			truncated: false
 		};
 	} catch {}
 	return {
-		report(location, detail) {
+		/** `cause` contributes only its code and the fixed site fields (siteFields), never text. */
+		report(location, detail, cause) {
 			if (!context) return;
 			try {
 				const checked = validateFailureLocation(inventory, location);
@@ -2527,11 +2609,20 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 					sessionId: root.id
 				}))) return;
 				if (checked.sessionId === void 0 && !inventory.sessions.some((session) => session.workspaceId === checked.workspaceId && roots.has(families?.owners.get(session.id)?.id ?? ""))) return;
+				const named = processingSite(cause);
+				if (!counted.some((seen) => contains(seen, checked) || contains(checked, seen))) {
+					counted.push(checked);
+					context = countFailure(context, {
+						...cause === void 0 ? {} : { code: safeCode(cause) },
+						...named
+					});
+				}
 				const facts = artifactFailureDetailSchema.safeParse(detail);
 				const parsed = preparationSourceFailureSchema.safeParse({
 					location: checked,
 					rootSessionId: root?.id ?? null,
-					detail: facts.success ? facts.data : null
+					detail: facts.success ? facts.data : null,
+					...named
 				});
 				if (!parsed.success) return;
 				const entry = parsed.data;
@@ -2556,13 +2647,50 @@ function collectPreparationFailures(inventory, rootSessionIds, bindings) {
 		}
 	};
 }
+/** Adds one source to its (code, site, harness, version) group; a group past the bound truncates. */
+function countFailure(context, group) {
+	const same = JSON.stringify({
+		...group,
+		count: 0
+	});
+	const index = context.sourceFailureCounts.findIndex((entry) => JSON.stringify({
+		...entry,
+		count: 0
+	}) === same);
+	if (index < 0 && context.sourceFailureCounts.length >= 32) return {
+		...context,
+		truncated: true
+	};
+	const next = {
+		...context,
+		sourceFailureCounts: index < 0 ? [...context.sourceFailureCounts, {
+			...group,
+			count: 1
+		}] : context.sourceFailureCounts.map((entry, at) => at === index ? {
+			...entry,
+			count: entry.count + 1
+		} : entry)
+	};
+	return readPreparationFailureContext(next) ? next : {
+		...context,
+		truncated: true
+	};
+}
 //#endregion
 //#region apps/cli/src/journey/prepare.ts
+const pendingSelected = (work) => work.status === "pending" && isSelectedWork(work);
+/** A retried Work is pending even if a previous generation produced a static receipt. */
+function initialScanWorks(state, scanRequested) {
+	if (!scanRequested || state.scope.status !== "confirmed") return [];
+	const selected = state.works.filter(isSelectedWork);
+	if (!selected.some(pendingSelected)) return selected;
+	return selected.filter((work) => work.status === "pending" || ["reading", "review"].includes(work.status) && !hasCurrentStaticReview(state, work));
+}
 function createJourneyPreparation(options) {
 	return async (journeyId, signal) => {
 		const { storage } = options;
 		if (signal?.aborted) throw new ApplicationError("OPERATION_CANCELED");
-		const current = await storage.current(journeyId);
+		const current = await storage.preparationState(journeyId);
 		if (!current?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 		if (obsoleteJourney(current)) throw new ApplicationError("JOURNEY_OBSOLETE");
 		if (current.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
@@ -2585,10 +2713,11 @@ function createJourneyPreparation(options) {
 				terms: []
 			};
 			const plan = await prepareSourcePlan(storage, options.harnesses, journeyId, terms, abort.signal, current.period, options.stateDir);
-			const initial = await storage.current(journeyId);
+			const initial = await storage.preparationState(journeyId);
 			if (!initial?.consent) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			const formed = initial.snapshotId ? [] : namedJourneyWorks(formJourneyWorks(plan.approval, options.processing.environment), options.processing, abort.signal);
-			const state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
+			let state;
+			if (!initial.snapshotId) state = await changeJourney(storage, journeyId, "snapshot", (before) => ({
 				...before,
 				snapshotId: before.snapshotId ?? textDigest(JSON.stringify(plan)),
 				...before.snapshotId ? {} : {
@@ -2596,17 +2725,22 @@ function createJourneyPreparation(options) {
 					reviewMethod: "dictionary"
 				},
 				works: before.snapshotId ? before.works : formed,
-				phase: before.phase === "paused" ? "paused" : !before.snapshotId || before.works.some((work) => work.status === "pending" && isSelectedWork(work)) ? "processing" : before.phase
+				phase: before.phase !== "paused" && (!before.snapshotId || before.works.some(pendingSelected)) ? "processing" : before.phase
 			}));
+			else if (initial.phase !== "processing" && initial.phase !== "paused" && initial.works.some(pendingSelected)) state = await changePreparation(storage, journeyId, "snapshot", (before) => before.phase !== "paused" && before.works.some(pendingSelected) ? {
+				...before,
+				phase: "processing"
+			} : before);
+			else state = initial;
 			if (!state.works.length) throw new ApplicationError("INVALID_SELECTION");
 			if (!scanRequested) await captureSortingScope(storage, journeyId, workApproval(plan.approval, state.works.flatMap((work) => work.rootSessionIds)), directory, abort.signal);
-			const scanWorks = scanRequested && state.scope.status === "confirmed" ? state.works : [];
+			const scanWorks = initialScanWorks(state, scanRequested);
 			if (scanWorks.length) run = await runWorkers(options.workers);
 			const frozen = state;
 			const blockedForRetry = new Set(state.works.filter((work) => work.status === "blocked").map((work) => `${work.id}:${work.inputRevision}`));
 			const deferredForHide = /* @__PURE__ */ new Set();
 			const blockWork = async (work, error) => {
-				const blocked = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const blocked = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					if (before.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 					if (before.phase === "sending" || before.phase === "completed") return before;
 					return withReadingProgress({
@@ -2645,7 +2779,7 @@ function createJourneyPreparation(options) {
 				abort.signal.throwIfAborted();
 				let resumed = false;
 				let deferred = false;
-				const committed = await changeJourney(storage, journeyId, "snapshot", (before) => {
+				const committed = await changePreparation(storage, journeyId, "snapshot", (before) => {
 					resumed = false;
 					deferred = false;
 					const target = before.works.find((item) => item.id === work.id);
@@ -2654,17 +2788,13 @@ function createJourneyPreparation(options) {
 					deferred = !resumed;
 					return withReadingProgress({
 						...before,
-						privacy: {
-							...before.privacy,
-							packageApproval: null
-						},
 						works: before.works.map((item) => item.id === work.id ? {
 							...item,
 							status: resumed ? work.status : "pending",
 							blockedCodes: []
 						} : item)
 					});
-				}, 100);
+				}, 100, true);
 				if (deferred && committed.pendingHideId && committed.works.some((item) => generation(item) === generation(work) && item.status === "pending")) deferredForHide.add(generation(work));
 				return resumed;
 			};
@@ -2684,7 +2814,7 @@ function createJourneyPreparation(options) {
 			};
 			/** D2: the person dropped this Work while it was prepared; the other Works go on. */
 			const droppedMidScan = async (workId) => {
-				const now = await storage.current(journeyId);
+				const now = await storage.preparationState(journeyId);
 				const work = now?.works.find((item) => item.id === workId);
 				return Boolean(now && now.phase !== "paused" && now.scope.status === "confirmed" && work && !isSelectedWork(work));
 			};
@@ -2693,7 +2823,7 @@ function createJourneyPreparation(options) {
 			/** True when failing roots left the Work, which is then prepared again (ADR 0188). */
 			const prepareWorkAttempt = async (planned, onSubmitted, releaseRead) => {
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId) ?? frozen;
+				const latest = await storage.preparationState(journeyId) ?? frozen;
 				abort.signal.throwIfAborted();
 				if (latest.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 				let work = latest.works.find((item) => item.id === planned.id);
@@ -2717,7 +2847,7 @@ function createJourneyPreparation(options) {
 						signal: abort.signal,
 						onTemporary: async () => {},
 						onPhase: async () => {},
-						onFailureLocation: (location) => failures.report(location),
+						onFailureLocation: (location, _detail, cause) => failures.report(location, void 0, cause),
