halfcycle 0.3.17 → 0.3.19

package/dist/bin.js

@@ -3,7 +3,7 @@
 // dist/bin.js
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { readFileSync as readFileSync9 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 
 // dist/install.js
 import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
@@ -61,11 +61,26 @@ var firedGuardSchema = z2.object({
    */
   path: z2.string().optional()
 }).strict();
+var notRunCheckSchema = z2.object({
+  /** Which check did not run, by the same reference a fired check carries. */
+  patternRef: z2.string(),
+  /**
+   * Why it could not run, in plain words — what this client did not send, or
+   * that the check's kind is not implemented yet. Never the check's own rule.
+   */
+  reason: z2.string()
+}).strict();
 var resultEnvelopeSchema = z2.object({
   guardsFired: z2.array(firedGuardSchema),
   severity: severitySchema.nullable(),
   blocking: z2.boolean(),
-  explanation: z2.string()
+  explanation: z2.string(),
+  /**
+   * The checks that could not run on this edit, each named with the reason.
+   * Absent when every check ran — so an evaluation where nothing was skipped
+   * looks exactly as it always has, and an absent list is never an empty one.
+   */
+  notRun: z2.array(notRunCheckSchema).optional()
 }).strict();
 var wireErrorSchema = z2.object({
   statusCode: z2.number(),
@@ -426,16 +441,92 @@ function loopbackVerificationUrl(verificationUrl, target) {
   return url.toString();
 }
 
-// ../events/dist/account-identity.js
+// ../events/dist/join-refusal.js
 import { z as z7 } from "zod";
-var accountIdentitySchema = z7.object({
-  accountId: z7.string().min(1),
-  email: z7.string().min(1).optional()
+var NOT_THIS_ACCOUNT_REASON = "not-this-account";
+var JOIN_REFUSAL_STATUS = 403;
+var notThisAccountRefusalSchema = z7.object({
+  statusCode: z7.literal(JOIN_REFUSAL_STATUS),
+  error: z7.string(),
+  message: z7.string(),
+  reason: z7.literal(NOT_THIS_ACCOUNT_REASON)
+}).strict();
+var joinRefusalSchema = z7.union([notThisAccountRefusalSchema, wireErrorSchema]);
+function isNotThisAccountRefusal(body) {
+  return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
+}
+
+// ../events/dist/account-identity.js
+import { z as z8 } from "zod";
+var accountIdentitySchema = z8.object({
+  accountId: z8.string().min(1),
+  email: z8.string().min(1).optional()
 }).strict();
 function safeParseAccountIdentity(payload) {
   return accountIdentitySchema.safeParse(payload);
 }
 
+// ../events/dist/phase-identity.js
+var PHASE_SEGMENT_PREFIX = "phase-";
+function isValidPhaseIdentity(identity) {
+  if (typeof identity === "number")
+    return Number.isInteger(identity) && identity >= 0;
+  if (typeof identity !== "string")
+    return false;
+  if (identity === "")
+    return false;
+  if (identity.includes("/"))
+    return false;
+  if (identity.includes("\\"))
+    return false;
+  if (identity.includes("\0"))
+    return false;
+  if (identity.startsWith("."))
+    return false;
+  return true;
+}
+var InvalidPhaseIdentityError = class extends Error {
+  /** The value that was refused, exactly as supplied. */
+  identity;
+  constructor(identity, allowedLocation) {
+    const subject = allowedLocation === void 0 ? "a file" : "a Build Record";
+    const where = allowedLocation === void 0 ? "" : `
+  Records are written only into ${allowedLocation.replace(/\\/g, "/")}/. Nothing was written.`;
+    super(`that phase identity cannot name ${subject}.
+  identity: ${describeIdentity(identity)}` + where);
+    this.name = "InvalidPhaseIdentityError";
+    this.identity = identity;
+  }
+};
+function assertValidPhaseIdentity(identity, allowedLocation) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity, allowedLocation);
+  }
+}
+function renderPhaseSegment(identity) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity);
+  }
+  return `${PHASE_SEGMENT_PREFIX}${identity}`;
+}
+function describeIdentity(identity) {
+  if (identity === "")
+    return "(empty)";
+  if (typeof identity === "string")
+    return identity;
+  if (identity === null)
+    return "null";
+  if (identity === void 0)
+    return "none supplied";
+  if (typeof identity === "number" || typeof identity === "boolean")
+    return String(identity);
+  if (Array.isArray(identity))
+    return "(a list)";
+  if (typeof identity === "object")
+    return "(an object)";
+  return `(a ${typeof identity})`;
+}
+
 // dist/engagement-credential.js
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -521,6 +612,18 @@ function engagementStateDir(engagementId, home) {
 function engagementEnvPath(engagementId, home) {
   return join2(engagementStateDir(engagementId, home), ENV_FILENAME);
 }
+var NOT_THIS_ACCOUNT_MARKER_FILENAME = "not-this-account";
+function notThisAccountMarkerPath(engagementId, home) {
+  return join2(engagementStateDir(engagementId, home), NOT_THIS_ACCOUNT_MARKER_FILENAME);
+}
+function writeNotThisAccountMarker(engagementId, home) {
+  const dir = engagementStateDir(engagementId, home);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const path = notThisAccountMarkerPath(engagementId, home);
+  writeFileSync2(path, `${(/* @__PURE__ */ new Date()).toISOString()}
+`, { mode: 384 });
+  applyOwnerOnly(path, dir);
+}
 var GUARD_ENV_KEYS = [
   "GUARD_SERVICE_URL",
   "GUARD_SERVICE_TOKEN",
@@ -535,6 +638,7 @@ var ENGAGEMENT_ENV_KEYS = [
   ...GUARD_ENV_KEYS,
   "CONTROL_TELEMETRY_URL"
 ];
+var PHASE_STAMP_ENV_KEY = "HALFCYCLE_PHASE";
 var ENV_HEADER = "# Halfcycle per-engagement credential \u2014 machine level, owner-only, never in a repository.";
 function shq(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -562,33 +666,50 @@ function parseEnvText(raw) {
   return out;
 }
 function reconcileEnvText(existing, values, keys = ENGAGEMENT_ENV_KEYS) {
-  const desired = new Map(keys.map((k) => [k, values[k] ?? ""]));
+  const desired = new Map(keys.map((k) => {
+    const value = values[k];
+    return [k, value === void 0 ? "" : value];
+  }));
   const line = (k) => `${k}=${shq(desired.get(k) ?? "")}`;
+  const written = keys.filter((k) => desired.get(k) !== null);
   if (existing === null) {
+    if (written.length === 0)
+      return "";
     return `${ENV_HEADER}
-` + keys.map(line).join("\n") + "\n";
+` + written.map(line).join("\n") + "\n";
   }
   const seen = /* @__PURE__ */ new Set();
-  const out = existing.split("\n").map((existingLine) => {
