@gitroll/tacitt-cli 0.6.9 → 0.6.11

package/dist/{src-DzKuzGVH.mjs → src-D1iONla3.mjs}

@@ -1,4 +1,4 @@
-import { $ as bCountSchema, $n as detectStatic, A as bDuplicateMirror, B as bEvidenceReader, Bt as sessionPeriodSchema, C as validateBUnit, Cn as inspectionSemanticVersions, Ct as cardsSubmitSchema, D as uncoveredBObligations, Dn as createStaticProcessor, Dt as privacyResolveSchema, E as bLiterals, Et as packageConfirmActionSchema, Fn as entityDictionaryVersion, Ft as termTypeInfo, G as subtractBRanges, Gn as validateProfile, H as codePointLength, Ht as journeyProfileAddressActionSchema, I as bIssue, It as termTypeSchema, J as bRetainedGroupSchema, Jn as validatePlan, Jt as respondProfileLinks, Kn as orderProfile, L as bOverlaps, Lt as termTypes, M as bLegacyBindings, Mt as reviewTermsResultSchema, N as bUnitFragments, Nt as termAssessmentSchema, O as indexBRanges, On as staticDefaults, Ot as privacyTermKey, P as bAdoptedObligations, Pn as cleanupImplementationVersion, Pt as termOverrideValueSchema, Q as bAnchorSchema, Qt as safeCode, R as unownedBObligations, Rt as deselectOutsidePeriod, S as validateBFields, Sn as currentDetectorVersion, St as cardsConfirmActionSchema, T as bLiteralTerms, Tn as gapReasons, Tt as emptyJourneyPrivacy, U as codePointSlice, Ut as journeyProfileLinksActionSchema, V as bDigest, Vt as emptyJourneyProfile, W as createCodePointIndex, X as bSessionDecisionSchema, Xt as ApplicationError, Y as bReviewSubmissionSchema, Yn as copyData, Yt as classificationTitleMaskSchema, Z as bTermSchema, Zt as UnfinishedJourneyError, _ as semanticFindingSchema, _t as hideConfirmSchema, a as reviewChunkSchema, an as observeSource, at as journeyExceptionSchema, b as validateBReview, bt as journeyConfigurationSchema, c as textDigest, cn as inventorySchema, cr as scalarBefore, ct as journeyPreferenceScopeSchema, dt as nativeJourneySchema, en as familyNeedsReview, et as bIdSchema, f as reviewAlignmentAuditSchema, fn as nativeSourceIdentitySchema, ft as journeyGuidanceSchema, g as validateReviewAlignment, h as reviewFindingsDigest, ht as journeyDescribeSchema, i as reviewBatchSchema, in as sourceKey, ir as createEntityMatcher, it as journeyDigestSchema, jt as reviewTermsInputSchema, kn as staticOptions, l as validateReview, lr as defaultDetectionLimits, lt as journeyProjectTypeSchema, m as reviewAlignmentSchema, mt as delegatedDecisionSchema, n as compileBFindings, nn as reviewFamilies, nt as journeyAccessSchema, o as reviewDigest, on as sourceSnapshotId, ot as journeyIdSchema, p as reviewAlignmentInputSchema, pt as journeyInstructionInputSchema, q as bRepresentationSchema, r as reviewBatchChunks, rn as sourceGraph, rt as journeyChoiceSchema, s as reviewSubmitSchema, sn as fileIdentitySchema, sr as scalarAfter, st as journeyKindSchema, tn as familySelected, tr as staticCategories, tt as bMethod, u as findingReferenceKey, un as sourcePartSchema, ut as journeyWorkTypeSchema, vt as hidePlanInputSchema, w as bLiteralAdmitted, x as createBAnalysisUnits, xt as cardAnswerActionSchema, y as validateBClassification, yt as hidePlanResourceSchema, z as bAnchorKey } from "./locate-BWkblijS.mjs";
+import { $ as bTermSchema, A as indexBRanges, At as packageConfirmActionSchema, B as unownedBObligations, Bn as cleanupImplementationVersion, Bt as termOverrideValueSchema, C as createBAnalysisUnits, Ct as hidePlanResourceSchema, D as bLiteralTerms, Dt as cardsSubmitSchema, E as bLiteralAdmitted, Et as cardsConfirmActionSchema, F as bUnitFragments, Fn as staticOptions, Ft as emptyReviewCorrectionSchema, G as codePointSlice, H as bEvidenceReader, Ht as termTypeSchema, I as bAdoptedObligations, Jt as journeyProfileAddressActionSchema, K as createCodePointIndex, Kt as sessionPeriodSchema, Lt as reviewTermsInputSchema, M as bDuplicateMirror, Mt as privacyTermKey, Nn as createStaticProcessor, O as bLiterals, On as currentDetectorVersion, P as bLegacyBindings, Pn as staticDefaults, Q as bSessionDecisionSchema, Qn as orderProfile, R as bIssue, Rt as reviewTermsResultSchema, S as validateBReview, St as hidePlanInputSchema, T as validateBUnit, Tt as cardAnswerActionSchema, U as bDigest, Ut as termTypes, V as bAnchorKey, Vn as entityDictionaryVersion, Vt as termTypeInfo, W as codePointLength, Wt as deselectOutsidePeriod, X as bRetainedGroupSchema, Y as bRepresentationSchema, Yt as journeyProfileLinksActionSchema, Z as bReviewSubmissionSchema, Zn as validateProfile, _ as reviewFindingsDigest, _t as journeyInstructionInputSchema, a as reviewBatchChunks, ar as detectStatic, at as journeyAccessSchema, c as reviewDigest, cn as reviewFamilies, ct as journeyExceptionSchema, d as validateReview, dn as observeSource, dt as journeyPreferenceScopeSchema, en as respondProfileLinks, er as validatePlan, et as bAnchorSchema, f as findingReferenceKey, fn as sourceSnapshotId, ft as journeyProjectTypeSchema, g as reviewAlignmentSchema, gn as sourcePartSchema, gt as journeyGuidanceSchema, h as reviewAlignmentInputSchema, hr as defaultDetectionLimits, ht as reviewInterruptionSchema, i as compileBFindings, in as safeCode, it as consentedWithoutAccount, jn as gapReasons, jt as privacyResolveSchema, k as uncoveredBObligations, kn as inspectionSemanticVersions, kt as emptyJourneyPrivacy, l as reviewSubmitSchema, ln as sourceGraph, lt as journeyIdSchema, m as reviewAlignmentAuditSchema, mn as inventorySchema, mr as scalarBefore, mt as nativeJourneySchema, nn as ApplicationError, nt as bIdSchema, o as reviewBatchSchema, on as familyNeedsReview, ot as journeyChoiceSchema, pn as fileIdentitySchema, pr as scalarAfter, pt as journeyWorkTypeSchema, q as subtractBRanges, qt as emptyJourneyProfile, rn as UnfinishedJourneyError, rt as bMethod, s as reviewChunkSchema, sn as familySelected, sr as staticCategories, st as journeyDigestSchema, tn as classificationTitleMaskSchema, tr as copyData, tt as bCountSchema, u as textDigest, un as sourceKey, ur as createEntityMatcher, ut as journeyKindSchema, v as validateReviewAlignment, vn as nativeSourceIdentitySchema, vt as delegatedDecisionSchema, w as validateBFields, wt as journeyConfigurationSchema, x as validateBClassification, xt as hideConfirmSchema, y as semanticFindingSchema, yt as journeyDescribeSchema, z as bOverlaps, zt as termAssessmentSchema } from "./locate-Cx52Zqxv.mjs";
 import { z } from "zod";
 import { createHash, createHmac, createSecretKey, randomUUID } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -14,6 +14,13 @@ const processingPlanSchema = z.unknown().transform((value, context) => {
 		return z.NEVER;
 	}
 });
+//#endregion
+//#region packages/application/src/processing/settings/data.ts
+/**
+* Sessions in one frozen configuration. Packaging admits at most 60,000 source parts per run
+* (the artifact's entry bound) and every selected session has a part, so this matches it.
+*/
+const maximumConfigurationSessions = 6e4;
 var SettingsError = class extends Error {
 	code;
 	field;
@@ -433,7 +440,7 @@ const staticPresets = Object.freeze([
 /** Browser-safe fixed metadata and definitions; no recognizers, native sources or session state. */
 const staticCatalogRef = Object.freeze({
 	id: "static-catalog",
-	version: "11"
+	version: "12"
 });
 //#endregion
 //#region packages/application/src/processing/settings/catalog.ts
@@ -1214,12 +1221,30 @@ function isClassifying(state) {
 * not skipped. The Skill helpers mirror this rule in `journey-state.mjs`.
 */
 function isSkippedWork(work) {
-	return work.status === "blocked" && !work.blockedCodes.includes("PRIVACY_CHANGE_PENDING");
+	return work.status === "blocked" && !work.blockedCodes.includes("PRIVACY_CHANGE_PENDING") && currentReviewInterruptions(work).length === 0;
 }
 /** A selected Work that is not skipped (ADR 0236). */
 function isIncludedWork(work) {
 	return isSelectedWork(work) && !isSkippedWork(work);
 }
+/**
+* ADR 0274: Public needs a recorded choice: the person's panel click or named conversation
+* answer (origin `explicit`), or, under ADR 0275, the account proof that every root was already
+* Public (origin and channel `account`). A Public Work stored before `accessChoice` existed is
+* still pending. Mirrored by `phaseOf` in the Skill's `journey-state.mjs` and by the panel's
+* `WorkAccess`.
+*/
+function hasPublicChoice(work) {
+	if (work.access !== "public") return true;
+	if (!work.accessConfirmed || !work.accessChoice) return false;
+	return work.accessChoice.channel === "account" ? work.accessOrigin === "account" : work.accessOrigin === "explicit";
+}
+/** ADR 0277 slice 2 display projection. Send consent remains a separate gate. */
+function publicSource(work) {
+	if (!isIncludedWork(work) || work.access !== "public" || work.accountAccessConflict) return null;
+	if (!hasPublicChoice(work)) return "suggestion";
+	return work.accessChoice?.channel === "account" ? "account" : "choice";
+}
 function selectedWorks(state) {
 	return state.works.filter(isSelectedWork);
 }
@@ -1235,9 +1260,13 @@ function hasCertifiedNoBatchReview(work, snapshotId) {
 	const roots = proofs.flatMap((proof) => proof.rootSessionIds);
 	return roots.length === work.rootSessionIds.length && new Set(roots).size === roots.length && work.rootSessionIds.every((id) => roots.includes(id));
 }
+/** A reused Work ID cannot carry an old input generation's failed review forward. */
+function currentReviewInterruptions(work) {
+	return (work.reviewInterruptions ?? []).filter((item) => item.inputRevision === work.inputRevision);
+}
 /** Reading completes over included Works once the person has confirmed the scan scope. */
 function isReadingComplete(state) {
-	return state.scope.status === "confirmed" && state.works.length > 0 && !isClassifying(state) && state.works.filter(isIncludedWork).every((work) => work.status !== "pending" && work.status !== "blocked" && (work.totalBatches > 0 || hasCertifiedNoBatchReview(work, state.snapshotId)) && work.completedBatches === work.totalBatches);
+	return state.scope.status === "confirmed" && state.works.length > 0 && !isClassifying(state) && state.works.filter(isIncludedWork).every((work) => currentReviewInterruptions(work).length === 0 && work.status !== "pending" && work.status !== "blocked" && (work.totalBatches > 0 || hasCertifiedNoBatchReview(work, state.snapshotId)) && work.completedBatches === work.totalBatches);
 }
 /** Recompute completion after a selection or reading change without leaving a paused/send phase. */
 function withReadingProgress(state) {
@@ -1466,6 +1495,26 @@ const sendItemSchema = z.object({
 		title: z.string(),
 		access
 	}).strict().optional(),
+	/** Safe preflight facts; local requested-access conflicts have no account owner. */
+	accessConflict: z.object({
+		sessionKey: journeyDigestSchema,
+		requestedAccess: access,
+		accountWorkId: journeyIdSchema.nullable(),
+		accountAccess: z.enum([
+			"public",
+			"private",
+			"removed",
+			"mixed"
+		]).nullable(),
+		rule: z.enum([
+			"held-elsewhere",
+			"destination-access",
+			"requested-access",
+			"content-access"
+		])
+	}).strict().optional(),
+	/** Distinct conflicting session keys across all rules and account holders. */
+	accessConflictSessionCount: count$13.positive().optional(),
 	/** Membership readback retained for visible conflict recovery. */
 	membershipConflict: z.object({
 		revision: count$13,
@@ -1721,6 +1770,16 @@ const journeyPropagateActionSchema = z.object({
 //#region packages/application/src/journey/scope/model.ts
 const count$11 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const safeText = z.string().trim().min(1).max(240);
+/**
+* One Work's stored account access (ADR 0274 D3(b), refined by ADR 0275): `public-all` when
+* every root key is held Public, `public` when the held keys are Public and other roots are new.
+*/
+const accountWorkAccessSchema = z.enum([
+	"private",
+	"public",
+	"public-all",
+	"mixed"
+]);
 const journeyScopeConfirmActionSchema = z.object({ kind: z.literal("scope-confirm") }).strict();
 const journeyWorkTypeActionSchema = z.object({
 	kind: z.literal("work-type"),
@@ -1730,7 +1789,11 @@ const journeyWorkTypeActionSchema = z.object({
 const journeyWorksAccessActionSchema = z.object({
 	kind: z.literal("works-access"),
 	workIds: z.array(journeyIdSchema).min(1).max(1e4),
-	access: journeyAccessSchema
+	access: journeyAccessSchema,
+	accessChoice: z.object({
+		channel: z.literal("conversation"),
+		at: z.iso.datetime()
+	}).strict().optional()
 }).strict();
 /** Static-only Work facts for proposing project types and scan scope; no source bodies. */
 const journeyCatalogQuerySchema = z.object({
@@ -1857,7 +1920,23 @@ const nativeStartSchema = z.object({
 	period: sessionPeriodSchema.optional()
 }).strict();
 const nativeGetSchema = z.object({ journeyId: journeyIdSchema.optional() }).strict();
+const retryReviewActionSchema = reviewInterruptionSchema.pick({
+	packId: true,
+	inputRevision: true
+}).extend({
+	kind: z.literal("retry-review"),
+	workId: journeyIdSchema
+});
 const journeyActionSchema = z.discriminatedUnion("kind", [
+	reviewInterruptionSchema.extend({
+		kind: z.literal("review-interrupted"),
+		workId: journeyIdSchema
+	}),
+	reviewInterruptionSchema.omit({ reason: true }).extend({
+		kind: z.literal("review-reader-closed"),
+		workId: journeyIdSchema
+	}),
+	retryReviewActionSchema,
 	journeySplitActionSchema,
 	journeyMergeActionSchema,
 	journeyPropagateActionSchema,
@@ -1870,6 +1949,7 @@ const journeyActionSchema = z.discriminatedUnion("kind", [
 		kind: z.literal("consent"),
 		allow: z.boolean()
 	}).strict(),
+	z.object({ kind: z.literal("account-read") }).strict(),
 	z.object({ kind: z.literal("abandon") }).strict(),
 	z.object({
 		kind: z.literal("delegate"),
@@ -1930,7 +2010,11 @@ const journeyActionSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("work-access"),
 		workId: journeyIdSchema,
-		access: journeyAccessSchema
+		access: journeyAccessSchema,
+		accessChoice: z.object({
+			channel: z.literal("conversation"),
+			at: z.iso.datetime()
+		}).strict().optional()
 	}).strict(),
 	z.object({
 		kind: z.literal("work-title"),
@@ -2047,15 +2131,24 @@ function privacyDecisionDigest(state) {
 	return digest;
 }
 function assertJourneyScanned(state) {
-	if (!state.consent || state.scope.status !== "confirmed" || !state.readingComplete || state.works.some((work) => isIncludedWork(work) && (!work.classificationMetadata || work.totalBatches === 0 && !hasCertifiedNoBatchReview(work, state.snapshotId) || work.completedBatches !== work.totalBatches || work.status === "blocked"))) throw new ApplicationError("SCOPE_NOT_READY");
+	if (!state.consent || state.scope.status !== "confirmed" || !state.readingComplete || state.works.some((work) => isIncludedWork(work) && (currentReviewInterruptions(work).length > 0 || !work.classificationMetadata || work.totalBatches === 0 && !hasCertifiedNoBatchReview(work, state.snapshotId) || work.completedBatches !== work.totalBatches || work.status === "blocked"))) throw new ApplicationError("SCOPE_NOT_READY");
+}
+/** Legacy model, delegate or unrecorded confirmation is not the person's Public choice. */
+function assertPublicChoices(state) {
+	if (state.works.some((work) => isIncludedWork(work) && !hasPublicChoice(work))) throw new ApplicationError("SCOPE_NOT_READY");
 }
 /** Track B (ADR 0172): preview and packaging need every selected Work's static base. */
 function assertJourneyStaticReady(state) {
 	if (state.works.some((work) => work.access !== "drop" && work.rootSessionIds.length > 0 && !isSkippedWork(work) && !hasCurrentStaticReview(state, work))) throw new ApplicationError("SCOPE_NOT_READY");
 }
-/** Cards need only Track A, AI review and metadata; this final gate also needs Track B. */
-function assertJourneyPrivacyReady(state, packaging = false) {
+/**
+* Cards need only Track A, AI review and metadata; this final gate also needs Track B.
+* `publicChoices` defaults to `packaging`: the Send click checks it before packaging, and the
+* follow-up of an already uploaded Send skips it because nothing more goes out (ADR 0274).
+*/
+function assertJourneyPrivacyReady(state, packaging = false, { publicChoices = packaging } = {}) {
 	assertJourneyScanned(state);
+	if (publicChoices) assertPublicChoices(state);
 	if (activePrivacyTerms(state).some((term) => term.disposition === "pending") || state.privacy.cards.length > 0 && (state.privacy.cards.some((card) => !card.answer) || state.privacy.confirmedAnswersRevision !== state.privacy.answersRevision)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 	assertJourneyStaticReady(state);
 	if (packaging && state.privacy.packageApproval !== privacyDecisionDigest(state)) throw new ApplicationError("CONFIRMATION_REQUIRED");
@@ -2085,15 +2178,23 @@ function appendDecisionCards(state, input) {
 	const open = new Set(activePrivacyTerms(state).filter((term) => term.disposition === "pending").map(privacyTermKey).filter((key) => !coveredBefore.has(key)));
 	const extend = input.extend ?? [];
 	const covered = [...input.cards.flatMap((card) => card.termKeys), ...extend.flatMap((item) => item.termKeys)];
-	if (!covered.length || state.privacy.cards.length + input.cards.length > 20 || new Set(input.cards.map((card) => card.id)).size !== input.cards.length || input.cards.some((card) => existing.has(card.id)) || new Set(extend.map((item) => item.cardId)).size !== extend.length || extend.some((item) => !existing.has(item.cardId)) || new Set(covered).size !== covered.length || covered.some((key) => !open.has(key))) throw new ApplicationError("INVALID_SELECTION");
+	if (!covered.length) throw new ApplicationError("INVALID_SELECTION", "cards.append.empty");
+	if (state.privacy.cards.length + input.cards.length > 20) throw new ApplicationError("INVALID_SELECTION", "cards.append.limit");
+	if (new Set(input.cards.map((card) => card.id)).size !== input.cards.length) throw new ApplicationError("INVALID_SELECTION", "cards.append.duplicate-card");
+	if (input.cards.some((card) => existing.has(card.id))) throw new ApplicationError("INVALID_SELECTION", "cards.append.existing-card");
+	if (new Set(extend.map((item) => item.cardId)).size !== extend.length) throw new ApplicationError("INVALID_SELECTION", "cards.append.duplicate-extension");
+	if (extend.some((item) => !existing.has(item.cardId))) throw new ApplicationError("INVALID_SELECTION", "cards.append.unknown-card");
+	if (new Set(covered).size !== covered.length) throw new ApplicationError("INVALID_SELECTION", "cards.append.duplicate-term");
+	if (covered.some((key) => !open.has(key))) throw new ApplicationError("INVALID_SELECTION", "cards.append.term-not-open");
 	const terms = new Map(state.privacy.terms.map((term) => [privacyTermKey(term), term]));
 	const ownValues = ownIdentityValues(state);
 	for (const extension of extend) {
 		const ownCard = !!state.privacy.cards.find((item) => item.id === extension.cardId)?.termKeys.some((key) => terms.get(key)?.type === "own-identity");
-		if (extension.termKeys.some((key) => {
+		for (const key of extension.termKeys) {
 			const term = terms.get(key);
-			return term?.type === "own-identity" ? !ownCard : term?.type === "people" && ownCard && !ownValues.has(identityValue(term.value));
-		})) throw new ApplicationError("INVALID_SELECTION");
+			if (term?.type === "own-identity" && !ownCard) throw new ApplicationError("INVALID_SELECTION", "cards.append.own-identity-card");
+			if (term?.type === "people" && ownCard && !ownValues.has(identityValue(term.value))) throw new ApplicationError("INVALID_SELECTION", "cards.append.other-person");
+		}
 	}
 	const additions = new Map(extend.map((item) => [item.cardId, item.termKeys]));
 	const inherited = new Map(extend.flatMap((item) => item.termKeys.map((key) => [key, item.cardId])));
@@ -2303,6 +2404,7 @@ function respondPrivacy(state, action, source) {
 		};
 	}
 	if (action.kind === "package-confirm") {
+		assertPublicChoices(state);
 		assertJourneyPrivacyReady(state);
 		return {
 			...state,
@@ -2356,7 +2458,7 @@ const journeyRenderSchema = z.object({
 /** One Work, or several in one call where each Work renders or fails on its own. */
 const journeyRenderInputSchema = z.union([journeyRenderSchema, z.object({
 	journeyId: journeyIdSchema,
-	workIds: z.array(journeyIdSchema).min(1).max(256)
+	workIds: z.array(journeyIdSchema).min(1).max(maximumConfigurationSessions)
 }).strict()]);
 const journeyPreviewSchema = journeyRenderSchema.extend({ cursor: z.object({
 	sha256: journeyDigestSchema,
@@ -2531,6 +2633,45 @@ const preparationSettlementSchema = z.object({
 	...binding,
 	facts: preparationFactsSchema
 }).strict();
+const preparationStateSchema = nativeJourneySchema.pick({
+	journeyId: true,
+	revision: true,
+	classificationRevision: true,
+	phase: true,
+	snapshotId: true,
+	scope: true,
+	consent: true,
+	pendingHideId: true,
+	configurationId: true,
+	works: true,
+	exceptions: true,
+	instructions: true,
+	instructionsRevision: true,
+	readingComplete: true,
+	readingStartedAt: true,
+	period: true,
+	adapters: true,
+	reviewMethod: true
+});
+const preparationPermissionSchema = nativeJourneySchema.pick({
+	destination: true,
+	consent: true,
+	phase: true,
+	scope: true,
+	pendingHideId: true
+});
+const preparationUpdateSchema = z.object({
+	journeyId: journeyIdSchema,
+	expectedRevision: preparationCountSchema,
+	requestKey: journeyIdSchema,
+	at: z.iso.datetime(),
+	kind: z.enum(["snapshot", "batch"]),
+	works: z.array(nativeJourneySchema.shape.works.element),
+	phase: nativeJourneySchema.shape.phase,
+	readingComplete: z.boolean(),
+	readingStartedAt: nativeJourneySchema.shape.readingStartedAt,
+	clearPackageApproval: z.boolean()
+}).strict();
 function emptyPreparationFacts() {
 	return {
 		stage: "capture",
@@ -2557,1335 +2698,1727 @@ function validatePreparationFacts(start, facts) {
 	if (facts.unsupported.evaluated > start.sourceParts || facts.emptyReviewRoots.evaluated > start.reviewRoots || facts.unsupported.known + facts.resourceLimited.known + facts.excluded.known > facts.unsupported.evaluated) throw new ApplicationError("CORRUPTED_STATE");
 }
 //#endregion
-//#region packages/application/src/journey/inventory/schema.ts
-const journeyInventoryQuerySchema = z.object({ journeyId: journeyIdSchema }).strict();
-/** Trusted host binding, never accepted by the public command schema. */
-const journeyInventoryReadSchema = journeyInventoryQuerySchema.extend({ expectedDestination: z.string().min(1).optional() }).strict();
-const discoveryWarningCodeSchema = z.enum([
-	"UNSUPPORTED_SOURCE_ENCODING",
-	"SKIPPED_NONREGULAR_SOURCE",
-	"WORKFLOW_JOURNAL_EXCLUDED",
-	"AUTOMATIC_HELPER_EXCLUDED",
-	"UNRESOLVED_WORKERS_EXCLUDED",
-	"METADATA_LIMIT",
-	"METADATA_DEPTH_LIMIT",
-	"INCOMPLETE_DISCOVERY",
-	"DISCOVERY_ENTRY_LIMIT",
-	"DISCOVERY_DEPTH_LIMIT",
-	"BROKEN_SOURCE_LINK"
-]);
-const evidence = z.object({
-	known: preparationCountSchema,
-	total: preparationCountSchema.nullable()
-}).strict().refine((value) => value.total === null || value.total === value.known);
-const workPreparationObservationSchema = z.object({
+//#region packages/application/src/journey/correction/model.ts
+/** Original field-relative code-point coordinates, end-exclusive, exactly as B anchors. */
+const correctionAnchorSchema = z.object({
+	fieldId: bIdSchema,
+	recordId: bIdSchema,
+	fieldHash: journeyDigestSchema,
+	start: bCountSchema,
+	end: bCountSchema,
+	quote: z.string().min(1).max(4096)
+}).strict();
+const correctionReportSchema = z.object({
+	id: journeyIdSchema,
 	workId: journeyIdSchema,
-	inputRevision: preparationCountSchema.min(1),
-	observation: z.enum([
-		"unavailable",
-		"incomplete",
-		"settled"
-	]),
-	stage: preparationStageSchema.nullable(),
-	sourceParts: z.object({
-		unsupported: evidence,
-		resourceLimited: evidence,
-		excluded: evidence,
-		unclassified: preparationCountSchema
-	}).strict(),
-	emptyReviewRoots: evidence,
-	unevaluatedReviewRoots: preparationCountSchema
+	inputRevision: z.number().int().min(1),
+	batchId: journeyIdSchema,
+	groupId: journeyIdSchema,
+	kind: journeyKindSchema,
+	reason: z.string().trim().min(1).max(1e3),
+	anchors: z.array(correctionAnchorSchema).min(1).max(256)
 }).strict();
-const journeyInventorySchema = z.object({
+const reviewCorrectSchema = z.object({
 	journeyId: journeyIdSchema,
-	revision: preparationCountSchema,
-	snapshotId: journeyDigestSchema.nullable(),
-	frozen: z.object({
-		retainedSessions: preparationCountSchema,
-		reviewRoots: preparationCountSchema,
-		identifiedMainRoots: preparationCountSchema,
-		unknownRoleRoots: preparationCountSchema,
-		attachedSubagents: preparationCountSchema,
-		unresolvedWorkerSessions: preparationCountSchema,
-		sourceParts: preparationCountSchema,
-		frozenSourceBytes: preparationCountSchema,
-		discoveryUnsupportedInputs: z.null(),
-		discoverySkippedInputs: z.null(),
-		discoverySkippedSourceBytes: z.null(),
-		warningOccurrences: z.array(z.object({
-			code: discoveryWarningCodeSchema,
-			occurrences: preparationCountSchema
-		}).strict())
-	}).strict().nullable(),
-	captures: z.object({
-		targetParts: preparationCountSchema,
-		capturedParts: preparationCountSchema,
-		capturedBytes: preparationCountSchema,
