@tendrilapp/cli 0.1.42 → 0.1.44

package/dist/tendril.js

@@ -1980,8 +1980,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path55) {
-  return `--${path55.join("-")}`;
+function tokenPathToCssVar(path56) {
+  return `--${path56.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -2025,11 +2025,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path55 = variableNameToPath(variable.name);
-    if (path55.length === 0) {
+    const path56 = variableNameToPath(variable.name);
+    if (path56.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path55 };
+    return { variable, path: path56 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -2050,21 +2050,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path55 } of entries) {
+  for (const { variable, path: path56 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path55.slice(0, -1)) {
+    for (const segment of path56.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path55[path55.length - 1];
+    const leaf = path56[path56.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path55.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path56.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path55.join("."),
-      cssVar: tokenPathToCssVar(path55),
+      path: path56.join("."),
+      cssVar: tokenPathToCssVar(path56),
       type: token.$type,
       value: token.$value
     });
@@ -2253,9 +2253,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path55 = ctx.pathById.get(id);
-  if (path55 === void 0) ctx.unresolved.add(id);
-  return path55;
+  const path56 = ctx.pathById.get(id);
+  if (path56 === void 0) ctx.unresolved.add(id);
+  return path56;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -2290,8 +2290,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path55 = resolveBinding(ctx, id);
-        if (path55 !== void 0) tokens.add(path55);
+        const path56 = resolveBinding(ctx, id);
+        if (path56 !== void 0) tokens.add(path56);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -2299,8 +2299,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path55 = resolveBinding(ctx, radiusId);
-    if (path55 !== void 0) tokens.add(path55);
+    const path56 = resolveBinding(ctx, radiusId);
+    if (path56 !== void 0) tokens.add(path56);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -2310,10 +2310,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path55 = resolveBinding(ctx, gapId);
-      if (path55 !== void 0) {
-        layout.gap = path55;
-        tokens.add(path55);
+      const path56 = resolveBinding(ctx, gapId);
+      if (path56 !== void 0) {
+        layout.gap = path56;
+        tokens.add(path56);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -2322,10 +2322,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path55 = resolveBinding(ctx, id);
-        if (path55 !== void 0) {
-          paddingPaths.push(path55);
-          tokens.add(path55);
+        const path56 = resolveBinding(ctx, id);
+        if (path56 !== void 0) {
+          paddingPaths.push(path56);
+          tokens.add(path56);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -6239,34 +6239,43 @@ function classifyBundleSurface(files, opts) {
   const excluded = [];
   const unknown = [];
   for (const raw of files) {
-    const path55 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
-    const inEvidence = path55.startsWith(`${EVIDENCE_DIR}/`);
-    const name = inEvidence ? path55.slice(EVIDENCE_DIR.length + 1) : path55;
+    const path56 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+    const inEvidence = path56.startsWith(`${EVIDENCE_DIR}/`);
+    if (path56.startsWith("fonts/")) {
+      const fname = path56.slice("fonts/".length);
+      if (!fname.includes("/") && (/\.(woff2?|ttf|otf)$/i.test(fname) || /^(NOTICE|LICENSE|LICENCE)[^/]*\.txt$/i.test(fname))) {
+        excluded.push({ path: path56, reason: "font payload \u2014 not published (fonts policy pending); faces are sha-pinned in component.json requiredFonts" });
+        continue;
+      }
+      unknown.push(path56);
+      continue;
+    }
+    const name = inEvidence ? path56.slice(EVIDENCE_DIR.length + 1) : path56;
     if (name.includes("/")) {
-      unknown.push(path55);
+      unknown.push(path56);
       continue;
     }
     if (inEvidence) {
-      if (name === "verify-report.json") published.push({ path: path55, role: "verify-report" });
-      else if (name === "diff-legend.txt") published.push({ path: path55, role: "diff-legend" });
-      else if (name === "inspect.html") published.push({ path: path55, role: "inspect-sheet" });
-      else if (/-mount-failure\.png$/.test(name)) excluded.push({ path: path55, reason: "harness failure diagnostic (regenerated every verify run, never published)" });
+      if (name === "verify-report.json") published.push({ path: path56, role: "verify-report" });
+      else if (name === "diff-legend.txt") published.push({ path: path56, role: "diff-legend" });
+      else if (name === "inspect.html") published.push({ path: path56, role: "inspect-sheet" });
+      else if (/-mount-failure\.png$/.test(name)) excluded.push({ path: path56, reason: "harness failure diagnostic (regenerated every verify run, never published)" });
       else {
         const hit = EVIDENCE_PATTERNS.find((p) => p.re.test(name));
-        if (hit !== void 0) published.push({ path: path55, role: hit.role });
-        else unknown.push(path55);
+        if (hit !== void 0) published.push({ path: path56, role: hit.role });
+        else unknown.push(path56);
       }
       continue;
     }
-    if (name === opts.entry) published.push({ path: path55, role: "entry" });
-    else if (name === "styles.css") published.push({ path: path55, role: "styles" });
-    else if (name === "tokens.css") published.push({ path: path55, role: "tokens" });
-    else if (name === "fonts.css") published.push({ path: path55, role: "fonts" });
-    else if (name === "component.json") published.push({ path: path55, role: "manifest" });
+    if (name === opts.entry) published.push({ path: path56, role: "entry" });
+    else if (name === "styles.css") published.push({ path: path56, role: "styles" });
+    else if (name === "tokens.css") published.push({ path: path56, role: "tokens" });
+    else if (name === "fonts.css") published.push({ path: path56, role: "fonts" });
+    else if (name === "component.json") published.push({ path: path56, role: "manifest" });
     else {
       const skip = EXCLUDED.find((e) => e.test(name));
-      if (skip !== void 0) excluded.push({ path: path55, reason: skip.reason });
-      else unknown.push(path55);
+      if (skip !== void 0) excluded.push({ path: path56, reason: skip.reason });
+      else unknown.push(path56);
     }
   }
   const roles = new Set(published.map((p) => p.role));
@@ -6276,8 +6285,8 @@ function missingInspectCrops(sheetText, publishedPaths) {
   const held = new Set(publishedPaths);
   const missing = /* @__PURE__ */ new Set();
   for (const [, name] of sheetText.matchAll(/src="\.\/([^"]+)"/g)) {
-    const path55 = `${EVIDENCE_DIR}/${name}`;
-    if (!held.has(path55)) missing.add(path55);
+    const path56 = `${EVIDENCE_DIR}/${name}`;
+    if (!held.has(path56)) missing.add(path56);
   }
   return [...missing].sort();
 }
@@ -6385,10 +6394,10 @@ function readScoredFiles(report) {
   const entries = Object.entries(value);
   if (entries.length === 0) return void 0;
   const out = {};
-  for (const [path55, digest] of entries) {
-    if (path55 === "" || path55.startsWith("/") || path55.includes("..")) return void 0;
+  for (const [path56, digest] of entries) {
+    if (path56 === "" || path56.startsWith("/") || path56.includes("..")) return void 0;
     if (!isSetHash(digest)) return void 0;
-    out[path55] = digest;
+    out[path56] = digest;
   }
   return out;
 }
@@ -6396,11 +6405,11 @@ function compareScoredFiles(recorded, actual) {
   const missing = [];
   const unscored = [];
   const changed = [];
-  for (const [path55, digest] of Object.entries(recorded)) {
-    if (!(path55 in actual)) missing.push(path55);
-    else if (actual[path55] !== digest) changed.push(path55);
+  for (const [path56, digest] of Object.entries(recorded)) {
+    if (!(path56 in actual)) missing.push(path56);