 						onTiming: (timing) => options.onTiming?.(planned.id, timing)
 					}, run.workers, (revised) => {
 						work = revised;
@@ -2745,7 +2875,7 @@ function createJourneyPreparation(options) {
 						readRetries.set(generation(work), attempt + 1);
 						return prepareWorkOnce(planned, onSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase === "sending" || now?.phase === "completed") return false;
 					if (blockedCodes(error, code).includes("PRIVACY_CHANGE_PENDING")) {
 						if (work) await blockWork(work, error);
@@ -2775,7 +2905,7 @@ function createJourneyPreparation(options) {
 			const staticWork = async (planned, passSubmitted) => {
 				await passSubmitted;
 				abort.signal.throwIfAborted();
-				const latest = await storage.current(journeyId);
+				const latest = await storage.preparationState(journeyId);
 				abort.signal.throwIfAborted();
 				if (!latest?.consent || latest.phase === "paused" || latest.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
 				const work = latest.works.find((item) => item.id === planned.id);
@@ -2803,7 +2933,7 @@ function createJourneyPreparation(options) {
 						staticRetries.set(generation(work), attempt + 1);
 						return staticWork(planned, passSubmitted);
 					}
-					const now = await storage.current(journeyId);
+					const now = await storage.preparationState(journeyId);
 					if (now?.phase !== "sending" && now?.phase !== "completed" && (attempt >= retryLimit || blockedCodes(error, safeCode(error)).includes("PRIVACY_CHANGE_PENDING"))) await blockWork(work, error);
 				}
 			};
@@ -2881,7 +3011,7 @@ function createJourneyPreparation(options) {
 				for (;;) {
 					abort.signal.throwIfAborted();
 					const settled = workSettled.promise;
-					const latest = await storage.current(journeyId);
+					const latest = await storage.preparationState(journeyId);
 					if (!latest || latest.phase === "paused" || latest.scope.status !== "confirmed") return [];
 					for (const work of latest.works) if (work.status === "blocked") blockedForRetry.add(generation(work));
 					const ready = latest.works.filter((work) => isSelectedWork(work) && [
@@ -2902,7 +3032,8 @@ function createJourneyPreparation(options) {
 				}
 			};
 			try {
-				for (let batch = scanWorks; batch.length && !fatal; batch = await later()) {
+				const firstBatch = scanRequested && !scanWorks.length && isClassifying(state) ? await later() : scanWorks;
+				for (let batch = firstBatch; batch.length && !fatal; batch = await later()) {
 					if (!run.workers && !run.pool) run = await runWorkers(options.workers);
 					await pass(batch);
 				}
@@ -2921,7 +3052,7 @@ function createJourneyPreparation(options) {
 			});
 			if (fatal) throw fatal.error;
 			abort.signal.throwIfAborted();
-			const result = await storage.current(journeyId);
+			const result = await storage.preparationState(journeyId);
 			await stopObserving();
 			abort.signal.throwIfAborted();
 			if (!result?.consent || result.phase === "paused" || scanRequested && result.scope.status !== "confirmed") throw new ApplicationError("OPERATION_CANCELED");
@@ -3582,7 +3713,7 @@ function assertScope(journey, send) {
 	if (journey.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
 	if (journey.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
 	if (scopeDigest(journey) !== send.scopeDigest) throw new ApplicationError("SEND_SCOPE_INVALIDATED");
-	assertJourneyPrivacyReady(journey, true);
+	assertJourneyPrivacyReady(journey, true, { publicChoices: send.status !== "completed" });
 	for (const item of send.items) {
 		const work = journey.works.find((value) => value.id === item.workId);
 		if (!work || work.status !== "ready" || !hasCompleteWorkDescription(work) || !work.accessConfirmed || work.access !== item.access || work.artifact?.revision !== work.revision || work.artifact.sha256 !== item.artifact.sha256 || work.artifact.archiveBytes !== item.artifact.byteLength || work.artifact.bundleId !== item.artifact.bundleId) throw new ApplicationError("SCOPE_NOT_READY");
@@ -3867,31 +3998,32 @@ function createJourneyRenderer(options) {
 	async function renderScope(journeyId, works, signal) {
 		const workers = options.workers;
 		const size = workers ? workers.parallelism ?? renderWorkerCount() : 0;
-		if (!workers || works < 1 || size < 1) {
-			const retry = renderRetry(signal, Math.max(1, works));
-			return {
-				render: (workId) => render(journeyId, workId, signal, { retry }),
-				close: async () => void 0
-			};
-		}
-		const retry = renderRetry(signal, Math.min(works, size + 1));
-		const store = retry.store(storage);
+		if (!workers || works < 1 || size < 1) return {
+			render: (workId) => render(journeyId, workId, signal, { retry: renderRetry(signal, Math.max(1, Math.min(16, works))) }),
+			close: async () => void 0
+		};
 		const pool = createRenderWorkers(workers, size);
-		const session = batchedRenderSession(store, journeyId);
+		const session = batchedRenderSession(storage, journeyId);
 		let plan;
-		const readPlan = () => plan ??= readJourneyPlan(store, journeyId).catch((error) => {
+		const readPlan = () => plan ??= readJourneyPlan(storage, journeyId).catch((error) => {
 			plan = void 0;
 			throw error;
 		});
 		return {
 			concurrency: size + 1,
-			render: (workId) => render(journeyId, workId, signal, {
-				write: pool.write,
-				session,
-				plan: readPlan,
-				writeBase: pool.writeBase,
-				retry
-			}),
+			render: (workId) => {
+				const retry = renderRetry(signal, Math.min(16, works, size + 1));
+				return render(journeyId, workId, signal, {
+					write: pool.write,
+					session: {
+						current: () => retry.run(() => session.current()),
+						commit: (change) => retry.run(() => session.commit(change))
+					},
+					plan: () => retry.run(readPlan),
+					writeBase: pool.writeBase,
+					retry
+				});
+			},
 			close: pool.close
 		};
 	}
@@ -4691,7 +4823,7 @@ async function resolveChunkSessions(storage, state, works, signal) {
 * read and applied by the store against the current state, so scan writes in between do not
 * refuse it (BL-216).
 */
-function createClassificationProposal(storage) {
+function createClassificationProposal(storage, accountAccess) {
 	return async (input, signal) => {
 		signal.throwIfAborted();
 		const state = await storage.current(input.journeyId);
@@ -4785,9 +4917,18 @@ function createClassificationProposal(storage) {
 		};
 		const { works } = classificationWorks(state, prepared);
 		const chunkSessions = await resolveChunkSessions(storage, state, works, signal);
+		const read = late ? await accountAccess?.({
+			...state,
+			works
+		}, signal) : void 0;
+		const sameAccount = read?.status === "read" && state.accountRead?.status === "read" && state.accountRead.subject === read.subject;
 		return storage.commitClassification({
 			...prepared,
-			chunkSessions
+			chunkSessions,
+			...sameAccount ? {
+				accountAccess: Object.fromEntries(read.access),
+				accountSubject: read.subject
+			} : read ? { accountRead: read.status === "read" ? "unavailable" : read.status } : {}
 		});
 	};
 }
@@ -5133,11 +5274,11 @@ function createJourneyClassification(storage, _processing) {
 //#endregion
 //#region apps/cli/src/journey/works/index.ts
 /** The journey local port's project catalog and project-type suggestions. */
-function createJourneyWorks(storage, processing, stateDir) {
+function createJourneyWorks(storage, processing, stateDir, accountAccess) {
 	return {
 		classificationSessions: createClassificationSessions(storage, processing, stateDir),
 		classificationRead: createClassificationReader(storage, stateDir),
-		classificationSubmit: createClassificationProposal(storage),
+		classificationSubmit: createClassificationProposal(storage, accountAccess),
 		catalog: createJourneyCatalog(storage, processing, stateDir),
 		classify: createJourneyClassification(storage, processing)
 	};
@@ -5231,6 +5372,46 @@ function protectedSourceText(field, hidden) {
 }
 //#endregion
 //#region apps/cli/src/journey/send-package.ts
+/** Explicit admission refusals must never become automatic packaging retries. */
+const packagingRefusalCodes = [
+	"ARTIFACT_INVALID_APPROVAL",
+	"ARTIFACT_IDENTITY_MISMATCH",
+	"CONFIRMATION_REQUIRED",
+	"INCOMPLETE_REVIEW",
+	"PRIVACY_CHANGE_PENDING",
+	"PRIVACY_UNCERTAIN",
+	"REVISION_CONFLICT",
+	"SCOPE_NOT_READY",
+	"JOURNEY_OBSOLETE",
+	"UNKNOWN_ITEM",
+	"UNKNOWN_WORKSPACE",
+	"OPERATION_CANCELED"
+];
+/**
+* Deterministic failures a later attempt cannot clear: the refusals above, the source refusals
+* preparation isolates per root, size limits, a missing source and a full disk. Every other code,
+* including Windows sharing or antivirus locks, retries until the saved request expires.