+  const out = [];
+  for (const existingLine of existing.split("\n")) {
     const eq = existingLine.indexOf("=");
-    if (eq === -1)
-      return existingLine;
+    if (eq === -1) {
+      out.push(existingLine);
+      continue;
+    }
     const lhs = existingLine.slice(0, eq);
     const exported = /^\s*export\s+/.exec(lhs);
     const prefix = exported === null ? "" : exported[0];
     const key = lhs.slice(prefix.length).trim();
-    if (desired.has(key)) {
-      seen.add(key);
-      return `${prefix}${line(key)}`;
+    if (!desired.has(key)) {
+      out.push(existingLine);
+      continue;
     }
-    return existingLine;
-  });
-  const missing = keys.filter((k) => !seen.has(k));
+    seen.add(key);
+    if (desired.get(key) === null)
+      continue;
+    out.push(`${prefix}${line(key)}`);
+  }
+  const missing = written.filter((k) => !seen.has(k));
   if (missing.length > 0) {
+    const header = existing.includes(ENV_HEADER) ? "" : `${ENV_HEADER}
+`;
+    const block = header + missing.map(line).join("\n");
     const trailingBlank = out.length > 0 && out[out.length - 1] === "";
-    const prefix = trailingBlank ? "" : existing.endsWith("\n") ? "" : "\n";
-    out.push(`${prefix}${ENV_HEADER}
-` + missing.map(line).join("\n"));
+    if (trailingBlank)
+      out.splice(out.length - 1, 0, block);
+    else
+      out.push(`
+${block}`);
   }
   let result = out.join("\n");
   if (existing.endsWith("\n") && !result.endsWith("\n"))
@@ -602,17 +723,19 @@ function readEngagementEnv(engagementId, home) {
     return null;
   }
 }
-function writeEngagementEnv(engagementId, values, home) {
+function writeEngagementEnv(engagementId, values, home, keys = ENGAGEMENT_ENV_KEYS) {
   const path = engagementEnvPath(engagementId, home);
   const dir = engagementStateDir(engagementId, home);
-  mkdirSync2(dir, { recursive: true, mode: 448 });
   let existing;
   try {
     existing = readFileSync2(path, "utf-8");
   } catch {
     existing = null;
   }
-  const reconciled = reconcileEnvText(existing, values);
+  const reconciled = reconcileEnvText(existing, values, keys);
+  if (existing === null && reconciled === "")
+    return "skipped";
+  mkdirSync2(dir, { recursive: true, mode: 448 });
   const outcome = existing === reconciled ? "skipped" : "written";
   if (outcome === "written") {
     writeFileSync2(path, reconciled, { mode: 384 });
@@ -642,14 +765,15 @@ function engagementResolutionShell() {
 # desktop session's PATH, so the id is cut out with sed \u2014 after flattening the
 # file, because sed is line-oriented and the pin's line breaks are not a contract.
 #
-# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT and HALFCYCLE_ENV_PROBLEM in
-# the CALLER's shell and returns a status. Call it as \`if halfcycle_env_file \u2026\`,
-# never as \`$(halfcycle_env_file \u2026)\` \u2014 a command substitution is a subshell and
-# would discard everything it set.
+# Sets HALFCYCLE_ENV_FILE, HALFCYCLE_ENV_ENGAGEMENT, HALFCYCLE_ENV_PROBLEM and
+# HALFCYCLE_ENV_NOT_THIS_ACCOUNT in the CALLER's shell and returns a status. Call
+# it as \`if halfcycle_env_file \u2026\`, never as \`$(halfcycle_env_file \u2026)\` \u2014 a
+# command substitution is a subshell and would discard everything it set.
 halfcycle_env_file() {
   HALFCYCLE_ENV_FILE=""
   HALFCYCLE_ENV_ENGAGEMENT=""
   HALFCYCLE_ENV_PROBLEM=""
+  HALFCYCLE_ENV_NOT_THIS_ACCOUNT=""
   hc_pin="$1/.halfcycle/bundle.json"
   if [ ! -f "$hc_pin" ]; then
     HALFCYCLE_ENV_PROBLEM="no-pin"
@@ -665,6 +789,9 @@ halfcycle_env_file() {
     HALFCYCLE_ENV_PROBLEM="no-home"
     return 1
   fi
+  if [ -f "$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${NOT_THIS_ACCOUNT_MARKER_FILENAME}" ]; then
+    HALFCYCLE_ENV_NOT_THIS_ACCOUNT=1
+  fi
   hc_env="$HOME/.halfcycle/${ENGAGEMENTS_DIR}/$hc_id/${ENV_FILENAME}"
   if [ ! -f "$hc_env" ]; then
     HALFCYCLE_ENV_PROBLEM="no-credential"
@@ -1036,6 +1163,13 @@ if halfcycle_env_file "$PROJECT_DIR"; then
   set +a
 fi
 
+# Pass along WHY this machine has no credential, as a plain variable \u2014 the
+# marker check above already answered it, and this is the one bit of that
+# answer the runner binary needs to say the right thing on every edit.
+if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+  export HALFCYCLE_NOT_THIS_ACCOUNT=1
+fi
+
 exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 `;
 }
@@ -1051,13 +1185,20 @@ MARKER_FILE="\${TMPDIR%/}/halfcycle-session-\${HASH}.ref"
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
 
 # ---------------------------------------------------------------------------
-# STANDING GUARD-COVERAGE STATEMENT (T-27).
+# STANDING GUARD-COVERAGE STATEMENT (T-27; two arms since T-02b).
 #
 # A repository with no credential on this machine is UNGUARDED: the PostToolUse
 # hook will find nothing to evaluate with, and it says so once per edit, after
 # the edit. This says it once, up front, before anything is written \u2014 which is
 # the one thing a session-start hook can do that nothing else can.
 #
+# TWO REASONS TO HAVE NO CREDENTIAL, TWO DIFFERENT THINGS TO SAY (T-02b,
+# solo-project-ownership \u2014 outcome B). "You have not signed in here yet" is
+# fixed by re-running the installer; "this is not your project" is permanent,
+# and the same remedy would send the reader in a circle forever. The two are
+# told apart by HALFCYCLE_ENV_NOT_THIS_ACCOUNT, set by \`halfcycle_env_file\`
+# below from a machine-level marker beside the credential store.
+#
 # Everything below runs in a SUBSHELL: it sources a credential store, and a
 # session-start hook must not leak an engagement's variables into whatever the
 # editor runs next. Any failure inside it is swallowed; this script's exit
@@ -1071,18 +1212,33 @@ ${engagementResolutionShell()}
     . "$HALFCYCLE_ENV_FILE"
     set +a
   fi
-  hc_missing=""
-  for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
-    eval "hc_value=\\\${$hc_key:-}"
-    if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
-  done
-  if [ -n "$hc_missing" ]; then
-    echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
-    echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
-    echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
-    echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
-    echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
-    echo "[halfcycle] and needs nothing configured first."