-		completeCapturedBytes: preparationCountSchema.nullable()
-	}).strict().nullable(),
-	workScope: z.object({
-		total: preparationCountSchema,
-		byStatus: z.object({
-			pending: preparationCountSchema,
-			reading: preparationCountSchema,
-			review: preparationCountSchema,
-			ready: preparationCountSchema,
-			blocked: preparationCountSchema
-		}).strict(),
-		byAccess: z.object({
-			public: preparationCountSchema,
-			private: preparationCountSchema,
-			drop: preparationCountSchema
-		}).strict(),
-		assignedReviewRoots: preparationCountSchema,
-		unassignedReviewRoots: preparationCountSchema.nullable(),
-		excludedAutomationRoots: preparationCountSchema.nullable(),
-		unassignedOtherRoots: preparationCountSchema.nullable()
-	}).strict(),
-	preparation: z.array(workPreparationObservationSchema)
+	expectedRevision: z.number().int().nonnegative(),
+	idempotencyKey: journeyIdSchema,
+	report: correctionReportSchema
 }).strict();
-/** Panel preparation counts over the selected Works: opaque Work IDs, parts and bytes only. */
-const journeyPreparationProgressSchema = z.object({
-	currentWorkIds: z.array(journeyIdSchema),
-	targetParts: preparationCountSchema,
-	capturedParts: preparationCountSchema,
-	targetBytes: preparationCountSchema,
-	capturedBytes: preparationCountSchema
+/** Immutable private report receipt; the only place where correction quotes are retained. */
+const correctionReportResourceSchema = z.object({
+	journeyId: journeyIdSchema,
+	kind: z.literal("correction-report"),
+	id: journeyIdSchema,
+	requestHash: journeyDigestSchema,
+	at: z.iso.datetime(),
+	snapshotId: journeyDigestSchema,
+	batchDigest: journeyDigestSchema,
+	decisionDigest: journeyDigestSchema,
+	report: correctionReportSchema
+}).strict();
+const correctionAuditSchema = z.object({
+	reportId: journeyIdSchema,
+	action: z.enum([
+		"report",
+		"hide",
+		"dismiss"
+	]),
+	actor: z.enum([
+		"observer",
+		"human",
+		"delegate"
+	]),
+	authorityId: journeyIdSchema.nullable(),
+	decisionDigest: journeyDigestSchema
 }).strict();
 //#endregion
-//#region packages/application/src/source/resolve.ts
-/** Queue-based ancestry resolution cannot leak deep descendants through a recursion cutoff. */
-function resolveParts(inventory, route) {
-	const nodes = sourceGraph(inventory);
-	const families = reviewFamilies(inventory, nodes);
-	const resolved = /* @__PURE__ */ new Map();
-	const depths = /* @__PURE__ */ new Map();
-	const dependents = /* @__PURE__ */ new Map();
-	const remaining = /* @__PURE__ */ new Map();
-	const queue = [];
-	const finish = (node, included, unresolved, reason, depth = 0) => {
-		resolved.set(node.key, {
-			sessionId: node.session.id,
-			partId: node.part?.id ?? "",
-			included,
-			unresolved,
-			reason
-		});
-		depths.set(node.key, depth);
-		queue.push(node);
-	};
-	const pending = (node, reason) => finish(node, route === "original", true, reason);
-	for (const node of nodes) {
-		const { identity, reason } = node.observation;
-		if (families.unresolved.has(node.session.id)) finish(node, false, node.ancestry !== "missing", node.ancestry === "missing" ? "missing-parent" : "ancestry-unresolved");
-		else if (!familySelected(inventory, families, node.session)) finish(node, false, false, families.owners.get(node.session.id)?.id !== node.session.id ? "deselected-parent" : node.session.selected ? "workspace-not-selected" : "not-selected");
-		else if (reason !== null) pending(node, reason);
-		else if (identity?.role === "guardian") finish(node, false, false, "guardian-excluded");
-		else if (identity?.role !== "worker") finish(node, true, false, null);
-		else if (node.ancestry === "missing") finish(node, false, false, "missing-parent");
-		else if (node.ancestry !== "parents") finish(node, false, true, "ancestry-unresolved");
-		else {
-			remaining.set(node.key, node.parents.length);
-			for (const parent of node.parents) {
-				const children = dependents.get(parent.key) ?? [];
-				children.push(node);
-				dependents.set(parent.key, children);
-			}
-		}
-	}
-	for (let cursor = 0; cursor < queue.length; cursor++) {
-		const parent = queue[cursor];
-		if (!parent) continue;
-		const value = resolved.get(parent.key);
-		for (const node of dependents.get(parent.key) ?? []) {
-			if (resolved.has(node.key)) continue;
-			const outstanding = (remaining.get(node.key) ?? 1) - 1;
-			remaining.set(node.key, outstanding);
-			const depth = (depths.get(parent.key) ?? 0) + 1;
-			if (value?.included && !value.unresolved && (route === "original" || depth <= 256)) {
-				finish(node, true, false, null, depth);
-				continue;
-			}
-			if (outstanding > 0) continue;
-			const results = node.parents.map((entry) => resolved.get(entry.key));
-			if (results.every((entry) => entry && [
-				"not-selected",
-				"workspace-not-selected",
-				"deselected-parent"
-			].includes(entry.reason ?? ""))) finish(node, false, false, "deselected-parent");
-			else if (results.every((entry) => entry?.reason === "missing-parent" || entry?.reason === "deselected-parent")) finish(node, false, false, "missing-parent");
-			else finish(node, false, true, "ancestry-unresolved");
-		}
-	}
-	for (const node of nodes) if (!resolved.has(node.key)) finish(node, false, true, "ancestry-unresolved");
-	return resolved;
+//#region packages/application/src/journey/correction/binding.ts
+function workCorrections(state, workId) {
+	return (state.corrections ?? []).filter((item) => item.workId === workId);
 }
-//#endregion
-//#region packages/application/src/source/index.ts
-function resolveSourceSelection(inventory, route = "original") {
-	const parts = resolveParts(inventory, route);
-	const sessions = /* @__PURE__ */ new Map();
-	const families = reviewFamilies(inventory);
-	const includedWorkspaces = /* @__PURE__ */ new Set();
-	const counts = {
-		workspaces: 0,
-		sessions: 0,
-		parts: 0,
-		sourceBytes: 0
-	};
-	const coverage = {
-		includedSessions: 0,
-		excludedSessions: 0,
-		unresolvedSessions: 0,
-		unresolvedParts: 0
-	};
-	for (const session of inventory.sessions) {
-		const decisions = session.parts.flatMap((part) => {
-			const value = parts.get(sourceKey(session.id, part.id));
-			return value ? [{
-				part,
-				value
-			}] : [];
-		});
-		const included = decisions.filter(({ value }) => value.included);
-		const unresolved = decisions.filter(({ value }) => value.unresolved);
-		const excluded = decisions.filter(({ value }) => !value.included && !value.unresolved);
-		const selected = familySelected(inventory, families, session);
-		const missing = selected && session.parts.length === 0;
-		const reasons = [...new Set(decisions.flatMap(({ value }) => value.reason ? [value.reason] : []))].sort();
-		if (missing) reasons.push("unreadable-source");
-		const summary = Object.freeze({
-			status: unresolved.length || missing ? "unresolved" : included.length ? excluded.length ? "partial" : "included" : "excluded",
-			includedParts: included.length,
-			excludedParts: excluded.length,
-			unresolvedParts: unresolved.length,
-			sourceBytes: included.reduce((sum, { part }) => sum + part.snapshot.size, 0),
-			reasons: Object.freeze(reasons)
-		});
-		sessions.set(session.id, summary);
-		if (!selected) continue;
-		if (summary.includedParts) {
-			counts.sessions++;
-			counts.parts += summary.includedParts;
-			counts.sourceBytes += summary.sourceBytes;
-			includedWorkspaces.add(session.workspaceId);
-			coverage.includedSessions++;
-		}
-		if (summary.status === "excluded") coverage.excludedSessions++;
-		if (summary.status === "unresolved") coverage.unresolvedSessions++;
-		coverage.unresolvedParts += summary.unresolvedParts;
-	}
-	counts.workspaces = includedWorkspaces.size;
-	return Object.freeze({
-		counts: Object.freeze(counts),
-		coverage: Object.freeze(coverage),
-		sessions,
-		session: (sessionId) => {
-			const value = sessions.get(sessionId);
-			if (!value) throw new ApplicationError("UNKNOWN_ITEM");
-			return value;
-		},
-		part: (sessionId, partId) => parts.get(sourceKey(sessionId, partId))
-	});
+/** Binds rendered output and generated metadata to every correction disposition of the Work. */
+function workCorrectionBinding(state, workId) {
+	const corrections = workCorrections(state, workId);
+	return corrections.length ? corrections.map(({ id, groupId, inputRevision, batchId, status, disposition }) => ({
+		id,
+		groupId,
+		inputRevision,
+		batchId,
+		status,
+		choice: disposition?.choice ?? null,
+		decisionDigest: disposition?.decisionDigest ?? null
+	})) : null;
 }
 //#endregion
-//#region packages/application/src/journey/scan-exclusion.ts
-/** Manual source-policy proof; never an assertion that unknown content was scanned. */
-const scanExclusionResourceSchema = z.object({
-	kind: z.literal("scan-exclusion"),
-	proofVersion: z.literal(1),
-	journeyId: journeyIdSchema,
-	workId: journeyIdSchema,
-	inputRevision: z.number().int().positive(),
-	snapshotId: journeyDigestSchema,
-	configurationDigest: journeyDigestSchema,
-	rootSessionId: z.string().min(1),
-	sessionId: z.string().min(1),
-	sourceId: z.string().min(1),
-	sourcePartId: z.string().min(1),
-	native: nativeSourceIdentitySchema,
-	adapterVersion: z.string().min(1),
-	reason: z.enum([
-		"guardian-excluded",
-		"missing-parent",
-		"deselected-parent",
-		"ancestry-unresolved",
-		"non-interactive-launch"
-	]),
-	facts: z.object({
-		representation: z.enum(["jsonl", "jsonl.zst"]),
-		byteLength: z.number().int().nonnegative(),
-		sha256: journeyDigestSchema
-	}).strict()
-}).strict();
-/** Validate policy against frozen identity evidence, never a caller-asserted source role. */
-function validateScanExclusion(resource, state, inventory, capture) {
-	const work = state.works.find((item) => item.id === resource.workId);
-	if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
-	if (!work || state.scope.status !== "confirmed" || work.access === "drop" || state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
-	if (state.journeyId !== resource.journeyId || work.inputRevision !== resource.inputRevision || state.snapshotId !== resource.snapshotId || !work.rootSessionIds.includes(resource.rootSessionId)) throw new ApplicationError("REVISION_CONFLICT");
-	const families = reviewFamilies(inventory);
-	const part = (families.members.get(resource.rootSessionId)?.find((item) => item.id === resource.sessionId))?.parts.find((item) => item.id === resource.sourcePartId);
-	const evidence = capture.source.nativeEvidence;
-	const launch = resource.reason === "non-interactive-launch";
-	const ancestry = resource.reason === "ancestry-unresolved";
-	if (ancestry && resource.native.role !== "worker") throw new ApplicationError("CORRUPTED_STATE");
-	const prefixRoot = launch && resource.rootSessionId === resource.sessionId && resource.native.role === "main" && evidence?.recognition === "unknown" && evidence.completeness === "prefix" && JSON.stringify(evidence.identity) === JSON.stringify({
-		...resource.native,
-		role: "unknown"
-	});
-	if (!part || capture.partId !== resource.sourcePartId || capture.facts.sha256 !== resource.facts.sha256 || capture.facts.byteLength !== resource.facts.byteLength || capture.facts.representation !== resource.facts.representation || !evidence || !prefixRoot && (evidence.recognition !== "recognized" || JSON.stringify(evidence.identity) !== JSON.stringify(resource.native)) || evidence.integrity !== "valid" || evidence.adapterVersion !== resource.adapterVersion || evidence.snapshotId !== sourceSnapshotId(capture.source) || JSON.stringify(part.nativeEvidence) !== JSON.stringify(evidence)) throw new ApplicationError("CORRUPTED_STATE");
-	const ids = new Set(work.rootSessionIds.flatMap((id) => (families.members.get(id) ?? []).map((item) => item.id)));
-	const sessions = inventory.sessions.filter((item) => ids.has(item.id));
-	const workspaceIds = new Set(sessions.map((item) => item.workspaceId));
-	const decision = resolveSourceSelection({
-		...inventory,
-		sessions,
-		workspaces: inventory.workspaces.filter((item) => workspaceIds.has(item.id))
-	}, "configured").part(resource.sessionId, resource.sourcePartId);
-	if (!decision || (prefixRoot ? decision.included || decision.reason !== "unknown-source" : ancestry ? decision.included ? decision.reason !== null : decision.reason !== resource.reason : decision.included !== launch || (launch ? decision.reason !== null : decision.reason !== resource.reason))) throw new ApplicationError("CORRUPTED_STATE");
+//#region packages/application/src/journey/placement/decisions.ts
+function workPrivacyDecisions(state, work) {
+	return state.groups.filter((group) => work.groupIds.includes(group.id)).map(({ id, key, kind, label, condition, choice, confirmed }) => ({
+		id,
+		key,
+		kind,
+		label,
+		condition,
+		choice,
+		confirmed
+	})).sort((a, b) => a.id.localeCompare(b.id));
+}
+/** Corrections are additive under an unchanged Hide group, so they bind metadata review too. */
+function workDecisionDigest(state, work) {
+	const decisions = workPrivacyDecisions(state, work);
+	const corrections = workCorrectionBinding(state, work.id);
+	return textDigest(JSON.stringify(corrections ? {
+		decisions,
+		corrections
+	} : decisions));
+}
+/** Retire generated text until it is reviewed; the processed project name keeps rows distinct. */
+function retireWorkDescription(work) {
+	return {
+		...work,
+		suggestion: null
+	};
 }
 //#endregion
-//#region packages/application/src/journey/scan-git-seeds.ts
-/**
-* Owner-only Git detector input fixed once per frozen snapshot and canonical root set.
-* Later Git activity cannot change or invalidate a scan of the same frozen sources.
-*/
-const scanGitSeedsResourceSchema = z.object({
-	kind: z.literal("git-seeds"),
-	journeyId: journeyIdSchema,
-	snapshotId: journeyDigestSchema,
-	roots: z.array(z.string()),
-	seeds: z.object({
-		names: z.array(z.string().min(1)),
-		snapshots: z.array(z.object({
-			id: z.string().min(1),
-			sha256: z.string()
-		}).strict())
-	}).strict(),
-	sha256: journeyDigestSchema
-}).strict();
-/** Storage key; equal root sets in any order share one receipt. */
-const scanGitSeedsId = (snapshotId, roots) => `${snapshotId}:${textDigest(JSON.stringify([...new Set(roots)].sort()))}`;
-function scanGitSeedsResource(journeyId, snapshotId, roots, seeds) {
-	const value = {
-		names: [...seeds.names],
-		snapshots: seeds.snapshots.map((row) => ({ ...row }))
+//#region packages/application/src/journey/terms/groups.ts
+const keyPrefix = "type:";
+const termGroupKey = (type) => `${keyPrefix}${type}`;
+/** RFC 9562 UUID version 5 of `name` in the `namespace` UUID. */
+function uuidV5(namespace, name) {
+	const bytes = createHash("sha1").update(Buffer.from(namespace.replaceAll("-", ""), "hex")).update(name, "utf8").digest().subarray(0, 16);
+	bytes.writeUInt8(bytes.readUInt8(6) & 15 | 80, 6);
+	bytes.writeUInt8(bytes.readUInt8(8) & 63 | 128, 8);
+	const hex = bytes.toString("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** Deterministic: every reader and writer of a journey names a type's group alike. */
+const termGroupId = (journeyId, type) => uuidV5(journeyId, type);
+/** The term type a group answers, or null for any other category. */
+function termGroupType(group) {
+	if (!group.key.startsWith(keyPrefix)) return null;
+	const parsed = termTypeSchema.safeParse(group.key.slice(5));
+	return parsed.success ? parsed.data : null;
+}
+const typeGroup = (state, type) => state.groups.find((group) => termGroupType(group) === type);
+function newTypeGroup(state, type, preference) {
+	const info = termTypeInfo[type];
+	const base = {
+		id: termGroupId(state.journeyId, type),
+		kind: info.kind,
+		key: termGroupKey(type),
+		label: info.label,
+		condition: info.condition,
+		count: 0,
+		preferenceScope: null,
+		representative: null
+	};
+	if (!info.asked) return {
+		...base,
+		belief: .97,
+		choice: "hide",
+		confirmed: true,
+		origin: "policy"
+	};
+	if (state.questionsPaused) return {
+		...base,
+		belief: .97,
+		choice: "hide",
+		confirmed: false,
+		origin: "paused"
 	};
 	return {
-		kind: "git-seeds",
-		journeyId,
-		snapshotId,
-		roots: [...new Set(roots)].sort(),
-		seeds: value,
-		sha256: textDigest(JSON.stringify(value))
+		...base,
+		belief: preference === null ? .5 : preference === "hide" ? .97 : .03,
+		choice: preference,
+		confirmed: false,
+		origin: preference === null ? "model" : "preference"
 	};
 }
-/** A missing, tampered or foreign receipt is corrupted state, never a cue to reread live Git. */
-function verifiedScanGitSeeds(resource, snapshotId, roots) {
-	if (resource.snapshotId !== snapshotId || scanGitSeedsId(resource.snapshotId, resource.roots) !== scanGitSeedsId(snapshotId, roots) || textDigest(JSON.stringify(resource.seeds)) !== resource.sha256) throw new ApplicationError("CORRUPTED_STATE");
-	return resource.seeds;
-}
-//#endregion
-//#region packages/application/src/journey/scan-session.ts
-const count$9 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
-const scanFileSchema = z.object({
-	path: z.string().min(1),
-	identity: fileIdentitySchema,
-	sha256: journeyDigestSchema,
-	byteLength: count$9
-}).strict();
 /**
-* Track A source-bound prose (`file`) with built-in static protection spans; no delivery archive
-* exists during scanning (ADR 0172). Obsolete version 3 inputs with detector evidence are refused.
+* One group per type with at least one dictionary value, `count` its distinct values. Existing
+* groups keep their identity and answer; other groups are unchanged.
 */
-const sessionScanInputSchema = z.object({
-	version: z.literal(4),
-	sessionId: z.string().min(1),
-	file: scanFileSchema,
-	sources: z.array(z.object({
-		sourceId: z.string().min(1),
-		sourcePartId: z.string().min(1),
-		native: nativeSourceIdentitySchema,
-		facts: z.object({
-			representation: z.enum(["jsonl", "jsonl.zst"]),
-			byteLength: count$9,
-			sha256: journeyDigestSchema
-		}).strict()
-	}).strict()),
-	recordCount: count$9,
-	fieldCount: count$9,
-	inputUtf16: count$9,
-	mainReviewVerified: z.literal(true),
-	emptyReviewVerified: z.boolean()
-}).strict().refine((input) => new Set(input.sources.map((source) => source.sourceId)).size === input.sources.length);
-const scanSessionResourceSchema = z.object({
-	kind: z.literal("scan-session"),
-	journeyId: journeyIdSchema,
-	workId: journeyIdSchema,
-	inputRevision: count$9.min(1),
-	snapshotId: journeyDigestSchema,
-	configurationDigest: journeyDigestSchema,
-	rootSessionId: z.string().min(1),
-	input: sessionScanInputSchema
-}).strict();
-/** Complete scan-set evidence for certified empty main input; never an output digest. */
-function scanPreparationDigest(resources) {
-	return textDigest(JSON.stringify(resources.map((resource) => resource.kind === "scan-exclusion" ? resource : [
-		resource.input.sessionId,
-		resource.rootSessionId,
-		resource.configurationDigest,
-		resource.input.file.sha256,
-		resource.input.sources
-	]).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)))));
+function syncTermGroups(state, counts, preference) {
+	const groups = state.groups.map((group) => {
+		const type = termGroupType(group);
+		return type === null ? group : {
+			...group,
+			count: counts.get(type) ?? group.count
+		};
+	});
+	for (const type of termTypes) {
+		const count = counts.get(type) ?? 0;
+		if (count === 0 || groups.some((group) => termGroupType(group) === type)) continue;
+		groups.push({
+			...newTypeGroup(state, type, preference(termGroupKey(type))),
+			count
+		});
+	}
+	return groups;
 }
-const scanBatchBinding = {
-	journeyId: journeyIdSchema,
-	workId: journeyIdSchema,
-	inputRevision: count$9.min(1),
-	snapshotId: journeyDigestSchema,
-	configurationDigest: journeyDigestSchema
-};
-const scanCanonicalResourceSchema = z.object({
-	...scanBatchBinding,
-	kind: z.literal("scan-canonical"),
-	id: journeyDigestSchema,
-	batchId: journeyIdSchema,
-	batchDigest: journeyDigestSchema
-}).strict();
-const scanAliasResourceSchema = z.object({
-	...scanBatchBinding,
-	kind: z.literal("scan-alias"),
-	id: journeyIdSchema,
-	canonicalBatchId: journeyIdSchema,
-	canonicalBatchDigest: journeyDigestSchema,
-	targetBatchId: journeyIdSchema,
-	targetBatchDigest: journeyDigestSchema,
-	equivalenceDigest: journeyDigestSchema
-}).strict();
 //#endregion
-//#region packages/application/src/journey/b/repair.ts
-const bRepairPlanSchema = z.object({
-	unitId: journeyDigestSchema,
-	unitDigest: journeyDigestSchema,
-	priorDigest: journeyDigestSchema,
-	round: z.literal(1),
-	targetFields: z.array(bIdSchema).min(1).max(24),
-	remainingFields: z.array(bIdSchema)
-}).strict();
-const bReviewDigest = (submission) => bDigest(JSON.stringify(bReviewSubmissionSchema.parse(submission)));
-const repairMeaning = (part) => JSON.stringify([part.category, part.classification]);
-function planBRepair(unit, review, completedRepairs = 0) {
-	if (completedRepairs !== 0) throw new ApplicationError("INVALID_OPERATION");
-	const validated = validateBReview(unit, review.submission);
-	const needed = new Set(validated.issues.flatMap((issue) => issue.fieldId === null ? [] : [issue.fieldId]));
-	const targets = [...new Set(unit.fragments.filter((part) => part.core).map((part) => part.fieldId))].filter((fieldId) => needed.has(fieldId));
-	if (!targets.length) return null;
-	return bRepairPlanSchema.parse({
-		unitId: unit.id,
-		unitDigest: unit.digest,
-		priorDigest: bReviewDigest(review.submission),
-		round: 1,
-		targetFields: targets.slice(0, 24),
-		remainingFields: [...needed].filter((fieldId) => !targets.slice(0, 24).includes(fieldId))
-	});
+//#region packages/application/src/journey/review/confirmed-hides.ts
+/** Kinds from lowest to highest mask priority. */
+const confirmedHideKinds = [
+	"internal",
+	"identity",
+	"private",
+	"credentials"
+];
+const kinds = confirmedHideKinds;
+const rank$1 = (kind) => kinds.indexOf(kind);
+/**
+* ADR 0086: a type's values are hidden unless its group is answered Keep; before an answer the
+* default is Hide. Credentials and contact details are always hidden (D06).
+*/
+function typeHides(state, type) {
+	const group = typeGroup(state, type);
+	return !termTypeInfo[type].asked || !group?.confirmed || group.choice !== "keep";
 }
-function mergeBRepair(unit, previous, inputPlan, raw) {
-	const plan = bRepairPlanSchema.parse(inputPlan);
-	const expected = planBRepair(unit, previous);
-	if (JSON.stringify(plan) !== JSON.stringify(expected)) throw new ApplicationError("REVISION_CONFLICT");
-	const correction = bReviewSubmissionSchema.parse(raw);
-	const targeted = (fieldId) => plan.targetFields.includes(fieldId);
-	if ([
-		...correction.terms.flatMap((term) => term.occurrences),
-		...correction.retainedSourceGroups,
-		...correction.representationLimits,
-		...correction.uncertainOccurrences
-	].some((part) => !targeted(part.fieldId))) throw new ApplicationError("INVALID_REVIEW_SPAN");
-	const repaired = validateBReview(unit, correction, plan.targetFields);
-	const prior = validateBReview(unit, previous.submission);
-	const correctedMeanings = /* @__PURE__ */ new Map();
-	for (const part of repaired.sensitive) {
-		const key = bAnchorKey(part);
-		const meanings = correctedMeanings.get(key) ?? /* @__PURE__ */ new Set();
-		meanings.add(repairMeaning(part));
-		correctedMeanings.set(key, meanings);
+/** B review (superseded by ADR 0086): IDs of the categories confirmed as Hide. */
+const confirmedHideGroupIds = (state) => state.groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => group.id);
+const overrideKey = (state) => (state.valueOverrides ?? []).map((item) => JSON.stringify([
+	item.type,
+	item.value,
+	item.choice
+])).toSorted();
+/**
+* Identifies the hidden set (ADR 0079, 0086). The dictionary only grows and a type's group
+* counts its distinct values, so each type's count and Hide answer, with the value overrides,
+* name exactly one hidden set.
+*/
+function confirmedHideKey(state) {
+	return createHash("sha256").update(JSON.stringify({
+		types: termTypes.map((type) => [
+			type,
+			typeGroup(state, type)?.count ?? 0,
+			typeHides(state, type)
+		]),
+		overrides: overrideKey(state),
+		terms: state.privacy.terms.filter((term) => term.disposition === "hidden").map((term) => [term.type, term.value]).toSorted((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
+	})).digest("hex");
+}
+/** Whether two states hold the same value overrides. */
+const sameValueOverrides = (left, right) => JSON.stringify(overrideKey(left)) === JSON.stringify(overrideKey(right));
+/**
+* A preparation's waived hits stay waived only while every category recorded for them is still a
+* confirmed Hide; otherwise render may no longer mask them, so the session needs reconciliation.
+*/
+function maskedHitsStale(maskedHits, hiding) {
+	const current = new Set(hiding);
+	return !!maskedHits?.some((hit) => hit.groupIds.some((id) => !current.has(id)));
+}
+/**
+* ADR 0086 hidden set: values of types not answered Keep, minus Keep overrides, plus Hide
+* overrides, plus every value of an always-hidden type. A value of several types takes the
+* highest mask kind among the types hiding it.