+    else if (actual[path56] !== digest) changed.push(path56);
   }
-  for (const path55 of Object.keys(actual)) if (!(path55 in recorded)) unscored.push(path55);
+  for (const path56 of Object.keys(actual)) if (!(path56 in recorded)) unscored.push(path56);
   return { missing: missing.sort(), unscored: unscored.sort(), changed: changed.sort() };
 }
 function scoredRecordingSetHash(report) {
@@ -8453,8 +8462,14 @@ var init_publish_client = __esm({
         this.token = options.token;
         this.send = options.fetch ?? globalThis.fetch;
       }
-      acceptTerms(input) {
-        return this.json("POST", "/api/consent", input);
+      requestApproval(input) {
+        return this.json("POST", "/api/publish-approvals", input);
+      }
+      pollApproval(input) {
+        return this.json("GET", `/api/publish-approvals/${encodeURIComponent(input.approvalId)}`, null, true);
+      }
+      whoami() {
+        return this.json("GET", "/api/whoami", null, true);
       }
       begin(input) {
         return this.json("POST", "/api/publications", input, true);
@@ -8548,7 +8563,6 @@ var init_publish_client = __esm({
           refusal: typeof record["refusal"] === "string" ? record["refusal"] : `the portal refused with ${String(response.status)}`,
           ...Array.isArray(record["detail"]) ? { detail: record["detail"] } : {},
           ...Array.isArray(record["missing"]) ? { missing: record["missing"] } : {},
-          ...isRecord(record["needsConsent"]) ? { needsConsent: record["needsConsent"] } : {},
           ...isRecord(record["needsConfirmation"]) ? { needsConfirmation: record["needsConfirmation"] } : {}
         };
       }
@@ -13791,6 +13805,72 @@ var init_activate = __esm({
   }
 });
 
+// packages/cli/src/run-presence.ts
+import { createHash as createHash8 } from "node:crypto";
+import { existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync29, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
+import path41 from "node:path";
+function presenceDir() {
+  return path41.join(path41.dirname(sessionPath()), "runs");
+}
+function presenceFile(componentName) {
+  return path41.join(presenceDir(), `${createHash8("sha256").update(componentName).digest("hex").slice(0, 16)}.json`);
+}
+function readCached(componentName) {
+  const file = presenceFile(componentName);
+  if (!existsSync32(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync29(file, "utf8"));
+    return typeof parsed.runId === "string" && typeof parsed.origin === "string" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function post(origin, token, pathname, body, method = "POST") {
+  const response = await fetch(`${origin}${pathname}`, {
+    method,
+    headers: { authorization: `Bearer ${token}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    signal: AbortSignal.timeout(PRESENCE_TIMEOUT_MS)
+  });
+  if (!response.ok) throw new Error(String(response.status));
+  return response.json();
+}
+async function reportRunPresence(componentName, phase) {
+  try {
+    const session = readStoredSession();
+    if (session === void 0) return;
+    const cached2 = readCached(componentName);
+    if (cached2 !== void 0 && cached2.origin === session.origin) {
+      const beat = await post(session.origin, session.token, `/api/runs/${encodeURIComponent(cached2.runId)}`, { phase });
+      if (beat.alive === true) return;
+    }
+    const started = await post(session.origin, session.token, "/api/runs", { componentName, phase });
+    if (typeof started.runId !== "string") return;
+    mkdirSync10(presenceDir(), { recursive: true });
+    writeFileSync14(presenceFile(componentName), `${JSON.stringify({ runId: started.runId, origin: session.origin })}
+`, { mode: 384 });
+  } catch {
+  }
+}
+async function endRunPresence(componentName) {
+  try {
+    const session = readStoredSession();
+    const cached2 = readCached(componentName);
+    rmSync5(presenceFile(componentName), { force: true });
+    if (session === void 0 || cached2 === void 0 || cached2.origin !== session.origin) return;
+    await post(session.origin, session.token, `/api/runs/${encodeURIComponent(cached2.runId)}`, void 0, "DELETE");
+  } catch {
+  }
+}
+var PRESENCE_TIMEOUT_MS;
+var init_run_presence = __esm({
+  "packages/cli/src/run-presence.ts"() {
+    "use strict";
+    init_publish_client();
+    PRESENCE_TIMEOUT_MS = 1500;
+  }
+});
+
 // packages/cli/src/commands/compose.ts
 var compose_exports = {};
 __export(compose_exports, {
@@ -13799,15 +13879,15 @@ __export(compose_exports, {
   compositionPairsFor: () => compositionPairsFor,
   runCompose: () => runCompose
 });
-import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync32, readFileSync as readFileSync29, readdirSync as readdirSync14 } from "node:fs";
-import path41 from "node:path";
+import { createHash as createHash9 } from "node:crypto";
+import { existsSync as existsSync33, readFileSync as readFileSync30, readdirSync as readdirSync14 } from "node:fs";
+import path42 from "node:path";
 function compositionPairsFor(hostSet, roots) {
-  const parent = path41.dirname(hostSet);
+  const parent = path42.dirname(hostSet);
   const explicitRoots = [...new Set(roots)];
   let skippedParent;
   let parentRoot = [];
-  if (!explicitRoots.some((r) => path41.resolve(r) === path41.resolve(parent))) {
+  if (!explicitRoots.some((r) => path42.resolve(r) === path42.resolve(parent))) {
     let parentEntries = 0;
     try {
       parentEntries = readdirSync14(parent).length;
@@ -13848,7 +13928,7 @@ function substitutionPairs(edges, hostSet) {
       });
     }
     const pair = pairs.get(key);
-    const poseDisplay = e.pose.reps.map((r) => `${path41.basename(r.dir)}:${r.slug}`).join(", ");
+    const poseDisplay = e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ");
     pair.instances.push({ hostRep: e.hostRep, instanceId: e.instanceId, poseVariantNodeId: e.pose.variantNodeId, ...poseDisplay !== "" ? { poseDisplay } : {} });
     for (const d of e.disclosures) if (!pair.disclosures.includes(d)) pair.disclosures.push(d);
   }
@@ -13860,7 +13940,7 @@ function runCompose(flags) {
     return;
   }
   const base = process.env["INIT_CWD"] ?? process.cwd();
-  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path41.resolve(base, d)) : [base];
+  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path42.resolve(base, d)) : [base];
   if (flags.set === void 0 && (flags.confirmCompositions === true || flags.decline !== void 0 && flags.decline.length > 0)) {
     fail(flags, ExitCode.InputValidation, {
       error: "--confirm-compositions/--decline require --set <host> \u2014 a decision needs the host set it decides for",
@@ -13869,7 +13949,7 @@ function runCompose(flags) {
     });
   }
   if (flags.set !== void 0) {
-    runComposeConfirm(flags, path41.resolve(base, flags.set), roots);
+    runComposeConfirm(flags, path42.resolve(base, flags.set), roots);
     return;
   }
   const index = buildComposeIndex(roots);
@@ -13887,7 +13967,7 @@ function runCompose(flags) {
     }
     let lastHost = "";
     for (const e of edges) {
-      const host = `${path41.basename(e.hostSet)}`;
+      const host = `${path42.basename(e.hostSet)}`;
       if (host !== lastHost) {
         process.stdout.write(`
 ${host}
@@ -13895,7 +13975,7 @@ ${host}
         lastHost = host;
       }
       const partners = e.partners.map((p) => p.displayName).join(" / ") || "\u2014";
-      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path41.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
+      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
       process.stdout.write(`  ${e.kind.toUpperCase().padEnd(12)} ${e.hostRep}/${e.instanceId} "${e.instanceName}" \u2192 ${partners}${pose}
 `);
       for (const d of e.disclosures) process.stdout.write(`    \xB7 ${d}
@@ -13907,14 +13987,14 @@ ${NOTE}
   });
 }
 function runComposeConfirm(flags, hostSet, roots) {
-  if (!existsSync32(path41.join(hostSet, "recording-set.json"))) {
+  if (!existsSync33(path42.join(hostSet, "recording-set.json"))) {
     fail(flags, ExitCode.InputValidation, {
       error: `no recording-set.json in ${hostSet}`,
       code: "no-recording-set",
       remediation: "Point --set at a recorded host set (the directory holding recording-set.json)."