+  if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+    # OUTCOME B (T-02b, solo-project-ownership). This is not the missing-keys
+    # case below wearing different words: there is nothing to fix, and the loop
+    # that follows is skipped entirely rather than run and then overridden \u2014 a
+    # repository whose credential is absent for THIS reason must never be told
+    # to re-run the installer, which can never obtain one for it.
+    echo "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked."
+    echo "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is"
+    echo "[halfcycle] evaluated, and nothing you do is reported as having passed."
+    echo "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming."
+    echo "[halfcycle] Ask the project's owner for view access."
+    echo "[halfcycle] If this account is wrong, sign in as the one that owns the project and run"
+    echo "[halfcycle] \\"npx halfcycle\\" again."
+  else
+    hc_missing=""
+    for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
+      eval "hc_value=\\\${$hc_key:-}"
+      if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
+    done
+    if [ -n "$hc_missing" ]; then
+      echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
+      echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
+      echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
+      echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
+      echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
+      echo "[halfcycle] and needs nothing configured first."
+    fi
   fi
 ) 2>/dev/null || true
 exit 0
@@ -1242,8 +1398,20 @@ if [ -z "$TOKEN" ]; then
       no-home)
         echo "halfcycle: HOME is not set, so the credential store cannot be located." >&2 ;;
       *)
-        echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
-        echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2 ;;
+        # OUTCOME B (T-02b, solo-project-ownership) is a \`no-credential\` PROBLEM
+        # with a REASON attached, checked here rather than as a fifth case value
+        # \u2014 see \`engagementResolutionShell\`'s own docblock for why. Re-running
+        # this installer can never obtain a credential for this reason, so it is
+        # the one sentence in this file that must not say to.
+        if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
+          echo "halfcycle: this project belongs to another Halfcycle account, so this machine has no" >&2
+          echo "halfcycle: credential for it and the Halfcycle tools are not available here. Nothing is" >&2
+          echo "halfcycle: broken \u2014 ask the project's owner for view access, or sign in as the account" >&2
+          echo "halfcycle: that owns it and run \\"npx halfcycle\\" again." >&2
+        else
+          echo "halfcycle: this machine holds no credential for engagement $HALFCYCLE_ENV_ENGAGEMENT." >&2
+          echo "halfcycle: run \\"npx halfcycle\\" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to $HOME/.halfcycle, outside this repository." >&2
+        fi ;;
     esac
     exit 1
   fi
@@ -2048,11 +2216,13 @@ var CreateEngagementRefused = class extends Error {
   status;
   serverMessage;
   errorCode;
-  constructor(status, serverMessage, errorCode, message) {
+  reason;
+  constructor(status, serverMessage, errorCode, reason, message) {
     super(message);
     this.status = status;
     this.serverMessage = serverMessage;
     this.errorCode = errorCode;
+    this.reason = reason;
     this.name = "CreateEngagementRefused";
   }
   /**
@@ -2097,7 +2267,8 @@ function planeRefusal(detail) {
     return void 0;
   return {
     message: candidate.message,
-    error: typeof candidate.error === "string" ? candidate.error : void 0
+    error: typeof candidate.error === "string" ? candidate.error : void 0,
+    reason: typeof candidate.reason === "string" ? candidate.reason : void 0
   };
 }
 var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
@@ -2138,7 +2309,7 @@ async function requestEngagementValues(url, requestBody, credential, shape) {
     const detail = await res.text().catch(() => "");
     const refusal = res.status === 404 ? void 0 : planeRefusal(detail);
     if (refusal) {
-      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
+      throw new CreateEngagementRefused(res.status, refusal.message, refusal.error, refusal.reason, `[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${refusal.message} ${shape.nothingHappened}.`);
     }
     const wrongOrigin = res.status === 404 ? `That address answered, but it does not serve ${shape.route} \u2014 so it is not the Halfcycle service. ` : "";
     throw new Error(`[bundle install] ${shape.action} failed: ${url} returned ${res.status}. ${wrongOrigin}${detail ? `Response: ${detail.slice(0, 300)}. ` : ""}${shape.nothingHappened}. ` + CONTROL_ORIGIN_HINT);
@@ -2619,6 +2790,9 @@ function armScript(credential, act, label, plainLabel, home) {
     }
   }
 }
+function identitySwitchRemedy(home) {
+  return `To act as a different account: run this again and answer "s" when asked, set HALFCYCLE_TOKEN for that account, or remove ${accountStorePath(home)} to be asked for a sign-in next time.`;
+}
 async function confirmActingIdentity(serviceUrl, credential, act, deps = {}) {
   const write = deps.write ?? ((text) => process.stdout.write(text));
   const colour = deps.colour ?? decideColour({ isTTY: process.stdout.isTTY === true, env: deps.env ?? process.env });
@@ -2684,6 +2858,9 @@ function deriveProjectName(targetRepoRoot) {
 }
 
 // dist/own-engagement.js
+function isOutcomeBRefusal(result) {
+  return "outcome" in result && result.outcome === "not-this-account";
+}
 async function createOwnedEngagement(serviceUrl, targetRepo, deps = {}) {
   let credential = await confirmActingIdentity(serviceUrl, await obtainCredential(serviceUrl, deps), { kind: "create", targetRepo }, deps);
   for (; ; ) {
@@ -2718,6 +2895,13 @@ async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps =
       if (!(err instanceof CreateEngagementRefused))
         throw err;
       if (err.status === 403) {
+        if (isNotThisAccountRefusal({ reason: err.reason })) {
+          return {
+            outcome: "not-this-account",
+            message: err.serverMessage,
+            actingAccountId: credential.accountId
+          };
+        }
         throw new SignInRefused(`join-${err.status}`, `${err.serverMessage} ${JOIN_REFUSED_LOCAL_REMEDY}`);
       }
       if (err.status !== 401) {
@@ -2816,8 +3000,203 @@ function projectSeedGuard(fired, includeExplanation) {
 // dist/build-record/sources.js
 import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
 import { createHash } from "node:crypto";
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