+*/
+function dictionaryHides(state, terms) {
+	const overrides = state.valueOverrides ?? [];
+	const kept = new Set(overrides.flatMap((item) => item.choice === "keep" ? [item.value] : []));
+	const hidden = /* @__PURE__ */ new Map();
+	const add = (value, type) => {
+		const prior = hidden.get(value);
+		const kind = termTypeInfo[type].kind;
+		hidden.set(value, {
+			kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
+			groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], termGroupId(state.journeyId, type)])].sort()
+		});
+	};
+	const all = [...terms];
+	const hiddenValues = new Set(state.privacy.terms.filter((item) => item.disposition === "hidden").map((item) => item.value));
+	for (const term of all) if (hiddenValues.has(term.value) && !kept.has(term.value)) add(term.value, term.type);
+	for (const item of overrides) if (item.choice === "hide") add(item.value, item.type);
+	for (const term of all) if (!termTypeInfo[term.type].asked) add(term.value, term.type);
+	return hidden;
+}
+/** The journey's current hidden set, applied to every selected Work (ADR 0086, D03). */
+async function journeyConfirmedHides(reader, state) {
+	return dictionaryHides(state, [...await reader.journeyTerms({ journeyId: state.journeyId }), ...state.privacy.terms]);
+}
+function confirmedHideTerms(groups, records) {
+	const confirmed = new Map(groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => [group.id, group]));
+	const fields = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const assigned = new Map(record.assignments.map((item) => [item.findingId, item.groupId]));
+		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
+		for (const finding of record.findings) {
+			const group = confirmed.get(assigned.get(finding.id) ?? "");
+			const chunk = chunks.get(finding.chunkId);
+			if (!group || !chunk || finding.class !== "gray") continue;
+			const key = JSON.stringify([chunk.fieldId, chunk.fieldHash]);
+			fields.set(key, [...fields.get(key) ?? [], {
+				start: chunk.offset + finding.start,
+				end: chunk.offset + finding.end,
+				text: chunk.text.slice(finding.start, finding.end),
+				split: [finding.start === 0, finding.end === chunk.text.length],
+				group
+			}]);
+		}
 	}
-	const preservedKeys = /* @__PURE__ */ new Set();
-	const conflicts = [];
-	const preserved = prior.sensitive.filter((part) => targeted(part.fieldId)).flatMap((part) => {
-		const retentions = part.classification.class === "certain" ? [] : repaired.retained.filter((retained) => retained.fieldId === part.fieldId);
-		return subtractBRanges([part], retentions).map((range) => ({
-			fieldId: part.fieldId,
-			recordId: part.recordId,
-			fieldHash: part.fieldHash,
+	const terms = /* @__PURE__ */ new Map();
+	const add = (text, groupIds, kind) => {
+		for (const term of bLiteralTerms(text)) {
+			const prior = terms.get(term);
+			terms.set(term, {
+				kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
+				groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], ...groupIds])].sort()
+			});
+		}
+	};
+	for (const spans of fields.values()) {
+		let open;
+		for (const span of spans.toSorted((a, b) => a.start - b.start || b.end - a.end)) {
+			if (open && span.split[0] && span.start === open.end) {
+				open.text += span.text;
+				open.end = span.end;
+				open.groupIds.push(span.group.id);
+			} else {
+				if (open) add(open.text, open.groupIds, open.kind);
+				open = {
+					end: span.end,
+					text: span.text,
+					groupIds: [span.group.id],
+					kind: span.group.kind
+				};
+			}
+			if (!span.split[1]) {
+				add(open.text, open.groupIds, open.kind);
+				open = void 0;
+			}
+		}
+		if (open) add(open.text, open.groupIds, open.kind);
+	}
+	return terms;
+}
+//#endregion
+//#region packages/application/src/journey/b/matches.ts
+function bDictionaryHits(fields, literals, signal = new AbortController().signal) {
+	const matcher = createEntityMatcher([...new Set(literals.map((part) => part.term))].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	const hits = [];
+	for (const field of fields) {
+		const index = createCodePointIndex(field.text);
+		const base = field.start ?? 0;
+		for (const match of matcher.find(field.text, signal, 1e5)) {
+			if (hits.length >= 1e6) throw new ApplicationError("PROCESSING_LIMIT");
+			const body = {
+				fieldId: field.id,
+				fieldHash: field.fieldHash,
+				recordId: field.recordId,
+				start: base + index.codePointOffset(match.range.start),
+				end: base + index.codePointOffset(match.range.end),
+				exactQuote: field.text.slice(match.range.start, match.range.end),
+				term: match.entity.value
+			};
+			hits.push({
+				...body,
+				digest: bDigest(JSON.stringify(body))
+			});
+		}
+	}
+	return [...new Map(hits.map((hit) => [hit.digest, hit])).values()];
+}
+function unclassifiedBHits(hits, literals, negative) {
+	const issues = [];
+	const positiveFields = new Map([...Map.groupBy(literals, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
+	const negativeFields = new Map([...Map.groupBy(negative, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
+	for (const hit of hits) {
+		const positive = positiveFields.get(hit.fieldId)?.relation(hit).covers ?? false;
+		const negative = negativeFields.get(hit.fieldId)?.relation(hit);
+		if (!positive && !negative?.covers || positive && negative?.overlaps) issues.push(bIssue(positive ? "CONFLICTING_PRIVACY_DECISIONS" : "UNCLASSIFIED_MATCH", hit));
+	}
+	return issues;
+}
+const bSpacedWord = (value) => /[\p{L}\p{N}_]/u.test(value) && !/[\p{sc=Han}\p{sc=Hiragana}\p{sc=Katakana}\p{sc=Thai}\p{sc=Lao}\p{sc=Khmer}\p{sc=Myanmar}]/u.test(value);
+/** A confirmed Hide value matches only where it does not run into a neighbouring word (ADR 0069). */
+function bWordBounded(text, start, end) {
+	return !(bSpacedWord(scalarBefore(text, start)) && bSpacedWord(scalarAfter(text, start)) || bSpacedWord(scalarBefore(text, end)) && bSpacedWord(scalarAfter(text, end)));
+}
+/**
+* Occurrences of a Work's explicit exceptions, matched like Hide everywhere: exact NFC values
+* over complete graphemes. A confirmed Hide value inside one stays visible there.
+*/
+function bExceptionRanges(values) {
+	const matcher = createEntityMatcher([...new Set([...values].map((value) => value.normalize("NFC")))].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	return (text, signal = new AbortController().signal) => matcher.find(text, signal, 1e5).filter(({ range, entity }) => text.slice(range.start, range.end).normalize("NFC") === entity.value).map(({ range }) => range);
+}
+/** Whether a range lies inside one of `ranges`: a prefix maximum of ends, O(log n) per query. */
+function bContainment(ranges) {
+	const sorted = ranges.toSorted((a, b) => a.start - b.start);
+	const reach = [];
+	for (const [index, range] of sorted.entries()) reach.push(Math.max(range.end, reach[index - 1] ?? range.end));
+	return (range) => {
+		let low = 0, high = sorted.length;
+		while (low < high) {
+			const middle = low + high >> 1;
+			if ((sorted[middle]?.start ?? Infinity) <= range.start) low = middle + 1;
+			else high = middle;
+		}
+		return low > 0 && (reach[low - 1] ?? -1) >= range.end;
+	};
+}
+/**
+* Word-bounded, exact, case-sensitive NFC occurrences of the terms, in UTF-16 coordinates,
+* except where an explicit exception occurrence contains one.
+*/
+function bTermMatcher(terms, exceptions = []) {
+	const matcher = createEntityMatcher([...new Set(terms)].map((value) => ({
+		kind: "custom-term",
+		value
+	})));
+	const excepted = bExceptionRanges(exceptions);
+	return (text, signal = new AbortController().signal) => {
+		const hits = matcher.find(text, signal, 1e5).filter(({ range }) => bWordBounded(text, range.start, range.end));
+		const kept = hits.length ? bContainment(excepted(text, signal)) : () => false;
+		return hits.filter(({ range }) => !kept(range)).map(({ range, entity }) => ({
 			...range,
-			exactQuote: codePointSlice(part.exactQuote, range.start - part.start, range.end - part.start),
-			category: part.category,
-			classification: part.classification,
-			reason: "Prior sensitive obligation preserved during bounded repair."
+			term: entity.value
 		}));
-	}).filter((part) => {
-		const anchor = bAnchorKey(part), meaning = repairMeaning(part), corrected = correctedMeanings.get(anchor);
-		if (corrected && (corrected.size > 1 || !corrected.has(meaning))) conflicts.push(bIssue("CONFLICTING_PRIVACY_DECISIONS", part));
-		if (corrected?.has(meaning)) return false;
-		const key = JSON.stringify([anchor, meaning]);
-		if (preservedKeys.has(key)) return false;
-		preservedKeys.add(key);
-		return true;
-	});
-	const original = previous.submission;
-	const merged = {
-		...original,
-		terms: [...original.terms.map((term) => ({
-			...term,
-			occurrences: term.occurrences.filter((part) => !targeted(part.fieldId))
-		})).filter((term) => term.occurrences.length > 0), ...correction.terms],
-		retainedSourceGroups: [...original.retainedSourceGroups.filter((part) => !targeted(part.fieldId)), ...correction.retainedSourceGroups],
-		representationLimits: [
-			...original.representationLimits.filter((part) => !targeted(part.fieldId)),
-			...correction.representationLimits,
-			...preserved
-		],
-		uncertainOccurrences: [...original.uncertainOccurrences.filter((part) => !targeted(part.fieldId)), ...correction.uncertainOccurrences],
-		coverage: [...original.coverage.filter((part) => !targeted(part.fieldId)), ...correction.coverage],
-		sessionDecision: correction.sessionDecision
 	};
-	const review = validateBReview(unit, merged);
-	review.issues = [...new Map([...review.issues, ...conflicts].map((issue) => [JSON.stringify(issue), issue])).values()];
-	return {
-		review,
-		receipt: {
-			...plan,
-			resultDigest: bReviewDigest(merged),
-			priorObligationsPreserved: true,
-			unresolvedIssues: review.issues
+}
+/** Dictionary hits that a confirmed Hide value masks at render, so they need no classification. */
+function bMaskedHits(fields, terms) {
+	const byId = new Map(fields.map((field) => [field.id, {
+		text: field.text,
+		index: createCodePointIndex(field.text),
+		base: field.start ?? 0
+	}]));
+	return (hit) => {
+		const field = byId.get(hit.fieldId);
+		return !!field && terms.has(hit.term) && bWordBounded(field.text, field.index.offset(hit.start - field.base), field.index.offset(hit.end - field.base));
+	};
+}
+const segmenter = new Intl.Segmenter("und", { granularity: "grapheme" });
+/** Beyond this many inner match edges in one word the index is not kept (retire instead). */
+const maximumEdges = 16;
+/** Beyond this many distinct pieces the index is not kept (retire instead). */
+const maximumHideIndexTokens = 2e6;
+/**
+* Adds the word pieces of `text` that an occurrence of a confirmed Hide value can consist of.
+* The matcher compares per-grapheme NFC text and checks word edges on the original characters
+* at grapheme edges only, so a match may start or end inside a run of word characters there,
+* or inside a grapheme. Every piece between such positions is added. Returns false when a run
+* has too many such positions to list.
+*/
+function addHideIndexTokens(text, add) {
+	let complete = true;
+	let from = 0;
+	for (const { index } of text.matchAll(/[^\p{ASCII}]+/gu)) {
+		if (index < from) continue;
+		let start = index;
+		while (start > from && asciiWord(text.charCodeAt(start - 1))) start--;
+		let end = index + 1;
+		while (end < text.length && (text.charCodeAt(end) > 127 || asciiWord(text.charCodeAt(end)))) end++;
+		asciiTokens(text.slice(from, start), add);
+		complete = graphemeTokens(text.slice(start, end), add) && complete;
+		from = end;
+	}
+	asciiTokens(text.slice(from), add);
+	return complete;
+}
+const asciiWord = (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code === 95 || code >= 97 && code <= 122;
+function asciiTokens(text, add) {
+	for (const [token] of text.matchAll(/[A-Za-z0-9_]+/gu)) add(token);
+}
+function graphemeTokens(text, add) {
+	let complete = true, run = [], edges = [];
+	const flush = () => {
+		if (edges.length > maximumEdges) complete = false;
+		else {
+			const cuts = [
+				0,
+				...edges,
+				run.length
+			];
+			for (let from = 0; from < cuts.length; from++) for (let to = from + 1; to < cuts.length; to++) add(run.slice(cuts[from], cuts[to]).join(""));
 		}
+		run = [];
+		edges = [];
 	};
+	let previous = "";
+	for (const { segment } of segmenter.segment(text)) {
+		const original = Array.from(segment);
+		Array.from(segment.normalize("NFC")).forEach((scalar, index) => {
+			if (!bSpacedWord(scalar)) {
+				if (run.length) flush();
+				return;
+			}
+			if (run.length && (index > 0 || !(bSpacedWord(previous) && bSpacedWord(original[0] ?? "")))) edges.push(run.length);
+			run.push(scalar);
+		});
+		previous = original.at(-1) ?? "";
+	}
+	if (run.length) flush();
+	return complete;
 }
-//#endregion
-//#region packages/application/src/journey/review/limits.ts
-/** Raw provider bytes stay bounded independently of JSON escaping and compiled findings. */
-const reviewResponseBytes = 4194304;
-/** Fits the escaped raw-response envelope and evidence plus compiled occurrence findings. */
-const reviewTransportBytes = 33554432;
-//#endregion
-//#region packages/application/src/journey/review/candidate-schema.ts
-const reviewIssueSchema = z.object({
-	code: z.string().regex(/^[A-Z_]{3,80}$/u),
-	fieldId: z.string().min(1).nullable(),
-	start: z.number().int().nonnegative().nullable(),
-	end: z.number().int().nonnegative().nullable()
-}).strict();
-const reviewCandidateInputSchema = z.object({
-	journeyId: journeyIdSchema,
-	batchId: journeyIdSchema,
-	batchDigest: journeyDigestSchema,
-	idempotencyKey: journeyIdSchema,
-	attemptId: journeyIdSchema,
-	response: z.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= reviewResponseBytes),
-	repairId: journeyIdSchema.nullable(),
-	sessionReviewId: journeyIdSchema.nullable()
-}).strict();
-const reviewCandidateResourceSchema = reviewCandidateInputSchema.omit({ idempotencyKey: true }).extend({
-	kind: z.literal("b-candidate"),
-	id: journeyIdSchema,
-	requestHash: journeyDigestSchema,
-	at: z.iso.datetime(),
-	workId: journeyIdSchema,
-	inputRevision: z.number().int().positive(),
-	snapshotId: journeyDigestSchema,
-	responseDigest: journeyDigestSchema,
-	status: z.enum([
-		"valid",
-		"pending",
-		"invalid"
-	]),
-	issues: z.array(reviewIssueSchema),
-	evidence: bReviewSubmissionSchema.nullable()
-}).strict();
-const reviewCandidateResultSchema = reviewCandidateResourceSchema.pick({
-	responseDigest: true,
-	status: true,
-	issues: true,
-	evidence: true
-}).extend({ candidateId: journeyIdSchema }).strict();
-const reviewRepairInputSchema = z.object({
-	journeyId: journeyIdSchema,
-	candidateId: journeyIdSchema,
-	idempotencyKey: journeyIdSchema
-}).strict();
-const reviewRepairResourceSchema = z.object({
-	kind: z.literal("b-repair"),
-	id: journeyIdSchema,
-	journeyId: journeyIdSchema,
-	workId: journeyIdSchema,
-	batchId: journeyIdSchema,
-	batchDigest: journeyDigestSchema,
-	inputRevision: z.number().int().positive(),
-	snapshotId: journeyDigestSchema,
-	candidateId: journeyIdSchema,
-	requestHash: journeyDigestSchema,
-	at: z.iso.datetime(),
-	plan: bRepairPlanSchema
-}).strict();
-//#endregion
-//#region packages/application/src/journey/correction/model.ts
-/** Original field-relative code-point coordinates, end-exclusive, exactly as B anchors. */
-const correctionAnchorSchema = z.object({
-	fieldId: bIdSchema,
-	recordId: bIdSchema,
-	fieldHash: journeyDigestSchema,
-	start: bCountSchema,
-	end: bCountSchema,
-	quote: z.string().min(1).max(4096)
-}).strict();
-const correctionReportSchema = z.object({
-	id: journeyIdSchema,
-	workId: journeyIdSchema,
-	inputRevision: z.number().int().min(1),
-	batchId: journeyIdSchema,
-	groupId: journeyIdSchema,
-	kind: journeyKindSchema,
-	reason: z.string().trim().min(1).max(1e3),
-	anchors: z.array(correctionAnchorSchema).min(1).max(256)
-}).strict();
-const reviewCorrectSchema = z.object({
-	journeyId: journeyIdSchema,
-	expectedRevision: z.number().int().nonnegative(),
-	idempotencyKey: journeyIdSchema,
-	report: correctionReportSchema
-}).strict();
-/** Immutable private report receipt; the only place where correction quotes are retained. */
-const correctionReportResourceSchema = z.object({
-	journeyId: journeyIdSchema,
-	kind: z.literal("correction-report"),
-	id: journeyIdSchema,
-	requestHash: journeyDigestSchema,
-	at: z.iso.datetime(),
-	snapshotId: journeyDigestSchema,
-	batchDigest: journeyDigestSchema,
-	decisionDigest: journeyDigestSchema,
-	report: correctionReportSchema
-}).strict();
-const correctionAuditSchema = z.object({
-	reportId: journeyIdSchema,
-	action: z.enum([
-		"report",
-		"hide",
-		"dismiss"
-	]),
-	actor: z.enum([
-		"observer",
-		"human",
-		"delegate"
-	]),
-	authorityId: journeyIdSchema.nullable(),
-	decisionDigest: journeyDigestSchema
-}).strict();
-//#endregion
-//#region packages/application/src/journey/correction/binding.ts
-function workCorrections(state, workId) {
-	return (state.corrections ?? []).filter((item) => item.workId === workId);
+/** The words of an NFC value, or null when it has none and cannot be checked by words. */
+function hideValueTokens(term) {
+	const tokens = [];
+	let run = "";
+	for (const scalar of term) if (bSpacedWord(scalar)) run += scalar;
+	else if (run) {
+		tokens.push(run);
+		run = "";
+	}
+	if (run) tokens.push(run);
+	return tokens.length ? [...new Set(tokens)] : null;
 }
-/** Binds rendered output and generated metadata to every correction disposition of the Work. */
-function workCorrectionBinding(state, workId) {
-	const corrections = workCorrections(state, workId);
-	return corrections.length ? corrections.map(({ id, groupId, inputRevision, batchId, status, disposition }) => ({
-		id,
-		groupId,
-		inputRevision,
-		batchId,
-		status,
-		choice: disposition?.choice ?? null,
-		decisionDigest: disposition?.decisionDigest ?? null
-	})) : null;
+/** A keyed, truncated digest; a collision can only retire an unaffected Work. */
+function hideTokenDigest(key, token) {
+	return createHmac("sha256", key).update(token, "utf8").digest("base64url").slice(0, 11);
 }
-//#endregion
-//#region packages/application/src/journey/placement/decisions.ts
-function workPrivacyDecisions(state, work) {
-	return state.groups.filter((group) => work.groupIds.includes(group.id)).map(({ id, key, kind, label, condition, choice, confirmed }) => ({
-		id,
-		key,
-		kind,
-		label,
-		condition,
-		choice,
-		confirmed
-	})).sort((a, b) => a.id.localeCompare(b.id));
+/** Identifies the key an index or delta was made with, without revealing it. */
+const hideKeyId = (key) => hideTokenDigest(key, "\0key");
+/** Sorted, distinct, fixed-width digests in one string. */
+function packHideIndex(key, tokens) {
+	const secret = createSecretKey(key);
+	return [...new Set([...tokens].map((token) => hideTokenDigest(secret, token)))].sort().join("");
 }
-/** Corrections are additive under an unchanged Hide group, so they bind metadata review too. */
-function workDecisionDigest(state, work) {
-	const decisions = workPrivacyDecisions(state, work);
-	const corrections = workCorrectionBinding(state, work.id);
-	return textDigest(JSON.stringify(corrections ? {
-		decisions,
-		corrections
-	} : decisions));
+/** One digest; an index is a run of them, checked by length and alphabet. */
+const hideDigestPattern = /^[A-Za-z0-9_-]{11}$/u;
+const isHideIndex = (value) => value.length % 11 === 0 && /^[A-Za-z0-9_-]*$/u.test(value);
+function hideIndexHas(index, digest) {
+	let low = 0, high = index.length / 11 - 1;
+	while (low <= high) {
+		const middle = low + high >> 1;
+		const value = index.slice(middle * 11, (middle + 1) * 11);
+		if (value === digest) return true;
+		if (value < digest) low = middle + 1;
+		else high = middle - 1;
+	}
+	return false;
 }
-/** Retire generated text until it is reviewed; the processed project name keeps rows distinct. */
-function retireWorkDescription(work) {
+//#endregion
+//#region packages/application/src/journey/review/retirement.ts
+/**
+* ADR 0079: the confirmed Hide values a commit adds, removes or recategorizes, with the kind
+* each then has (null once removed; for additions, the lowest it can have). Terms exist only in
+* memory for this commit. `rendered` holds the value's keyed digest for each kind, to compare
+* with the values a Work was rendered with; `tokens` holds its words' keyed digests, or null
+* when it has none. A partial value is a literal that may join a neighbour across a chunk edge,
+* so its whole text, and every Work it may reach, is unknown.
+*/
+const deltaValueSchema = z.object({
+	term: z.string().min(1),
+	kind: journeyKindSchema.nullable(),
+	partial: z.boolean(),
+	rendered: z.array(z.string().regex(hideDigestPattern)).length(confirmedHideKinds.length),
+	tokens: z.array(z.string().regex(hideDigestPattern)).min(1).nullable(),
+	/** The new findings an addition comes from; the store keeps it only if one joins a Hide. */
+	sources: z.array(z.object({
+		batchId: z.uuid(),
+		findingId: z.uuid()
+	}).strict()).min(1).optional()
+}).strict();
+/** `keyId` names the journey key the digests were made with; an index under another key is unusable. */
+const keyId = z.string().regex(hideDigestPattern);
+const confirmedHideDeltaSchema = z.discriminatedUnion("scope", [z.object({
+	scope: z.literal("complete"),
+	keyId,
+	from: z.string(),
+	to: z.string(),
+	values: z.array(deltaValueSchema)
+}).strict(), z.object({
+	scope: z.literal("additions"),
+	keyId,
+	values: z.array(deltaValueSchema)
+}).strict()]);
+/** What a value was rendered as: its kind, in the digests a render keeps (ADR 0079). */
+const renderedHideValue = (kind, term) => `${kind}\u0000${term}`;
+function hideDeltaValue(key, term, kind, partial = false) {
+	const tokens = partial ? null : hideValueTokens(term);
 	return {
-		...work,
-		suggestion: null
+		term,
+		kind,
+		partial,
+		rendered: confirmedHideKinds.map((item) => hideTokenDigest(key, renderedHideValue(item, term))),
+		tokens: tokens && tokens.map((token) => hideTokenDigest(key, token))
 	};
 }
-//#endregion
-//#region packages/application/src/journey/terms/groups.ts
-const keyPrefix = "type:";
-const termGroupKey = (type) => `${keyPrefix}${type}`;
-/** RFC 9562 UUID version 5 of `name` in the `namespace` UUID. */
-function uuidV5(namespace, name) {
-	const bytes = createHash("sha1").update(Buffer.from(namespace.replaceAll("-", ""), "hex")).update(name, "utf8").digest().subarray(0, 16);
-	bytes.writeUInt8(bytes.readUInt8(6) & 15 | 80, 6);
-	bytes.writeUInt8(bytes.readUInt8(8) & 63 | 128, 8);
-	const hex = bytes.toString("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-/** Deterministic: every reader and writer of a journey names a type's group alike. */
-const termGroupId = (journeyId, type) => uuidV5(journeyId, type);
-/** The term type a group answers, or null for any other category. */
-function termGroupType(group) {
-	if (!group.key.startsWith(keyPrefix)) return null;
-	const parsed = termTypeSchema.safeParse(group.key.slice(5));
-	return parsed.success ? parsed.data : null;
-}
-const typeGroup = (state, type) => state.groups.find((group) => termGroupType(group) === type);
-function newTypeGroup(state, type, preference) {
-	const info = termTypeInfo[type];
-	const base = {
-		id: termGroupId(state.journeyId, type),
-		kind: info.kind,
-		key: termGroupKey(type),
-		label: info.label,
-		condition: info.condition,
-		count: 0,
-		preferenceScope: null,
-		representative: null
-	};
-	if (!info.asked) return {
-		...base,
-		belief: .97,
-		choice: "hide",
-		confirmed: true,
-		origin: "policy"
-	};
-	if (state.questionsPaused) return {
-		...base,
-		belief: .97,
-		choice: "hide",
-		confirmed: false,
-		origin: "paused"
+const kindOf = (kind) => journeyKindSchema.nullable().parse(kind ?? null);
+const rank = (kind) => kind === null ? -1 : confirmedHideKinds.indexOf(kind);
+/**
+* Every value whose hidden kind differs between two states (ADR 0086): both are read against the
+* same dictionary, which only grows and is unchanged by the commit that asks.
+*/
+async function readConfirmedHideChange(reader, key, previous, next) {
+	const terms = await reader.journeyTerms({ journeyId: previous.journeyId });
+	const before = dictionaryHides(previous, terms), after = dictionaryHides(next, terms);
+	return {
+		scope: "complete",
+		keyId: hideKeyId(key),
+		from: confirmedHideKey(previous),
+		to: confirmedHideKey(next),
+		values: [.../* @__PURE__ */ new Set([...before.keys(), ...after.keys()])].filter((term) => before.get(term)?.kind !== after.get(term)?.kind).map((term) => hideDeltaValue(key, term, kindOf(after.get(term)?.kind)))
 	};
+}
+/** Dictionary values a commit may add to the hidden set, each with its type's kind (ADR 0086). */
+function termHideAdditions(key, values) {
+	const unique = /* @__PURE__ */ new Map();
+	for (const { term, kind } of values) unique.set(JSON.stringify([term, kind]), hideDeltaValue(key, term, kindOf(kind)));
 	return {
-		...base,
-		belief: preference === null ? .5 : preference === "hide" ? .97 : .03,
-		choice: preference,
-		confirmed: false,
-		origin: preference === null ? "model" : "preference"
+		scope: "additions",
+		keyId: hideKeyId(key),
+		values: [...unique.values()]
 	};
 }
 /**
-* One group per type with at least one dictionary value, `count` its distinct values. Existing
-* groups keep their identity and answer; other groups are unchanged.
+* The values new Gray findings can add. A finding at a chunk edge may join a neighbouring
+* literal of the same field, so its words are not checked.
 */
-function syncTermGroups(state, counts, preference) {
-	const groups = state.groups.map((group) => {
-		const type = termGroupType(group);
-		return type === null ? group : {
-			...group,
-			count: counts.get(type) ?? group.count
-		};
-	});
-	for (const type of termTypes) {
-		const count = counts.get(type) ?? 0;
-		if (count === 0 || groups.some((group) => termGroupType(group) === type)) continue;
-		groups.push({
-			...newTypeGroup(state, type, preference(termGroupKey(type))),
-			count
-		});
+function confirmedHideAdditions(key, records) {
+	const values = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
+		for (const finding of record.findings) {
+			const chunk = chunks.get(finding.chunkId);
+			if (!chunk || finding.class !== "gray") continue;
+			const whole = chunk.offset === 0 && chunk.textHash === chunk.fieldHash;
+			const joins = finding.start === 0 && chunk.offset > 0 || finding.end === chunk.text.length && !whole;
+			const source = {
+				batchId: record.batchId,
+				findingId: finding.id
+			};
+			for (const term of bLiteralTerms(chunk.text.slice(finding.start, finding.end))) {
+				const id = JSON.stringify([
+					term,
+					finding.kind,
+					joins
+				]);
+				const value = values.get(id);
+				if (value) value.sources.push(source);
+				else values.set(id, {
+					...hideDeltaValue(key, term, finding.kind, joins),
+					sources: [source]
+				});
+			}
+		}
 	}
-	return groups;
+	return {
+		scope: "additions",
+		keyId: hideKeyId(key),
+		values: [...values.values()]
+	};
 }
-//#endregion
-//#region packages/application/src/journey/review/confirmed-hides.ts
-/** Kinds from lowest to highest mask priority. */
-const confirmedHideKinds = [
-	"internal",
-	"identity",
-	"private",
-	"credentials"
-];
-const kinds = confirmedHideKinds;
-const rank$1 = (kind) => kinds.indexOf(kind);
 /**
-* ADR 0086: a type's values are hidden unless its group is answered Keep; before an answer the
-* default is Hide. Credentials and contact details are always hidden (D06).
+* How hidden values moved when the value overrides and type answers stay the same: not at all,
+* only added (new dictionary values of hiding types), only removed, or otherwise. A type's
+* hidden values are its distinct values while it hides; an answer that changes whether a type
+* hides is otherwise, so only a complete delta covers it.
+*/
+function memberChange(previous, next) {
+	if (!sameValueOverrides(previous, next)) return "other";
+	if (termTypes.some((type) => typeGroup(previous, type) !== void 0 && typeHides(previous, type) !== typeHides(next, type))) return "other";
+	const hidden = (state, type) => typeHides(state, type) ? typeGroup(state, type)?.count ?? 0 : 0;
+	const counts = termTypes.map((type) => hidden(next, type) - hidden(previous, type));
+	if (counts.every((count) => count === 0)) return "same";
+	return counts.every((count) => count >= 0) ? "additions" : counts.every((count) => count <= 0) ? "removals" : "other";
+}
+/**
+* Whether a Work's output may change with the delta (Work metadata is never masked, so a
+* generated description never retires on its own). Without a delta that covers this exact change every Work is affected, as ADR 0069 first decided, except when
+* members were only removed: no value is then added, so nothing can be under-hidden, and an
+* output may keep masking a value that left its category until it is rendered again.