+*/
+const finalPackagingCodes = [
+	...packagingRefusalCodes,
+	...rootScanRefusals,
+	"ARTIFACT_ARCHIVE_LIMIT",
+	"ARTIFACT_ENTRY_LIMIT",
+	"ARTIFACT_FILESYSTEM_LIMIT",
+	"ARTIFACT_INDEX_LIMIT",
+	"ARTIFACT_METADATA_LIMIT",
+	"ARTIFACT_PART_LIMIT",
+	"ARTIFACT_SOURCE_MISSING",
+	"ARTIFACT_DISK_FULL",
+	"ARTIFACT_INVALID_APPROVAL",
+	"ARTIFACT_INVALID_ARCHIVE",
+	"ARTIFACT_INVALID_MANIFEST",
+	"ARTIFACT_OUTPUT_UNSAFE",
+	"ARTIFACT_PROCESSING_MISMATCH",
+	"ARTIFACT_QUOTA_EXCEEDED",
+	"ARTIFACT_SOURCE_UNSAFE",
+	"ARTIFACT_UNSAFE_REMOTE"
+];
 const packaged = (work) => work.status === "ready" && work.artifact?.revision === work.revision;
 /** One host-lifetime packaging batch per advance; persisted artifacts are its progress. */
 function createSendPackager(ports) {
@@ -5249,13 +5430,16 @@ function createSendPackager(ports) {
 			if (!current) throw new ApplicationError("UNKNOWN_ITEM");
 		}
 		const ready = (works, id) => works.some((work) => work.id === id && packaged(work));
-		const batch = workIds.filter((id) => !ready(current.works, id)).slice(0, 16);
+		const batch = workIds.filter((id) => !ready(current.works, id));
 		if (!batch.length) return true;
 		signal.throwIfAborted();
 		const result = await ports.render({
 			journeyId,
 			workIds: batch
 		}, signal);
+		const failures = result.renders?.filter((item) => item.status === "failed") ?? [];
+		const failure = failures.find((item) => packagingRefusalCodes.includes(item.code)) ?? failures.find((item) => finalPackagingCodes.includes(item.code)) ?? failures[0];
+		if (failure) throw new ApplicationError(failure.code);
 		if (batch.some((id) => !ready(result.works, id))) throw new Error("PACKAGING_FAILED");
 		return false;
 	};
@@ -5628,6 +5812,19 @@ async function classifyExit(child, startup, exited, busy) {
 }
 //#endregion
 //#region apps/cli/src/send-host.ts
+/**
+* The detached focused host (ADR 0227) drives a Send only for the store's current journey, the
+* check its timer makes, and only while `liveHost` verifies its process identity and URL.
+* Anything the CLI cannot confirm returns false, so the CLI keeps stepping as before.
+*/
+async function focusedHostAlive(stateDir, journeyId, currentJourneyId) {
+	try {
+		if (await currentJourneyId() !== journeyId) return false;
+		return (await liveHost(join(stateDir, "serve"), journeyId)).status === "alive";
+	} catch {
+		return false;
+	}
+}
 const recordSchema = z.object({
 	hostId: z.uuid(),
 	pid: z.number().int().positive()
@@ -6091,49 +6288,72 @@ var SessionContentConflict = class extends ApplicationError {
 		this.contentConflict = contentConflict;
 	}
 };
-/** Check the entire pending Send before admitting any session mutation. */
+/** Collect safe conflicts across the entire pending Send before any session mutation. */
 async function sessionAccessBlocked(dependencies, journeyId, items, inventory, signal) {
 	const sessions = dependencies.artifacts.sessionFacts ?? dependencies.artifacts.sessions;
-	if (!sessions) return false;
+	if (!sessions) return [];
+	const conflicts = /* @__PURE__ */ new Map();
+	const accountAccesses = /* @__PURE__ */ new Map();
+	function observe(item, access) {
+		const values = accountAccesses.get(item.workId) ?? /* @__PURE__ */ new Set();
+		values.add(access);
+		accountAccesses.set(item.workId, values);
+	}
+	function record(item, sessionKey, rule, account) {
+		if (account) observe(item, account.access);
+		const conflict = {
+			workId: item.workId,
+			sessionKey,
+			requestedAccess: item.access,
+			accountWorkId: account?.logicalWorkId ?? null,
+			accountAccess: account?.access ?? null,
+			rule
+		};
+		conflicts.set(JSON.stringify(conflict), conflict);
+	}
 	const requestedAccess = /* @__PURE__ */ new Map();
 	const requestedDigests = /* @__PURE__ */ new Map();
 	const contentAccess = /* @__PURE__ */ new Map();
-	const claimContent = (key, sha256, access) => {
-		const identity = JSON.stringify([key, sha256]);
-		const previous = contentAccess.get(identity);
-		if (previous !== void 0 && previous !== access) return true;
-		contentAccess.set(identity, access);
-		return false;
-	};
+	function claim(claims, identity, key, item, rule) {
+		const previous = claims.get(identity) ?? [];
+		for (const other of previous) {
+			if (other.access === item.access) continue;
+			record(item, key, rule);
+			record(other, key, rule);
+		}
+		if (!previous.some((other) => other.workId === item.workId)) previous.push(item);
+		claims.set(identity, previous);
+	}
+	const claimContent = (key, sha256, item) => claim(contentAccess, JSON.stringify([key, sha256]), key, item, "content-access");
 	for (const item of items) {
 		if (item.status === "blocked" || item.sessionAssembly) continue;
 		const keys = item.sessionMembership?.keys ?? (item.sessionUpload ? [item.sessionUpload.key] : []);
 		if (!keys.length) continue;
 		const destination = inventory.works.find((work) => work.logicalWorkId === item.workId);
 		if (destination?.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		if (destination) observe(item, destination.access);
 		for (const key of keys) {
-			const access = requestedAccess.get(key);
-			if (access !== void 0 && access !== item.access) return true;
-			requestedAccess.set(key, item.access);
-			const source = inventory.works.find((work) => work.sessions.some((entry) => entry.key === key));
-			if (source && source.logicalWorkId !== item.workId && source.access !== item.access) return true;
-			const sha256 = item.sessionMembership ? source?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
-			if (sha256 && claimContent(key, sha256, item.access)) return true;
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && (item.sessionMembership || entry.sha256 === sha256))) return true;
+			claim(requestedAccess, key, key, item, "requested-access");
+			const sources = inventory.works.filter((work) => work.sessions.some((entry) => entry.key === key));
+			for (const source of sources) observe(item, source.access);
+			for (const source of sources) if (source.logicalWorkId !== item.workId && source.access !== item.access) record(item, key, "held-elsewhere", source);
+			const sha256 = item.sessionMembership ? sources[0]?.sessions.find((session) => session.key === key)?.sha256 : item.sessionUpload?.sha256;
+			if (sha256) claimContent(key, sha256, item);
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
 	}
 	for (const item of items) {
 		if (item.sessionAssembly || item.sessionMembership || ["completed", "blocked"].includes(item.status)) continue;
 		const destination = inventory.works.find((work) => work.logicalWorkId === item.workId);
 		if (destination?.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		if (destination) observe(item, destination.access);
 		for await (const session of sessions(journeyId, item.artifact, signal)) {
 			const key = await sessionKeyFor(session);
 			const { workerIdentity: _, ...original } = session;
 			const legacyKey = session.workerIdentity ? await sessionKeyFor(original) : key;
-			if (claimContent(key, session.sha256, item.access) || legacyKey !== key && claimContent(legacyKey, session.sha256, item.access)) return true;
-			const otherAccess = requestedAccess.get(key);
-			if (otherAccess !== void 0 && otherAccess !== item.access) return true;
-			requestedAccess.set(key, item.access);
+			claimContent(key, session.sha256, item);
+			if (legacyKey !== key) claimContent(legacyKey, session.sha256, item);
+			claim(requestedAccess, key, key, item, "requested-access");
 			const otherDigest = requestedDigests.get(key);
 			if (otherDigest !== void 0 && otherDigest.sha256 !== session.sha256) throw new SessionContentConflict({