     });
   }
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path41.dirname(hostSet)])];
+  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path42.dirname(hostSet)])];
   const index = buildComposeIndex(scanRoots);
   const edges = composeReport(index);
   const pairs = substitutionPairs(edges, hostSet);
@@ -13997,7 +14077,7 @@ PAIR ${p.displayName}${p.figmaFile !== void 0 ? ` (file ${p.figmaFile})` : " \u2
       // full recording-set hash join lands with pin authoring, where
       // task configs exist.)
       manifestSha256: Object.fromEntries(
-        p.partnerDirs.map((d) => [path41.relative(hostSet, d), createHash8("sha256").update(readFileSync29(path41.join(d, "recording-set.json"))).digest("hex")])
+        p.partnerDirs.map((d) => [path42.relative(hostSet, d), createHash9("sha256").update(readFileSync30(path42.join(d, "recording-set.json"))).digest("hex")])
       )
     },
     // Schema shape ONLY (review: the display-side poseDisplay field
@@ -14077,10 +14157,10 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync33, mkdtempSync as mkdtempSync2, readFileSync as readFileSync30, readdirSync as readdirSync15 } from "node:fs";
+import { existsSync as existsSync34, mkdtempSync as mkdtempSync2, readFileSync as readFileSync31, readdirSync as readdirSync15 } from "node:fs";
 import os7 from "node:os";
-import path42 from "node:path";
-import { writeFileSync as writeFileSync14 } from "node:fs";
+import path43 from "node:path";
+import { writeFileSync as writeFileSync15 } from "node:fs";
 function recordsInteractionState(reports) {
   const evident = (s) => stateTokens(s).some((t) => INTERACTION_TREATMENT_VALUES.has(t));
   return reports.some((r) => evident(r.axis) || r.domain.some(evident));
@@ -14102,7 +14182,7 @@ function interactionDisclosure(component, reports) {
   };
 }
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync30(file, "utf8"));
+  const env = JSON.parse(readFileSync31(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -14160,8 +14240,8 @@ function runRecordPlan(opts) {
   if (rawFile !== void 0) {
     try {
       const envelope = rawEnvelopeFromFile(rawFile, opts.metadataRawPartsFile !== void 0);
-      const tmp = path42.join(mkdtempSync2(path42.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
-      writeFileSync14(tmp, JSON.stringify(envelope));
+      const tmp = path43.join(mkdtempSync2(path43.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
+      writeFileSync15(tmp, JSON.stringify(envelope));
       metadataEntries.push({ file: tmp });
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
@@ -14182,7 +14262,7 @@ function runRecordPlan(opts) {
   let metadataTruncated = false;
   for (const { file, frame } of metadataEntries) {
     try {
-      const parsed = symbolsFromMetadataEnvelope(path42.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path43.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -14216,7 +14296,7 @@ function runRecordPlan(opts) {
   if (symbols.length === 0) {
     const leads = metadataEntries.flatMap(({ file }) => {
       try {
-        const env = JSON.parse(readFileSync30(path42.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -14309,7 +14389,7 @@ function runRecordPlan(opts) {
         // a CLI flag and the MCP surface has no parameter for it.
         decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
         text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
-        userRuns: [`rm ${quoteArg(path42.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+        userRuns: [`rm ${quoteArg(path43.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
       },
       {
         id: "larger-allowance",
@@ -14319,6 +14399,7 @@ function runRecordPlan(opts) {
     ],
     limitHintIfWhoamiIsSilent: LIMIT_HINT
   };
+  void reportRunPresence(opts.component, "recording");
   emitData(
     opts,
     {
@@ -14507,7 +14588,7 @@ function runRecordNext(opts) {
     const progress = payload["progress"];
     process.stdout.write(`[${progress.recordedReps}/${progress.totalReps} reps] ${payload["tool"]} for ${payload["slug"]} (node ${payload["nodeId"]})
   \u2192 ${payload["note"]}
-  \u2192 then: ${tendrilCommand(`record ingest --set ${path42.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
+  \u2192 then: ${tendrilCommand(`record ingest --set ${path43.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
 `);
   });
 }
@@ -14581,7 +14662,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync33(path42.join(setDir, rep, name))) {
+    if (existsSync34(path43.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -14603,16 +14684,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync30(path42.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync30(path42.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync31(path43.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync30(path42.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync31(path43.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -14624,7 +14705,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
-      remediation: `Use \`${tendrilCommand(`record fetch --set ${path42.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
+      remediation: `Use \`${tendrilCommand(`record fetch --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
     });
   }
   if (opts.rep === "__set__" && opts.tool === "get_variable_defs") {
@@ -14644,7 +14725,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync14(path42.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync15(path43.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -14668,7 +14749,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync14(path42.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync15(path43.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_motion_context", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_motion_context ingested\n");
@@ -14684,7 +14765,7 @@ async function runRecordIngest(opts) {
       if (assets !== void 0) {
         for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path42.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
       }
     });
@@ -14757,14 +14838,14 @@ async function runRecordIngestRep(opts) {
     if (assets !== void 0) {
       for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path42.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
     }
   });
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path42.resolve(opts.dir);
+    const dir = path43.resolve(opts.dir);
     const names = readdirSync15(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
@@ -14776,7 +14857,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync30(path42.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync31(path43.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -14796,11 +14877,11 @@ function runRecordAsset(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "pass --name and --file for a single asset, or --dir for a batch",
       code: "asset-rejected",
-      remediation: tendrilCommand(`record asset --set ${path42.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
+      remediation: tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync30(path42.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync31(path43.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -14817,8 +14898,8 @@ function runRecordStatus(opts) {
   const status = sessionStatus(opts.setDir);
   const composition = (() => {
     try {
-      const setDir = path42.resolve(opts.setDir);
-      const { open, standing, invalid } = compositionPairsFor(setDir, [path42.dirname(setDir)]);
+      const setDir = path43.resolve(opts.setDir);
+      const { open, standing, invalid } = compositionPairsFor(setDir, [path43.dirname(setDir)]);
       return {
         openPairs: open.map((p) => ({ displayName: p.displayName, pairKey: p.key, instances: p.instances.length })),
         confirmed: standing.filter((s) => s.status === "confirmed").length,
@@ -14839,7 +14920,7 @@ function runRecordStatus(opts) {
       }
     }
     process.stdout.write(
-      status.motion.recorded ? motionTruthFor(path42.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
+      status.motion.recorded ? motionTruthFor(path43.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
 ` : "MOTION set-level motion context not yet recorded \u2014 `record next` names the call once the reps and token map are done\n" : "MOTION never asked \u2014 this set predates the motion-capture obligation (fresh plans record it; briefs prescribe default motion doctrine only)\n"
     );
     if ("unavailable" in composition) {
@@ -14847,7 +14928,7 @@ function runRecordStatus(opts) {
 `);
     } else if (composition.openPairs.length > 0) {
       process.stdout.write(
-        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path42.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
+        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path43.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
 `
       );
     } else if (composition.confirmed > 0) {
@@ -14887,7 +14968,7 @@ function narrowedRoles(derived, override) {
 function rolesFromFile(opts, file, derived) {
   let json;
   try {
-    json = JSON.parse(readFileSync30(path42.resolve(file), "utf8"));
+    json = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read roles file ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -14925,11 +15006,11 @@ function rolesFromFile(opts, file, derived) {
   };
 }
 function runRecordFinish(opts) {
-  if (!existsSync33(path42.join(opts.setDir, "recording-set.json"))) {
+  if (!existsSync34(path43.join(opts.setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `no recording-set.json in ${opts.setDir}`,
       code: "no-recording-set",
-      remediation: `Run \`${tendrilCommand(`record plan --set ${path42.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
+      remediation: `Run \`${tendrilCommand(`record plan --set ${path43.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
     });
   }
   const { manifest, raw } = readManifestFile(opts.setDir);
@@ -14957,17 +15038,17 @@ function runRecordFinish(opts) {
     fail(opts, ExitCode.ConfirmationRequired, {
       error: "--confirm-roles (and --roles-file) require an interactive terminal \u2014 this confirmation is human-only",
       code: "roles-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path42.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
+      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path43.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
     });
   }
   const merged = { ...raw, roles };
-  const { issues } = validateRecordingSet(merged, (rel) => existsSync33(path42.join(opts.setDir, rel)));
+  const { issues } = validateRecordingSet(merged, (rel) => existsSync34(path43.join(opts.setDir, rel)));
   const errors = issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set rejected \u2014 roles NOT written: ${errors.map((e) => e.message).join("; ")}`,
       code: "recording-set-invalid",
-      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path42.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
+      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path43.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