 */
-function typeHides(state, type) {
-	const group = typeGroup(state, type);
-	return !termTypeInfo[type].asked || !group?.confirmed || group.choice !== "keep";
+function impact(previous, next, delta, outputIndex) {
+	const change = memberChange(previous, next);
+	const covered = delta && (delta.scope === "complete" ? delta.from === confirmedHideKey(previous) && delta.to === confirmedHideKey(next) : change === "additions" || change === "same");
+	if (!delta || !covered) return change === "removals" || change === "same" ? () => false : () => true;
+	const unchanged = (index, value) => {
+		const at = value.rendered.findIndex((digest) => hideIndexHas(index.values, digest));
+		const was = at < 0 ? null : confirmedHideKinds[at] ?? null;
+		return delta.scope === "additions" ? rank(was) >= rank(value.kind) : was === value.kind;
+	};
+	const reaches = (index, value) => {
+		const digests = index.digests;
+		return !value.tokens || !digests || value.tokens.every((token) => hideIndexHas(digests, token));
+	};
+	return (work) => {
+		if (!work.artifact) return false;
+		const found = outputIndex(work);
+		const index = found?.keyId === delta.keyId ? found : null;
+		return !index || delta.values.some((value) => value.partial || !unchanged(index, value) && reaches(index, value));
+	};
 }
-/** B review (superseded by ADR 0086): IDs of the categories confirmed as Hide. */
-const confirmedHideGroupIds = (state) => state.groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => group.id);
-const overrideKey = (state) => (state.valueOverrides ?? []).map((item) => JSON.stringify([
-	item.type,
-	item.value,
-	item.choice
-])).toSorted();
 /**
-* Identifies the hidden set (ADR 0079, 0086). The dictionary only grows and a type's group
-* counts its distinct values, so each type's count and Hide answer, with the value overrides,
-* name exactly one hidden set.
+* Applied with every Journey commit. When confirmed Hide categories or their members change,
+* a Work whose output or generated description may change is retired until both are produced
+* again (ADR 0069); ADR 0079 limits this to Works the changed values can reach.
 */
-function confirmedHideKey(state) {
-	return createHash("sha256").update(JSON.stringify({
-		types: termTypes.map((type) => [
-			type,
-			typeGroup(state, type)?.count ?? 0,
-			typeHides(state, type)
+function settleConfirmedHides(previous, next, delta, outputIndex = () => null) {
+	if (!previous || confirmedHideKey(previous) === confirmedHideKey(next)) return next;
+	const before = new Map(previous.works.map((work) => [work.id, work.revision]));
+	const affected = impact(previous, next, delta, outputIndex);
+	return {
+		...next,
+		works: next.works.map((work) => work.artifact === null && work.revision > (before.get(work.id) ?? work.revision) || !affected(work) ? work : {
+			...retireWorkDescription(work),
+			artifact: null,
+			revision: work.revision + 1,
+			status: work.status === "ready" ? "review" : work.status
+		})
+	};
+}
+//#endregion
+//#region packages/application/src/journey/storage.ts
+const journeyEventSchema = z.object({
+	sequence: z.number().int().nonnegative(),
+	journeyId: journeyIdSchema,
+	revision: z.number().int().nonnegative(),
+	kind: z.enum([
+		"started",
+		"response",
+		"snapshot",
+		"batch",
+		"output",
+		"send",
+		"search"
+	]),
+	source: z.enum([
+		"conversation",
+		"panel",
+		"system"
+	]),
+	at: z.iso.datetime(),
+	alignment: reviewAlignmentAuditSchema.optional(),
+	preferenceScopes: z.array(z.object({
+		groupId: journeyIdSchema,
+		preferenceScope: journeyPreferenceScopeSchema
+	}).strict()).min(1).max(1e4).optional(),
+	correction: correctionAuditSchema.optional(),
+	decision: delegatedDecisionSchema.extend({
+		action: z.enum([
+			"group",
+			"groups-hide",
+			"work-access",
+			"instruction",
+			"correction",
+			"works-access",
+			"work-type",
+			"scope-confirm",
+			"account-read",
+			"card-answer",
+			"cards-confirm"
 		]),
-		overrides: overrideKey(state),
-		terms: state.privacy.terms.filter((term) => term.disposition === "hidden").map((term) => [term.type, term.value]).toSorted((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))
-	})).digest("hex");
+		targetIds: z.array(journeyIdSchema).min(1),
+		choice: z.string().min(1).max(16)
+	}).optional()
+}).strict();
+const journeyCommitSchema = z.object({
+	expectedRevision: z.number().int().nonnegative().nullable(),
+	requestKey: journeyIdSchema,
+	requestHash: journeyDigestSchema,
+	state: nativeJourneySchema,
+	event: journeyEventSchema.omit({
+		sequence: true,
+		revision: true
+	}),
+	/** Inserted in the same transaction as this state; never through the generic resource save. */
+	correctionReport: correctionReportResourceSchema.optional(),
+	/** Verify unread batch ownership in the same transaction as a reader interruption. */
+	closedReader: reviewInterruptionSchema.pick({
+		inputRevision: true,
+		packId: true,
+		batchIds: true
+	}).extend({ workId: journeyIdSchema }).optional(),
+	/** Set by the store for this commit only and never persisted (ADR 0079). */
+	confirmedHideDelta: confirmedHideDeltaSchema.optional(),
+	/** Dictionary values a Hide override adds (ADR 0086), inserted with this state. */
+	terms: z.array(z.object({
+		type: termTypeSchema,
+		value: z.string().min(1)
+	}).strict()).max(2e4).optional()
+}).strict();
+const journeyCommitResultSchema = z.object({
+	status: z.enum([
+		"applied",
+		"replayed",
+		"stale"
+	]),
+	state: nativeJourneySchema
+}).strict();
+//#endregion
+//#region packages/application/src/journey/search.ts
+const count$9 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const term = z.string().min(1).max(1024).refine((value) => Buffer.byteLength(value) <= 1024 && !/[\0\r\n]/u.test(value));
+const journeySearchSchema = z.object({
+	journeyId: journeyIdSchema,
+	terms: z.array(z.object({
+		id: z.string().min(1).max(64),
+		text: term,
+		variants: z.array(term).max(7).default([])
+	}).strict()).min(1).max(16)
+}).strict();
+const journeySearchResultSchema = z.object({
+	binding: z.object({
+		journeyId: journeyIdSchema,
+		snapshotId: journeyDigestSchema,
+		revision: count$9,
+		scopeDigest: journeyDigestSchema,
+		outputs: z.array(z.object({
+			workId: journeyIdSchema,
+			outputRevision: count$9,
+			sha256: journeyDigestSchema
+		}).strict())
+	}).strict(),
+	status: z.enum(["complete", "partial"]),
+	scope: z.object({
+		retainedText: z.literal(true),
+		metadata: z.literal(true),
+		setupText: z.literal(true),
+		attachments: z.literal(false),
+		images: z.literal(false),
+		originals: z.literal("frozen-native-records-and-discovery-metadata"),
+		matching: z.literal("case-sensitive-literal-leftmost-longest")
+	}).strict(),
+	terms: z.array(z.object({
+		id: z.string(),
+		tried: z.array(z.string()),
+		sentMatches: count$9.nullable(),
+		originalMatches: count$9.nullable(),
+		sentSessions: count$9.nullable(),
+		originalSessions: count$9.nullable()
+	}).strict()),
+	hits: z.array(z.object({
+		termId: z.string(),
+		basis: z.enum(["sent", "original"]),
+		workId: journeyIdSchema,
+		locator: z.object({
+			kind: z.enum([
+				"retained-text",
+				"metadata",
+				"setup-text"
+			]),
+			entryPath: z.string().optional(),
+			archiveSessionId: z.string().optional(),
+			sessionId: z.string().optional(),
+			sourcePartId: z.string().optional(),
+			recordIndex: count$9,
+			fieldId: z.string(),
+			line: count$9
+		}).strict(),
+		occurrences: count$9,
+		modelContext: z.string().max(4096).optional(),
+		match: z.object({
+			variantIndex: count$9.max(7),
+			start: count$9,
+			end: count$9
+		}).strict().optional()
+	}).strict()),
+	failures: z.array(z.object({
+		workId: journeyIdSchema,
+		basis: z.enum(["sent", "original"]),
+		code: z.enum(["SEARCH_INPUT_UNAVAILABLE", "SEARCH_ENGINE_FAILED"])
+	}).strict()),
+	truncated: z.boolean()
+}).strict().refine((result) => result.hits.every((hit) => {
+	if (hit.basis === "original") return hit.modelContext === void 0 && hit.match === void 0;
+	if (!hit.match || hit.modelContext === void 0) return false;
+	const { start, end, variantIndex } = hit.match;
+	const variant = result.terms.find((term) => term.id === hit.termId)?.tried[variantIndex];
+	if (!variant || end <= start || end > hit.modelContext.length || hit.modelContext.slice(start, end) !== variant) return false;
+	return [start, end].every((offset) => {
+		const before = hit.modelContext?.charCodeAt(offset - 1) ?? 0;
+		const after = hit.modelContext?.charCodeAt(offset) ?? 0;
+		return !(before >= 55296 && before <= 56319 && after >= 56320 && after <= 57343);
+	});
+}));
+const journeySearchSaveSchema = z.object({
+	journeyId: journeyIdSchema,
+	expectedRevision: count$9,
+	idempotencyKey: journeyIdSchema,
+	result: journeySearchResultSchema
+}).strict();
+function searchScopeDigest(state) {
+	return textDigest(JSON.stringify({
+		snapshot: state.snapshotId,
+		configurationId: state.configurationId,
+		pendingHideId: state.pendingHideId,
+		works: state.works.map((work) => ({
+			id: work.id,
+			revision: work.revision,
+			inputRevision: work.inputRevision,
+			access: work.access,
+			artifact: work.artifact?.sha256 ?? null
+		}))
+	}));
 }
-/** Whether two states hold the same value overrides. */
-const sameValueOverrides = (left, right) => JSON.stringify(overrideKey(left)) === JSON.stringify(overrideKey(right));
+z.object({
+	journeyId: journeyIdSchema.optional(),
+	workIds: z.array(journeyIdSchema).min(1).max(1e3).optional()
+}).strict();
+const categories = z.object({
+	identity: z.number().int().nonnegative(),
+	credentials: z.number().int().nonnegative(),
+	internal: z.number().int().nonnegative(),
+	private: z.number().int().nonnegative()
+}).strict();
+z.object({
+	journeyId: journeyIdSchema,
+	nonAdditiveMechanismCounts: z.literal(true),
+	total: z.number().int().nonnegative(),
+	categories,
+	byMechanism: z.object({
+		staticNodes: z.record(z.string(), z.number().int().nonnegative()),
+		semantic: z.number().int().nonnegative(),
+		correction: z.number().int().nonnegative()
+	}).strict(),
+	works: z.array(z.object({
+		workId: journeyIdSchema,
+		revision: z.number().int().positive(),
+		inputRevision: z.number().int().positive(),
+		primarySha256: z.string().length(64),
+		companionSha256: z.string().length(64),
+		ledgerSha256: z.string().length(64),
+		decisionDigest: z.string().length(64),
+		reviewInputDigest: z.string().length(64),
+		total: z.number().int().nonnegative(),
+		categories,
+		byMechanism: z.object({
+			staticNodes: z.record(z.string(), z.number().int().nonnegative()),
+			semantic: z.number().int().nonnegative(),
+			correction: z.number().int().nonnegative()
+		}).strict()
+	}).strict())
+}).strict();
+//#endregion
+//#region packages/application/src/journey/scope/respond.ts
 /**
-* A preparation's waived hits stay waived only while every category recorded for them is still a
-* confirmed Hide; otherwise render may no longer mask them, so the session needs reconciliation.
+* Account-seeded access (ADR 0274 D3(b)). With `held`, the time the account inventory was read,
+* a Work whose every root is held Public is confirmed Public with the account as its recorded
+* choice (ADR 0275); without it, Public stays a suggestion.
 */
-function maskedHitsStale(maskedHits, hiding) {
-	const current = new Set(hiding);
-	return !!maskedHits?.some((hit) => hit.groupIds.some((id) => !current.has(id)));
+function accountSeededAccess(account, held) {
+	const accessChoice = account === "public-all" && held !== void 0 ? {
+		channel: "account",
+		at: held
+	} : void 0;
+	return {
+		access: account === "public" || account === "public-all" ? "public" : "private",
+		accessOrigin: "account",
+		accessConfirmed: account === "private" || accessChoice !== void 0,
+		accountAccessConflict: account === "mixed",
+		accessChoice
+	};
 }
 /**
-* ADR 0086 hidden set: values of types not answered Keep, minus Keep overrides, plus Hide
-* overrides, plus every value of an always-hidden type. A value of several types takes the
-* highest mask kind among the types hiding it.
+* The scope-confirmation stop (ADR 0277 section 5), or null when the read lets it confirm. A
+* failed read always stops, with Retry only. A signed-out read stops too, except when the
+* journey's consent has no subject (Q11 a and Q13 a), regardless of caller configuration.
 */
-function dictionaryHides(state, terms) {
-	const overrides = state.valueOverrides ?? [];
-	const kept = new Set(overrides.flatMap((item) => item.choice === "keep" ? [item.value] : []));
-	const hidden = /* @__PURE__ */ new Map();
-	const add = (value, type) => {
-		const prior = hidden.get(value);
-		const kind = termTypeInfo[type].kind;
-		hidden.set(value, {
-			kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
-			groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], termGroupId(state.journeyId, type)])].sort()
-		});
-	};
-	const all = [...terms];
-	const hiddenValues = new Set(state.privacy.terms.filter((item) => item.disposition === "hidden").map((item) => item.value));
-	for (const term of all) if (hiddenValues.has(term.value) && !kept.has(term.value)) add(term.value, term.type);
-	for (const item of overrides) if (item.choice === "hide") add(item.value, item.type);
-	for (const term of all) if (!termTypeInfo[term.type].asked) add(term.value, term.type);
-	return hidden;
-}
-/** The journey's current hidden set, applied to every selected Work (ADR 0086, D03). */
-async function journeyConfirmedHides(reader, state) {
-	return dictionaryHides(state, [...await reader.journeyTerms({ journeyId: state.journeyId }), ...state.privacy.terms]);
+function accountReadStop(state, read) {
+	if (!read || read.status === "read") return null;
+	if (read.status === "unavailable") return "ACCOUNT_ACCESS_UNAVAILABLE";
+	return consentedWithoutAccount(state) ? null : "ACCOUNT_SIGNED_OUT";
 }
-function confirmedHideTerms(groups, records) {
-	const confirmed = new Map(groups.filter((group) => group.confirmed && group.choice === "hide").map((group) => [group.id, group]));
-	const fields = /* @__PURE__ */ new Map();
-	for (const record of records) {
-		const assigned = new Map(record.assignments.map((item) => [item.findingId, item.groupId]));
-		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
-		for (const finding of record.findings) {
-			const group = confirmed.get(assigned.get(finding.id) ?? "");
-			const chunk = chunks.get(finding.chunkId);
-			if (!group || !chunk || finding.class !== "gray") continue;
-			const key = JSON.stringify([chunk.fieldId, chunk.fieldHash]);
-			fields.set(key, [...fields.get(key) ?? [], {
-				start: chunk.offset + finding.start,
-				end: chunk.offset + finding.end,
-				text: chunk.text.slice(finding.start, finding.end),
-				split: [finding.start === 0, finding.end === chunk.text.length],
-				group
-			}]);
-		}
-	}
-	const terms = /* @__PURE__ */ new Map();
-	const add = (text, groupIds, kind) => {
-		for (const term of bLiteralTerms(text)) {
-			const prior = terms.get(term);
-			terms.set(term, {
-				kind: prior && rank$1(prior.kind) > rank$1(kind) ? prior.kind : kind,
-				groupIds: [.../* @__PURE__ */ new Set([...prior?.groupIds ?? [], ...groupIds])].sort()
-			});
+/** The journey with this read recorded; the subject is kept only for a `read`. */
+function withAccountRead(state, read, now) {
+	return {
+		...state,
+		accountRead: read.status === "read" ? {
+			status: "read",
+			subject: read.subject,
+			at: now
+		} : {
+			status: read.status,
+			at: now
 		}
 	};
-	for (const spans of fields.values()) {
-		let open;
-		for (const span of spans.toSorted((a, b) => a.start - b.start || b.end - a.end)) {
-			if (open && span.split[0] && span.start === open.end) {
-				open.text += span.text;
-				open.end = span.end;
-				open.groupIds.push(span.group.id);
-			} else {
-				if (open) add(open.text, open.groupIds, open.kind);
-				open = {
-					end: span.end,
-					text: span.text,
-					groupIds: [span.group.id],
-					kind: span.group.kind
-				};
-			}
-			if (!span.split[1]) {
-				add(open.text, open.groupIds, open.kind);
-				open = void 0;
-			}
-		}
-		if (open) add(open.text, open.groupIds, open.kind);
-	}
-	return terms;
-}
-//#endregion
-//#region packages/application/src/journey/b/matches.ts
-function bDictionaryHits(fields, literals, signal = new AbortController().signal) {
-	const matcher = createEntityMatcher([...new Set(literals.map((part) => part.term))].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	const hits = [];
-	for (const field of fields) {
-		const index = createCodePointIndex(field.text);
-		const base = field.start ?? 0;
-		for (const match of matcher.find(field.text, signal, 1e5)) {
-			if (hits.length >= 1e6) throw new ApplicationError("PROCESSING_LIMIT");
-			const body = {
-				fieldId: field.id,
-				fieldHash: field.fieldHash,
-				recordId: field.recordId,
-				start: base + index.codePointOffset(match.range.start),
-				end: base + index.codePointOffset(match.range.end),
-				exactQuote: field.text.slice(match.range.start, match.range.end),
-				term: match.entity.value
-			};
-			hits.push({
-				...body,
-				digest: bDigest(JSON.stringify(body))
-			});
-		}
-	}
-	return [...new Map(hits.map((hit) => [hit.digest, hit])).values()];
-}
-function unclassifiedBHits(hits, literals, negative) {
-	const issues = [];
-	const positiveFields = new Map([...Map.groupBy(literals, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
-	const negativeFields = new Map([...Map.groupBy(negative, (part) => part.fieldId)].map(([id, parts]) => [id, indexBRanges(parts)]));
-	for (const hit of hits) {
-		const positive = positiveFields.get(hit.fieldId)?.relation(hit).covers ?? false;
-		const negative = negativeFields.get(hit.fieldId)?.relation(hit);
-		if (!positive && !negative?.covers || positive && negative?.overlaps) issues.push(bIssue(positive ? "CONFLICTING_PRIVACY_DECISIONS" : "UNCLASSIFIED_MATCH", hit));
-	}
-	return issues;
-}
-const bSpacedWord = (value) => /[\p{L}\p{N}_]/u.test(value) && !/[\p{sc=Han}\p{sc=Hiragana}\p{sc=Katakana}\p{sc=Thai}\p{sc=Lao}\p{sc=Khmer}\p{sc=Myanmar}]/u.test(value);
-/** A confirmed Hide value matches only where it does not run into a neighbouring word (ADR 0069). */
-function bWordBounded(text, start, end) {
-	return !(bSpacedWord(scalarBefore(text, start)) && bSpacedWord(scalarAfter(text, start)) || bSpacedWord(scalarBefore(text, end)) && bSpacedWord(scalarAfter(text, end)));
 }
 /**
-* Occurrences of a Work's explicit exceptions, matched like Hide everywhere: exact NFC values
-* over complete graphemes. A confirmed Hide value inside one stays visible there.
+* Retry at the Send screen (ADR 0277 section 5): record the read and, on `read`, re-apply the
+* account while keeping confirmed person choices and every Private or dropped Work. An earlier choice
+* that cannot carry falls back to Private. Access changes get a new revision and clear the
+* output and package approval.
 */
-function bExceptionRanges(values) {
-	const matcher = createEntityMatcher([...new Set([...values].map((value) => value.normalize("NFC")))].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	return (text, signal = new AbortController().signal) => matcher.find(text, signal, 1e5).filter(({ range, entity }) => text.slice(range.start, range.end).normalize("NFC") === entity.value).map(({ range }) => range);
-}
-/** Whether a range lies inside one of `ranges`: a prefix maximum of ends, O(log n) per query. */
-function bContainment(ranges) {
-	const sorted = ranges.toSorted((a, b) => a.start - b.start);
-	const reach = [];
-	for (const [index, range] of sorted.entries()) reach.push(Math.max(range.end, reach[index - 1] ?? range.end));
-	return (range) => {
-		let low = 0, high = sorted.length;
-		while (low < high) {
-			const middle = low + high >> 1;
-			if ((sorted[middle]?.start ?? Infinity) <= range.start) low = middle + 1;
-			else high = middle;
+function retryAccountRead(state, read, now) {
+	if (state.scope.status !== "confirmed" || state.phase === "sending" || state.phase === "completed") throw new ApplicationError("INVALID_TRANSITION");
+	const recorded = withAccountRead(state, read, now);
+	if (read.status !== "read") return recorded;
+	let changed = false;
+	const works = state.works.map((work) => {
+		if (work.placement === "classifying") return work;
+		if (work.accessOrigin === "explicit" && work.accessConfirmed) return work;
+		if (work.access !== "public") return work;
+		const account = read.access.get(work.id);
+		if (!account && !work.accessChoice && work.accessOrigin !== "account") return work;
+		const seeded = accountSeededAccess(account ?? "private", now);
+		if (work.accessChoice && (work.accessChoice.channel !== "account" || !seeded.accessChoice)) {
+			seeded.access = "private";
+			seeded.accessConfirmed = account !== "mixed";
+			seeded.accessChoice = void 0;
 		}
-		return low > 0 && (reach[low - 1] ?? -1) >= range.end;
+		if (seeded.access === work.access) return {
+			...work,
+			...seeded
+		};
+		changed = true;
+		return {
+			...work,
+			...seeded,
+			revision: work.revision + 1,
+			artifact: null,
+			status: work.status === "ready" ? "review" : work.status
+		};
+	});
+	return changed ? withReadingProgress({
+		...recorded,
+		privacy: {
+			...state.privacy,
+			packageApproval: null
+		},
+		works
+	}) : {
+		...recorded,
+		works
 	};
 }
-/**
-* Word-bounded, exact, case-sensitive NFC occurrences of the terms, in UTF-16 coordinates,
-* except where an explicit exception occurrence contains one.
-*/
-function bTermMatcher(terms, exceptions = []) {
-	const matcher = createEntityMatcher([...new Set(terms)].map((value) => ({
-		kind: "custom-term",
-		value
-	})));
-	const excepted = bExceptionRanges(exceptions);
-	return (text, signal = new AbortController().signal) => {
-		const hits = matcher.find(text, signal, 1e5).filter(({ range }) => bWordBounded(text, range.start, range.end));
-		const kept = hits.length ? bContainment(excepted(text, signal)) : () => false;
-		return hits.filter(({ range }) => !kept(range)).map(({ range, entity }) => ({
-			...range,
-			term: entity.value
-		}));
-	};
+/** Classification confirmation initializes visibility and scan membership for this journey. */
+function confirmScope(state, now, decision, accountAccess) {
+	if (state.scope.status === "confirmed") return state;
+	if (state.classificationRevision === null || !state.works.length || state.works.some((work) => work.placement !== "placed" && work.placement !== "classifying" || work.placement === "placed" && !(work.status === "blocked" && work.access === "drop" && work.accessConfirmed) && (!work.description.trim() || !work.projectType))) throw new ApplicationError("SCOPE_NOT_READY");
+	return withReadingProgress({
+		...state,
+		scope: {
+			status: "confirmed",
+			actor: decision ? "delegate" : "human",
+			at: now
+		},
+		works: state.works.map((work) => {
+			if (work.placement === "classifying") return work;
+			if (work.accessOrigin === "explicit" && work.accessConfirmed) return work;
+			if (work.access === "private" && work.accessOrigin === "delegate") return work;
+			const account = accountAccess?.get(work.id);
+			if (account) return {
+				...work,
+				...accountSeededAccess(account, now)
+			};
+			if (work.accessOrigin === "account") return work;
+			const access = work.accessConfirmed ? work.access : work.classificationRecommendation?.access ?? work.access;
+			return {
+				...work,
+				access,
+				accessOrigin: work.accessConfirmed || !work.classificationRecommendation ? work.accessOrigin : "model",
+				accessConfirmed: access !== "public"
+			};
+		})
+	});
 }
-/** Dictionary hits that a confirmed Hide value masks at render, so they need no classification. */
-function bMaskedHits(fields, terms) {
-	const byId = new Map(fields.map((field) => [field.id, {
-		text: field.text,
-		index: createCodePointIndex(field.text),
-		base: field.start ?? 0
-	}]));
-	return (hit) => {
-		const field = byId.get(hit.fieldId);
-		return !!field && terms.has(hit.term) && bWordBounded(field.text, field.index.offset(hit.start - field.base), field.index.offset(hit.end - field.base));
+function setWorkType(state, workId, type, decision) {
+	if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
+	const projectType = decision ? {
+		type,
+		reason: "Chosen by your delegate for this journey.",
+		origin: "delegate"
+	} : {
+		type,
+		reason: "Chosen by you.",
+		origin: "explicit"
+	};
+	return {
+		...state,
+		scope: {
+			status: "pending",
+			actor: null,
+			at: null
+		},
+		privacy: {
+			...state.privacy,
+			cards: [],
+			confirmedAnswersRevision: null,
+			packageApproval: null
+		},
+		works: state.works.map((work) => work.id !== workId || decision && work.projectType?.origin === "explicit" ? work : {
+			...work,
+			projectType
+		})
 	};
 }
-const segmenter = new Intl.Segmenter("und", { granularity: "grapheme" });
-/** Beyond this many inner match edges in one word the index is not kept (retire instead). */
-const maximumEdges = 16;
-/** Beyond this many distinct pieces the index is not kept (retire instead). */
-const maximumHideIndexTokens = 2e6;
+/** One rule for single and bulk choices; selection changes recompute reading completion. */
+function setWorksAccess(state, workIds, access, decision, accessChoice) {
+	if (decision && access === "public") throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (new Set(workIds).size !== workIds.length) throw new ApplicationError("INVALID_SELECTION");
+	if (workIds.some((id) => !state.works.some((work) => work.id === id))) throw new ApplicationError("UNKNOWN_WORKSPACE");
+	if (state.scope.status === "confirmed") return changeConfirmedAccess(state, workIds, access, decision, accessChoice);
+	return withReadingProgress({
+		...state,
+		scope: {
+			status: "pending",
+			actor: null,
+			at: null
+		},
+		privacy: {
+			...state.privacy,
+			cards: [],
+			confirmedAnswersRevision: null,
+			packageApproval: null
+		},
+		works: state.works.map((work) => !workIds.includes(work.id) ? work : {
+			...work,
+			revision: work.revision + 1,
+			artifact: null,
+			status: work.status === "ready" ? "review" : work.status,
+			access,
+			accessConfirmed: true,
+			accountAccessConflict: false,
+			accessChoice: access === "public" ? accessChoice : void 0,
+			accessOrigin: decision && work.accessOrigin !== "explicit" ? "delegate" : "explicit"
+		})
+	});
+}
 /**
-* Adds the word pieces of `text` that an occurrence of a confirmed Hide value can consist of.
-* The matcher compares per-grapheme NFC text and checks word edges on the original characters
-* at grapheme edges only, so a match may start or end inside a run of word characters there,
-* or inside a grapheme. Every piece between such positions is added. Returns false when a run
-* has too many such positions to list.
+* After confirmation the person, never a delegate, may still change any Work's visibility
+* (D2, superseding ADR 0162's lock and ADR 0188's blocked-only Drop). Drop stops that Work's
+* scan; a Work moved out of Drop is read again; reading progress is recomputed.