 				workIds: [.../* @__PURE__ */ new Set([...otherDigest.workIds, item.workId])],
@@ -6143,11 +6363,18 @@ async function sessionAccessBlocked(dependencies, journeyId, items, inventory, s
 				sha256: session.sha256,
 				workIds: [.../* @__PURE__ */ new Set([...otherDigest?.workIds ?? [], item.workId])]
 			});
-			if (inventory.works.some((work) => work.logicalWorkId !== item.workId && work.access !== item.access && work.sessions.some((entry) => entry.key === key || entry.key === legacyKey && entry.sha256 === session.sha256))) return true;
-			if (destination && destination.access !== item.access && !destination.sessions.some((entry) => entry.key === key && entry.sha256 === session.sha256)) return true;
+			for (const work of inventory.works) for (const entry of work.sessions) {
+				if (entry.key !== key && !(entry.key === legacyKey && entry.sha256 === session.sha256)) continue;
+				observe(item, work.access);
+				if (work.logicalWorkId !== item.workId && work.access !== item.access) record(item, entry.key, "held-elsewhere", work);
+			}
+			if (destination && destination.access !== item.access) record(item, key, "destination-access", destination);
 		}
 	}
-	return false;
+	return [...conflicts.values()].map((conflict) => (accountAccesses.get(conflict.workId)?.size ?? 0) > 1 ? {
+		...conflict,
+		accountAccess: "mixed"
+	} : conflict);
 }
 /** Keep overlapping session ownership serial through membership, including retained members. */
 async function sessionIndependentItems(dependencies, journeyId, items, inventory, signal) {
@@ -6825,8 +7052,8 @@ async function put(context, item, receiptId, upload, connection, signal, guard)
 	await guard();
 	await context.upload(item.artifact, upload, signal);
 	const sent = withoutBusy(item);
-	await guard();
 	try {
+		await guard();
 		return observe(sent, await connection.complete(receiptId, signal), connection, signal, context.snapshot === true);
 	} catch (error) {
 		if (upload.headers !== void 0 && error instanceof JourneyRemoteError && error.code === "bundle_mismatch") return {
@@ -6956,13 +7183,14 @@ function isCode(error, code) {
 }
 /**
 * A step that ended without a definite answer and is safe to repeat: a request timeout or abort
-* that is not the Send's own cancellation, or a connection failure from `fetch`. The Work keeps
+* that is not the Send's own cancellation, or a connection failure from `fetch`: `fetch failed`
+* before the response, `terminated` when the socket resets while the body is read. The Work keeps
 * its state, so the next advance repeats the same idempotent step (ADR 0197).
 */
 function isInterrupted(error) {
 	if (!(error instanceof Error)) return false;
 	if (error.name === "TimeoutError" || error.name === "AbortError") return true;
-	return error instanceof TypeError && error.message === "fetch failed";
+	return error instanceof TypeError && (error.message === "fetch failed" || error.message === "terminated");
 }
 const sessionBackoffMs = (attempt) => 1e3 * 2 ** (attempt - 1);
 const zeroByteBackoffMs = (count) => [
@@ -7183,8 +7411,10 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 			break;
 		}
 	}
+	const ownKeys = /* @__PURE__ */ new Set();
 	for await (const session of sessions(journeyId, item.artifact, signal)) {
 		const identity = await keys.add(session);
+		ownKeys.add(identity.key);
 		if (recoverLegacy && (identity.legacyKey !== pending?.key || session.sha256 !== pending?.sha256)) continue;
 		const key = recoverLegacy && pending ? pending.key : identity.key;
 		if (stored.get(key)?.sha256 === session.sha256) {
@@ -7210,13 +7440,23 @@ async function stepSessionWork(dependencies, journeyId, context, item, connectio
 	const assembly = await remote.assembly(item.workId, signal);
 	const current = (await remote.inventory(signal)).works.find((work) => work.logicalWorkId === item.workId);
 	if (current && current.access !== item.access) {
-		const resolution = await connection.resolve(resolveInput(item, context.bindingId), signal);
-		const [candidate] = resolution.candidates;
-		if (resolution.status === "blocked" || candidate?.access === "removed") throw new ApplicationError("WORK_REMOVED");
-		if (resolution.status !== "matched" || resolution.logicalWorkId !== item.workId || resolution.candidates.length !== 1 || !candidate || context.bindingId !== void 0 && candidate.bindingId !== context.bindingId) throw new ApplicationError("INVALID_STATE");
-		const settings = await connection.preview(candidate.workId, item.access, signal);
+		if (current.access === "removed") throw new ApplicationError("WORK_REMOVED");
+		const [ownKey] = ownKeys;
+		if (!ownKey) throw new ApplicationError("INVALID_STATE");
 		await guard();
-		await connection.confirm(settings, signal);
+		return {
+			...item,
+			status: "blocked",
+			error: "SESSION_MOVE_ACCESS_REQUIRED",
+			accessConflict: {
+				sessionKey: ownKey,
+				requestedAccess: item.access,
+				accountWorkId: current.logicalWorkId,
+				accountAccess: current.access,
+				rule: "destination-access"
+			},
+			accessConflictSessionCount: ownKeys.size
+		};
 	}
 	await guard();
 	return {
@@ -7280,6 +7520,10 @@ function aggregate(send) {
 function awaitingPassport(send) {
 	return send.status === "completed" && send.items.some((item) => !["completed", "blocked"].includes(item.status));
 }
+/** The host continues confirmed uploads and unfinished Passport assessments without a panel. */
+function hostDrives(send) {
+	return awaitingPassport(send) || send.confirmedAt != null && ["sending", "waiting"].includes(send.status);
+}
 /** Explicit resume retries recoverable items and recaptures a pending sign-in or profile. */
 function resumeState(send) {
 	if (send.status !== "completed" && send.items.length && send.items.every((item) => item.status === "completed") && send.items.some((item) => !item.sessionAssembly)) return {
@@ -7304,18 +7548,23 @@ function resumeState(send) {
 		...send,
 		status: "sending",
 		error: null,
-		items: send.items.map((item) => item.status === "blocked" && [
-			"OPERATION_FAILED",
-			"UPLOAD_FAILED",
-			"SEND_REMOTE_REFUSED",
-			"SESSION_MOVE_ACCESS_REQUIRED",
-			"IDENTITY_UNAVAILABLE",
-			"ACCOUNT_SIGNED_OUT"
-		].includes(item.error ?? "") ? {
-			...item,
-			status: item.receipt ? item.receipt.state === "awaiting_upload" ? "uploading" : "assessing" : "ready",
-			error: null
-		} : item)
+		items: send.items.map((item) => {
+			const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
+			return item.status === "blocked" && [
+				"OPERATION_FAILED",
+				"COORDINATION_BUSY",
+				"UPLOAD_FAILED",
+				"SEND_REMOTE_REFUSED",
+				"SESSION_MOVE_ACCESS_REQUIRED",
+				"SESSION_MOVE_ACCESS_HELD",
+				"IDENTITY_UNAVAILABLE",
+				"ACCOUNT_SIGNED_OUT"
+			].includes(item.error ?? "") ? {
+				...current,
+				status: item.receipt ? item.receipt.state === "awaiting_upload" ? "uploading" : "assessing" : "ready",
+				error: null
+			} : item;
+		})
 	});
 	return profileRequired && !["blocked", "completed"].includes(next.status) ? {
 		...next,
@@ -7356,7 +7605,7 @@ async function writeProfile(connection, chosen, guard, signal, failure, captured
 		await guard();
 		return captured;
 	} catch (error) {
-		if (signal.aborted) throw error;
+		if (signal.aborted || safeCode(error) === "COORDINATION_BUSY") throw error;
 		if (error instanceof JourneyRemoteError && error.status === 409 && addressRefusals[error.code]) return {
 			status: "blocked",
 			error: addressRefusals[error.code] ?? null
@@ -7382,7 +7631,7 @@ async function captureProfile(connection, guard, signal, failure) {
 			parallelCompletes: parallelCompletes ? true : void 0
 		};
 	} catch (error) {