+
+// dist/build-record/close-record.js
 import { execFileSync as execFileSync2 } from "node:child_process";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname3, join as join6 } from "node:path";
+var CLOSE_RECORD_FORMAT = "halfcycle-phase-close/v1";
+var BUILD_RECORD_ZONE_B_DIR = join6(ZONE_B_DIR, "build-record");
+var InvalidCloseRecordError = class extends Error {
+  constructor(path, detail) {
+    super(`[build-record] the phase close record at ${path} cannot be read \u2014 ${detail}`);
+    this.name = "InvalidCloseRecordError";
+  }
+};
+function closeRecordPath(repoRoot, phase) {
+  assertValidPhaseIdentity(phase, BUILD_RECORD_ZONE_B_DIR);
+  return join6(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phase)}.close.json`);
+}
+function resolveCloseAtHead(repoRoot) {
+  try {
+    const closeCommit = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const closedDate = execFileSync2("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (closeCommit === "" || closedDate === "")
+      return null;
+    return { closeCommit, closedDate };
+  } catch {
+    return null;
+  }
+}
+function writeCloseRecord(repoRoot, phase) {
+  let path;
+  try {
+    path = closeRecordPath(repoRoot, phase);
+  } catch (err) {
+    return { recorded: false, path: null, reason: err instanceof Error ? err.message : String(err) };
+  }
+  const at = resolveCloseAtHead(repoRoot);
+  if (at === null) {
+    return {
+      recorded: false,
+      path,
+      reason: `the commit could not be read from ${repoRoot} \u2014 there is no git available, no repository there, or no commit in it yet`
+    };
+  }
+  const record2 = {
+    format: CLOSE_RECORD_FORMAT,
+    phase,
+    closeCommit: at.closeCommit,
+    closedDate: at.closedDate
+  };
+  try {
+    mkdirSync5(dirname3(path), { recursive: true });
+    writeFileSync5(path, JSON.stringify(record2, null, 2) + "\n", "utf-8");
+  } catch (err) {
+    return { recorded: false, path, reason: err instanceof Error ? err.message : String(err) };
+  }
+  return { recorded: true, path, closeCommit: at.closeCommit, closedDate: at.closedDate };
+}
+function parseCloseRecord(path, parsed) {
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new InvalidCloseRecordError(path, "it does not hold a record");
+  }
+  const record2 = parsed;
+  if (record2.format !== CLOSE_RECORD_FORMAT) {
+    throw new InvalidCloseRecordError(path, `it is not a ${CLOSE_RECORD_FORMAT} record (it says ${JSON.stringify(record2.format)})`);
+  }
+  const commit = record2.closeCommit;
+  const date = record2.closedDate;
+  const missing = [];
+  if (typeof commit !== "string" || commit.trim() === "")
+    missing.push("closeCommit");
+  if (typeof date !== "string" || date.trim() === "")
+    missing.push("closedDate");
+  if (missing.length > 0) {
+    throw new InvalidCloseRecordError(path, `${missing.join(" and ")} ${missing.length === 1 ? "is" : "are"} not recorded in it. A close records the commit and its date together or records neither, so a file carrying one of them was edited by hand.`);
+  }
+  if (typeof record2.phase !== "string" && typeof record2.phase !== "number") {
+    throw new InvalidCloseRecordError(path, "it does not say which phase closed");
+  }
+  return {
+    format: CLOSE_RECORD_FORMAT,
+    phase: record2.phase,
+    closeCommit: commit,
+    closedDate: date
+  };
+}
+
+// dist/build-record/write.js
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename2, join as join7, resolve as resolve2, relative as relative2, isAbsolute } from "node:path";
+
+// dist/build-record/template.js
+function severityLabel(seed) {
+  return `\`${seed.patternRef}\` (severity \`${seed.severity}\`)`;
+}
+var NOT_RECORDED = "not recorded";
+function renderCloseLine(record2) {
+  const status = `**Status:** ${record2.status.toUpperCase()}`;
+  const closed = `**Closed:** ${record2.closedDate ?? NOT_RECORDED}`;
+  const commit = record2.closeCommit === null ? `**Close commit:** ${NOT_RECORDED}` : `**Close commit:** \`${record2.closeCommit}\``;
+  return `${status} \xB7 ${closed} \xB7 ${commit}`;
+}
+function renderCloseProvenance(record2) {
+  return record2.closeCommit === null && record2.closedDate === null ? "*The close date and the commit were not recorded when this phase closed, so this record does not name them. Nothing has been substituted for them.*" : "*The close date and the commit are the client's own assertion about their own repository, written down when the phase was closed. Halfcycle did not observe them and does not check them.*";
+}
+function renderDoneWhenRows(record2) {
+  const rows = [];
+  for (const [key, dw] of Object.entries(record2.acceptance.doneWhen)) {
+    const mark = dw.result === "pass" ? "\u2705" : dw.result === "dropped" ? "\u2014" : dw.result;
+    rows.push(`| ${key} | ${mark} | ${dw.detail} |`);
+  }
+  return rows.join("\n");
+}
+function renderBuildRecordMarkdown(record2) {
+  const { phase } = record2;
+  const companion = `${renderPhaseSegment(phase.id)}.json`;
+  const guardsList = record2.seedGuards.map(severityLabel).join(", ");
+  const lines = [
+    // Fixed prose (vault-canonical template) + projected title slots.
+    `# Build Record \u2014 Phase ${phase.id}: ${phase.name}`,
+    "",
+    `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
+    "",
+    "> This Build Record was assembled automatically at phase close by the method bundle (`packages/bundle`). Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
+    "",
+    `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
+    `**Phase:** ${phase.id} \u2014 ${phase.name}`,
+    renderCloseLine(record2),
+    `**Companion:** [\`${companion}\`](${companion})`,
+    "",
+    renderCloseProvenance(record2),
+    "",
+    "## What this phase proved",
+    "",
+    `${record2.thesis} **Thesis held: ${record2.thesisHeld ? "yes" : "no"}.**`,
+    "",
+    "## Delivered",
+    "",
+    `- **Packages:** ${record2.delivered.packages.join(", ")}`,
+    `- **Services:** ${record2.delivered.services.join(", ")}`,
+    `- **Tools:** ${record2.delivered.tools.join(", ")}`,
+    `- **Dogfood:** ${record2.delivered.dogfood}`,
+    "",
+    guardsList ? `Guards evaluated (INV-007-safe results): ${guardsList}. *(Guard \`channel\`/\`version\` are guard-asset metadata, excluded from the v1 record \u2014 INV-007/INV-001.)*` : "No guards fired during this phase.",
+    "",
+    `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
+    "",
+    `**Verdict:** ${record2.acceptance.verdict} \xB7 **Findings:** ${record2.acceptance.findings}`,
+    "",
+    "| Done-when | Result | Evidence |",
+    "|---|---|---|",
+    renderDoneWhenRows(record2),
+    ""
+  ];
+  if (record2.acceptance.inv002ProdBypassProbe) {