 */
-function addHideIndexTokens(text, add) {
-	let complete = true;
-	let from = 0;
-	for (const { index } of text.matchAll(/[^\p{ASCII}]+/gu)) {
-		if (index < from) continue;
-		let start = index;
-		while (start > from && asciiWord(text.charCodeAt(start - 1))) start--;
-		let end = index + 1;
-		while (end < text.length && (text.charCodeAt(end) > 127 || asciiWord(text.charCodeAt(end)))) end++;
-		asciiTokens(text.slice(from, start), add);
-		complete = graphemeTokens(text.slice(start, end), add) && complete;
-		from = end;
-	}
-	asciiTokens(text.slice(from), add);
-	return complete;
+function changeConfirmedAccess(state, workIds, access, decision, accessChoice) {
+	if (decision || state.phase === "sending" || state.phase === "completed" || state.works.some((work) => workIds.includes(work.id) && work.access === access && work.accessConfirmed && hasPublicChoice(work))) throw new ApplicationError("INVALID_TRANSITION");
+	if (access === "public" && state.works.every((work) => !workIds.includes(work.id) || work.access === "public" && work.accessConfirmed)) return {
+		...state,
+		works: state.works.map((work) => workIds.includes(work.id) && accessChoice ? {
+			...work,
+			accessOrigin: "explicit",
+			accessChoice
+		} : work)
+	};
+	return withReadingProgress({
+		...state,
+		privacy: {
+			...state.privacy,
+			packageApproval: null
+		},
+		works: state.works.map((work) => workIds.includes(work.id) ? {
+			...work,
+			revision: work.revision + 1,
+			artifact: null,
+			status: work.status === "ready" ? "review" : work.status,
+			access,
+			accessConfirmed: true,
+			accountAccessConflict: false,
+			accessChoice: access === "public" ? accessChoice : void 0,
+			accessOrigin: "explicit"
+		} : work)
+	});
 }
-const asciiWord = (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code === 95 || code >= 97 && code <= 122;
-function asciiTokens(text, add) {
-	for (const [token] of text.matchAll(/[A-Za-z0-9_]+/gu)) add(token);
+/** Model suggestions fill or refresh model types only; a person's or delegate's type stays. */
+function applyClassification(state, items) {
+	if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
+	const byWork = new Map(items.map((item) => [item.workId, item]));
+	if (byWork.size !== items.length) throw new ApplicationError("INVALID_SELECTION");
+	if (items.some((item) => !state.works.some((work) => work.id === item.workId))) throw new ApplicationError("UNKNOWN_WORKSPACE");
+	return {
+		...state,
+		works: state.works.map((work) => {
+			const item = byWork.get(work.id);
+			if (!item || work.projectType && work.projectType.origin !== "model") return work;
+			return {
+				...work,
+				projectType: {
+					type: item.type,
+					reason: item.reason,
+					origin: "model"
+				}
+			};
+		})
+	};
 }
-function graphemeTokens(text, add) {
-	let complete = true, run = [], edges = [];
-	const flush = () => {
-		if (edges.length > maximumEdges) complete = false;
-		else {
-			const cuts = [
-				0,
-				...edges,
-				run.length
-			];
-			for (let from = 0; from < cuts.length; from++) for (let to = from + 1; to < cuts.length; to++) add(run.slice(cuts[from], cuts[to]).join(""));
-		}
-		run = [];
-		edges = [];
+//#endregion
+//#region packages/application/src/journey/inventory/schema.ts
+const journeyInventoryQuerySchema = z.object({ journeyId: journeyIdSchema }).strict();
+/** Trusted host binding, never accepted by the public command schema. */
+const journeyInventoryReadSchema = journeyInventoryQuerySchema.extend({ expectedDestination: z.string().min(1).optional() }).strict();
+const discoveryWarningCodeSchema = z.enum([
+	"UNSUPPORTED_SOURCE_ENCODING",
+	"SKIPPED_NONREGULAR_SOURCE",
+	"WORKFLOW_JOURNAL_EXCLUDED",
+	"AUTOMATIC_HELPER_EXCLUDED",
+	"UNRESOLVED_WORKERS_EXCLUDED",
+	"METADATA_LIMIT",
+	"METADATA_DEPTH_LIMIT",
+	"INCOMPLETE_DISCOVERY",
+	"DISCOVERY_ENTRY_LIMIT",
+	"DISCOVERY_DEPTH_LIMIT",
+	"BROKEN_SOURCE_LINK"
+]);
+const evidence = z.object({
+	known: preparationCountSchema,
+	total: preparationCountSchema.nullable()
+}).strict().refine((value) => value.total === null || value.total === value.known);
+const workPreparationObservationSchema = z.object({
+	workId: journeyIdSchema,
+	inputRevision: preparationCountSchema.min(1),
+	observation: z.enum([
+		"unavailable",
+		"incomplete",
+		"settled"
+	]),
+	stage: preparationStageSchema.nullable(),
+	sourceParts: z.object({
+		unsupported: evidence,
+		resourceLimited: evidence,
+		excluded: evidence,
+		unclassified: preparationCountSchema
+	}).strict(),
+	emptyReviewRoots: evidence,
+	unevaluatedReviewRoots: preparationCountSchema
+}).strict();
+const journeyInventorySchema = z.object({
+	journeyId: journeyIdSchema,
+	revision: preparationCountSchema,
+	snapshotId: journeyDigestSchema.nullable(),
+	frozen: z.object({
+		retainedSessions: preparationCountSchema,
+		reviewRoots: preparationCountSchema,
+		identifiedMainRoots: preparationCountSchema,
+		unknownRoleRoots: preparationCountSchema,
+		attachedSubagents: preparationCountSchema,
+		unresolvedWorkerSessions: preparationCountSchema,
+		sourceParts: preparationCountSchema,
+		frozenSourceBytes: preparationCountSchema,
+		discoveryUnsupportedInputs: z.null(),
+		discoverySkippedInputs: z.null(),
+		discoverySkippedSourceBytes: z.null(),
+		warningOccurrences: z.array(z.object({
+			code: discoveryWarningCodeSchema,
+			occurrences: preparationCountSchema
+		}).strict())
+	}).strict().nullable(),
+	captures: z.object({
+		targetParts: preparationCountSchema,
+		capturedParts: preparationCountSchema,
+		capturedBytes: preparationCountSchema,
+		completeCapturedBytes: preparationCountSchema.nullable()
+	}).strict().nullable(),
+	workScope: z.object({
+		total: preparationCountSchema,
+		byStatus: z.object({
+			pending: preparationCountSchema,
+			reading: preparationCountSchema,
+			review: preparationCountSchema,
+			ready: preparationCountSchema,
+			blocked: preparationCountSchema
+		}).strict(),
+		byAccess: z.object({
+			public: preparationCountSchema,
+			private: preparationCountSchema,
+			drop: preparationCountSchema
+		}).strict(),
+		assignedReviewRoots: preparationCountSchema,
+		unassignedReviewRoots: preparationCountSchema.nullable(),
+		excludedAutomationRoots: preparationCountSchema.nullable(),
+		unassignedOtherRoots: preparationCountSchema.nullable()
+	}).strict(),
+	preparation: z.array(workPreparationObservationSchema)
+}).strict();
+/** Panel preparation counts over the selected Works: opaque Work IDs, parts and bytes only. */
+const journeyPreparationProgressSchema = z.object({
+	currentWorkIds: z.array(journeyIdSchema),
+	targetParts: preparationCountSchema,
+	capturedParts: preparationCountSchema,
+	targetBytes: preparationCountSchema,
+	capturedBytes: preparationCountSchema
+}).strict();
+//#endregion
+//#region packages/application/src/source/resolve.ts
+/** Queue-based ancestry resolution cannot leak deep descendants through a recursion cutoff. */
+function resolveParts(inventory, route) {
+	const nodes = sourceGraph(inventory);
+	const families = reviewFamilies(inventory, nodes);
+	const resolved = /* @__PURE__ */ new Map();
+	const depths = /* @__PURE__ */ new Map();
+	const dependents = /* @__PURE__ */ new Map();
+	const remaining = /* @__PURE__ */ new Map();
+	const queue = [];
+	const finish = (node, included, unresolved, reason, depth = 0) => {
+		resolved.set(node.key, {
+			sessionId: node.session.id,
+			partId: node.part?.id ?? "",
+			included,
+			unresolved,
+			reason
+		});
+		depths.set(node.key, depth);
+		queue.push(node);
 	};
-	let previous = "";
-	for (const { segment } of segmenter.segment(text)) {
-		const original = Array.from(segment);
-		Array.from(segment.normalize("NFC")).forEach((scalar, index) => {
-			if (!bSpacedWord(scalar)) {
-				if (run.length) flush();
-				return;
+	const pending = (node, reason) => finish(node, route === "original", true, reason);
+	for (const node of nodes) {
+		const { identity, reason } = node.observation;
+		if (families.unresolved.has(node.session.id)) finish(node, false, node.ancestry !== "missing", node.ancestry === "missing" ? "missing-parent" : "ancestry-unresolved");
+		else if (!familySelected(inventory, families, node.session)) finish(node, false, false, families.owners.get(node.session.id)?.id !== node.session.id ? "deselected-parent" : node.session.selected ? "workspace-not-selected" : "not-selected");
+		else if (reason !== null) pending(node, reason);
+		else if (identity?.role === "guardian") finish(node, false, false, "guardian-excluded");
+		else if (identity?.role !== "worker") finish(node, true, false, null);
+		else if (node.ancestry === "missing") finish(node, false, false, "missing-parent");
+		else if (node.ancestry !== "parents") finish(node, false, true, "ancestry-unresolved");
+		else {
+			remaining.set(node.key, node.parents.length);
+			for (const parent of node.parents) {
+				const children = dependents.get(parent.key) ?? [];
+				children.push(node);
+				dependents.set(parent.key, children);
 			}
-			if (run.length && (index > 0 || !(bSpacedWord(previous) && bSpacedWord(original[0] ?? "")))) edges.push(run.length);
-			run.push(scalar);
-		});
-		previous = original.at(-1) ?? "";
+		}
 	}
-	if (run.length) flush();
-	return complete;
-}
-/** The words of an NFC value, or null when it has none and cannot be checked by words. */
-function hideValueTokens(term) {
-	const tokens = [];
-	let run = "";
-	for (const scalar of term) if (bSpacedWord(scalar)) run += scalar;
-	else if (run) {
-		tokens.push(run);
-		run = "";
+	for (let cursor = 0; cursor < queue.length; cursor++) {
+		const parent = queue[cursor];
+		if (!parent) continue;
+		const value = resolved.get(parent.key);
+		for (const node of dependents.get(parent.key) ?? []) {
+			if (resolved.has(node.key)) continue;
+			const outstanding = (remaining.get(node.key) ?? 1) - 1;
+			remaining.set(node.key, outstanding);
+			const depth = (depths.get(parent.key) ?? 0) + 1;
+			if (value?.included && !value.unresolved && (route === "original" || depth <= 256)) {
+				finish(node, true, false, null, depth);
+				continue;
+			}
+			if (outstanding > 0) continue;
+			const results = node.parents.map((entry) => resolved.get(entry.key));
+			if (results.every((entry) => entry && [
+				"not-selected",
+				"workspace-not-selected",
+				"deselected-parent"
+			].includes(entry.reason ?? ""))) finish(node, false, false, "deselected-parent");
+			else if (results.every((entry) => entry?.reason === "missing-parent" || entry?.reason === "deselected-parent")) finish(node, false, false, "missing-parent");
+			else finish(node, false, true, "ancestry-unresolved");
+		}
 	}
-	if (run) tokens.push(run);
-	return tokens.length ? [...new Set(tokens)] : null;
-}
-/** A keyed, truncated digest; a collision can only retire an unaffected Work. */
-function hideTokenDigest(key, token) {
-	return createHmac("sha256", key).update(token, "utf8").digest("base64url").slice(0, 11);
-}
-/** Identifies the key an index or delta was made with, without revealing it. */
-const hideKeyId = (key) => hideTokenDigest(key, "\0key");
-/** Sorted, distinct, fixed-width digests in one string. */
-function packHideIndex(key, tokens) {
-	const secret = createSecretKey(key);
-	return [...new Set([...tokens].map((token) => hideTokenDigest(secret, token)))].sort().join("");
+	for (const node of nodes) if (!resolved.has(node.key)) finish(node, false, true, "ancestry-unresolved");
+	return resolved;
 }
-/** One digest; an index is a run of them, checked by length and alphabet. */
-const hideDigestPattern = /^[A-Za-z0-9_-]{11}$/u;
-const isHideIndex = (value) => value.length % 11 === 0 && /^[A-Za-z0-9_-]*$/u.test(value);
-function hideIndexHas(index, digest) {
-	let low = 0, high = index.length / 11 - 1;
-	while (low <= high) {
-		const middle = low + high >> 1;
-		const value = index.slice(middle * 11, (middle + 1) * 11);
-		if (value === digest) return true;
-		if (value < digest) low = middle + 1;
-		else high = middle - 1;
+//#endregion
+//#region packages/application/src/source/index.ts
+function resolveSourceSelection(inventory, route = "original") {
+	const parts = resolveParts(inventory, route);
+	const sessions = /* @__PURE__ */ new Map();
+	const families = reviewFamilies(inventory);
+	const includedWorkspaces = /* @__PURE__ */ new Set();
+	const counts = {
+		workspaces: 0,
+		sessions: 0,
+		parts: 0,
+		sourceBytes: 0
+	};
+	const coverage = {
+		includedSessions: 0,
+		excludedSessions: 0,
+		unresolvedSessions: 0,
+		unresolvedParts: 0
+	};
+	for (const session of inventory.sessions) {
+		const decisions = session.parts.flatMap((part) => {
+			const value = parts.get(sourceKey(session.id, part.id));
+			return value ? [{
+				part,
+				value
+			}] : [];
+		});
+		const included = decisions.filter(({ value }) => value.included);
+		const unresolved = decisions.filter(({ value }) => value.unresolved);
+		const excluded = decisions.filter(({ value }) => !value.included && !value.unresolved);
+		const selected = familySelected(inventory, families, session);
+		const missing = selected && session.parts.length === 0;
+		const reasons = [...new Set(decisions.flatMap(({ value }) => value.reason ? [value.reason] : []))].sort();
+		if (missing) reasons.push("unreadable-source");
+		const summary = Object.freeze({
+			status: unresolved.length || missing ? "unresolved" : included.length ? excluded.length ? "partial" : "included" : "excluded",
+			includedParts: included.length,
+			excludedParts: excluded.length,
+			unresolvedParts: unresolved.length,
+			sourceBytes: included.reduce((sum, { part }) => sum + part.snapshot.size, 0),
+			reasons: Object.freeze(reasons)
+		});
+		sessions.set(session.id, summary);
+		if (!selected) continue;
+		if (summary.includedParts) {
+			counts.sessions++;
+			counts.parts += summary.includedParts;
+			counts.sourceBytes += summary.sourceBytes;
+			includedWorkspaces.add(session.workspaceId);
+			coverage.includedSessions++;
+		}
+		if (summary.status === "excluded") coverage.excludedSessions++;
+		if (summary.status === "unresolved") coverage.unresolvedSessions++;
+		coverage.unresolvedParts += summary.unresolvedParts;
 	}
-	return false;
+	counts.workspaces = includedWorkspaces.size;
+	return Object.freeze({
+		counts: Object.freeze(counts),
+		coverage: Object.freeze(coverage),
+		sessions,
+		session: (sessionId) => {
+			const value = sessions.get(sessionId);
+			if (!value) throw new ApplicationError("UNKNOWN_ITEM");
+			return value;
+		},
+		part: (sessionId, partId) => parts.get(sourceKey(sessionId, partId))
+	});
 }
 //#endregion
-//#region packages/application/src/journey/review/retirement.ts
-/**
-* ADR 0079: the confirmed Hide values a commit adds, removes or recategorizes, with the kind
-* each then has (null once removed; for additions, the lowest it can have). Terms exist only in
-* memory for this commit. `rendered` holds the value's keyed digest for each kind, to compare
-* with the values a Work was rendered with; `tokens` holds its words' keyed digests, or null
-* when it has none. A partial value is a literal that may join a neighbour across a chunk edge,
-* so its whole text, and every Work it may reach, is unknown.
-*/
-const deltaValueSchema = z.object({
-	term: z.string().min(1),
-	kind: journeyKindSchema.nullable(),
-	partial: z.boolean(),
-	rendered: z.array(z.string().regex(hideDigestPattern)).length(confirmedHideKinds.length),
-	tokens: z.array(z.string().regex(hideDigestPattern)).min(1).nullable(),
-	/** The new findings an addition comes from; the store keeps it only if one joins a Hide. */
-	sources: z.array(z.object({
-		batchId: z.uuid(),
-		findingId: z.uuid()
-	}).strict()).min(1).optional()
+//#region packages/application/src/journey/scan-exclusion.ts
+/** Manual source-policy proof; never an assertion that unknown content was scanned. */
+const scanExclusionResourceSchema = z.object({
+	kind: z.literal("scan-exclusion"),
+	proofVersion: z.literal(1),
+	journeyId: journeyIdSchema,
+	workId: journeyIdSchema,
+	inputRevision: z.number().int().positive(),
+	snapshotId: journeyDigestSchema,
+	configurationDigest: journeyDigestSchema,
+	rootSessionId: z.string().min(1),
+	sessionId: z.string().min(1),
+	sourceId: z.string().min(1),
+	sourcePartId: z.string().min(1),
+	native: nativeSourceIdentitySchema,
+	adapterVersion: z.string().min(1),
+	reason: z.enum([
+		"guardian-excluded",
+		"missing-parent",
+		"deselected-parent",
+		"ancestry-unresolved",
+		"non-interactive-launch"
+	]),
+	facts: z.object({
+		representation: z.enum(["jsonl", "jsonl.zst"]),
+		byteLength: z.number().int().nonnegative(),
+		sha256: journeyDigestSchema
+	}).strict()
 }).strict();
-/** `keyId` names the journey key the digests were made with; an index under another key is unusable. */
-const keyId = z.string().regex(hideDigestPattern);
-const confirmedHideDeltaSchema = z.discriminatedUnion("scope", [z.object({
-	scope: z.literal("complete"),
-	keyId,
-	from: z.string(),
-	to: z.string(),
-	values: z.array(deltaValueSchema)
-}).strict(), z.object({
-	scope: z.literal("additions"),
-	keyId,
-	values: z.array(deltaValueSchema)
-}).strict()]);
-/** What a value was rendered as: its kind, in the digests a render keeps (ADR 0079). */
-const renderedHideValue = (kind, term) => `${kind}\u0000${term}`;
-function hideDeltaValue(key, term, kind, partial = false) {
-	const tokens = partial ? null : hideValueTokens(term);
-	return {
-		term,
-		kind,
-		partial,
-		rendered: confirmedHideKinds.map((item) => hideTokenDigest(key, renderedHideValue(item, term))),
-		tokens: tokens && tokens.map((token) => hideTokenDigest(key, token))
-	};
+/** Validate policy against frozen identity evidence, never a caller-asserted source role. */
+function validateScanExclusion(resource, state, inventory, capture) {
+	const work = state.works.find((item) => item.id === resource.workId);
+	if (state.phase === "paused") throw new ApplicationError("OPERATION_CANCELED");
+	if (!work || state.scope.status !== "confirmed" || work.access === "drop" || state.pendingHideId) throw new ApplicationError("SCOPE_NOT_READY");
+	if (state.journeyId !== resource.journeyId || work.inputRevision !== resource.inputRevision || state.snapshotId !== resource.snapshotId || !work.rootSessionIds.includes(resource.rootSessionId)) throw new ApplicationError("REVISION_CONFLICT");
+	const families = reviewFamilies(inventory);
+	const part = (families.members.get(resource.rootSessionId)?.find((item) => item.id === resource.sessionId))?.parts.find((item) => item.id === resource.sourcePartId);
+	const evidence = capture.source.nativeEvidence;
+	const launch = resource.reason === "non-interactive-launch";
+	const ancestry = resource.reason === "ancestry-unresolved";
+	if (ancestry && resource.native.role !== "worker") throw new ApplicationError("CORRUPTED_STATE");
+	const prefixRoot = launch && resource.rootSessionId === resource.sessionId && resource.native.role === "main" && evidence?.recognition === "unknown" && evidence.completeness === "prefix" && JSON.stringify(evidence.identity) === JSON.stringify({
+		...resource.native,
+		role: "unknown"
+	});
+	if (!part || capture.partId !== resource.sourcePartId || capture.facts.sha256 !== resource.facts.sha256 || capture.facts.byteLength !== resource.facts.byteLength || capture.facts.representation !== resource.facts.representation || !evidence || !prefixRoot && (evidence.recognition !== "recognized" || JSON.stringify(evidence.identity) !== JSON.stringify(resource.native)) || evidence.integrity !== "valid" || evidence.adapterVersion !== resource.adapterVersion || evidence.snapshotId !== sourceSnapshotId(capture.source) || JSON.stringify(part.nativeEvidence) !== JSON.stringify(evidence)) throw new ApplicationError("CORRUPTED_STATE");
+	const ids = new Set(work.rootSessionIds.flatMap((id) => (families.members.get(id) ?? []).map((item) => item.id)));
+	const sessions = inventory.sessions.filter((item) => ids.has(item.id));
+	const workspaceIds = new Set(sessions.map((item) => item.workspaceId));
+	const decision = resolveSourceSelection({
+		...inventory,
+		sessions,
+		workspaces: inventory.workspaces.filter((item) => workspaceIds.has(item.id))
+	}, "configured").part(resource.sessionId, resource.sourcePartId);
+	if (!decision || (prefixRoot ? decision.included || decision.reason !== "unknown-source" : ancestry ? decision.included ? decision.reason !== null : decision.reason !== resource.reason : decision.included !== launch || (launch ? decision.reason !== null : decision.reason !== resource.reason))) throw new ApplicationError("CORRUPTED_STATE");
 }
-const kindOf = (kind) => journeyKindSchema.nullable().parse(kind ?? null);
-const rank = (kind) => kind === null ? -1 : confirmedHideKinds.indexOf(kind);
+//#endregion
+//#region packages/application/src/journey/scan-git-seeds.ts
 /**
-* Every value whose hidden kind differs between two states (ADR 0086): both are read against the
-* same dictionary, which only grows and is unchanged by the commit that asks.
+* Owner-only Git detector input fixed once per frozen snapshot and canonical root set.
+* Later Git activity cannot change or invalidate a scan of the same frozen sources.
 */
-async function readConfirmedHideChange(reader, key, previous, next) {
-	const terms = await reader.journeyTerms({ journeyId: previous.journeyId });
-	const before = dictionaryHides(previous, terms), after = dictionaryHides(next, terms);
-	return {
-		scope: "complete",
-		keyId: hideKeyId(key),
-		from: confirmedHideKey(previous),
-		to: confirmedHideKey(next),
-		values: [.../* @__PURE__ */ new Set([...before.keys(), ...after.keys()])].filter((term) => before.get(term)?.kind !== after.get(term)?.kind).map((term) => hideDeltaValue(key, term, kindOf(after.get(term)?.kind)))
+const scanGitSeedsResourceSchema = z.object({
+	kind: z.literal("git-seeds"),
+	journeyId: journeyIdSchema,
+	snapshotId: journeyDigestSchema,
+	roots: z.array(z.string()),
+	seeds: z.object({
+		names: z.array(z.string().min(1)),
+		snapshots: z.array(z.object({
+			id: z.string().min(1),
+			sha256: z.string()
+		}).strict())
+	}).strict(),
+	sha256: journeyDigestSchema
+}).strict();
+/** Storage key; equal root sets in any order share one receipt. */
+const scanGitSeedsId = (snapshotId, roots) => `${snapshotId}:${textDigest(JSON.stringify([...new Set(roots)].sort()))}`;
+function scanGitSeedsResource(journeyId, snapshotId, roots, seeds) {
+	const value = {
+		names: [...seeds.names],
+		snapshots: seeds.snapshots.map((row) => ({ ...row }))
 	};
-}
-/** Dictionary values a commit may add to the hidden set, each with its type's kind (ADR 0086). */
-function termHideAdditions(key, values) {
-	const unique = /* @__PURE__ */ new Map();
-	for (const { term, kind } of values) unique.set(JSON.stringify([term, kind]), hideDeltaValue(key, term, kindOf(kind)));
 	return {
-		scope: "additions",
-		keyId: hideKeyId(key),
-		values: [...unique.values()]
+		kind: "git-seeds",
+		journeyId,
+		snapshotId,
+		roots: [...new Set(roots)].sort(),
+		seeds: value,
+		sha256: textDigest(JSON.stringify(value))
 	};
 }
-/**
-* The values new Gray findings can add. A finding at a chunk edge may join a neighbouring
-* literal of the same field, so its words are not checked.
-*/
-function confirmedHideAdditions(key, records) {
-	const values = /* @__PURE__ */ new Map();
-	for (const record of records) {
-		const chunks = new Map(record.chunks.map((chunk) => [chunk.id, chunk]));
-		for (const finding of record.findings) {
-			const chunk = chunks.get(finding.chunkId);
-			if (!chunk || finding.class !== "gray") continue;
-			const whole = chunk.offset === 0 && chunk.textHash === chunk.fieldHash;
-			const joins = finding.start === 0 && chunk.offset > 0 || finding.end === chunk.text.length && !whole;
-			const source = {
-				batchId: record.batchId,
-				findingId: finding.id
-			};
-			for (const term of bLiteralTerms(chunk.text.slice(finding.start, finding.end))) {
-				const id = JSON.stringify([
-					term,
-					finding.kind,
-					joins
-				]);
-				const value = values.get(id);
-				if (value) value.sources.push(source);
-				else values.set(id, {
-					...hideDeltaValue(key, term, finding.kind, joins),
-					sources: [source]
-				});
-			}
-		}
-	}
-	return {
-		scope: "additions",
-		keyId: hideKeyId(key),
-		values: [...values.values()]
-	};
+/** A missing, tampered or foreign receipt is corrupted state, never a cue to reread live Git. */
+function verifiedScanGitSeeds(resource, snapshotId, roots) {
+	if (resource.snapshotId !== snapshotId || scanGitSeedsId(resource.snapshotId, resource.roots) !== scanGitSeedsId(snapshotId, roots) || textDigest(JSON.stringify(resource.seeds)) !== resource.sha256) throw new ApplicationError("CORRUPTED_STATE");
+	return resource.seeds;
 }
+//#endregion
+//#region packages/application/src/journey/scan-session.ts
+const count$8 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const scanFileSchema = z.object({
+	path: z.string().min(1),
+	identity: fileIdentitySchema,
+	sha256: journeyDigestSchema,
+	byteLength: count$8
+}).strict();
 /**
-* How hidden values moved when the value overrides and type answers stay the same: not at all,
-* only added (new dictionary values of hiding types), only removed, or otherwise. A type's
-* hidden values are its distinct values while it hides; an answer that changes whether a type
-* hides is otherwise, so only a complete delta covers it.
+* Track A source-bound prose (`file`) with built-in static protection spans; no delivery archive
+* exists during scanning (ADR 0172). Obsolete version 3 inputs with detector evidence are refused.
 */
-function memberChange(previous, next) {
-	if (!sameValueOverrides(previous, next)) return "other";
-	if (termTypes.some((type) => typeGroup(previous, type) !== void 0 && typeHides(previous, type) !== typeHides(next, type))) return "other";
-	const hidden = (state, type) => typeHides(state, type) ? typeGroup(state, type)?.count ?? 0 : 0;
-	const counts = termTypes.map((type) => hidden(next, type) - hidden(previous, type));
-	if (counts.every((count) => count === 0)) return "same";
-	return counts.every((count) => count >= 0) ? "additions" : counts.every((count) => count <= 0) ? "removals" : "other";
+const sessionScanInputSchema = z.object({
+	version: z.literal(4),
+	sessionId: z.string().min(1),
+	file: scanFileSchema,
+	sources: z.array(z.object({
+		sourceId: z.string().min(1),
+		sourcePartId: z.string().min(1),
+		native: nativeSourceIdentitySchema,
+		facts: z.object({
+			representation: z.enum(["jsonl", "jsonl.zst"]),
+			byteLength: count$8,
+			sha256: journeyDigestSchema
+		}).strict()
+	}).strict()),
+	recordCount: count$8,
+	fieldCount: count$8,
+	inputUtf16: count$8,
+	mainReviewVerified: z.literal(true),
+	emptyReviewVerified: z.boolean()
+}).strict().refine((input) => new Set(input.sources.map((source) => source.sourceId)).size === input.sources.length);
+const scanSessionResourceSchema = z.object({
+	kind: z.literal("scan-session"),
+	journeyId: journeyIdSchema,
+	workId: journeyIdSchema,
+	inputRevision: count$8.min(1),
+	snapshotId: journeyDigestSchema,
+	configurationDigest: journeyDigestSchema,
+	rootSessionId: z.string().min(1),
+	input: sessionScanInputSchema
+}).strict();
+/** Complete scan-set evidence for certified empty main input; never an output digest. */
+function scanPreparationDigest(resources) {
+	return textDigest(JSON.stringify(resources.map((resource) => resource.kind === "scan-exclusion" ? resource : [
+		resource.input.sessionId,
+		resource.rootSessionId,
+		resource.configurationDigest,
+		resource.input.file.sha256,
+		resource.input.sources
+	]).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)))));
 }
-/**
-* Whether a Work's output may change with the delta (Work metadata is never masked, so a
-* generated description never retires on its own). Without a delta that covers this exact change every Work is affected, as ADR 0069 first decided, except when
-* members were only removed: no value is then added, so nothing can be under-hidden, and an
-* output may keep masking a value that left its category until it is rendered again.