-		if (signal.aborted) throw error;
+		if (signal.aborted || safeCode(error) === "COORDINATION_BUSY") throw error;
 		if (error instanceof JourneyRemoteError && error.status === 401 || error instanceof ApplicationError && error.code === "ACCOUNT_SIGNED_OUT") return {
 			status: "sign-in",
 			error: null
@@ -7503,7 +7752,14 @@ async function advanceItems(host, signal) {
 				});
 				host.failure("SEND_SCOPE_BUSY", cause);
 				error = "SEND_SCOPE_BUSY";
-			} else if (isInterrupted(cause) || isTransientRefusal(cause)) {
+			} else if (isInterrupted(cause) || isTransientRefusal(cause) || safeCode(cause) === "COORDINATION_BUSY") {
+				if (safeCode(cause) === "COORDINATION_BUSY") {
+					const current = progressed ?? item;
+					next.set(item.workId, {
+						...current,
+						busyRefusals: (current.busyRefusals ?? 0) + 1
+					});
+				}
 				host.failure("SEND_INTERRUPTED", cause);
 				error = "SEND_INTERRUPTED";
 			} else {
@@ -7537,7 +7793,7 @@ async function advanceItems(host, signal) {
 			items
 		}));
 	} catch (error) {
-		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE"))) {
+		if (!signal.aborted && (isInterrupted(error) || error instanceof Error && isInterrupted(error.cause) || isCode(error, "IDENTITY_UNAVAILABLE") || safeCode(error) === "COORDINATION_BUSY")) {
 			host.failure("SEND_INTERRUPTED", error);
 			return send.error === "SEND_INTERRUPTED" ? host.applied() : host.save({
 				...send,
@@ -7643,8 +7899,22 @@ async function advanceSend(dependencies, address, signal, chain) {
 				error: "SEND_SCOPE_CHANGED"
 			})
 		});
+		const invalidated = safeCode(error) === "SEND_SCOPE_INVALIDATED";
+		const answered = (item) => {
+			const work = snapshot.journey.works.find((work) => work.id === item.workId);
+			return !work || work.access !== item.access;
+		};
+		const answeredSessions = new Set(snapshot.send.items.flatMap((item) => item.error === "SESSION_MOVE_ACCESS_REQUIRED" && item.accessConflict && answered(item) ? [item.accessConflict.sessionKey] : []));
 		return blockSend({
-			send: snapshot.send,
+			send: invalidated ? {
+				...snapshot.send,
+				items: snapshot.send.items.filter((item) => {
+					if (item.error === "SESSION_MOVE_ACCESS_HELD") return false;
+					if (item.error !== "SESSION_MOVE_ACCESS_REQUIRED") return true;
+					if (item.accessConflict?.accountAccess === null && answeredSessions.has(item.accessConflict.sessionKey)) return false;
+					return !answered(item);
+				})
+			} : snapshot.send,
 			failure: dependencies.failure,
 			save
 		}, error, signal);
@@ -7670,18 +7940,41 @@ async function advanceSend(dependencies, address, signal, chain) {
 					if (!connection.sessions) throw new ApplicationError("INVALID_STATE");
 					if (!send.items.some((item) => item.status === "uploading" && !item.sessionAssembly && !item.receipt && !item.reservation)) return null;
 					const inventory = await connection.sessions.inventory(preflightSignal);
-					if (!await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal)) {
+					const conflicts = await sessionAccessBlocked(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
+					if (conflicts.length === 0) {
 						independentItems = await sessionIndependentItems(preparation.dependencies, snapshot.journey.journeyId, send.items, inventory, preflightSignal);
 						return null;
 					}
 					await connection.assertCurrent(preflightSignal);
+					dependencies.failure("SESSION_MOVE_ACCESS_REQUIRED", {
+						code: "SESSION_MOVE_ACCESS_REQUIRED",
+						message: JSON.stringify({
+							conflicts: conflicts.length,
+							works: new Set(conflicts.map((conflict) => conflict.workId)).size,
+							rules: [...new Set(conflicts.map((conflict) => conflict.rule))].sort()
+						})
+					});
 					return save({
 						...send,
 						status: "blocked",
-						items: send.items.map((item) => item.sessionAssembly || item.status === "completed" ? item : {
-							...item,
-							status: "blocked",
-							error: "SESSION_MOVE_ACCESS_REQUIRED"
+						items: send.items.map((item) => {
+							if (item.sessionAssembly || item.status === "completed") return item;
+							const { accessConflict: _previous, accessConflictSessionCount: _count, ...current } = item;
+							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
+							if (!conflict) return {
+								...current,
+								status: "blocked",
+								error: "SESSION_MOVE_ACCESS_HELD"
+							};
+							const { workId: _, ...accessConflict } = conflict;
+							return {
+								...current,
+								status: "blocked",
+								error: "SESSION_MOVE_ACCESS_REQUIRED",
+								accessConflict,
+								accessConflictSessionCount: new Set(itemConflicts.map((entry) => entry.sessionKey)).size
+							};
 						})
 					});
 				},
@@ -7702,7 +7995,7 @@ async function advanceSend(dependencies, address, signal, chain) {
 					});
 					saving = pending.catch(() => void 0);
 					return pending;
-				}).then((result) => {
+				}).then(({ busyRefusals: _busy, ...result }) => {
 					fulfilled.add(item.workId);
 					return result;
 				})
@@ -8023,20 +8316,15 @@ function createManualUploader(dependencies) {
 			upload,
 			status: "applied"
 		};
-		const host = {
+		let bindings = [];
+		return advanceItems({
 			send: upload,
 			failure: dependencies.failure,
-			save: (next) => save(upload, next)
-		};
-		let bindings;
-		try {
-			bindings = await storage.bindings();
-		} catch (error) {
-			return blockSend(host, error, signal);
-		}
-		return advanceItems({
-			...host,
-			connect: dependencies.auth.connect,
+			save: (next) => save(upload, next),
+			connect: async (connectSignal) => {
+				bindings = await storage.bindings();
+				return dependencies.auth.connect(connectSignal);
+			},
 			profile: (connection, profileSignal) => captureProfile(connection, guard(upload), profileSignal, dependencies.failure),
 			context: (item) => ({
 				active: guard(upload, item),
@@ -9330,7 +9618,7 @@ async function requestSend(dependencies, raw, hostId, source) {
 			...current,
 			status: "stale"
 		};
-		assertJourneyPrivacyReady(current.journey);
+		assertJourneyPrivacyReady(current.journey, false, { publicChoices: true });
 		if (current.journey.pendingHideId || current.journey.phase === "paused") throw new ApplicationError("SCOPE_NOT_READY");
 		if (current.send && ([
 			"awaiting-packaging",
@@ -9452,6 +9740,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 	/** The serving host owns a pending request; another process leaves it unchanged. */
 	const pendingElsewhere = (send) => !host.serving && send?.request !== void 0 && !send.confirmedAt;
 	const progress = /* @__PURE__ */ new Map();
+	let packagingRetry;
 	const sessionFacts = createSessionFactsCache();
 	const running = /* @__PURE__ */ new Map();
 	const runKey = (address) => `${address.journeyId}:${address.sendId}`;
@@ -9551,27 +9840,51 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const pendingError = pending ? await requestError(dependencies, pending, hostId, signal) : null;
 			if (pending && (pendingError || !requestMatches(pending, snapshot.journey))) return block(snapshot, pending, pendingError ?? "REVISION_CONFLICT");
 			const draft = await draftSend(snapshot.journey, dependencies, signal);
+			let observed = false;
 			const recover = snapshot.send && [
 				"blocked",
 				"paused",
 				"completed"
 			].includes(snapshot.send.status) && snapshot.send.items.some((item) => sendRecoveryCodes.includes(item.error ?? ""));
-			if (recover && snapshot.send) {
+			if (recover || dependencies.artifacts.sessions) {
 				const connection = await dependencies.auth.connect(signal);
-				if (!connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