     });
   }
   for (const issue of issues) if (issue.severity === "warning") warn(opts, issue.message);
@@ -14986,6 +15067,7 @@ var init_record = __esm({
     init_src();
     init_src4();
     init_output();
+    init_run_presence();
     init_entitlement();
     init_invocation();
     init_compose2();
@@ -15017,9 +15099,9 @@ var init_record = __esm({
 });
 
 // packages/cli/src/font-guidance.ts
-import path43 from "node:path";
+import path44 from "node:path";
 function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path43.resolve(setDir);
+  const set = setDir === void 0 ? void 0 : path44.resolve(setDir);
   if (set !== void 0) {
     try {
       const needs = recordedFontNeeds(set);
@@ -15094,8 +15176,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync34, readFileSync as readFileSync31 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync35, readFileSync as readFileSync32 } from "node:fs";
+import path45 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   const queryRefusal = systemFaceRefusal(opts.family.trim());
@@ -15116,7 +15198,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path44.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path45.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -15211,16 +15293,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path44.join(opts.cacheDir, "manifest.json");
-  if (!existsSync34(manifestPath2)) {
+  const manifestPath2 = path45.join(opts.cacheDir, "manifest.json");
+  if (!existsSync35(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: `Run \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) first.`
     });
   }
-  const faces = JSON.parse(readFileSync31(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path44.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync32(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path45.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -15264,13 +15346,13 @@ function familyMismatch(family, declared) {
 }
 function runFontsAdd(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path44.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path44.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path45.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
       });
     }
   } else {
@@ -15329,13 +15411,13 @@ cache them: ${tendrilCommand(`fonts add-system ${quoteArg(opts.family)}`)}
 }
 function runFontsAddSystem(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path44.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. A face cached under a name the mount never matches leaves scoring refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path44.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path45.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
       });
     }
   } else {
@@ -15385,12 +15467,12 @@ var init_fonts = __esm({
 });
 
 // packages/cli/src/profile-input.ts
-import { existsSync as existsSync35, readFileSync as readFileSync32 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync36, readFileSync as readFileSync33 } from "node:fs";
+import path46 from "node:path";
 function loadCodebaseProfile(flags, profilePath) {
   if (profilePath === void 0) return null;
-  const abs = path45.resolve(profilePath);
-  if (!existsSync35(abs)) {
+  const abs = path46.resolve(profilePath);
+  if (!existsSync36(abs)) {
     fail(flags, ExitCode.InputValidation, {
       error: `no profile at ${abs}`,
       code: "profile_missing",
@@ -15398,7 +15480,7 @@ function loadCodebaseProfile(flags, profilePath) {
     });
   }
   try {
-    return readCodebaseProfile(readFileSync32(abs, "utf8"));
+    return readCodebaseProfile(readFileSync33(abs, "utf8"));
   } catch (error) {
     fail(flags, ExitCode.InputValidation, {
       error: `profile at ${abs} is not a valid codebase profile: ${error instanceof Error ? error.message : String(error)}`,
@@ -15440,8 +15522,8 @@ __export(verify_exports, {
   runVerify: () => runVerify,
   verdictCaveatsFor: () => verdictCaveatsFor
 });
-import { existsSync as existsSync36, readFileSync as readFileSync33, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
-import path46 from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync34, rmSync as rmSync6, writeFileSync as writeFileSync16 } from "node:fs";
+import path47 from "node:path";
 function interactionCoverage(behaviors) {
   const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
   const content = behaviors.filter((b) => b.id.startsWith("content-prop-renders("));
@@ -15682,12 +15764,12 @@ function compositionReport(input) {
 function eyeCheck(bundleDir) {
   return {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path46.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path47.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
 }
 function evidenceArtifacts(evidenceDir, reps) {
-  const named = (name) => existsSync36(path46.join(evidenceDir, name)) ? name : null;
+  const named = (name) => existsSync37(path47.join(evidenceDir, name)) ? name : null;
   return {
     legend: named("diff-legend.txt"),
     configs: reps.map((rep) => {
@@ -15735,7 +15817,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path46.resolve(t.set) === path46.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -15796,19 +15878,19 @@ function verdictCaveatsFor(input) {
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   let recordingSetDrift;
-  const setOverride = opts.set !== void 0 ? path46.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path46.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync36(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path47.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path47.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync37(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path46.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path47.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync36(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync33(manifestPath2, "utf8"));
+  if (existsSync37(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync34(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15839,21 +15921,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path46.isAbsolute(p)) return p;
-      const fromRepo = path46.resolve(REPO_ROOT, p);
-      if (existsSync36(fromRepo)) return fromRepo;
-      return path46.resolve(callerCwd, p);
+      if (path47.isAbsolute(p)) return p;
+      const fromRepo = path47.resolve(REPO_ROOT, p);
+      if (existsSync37(fromRepo)) return fromRepo;
+      return path47.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync36(path46.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path46.resolve(t.set) === path46.resolve(setDir))) {
+    if (!existsSync37(path47.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path47.resolve(t.set) === path47.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path46.resolve(t.set) === path46.resolve(setDir));
-    if (registry !== void 0 && !existsSync36(path46.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
+    if (registry !== void 0 && !existsSync37(path47.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -15885,9 +15967,9 @@ async function runVerify(opts) {
       recordingSetDrift = { stamped: manifest.provenance.recordingSet.hash, current: hash };
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path46.join(opts.bundleDir, name);
-      if (!existsSync36(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync33(p)));
+      const p = path47.join(opts.bundleDir, name);
+      if (!existsSync37(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync34(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15925,7 +16007,7 @@ async function runVerify(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync36(path46.join(task.set, c.rep, "get_screenshot.json")) || !existsSync36(path46.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync37(path47.join(task.set, c.rep, "get_screenshot.json")) || !existsSync37(path47.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -15935,8 +16017,8 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path46.join(opts.bundleDir, "verify-evidence");
-  rmSync5(evidenceDir, { recursive: true, force: true });
+  const evidenceDir = path47.join(opts.bundleDir, "verify-evidence");
+  rmSync6(evidenceDir, { recursive: true, force: true });
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(
     opts.bundleDir,
@@ -15953,7 +16035,7 @@ async function runVerify(opts) {
     // ASKED, never "follows every convention".
     loadCodebaseProfile(opts, opts.profile) ?? void 0
   );
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path46.join(opts.bundleDir, f)).filter((f) => existsSync36(f)).map((f) => readFileSync33(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss, { ...authorityConfigs !== void 0 ? { authority: authorityConfigs } : {} });
   const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs, {
     ...opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {},
@@ -15974,10 +16056,10 @@ async function runVerify(opts) {
     warn(opts, `compositions extension REJECTED (${crossComposition.malformed}) \u2014 the cross-bundle backstop did NOT run over it; repair the manifest entry and re-verify. This is an instrument failure, not a clean bill.`);
   }
   const verifyCallerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path46.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
+  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path47.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
   const staticComposedChecks = composedChecks(opts.bundleDir, task.entry, verifyPins.pins);
   const renderExpectations = verifyPins.pins.map((pin) => ({
-    modulePath: path46.join(composedModuleDir(pin.partnerName), pin.entryComponent),
+    modulePath: path47.join(composedModuleDir(pin.partnerName), pin.entryComponent),
     component: pin.entryComponent,
     stampName: `${pin.pairKey}:${pin.entryComponent}`,
     hostReps: [...new Set(pin.instances.map((i) => i.hostRep))],
@@ -16270,7 +16352,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path46.join(opts.bundleDir, f)).filter((f) => existsSync36(f)).map((f) => readFileSync33(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -16325,7 +16407,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
   persistReport(opts, report, evidenceDir);
 }
 function persistReport(opts, report, evidenceDir) {
-  if (!existsSync36(evidenceDir)) return;
+  if (!existsSync37(evidenceDir)) return;
   const rulerExit = process.exitCode === void 0 ? 0 : Number(process.exitCode);
   const withExit = {
     ...report,
@@ -16333,9 +16415,9 @@ function persistReport(opts, report, evidenceDir) {
     ...rulerExit !== 0 ? { rulerRefusal: EXIT_REFUSALS[rulerExit] ?? `ruler exited ${rulerExit}` } : {}
   };
   try {
-    writeFileSync15(
-      path46.join(evidenceDir, VERIFY_REPORT_FILENAME),
-      `${JSON.stringify(verifyReportForTransport(withExit, path46.basename(opts.bundleDir)), null, 2)}
+    writeFileSync16(
+      path47.join(evidenceDir, VERIFY_REPORT_FILENAME),
+      `${JSON.stringify(verifyReportForTransport(withExit, path47.basename(opts.bundleDir)), null, 2)}
 `
     );
   } catch (e) {