-*/
-function impact(previous, next, delta, outputIndex) {
-	const change = memberChange(previous, next);
-	const covered = delta && (delta.scope === "complete" ? delta.from === confirmedHideKey(previous) && delta.to === confirmedHideKey(next) : change === "additions" || change === "same");
-	if (!delta || !covered) return change === "removals" || change === "same" ? () => false : () => true;
-	const unchanged = (index, value) => {
-		const at = value.rendered.findIndex((digest) => hideIndexHas(index.values, digest));
-		const was = at < 0 ? null : confirmedHideKinds[at] ?? null;
-		return delta.scope === "additions" ? rank(was) >= rank(value.kind) : was === value.kind;
-	};
-	const reaches = (index, value) => {
-		const digests = index.digests;
-		return !value.tokens || !digests || value.tokens.every((token) => hideIndexHas(digests, token));
-	};
-	return (work) => {
-		if (!work.artifact) return false;
-		const found = outputIndex(work);
-		const index = found?.keyId === delta.keyId ? found : null;
-		return !index || delta.values.some((value) => value.partial || !unchanged(index, value) && reaches(index, value));
-	};
+const scanBatchBinding = {
+	journeyId: journeyIdSchema,
+	workId: journeyIdSchema,
+	inputRevision: count$8.min(1),
+	snapshotId: journeyDigestSchema,
+	configurationDigest: journeyDigestSchema
+};
+const scanCanonicalResourceSchema = z.object({
+	...scanBatchBinding,
+	kind: z.literal("scan-canonical"),
+	id: journeyDigestSchema,
+	batchId: journeyIdSchema,
+	batchDigest: journeyDigestSchema
+}).strict();
+const scanAliasResourceSchema = z.object({
+	...scanBatchBinding,
+	kind: z.literal("scan-alias"),
+	id: journeyIdSchema,
+	canonicalBatchId: journeyIdSchema,
+	canonicalBatchDigest: journeyDigestSchema,
+	targetBatchId: journeyIdSchema,
+	targetBatchDigest: journeyDigestSchema,
+	equivalenceDigest: journeyDigestSchema
+}).strict();
+//#endregion
+//#region packages/application/src/journey/b/repair.ts
+const bRepairPlanSchema = z.object({
+	unitId: journeyDigestSchema,
+	unitDigest: journeyDigestSchema,
+	priorDigest: journeyDigestSchema,
+	round: z.literal(1),
+	targetFields: z.array(bIdSchema).min(1).max(24),
+	remainingFields: z.array(bIdSchema)
+}).strict();
+const bReviewDigest = (submission) => bDigest(JSON.stringify(bReviewSubmissionSchema.parse(submission)));
+const repairMeaning = (part) => JSON.stringify([part.category, part.classification]);
+function planBRepair(unit, review, completedRepairs = 0) {
+	if (completedRepairs !== 0) throw new ApplicationError("INVALID_OPERATION");
+	const validated = validateBReview(unit, review.submission);
+	const needed = new Set(validated.issues.flatMap((issue) => issue.fieldId === null ? [] : [issue.fieldId]));
+	const targets = [...new Set(unit.fragments.filter((part) => part.core).map((part) => part.fieldId))].filter((fieldId) => needed.has(fieldId));
+	if (!targets.length) return null;
+	return bRepairPlanSchema.parse({
+		unitId: unit.id,
+		unitDigest: unit.digest,
+		priorDigest: bReviewDigest(review.submission),
+		round: 1,
+		targetFields: targets.slice(0, 24),
+		remainingFields: [...needed].filter((fieldId) => !targets.slice(0, 24).includes(fieldId))
+	});
 }
-/**
-* Applied with every Journey commit. When confirmed Hide categories or their members change,
-* a Work whose output or generated description may change is retired until both are produced
-* again (ADR 0069); ADR 0079 limits this to Works the changed values can reach.
-*/
-function settleConfirmedHides(previous, next, delta, outputIndex = () => null) {
-	if (!previous || confirmedHideKey(previous) === confirmedHideKey(next)) return next;
-	const before = new Map(previous.works.map((work) => [work.id, work.revision]));
-	const affected = impact(previous, next, delta, outputIndex);
+function mergeBRepair(unit, previous, inputPlan, raw) {
+	const plan = bRepairPlanSchema.parse(inputPlan);
+	const expected = planBRepair(unit, previous);
+	if (JSON.stringify(plan) !== JSON.stringify(expected)) throw new ApplicationError("REVISION_CONFLICT");
+	const correction = bReviewSubmissionSchema.parse(raw);
+	const targeted = (fieldId) => plan.targetFields.includes(fieldId);
+	if ([
+		...correction.terms.flatMap((term) => term.occurrences),
+		...correction.retainedSourceGroups,
+		...correction.representationLimits,
+		...correction.uncertainOccurrences
+	].some((part) => !targeted(part.fieldId))) throw new ApplicationError("INVALID_REVIEW_SPAN");
+	const repaired = validateBReview(unit, correction, plan.targetFields);
+	const prior = validateBReview(unit, previous.submission);
+	const correctedMeanings = /* @__PURE__ */ new Map();
+	for (const part of repaired.sensitive) {
+		const key = bAnchorKey(part);
+		const meanings = correctedMeanings.get(key) ?? /* @__PURE__ */ new Set();
+		meanings.add(repairMeaning(part));
+		correctedMeanings.set(key, meanings);
+	}
+	const preservedKeys = /* @__PURE__ */ new Set();
+	const conflicts = [];
+	const preserved = prior.sensitive.filter((part) => targeted(part.fieldId)).flatMap((part) => {
+		const retentions = part.classification.class === "certain" ? [] : repaired.retained.filter((retained) => retained.fieldId === part.fieldId);
+		return subtractBRanges([part], retentions).map((range) => ({
+			fieldId: part.fieldId,
+			recordId: part.recordId,
+			fieldHash: part.fieldHash,
+			...range,
+			exactQuote: codePointSlice(part.exactQuote, range.start - part.start, range.end - part.start),
+			category: part.category,
+			classification: part.classification,
+			reason: "Prior sensitive obligation preserved during bounded repair."
+		}));
+	}).filter((part) => {
+		const anchor = bAnchorKey(part), meaning = repairMeaning(part), corrected = correctedMeanings.get(anchor);
+		if (corrected && (corrected.size > 1 || !corrected.has(meaning))) conflicts.push(bIssue("CONFLICTING_PRIVACY_DECISIONS", part));
+		if (corrected?.has(meaning)) return false;
+		const key = JSON.stringify([anchor, meaning]);
+		if (preservedKeys.has(key)) return false;
+		preservedKeys.add(key);
+		return true;
+	});
+	const original = previous.submission;
+	const merged = {
+		...original,
+		terms: [...original.terms.map((term) => ({
+			...term,
+			occurrences: term.occurrences.filter((part) => !targeted(part.fieldId))
+		})).filter((term) => term.occurrences.length > 0), ...correction.terms],
+		retainedSourceGroups: [...original.retainedSourceGroups.filter((part) => !targeted(part.fieldId)), ...correction.retainedSourceGroups],
+		representationLimits: [
+			...original.representationLimits.filter((part) => !targeted(part.fieldId)),
+			...correction.representationLimits,
+			...preserved
+		],
+		uncertainOccurrences: [...original.uncertainOccurrences.filter((part) => !targeted(part.fieldId)), ...correction.uncertainOccurrences],
+		coverage: [...original.coverage.filter((part) => !targeted(part.fieldId)), ...correction.coverage],
+		sessionDecision: correction.sessionDecision
+	};
+	const review = validateBReview(unit, merged);
+	review.issues = [...new Map([...review.issues, ...conflicts].map((issue) => [JSON.stringify(issue), issue])).values()];
 	return {
-		...next,
-		works: next.works.map((work) => work.artifact === null && work.revision > (before.get(work.id) ?? work.revision) || !affected(work) ? work : {
-			...retireWorkDescription(work),
-			artifact: null,
-			revision: work.revision + 1,
-			status: work.status === "ready" ? "review" : work.status
-		})
+		review,
+		receipt: {
+			...plan,
+			resultDigest: bReviewDigest(merged),
+			priorObligationsPreserved: true,
+			unresolvedIssues: review.issues
+		}
 	};
 }
 //#endregion
-//#region packages/application/src/journey/storage.ts
-const journeyEventSchema = z.object({
-	sequence: z.number().int().nonnegative(),
+//#region packages/application/src/journey/review/limits.ts
+/** Raw provider bytes stay bounded independently of JSON escaping and compiled findings. */
+const reviewResponseBytes = 4194304;
+/** Fits the escaped raw-response envelope and evidence plus compiled occurrence findings. */
+const reviewTransportBytes = 33554432;
+//#endregion
+//#region packages/application/src/journey/review/candidate-schema.ts
+const reviewIssueSchema = z.object({
+	code: z.string().regex(/^[A-Z_]{3,80}$/u),
+	fieldId: z.string().min(1).nullable(),
+	start: z.number().int().nonnegative().nullable(),
+	end: z.number().int().nonnegative().nullable()
+}).strict();
+const reviewCandidateInputSchema = z.object({
 	journeyId: journeyIdSchema,
-	revision: z.number().int().nonnegative(),
-	kind: z.enum([
-		"started",
-		"response",
-		"snapshot",
-		"batch",
-		"output",
-		"send",
-		"search"
-	]),
-	source: z.enum([
-		"conversation",
-		"panel",
-		"system"
-	]),
-	at: z.iso.datetime(),
-	alignment: reviewAlignmentAuditSchema.optional(),
-	preferenceScopes: z.array(z.object({
-		groupId: journeyIdSchema,
-		preferenceScope: journeyPreferenceScopeSchema
-	}).strict()).min(1).max(1e4).optional(),
-	correction: correctionAuditSchema.optional(),
-	decision: delegatedDecisionSchema.extend({
-		action: z.enum([
-			"group",
-			"groups-hide",
-			"work-access",
-			"instruction",
-			"correction",
-			"works-access",
-			"work-type",
-			"scope-confirm",
-			"card-answer",
-			"cards-confirm"
-		]),
-		targetIds: z.array(journeyIdSchema).min(1),
-		choice: z.string().min(1).max(16)
-	}).optional()
+	batchId: journeyIdSchema,
+	batchDigest: journeyDigestSchema,
+	idempotencyKey: journeyIdSchema,
+	attemptId: journeyIdSchema,
+	response: z.string().min(1).refine((value) => Buffer.byteLength(value, "utf8") <= reviewResponseBytes),
+	repairId: journeyIdSchema.nullable(),
+	sessionReviewId: journeyIdSchema.nullable()
 }).strict();
-const journeyCommitSchema = z.object({
-	expectedRevision: z.number().int().nonnegative().nullable(),
-	requestKey: journeyIdSchema,
+const reviewCandidateResourceSchema = reviewCandidateInputSchema.omit({ idempotencyKey: true }).extend({
+	kind: z.literal("b-candidate"),
+	id: journeyIdSchema,
 	requestHash: journeyDigestSchema,
-	state: nativeJourneySchema,
-	event: journeyEventSchema.omit({
-		sequence: true,
-		revision: true
-	}),
-	/** Inserted in the same transaction as this state; never through the generic resource save. */
-	correctionReport: correctionReportResourceSchema.optional(),
-	/** Set by the store for this commit only and never persisted (ADR 0079). */
-	confirmedHideDelta: confirmedHideDeltaSchema.optional(),
-	/** Dictionary values a Hide override adds (ADR 0086), inserted with this state. */
-	terms: z.array(z.object({
-		type: termTypeSchema,
-		value: z.string().min(1)
-	}).strict()).max(2e4).optional()
-}).strict();
-const journeyCommitResultSchema = z.object({
+	at: z.iso.datetime(),
+	workId: journeyIdSchema,
+	inputRevision: z.number().int().positive(),
+	snapshotId: journeyDigestSchema,
+	responseDigest: journeyDigestSchema,
 	status: z.enum([
-		"applied",
-		"replayed",
-		"stale"
+		"valid",
+		"pending",
+		"invalid"
 	]),
-	state: nativeJourneySchema
+	issues: z.array(reviewIssueSchema),
+	evidence: bReviewSubmissionSchema.nullable()
+}).strict();
+const reviewCandidateResultSchema = reviewCandidateResourceSchema.pick({
+	responseDigest: true,
+	status: true,
+	issues: true,
+	evidence: true
+}).extend({ candidateId: journeyIdSchema }).strict();
+const reviewRepairInputSchema = z.object({
+	journeyId: journeyIdSchema,
+	candidateId: journeyIdSchema,
+	idempotencyKey: journeyIdSchema
+}).strict();
+const reviewRepairResourceSchema = z.object({
+	kind: z.literal("b-repair"),
+	id: journeyIdSchema,
+	journeyId: journeyIdSchema,
+	workId: journeyIdSchema,
+	batchId: journeyIdSchema,
+	batchDigest: journeyDigestSchema,
+	inputRevision: z.number().int().positive(),
+	snapshotId: journeyDigestSchema,
+	candidateId: journeyIdSchema,
+	requestHash: journeyDigestSchema,
+	at: z.iso.datetime(),
+	plan: bRepairPlanSchema
 }).strict();
 //#endregion
 //#region packages/application/src/journey/review/usefulness-schema.ts
@@ -3957,7 +4490,7 @@ const reviewProgressSchema = z.array(z.object({
 }).strict());
 //#endregion
 //#region packages/application/src/journey/review/session-schema.ts
-const count$8 = z.number().int().nonnegative();
+const count$7 = z.number().int().nonnegative();
 const sessionReviewInputSchema = z.object({
 	journeyId: journeyIdSchema,
 	workId: journeyIdSchema,
@@ -3978,7 +4511,7 @@ const sessionReviewResourceSchema = z.object({
 	workId: journeyIdSchema,
 	sessionId: z.string().min(1).max(128),
 	snapshotId: journeyDigestSchema,
-	inputRevision: count$8.positive(),
+	inputRevision: count$7.positive(),
 	requestHash: journeyDigestSchema,
 	bindingDigest: journeyDigestSchema,
 	at: z.iso.datetime(),
@@ -3992,8 +4525,8 @@ const sessionReviewResourceSchema = z.object({
 	issues: z.array(reviewIssueSchema),
 	requiresSemantic: z.boolean(),
 	usefulness: sessionUsefulnessSchema,
-	totalCodePoints: count$8,
-	reviewedCodePoints: count$8
+	totalCodePoints: count$7,
+	reviewedCodePoints: count$7
 }).strict();
 const sessionRereadInputSchema = z.object({
 	journeyId: journeyIdSchema,
@@ -4002,8 +4535,8 @@ const sessionRereadInputSchema = z.object({
 	anchors: z.array(z.object({
 		fieldId: z.string().min(1),
 		fieldHash: journeyDigestSchema,
-		start: count$8,
-		end: count$8
+		start: count$7,
+		end: count$7
 	}).strict()).min(1).max(128)
 }).strict();
 const sessionRereadResourceSchema = z.object({
@@ -4012,7 +4545,7 @@ const sessionRereadResourceSchema = z.object({
 	journeyId: journeyIdSchema,
 	workId: journeyIdSchema,
 	sessionId: z.string().min(1).max(128),
-	inputRevision: count$8.positive(),
+	inputRevision: count$7.positive(),
 	snapshotId: journeyDigestSchema,
 	sessionReviewId: journeyIdSchema,
 	bindingDigest: journeyDigestSchema,
@@ -4030,8 +4563,8 @@ const sessionReconcileInputSchema = z.object({
 	alignment: reviewAlignmentSchema
 }).strict();
 const retainedReviewAnchorSchema = bAnchorSchema.extend({
-	utf16Start: count$8,
-	utf16End: count$8,
+	utf16Start: count$7,
+	utf16End: count$7,
 	owned: z.boolean()
 }).strict();
 const sessionOverlaySchema = z.object({
@@ -4045,7 +4578,7 @@ const sessionReconciliationResourceSchema = z.object({
 	journeyId: journeyIdSchema,
 	workId: journeyIdSchema,
 	sessionId: z.string().min(1).max(128),
-	inputRevision: count$8.positive(),
+	inputRevision: count$7.positive(),
 	snapshotId: journeyDigestSchema,
 	sessionReviewId: journeyIdSchema,
 	bindingDigest: journeyDigestSchema,
@@ -4073,8 +4606,8 @@ const sessionReviewQuerySchema = z.object({
 	workId: journeyIdSchema.optional(),
 	sessionId: z.string().min(1).max(128).optional(),
 	sessionReviewId: journeyIdSchema.optional(),
-	afterHit: count$8.default(0),
-	limit: count$8.positive().max(500).default(100)
+	afterHit: count$7.default(0),
+	limit: count$7.positive().max(500).default(100)
 }).strict();
 const sessionReviewStatusSchema = z.object({
 	complete: z.boolean(),
@@ -4090,8 +4623,8 @@ const sessionReviewStatusSchema = z.object({
 		requiresHumanDecision: z.boolean(),
 		requiresSemantic: z.boolean(),
 		issues: z.array(reviewIssueSchema),
-		totalCodePoints: count$8,
-		reviewedCodePoints: count$8,
+		totalCodePoints: count$7,
+		reviewedCodePoints: count$7,
 		reconciliationId: journeyIdSchema.nullable(),
 		/** ADR 0086: a read unit of the session suggests excluding it; advice, never a gate. */
 		suggestExclude: z.boolean(),
@@ -4099,8 +4632,8 @@ const sessionReviewStatusSchema = z.object({
 		reason: z.string().min(1).max(2e3).nullable()
 	}).strict()),
 	hits: z.array(sessionReviewHitSchema),
-	nextHit: count$8.nullable(),
-	totalHits: count$8
+	nextHit: count$7.nullable(),
+	totalHits: count$7
 }).strict();
 const sessionReviewResultSchema = z.object({
 	preparation: sessionReviewResourceSchema,
@@ -4184,13 +4717,13 @@ const metadataFieldsSchema = z.object({
 }).strict();
 //#endregion
 //#region packages/application/src/journey/placement/routing-schema.ts
-const count$7 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const count$6 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const bucket = z.object({
 	complete: z.boolean(),
-	total: count$7,
+	total: count$6,
 	repositories: z.array(z.object({
 		id: z.string().min(1),
-		count: count$7.min(1)
+		count: count$6.min(1)
 	}).strict())
 }).strict();
 const placementSignalsSchema = z.object({
@@ -4208,8 +4741,8 @@ const cheapPlacementSchema = z.object({
 		"name"
 	]),
 	confidence: z.enum(["high", "medium"]),
-	matched: count$7.min(1),
-	total: count$7.min(1),
+	matched: count$6.min(1),
+	total: count$6.min(1),
 	otherRepositoryIds: z.array(z.string())
 }).strict();
 const sortingResourceSchema = z.object({
@@ -4230,26 +4763,26 @@ const sortingResourceSchema = z.object({
 const sortingApplySchema = z.object({
 	journeyId: z.uuid(),
 	sessionId: z.string().min(1).max(128),
-	expectedRevision: count$7,
+	expectedRevision: count$6,
 	idempotencyKey: z.uuid()
 }).strict();
 /** Preparation moves identified failing roots of one pending Work into its blocked Work. */
 const journeyIsolateSchema = z.object({
 	journeyId: z.uuid(),
 	workId: z.uuid(),
-	inputRevision: count$7.min(1),
+	inputRevision: count$6.min(1),
 	roots: z.array(z.object({
 		sessionId: z.string().min(1).max(128),
 		code: z.string().regex(/^[A-Z_]{3,80}$/u)
 	}).strict()).min(1).max(1e5),
-	expectedRevision: count$7,
+	expectedRevision: count$6,
 	idempotencyKey: z.uuid()
 }).strict();
 const placement = z.object({
 	workId: z.uuid(),
 	sessionId: z.string().min(1).max(128),
-	inputRevision: count$7.min(1),
-	throughEvent: count$7,
+	inputRevision: count$6.min(1),
+	throughEvent: count$6,
 	contextDigest: z.string().regex(/^[a-f0-9]{64}$/u),
 	decision: z.enum([
 		"join",
@@ -4265,13 +4798,13 @@ const placement = z.object({
 }).strict();
 const journeyPlaceSchema = z.object({
 	journeyId: z.uuid(),
-	expectedRevision: count$7,
+	expectedRevision: count$6,
 	idempotencyKey: z.uuid(),
 	placements: z.array(placement).min(1).max(1e3)
 }).strict();
 //#endregion
 //#region packages/application/src/journey/scope/progress.ts
-const count$6 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const count$5 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const ids = z.array(z.string().min(1).max(128)).max(1e5).refine((values) => new Set(values).size === values.length);
 const journeyClassificationProgressSchema = z.object({
 	journeyId: journeyIdSchema,
@@ -4279,8 +4812,8 @@ const journeyClassificationProgressSchema = z.object({
 	id: z.literal("current"),
 	snapshotId: journeyDigestSchema,
 	inputFingerprint: journeyDigestSchema,
-	baselineRevision: count$6,
-	proposalRevision: count$6.nullable(),
+	baselineRevision: count$5,
+	proposalRevision: count$5.nullable(),
 	stage: z.enum(["classification", "proposal"]),
 	status: z.enum([
 		"running",
@@ -4290,7 +4823,7 @@ const journeyClassificationProgressSchema = z.object({
 	]),
 	startedAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime(),
-	elapsedMs: count$6,
+	elapsedMs: count$5,
 	rootIds: ids,
 	completedRootIds: ids,
 	groupedRootIds: ids,
@@ -4325,9 +4858,23 @@ const journeyCaptureSchema = z.object({
 }).strict();
 const base = { journeyId: journeyIdSchema };
 const journeyResourceSchema = z.discriminatedUnion("kind", [
+	z.object({
+		...base,
+		kind: z.literal("closed-reader"),
+		id: z.string(),
+		batchId: journeyIdSchema,
+		packId: journeyIdSchema
+	}).strict(),
 	scanSessionResourceSchema,
 	scanCanonicalResourceSchema,
 	scanAliasResourceSchema,
+	z.object({
+		...base,
+		kind: z.literal("withdrawn-term-pack"),
+		id: z.string(),
+		batchId: journeyIdSchema,
+		packId: journeyIdSchema
+	}).strict(),
 	scanExclusionResourceSchema,
 	scanGitSeedsResourceSchema,
 	staticSessionResourceSchema,
@@ -4540,124 +5087,18 @@ function projectPreparationProgress(state, plan, captures, starts, settlements)
 		}).map((work) => work.id),
 		targetParts: sizes.size,
 		capturedParts: captured.length,
-		targetBytes: [...sizes.values()].reduce((sum, size) => sum + size, 0),
-		capturedBytes: captured.reduce((sum, resource) => sum + resource.capture.facts.byteLength, 0)
-	};
-}
-//#endregion
-//#region packages/application/src/journey/policy/port.ts
-const journeyPolicyRespondSchema = z.object({
-	request: nativeRespondSchema,
-	source: z.enum(["conversation", "panel"]),
-	now: z.iso.datetime()
-}).strict();
-//#endregion
-//#region packages/application/src/journey/search.ts
-const count$5 = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
-const term = z.string().min(1).max(1024).refine((value) => Buffer.byteLength(value) <= 1024 && !/[\0\r\n]/u.test(value));
-const journeySearchSchema = z.object({
-	journeyId: journeyIdSchema,
-	terms: z.array(z.object({
-		id: z.string().min(1).max(64),
-		text: term,
-		variants: z.array(term).max(7).default([])
-	}).strict()).min(1).max(16)
-}).strict();
-const journeySearchResultSchema = z.object({
-	binding: z.object({
-		journeyId: journeyIdSchema,
-		snapshotId: journeyDigestSchema,
-		revision: count$5,
-		scopeDigest: journeyDigestSchema,
-		outputs: z.array(z.object({
-			workId: journeyIdSchema,
-			outputRevision: count$5,
-			sha256: journeyDigestSchema
-		}).strict())
-	}).strict(),
-	status: z.enum(["complete", "partial"]),
-	scope: z.object({
-		retainedText: z.literal(true),
-		metadata: z.literal(true),
-		setupText: z.literal(true),
-		attachments: z.literal(false),
-		images: z.literal(false),
-		originals: z.literal("frozen-native-records-and-discovery-metadata"),
-		matching: z.literal("case-sensitive-literal-leftmost-longest")
-	}).strict(),
-	terms: z.array(z.object({
-		id: z.string(),
-		tried: z.array(z.string()),
-		sentMatches: count$5.nullable(),
-		originalMatches: count$5.nullable(),
-		sentSessions: count$5.nullable(),
-		originalSessions: count$5.nullable()
-	}).strict()),
-	hits: z.array(z.object({
-		termId: z.string(),
-		basis: z.enum(["sent", "original"]),
-		workId: journeyIdSchema,
-		locator: z.object({
-			kind: z.enum([
-				"retained-text",
-				"metadata",
-				"setup-text"
-			]),
-			entryPath: z.string().optional(),
-			archiveSessionId: z.string().optional(),
-			sessionId: z.string().optional(),
-			sourcePartId: z.string().optional(),
-			recordIndex: count$5,
-			fieldId: z.string(),
-			line: count$5
-		}).strict(),
-		occurrences: count$5,
-		modelContext: z.string().max(4096).optional(),
-		match: z.object({
-			variantIndex: count$5.max(7),
-			start: count$5,
-			end: count$5
-		}).strict().optional()
-	}).strict()),
-	failures: z.array(z.object({
-		workId: journeyIdSchema,
-		basis: z.enum(["sent", "original"]),
-		code: z.enum(["SEARCH_INPUT_UNAVAILABLE", "SEARCH_ENGINE_FAILED"])
-	}).strict()),
-	truncated: z.boolean()
-}).strict().refine((result) => result.hits.every((hit) => {
-	if (hit.basis === "original") return hit.modelContext === void 0 && hit.match === void 0;
-	if (!hit.match || hit.modelContext === void 0) return false;
-	const { start, end, variantIndex } = hit.match;
-	const variant = result.terms.find((term) => term.id === hit.termId)?.tried[variantIndex];
-	if (!variant || end <= start || end > hit.modelContext.length || hit.modelContext.slice(start, end) !== variant) return false;
-	return [start, end].every((offset) => {
-		const before = hit.modelContext?.charCodeAt(offset - 1) ?? 0;
-		const after = hit.modelContext?.charCodeAt(offset) ?? 0;
-		return !(before >= 55296 && before <= 56319 && after >= 56320 && after <= 57343);
-	});
-}));
-const journeySearchSaveSchema = z.object({
-	journeyId: journeyIdSchema,
-	expectedRevision: count$5,
-	idempotencyKey: journeyIdSchema,
-	result: journeySearchResultSchema
-}).strict();
-function searchScopeDigest(state) {
-	return textDigest(JSON.stringify({
-		snapshot: state.snapshotId,
-		configurationId: state.configurationId,
-		pendingHideId: state.pendingHideId,
-		works: state.works.map((work) => ({
-			id: work.id,
-			revision: work.revision,
-			inputRevision: work.inputRevision,
-			access: work.access,
-			artifact: work.artifact?.sha256 ?? null
-		}))
-	}));
+		targetBytes: [...sizes.values()].reduce((sum, size) => sum + size, 0),
+		capturedBytes: captured.reduce((sum, resource) => sum + resource.capture.facts.byteLength, 0)
+	};
 }
 //#endregion
+//#region packages/application/src/journey/policy/port.ts
+const journeyPolicyRespondSchema = z.object({
+	request: nativeRespondSchema,
+	source: z.enum(["conversation", "panel"]),
+	now: z.iso.datetime()
+}).strict();
+//#endregion
 //#region packages/application/src/journey/hide/port.ts
 const hidePublishSchema = z.object({
 	expectedRevision: z.number().int().nonnegative(),
@@ -4815,7 +5256,7 @@ function retireScanGeneration(state, workId) {
 }
 /** The same Work with a new scan generation: it is read again from its first session. */
 function resetWorkScan(work) {
-	const { emptyReview: _empty, excludedReview: _excluded, staticReview: _static, metadataReviewedDigest: _metadata, reviewReuseFrom: _reuse, renderFailure: _failure, ...retained } = work;
+	const { reviewInterruptions: _reviewInterruptions, emptyReview: _empty, excludedReview: _excluded, staticReview: _static, metadataReviewedDigest: _metadata, reviewReuseFrom: _reuse, renderFailure: _failure, ...retained } = work;
 	return {
 		...retained,
 		revision: work.revision + 1,
@@ -4851,6 +5292,11 @@ const classificationCommitSchema = z.object({
 	/** `classificationPartition` of the state the proposal was prepared against. */
 	partition: journeyDigestSchema,
 	late: z.boolean(),
+	accountAccess: z.record(z.string(), accountWorkAccessSchema).optional(),
+	/** Binds late account facts to the full read that remains current at commit. */
+	accountSubject: z.string().min(1).max(128).optional(),
+	/** A failed or mismatched late read (ADR 0277 section 5). */
+	accountRead: z.enum(["signed-out", "unavailable"]).optional(),
 	items: z.array(journeyClassificationSubmitSchema.shape.items.element.extend({
 		workId: journeyIdSchema,
 		workspaceIds: workspaces
@@ -4874,13 +5320,22 @@ function classificationPartition(state) {
 		work.rootSessionIds.toSorted()
 	]))).digest("hex");
 }
+/**
+* Two placed Works one late item may join: the same access, origin, confirmation, recorded
+* Public choice and account access conflict, as local-host isolation.ts compares. The Skill's `validateLatePlacedWorks` mirrors this rule before commit.