-				if (snapshot.send.subject !== null && snapshot.send.subject !== connection.subject) throw new ApplicationError("IDENTITY_REJECTED");
+				if (connection && draft.subject !== connection.subject) return {
+					...snapshot,
+					status: "stale"
+				};
+				if (recover && !connection) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
+				if (recover && snapshot.send?.subject && snapshot.send.subject !== connection?.subject) throw new ApplicationError("IDENTITY_REJECTED");
 				const sessions = dependencies.artifacts.sessions;
-				const remote = connection.sessions;
-				if (sessions && remote) {
-					const inventory = await remote.inventory(signal);
-					for (const item of draft.items) {
-						const current = inventory.works.find((work) => work.logicalWorkId === item.workId);
+				const remote = connection?.sessions;
+				if (sessions && remote && connection) {
+					const inventory = await remote.inventory(signal).catch((error) => {
+						if (signal.aborted || recover) throw error;
+						dependencies.failure("SEND_INTERRUPTED", error);
+						return null;
+					});
+					observed = inventory !== null;
+					try {
+						const conflicts = inventory ? await sessionAccessBlocked(dependencies, input.journeyId, draft.items, inventory, signal) : [];
+						for (const item of draft.items) {
+							const itemConflicts = conflicts.filter((entry) => entry.workId === item.workId);
+							const conflict = itemConflicts.find((entry) => entry.accountAccess !== null) ?? itemConflicts[0];
+							if (conflict) {
+								const { workId: _, ...accessConflict } = conflict;
+								item.accessConflict = accessConflict;
+								item.accessConflictSessionCount = new Set(itemConflicts.map((entry) => entry.sessionKey)).size;
+							}
+						}
+					} catch (error) {
+						if (!(error instanceof SessionContentConflict) && !(error instanceof ApplicationError && error.code === "WORK_REMOVED")) throw error;
+					}
+					for (const item of inventory && recover && snapshot.send ? draft.items : []) {
+						const current = inventory?.works.find((work) => work.logicalWorkId === item.workId);
 						const assembly = await remote.assembly(item.workId, signal);
 						const selected = createSessionKeys();
 						for await (const session of sessions(input.journeyId, item.artifact, signal)) await selected.add(session);
 						const currentKeys = current?.sessions.map((session) => session.key) ?? [];
 						item.recoveryReview = {
-							previousSendId: snapshot.send.id,
+							previousSendId: snapshot.send?.id ?? draft.id,
 							revision: assembly?.revision ?? 0,
 							currentAccess: current?.access ?? null,
 							currentKeys,
@@ -9581,6 +9894,13 @@ function createJourneySender(dependencies, phases = 3, host = {
 					await connection.assertCurrent(signal);
 				}
 			}
+			for (const item of observed ? [] : draft.items) {
+				const previous = snapshot.send?.items.find((entry) => entry.workId === item.workId && entry.access === item.access);
+				if (previous?.accessConflict && !item.accessConflict) {
+					item.accessConflict = previous.accessConflict;
+					item.accessConflictSessionCount = previous.accessConflictSessionCount;
+				}
+			}
 			const canReuseExistingSend = !(snapshot.send?.confirmedAt && ["blocked", "paused"].includes(snapshot.send.status)) && !recover && snapshot.send && scopeDigest(snapshot.journey) === snapshot.send.scopeDigest && snapshot.send.subject === draft.subject;
 			const next = pending ? {
 				...draft,
@@ -9589,6 +9909,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 				request: pending.request
 			} : canReuseExistingSend && snapshot.send ? {
 				...snapshot.send,
+				...snapshot.send.confirmedAt === null ? { items: draft.items } : {},
 				revision: snapshot.send.revision + 1
 			} : draft;
 			const result = await dependencies.storage.commitSend({
@@ -9619,7 +9940,7 @@ function createJourneySender(dependencies, phases = 3, host = {
 			const authorizationError = await requestError(dependencies, snapshot.send, hostId, signal);
 			if (snapshot.send.request && !snapshot.send.confirmedAt && (authorizationError || !requestMatches(snapshot.send, snapshot.journey))) return block(snapshot, snapshot.send, authorizationError ?? "REVISION_CONFLICT");
 			assertScope(snapshot.journey, snapshot.send);
-			if (!sameIds$1(input.confirmedWorkIds, snapshot.send.items.map((item) => item.workId)) || !sameIds$1(input.confirmedOmittedWorkIds, snapshot.send.omitted.map((item) => item.workId)) || input.scopeDigest !== snapshot.send.scopeDigest || snapshot.send.items.length === 0) throw new ApplicationError("CONFIRMATION_REQUIRED");
+			if (!sameIds$1(input.confirmedWorkIds, snapshot.send.items.map((item) => item.workId)) || !sameIds$1(input.confirmedOmittedWorkIds, snapshot.send.omitted.map((item) => item.workId)) || input.scopeDigest !== snapshot.send.scopeDigest || snapshot.send.items.length === 0 || snapshot.send.items.some((item) => item.accessConflict !== void 0)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 			if (snapshot.send.confirmedAt !== null) return saveStart(snapshot.send);
 			const connection = await dependencies.auth.connect(signal);
 			if (snapshot.send.request && (connection?.subject ?? null) !== snapshot.send.request.subject) return saveSend(dependencies, snapshot, {
@@ -9728,6 +10049,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 					...snapshot,
 					status: "applied"
 				};
+				if (!host.serving && hostDrives(snapshot.send) && await host.focused?.(address.journeyId)) return {
+					...snapshot,
+					status: "applied"
+				};
 				const authorizationError = await requestError(dependencies, snapshot.send, hostId, lifetime);
 				if (authorizationError) return block(snapshot, snapshot.send, authorizationError);
 				if (snapshot.send.request && !snapshot.send.confirmedAt && ["awaiting-packaging", "prepared"].includes(snapshot.send.status)) {
@@ -9742,10 +10067,52 @@ function createJourneySender(dependencies, phases = 3, host = {
 						error: "REVISION_CONFLICT"
 					});
 					if (snapshot.send.status === "awaiting-packaging") {
-						if (await dependencies.package?.(address.journeyId, snapshot.send.request.included.map((item) => item.workId), lifetime, snapshot.send.request.source) === false) return {
-							...await load(address),
+						if (packagingRetry?.key !== key) packagingRetry = void 0;
+						if (packagingRetry && Date.parse(dependencies.now()) < packagingRetry.after) return {
+							...snapshot,
 							status: "applied"
 						};
+						let packaged;
+						try {
+							packaged = await dependencies.package?.(address.journeyId, snapshot.send.request.included.map((item) => item.workId), lifetime, snapshot.send.request.source);
+						} catch (cause) {
+							lifetime.throwIfAborted();
+							const code = cause instanceof ApplicationError ? cause.code : safeCode(cause);
+							if (packagingRefusalCodes.includes(code)) throw cause;
+							dependencies.failure(code, cause);
+							snapshot = await load(address);
+							if (snapshot.send.status !== "awaiting-packaging") return {
+								...snapshot,
+								status: "stale"
+							};
+							const error = await requestError(dependencies, snapshot.send, hostId, lifetime);
+							if (error || !requestMatches(snapshot.send, snapshot.journey)) return block(snapshot, snapshot.send, error ?? "REVISION_CONFLICT");
+							if (finalPackagingCodes.includes(code)) {
+								packagingRetry = void 0;
+								return block(snapshot, snapshot.send, code);
+							}
+							const failures = Math.min((packagingRetry?.failures ?? 0) + 1, 5);
+							packagingRetry = {
+								key,
+								failures,