+    lines.push(`**INV-002 production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
+  }
+  lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
+  return lines.join("\n");
+}
+
+// dist/build-record/write.js
+var BUILD_RECORD_DIR = join7("docs", "build-records");
+function serialiseRecordJson(record2) {
+  return JSON.stringify(record2, null, 2) + "\n";
+}
+function assertInsideOutDir(outDir, candidate, identity) {
+  const rel = relative2(outDir, resolve2(candidate));
+  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute(rel) && rel === basename2(rel);
+  if (!isPlainFilename) {
+    throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
+  }
+}
+function writeBuildRecord(repoRoot, record2) {
+  const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
+  const identity = record2.phase.id;
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
+  }
+  const segment = renderPhaseSegment(identity);
+  const jsonPath = join7(outDir, `${segment}.json`);
+  const mdPath = join7(outDir, `${segment}.md`);
+  assertInsideOutDir(outDir, jsonPath, identity);
+  assertInsideOutDir(outDir, mdPath, identity);
+  mkdirSync6(outDir, { recursive: true });
+  writeFileSync6(jsonPath, serialiseRecordJson(record2), "utf-8");
+  writeFileSync6(mdPath, renderBuildRecordMarkdown(record2), "utf-8");
+  return { jsonPath, mdPath };
+}
+
+// dist/build-record/sources.js
 var MissingSourceError = class extends Error {
   constructor(sourceName, detail) {
     super(`[build-record] missing required source: ${sourceName} \u2014 ${detail}`);
@@ -2873,7 +3252,7 @@ function syntheticRunId(record2) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 function readGuardEvalLog(logDir, phaseId) {
-  const logPath = join6(logDir, `phase-${phaseId}.jsonl`);
+  const logPath = join8(logDir, `${renderPhaseSegment(phaseId)}.jsonl`);
   if (!existsSync4(logPath)) {
     throw new MissingSourceError("guard-eval log", `no runner guard-eval log at ${logPath} for phase ${phaseId}`);
   }
@@ -2889,7 +3268,7 @@ function readGuardEvalLog(logDir, phaseId) {
   return runs;
 }
 function readOrchestrationState(phasesDir, phaseId) {
-  const statePath = join6(phasesDir, `phase-${phaseId}-orchestration-state.json`);
+  const statePath = join8(phasesDir, `${renderPhaseSegment(phaseId)}-orchestration-state.json`);
   if (!existsSync4(statePath)) {
     throw new MissingSourceError("orchestration state", `no orchestration-state file at ${statePath} for phase ${phaseId}`);
   }
@@ -2906,22 +3285,21 @@ function readOrchestrationState(phasesDir, phaseId) {
   }
   return { tasks };
 }
-function readGitClose(repoRoot) {
-  let closeCommit;
-  let closedDate;
+function readPhaseClose(repoRoot, phaseId) {
+  const path = closeRecordPath(repoRoot, phaseId);
+  if (!existsSync4(path))
+    return { closeCommit: null, closedDate: null };
+  let parsed;
   try {
-    closeCommit = execFileSync2("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
-      encoding: "utf-8"
-    }).trim();
-    closedDate = execFileSync2("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], { encoding: "utf-8" }).trim();
+    parsed = JSON.parse(readFileSync6(path, "utf-8"));
   } catch (err) {
-    throw new MissingSourceError("git HEAD", `cannot resolve close commit/date in ${repoRoot}: ${err instanceof Error ? err.message : String(err)}`);
+    throw new InvalidCloseRecordError(path, `it is not readable JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const record2 = parseCloseRecord(path, parsed);
+  if (renderPhaseSegment(record2.phase) !== renderPhaseSegment(phaseId)) {
+    throw new InvalidCloseRecordError(path, `it records the close of ${String(record2.phase)}, not of ${String(phaseId)}`);
   }
-  if (!closeCommit)
-    throw new MissingSourceError("git HEAD", `empty commit sha in ${repoRoot}`);
-  if (!closedDate)
-    throw new MissingSourceError("git HEAD", `empty commit date in ${repoRoot}`);
-  return { closeCommit, closedDate };
+  return { closeCommit: record2.closeCommit, closedDate: record2.closedDate };
 }
 function validateNarrated(narrated) {
   const req = (v, name) => {
@@ -2932,6 +3310,7 @@ function validateNarrated(narrated) {
   req(narrated.engagement, "engagement");
   req(narrated.engagementType, "engagementType");
   req(narrated.phase?.name, "phase.name");
+  assertValidPhaseIdentity(narrated.phase?.id, BUILD_RECORD_DIR);
   req(narrated.status, "status");
   req(narrated.thesis, "thesis");
   req(narrated.delivered, "delivered");
@@ -2947,7 +3326,7 @@ function validateNarrated(narrated) {
 function loadSources(opts) {
   const orchestration = readOrchestrationState(opts.phasesDir, opts.phaseId);
   const guardEvalRuns = readGuardEvalLog(opts.guardEvalLogDir, opts.phaseId);
-  const git2 = readGitClose(opts.repoRoot);
+  const close = readPhaseClose(opts.repoRoot, opts.phaseId);
   const narrated = validateNarrated(opts.narrated);
   if (!Array.isArray(opts.touchedInvariants)) {
     throw new MissingSourceError("feature-spec Touches", "touchedInvariants must be an array");
@@ -2955,7 +3334,7 @@ function loadSources(opts) {
   return {
     orchestration,
     narrated,
-    git: git2,
+    close,
     guardEvalRuns,
     touchedInvariants: opts.touchedInvariants
   };
@@ -2985,15 +3364,15 @@ function deriveInvariantsExercised(touched) {
   return [...new Set(touched)].sort((a, b) => a.localeCompare(b));
 }
 function assembleBuildRecord(sources) {
-  const { narrated, git: git2, orchestration } = sources;
+  const { narrated, close, orchestration } = sources;
   return {
     format: BUILD_RECORD_FORMAT,
     engagement: narrated.engagement,
     engagementType: narrated.engagementType,
     phase: { id: narrated.phase.id, name: narrated.phase.name },
     status: narrated.status,
-    closedDate: git2.closedDate,
-    closeCommit: git2.closeCommit,
+    closedDate: close.closedDate,
+    closeCommit: close.closeCommit,
     thesis: narrated.thesis,
     thesisHeld: deriveThesisHeld(narrated.acceptance),
     delivered: narrated.delivered,
@@ -3007,85 +3386,6 @@ function assembleBuildRecord(sources) {
   };
 }
 
-// dist/build-record/template.js
-function severityLabel(seed) {
-  return `\`${seed.patternRef}\` (severity \`${seed.severity}\`)`;
-}
-function renderDoneWhenRows(record2) {
-  const rows = [];
-  for (const [key, dw] of Object.entries(record2.acceptance.doneWhen)) {
-    const mark = dw.result === "pass" ? "\u2705" : dw.result === "dropped" ? "\u2014" : dw.result;
-    rows.push(`| ${key} | ${mark} | ${dw.detail} |`);
-  }
-  return rows.join("\n");
-}
-function renderBuildRecordMarkdown(record2) {
-  const { phase } = record2;
-  const guardsList = record2.seedGuards.map(severityLabel).join(", ");
-  const lines = [
-    // Fixed prose (vault-canonical template) + projected title slots.