@@ -16385,11 +16467,11 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync37, mkdirSync as mkdirSync10, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "node:fs";
-import path47 from "node:path";
+import { appendFileSync, existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync35, writeFileSync as writeFileSync17 } from "node:fs";
+import path48 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path47.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync37(path47.join(asPath, "recording-set.json"));
+  const asPath = path48.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync38(path48.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
@@ -16398,7 +16480,7 @@ function resolveEngineTask(opts, callerCwd) {
       for (const d of authored.disclosures) warn(opts, d);
       return {
         task: authored.task,
-        name: path47.basename(asPath),
+        name: path48.basename(asPath),
         ref: asPath,
         disclosures: authored.disclosures,
         interactionEvidence: authored.api.interactionEvidence,
@@ -16425,10 +16507,11 @@ function runEngineBrief(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const { task, name, ref, disclosures } = resolveEngineTask(opts, callerCwd);
+  void reportRunPresence(name, "implementing");
   const bar = BARS3[opts.bar];
-  if (existsSync37(path47.join(task.set, "recording-set.json"))) {
+  if (existsSync38(path48.join(task.set, "recording-set.json"))) {
     try {
-      const { open, skippedParent } = compositionPairsFor(path47.resolve(task.set), [opts.library !== void 0 ? path47.resolve(callerCwd, opts.library) : callerCwd]);
+      const { open, skippedParent } = compositionPairsFor(path48.resolve(task.set), [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
       if (skippedParent !== void 0) {
         disclosures.push(
           `COMPOSITION DISCOVERY PARTIAL: the set's parent directory (${skippedParent.dir}) holds ${String(skippedParent.entries)} entries and was not scanned as a recordings library \u2014 sibling sets there are invisible to pairing. Pass --library <dir> to scan a specific library deliberately.`
@@ -16437,7 +16520,7 @@ function runEngineBrief(opts) {
       if (open.length > 0) {
         const componentNames = [...new Set(open.map((p) => p.displayName))];
         disclosures.push(
-          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path47.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path48.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
         );
       }
     } catch (err) {
@@ -16454,9 +16537,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock + motionBriefSection(task.set) + conventions;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path47.join(task.set, "recording-set.json");
-  if (existsSync37(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync34(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path48.join(task.set, "recording-set.json");
+  if (existsSync38(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync35(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -16464,7 +16547,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync37(manifestPath2)) {
+  if (existsSync38(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -16486,7 +16569,7 @@ ${notRecorded}` : "";
       };
     }
   }
-  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path47.resolve(callerCwd, opts.library) : callerCwd]);
+  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
   const jsxProp = ([k, v]) => typeof v === "string" ? `${k}=${JSON.stringify(v)}` : `${k}={${JSON.stringify(v)}}`;
   const composedBlock = pinsResult.pins.length === 0 && pinsResult.issues.length === 0 ? "" : (pinsResult.pins.length > 0 ? `
 
@@ -16522,10 +16605,10 @@ ${pinsResult.issues.map((i) => `- ${i}`).join("\n")}` : "");
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path47.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path47.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync10(path47.dirname(payloadFile), { recursive: true });
-  writeFileSync16(payloadFile, payload);
+  const payloadFile = path48.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path48.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync11(path48.dirname(payloadFile), { recursive: true });
+  writeFileSync17(payloadFile, payload);
   emitData(
     opts,
     {
@@ -16571,7 +16654,7 @@ ${segments}`;
         // command must search the same bundle roots the pins came
         // from, or the oracle and the brief describe different worlds.
         `Run \`${tendrilCommand(
-          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path47.resolve(callerCwd, opts.library))}` : ""} --json`
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path48.resolve(callerCwd, opts.library))}` : ""} --json`
         )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass. Two consecutive non-improving scores mean INSPECT the verify-evidence diffs before deciding \u2014 stop only when inspection yields no fix hypothesis (a measured run was byte-identical twice, then went 27/27 after reading the diffs).",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
@@ -16586,8 +16669,8 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  const file = path47.join(candidateDir, "score-history.jsonl");
-  const starts = existsSync37(file) ? readFileSync34(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const file = path48.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync38(file) ? readFileSync35(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
   const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
   appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
@@ -16595,9 +16678,10 @@ function appendScoreHistory(candidateDir, entry) {
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path47.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path48.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence, unmappedInteractionEvidence: interactionEvidenceUnmapped, satisfiabilityDemoted, expertContract } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync37(candidateDir)) {
+  void reportRunPresence(name, "implementing");
+  if (!existsSync38(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -16622,10 +16706,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync37(path47.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync38(path48.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync34(path47.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync35(path48.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -16647,13 +16731,13 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path47.join(candidateDir, "verify-evidence");
+  const evidenceDir = path48.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const hoverOpts = opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {};
   const parity = await checkHoverParity(task, candidateDir, task.configs, { ...hoverOpts, failureShotDir: evidenceDir });
   const occlusionRows = await checkSiblingOcclusion(task, candidateDir, candidateCss(candidateDir), { authority: task.configs });
   const occlusionFailures = occlusionRows.filter((o) => !o.pass);
-  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path47.resolve(callerCwd, opts.library) : callerCwd]);
+  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
   const composition = composedChecks(candidateDir, task.entry, scorePins.pins);
   const behaviors = [...await checkBehaviors(task, candidateDir, hoverOpts), ...parity, ...composition];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
@@ -16858,6 +16942,7 @@ var init_engine2 = __esm({
     init_entitlement();
     init_verify();
     init_compose2();
+    init_run_presence();
     init_src5();
     BARS3 = {
       pass: { sim: 0.95, ink: 0.95 },
@@ -16871,11 +16956,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync38, readFileSync as readFileSync35, writeFileSync as writeFileSync17 } from "node:fs";
-import path48 from "node:path";
+import { existsSync as existsSync39, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
+import path49 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path48.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path49.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -16891,7 +16976,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync35(path48.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync36(path49.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -16901,8 +16986,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path48.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync38(path48.join(setDir, "recording-set.json"))) {
+  const setDir = path49.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync39(path49.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -16923,10 +17008,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path48.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync38(meta)) return void 0;
+    const meta = path49.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync39(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync35(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync36(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -16991,7 +17076,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path48.relative(callerCwd, path48.join(bundleDir, manifest.entry));
+  const entryRel = path49.relative(callerCwd, path49.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -17015,8 +17100,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path48.resolve(callerCwd, opts.out ?? path48.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync17(outFile, lines);
+  const outFile = path49.resolve(callerCwd, opts.out ?? path49.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync18(outFile, lines);
   emitData(
     opts,
     {
@@ -17054,18 +17139,18 @@ var init_codeconnect = __esm({
 });
 
 // packages/mcp/src/server.ts
-import { createHash as createHash9 } from "node:crypto";
-import { existsSync as existsSync39, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, readdirSync as readdirSync16, writeFileSync as writeFileSync18 } from "node:fs";
+import { createHash as createHash10 } from "node:crypto";
+import { existsSync as existsSync40, mkdtempSync as mkdtempSync3, readFileSync as readFileSync37, readdirSync as readdirSync16, writeFileSync as writeFileSync19 } from "node:fs";
 import os8 from "node:os";
-import path49 from "node:path";
+import path50 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z14 } from "zod";
 function sourceHash() {
-  const dir = path49.dirname(fileURLToPath6(import.meta.url));
-  const h = createHash9("sha256");
+  const dir = path50.dirname(fileURLToPath6(import.meta.url));
+  const h = createHash10("sha256");
   for (const f of readdirSync16(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync36(path49.join(dir, f)));
+    h.update(readFileSync37(path50.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -17073,10 +17158,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path49.resolve(path49.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path49.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path49.join(path49.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync39(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path50.resolve(path50.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path50.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path50.join(path50.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync40(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z14.string().describe(d);