+								after: Date.parse(dependencies.now()) + Math.min(2e3 * 2 ** (failures - 1), 3e4)
+							};
+							return saveSend(dependencies, snapshot, {
+								...snapshot.send,
+								error: code
+							});
+						}
+						packagingRetry = void 0;
+						if (packaged === false) {
+							snapshot = await load(address);
+							return snapshot.send.error ? saveSend(dependencies, snapshot, {
+								...snapshot.send,
+								error: null
+							}) : {
+								...snapshot,
+								status: "applied"
+							};
+						}
 						snapshot = await load(address);
 						if (snapshot.send.status !== "awaiting-packaging") return {
 							...snapshot,
@@ -9759,6 +10126,10 @@ function createJourneySender(dependencies, phases = 3, host = {
 						if (prepared.status === "stale" || prepared.send?.status !== "prepared") return prepared;
 						snapshot = requireSend(prepared);
 					}
+					if (snapshot.send.items.some((item) => item.accessConflict)) return saveSend(dependencies, snapshot, {
+						...snapshot.send,
+						request: void 0
+					});
 					if (!requestMatches(snapshot.send, snapshot.journey) || !requestedItemsMatch(snapshot.send, snapshot.journey)) return saveSend(dependencies, snapshot, {
 						...snapshot.send,
 						status: "blocked",
@@ -9796,10 +10167,6 @@ function createJourneySender(dependencies, phases = 3, host = {
 }
 //#endregion
 //#region apps/cli/src/account/journey/auth.ts
-/** An access token this close to expiry is renewed first, so a step never starts on it. */
-const renewBeforeMs = 12e4;
-const renewTimeoutMs = 3e4;
-const renewals = /* @__PURE__ */ new WeakMap();
 /** Reuses the existing device sign-in credential; a token is never returned to the panel or Agent. */
 function createJourneySendAuth(account, requestFetch) {
 	/**
@@ -9826,39 +10193,11 @@ function createJourneySendAuth(account, requestFetch) {
 			return value;
 		})).credential?.refreshToken) await expire(accessToken);
 	}
-	function renew(credential) {
-		const running = renewals.get(account);
-		if (running) return running;
-		const renewing = (async () => {
-			try {
-				const token = await account.identity.refresh(credential.refreshToken, AbortSignal.timeout(renewTimeoutMs));
-				if (!token) {
-					await expire(credential.accessToken);
-					return null;
-				}
-				return (await account.credentials.update((value) => {
-					if (value.credential?.refreshToken === credential.refreshToken) value.credential = {
-						...value.credential,
-						accessToken: token.accessToken,
-						refreshToken: token.refreshToken ?? credential.refreshToken,
-						scope: token.scope,
-						issuedAt: account.now(),
-						expiresAt: token.expiresAt
-					};
-					return value;
-				})).credential;
-			} finally {
-				renewals.delete(account);
-			}
-		})();
-		renewals.set(account, renewing);
-		return renewing;
-	}
 	async function current() {
 		const credential = (await account.credentials.update((value) => value)).credential;
 		if (!credential || credential.identityUrl !== account.configuration.identityUrl || credential.clientId !== account.configuration.clientId) return null;
 		const left = Date.parse(credential.expiresAt) - Date.parse(account.now());
-		if (Number.isFinite(left) && left > renewBeforeMs) return credential;
+		if (Number.isFinite(left) && left > 12e4) return credential;
 		const { refreshToken } = credential;
 		if (!refreshToken) {
 			if (Number.isFinite(left) && left > 0) return credential;
@@ -9866,7 +10205,7 @@ function createJourneySendAuth(account, requestFetch) {
 			return null;
 		}
 		try {
-			return await renew({
+			return await renew(account, {
 				...credential,
 				refreshToken
 			});
@@ -9916,6 +10255,136 @@ function createJourneySendAuth(account, requestFetch) {
 	};
 }
 //#endregion
+//#region apps/cli/src/account/journey/account-access.ts
+/**
+* Whole scope-confirm account read: identity, every inventory page and a token refresh. A 203-Work,
+* 1,400-session account took 2.3 to 3.4 s for its pages plus a refresh, past the earlier 5 s
+* (issue #53). On expiry the read is `unavailable` (ADR 0277 section 5).
+*/
+const accountReadBoundMs = 3e4;
+const ownerBodyErrors = /* @__PURE__ */ new Set(["OWNER_EMPTY_RESPONSE", "OWNER_RESPONSE_LIMIT"]);
+/** Why the read failed, from error types and codes only; messages are never logged. */
+function failureClass(error, depth = 0) {
+	if (!(error instanceof Error)) return "other";
+	if (error.name === "TimeoutError") return "timeout";
+	if (isCode(error, "ACCOUNT_SIGNED_OUT") || isCode(error, "IDENTITY_REJECTED")) return "signed-out";
+	if (error instanceof JourneyRemoteError) {
+		if (error.status === 401 || error.status === 403) return "signed-out";
+		return error.status >= 500 || error.status === 429 ? "network" : "protocol";
+	}
+	if (isCode(error, "IDENTITY_UNAVAILABLE") && isInterrupted(error.cause)) return failureClass(error.cause, 1);
+	if (isCode(error, "IDENTITY_UNAVAILABLE") || error instanceof SyntaxError || ownerBodyErrors.has(error.message)) return "protocol";
+	if (isInterrupted(error)) return "network";
+	return depth === 0 && error.cause !== void 0 ? failureClass(error.cause, 1) : "other";
+}
+/** Current and legacy upload keys of every part of one local session. */
+async function keysOf(session) {
+	const keys = [];
+	for (const part of session.parts.length ? session.parts : [void 0]) {
+		const native = part?.nativeEvidence?.identity;
+		const identity = {
+			harness: session.harness,
+			nativeSessionId: native?.sessionId ?? session.sourceSessionId,
+			...part?.harnessRelativePath ? { relativePath: part.harnessRelativePath } : {},
+			...session.harness === "claude" && native?.role === "worker" ? { workerIdentity: { agentId: native.agentId } } : {}
+		};
+		const { workerIdentity: _, ...original } = identity;
+		keys.push([await sessionKeyFor(identity), await sessionKeyFor(original)]);
+	}
+	return keys;
+}
+/**
+* Compare frozen identities with the same hashed keys used by session uploads. A Work sends each
+* root's whole family (`members`, from `reviewFamilies`), so uniform Public is `public-all` only
+* when every part of every member is held; any key without history keeps it `public` (ADR 0275).
+*/
+async function accountAccessForRoots(state, roots, inventory, members) {
+	const sessions = new Map(roots.map((session) => [session.id, session]));
+	const held = /* @__PURE__ */ new Map();
+	for (const work of inventory.works) for (const session of work.sessions) {
+		const access = held.get(session.key) ?? /* @__PURE__ */ new Set();
+		access.add(work.access);
+		held.set(session.key, access);
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const work of state.works) {
+		const access = /* @__PURE__ */ new Set();
+		let known = 0;
+		let unknown = 0;
+		for (const id of work.rootSessionIds) {
+			const root = sessions.get(id);
+			if (!root) throw new ApplicationError("CORRUPTED_STATE");
+			for (const session of members.get(id) ?? [root]) for (const [key, legacyKey] of await keysOf(session)) {
+				const values = /* @__PURE__ */ new Set([...held.get(key) ?? [], ...held.get(legacyKey) ?? []]);
+				if (!values.size) {
+					unknown++;
+					continue;
+				}
+				known++;
+				for (const value of values) access.add(value);
+			}
+		}
+		if (!known) continue;
+		const uniform = access.size === 1;
+		result.set(work.id, uniform && access.has("private") ? "private" : uniform && access.has("public") ? unknown === 0 ? "public-all" : "public" : "mixed");
+	}
+	return result;
+}
+/**
+* Existing authenticated owner ports supply inventory. The result is three-way (ADR 0277 section
+* 5): a caller stops on `signed-out` or `unavailable` instead of using model access.