-    `# Build Record \u2014 Phase ${phase.id}: ${phase.name}`,
-    "",
-    `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
-    "",
-    "> This Build Record was assembled automatically at phase close by the method bundle (`packages/bundle`). Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
-    "",
-    `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
-    `**Phase:** ${phase.id} \u2014 ${phase.name}`,
-    `**Status:** ${record2.status.toUpperCase()} \xB7 **Closed:** ${record2.closedDate} \xB7 **Close commit:** \`${record2.closeCommit}\``,
-    `**Companion:** [\`phase-${phase.id}.json\`](phase-${phase.id}.json)`,
-    "",
-    "## What this phase proved",
-    "",
-    `${record2.thesis} **Thesis held: ${record2.thesisHeld ? "yes" : "no"}.**`,
-    "",
-    "## Delivered",
-    "",
-    `- **Packages:** ${record2.delivered.packages.join(", ")}`,
-    `- **Services:** ${record2.delivered.services.join(", ")}`,
-    `- **Tools:** ${record2.delivered.tools.join(", ")}`,
-    `- **Dogfood:** ${record2.delivered.dogfood}`,
-    "",
-    guardsList ? `Guards evaluated (INV-007-safe results): ${guardsList}. *(Guard \`channel\`/\`version\` are guard-asset metadata, excluded from the v1 record \u2014 INV-007/INV-001.)*` : "No guards fired during this phase.",
-    "",
-    `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
-    "",
-    `**Verdict:** ${record2.acceptance.verdict} \xB7 **Findings:** ${record2.acceptance.findings}`,
-    "",
-    "| Done-when | Result | Evidence |",
-    "|---|---|---|",
-    renderDoneWhenRows(record2),
-    ""
-  ];
-  if (record2.acceptance.inv002ProdBypassProbe) {
-    lines.push(`**INV-002 production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
-  }
-  lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
-  return lines.join("\n");
-}
-
-// dist/build-record/write.js
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join7, resolve as resolve2, relative as relative2, isAbsolute } from "node:path";
-var BUILD_RECORD_DIR = join7("docs", "build-records");
-function serialiseRecordJson(record2) {
-  return JSON.stringify(record2, null, 2) + "\n";
-}
-function writeBuildRecord(repoRoot, record2) {
-  const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
-  const expected = resolve2(repoRoot, BUILD_RECORD_DIR);
-  const rel = relative2(expected, outDir);
-  if (rel !== "" || isAbsolute(rel)) {
-    throw new Error(`[build-record] refusing to write outside ${BUILD_RECORD_DIR}`);
-  }
-  mkdirSync5(outDir, { recursive: true });
-  const jsonPath = join7(outDir, `phase-${record2.phase.id}.json`);
-  const mdPath = join7(outDir, `phase-${record2.phase.id}.md`);
-  writeFileSync5(jsonPath, serialiseRecordJson(record2), "utf-8");
-  writeFileSync5(mdPath, renderBuildRecordMarkdown(record2), "utf-8");
-  return { jsonPath, mdPath };
-}
-
 // dist/build-record/index.js
 function assemblePhaseBuildRecord(opts) {
   const sources = loadSources({
@@ -3102,7 +3402,7 @@ function assemblePhaseBuildRecord(opts) {
 
 // dist/open-phase.js
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var OpenPhaseRefused = class extends Error {
   status;
   finding;
@@ -3121,7 +3421,7 @@ var OPEN_PHASE_ENV_KEYS = [
 function readRepoCredential(repoRoot, env = process.env, home) {
   const pinned = readPinnedEngagementId(repoRoot);
   const fromStore = pinned === null ? null : readEngagementEnv(pinned, home);
-  const looked = pinned === null ? `${join8(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
+  const looked = pinned === null ? `${join9(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
   const values = {};
   for (const key of OPEN_PHASE_ENV_KEYS) {
     const value = (env[key] ?? fromStore?.[key] ?? "").trim();
@@ -3138,18 +3438,33 @@ function readRepoCredential(repoRoot, env = process.env, home) {
 }
 function readPinnedEngagementId(repoRoot) {
   try {
-    const pin = JSON.parse(readFileSync7(join8(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
+    const pin = JSON.parse(readFileSync7(join9(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
     const id = pin[PIN_ENGAGEMENT_ID_FIELD];
     return typeof id === "string" && id !== "" ? id : null;
   } catch {
     return null;
   }
 }
-async function openPhase(credential, phase, entry) {
+function writePhaseStamp(engagementId, phase, home) {
+  const path = engagementEnvPath(engagementId, home);
+  if (phase !== null && !isValidPhaseIdentity(phase)) {
+    return { path, reason: new InvalidPhaseIdentityError(phase).message };
+  }
+  try {
+    writeEngagementEnv(engagementId, { [PHASE_STAMP_ENV_KEY]: phase }, home, [PHASE_STAMP_ENV_KEY]);
+    return null;
+  } catch (err) {
+    return { path, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function openPhase(credential, phase, entry, home) {
   const parsed = phaseEntryDecisionSchema.safeParse(entry);
   if (!parsed.success) {
     throw new Error(`[halfcycle] The entry decision is not a decision this platform accepts: ${parsed.error.issues.map((i) => i.message).join("; ")}.`);
   }
+  if (phase !== null && !isValidPhaseIdentity(phase)) {
+    throw new InvalidPhaseIdentityError(phase);
+  }
   const url = `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/phase`;
   let res;
   try {
@@ -3174,9 +3489,11 @@ async function openPhase(credential, phase, entry) {
   if (!body || !(typeof body.phase === "string" || body.phase === null) || !(typeof body.previousPhase === "string" || body.previousPhase === null) || typeof body.decision !== "object" || body.decision === null || typeof body.decision.decisionId !== "string") {
     throw new Error(`[halfcycle] The response from ${url} did not carry { phase, previousPhase, decision }. The phase may or may not have moved \u2014 read the engagement's decision history before retrying.`);
   }
+  const stampFailure = writePhaseStamp(credential.engagementId, body.phase, home);
   return {
     phase: body.phase,
     previousPhase: body.previousPhase,
+    stampFailure,
     decision: body.decision
   };
 }
@@ -3194,7 +3511,7 @@ var ClosePhaseRefused = class extends Error {
     this.name = "ClosePhaseRefused";
   }
 };
-async function closePhase(credential, phase, outcome, close) {
+async function closePhase(credential, phase, outcome, close, home, repoRoot) {
   const parsed = acceptanceOutcomeSchema.safeParse(outcome);
   if (!parsed.success) {
     throw new Error(`[halfcycle] That is not an acceptance outcome this platform accepts: ${parsed.error.issues.map((i) => i.message).join("; ")}.`);
@@ -3228,7 +3545,13 @@ async function closePhase(credential, phase, outcome, close) {
   if (!body || typeof body.engagementId !== "string" || typeof body.status !== "string") {
     throw new Error(`[halfcycle] The response from ${url} did not carry { engagementId, status }. The phase may or may not have closed \u2014 read the engagement's status before retrying.`);
   }
-  return { engagementId: body.engagementId, status: body.status };
+  const closeRecord = repoRoot === void 0 ? {
+    recorded: false,
+    path: null,
+    reason: "no repository was named for this close, so there was nowhere to read a commit from"
+  } : writeCloseRecord(repoRoot, phase);
+  const stampFailure = writePhaseStamp(credential.engagementId, null, home);