     optStr = (d) => z14.string().optional().describe(d);
     TOOLS = [
@@ -17107,13 +17192,13 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path49.join(mkdtempSync3(path49.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync18(tmp, single);
+              writeFileSync19(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
             } else {
               if (parts.length === 0) throw new Error("`metadataParts` must be a non-empty array of block texts");
-              writeFileSync18(tmp, JSON.stringify(parts));
+              writeFileSync19(tmp, JSON.stringify(parts));
               argvOut.push("--metadata-raw-parts-file", tmp);
             }
           }
@@ -17163,6 +17248,24 @@ var init_server = __esm({
         schema: z14.object({}),
         argv: () => ["login", "--device-wait"]
       },
+      {
+        name: "tendril_publish",
+        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim, along with which account the result says to be signed in as (they click Approve in the browser; approving includes accepting the design system's publishing terms, which is their decision to make, never yours to urge). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
+        schema: z14.object({
+          bundleDir: str("bundle directory (verified \u2014 carries component.json and verify-evidence)"),
+          portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")
+        }),
+        argv: (i) => ["publish", i["bundleDir"], "--approve-start", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
+      {
+        name: "tendril_publish_wait",
+        description: "Phase two of the browser-approved publish: waits (with live progress) for the user's Approve click on the page tendril_publish returned, then uploads the bundle, commits it, and returns the live publication URL. Call it right after relaying the approve link. A denial, a lapse, and success each come back as their own sentence \u2014 report the outcome and the URL to the user.",
+        schema: z14.object({
+          bundleDir: str("the same bundle directory tendril_publish was called with"),
+          portal: optStr("portal origin override (must match tendril_publish's)")
+        }),
+        argv: (i) => ["publish", i["bundleDir"], "--approve-wait", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
       {
         name: "tendril_record_next",
         annotations: { readOnlyHint: true },
@@ -17204,14 +17307,14 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path49.join(mkdtempSync3(path49.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync18(tmp, single);
+              writeFileSync19(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
             } else {
               const blocks = parts;
               if (blocks.length === 0) throw new Error(`\`${label}Parts\` must be a non-empty array of block texts`);
-              writeFileSync18(tmp, JSON.stringify(blocks));
+              writeFileSync19(tmp, JSON.stringify(blocks));
               argvOut.push(`--${label}-parts-file`, tmp);
             }
           };
@@ -17252,12 +17355,12 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path49.join(mkdtempSync3(path49.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
-            writeFileSync18(tmp, text);
+            writeFileSync19(tmp, text);
             return [...base, "--file", tmp, "--raw"];
           }
-          writeFileSync18(tmp, JSON.stringify(texts));
+          writeFileSync19(tmp, JSON.stringify(texts));
           return [...base, "--file", tmp, "--raw-parts"];
         }
       },
@@ -17414,13 +17517,13 @@ __export(permissions_exports, {
   runPermissions: () => runPermissions,
   writeSelection: () => writeSelection
 });
-import { existsSync as existsSync40, mkdirSync as mkdirSync11, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "node:fs";
 import os9 from "node:os";
-import path50 from "node:path";
+import path51 from "node:path";
 function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync40(file) && readFileSync37(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync37(file, "utf8"));
+  if (existsSync41(file) && readFileSync38(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync38(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -17440,8 +17543,8 @@ function mergeAllowlist(file, entries, denyEntries = []) {
   }
   if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync11(path50.dirname(file), { recursive: true });
-    writeFileSync19(file, `${JSON.stringify(settings, null, 2)}
+    mkdirSync12(path51.dirname(file), { recursive: true });
+    writeFileSync20(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
   return { added, alreadyPresent, denyAdded };
@@ -17505,7 +17608,7 @@ async function runPermissions(flags) {
   }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path50.join(os9.homedir(), ".claude", "settings.json") : path50.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path51.join(os9.homedir(), ".claude", "settings.json") : path51.join(base, ".claude", "settings.local.json");
     const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
       emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
@@ -17654,13 +17757,13 @@ __export(inspect_exports, {
   INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
   runInspect: () => runInspect
 });
-import { existsSync as existsSync41, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "node:fs";
-import path51 from "node:path";
+import { existsSync as existsSync42, readFileSync as readFileSync39, writeFileSync as writeFileSync21 } from "node:fs";
+import path52 from "node:path";
 function readVerifyReport(evidenceDir) {
-  const p = path51.join(evidenceDir, VERIFY_REPORT_FILENAME);
-  if (!existsSync41(p)) return void 0;
+  const p = path52.join(evidenceDir, VERIFY_REPORT_FILENAME);
+  if (!existsSync42(p)) return void 0;
   try {
-    return JSON.parse(readFileSync38(p, "utf8"));
+    return JSON.parse(readFileSync39(p, "utf8"));
   } catch {
     return void 0;
   }
@@ -17688,17 +17791,17 @@ async function runInspect(opts) {
     printDescription(INSPECT_DESCRIPTION);
     return;
   }
-  const bundleDir = path51.resolve(opts.bundleDir);
-  const evidenceDir = path51.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path51.join(bundleDir, "component.json");
-  if (!existsSync41(evidenceDir) || !existsSync41(manifestPath2)) {
+  const bundleDir = path52.resolve(opts.bundleDir);
+  const evidenceDir = path52.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path52.join(bundleDir, "component.json");
+  if (!existsSync42(evidenceDir) || !existsSync42(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync41(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync42(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
       code: "no-evidence",
       remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync38(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync39(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -17706,9 +17809,9 @@ async function runInspect(opts) {
       remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
     });
   }
-  const setDir = path51.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const setDir = path52.resolve(opts.set ?? manifest.provenance.recordingSet.path);
   const report = readVerifyReport(evidenceDir);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync41(path51.join(evidenceDir, `${rep}-ref.png`)) && existsSync41(path51.join(evidenceDir, `${rep}-render.png`)));
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync42(path52.join(evidenceDir, `${rep}-ref.png`)) && existsSync42(path52.join(evidenceDir, `${rep}-render.png`)));
   if (reps.length === 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "verify-evidence holds no ref/render pairs for this bundle's configs",
@@ -17719,15 +17822,15 @@ async function runInspect(opts) {
   let crops = 0;
   const sections = [];
   for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync38(path51.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync38(path51.join(evidenceDir, `${rep}-render.png`)));
+    const ref = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-render.png`)));
     const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
     const cells = [];
     for (const [i, n] of nodes.entries()) {
       const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
       try {
-        writeFileSync20(path51.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync20(path51.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
       } catch {
         continue;
       }
@@ -17744,8 +17847,8 @@ async function runInspect(opts) {
     if (reps.includes(c.rep)) continue;
     sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
   }
-  const sheet = path51.join(evidenceDir, "inspect.html");
-  writeFileSync20(
+  const sheet = path52.join(evidenceDir, "inspect.html");
+  writeFileSync21(
     sheet,
     `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
 body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
@@ -17818,8 +17921,8 @@ __export(login_exports, {
   runLogout: () => runLogout
 });
 import { spawn } from "node:child_process";
-import { existsSync as existsSync42, mkdirSync as mkdirSync12, readFileSync as readFileSync39, rmSync as rmSync6, writeFileSync as writeFileSync21 } from "node:fs";
-import path52 from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync13, readFileSync as readFileSync40, rmSync as rmSync7, writeFileSync as writeFileSync22 } from "node:fs";
+import path53 from "node:path";
 import { isCancel as isCancel3, password as password2 } from "@clack/prompts";
 async function runLogin(opts, deps) {
   const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? DEFAULT_PORTAL_ORIGIN).replace(/\/+$/, "");
@@ -17913,13 +18016,13 @@ function settleDecision(opts, origin, outcome) {
   }
 }
 function pendingLoginPath() {
-  return path52.join(path52.dirname(sessionPath()), "pending-login.json");
+  return path53.join(path53.dirname(sessionPath()), "pending-login.json");
 }
 async function deviceStartPhase(opts, origin, deps) {
   const started = await startHandshake(opts, origin, deps);
   const file = pendingLoginPath();
-  mkdirSync12(path52.dirname(file), { recursive: true });
-  writeFileSync21(file, `${JSON.stringify({ origin, ...started }, null, 2)}
+  mkdirSync13(path53.dirname(file), { recursive: true });
+  writeFileSync22(file, `${JSON.stringify({ origin, ...started }, null, 2)}
 `, { mode: 384 });
   deps.openBrowser(started.verificationUrl);
   emitData(
@@ -17944,9 +18047,9 @@ async function deviceStartPhase(opts, origin, deps) {
 async function deviceWaitPhase(opts, deps) {
   const file = pendingLoginPath();
   let pending;
-  if (existsSync42(file)) {
+  if (existsSync43(file)) {
     try {
-      const parsed = JSON.parse(readFileSync39(file, "utf8"));