+*/
+function sameAccessRecord(work, other) {
+	return work.access === other?.access && work.accessOrigin === other.accessOrigin && work.accessConfirmed === other.accessConfirmed && work.accessChoice?.channel === other.accessChoice?.channel && work.accessChoice?.at === other.accessChoice?.at && work.accountAccessConflict === other.accountAccessConflict;
+}
 /** The proposal's Works built from the given state's current Works (E2). */
 function classificationWorks(state, plan) {
 	const late = plan.late;
 	const works = [];
 	for (const item of plan.items) {
 		const existing = state.works.find((work) => work.placement !== "classifying" && work.rootSessionIds.length === item.rootSessionIds.length && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root)));
-		const extended = late ? state.works.find((work) => work.placement === "placed" && work.rootSessionIds.every((root) => item.rootSessionIds.includes(root))) : void 0;
+		const owners = late ? state.works.filter((work) => work.placement === "placed" && work.rootSessionIds.some((root) => item.rootSessionIds.includes(root))) : [];
+		if (owners.some((work) => !sameAccessRecord(work, owners[0]))) throw new ApplicationError("INVALID_SELECTION", "classification.late.several-works");
+		const extended = owners.find((work) => work.rootSessionIds.every((root) => item.rootSessionIds.includes(root)));
 		if (late && existing) {
 			works.push(existing);
 			continue;
@@ -4891,6 +5346,9 @@ function classificationWorks(state, plan) {
 			sourceWorkspaceIds: [.../* @__PURE__ */ new Set([...extended.sourceWorkspaceIds, ...item.workspaceIds])]
 		} : newJourneyWork(item.workId, item.projectName, item.rootSessionIds, item.workspaceIds, "placed"));
 		const { classificationMetadata: _display, ...original } = base;
+		const account = plan.accountAccess?.[base.id];
+		const inherit = late && account && base.accessOrigin !== "explicit";
+		const unproven = extended && base.accessChoice?.channel === "account" && account !== "public-all";
 		works.push({
 			...original,
 			projectName: item.projectName,
@@ -4905,8 +5363,13 @@ function classificationWorks(state, plan) {
 			...late && !extended ? {
 				access: item.recommendation.access,
 				accessOrigin: "model",
-				accessConfirmed: true
+				accessConfirmed: item.recommendation.access !== "public"
+			} : {},
+			...unproven ? {
+				accessConfirmed: false,
+				accessChoice: void 0
 			} : {},
+			...inherit && account ? accountSeededAccess(account, plan.at) : {},
 			classificationRecommendation: item.recommendation,
 			suggestion: null,
 			artifact: null,
@@ -4977,7 +5440,12 @@ function regroupTerms(terms, works, changedMetadata, chunkSessions) {
 function applyClassificationProposal(state, plan) {
 	const classifying = isClassifying(state);
 	if (!state.consent || state.journeyId !== plan.journeyId || (plan.expectedClassificationRevision === null ? state.revision !== plan.expectedRevision : !classifying || state.classificationRevision !== plan.expectedClassificationRevision) || state.snapshotId !== plan.snapshotId || state.scope.status === "confirmed" !== plan.late || plan.late && !classifying || state.phase === "paused" || state.pendingHideId || classificationPartition(state) !== plan.partition) return null;
-	const { works, changedMetadata } = classificationWorks(state, plan);
+	const currentPlan = plan.accountAccess !== void 0 && (!plan.accountSubject || state.accountRead?.status !== "read" || state.accountRead.subject !== plan.accountSubject) ? {
+		...plan,
+		accountAccess: void 0,
+		accountRead: "unavailable"
+	} : plan;
+	const { works, changedMetadata } = classificationWorks(state, currentPlan);
 	const retained = new Set(works.map((work) => work.id));
 	const regrouped = !plan.late && (state.works.some((work) => !retained.has(work.id)) || changedMetadata.size > 0);
 	const cardTerms = new Set(state.privacy.cards.flatMap((card) => card.termKeys));
@@ -5008,6 +5476,10 @@ function applyClassificationProposal(state, plan) {
 				confirmedAnswersRevision: null
 			} : {}
 		},
+		...currentPlan.accountRead ? { accountRead: {
+			status: currentPlan.accountRead,
+			at: plan.at
+		} } : {},
 		readingComplete: !plan.pending && works.filter((work) => work.access !== "drop").every((work) => work.totalBatches > 0 && work.completedBatches === work.totalBatches),
 		phase: "processing"
 	};
@@ -5073,44 +5545,6 @@ z.object({
 		groupId: journeyIdSchema
 	}).strict())
 }).strict().nullable();
-z.object({
-	journeyId: journeyIdSchema.optional(),
-	workIds: z.array(journeyIdSchema).min(1).max(1e3).optional()
-}).strict();
-const categories = z.object({
-	identity: z.number().int().nonnegative(),
-	credentials: z.number().int().nonnegative(),
-	internal: z.number().int().nonnegative(),
-	private: z.number().int().nonnegative()
-}).strict();
-z.object({
-	journeyId: journeyIdSchema,
-	nonAdditiveMechanismCounts: z.literal(true),
-	total: z.number().int().nonnegative(),
-	categories,
-	byMechanism: z.object({
-		staticNodes: z.record(z.string(), z.number().int().nonnegative()),
-		semantic: z.number().int().nonnegative(),
-		correction: z.number().int().nonnegative()
-	}).strict(),
-	works: z.array(z.object({
-		workId: journeyIdSchema,
-		revision: z.number().int().positive(),
-		inputRevision: z.number().int().positive(),
-		primarySha256: z.string().length(64),
-		companionSha256: z.string().length(64),
-		ledgerSha256: z.string().length(64),
-		decisionDigest: z.string().length(64),
-		reviewInputDigest: z.string().length(64),
-		total: z.number().int().nonnegative(),
-		categories,
-		byMechanism: z.object({
-			staticNodes: z.record(z.string(), z.number().int().nonnegative()),
-			semantic: z.number().int().nonnegative(),
-			correction: z.number().int().nonnegative()
-		}).strict()
-	}).strict())
-}).strict();
 //#endregion
 //#region packages/application/src/journey/delegation.ts
 function delegatedDecisionScope(action) {
@@ -5163,6 +5597,11 @@ function delegatedDecisionTargets(action, journeyId) {
 		targetIds: [journeyId],
 		choice: String(action.answersRevision)
 	};
+	if (action.kind === "account-read") return {
+		action: action.kind,
+		targetIds: [journeyId],
+		choice: "retry"
+	};
 	return action.kind === "scope-confirm" ? {
 		action: action.kind,
 		targetIds: [journeyId],
@@ -5179,7 +5618,7 @@ function assertDelegatedDecision(state, action, decision, source) {
 	}
 	if (action.kind === "cards-confirm") return;
 	if (action.kind === "work-access" || action.kind === "works-access") {
-		if (action.access === "drop") throw new ApplicationError("CONFIRMATION_REQUIRED");
+		if (action.access === "drop" || action.access === "public") throw new ApplicationError("CONFIRMATION_REQUIRED");
 		const ids = action.kind === "work-access" ? [action.workId] : action.workIds;
 		if (state.works.some((work) => ids.includes(work.id) && work.accessOrigin === "explicit" && work.access !== action.access)) throw new ApplicationError("CONFIRMATION_REQUIRED");
 		return;
@@ -5194,7 +5633,7 @@ function assertDelegatedDecision(state, action, decision, source) {
 		if (work?.projectType?.origin === "explicit" && work.projectType.type !== action.type) throw new ApplicationError("CONFIRMATION_REQUIRED");
 		return;
 	}
-	if (action.kind === "scope-confirm") return;
+	if (action.kind === "scope-confirm" || action.kind === "account-read") return;
 	if (action.kind !== "group" && action.kind !== "groups-hide") throw new ApplicationError("CONFIRMATION_REQUIRED");
 	const ids = action.kind === "group" ? [action.groupId] : action.groupIds;
 	const choice = action.kind === "group" ? action.choice : "hide";
@@ -5259,135 +5698,6 @@ function propagateGroups(state, action) {
 	};
 }
 //#endregion
-//#region packages/application/src/journey/scope/respond.ts
-/** Classification confirmation fixes visibility and scan membership for this journey. */
-function confirmScope(state, now, decision) {
-	if (state.scope.status === "confirmed") return state;
-	if (state.classificationRevision === null || !state.works.length || state.works.some((work) => work.placement !== "placed" && work.placement !== "classifying" || work.placement === "placed" && !(work.status === "blocked" && work.access === "drop" && work.accessConfirmed) && (!work.description.trim() || !work.projectType))) throw new ApplicationError("SCOPE_NOT_READY");
-	return withReadingProgress({
-		...state,
-		scope: {
-			status: "confirmed",
-			actor: decision ? "delegate" : "human",
-			at: now
-		},
-		works: state.works.map((work) => work.placement === "classifying" ? work : work.accessConfirmed || !work.classificationRecommendation ? {
-			...work,
-			accessConfirmed: true
-		} : {
-			...work,
-			access: work.classificationRecommendation.access,
-			accessOrigin: "model",
-			accessConfirmed: true
-		})
-	});
-}
-function setWorkType(state, workId, type, decision) {
-	if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
-	const projectType = decision ? {
-		type,
-		reason: "Chosen by your delegate for this journey.",
-		origin: "delegate"
-	} : {
-		type,
-		reason: "Chosen by you.",
-		origin: "explicit"
-	};
-	return {
-		...state,
-		scope: {
-			status: "pending",
-			actor: null,
-			at: null
-		},
-		privacy: {
-			...state.privacy,
-			cards: [],
-			confirmedAnswersRevision: null,
-			packageApproval: null
-		},
-		works: state.works.map((work) => work.id !== workId || decision && work.projectType?.origin === "explicit" ? work : {
-			...work,
-			projectType
-		})
-	};
-}
-/** One rule for single and bulk choices; selection changes recompute reading completion. */
-function setWorksAccess(state, workIds, access, decision) {
-	if (new Set(workIds).size !== workIds.length) throw new ApplicationError("INVALID_SELECTION");
-	if (workIds.some((id) => !state.works.some((work) => work.id === id))) throw new ApplicationError("UNKNOWN_WORKSPACE");
-	if (state.scope.status === "confirmed") return changeConfirmedAccess(state, workIds, access, decision);
-	return withReadingProgress({
-		...state,
-		scope: {
-			status: "pending",
-			actor: null,
-			at: null
-		},
-		privacy: {
-			...state.privacy,
-			cards: [],
-			confirmedAnswersRevision: null,
-			packageApproval: null
-		},
-		works: state.works.map((work) => !workIds.includes(work.id) ? work : {
-			...work,
-			revision: work.revision + 1,
-			artifact: null,
-			status: work.status === "ready" ? "review" : work.status,
-			access,
-			accessConfirmed: true,
-			accessOrigin: decision && work.accessOrigin !== "explicit" ? "delegate" : "explicit"
-		})
-	});
-}
-/**
-* After confirmation the person, never a delegate, may still change any Work's visibility
-* (D2, superseding ADR 0162's lock and ADR 0188's blocked-only Drop). Drop stops that Work's
-* scan; a Work moved out of Drop is read again; reading progress is recomputed.
-*/
-function changeConfirmedAccess(state, workIds, access, decision) {
-	if (decision || state.phase === "sending" || state.phase === "completed" || state.works.some((work) => workIds.includes(work.id) && work.access === access)) throw new ApplicationError("INVALID_TRANSITION");
-	return withReadingProgress({
-		...state,
-		privacy: {
-			...state.privacy,
-			packageApproval: null
-		},
-		works: state.works.map((work) => workIds.includes(work.id) ? {
-			...work,
-			revision: work.revision + 1,
-			artifact: null,
-			status: work.status === "ready" ? "review" : work.status,
-			access,
-			accessConfirmed: true,
-			accessOrigin: "explicit"
-		} : work)
-	});
-}
-/** Model suggestions fill or refresh model types only; a person's or delegate's type stays. */
-function applyClassification(state, items) {
-	if (state.scope.status === "confirmed") throw new ApplicationError("INVALID_TRANSITION");
-	const byWork = new Map(items.map((item) => [item.workId, item]));
-	if (byWork.size !== items.length) throw new ApplicationError("INVALID_SELECTION");
-	if (items.some((item) => !state.works.some((work) => work.id === item.workId))) throw new ApplicationError("UNKNOWN_WORKSPACE");
-	return {
-		...state,
-		works: state.works.map((work) => {
-			const item = byWork.get(work.id);
-			if (!item || work.projectType && work.projectType.origin !== "model") return work;
-			return {
-				...work,
-				projectType: {
-					type: item.type,
-					reason: item.reason,
-					origin: "model"
-				}
-			};
-		})
-	};
-}
-//#endregion
 //#region packages/application/src/journey/respond.ts
 /** A changed privacy instruction requires a new read of the same frozen roots. */
 function invalidateAnalysisIntent(state) {
@@ -5396,7 +5706,7 @@ function invalidateAnalysisIntent(state) {
 		...state,
 		works: state.works.map((work) => {
 			if (!work.rootSessionIds.length) return work;
-			const { emptyReview: _empty, excludedReview: _excluded, ...retired } = retireWorkDescription(work);
+			const { reviewInterruptions: _reviewInterruptions, emptyReview: _empty, excludedReview: _excluded, ...retired } = retireWorkDescription(work);
 			return {
 				...retired,
 				title: work.explicitTitleId ? work.title : retired.title,
@@ -5411,7 +5721,7 @@ function invalidateAnalysisIntent(state) {
 		})
 	});
 }
-function respondToJourney(state, action, source, now, decision, preferenceScope) {
+function respondToJourney(state, action, source, now, decision, preferenceScope, accountRead, account) {
 	if (preferenceScope && (decision || !["group", "groups-hide"].includes(action.kind))) throw new ApplicationError("INVALID_ARGUMENTS");
 	if (state.abandonedAt) throw new ApplicationError("INVALID_TRANSITION");
 	if (action.kind === "abandon") {
@@ -5465,12 +5775,14 @@ function respondToJourney(state, action, source, now, decision, preferenceScope)
 			...state,
 			phase: "welcome"
 		};
+		if (account?.configured && !account.subject) throw new ApplicationError("JOURNEY_SIGN_IN_REQUIRED");
 		return {
 			...state,
 			consent: {
 				provider: state.provider,
 				source,
-				allowedAt: now
+				allowedAt: now,
+				...account?.subject ? { subject: account.subject } : {}
 			},
 			phase: "discovering"
 		};
@@ -5525,10 +5837,21 @@ function respondToJourney(state, action, source, now, decision, preferenceScope)
 	};
 	if (action.kind === "scope-confirm") {
 		if (source !== "conversation" || decision) throw new ApplicationError("CONFIRMATION_REQUIRED");
-		return confirmScope(state, now);
+		const stop = accountReadStop(state, accountRead);
+		if (stop) throw new ApplicationError(stop);
+		const confirmed = confirmScope(state, now, void 0, accountRead?.status === "read" ? accountRead.access : void 0);
+		return accountRead && confirmed !== state ? withAccountRead(confirmed, accountRead, now) : confirmed;
+	}
+	if (action.kind === "account-read") {
+		if (!accountRead) throw new ApplicationError("INVALID_TRANSITION");
+		return retryAccountRead(state, accountRead, now);
 	}
 	if (action.kind === "card-answer" || action.kind === "cards-confirm" || action.kind === "package-confirm") throw new ApplicationError("INVALID_TRANSITION");
-	if (action.kind === "works-access") return setWorksAccess(state, action.workIds, action.access, decision);
+	if ((action.kind === "work-access" || action.kind === "works-access") && action.access === "public" && source === "conversation" && (!action.accessChoice || action.accessChoice.channel !== "conversation" || !Number.isFinite(Date.parse(action.accessChoice.at)))) throw new ApplicationError("CONFIRMATION_REQUIRED");
+	if (action.kind === "works-access") return setWorksAccess(state, action.workIds, action.access, decision, source === "panel" ? {
+		channel: source,
+		at: now
+	} : action.accessChoice);
 	if (action.kind === "group" || action.kind === "groups-hide") {
 		const ids = action.kind === "group" ? [action.groupId] : action.groupIds;
 		if (new Set(ids).size !== ids.length || ids.some((id) => !state.groups.some((group) => group.id === id))) throw new ApplicationError("UNKNOWN_ITEM");
@@ -5542,6 +5865,48 @@ function respondToJourney(state, action, source, now, decision, preferenceScope)
 	const workId = action.workId;
 	if (!state.works.some((work) => work.id === workId)) throw new ApplicationError("UNKNOWN_WORKSPACE");
 	if (action.kind === "work-type") return setWorkType(state, workId, action.type, decision);
+	if (action.kind === "review-interrupted" || action.kind === "review-reader-closed" || action.kind === "retry-review") {
+		const work = state.works.find((item) => item.id === workId);
+		if (!work || work.inputRevision !== action.inputRevision) throw new ApplicationError("REVISION_CONFLICT");
+		if (!isSelectedWork(work) || work.status === "blocked" || state.scope.status !== "confirmed" || state.phase === "sending" || state.phase === "completed") throw new ApplicationError("INVALID_TRANSITION");
+		if (action.kind === "review-reader-closed") {
+			if (source !== "conversation" || decision) throw new ApplicationError("CONFIRMATION_REQUIRED");
+			return state;
+		}
+		const holds = currentReviewInterruptions(work);
+		const previous = holds.find((item) => item.packId === action.packId);
+		let nextHolds;
+		if (action.kind === "review-interrupted") {
+			if (source !== "conversation" || decision) throw new ApplicationError("CONFIRMATION_REQUIRED");
+			if (previous) {
+				if (previous.reason !== action.reason || previous.batchIds.length !== action.batchIds.length || !action.batchIds.every((id) => previous.batchIds.includes(id))) throw new ApplicationError("OPERATION_CONFLICT");
+				return state;
+			}
+			if (work.totalBatches - work.completedBatches < action.batchIds.length || holds.some((hold) => hold.batchIds.some((id) => action.batchIds.includes(id)))) throw new ApplicationError("INVALID_TRANSITION");
+			nextHolds = [...holds, {
+				packId: action.packId,
+				inputRevision: action.inputRevision,
+				batchIds: action.batchIds,
+				reason: action.reason
+			}];
+		} else {
+			if (previous?.reason !== "retry-exhausted") throw new ApplicationError("INVALID_TRANSITION");
+			nextHolds = holds.filter((item) => item.packId !== action.packId);
+		}
+		return withReadingProgress({
+			...state,
+			privacy: {
+				...state.privacy,
+				packageApproval: null
+			},
+			works: state.works.map((item) => item.id === workId ? {
+				...item,
+				reviewInterruptions: nextHolds,
+				revision: item.revision + 1,
+				artifact: null
+			} : item)
+		});
+	}
 	if (action.kind === "retry-work") {
 		if (state.works.find((item) => item.id === workId)?.status !== "blocked" || state.phase === "sending" || state.phase === "completed") throw new ApplicationError("INVALID_TRANSITION");
 		return withReadingProgress({
@@ -5559,7 +5924,10 @@ function respondToJourney(state, action, source, now, decision, preferenceScope)
 			})
 		});
 	}
-	return setWorksAccess(state, [workId], action.access, decision);
+	return setWorksAccess(state, [workId], action.access, decision, source === "panel" ? {
+		channel: source,
+		at: now
+	} : action.accessChoice);
 }
 //#endregion
 //#region packages/application/src/journey/questions.ts
@@ -6290,10 +6658,19 @@ function digest$1(value) {
 * quotes stay out. The agent reads override values from `journey.get` and the guidance.