+  return { engagementId: body.engagementId, status: body.status, stampFailure, closeRecord };
 }
 
 // dist/cli-contract.js
@@ -3349,7 +3672,7 @@ var PLACEHOLDERS = {
 // dist/banner-facts.js
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync8 } from "node:fs";
-import { basename as basename2, join as join9, resolve as resolve3 } from "node:path";
+import { basename as basename3, join as join10, resolve as resolve3 } from "node:path";
 var BRAND_URL = "halfcycle.ai";
 var TAGLINE = [
   "Fewer cycles.",
@@ -3362,7 +3685,7 @@ var TAGLINE_NARROW = [
 ];
 function bundleVersion() {
   try {
-    const pkg = JSON.parse(readFileSync8(join9(BUNDLE_ROOT, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync8(join10(BUNDLE_ROOT, "package.json"), "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -3451,7 +3774,7 @@ function openingBannerContent(projectDir, env = process.env, probes = REAL_PROBE
 }
 function safeBasename(dir) {
   try {
-    const name = basename2(resolve3(dir)).trim();
+    const name = basename3(resolve3(dir)).trim();
     return name === "" ? "project" : name;
   } catch {
     return "project";
@@ -3512,7 +3835,7 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
          install into target (default: the current directory)
          --yes / -y: use this machine's saved sign-in without being asked
   halfcycle check-drift <target-repo>
-  halfcycle build-record <phase-id> [--repo <root>]
+  halfcycle build-record <phase> [--repo <root>]
   halfcycle open-phase <phase|--none> --actor "\u2026" (--evidence "\u2026" | --override --reason "\u2026") [--repo <root>]
   halfcycle close-phase <phase> --verdict <clean|defects> --actor "\u2026" [--finding "\u2026"]\u2026 [--override --reason "\u2026"] [--repo <root>]
 
@@ -3521,7 +3844,7 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
 `;
 function isHalfcycleMonorepo(dir) {
   try {
-    const pkg = JSON.parse(readFileSync9(join10(dir, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(join11(dir, "package.json"), "utf-8"));
     return pkg.name === "halfcycle-monorepo";
   } catch {
     return false;
@@ -3573,6 +3896,7 @@ ${USAGE}`);
       const reusable = pinned !== null && pinned.engagementId === requestedId ? pinned.credential : void 0;
       let engagementId;
       let credential;
+      let notThisAccountMessage;
       let actingAccountId;
       let foundLine = "";
       if (reusable !== void 0 && pinned !== null) {
@@ -3593,21 +3917,30 @@ ${USAGE}`);
         }
       } else if (requestedId !== void 0) {
         const joined = await joinPinnedEngagement(serviceUrl, requestedId, targetRepo, { assumeYes, verbose });
-        engagementId = joined.engagementId;
-        actingAccountId = joined.actingAccountId;
-        credential = {
-          serviceUrl,
-          token: joined.sessionToken,
-          mcpUrl: joined.mcpUrl,
-          guardUrl: joined.guardUrl,
-          // T-10 — optional; absent on a plane that has not configured
-          // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
-          // an absent value, never `undefined` verbatim.
-          controlTelemetryUrl: joined.controlTelemetryUrl
-        };
-        foundLine = `this repo is pinned to a shared project \u2014 joining it as you (${shortId(joined.engagementId)})`;
-        if (verbose) {
-          process.stdout.write(`[halfcycle] Joined engagement ${joined.engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
+        if (isOutcomeBRefusal(joined)) {
+          engagementId = requestedId;
+          actingAccountId = joined.actingAccountId;
+          credential = void 0;
+          notThisAccountMessage = joined.message;
+          foundLine = `this repo is pinned to a project that belongs to a different Halfcycle account`;
+          writeNotThisAccountMarker(engagementId);
+        } else {
+          engagementId = joined.engagementId;
+          actingAccountId = joined.actingAccountId;
+          credential = {
+            serviceUrl,
+            token: joined.sessionToken,
+            mcpUrl: joined.mcpUrl,
+            guardUrl: joined.guardUrl,
+            // T-10 — optional; absent on a plane that has not configured
+            // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
+            // an absent value, never `undefined` verbatim.
+            controlTelemetryUrl: joined.controlTelemetryUrl
+          };
+          foundLine = `this repo is pinned to a shared project \u2014 joining it as you (${shortId(joined.engagementId)})`;
+        }
+        if (verbose && credential !== void 0) {
+          process.stdout.write(`[halfcycle] Joined engagement ${engagementId} \u2014 this credential is yours. Everyone else's keeps working; nobody was signed out and nothing was pasted.
 `);
         }
       } else {
@@ -3668,18 +4001,20 @@ ${USAGE}`);
 [halfcycle] ${missing.length === 1 ? "it" : "them"}) and re-run, and the credential moves out of the tree.
 `);
       }
-      const probe = await probeMcpOrigin(credential.mcpUrl);
-      if (probe.reached) {
-        if (verbose) {
-          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
+      if (credential) {
+        const probe = await probeMcpOrigin(credential.mcpUrl);
+        if (probe.reached) {
+          if (verbose) {
+            process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 reachable (${probe.serverName})
 `);
-        }
-      } else {
-        process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
+          }
+        } else {
+          process.stdout.write(`[halfcycle] Method delivery (MCP): ${credential.mcpUrl} \u2014 NOT reachable: ${probe.problem}.
 [halfcycle] The Halfcycle commands will have no method context until that address answers. This is the SECOND of two origins and the platform supplied it, so it is not the CONTROL origin (${credential.serviceUrl}) that is wrong \u2014 that one just worked. It is recorded as HALFCYCLE_MCP_URL in this engagement's credential store; re-run this installer once the service is up.
 `);
+        }
       }
-      if (verbose) {
+      if (credential && verbose) {
         process.stdout.write(`[halfcycle] Guard evaluation: ON \u2014 the hook evaluates against ${credential.guardUrl}. Credentials (${GUARD_COVERAGE_REQUIRED_KEYS.join(", ")}) are in ${engagementEnvPath(engagementId)}, outside this repository; the hook loads them itself, so you do not export anything and nothing here can be committed.
 `);
         process.stdout.write(`[halfcycle] Your credential is at ${engagementEnvPath(engagementId)} \u2014 outside this repository, readable only by you. .mcp.json reads it at connection time through .halfcycle/mcp-headers.sh, so there is no token in this tree to commit and nothing for you to export.
@@ -3687,30 +4022,38 @@ ${USAGE}`);
         process.stdout.write(`[halfcycle] Expect a workspace trust prompt the first time you open this folder \u2014 the helper is a shell command, and Claude Code will not run it until you accept. Needs Claude Code ${MIN_HEADERS_HELPER_VERSION} or newer (${MIN_HEADER_ROTATION_VERSION}+ to re-authenticate a rotated token without restarting).
 `);
         process.stdout.write(`[halfcycle] If Halfcycle tools appear but every call returns 401, the helper could not read HALFCYCLE_TOKEN from ${engagementEnvPath(engagementId)} \u2014 re-run this installer.