+      const parsed = JSON.parse(readFileSync40(file, "utf8"));
       if (typeof parsed.origin === "string" && typeof parsed.deviceCode === "string" && typeof parsed.intervalSeconds === "number") {
         pending = parsed;
       }
@@ -17960,7 +18063,7 @@ async function deviceWaitPhase(opts, deps) {
       remediation: `Start one first: ${tendrilCommand("login --device-start")} (the tendril_login tool).`
     });
   }
-  const done = () => rmSync6(file, { force: true });
+  const done = () => rmSync7(file, { force: true });
   const total = Math.ceil(660 / Math.max(1, pending.intervalSeconds));
   let ticks = 0;
   const outcome = await waitForDecision(opts, pending.origin, deps, pending, () => {
@@ -18195,12 +18298,13 @@ var init_share = __esm({
 // packages/cli/src/commands/publish.ts
 var publish_exports = {};
 __export(publish_exports, {
+  resolveOrigin: () => resolveOrigin,
   runPublish: () => runPublish
 });
-import { existsSync as existsSync43, readFileSync as readFileSync40 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync44, readFileSync as readFileSync41, rmSync as rmSync8, writeFileSync as writeFileSync23 } from "node:fs";
+import path54 from "node:path";
 async function runPublish(opts) {
-  const bundleDir = path53.resolve(opts.bundleDir);
+  const bundleDir = path54.resolve(opts.bundleDir);
   const bundle = readBundle(opts, bundleDir);
   const report = bundle.report;
   if (typeof report["rulerExit"] !== "number" || !Number.isInteger(report["rulerExit"])) {
@@ -18245,7 +18349,7 @@ async function runPublish(opts) {
   const sheetEntry = surface.published.find((p) => p.role === "inspect-sheet");
   if (sheetEntry !== void 0) {
     const missingCrops = missingInspectCrops(
-      readFileSync40(path53.join(bundleDir, sheetEntry.path), "utf8"),
+      readFileSync41(path54.join(bundleDir, sheetEntry.path), "utf8"),
       surface.published.map((p) => p.path)
     );
     if (missingCrops.length > 0) {
@@ -18310,48 +18414,42 @@ async function runPublish(opts) {
     );
     return;
   }
-  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  const origin = resolveOrigin(opts);
   const client = opts.client ?? httpClient(opts, origin);
-  if (opts.confirmPublish === true && process.stdin.isTTY !== true) {
-    fail(opts, ExitCode.ConfirmationRequired, {
-      error: "--confirm-publish requires an interactive terminal \u2014 putting a component on the internet is a human-only decision",
-      code: "publish-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Agents: show this to your operator instead of confirming it.`
-    });
+  if (opts.approveWait === true) {
+    await approveWaitPhase(opts, client, bundleDir, { componentName, figmaFile });
   }
-  if (opts.acceptTerms === true) {
-    const accepted = await client.acceptTerms({ figmaFile });
-    if (!accepted.ok) refuse2(opts, accepted, "accept-terms-refused");
-  }
-  const opened = await client.begin({
+  void reportRunPresence(componentName, "publishing");
+  let opened = await client.begin({
     componentName,
     figmaFile,
     entry: bundle.manifest.entry,
     files: bundle.files,
-    report: bundle.reportText,
-    confirmed: opts.confirmPublish === true
+    report: bundle.reportText
   });
+  if (!opened.ok && opened.needsConfirmation !== void 0 && opts.approveWait !== true) {
+    const flow = await runApprovalFlow(opts, client, bundleDir, {
+      componentName,
+      figmaFile,
+      begin: () => client.begin({ componentName, figmaFile, entry: bundle.manifest.entry, files: bundle.files, report: bundle.reportText })
+    });
+    if (flow === void 0) return;
+    opened = flow;
+  }
   if (!opened.ok) {
-    if (opened.needsConsent !== void 0) {
-      fail(opts, ExitCode.ConfirmationRequired, {
-        error: `publishing this design system needs an acceptance of the publishing terms (version ${opened.needsConsent.termsVersion}) first`,
-        code: "publishing-terms-not-accepted",
-        remediation: `Read the terms, then run \`${tendrilCommand(`publish ${opts.bundleDir} --accept-terms --confirm-publish`)}\`. The acceptance covers this design system only.`
-      });
-    }
     if (opened.needsConfirmation !== void 0) {
       fail(opts, ExitCode.ConfirmationRequired, {
-        error: `publishing ${JSON.stringify(opened.needsConfirmation.componentName)} for the first time is a decision a person makes, not a build step`,
+        error: opened.refusal,
         code: "first-publish-unconfirmed",
-        remediation: `A human runs \`${tendrilCommand(`publish ${opts.bundleDir} --confirm-publish`)}\` in their own terminal. Later publishes of this component need no flag.`
+        remediation: "Approve it in your browser \u2014 run the publish again and open the link it prints."
       });
     }
     refuse2(opts, opened, "publish-refused");
   }
   const uploaded = [];
   for (const object of opened.value.plan.objects) {
-    const file = path53.join(bundleDir, object.relPath);
-    if (!existsSync43(file)) {
+    const file = path54.join(bundleDir, object.relPath);
+    if (!existsSync44(file)) {
       fail(opts, ExitCode.InputValidation, {
         error: `the portal expects ${object.relPath}, and it is not in ${opts.bundleDir}`,
         code: "planned-file-missing",
@@ -18361,12 +18459,15 @@ async function runPublish(opts) {
     const sent = await client.upload({
       publicationId: opened.value.publicationId,
       relPath: object.relPath,
-      bytes: new Uint8Array(readFileSync40(file))
+      bytes: new Uint8Array(readFileSync41(file))
     });
-    if (!sent.ok) refuse2(opts, sent, "upload-refused");
+    if (!sent.ok) refuse2(opts, sent, "upload-refused", true);
     uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
   }
   const committed = await client.commit({ publicationId: opened.value.publicationId });
+  if (committed.ok) {
+    await endRunPresence(componentName);
+  }
   if (!committed.ok) {
     if (committed.missing !== void 0 && committed.missing.length > 0) {
       fail(opts, ExitCode.General, {
@@ -18375,7 +18476,7 @@ async function runPublish(opts) {
         remediation: `Run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication and re-sends only what is missing.`
       });
     }
-    refuse2(opts, committed, "commit-refused");
+    refuse2(opts, committed, "commit-refused", true);
   }
   emitData(
     opts,
@@ -18403,23 +18504,23 @@ async function runPublish(opts) {
   );
 }
 function readBundle(opts, bundleDir) {
-  const manifestPath2 = path53.join(bundleDir, "component.json");
-  const reportPath = path53.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
-  if (!existsSync43(manifestPath2)) {
+  const manifestPath2 = path54.join(bundleDir, "component.json");
+  const reportPath = path54.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
+  if (!existsSync44(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
       error: `there is no component.json in ${opts.bundleDir}, so this is not a bundle`,
       code: "not-a-bundle",
       remediation: `Point publish at a directory a Tendril run produced. \`${tendrilCommand("generate --help")}\` shows how one is made.`
     });
   }
-  if (!existsSync43(reportPath)) {
+  if (!existsSync44(reportPath)) {
     fail(opts, ExitCode.InputValidation, {
       error: `this bundle has never been verified \u2014 there is no ${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME}`,
       code: "bundle-not-verified",
       remediation: `Run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` first. Verification is free and needs no account; publishing without it would put a page up with no verdict on it.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync40(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync41(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -18427,7 +18528,7 @@ function readBundle(opts, bundleDir) {
       remediation: `Re-emit the bundle \u2014 \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` rewrites component.json \u2014 then publish.`
     });
   }
-  const reportText = readFileSync40(reportPath, "utf8");
+  const reportText = readFileSync41(reportPath, "utf8");
   let report;
   try {
     report = JSON.parse(reportText);
@@ -18447,6 +18548,12 @@ function readBundle(opts, bundleDir) {
   }
   return { manifest, report, reportText, files: bundleFiles(bundleDir) };
 }
+function resolveOrigin(opts) {
+  const named = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  if (named !== "") return named;
+  if ((process.env["TENDRIL_TOKEN"] ?? "") !== "") return "";
+  return (readStoredSession()?.origin ?? "").replace(/\/+$/, "");
+}
 function httpClient(opts, origin) {
   if (origin === "") {
     fail(opts, ExitCode.InputValidation, {
@@ -18479,14 +18586,118 @@ function httpClient(opts, origin) {
   }
   return new HttpPublishClient({ origin, token: found.token });
 }
-function refuse2(opts, sent, code) {
+function refuse2(opts, sent, code, rejoins = false) {
   const detail = sent.detail === void 0 || sent.detail.length === 0 ? "" : `: ${sent.detail.join(", ")}`;
+  const retry = rejoins ? `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one` : `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again`;
   fail(opts, sent.status === 401 ? ExitCode.Auth : ExitCode.General, {
     error: `${sent.refusal}${detail}`,
     code,
-    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${(opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "")}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 a retry rejoins this same unfinished publication.` : `Fix what is named above and run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one.`
+    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${resolveOrigin(opts)}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then ${retry}.` : `Fix what is named above and ${retry}.`
+  });
+}
+function pendingApprovalPath() {
+  return path54.join(path54.dirname(sessionPath()), "pending-publish.json");
+}
+async function runApprovalFlow(opts, client, bundleDir, input) {
+  const requested = await client.requestApproval({ componentName: input.componentName, figmaFile: input.figmaFile });
+  if (!requested.ok) refuse2(opts, requested, "approval-request-refused");
+  const approval = requested.value;
+  const who = await client.whoami?.();
+  const asAccount = who?.ok === true && who.value.email !== "" ? ` signed in as ${who.value.email}` : "";
+  if (opts.approveStart === true) {
+    const pending = { ...approval, bundleDir, componentName: input.componentName, figmaFile: input.figmaFile };
+    writeFileSync23(pendingApprovalPath(), `${JSON.stringify(pending, null, 2)}
+`, { mode: 384 });
+    await endRunPresence(input.componentName);
+    emitData(
+      opts,
+      {
+        status: "approval-pending",
+        approveUrl: approval.approveUrl,
+        componentName: input.componentName,
+        ...asAccount === "" ? {} : { approveAsAccount: who?.ok === true ? who.value.email : "" },
+        expiresAt: approval.expiresAt,
+        next: `open the approve page in the browser${asAccount}, click Approve, then finish with --approve-wait`
+      },
+      () => {
+        process.stdout.write(`Approval requested for ${JSON.stringify(input.componentName)}.