 */
 function journeyView(state, now) {
-	const { exceptions, instructions, corrections, valueOverrides, ...safe } = state;
+	const { exceptions, instructions, corrections, valueOverrides, consent, accountRead, ...safe } = state;
 	const terms = activePrivacyTerms(state);
 	return {
 		...safe,
+		consent: consent && {
+			provider: consent.provider,
+			allowedAt: consent.allowedAt,
+			source: consent.source
+		},
+		...accountRead ? { accountRead: {
+			status: accountRead.status,
+			at: accountRead.at
+		} } : {},
 		displayedScopeDigest: displayedScopeDigest(state),
 		privacy: {
 			...state.privacy,
@@ -6302,10 +6679,12 @@ function journeyView(state, now) {
 		works: state.works.map((work) => {
 			const localTitle = work.suggestion || work.explicitTitleId ? work.title : work.classificationMetadata?.title ?? work.title;
 			const imagesOmitted = hasCurrentStaticReview(state, work) ? work.staticReview?.imagesOmitted ?? 0 : 0;
+			const source = publicSource(work);
 			if (!work.classificationMetadata) return {
 				...work,
 				localTitle,
-				imagesOmitted
+				imagesOmitted,
+				publicSource: source
 			};
 			const metadata = work.classificationMetadata;
 			const displayed = {
@@ -6319,6 +6698,7 @@ function journeyView(state, now) {
 				...displayed,
 				localTitle,
 				imagesOmitted,
+				publicSource: source,
 				projectType: work.projectType ? {
 					...work.projectType,
 					reason: work.projectType.origin === "model" ? displayed.reason : work.projectType.reason
@@ -6351,6 +6731,59 @@ function journeyView(state, now) {
 }
 /** Works rendered at once by one several-Work call. */
 const renderConcurrency = 4;
+const inFlightRenders = /* @__PURE__ */ new WeakMap();
+const renderScopeTails = /* @__PURE__ */ new WeakMap();
+function waitForRender(pending, signal) {
+	signal.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		const abort = () => reject(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+		pending.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+	});
+}
+async function acquireRenderScope(port, signal) {
+	const previous = renderScopeTails.get(port);
+	const gate = Promise.withResolvers();
+	const tail = (previous ?? Promise.resolve()).then(() => gate.promise);
+	renderScopeTails.set(port, tail);
+	const release = () => {
+		gate.resolve();
+		if (renderScopeTails.get(port) === tail) renderScopeTails.delete(port);
+	};
+	try {
+		await waitForRender(previous ?? Promise.resolve(), signal);
+		return {
+			release,
+			waited: previous !== void 0
+		};
+	} catch (error) {
+		tail.then(() => {
+			if (renderScopeTails.get(port) === tail) renderScopeTails.delete(port);
+		});
+		gate.resolve();
+		throw error;
+	}
+}
+async function joinRender(port, journeyId, workId, run, signal, retryConflict = true) {
+	let pending = inFlightRenders.get(port);
+	if (!pending) {
+		pending = /* @__PURE__ */ new Map();
+		inFlightRenders.set(port, pending);
+	}
+	const key = `${journeyId}:${workId}`;
+	const existing = pending.get(key);
+	if (existing) try {
+		return await waitForRender(existing, signal);
+	} catch (error) {
+		signal.throwIfAborted();
+		if (retryConflict && safeCode(error) === "REVISION_CONFLICT") return joinRender(port, journeyId, workId, run, signal, false);
+		throw error;
+	}
+	const entries = pending;
+	const result = Promise.resolve().then(run).finally(() => entries.delete(key));
+	entries.set(key, result);
+	return result;
+}
 function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).toISOString(), local) {
 	/** Callers present after their write is durable, so a concurrent commit must not turn it into an error. */
 	async function present(committed) {
@@ -6384,12 +6817,14 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 				status: state.phase === "paused" && classificationProgress.status === "running" ? "paused" : classificationProgress.status
 			} : null;
 			const packaging = await local?.renderActivity?.read(state.journeyId) ?? null;
+			const subject = state.accountRead?.status === "read" ? await local?.accountState?.().then((account) => account.subject).catch(() => null) : null;
 			return {
 				...view,
 				...reads,
 				packaging,
 				preparationProgress,
-				classificationProgress: liveClassificationProgress
+				classificationProgress: liveClassificationProgress,
+				accountReadCurrent: state.accountRead?.status === "read" && typeof subject === "string" && state.accountRead.subject === subject
 			};
 		}
 	}
@@ -6623,18 +7058,50 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			"works-access",
 			"card-answer",
 			"profile-address",
-			"profile-links"
+			"profile-links",
+			"account-read"
 		].includes(input.action.kind);
+		let accountRead;
+		const readAccount = async (state) => {
+			const scope = digest$1(state.works.map((work) => ({
+				id: work.id,
+				roots: work.rootSessionIds.toSorted()
+			})).sort((left, right) => left.id.localeCompare(right.id)));
+			if (!accountRead || accountRead.scope !== scope) accountRead = {
+				scope,
+				result: await local?.accountAccess?.(state, new AbortController().signal)
+			};
+			return accountRead.result;
+		};
 		for (let attempt = 0;; attempt++) {
-			const result = await commitResponse(input, source, rebase);
+			const result = await commitResponse(input, source, rebase, readAccount);
 			if (result.status !== "stale" || !rebase || attempt >= 4) return result;
 		}
 	}
-	async function commitResponse(input, source, rebase) {
+	async function commitResponse(input, source, rebase, readAccount) {
 		const current = await storage.current(input.journeyId);
 		if (!current) throw new ApplicationError("UNKNOWN_ITEM");
 		const expectedRevision = rebase ? current.revision : input.expectedRevision;
-		const state = current.revision === expectedRevision ? respondToJourney(current, input.action, source, now(), input.decision, input.preferenceScope) : current;
+		const scopeRead = input.action.kind === "scope-confirm" && current.scope.status !== "confirmed" && source === "conversation" && !input.decision;
+		const accountRead = current.revision === expectedRevision && (scopeRead || input.action.kind === "account-read") ? await readAccount(current) : void 0;
+		const account = current.revision === expectedRevision && (input.action.kind === "consent" && input.action.allow && !current.consent || scopeRead) ? await local?.accountState?.() : void 0;
+		const stop = scopeRead && accountReadStop(current, accountRead);
+		if (stop && accountRead) {
+			await storage.commit({
+				expectedRevision,
+				requestKey: randomUUID(),
+				requestHash: digest$1(input),
+				state: withAccountRead(current, accountRead, now()),
+				event: {
+					journeyId: current.journeyId,
+					kind: "response",
+					source,
+					at: now()
+				}
+			});
+			throw new ApplicationError(stop);
+		}
+		const state = current.revision === expectedRevision ? respondToJourney(current, input.action, source, now(), input.decision, input.preferenceScope, accountRead, account) : current;
 		const groupIds = input.action.kind === "group" ? [input.action.groupId] : input.action.kind === "groups-hide" ? input.action.groupIds : [];
 		const preferenceScopes = input.decision ? [] : state.groups.flatMap((group) => groupIds.includes(group.id) && group.preferenceScope ? [{
 			groupId: group.id,
@@ -6645,6 +7112,12 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			requestKey: input.idempotencyKey,
 			requestHash: digest$1(input),
 			state,
+			...input.action.kind === "review-interrupted" || input.action.kind === "review-reader-closed" ? { closedReader: {
+				packId: input.action.packId,
+				workId: input.action.workId,
+				inputRevision: input.action.inputRevision,
+				batchIds: input.action.batchIds
+			} } : {},
 			event: {
 				journeyId: state.journeyId,
 				kind: "response",
@@ -6674,12 +7147,27 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 			await setTimeout$1(Math.min(1e3, Math.max(0, deadline - Date.now())), void 0, { signal });
 		}
 	}
-	async function prepare(value, signal) {
+	async function runPreparation(value, signal) {
 		const input = nativeGetSchema.required().parse(value);
 		if (!local) throw new ApplicationError("INVALID_TRANSITION");
-		await local.hide.recover(input.journeyId, signal ?? new AbortController().signal);
-		const state = await local.prepare(input.journeyId, signal);
-		return state ? present(state) : null;
+		const permission = await storage.preparationPermission(input.journeyId);
+		if (!permission) throw new ApplicationError("UNKNOWN_ITEM");
+		if (permission.pendingHideId) await local.hide.recover(input.journeyId, signal ?? new AbortController().signal);
+		return local.prepare(input.journeyId, signal);
+	}
+	async function prepare(value, signal) {
+		const state = await runPreparation(value, signal);
+		return state ? get({ journeyId: state.journeyId }) : null;
+	}
+	/** The owned CLI scan needs an exit receipt; the panel owns the full presentation read. */
+	async function prepareReceipt(value, signal) {
+		const state = await runPreparation(value, signal);
+		return state && {
+			journeyId: state.journeyId,
+			revision: state.revision,
+			phase: state.phase,
+			readingComplete: state.readingComplete
+		};
 	}
 	async function read(value) {
 		return storage.readBatch(journeyBatchReadSchema.parse(value));
@@ -6750,7 +7238,7 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 		const release = await port.renderActivity?.begin(input.journeyId, workIds);
 		let result;
 		try {
-			result = "workId" in input ? { state: await port.render(input.journeyId, input.workId, signal) } : {
+			result = "workId" in input ? { state: await joinRender(port, input.journeyId, input.workId, () => port.render(input.journeyId, input.workId, signal), signal) } : {
 				renders: await renderSeveral(port, input.journeyId, workIds, signal),
 				state: await currentState(input.journeyId)
 			};
@@ -6770,35 +7258,51 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 	}
 	async function renderSeveral(port, journeyId, workIds, signal) {
 		const renders = [];
-		let next = 0;
-		const scope = await port.renderScope?.(journeyId, workIds.length, signal);
-		const renderWork = scope ? (workId) => scope.render(workId) : (workId) => port.render(journeyId, workId, signal);
+		const lease = await acquireRenderScope(port, signal);
 		try {
-			const failure = (await Promise.allSettled(Array.from({ length: Math.min(scope?.concurrency ?? renderConcurrency, workIds.length) }, async () => {
-				for (let workId = workIds[next++]; workId !== void 0; workId = workIds[next++]) {
-					try {
-						await renderWork(workId);
-						renders.push({
-							workId,
-							status: "rendered"
-						});
-					} catch (error) {
-						signal.throwIfAborted();
-						port.renderFailed?.(workId, error);
-						renders.push({
-							workId,
-							status: "failed",
-							code: safeCode(error)
-						});
+			const current = lease.waited ? await currentState(journeyId) : void 0;
+			const completed = new Set(current?.works.filter((work) => work.artifact?.revision === work.revision && work.status === "ready" && !current.pendingHideId && current.phase !== "paused").map((work) => work.id));
+			const remaining = workIds.filter((workId) => {
+				if (!completed.has(workId)) return true;
+				renders.push({
+					workId,
+					status: "rendered"
+				});
+				return false;
+			});
+			let next = 0;
+			const scope = remaining.length ? await port.renderScope?.(journeyId, remaining.length, signal) : void 0;
+			const renderWork = scope ? (workId) => scope.render(workId) : (workId) => port.render(journeyId, workId, signal);
+			try {
+				const failure = (await Promise.allSettled(Array.from({ length: Math.min(scope?.concurrency ?? renderConcurrency, remaining.length) }, async () => {
+					for (let workId = remaining[next++]; workId !== void 0; workId = remaining[next++]) {
+						try {
+							await joinRender(port, journeyId, workId, () => renderWork(workId), signal);
+							renders.push({
+								workId,
+								status: "rendered"
+							});
+						} catch (error) {
+							signal.throwIfAborted();
+							port.renderFailed?.(workId, error);
+							renders.push({
+								workId,
+								status: "failed",
+								code: safeCode(error)
+							});
+						}
+						await new Promise((resolve) => setImmediate(resolve));
 					}
-					await new Promise((resolve) => setImmediate(resolve));
-				}
-			}))).find((item) => item.status === "rejected");
-			if (failure) throw failure.reason;
+				}))).find((item) => item.status === "rejected");
+				if (failure) throw failure.reason;
+			} finally {
+				await scope?.close();
+			}
+			const order = new Map(workIds.map((workId, index) => [workId, index]));
+			return renders.toSorted((a, b) => (order.get(a.workId) ?? 0) - (order.get(b.workId) ?? 0));
 		} finally {
-			await scope?.close();
+			lease.release();
 		}
-		return renders.toSorted((a, b) => workIds.indexOf(a.workId) - workIds.indexOf(b.workId));
 	}
 	async function findings(value, signal = new AbortController().signal) {
 		if (!local) throw new ApplicationError("INVALID_TRANSITION");
@@ -6888,7 +7392,32 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 		const current = await storage.current(input.journeyId);
 		if (!current) throw new ApplicationError("UNKNOWN_ITEM");
 		const expectedRevision = rebase ? current.revision : input.expectedRevision;
-		const state = current.revision !== expectedRevision ? current : "resolutions" in input ? resolvePrivacyTerms(current, input) : publishDecisionCards(current, input);
+		let state;
+		try {
+			state = current.revision !== expectedRevision ? current : "resolutions" in input ? resolvePrivacyTerms(current, input) : publishDecisionCards(current, input);
+		} catch (error) {
+			if (!rebase || current.revision <= input.expectedRevision || !(error instanceof ApplicationError) || error.code !== "INVALID_SELECTION") throw error;
+			const receipt = await storage.commit({
+				expectedRevision: input.expectedRevision,
+				requestKey: input.idempotencyKey,
+				requestHash: digest$1(input),
+				state: current,
+				event: {
+					journeyId: current.journeyId,
+					kind: "response",
+					source: "conversation",
+					at: now()
+				}
+			}).catch((probeError) => {
+				if (probeError instanceof ApplicationError && probeError.code === "OPERATION_CONFLICT") throw error;
+				throw probeError;
+			});
+			if (receipt.status === "replayed") return {
+				...receipt,
+				state: await present(receipt.state)
+			};
+			throw error;
+		}
 		const result = await storage.commit({
 			expectedRevision,
 			requestKey: input.idempotencyKey,
@@ -6934,8 +7463,10 @@ function createNativeJourney(storage, now = () => (/* @__PURE__ */ new Date()).t
 		events,
 		groupItems: (value) => readGroupItems(storage, value),
 		/** ADR 0086: one pack of read units and the values found in them. */
+		reopenEmpty: (value) => storage.reopenEmpty(emptyReviewCorrectionSchema.parse(value)),
 		terms: async (value) => reviewTermsResultSchema.parse(await storage.recordTerms(reviewTermsInputSchema.parse(value))),
 		prepare,
+		prepareReceipt,
 		read,
 		guidance,
 		inspect,
@@ -10579,7 +11110,7 @@ const bindingFields = {
 };
 const inspectionBindingSchema = z.union([z.object({
 	...bindingFields,
-	detectorVersion: z.literal(currentDetectorVersion),
+	detectorVersion: z.enum([currentDetectorVersion, "static-catalog-11"]),
 	dictionaryVersion: z.literal(entityDictionaryVersion)
 }).strict(), z.object({
 	...bindingFields,
@@ -11749,6 +12280,48 @@ const storedCredentialSchema = accountProfileSchema.extend({
 	expiresAt: z.string().min(1).max(64)
 }).refine((value) => profileUrlMatchesIdentity(value.profileUrl, value.identityUrl));
 //#endregion
+//#region packages/application/src/account/renew.ts
+const renewBeforeMs = 12e4;
+const renewTimeoutMs = 3e4;
+const renewals = /* @__PURE__ */ new WeakMap();
+function renew(account, credential) {
+	function configured(value) {
+		return value?.identityUrl === account.configuration.identityUrl && value.clientId === account.configuration.clientId ? value : null;
+	}
+	const running = renewals.get(account);
+	if (running) return running;
+	const renewing = (async () => {
+		try {
+			const stored = configured((await account.credentials.update((state) => state)).credential);
+			if (!stored || stored.refreshToken !== credential.refreshToken) return stored;
+			const token = await account.identity.refresh(credential.refreshToken, AbortSignal.timeout(renewTimeoutMs));
+			if (!token) return configured((await account.credentials.update((state) => {
+				if (state.credential?.refreshToken === credential.refreshToken) {
+					state.credential = null;
+					state.connection = null;
+					state.lastError = "SIGN_IN_EXPIRED";
+				}
+				return state;
+			})).credential);
+			return configured((await account.credentials.update((value) => {
+				if (value.credential?.refreshToken === credential.refreshToken) value.credential = {
+					...value.credential,
+					accessToken: token.accessToken,
+					refreshToken: token.refreshToken ?? credential.refreshToken,
+					scope: token.scope,
+					issuedAt: account.now(),
+					expiresAt: token.expiresAt
+				};
+				return value;
+			})).credential);
+		} finally {
+			renewals.delete(account);
+		}
+	})();
+	renewals.set(account, renewing);
+	return renewing;
+}
+//#endregion
 //#region packages/application/src/account/poll-interval.ts
 /** RFC 8628 section 3.5: each `slow_down` lengthens the interval by five seconds. */
 const slowDownStepMs = 5e3;
@@ -12037,11 +12610,41 @@ function createSharedAccount(ports) {
 			return stop(true);
 		},
 		async verify() {
-			const saved = (await read()).credential;
+			let saved = (await read()).credential;
 			if (!saved || !belongsToConfiguration(saved)) throw new ApplicationError("ACCOUNT_SIGNED_OUT");
-			const result = await ports.connection.check(saved.accessToken, shutdown.signal);
+			let result;
+			let renewing = false;
+			try {
+				const left = Date.parse(saved.expiresAt) - Date.parse(ports.now());
+				if (saved.refreshToken && (!Number.isFinite(left) || left <= 12e4)) {
+					renewing = true;
+					saved = await renew(ports, {
+						...saved,
+						refreshToken: saved.refreshToken
+					});
+					renewing = false;
+					if (!saved) return view(await read());
+				}
+				result = await ports.connection.check(saved.accessToken, shutdown.signal);
+				if (result === "rejected" && saved.refreshToken) {
+					renewing = true;
+					saved = await renew(ports, {
+						...saved,
+						refreshToken: saved.refreshToken
+					});
+					renewing = false;
+					if (!saved) return view(await read());
+					result = await ports.connection.check(saved.accessToken, shutdown.signal);
+				}
+			} catch (error) {
+				if (safeCode(error) !== "IDENTITY_UNAVAILABLE" && !(renewing && saved && !expired(saved.expiresAt, ports.now()))) throw error;
+				const detail = typeof error === "object" && error !== null && "detail" in error ? ` (${String(error.detail)})` : "";
+				console.error(`Account verification failed: ${safeCode(error)}${detail}`);
+				result = "unavailable";
+			}
+			const checked = saved;
 			return view(await update((state) => {
-				if (sameCredential(state.credential, saved)) {
+				if (checked && sameCredential(state.credential, checked)) {
 					if (result === "rejected") {
 						state.credential = null;
 						state.connection = null;
@@ -13345,7 +13948,6 @@ z.object({
 }).strict();
 //#endregion
 //#region packages/application/src/journey/scan-equivalence.ts
-/** State authority relevant to AI meaning; unrelated Work progress does not invalidate publication. */
 function scanBatchContextDigest(state, workId) {
 	const work = state.works.find((work) => work.id === workId);
 	if (!work) throw new ApplicationError("REVISION_CONFLICT");
@@ -13448,4 +14050,4 @@ function equivalenceDuplicates(batch) {
 	return bindings.sort();
 }
 //#endregion
-export { settingsBatchSchema as $, reviewTransportBytes as $n, isReadingComplete as $r, projectPreparationProgress as $t, deviceAuthorizationSchema as A, maximumHideIndexTokens as An, applyCardAnswers as Ar, nativeAdapterVersions as At, inspectionStartSchema as B, confirmedHideTerms as Bn, staticSessionResourceSchema as Br, classificationWorks as Bt, rebindReviewOverlay as C, confirmedHideDeltaSchema as Cn, journeyFindingImpactSchema as Cr, sendPrepareSchema as Ct, staticallyHiddenFindings as D, termHideAdditions as Dn, journeyRenderSchema as Dr, currentJourneyAdapters as Dt, guardedFindingText as E, settleConfirmedHides as En, journeyRenderInputSchema as Er, settleCorrections as Et, sourceIdentityEvidence as F, bTermMatcher as Fn, nativeRespondSchema as Fr, journeyBatchReadSchema as Ft, validateInspectionClaim as G, retireWorkDescription as Gn, sendArtifactSchema as Gr, journeyContextSchema as Gt, validateInspectionBatches as H, journeyConfirmedHides as Hn, agentSourceSchema as Hr, newJourneyWork as Ht, withSourceEvidence as I, bWordBounded as In, mergePrivacyTerms as Ir, journeyReviewStorageQuerySchema as It, validateInspectionInputs as J, workCorrectionBinding as Jn, sendResolutionSchema as Jr, hidePublishSchema as Jt, validateInspectionFence as K, workDecisionDigest as Kn, sendReceiptSchema as Kr, hideBeginSchema as Kt, agentSetupKey as L, confirmedHideGroupIds as Ln, hasCurrentStaticReview as Lr, applyClassificationProposal as Lt, profileUrlMatchesIdentity as M, bContainment as Mn, privacyDecisionDigest as Mr, validateAttemptAppend as Mt, readAccountAvatarUrl as N, bExceptionRanges as Nn, nativeEventsSchema as Nr, journeyGuidance as Nt, createAccount as O, addHideIndexTokens as On, displayedScopeDigest as Or, obsoleteJourney as Ot, storedCredentialSchema as P, bMaskedHits as Pn, nativeGetSchema as Pr, applyClassification as Pt, inspectionInputs as Q, reviewRepairResourceSchema as Qn, isIncludedWork as Qr, journeyPolicyRespondSchema as Qt, createApplication as R, confirmedHideKey as Rn, staticReviewDigest as Rr, classificationCommitSchema as Rt, rebindReviewAlignment as S, confirmedHideAdditions as Sn, journeyClassificationSessionsSchema as Sr, sendChoiceSchema as St, reviewBatchReuse as T, renderedHideValue as Tn, journeyPreviewSchema as Tr, sendStartSchema as Tt, validateInspectionRequest as U, maskedHitsStale as Un, agentSourcesSchema as Ur, reviewCompileSchema as Ut, validateInspectionBatch as V, dictionaryHides as Vn, agentSourcePathSegment as Vr, retireScanGeneration as Vt, inspectionQuerySchema as W, syncTermGroups as Wn, journeySendSchema as Wr, journeyContextQuerySchema as Wt, validateInspectionContribution as X, reviewCandidateResourceSchema as Xn, hasCompleteWorkDescription as Xr, journeySearchSaveSchema as Xt, validateInspectionQuery as Y, reviewCandidateInputSchema as Yn, sendSettingsSchema as Yr, journeySearchResultSchema as Yt, validateDetectionSummary as Z, reviewRepairInputSchema as Zn, isClassifying as Zr, searchScopeDigest as Zt, changeJourney as _, selectFrozenConfiguration as _i, sessionUsefulnessInputSchema as _n, emptyPreparationFacts as _r, emptyTermsRevision as _t, bCrossSegmentReviewSchema as a, packageCommandSchema as ai, reviewAttemptResourceSchema as an, scanPreparationDigest as ar, defaultAgentSetupInclusion as at, isGenericPublicTerm as b, journeyCommitSchema as bn, preparationStartSchema as br, replaceSensitiveTermsSchema as bt, reconstructBFields as c, gitMetadataBudgetBytes as ci, sessionReconcileInputSchema as cn, scanGitSeedsResource as cr, resolveFailureLocation as ct, resolveGroupSplit as d, sourceChangePolicy as di, sessionRereadInputSchema as dn, validateScanExclusion as dr, manualUploadBindingSchema as dt, isSelectedWork as ei, journeyResourceQuerySchema as en, bReviewDigest as er, settingsQuerySchema as et, selectedValueMembers as f, recommendParallelism as fi, sessionRereadResourceSchema as fn, resolveSourceSelection as fr, manualUploadChoiceSchema as ft, semanticGroupKey as g, freezeConfiguration as gi, sessionReviewStatusSchema as gn, journeyPreparationProgressSchema as gr, candidateSortAvailable as gt, hideScopeDigest as h, defaultScopedSettings as hi, sessionReviewResourceSchema as hn, journeyInventorySchema as hr, manualUploadStartSchema as ht, validateBCrossSegmentReview as i, commandSchema as ii, sortingApplySchema as in, scanCanonicalResourceSchema as ir, classifyAgentSetup as it, deviceProfileScopeSchema as j, packHideIndex as jn, assertJourneyPrivacyReady as jr, attemptBudgetCodePoints as jt, accountProfileSchema as k, hideKeyId as kn, requestedScope as kr, metadataProcessingVersion as kt, chooseCheapPlacement as l, producerVersion as li, sessionReconcileResultSchema as ln, verifiedScanGitSeeds as lr, validateFailureLocation as lt, activeJourneyTerms as m, effectiveTreatmentSchema as mi, sessionReviewQuerySchema as mn, journeyInventoryReadSchema as mr, manualUploadSchema as mt, scanBatchEquivalenceDigest as n, selectedWorks as ni, journeyIsolateSchema as nn, planBRepair as nr, reviewInventory as nt, bRereadDigest as o, selectionBatchSchema as oi, reviewAttemptsQuerySchema as on, scanSessionResourceSchema as or, maximumAgentSetupSessions as ot, splitSelectorValues as p, approvedTreatmentSchema as pi, sessionReviewInputSchema as pn, journeyInventoryQuerySchema as pr, manualUploadPrepareSchema as pt, validateInspectionHead as q, workPrivacyDecisions as qn, sendReplaceResultSchema as qr, hideFinishSchema as qt, locateTermEvidence as r, withReadingProgress as ri, journeyPlaceSchema as rn, scanAliasResourceSchema as rr, appendSensitiveTerms as rt, reconcileBSession as s, selectionSchema as si, reviewAttemptsResultSchema as sn, scanGitSeedsId as sr, artifactFailureDetailSchema as st, scanBatchContextDigest as t, isSkippedWork as ti, journeyResourceSchema as tn, mergeBRepair as tr, readWorkspaceOutcomes as tt, reviseGroupMembership as u, stateSchema as ui, sessionReconciliationResourceSchema as un, scanExclusionResourceSchema as ur, manualUploadActionSchema as ut, projectJourneyInventory as v, staticCatalogRef as vi, sessionUsefulnessResourceSchema as vn, preparationBeginSchema as vr, maximumTermsFileBytes as vt, rebindReviewSubmit as w, readConfirmedHideChange as wn, journeyFindingsSchema as wr, sendRequestSchema as wt, bReviewScope as x, journeyEventSchema as xn, validatePreparationFacts as xr, sendActionSchema as xt, preparationScope as y, journeyCommitResultSchema as yn, preparationSettlementSchema as yr, normalizeSensitiveTerms as yt, inspectionCancelSchema as z, confirmedHideKinds as zn, staticSessionId as zr, classificationPartition as zt };
+export { validateDetectionSummary as $, hideKeyId as $n, sendReplaceResultSchema as $r, journeyResourceSchema as $t, renewBeforeMs as A, scanGitSeedsResource as An, journeyPreviewSchema as Ar, obsoleteJourney as At, createApplication as B, journeySearchResultSchema as Bn, nativeRespondSchema as Br, classificationPartition as Bt, rebindReviewOverlay as C, selectFrozenConfiguration as Ci, mergeBRepair as Cn, preparationStartSchema as Cr, sendActionSchema as Ct, staticallyHiddenFindings as D, scanPreparationDigest as Dn, journeyClassificationSessionsSchema as Dr, sendStartSchema as Dt, guardedFindingText as E, scanCanonicalResourceSchema as En, validatePreparationFacts as Er, sendRequestSchema as Et, readAccountAvatarUrl as F, journeyInventoryQuerySchema as Fn, applyCardAnswers as Fr, journeyGuidance as Ft, validateInspectionRequest as G, journeyEventSchema as Gn, staticSessionId as Gr, journeyContextQuerySchema as Gt, inspectionStartSchema as H, searchScopeDigest as Hn, mergePrivacyTerms as Hr, retireScanGeneration as Ht, storedCredentialSchema as I, journeyInventoryReadSchema as In, assertJourneyPrivacyReady as Ir, journeyBatchReadSchema as It, validateInspectionFence as J, readConfirmedHideChange as Jn, agentSourceSchema as Jr, hideFinishSchema as Jt, inspectionQuerySchema as K, confirmedHideAdditions as Kn, staticSessionResourceSchema as Kr, journeyContextSchema as Kt, sourceIdentityEvidence as L, journeyInventorySchema as Ln, privacyDecisionDigest as Lr, journeyReviewStorageQuerySchema as Lt, deviceAuthorizationSchema as M, scanExclusionResourceSchema as Mn, journeyRenderSchema as Mr, nativeAdapterVersions as Mt, deviceProfileScopeSchema as N, validateScanExclusion as Nn, displayedScopeDigest as Nr, attemptBudgetCodePoints as Nt, createAccount as O, scanSessionResourceSchema as On, journeyFindingImpactSchema as Or, settleCorrections as Ot, profileUrlMatchesIdentity as P, resolveSourceSelection as Pn, requestedScope as Pr, validateAttemptAppend as Pt, validateInspectionContribution as Q, addHideIndexTokens as Qn, sendReceiptSchema as Qr, journeyResourceQuerySchema as Qt, withSourceEvidence as R, journeyPreparationProgressSchema as Rn, nativeEventsSchema as Rr, applyClassificationProposal as Rt, rebindReviewAlignment as S, freezeConfiguration as Si, bReviewDigest as Sn, preparationSettlementSchema as Sr, replaceSensitiveTermsSchema as St, reviewBatchReuse as T, scanAliasResourceSchema as Tn, preparationUpdateSchema as Tr, sendPrepareSchema as Tt, validateInspectionBatch as U, journeyCommitResultSchema as Un, hasCurrentStaticReview as Ur, newJourneyWork as Ut, inspectionCancelSchema as V, journeySearchSaveSchema as Vn, retryReviewActionSchema as Vr, classificationWorks as Vt, validateInspectionBatches as W, journeyCommitSchema as Wn, staticReviewDigest as Wr, reviewCompileSchema as Wt, validateInspectionInputs as X, settleConfirmedHides as Xn, journeySendSchema as Xr, journeyPolicyRespondSchema as Xt, validateInspectionHead as Y, renderedHideValue as Yn, agentSourcesSchema as Yr, hidePublishSchema as Yt, validateInspectionQuery as Z, termHideAdditions as Zn, sendArtifactSchema as Zr, projectPreparationProgress as Zt, changeJourney as _, sourceChangePolicy as _i, reviewCandidateInputSchema as _n, workPrivacyDecisions as _r, manualUploadStartSchema as _t, bCrossSegmentReviewSchema as a, isReadingComplete as ai, reviewAttemptsResultSchema as an, bTermMatcher as ar, appendSensitiveTerms as at, isGenericPublicTerm as b, effectiveTreatmentSchema as bi, reviewRepairResourceSchema as bn, preparationBeginSchema as br, maximumTermsFileBytes as bt, reconstructBFields as c, selectedWorks as ci, sessionReconciliationResourceSchema as cn, confirmedHideKey as cr, maximumAgentSetupSessions as ct, resolveGroupSplit as d, packageCommandSchema as di, sessionReviewInputSchema as dn, dictionaryHides as dr, validateFailureLocation as dt, sendResolutionSchema as ei, journeyIsolateSchema as en, maximumHideIndexTokens as er, inspectionInputs as et, selectedValueMembers as f, selectionBatchSchema as fi, sessionReviewQuerySchema as fn, journeyConfirmedHides as fr, manualUploadActionSchema as ft, semanticGroupKey as g, stateSchema as gi, sessionUsefulnessResourceSchema as gn, workDecisionDigest as gr, manualUploadSchema as gt, hideScopeDigest as h, producerVersion as hi, sessionUsefulnessInputSchema as hn, retireWorkDescription as hr, manualUploadPrepareSchema as ht, validateBCrossSegmentReview as i, isIncludedWork as ii, reviewAttemptsQuerySchema as in, bMaskedHits as ir, reviewInventory as it, accountProfileSchema as j, verifiedScanGitSeeds as jn, journeyRenderInputSchema as jr, metadataProcessingVersion as jt, renew as k, scanGitSeedsId as kn, journeyFindingsSchema as kr, currentJourneyAdapters as kt, chooseCheapPlacement as l, withReadingProgress as li, sessionRereadInputSchema as ln, confirmedHideKinds as lr, artifactFailureDetailSchema as lt, activeJourneyTerms as m, gitMetadataBudgetBytes as mi, sessionReviewStatusSchema as mn, syncTermGroups as mr, manualUploadChoiceSchema as mt, scanBatchEquivalenceDigest as n, hasCompleteWorkDescription as ni, sortingApplySchema as nn, bContainment as nr, settingsQuerySchema as nt, bRereadDigest as o, isSelectedWork as oi, sessionReconcileInputSchema as on, bWordBounded as or, classifyAgentSetup as ot, splitSelectorValues as p, selectionSchema as pi, sessionReviewResourceSchema as pn, maskedHitsStale as pr, manualUploadBindingSchema as pt, validateInspectionClaim as q, confirmedHideDeltaSchema as qn, agentSourcePathSegment as qr, hideBeginSchema as qt, locateTermEvidence as r, isClassifying as ri, reviewAttemptResourceSchema as rn, bExceptionRanges as rr, readWorkspaceOutcomes as rt, reconcileBSession as s, isSkippedWork as si, sessionReconcileResultSchema as sn, confirmedHideGroupIds as sr, defaultAgentSetupInclusion as st, scanBatchContextDigest as t, sendSettingsSchema as ti, journeyPlaceSchema as tn, packHideIndex as tr, settingsBatchSchema as tt, reviseGroupMembership as u, commandSchema as ui, sessionRereadResourceSchema as un, confirmedHideTerms as ur, resolveFailureLocation as ut, projectJourneyInventory as v, recommendParallelism as vi, reviewCandidateResourceSchema as vn, workCorrectionBinding as vr, candidateSortAvailable as vt, rebindReviewSubmit as w, staticCatalogRef as wi, planBRepair as wn, preparationStateSchema as wr, sendChoiceSchema as wt, bReviewScope as x, defaultScopedSettings as xi, reviewTransportBytes as xn, preparationPermissionSchema as xr, normalizeSensitiveTerms as xt, preparationScope as y, approvedTreatmentSchema as yi, reviewRepairInputSchema as yn, emptyPreparationFacts as yr, emptyTermsRevision as yt, agentSetupKey as z, applyClassification as zn, nativeGetSchema as zr, classificationCommitSchema as zt };