+`);
+      }
+      if (credential === void 0 && notThisAccountMessage !== void 0) {
+        process.stdout.write(`[halfcycle] ${notThisAccountMessage} Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming. Your work carries on exactly as it would without Halfcycle: no edit is evaluated, and nothing you do here is reported as having passed. Ask the project's owner for view access. ${identitySwitchRemedy()}
 `);
       }
       reportClaudeCodeVersion(verbose);
-      const identity = await describeAccount(credential.serviceUrl, credential.token);
+      const identity = credential ? await describeAccount(credential.serviceUrl, credential.token) : void 0;
       const written = result.writtenPaths.length;
       const merged = result.mergedPaths.length;
       process.stdout.write(`[halfcycle] Signed in as ${accountLabel(identity, actingAccountId, verbose)}
 `);
       process.stdout.write(`[halfcycle] Found: ${foundLine}
 `);
-      process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, guards armed on every edit
+      process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, ${credential ? "guards armed on every edit" : "not checked \u2014 this copy is not this account\u2019s project"}
 `);
-      process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
+      if (credential) {
+        process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-      process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
+        process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
 `);
-      try {
-        const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
-        process.stdout.write(`[halfcycle] Your project's page \u2014 how it is going, the agents working on it, and your other projects (first visit): ${minted.boardUrl}
+      }
+      if (credential) {
+        try {
+          const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
+          process.stdout.write(`[halfcycle] Your project's page \u2014 how it is going, the agents working on it, and your other projects (first visit): ${minted.boardUrl}
 `);
-        process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
+          process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
 `);
-      } catch {
-        process.stdout.write("[halfcycle] Your project's page: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
+        } catch {
+          process.stdout.write("[halfcycle] Your project's page: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
+        }
       }
       process.exit(0);
     } catch (err) {
@@ -3755,30 +4098,31 @@ ${USAGE}`);
   if (cmd === "build-record") {
     const phaseArg = rest[0];
     const repoRoot = rest.includes("--repo") ? rest[rest.indexOf("--repo") + 1] : process.cwd();
-    if (!phaseArg || !/^\d+$/.test(phaseArg)) {
-      process.stderr.write("halfcycle-bundle: usage: halfcycle-bundle build-record <phase-id> [--repo <root>]\n");
+    if (phaseArg === void 0) {
+      process.stderr.write("halfcycle: usage: halfcycle build-record <phase> [--repo <root>]\n");
       process.exit(1);
       return;
     }
-    const phaseId = Number(phaseArg);
+    const phaseId = phaseArg;
     try {
-      const inputPath = join10(repoRoot, ".workbench", "build-record", `phase-${phaseId}.input.json`);
+      assertValidPhaseIdentity(phaseId, BUILD_RECORD_DIR);
+      const inputPath = join11(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phaseId)}.input.json`);
       const input = JSON.parse(readFileSync9(inputPath, "utf-8"));
       const result = assemblePhaseBuildRecord({
         repoRoot,
-        phasesDir: join10(repoRoot, "docs", "phases"),
-        guardEvalLogDir: input.guardEvalLogDir ?? join10(repoRoot, ".workbench", "guard-eval-log"),
+        phasesDir: join11(repoRoot, "docs", "phases"),
+        guardEvalLogDir: input.guardEvalLogDir ?? join11(repoRoot, ".workbench", "guard-eval-log"),
         phaseId,
         narrated: input.narrated,
         touchedInvariants: input.touchedInvariants
       });
-      process.stdout.write(`[halfcycle-bundle] Build Record written:
+      process.stdout.write(`[halfcycle] Build Record written:
   ${result.jsonPath}
   ${result.mdPath}
 `);
       process.exit(0);
     } catch (err) {
-      process.stderr.write(`halfcycle-bundle build-record failed: ${err instanceof Error ? err.message : String(err)}
+      process.stderr.write(`halfcycle build-record failed: ${err instanceof Error ? err.message : String(err)}
 `);
       process.exit(1);
     }
@@ -3820,8 +4164,22 @@ ${USAGE}`);
         process.stdout.write(`[halfcycle] This decision CROSSED: ${opened.decision.blockingFinding}
 `);
       }
+      if (opened.stampFailure) {
+        process.stderr.write(`halfcycle open-phase: the phase moved, but this machine's copy of it could not be written: ${opened.stampFailure.reason}
+halfcycle open-phase: until ${opened.stampFailure.path} can be written, guard evaluations here are filed under whatever phase that file still names. Fix the file and re-run this command \u2014 re-running it is safe.
+`);
+        process.exit(1);
+        return;
+      }
       process.exit(0);
     } catch (err) {
+      if (err instanceof InvalidPhaseIdentityError) {
+        process.stderr.write(`halfcycle open-phase: ${err.message}
+halfcycle open-phase: a phase name has to work as a single folder name on this machine \u2014 that is what this machine files its guard evaluations under. Nothing was opened.
+`);
+        process.exit(2);
+        return;
+      }
       if (err instanceof OpenPhaseRefused) {
         process.stderr.write(`halfcycle open-phase: refused (${err.status}). ${err.message}
 `);
@@ -3901,15 +4259,30 @@ ${USAGE}`);
         verdict,
         findings: findingsDetail.length,
         findingsDetail
-      }, closeDecision);
+      }, closeDecision, void 0, repoRoot);
       process.stdout.write(`[halfcycle] Phase "${phaseArg}" closed as ${verdict}${findingsDetail.length > 0 ? ` with ${findingsDetail.length} finding(s)` : ""} by ${closeDecision.actor}. The engagement is now ${closed.status}.
 `);
       if (closeDecision.decision === "override") {
         process.stdout.write(`[halfcycle] This close was an OVERRIDE: ${closeDecision.reason}
+`);
+      }
+      if (closed.closeRecord.recorded) {
+        process.stdout.write(`[halfcycle] Closed at commit ${closed.closeRecord.closeCommit} (${closed.closeRecord.closedDate}). The Build Record for this phase will name it.
+`);
+      } else {
+        process.stderr.write(`halfcycle close-phase: the phase closed, but the commit it closed at was not recorded on this machine: ${closed.closeRecord.reason}
+halfcycle close-phase: this phase's Build Record will say the close commit and the close date were not recorded.
 `);
       }
       process.stdout.write(`[halfcycle] Open the next phase with: halfcycle open-phase <phase> --actor "you" --evidence "\u2026"
 `);
+      if (closed.stampFailure) {
+        process.stderr.write(`halfcycle close-phase: the phase closed, but this machine's record of it could not be cleared: ${closed.stampFailure.reason}
+halfcycle close-phase: until ${closed.stampFailure.path} can be written, guard evaluations here are still filed under the phase you just closed.
+`);
+        process.exit(1);
+        return;
+      }
       process.exit(0);
     } catch (err) {
       if (err instanceof ClosePhaseRefused) {