+`);
+        process.stdout.write(`Approve it here${asAccount}: ${approval.approveUrl}
+`);
+        process.stdout.write(`Then finish with: ${tendrilCommand(`publish ${opts.bundleDir} --approve-wait`)}
+`);
+      }
+    );
+    return void 0;
+  }
+  process.stderr.write(`This component's FIRST publish needs your approval in the browser${asAccount}:
+  ${approval.approveUrl}
+`);
+  process.stderr.write(`Waiting for your decision (lapses at ${approval.expiresAt.slice(11, 16)} UTC)\u2026
+`);
+  const decided = await waitForApproval(opts, client, approval);
+  if (decided === "approved") return input.begin();
+  await endRunPresence(input.componentName);
+  failDecision(opts, decided);
+}
+async function approveWaitPhase(opts, client, bundleDir, subject) {
+  const file = pendingApprovalPath();
+  let pending;
+  if (existsSync44(file)) {
+    try {
+      const parsed = JSON.parse(readFileSync41(file, "utf8"));
+      if (typeof parsed.approvalId === "string" && typeof parsed.approveUrl === "string" && typeof parsed.expiresAt === "string") {
+        pending = { pollSeconds: 3, bundleDir, ...parsed };
+      }
+    } catch {
+    }
+  }
+  if (pending === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "there is no publish approval waiting to finish",
+      code: "no-pending-approval",
+      remediation: `Start one first: ${tendrilCommand(`publish ${opts.bundleDir} --approve-start`)} (the tendril_publish tool).`
+    });
+  }
+  if (pending.componentName !== void 0 && pending.componentName !== subject.componentName) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `the waiting approval is for ${JSON.stringify(pending.componentName)}, and this publish is ${JSON.stringify(subject.componentName)}`,
+      code: "pending-approval-mismatch",
+      remediation: `Finish that one first (${tendrilCommand(`publish ${pending.bundleDir} --approve-wait`)}), or start this one fresh with --approve-start \u2014 starting one replaces the waiting slot.`
+    });
+  }
+  const done = () => rmSync8(file, { force: true });
+  const decided = await waitForApproval(opts, client, pending);
+  done();
+  if (decided !== "approved") failDecision(opts, decided);
+}
+async function waitForApproval(opts, client, approval) {
+  const interval = Math.max(1, approval.pollSeconds) * 1e3;
+  const total = Math.ceil(APPROVAL_WAIT_CAP_MS / interval);
+  for (let tick = 1; tick <= total; tick += 1) {
+    const polled = await client.pollApproval({ approvalId: approval.approvalId });
+    if (!polled.ok) refuse2(opts, polled, "approval-poll-refused");
+    if (polled.value.status !== "pending") return polled.value.status;
+    emitProgress(tick, total, "waiting for the browser approval");
+    await new Promise((resolve) => setTimeout(resolve, interval));
+  }
+  return "expired";
+}
+function failDecision(opts, decided) {
+  if (decided === "denied") {
+    fail(opts, ExitCode.ConfirmationRequired, {
+      error: "the publish was DENIED in the browser \u2014 the human said no",
+      code: "publish-approval-denied",
+      remediation: "Nothing was published. If minds change, run the publish again \u2014 it makes a fresh request."
+    });
+  }
+  fail(opts, ExitCode.ConfirmationRequired, {
+    error: decided === "expired" ? "the approval request lapsed before anyone decided it" : "the approval request is gone \u2014 it lapsed and was cleaned up, or was already spent",
+    code: "publish-approval-lapsed",
+    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window. If the approve page showed nothing waiting, the browser is signed in to a DIFFERENT account than this CLI \u2014 the page lists only its own account's requests."
   });
 }
+var APPROVAL_WAIT_CAP_MS;
 var init_publish = __esm({
   "packages/cli/src/commands/publish.ts"() {
     "use strict";
@@ -18495,6 +18706,8 @@ var init_publish = __esm({
     init_invocation();
     init_output();
     init_publish_client();
+    init_run_presence();
+    APPROVAL_WAIT_CAP_MS = 31 * 6e4;
   }
 });
 
@@ -18522,17 +18735,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel4 } from "@clack/prompts";
-import { existsSync as existsSync44, readFileSync as readFileSync41 } from "node:fs";
-import path54 from "node:path";
+import { existsSync as existsSync45, readFileSync as readFileSync42 } from "node:fs";
+import path55 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path54.resolve(callerCwd, opts.out);
-  const recordedAsPath = path54.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path55.resolve(callerCwd, opts.out);
+  const recordedAsPath = path55.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync44(path54.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync45(path55.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -18541,7 +18754,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path54.basename(recordedAsPath);
+      taskName = path55.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -18575,7 +18788,7 @@ async function runGenerateRecorded(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync44(path54.join(task.set, c.rep, "get_screenshot.json")) || !existsSync44(path54.join(task.set, c.rep, "get_metadata.json")) || !existsSync44(path54.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync45(path55.join(task.set, c.rep, "get_screenshot.json")) || !existsSync45(path55.join(task.set, c.rep, "get_metadata.json")) || !existsSync45(path55.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -18645,8 +18858,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path54.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path54.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path55.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path55.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -18669,10 +18882,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path54.join(outDirAbs, taskName);
-  if (existsSync44(path54.join(bundleDir, "component.json"))) {
+  const bundleDir = path55.join(outDirAbs, taskName);
+  if (existsSync45(path55.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync41(path54.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync42(path55.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -19965,7 +20178,7 @@ function buildProgram() {
       ...local["revoke"] !== void 0 ? { revoke: local["revoke"] } : {}
     });
   });
-  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--accept-terms", "accept the current publishing terms for this design system as part of this run").option("--confirm-publish", "you, a person, saying this component may be published \u2014 required the first time, and refused without an interactive terminal").action(async (bundleDir, _o, cmd) => {
+  program.command("publish").description("Put a verified bundle and its evidence on a page, at a URL you can send to someone. Refuses a run the ruler declined.").argument("<bundleDir>", "bundle directory that has already been verified").option("--to <url>", "the portal to publish to (or set TENDRIL_PORTAL_URL)").option("--name <name>", "library label for this component (default: the bundle manifest's own name)").option("--approve-start", "first publish only: request the browser approval, print the link, persist the pending state and exit \u2014 the tendril_publish tool's phase one").option("--approve-wait", "resume a pending approval: poll until the human decides in the browser, then publish \u2014 phase two").action(async (bundleDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const local = cmd.opts();
     const { runPublish: runPublish2 } = await Promise.resolve().then(() => (init_publish(), publish_exports));
@@ -19974,8 +20187,8 @@ function buildProgram() {
       bundleDir,
       ...local["to"] !== void 0 ? { to: local["to"] } : {},
       ...local["name"] !== void 0 ? { name: local["name"] } : {},
-      ...local["acceptTerms"] !== void 0 ? { acceptTerms: local["acceptTerms"] } : {},
-      ...local["confirmPublish"] !== void 0 ? { confirmPublish: local["confirmPublish"] } : {}
+      ...local["approveStart"] !== void 0 ? { approveStart: local["approveStart"] } : {},
+      ...local["approveWait"] !== void 0 ? { approveWait: local["approveWait"] } : {}
     });
   });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--library <dir>", "workspace root holding confirmed partners generated bundles (ADR-013 composed pins; default: current directory)").option("--profile <file>", "a `tendril profile` artifact; reports whether the bundle followed your codebase conventions (never gates the verdict)").option("--hover-timeout <ms>", "hover actionability budget in ms (default 2000) \u2014 for diagnosing a slow machine; a non-default value is recorded in the report as a verdict caveat, never silently").action(async (bundleDir, _opts, cmd) => {