+*/
+function createAccountAccess(storage, auth) {
+	return async (state, signal) => {
+		const started = Date.now();
+		const controller = new AbortController();
+		const boundedSignal = AbortSignal.any([signal, controller.signal]);
+		let timer;
+		let onAbort = () => {};
+		const stopped = new Promise((_resolve, reject) => {
+			onAbort = () => reject(/* @__PURE__ */ new Error("ACCOUNT_ACCESS_CANCELLED"));
+			boundedSignal.addEventListener("abort", onAbort, { once: true });
+			if (boundedSignal.aborted) onAbort();
+			timer = setTimeout(() => controller.abort(), accountReadBoundMs);
+		});
+		const read = async () => {
+			boundedSignal.throwIfAborted();
+			const connection = await auth.connect(boundedSignal);
+			if (!connection?.sessions) return { status: "signed-out" };
+			const plan = (await storage.resources({
+				journeyId: state.journeyId,
+				kind: "plan"
+			}))[0];
+			if (plan?.kind !== "plan") throw new ApplicationError("SCOPE_NOT_READY");
+			const inventory = await connection.sessions.inventory(boundedSignal);
+			const access = await accountAccessForRoots(state, plan.approval.inventory.sessions, inventory, reviewFamilies(plan.approval.inventory).members);
+			await connection.assertCurrent(boundedSignal);
+			return {
+				status: "read",
+				subject: connection.subject,
+				access
+			};
+		};
+		try {
+			return await Promise.race([read(), stopped]);
+		} catch (error) {
+			if (error instanceof ApplicationError && ![
+				"ACCOUNT_SIGNED_OUT",
+				"IDENTITY_REJECTED",
+				"IDENTITY_UNAVAILABLE",
+				"CREDENTIAL_STORE_FAILED"
+			].includes(error.code)) throw error;
+			const reason = signal.aborted ? "cancelled" : controller.signal.aborted ? "timeout" : failureClass(error);
+			console.error(`ACCOUNT_ACCESS_UNAVAILABLE: account read failed (class=${reason} elapsedMs=${Date.now() - started})`);
+			return { status: reason === "signed-out" ? "signed-out" : "unavailable" };
+		} finally {
+			clearTimeout(timer);
+			boundedSignal.removeEventListener("abort", onAbort);
+			controller.abort();
+		}
+	};
+}
+//#endregion
 //#region apps/cli/src/operation/protocol.ts
 const sourceExclusionReasonSchema = z.enum([
 	"guardian-excluded",
@@ -10511,6 +10980,9 @@ async function readJson(response, where) {
 			}
 			chunks.push(next.value);
 		}
+	} catch (error) {
+		if (error instanceof ApplicationError) throw error;
+		throw unavailable(`${where} body read failed`, error);
 	} finally {
 		reader.releaseLock();
 	}
@@ -11040,7 +11512,8 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 				code: safeCode(error),
 				at: (/* @__PURE__ */ new Date()).toISOString(),
 				stage,
-				...operationId ? { operationId } : {}
+				...operationId ? { operationId } : {},
+				...processingSite(error)
 			};
 			summary(diagnostic);
 			if (closed) {
@@ -11076,14 +11549,18 @@ function createDiagnostics(stateDir, writeSummary, onFatal) {
 			}
 		},
 		onDiagnostic(diagnostic, error) {
-			summary(diagnostic);
+			const named = {
+				...diagnostic,
+				...processingSite(error)
+			};
+			summary(named);
 			if (closed) {
-				unavailable(diagnostic);
+				unavailable(named);
 				return;
 			}
 			try {
 				local.logger.error({
-					...diagnostic,
+					...named,
 					error: errorDetail(error)
 				});
 			} catch {
@@ -11545,6 +12022,8 @@ async function compose(options, callbacks, bundles) {
 			onFatal: fatalStore.fail
 		});
 		const account = createAccount(accountPorts);
+		const sendAuth = createJourneySendAuth(accountPorts);
+		const accountAccess = createAccountAccess(journeyStorage, sendAuth);
 		const application = createApplication({
 			sessionPeriod: options.sessionPeriod,
 			journeySender: createJourneySender({
@@ -11561,7 +12040,7 @@ async function compose(options, callbacks, bundles) {
 					}
 				}),
 				artifacts: createJourneySendArtifacts(journeyStorage),
-				auth: createJourneySendAuth(accountPorts),
+				auth: sendAuth,
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
 				failure: (code, cause) => diagnostics.onFailure(code, cause),
 				sessionTransfer: (workId, transfer) => diagnostics.onActivity({
@@ -11584,18 +12063,29 @@ async function compose(options, callbacks, bundles) {
 					phases: { upload: elapsedMs },
 					volumes: { bytes }
 				})
-			}, void 0, sendHost),
+			}, void 0, sendHost.serving ? sendHost : {
+				...sendHost,
+				focused: (journeyId) => focusedHostAlive(stateDir, journeyId, async () => (await journeyStorage.current())?.journeyId)
+			}),
 			manualUploader: createManualUploader({
 				storage: store.manualUpload,
 				artifacts: createManualUploadArtifacts({ getDeliverySources: () => application.getDeliverySources() }),
-				auth: createJourneySendAuth(accountPorts),
+				auth: sendAuth,
 				now: () => (/* @__PURE__ */ new Date()).toISOString(),
 				failure: (code, cause) => diagnostics.onFailure(code, cause)
 			}),
 			journeyLocal: {
+				accountAccess,
+				async accountState() {
+					const view = await account.status();
+					return {
+						configured: view.configuration.clientId !== null,
+						subject: view.state === "signed-in" ? view.identityId : null
+					};
+				},
 				titles: createJourneyTitles(journeyStorage, processing),
 				describe: createJourneyDescription(journeyStorage, processing),
-				works: createJourneyWorks(journeyStorage, processing, stateDir),
+				works: createJourneyWorks(journeyStorage, processing, stateDir, accountAccess),
 				hide: createJourneyHide({
 					storage: journeyStorage,
 					execution,
@@ -11864,7 +12354,14 @@ async function invoke(runtime, command, value, signal) {
 		case "journey.findingImpact": return app.journey?.findingImpact(value);
 		case "journey.preview": return app.journey?.preview(value);
 		case "journey.files": return app.journey?.files(value);
-		case "journey.prepare": return app.journey?.prepare(value, signal);
+		case "journey.prepare": {
+			const input = z.object({
+				journeyId: z.uuid(),
+				result: z.literal("receipt").optional()
+			}).strict().parse(value);
+			return input.result === "receipt" ? app.journey?.prepareReceipt({ journeyId: input.journeyId }, signal) : app.journey?.prepare({ journeyId: input.journeyId }, signal);
+		}
+		case "review.reopenEmpty": return app.journey?.reopenEmpty(value);
 		case "review.terms": return app.journey?.terms(value);
 		case "review.status": return app.journey?.reviewStatus(value);
 		case "review.guidance": return app.journey?.guidance(value);
@@ -12064,4 +12561,4 @@ async function cancelOperation(runtime, id) {
 	return readOperation(runtime, id);
 }
 //#endregion
-export { permissionDiagnostic as _, readAgentPresence as a, executorRequestSchema as c, guardDetachedStartup as d, createRenderActivity as f, longCommands as g, businessCommands as h, invoke as i, awaitingPassport as l, parseOptions as m, readOperation as n, createRuntime as o, helpText as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, serveDetached as u, startupFailure as v, traceStartup as y };
+export { longCommands as _, readAgentPresence as a, traceStartup as b, executorRequestSchema as c, serveDetached as d, guardDetachedStartup as f, businessCommands as g, parseOptions as h, invoke as i, awaitingPassport as l, helpText as m, readOperation as n, createRuntime as o, createRenderActivity as p, waitOperation as r, executorEventSchema as s, cancelOperation as t, hostDrives as u, permissionDiagnostic as v, startupFailure as y };