halfcycle 0.3.32 → 0.3.33

package/dist/bin.js

@@ -3,7 +3,7 @@
 // dist/bin.js
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync10, statSync } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join10 } from "node:path";
 
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -203,6 +203,31 @@ var HALFCYCLE_HOOK_WIRING_PATHS = [
   .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
 ];
 
+// ../core/dist/secret-shape.js
+var SECRET_SHAPE_PATTERNS = [
+  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
+  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
+  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
+  // Connection strings that embed credentials: `scheme://user:pass@host`.
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
+  // Bearer / authorization header values.
+  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
+  // PEM / private-key block headers.
+  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
+  // JWT shape: three base64url segments separated by dots.
+  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
+  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
+  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
+  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
+];
+function looksLikeSecret(text) {
+  for (const pattern of SECRET_SHAPE_PATTERNS) {
+    if (pattern.test(text))
+      return true;
+  }
+  return false;
+}
+
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
@@ -262,219 +287,31 @@ var wireErrorSchema = z2.object({
   message: z2.string()
 }).strict();
 
-// ../events/dist/telemetry.js
-import { z as z3 } from "zod";
-var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
-var guardEvalOutcomeSchema = z3.enum([
-  "evaluated",
-  "infra-error",
-  "contract-error",
-  "unconfigured"
-]);
-var guardEvalRunSchema = z3.object({
-  // `runId`/`outcome` are the E2 run-observability additions, declared
-  // field-level-OPTIONAL as the FIRST (expand) step of an expand-contract
-  // migration. Every new record populated by the migrated writer (T-07)
-  // carries both; a legacy line predating the amendment carries neither and
-  // must still parse (the mixed-era guard-eval log the Build-Record reader
-  // assembles from, and the runner emit not yet migrated). So the presence
-  // refinement below is skipped for a legacy line (no `outcome`), and the
-  // per-writer guarantee lives with the writer + reader-normalisation (T-07),
-  // where the schema may then be tightened to required. runId is uuid-checked
-  // WHEN present; outcome is enum-checked when present.
-  runId: z3.string().uuid().optional(),
-  engagementId: z3.string().optional(),
-  runType: z3.enum(["hook", "ci"]),
-  occurredAt: utcIso8601,
-  outcome: guardEvalOutcomeSchema.optional(),
-  failureReason: z3.string().optional(),
-  phase: z3.string().optional(),
-  scope: z3.record(z3.string(), z3.unknown()),
-  cost: z3.record(z3.string(), z3.unknown()).optional(),
-  result: resultEnvelopeSchema.optional()
-}).strict().superRefine((run, ctx) => {
-  if (run.outcome === void 0)
-    return;
-  if (run.outcome === "evaluated" && run.result === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is required when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "evaluated" && run.result !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["result"],
-      message: "result is only present when outcome is 'evaluated'"
-    });
-  }
-  if (run.outcome !== "unconfigured" && run.engagementId === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      path: ["engagementId"],
-      message: "engagementId is required unless outcome is 'unconfigured'"
-    });
-  }
-});
-
 // ../events/dist/engagement-lifecycle.js
+import { z as z5 } from "zod";
+
+// ../events/dist/lone-surrogates.js
+var LONE_SURROGATE = new RegExp("\\p{Cs}", "u");
+function hasLoneSurrogate(text) {
+  return LONE_SURROGATE.test(text);
+}
+var LONE_SURROGATE_MESSAGE = "must be valid text: it holds half of a character pair with no other half";
+
+// ../events/dist/build-record.js
 import { z as z4 } from "zod";
-var utcIso86012 = z4.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
-var engagementTypeSchema = z4.enum(["client"]);
-var lifecycleStatusSchema = z4.enum(["active", "delivering", "closed"]);
-var createEngagementRequestSchema = z4.object({
-  name: z4.string(),
-  region: z4.string(),
-  engagementType: engagementTypeSchema
-}).strict();
-var createEngagementResponseSchema = z4.object({
-  engagementId: z4.string(),
-  name: z4.string(),
-  region: z4.string(),
-  status: lifecycleStatusSchema,
-  createdAt: utcIso86012,
-  sessionToken: z4.string()
-}).strict();
-var engagementStatusResponseSchema = z4.object({
-  engagementId: z4.string(),
-  name: z4.string(),
-  region: z4.string(),
-  status: lifecycleStatusSchema,
-  installLinked: z4.boolean(),
-  createdAt: utcIso86012,
-  updatedAt: utcIso86012
-}).strict();
-var linkInstallationRequestSchema = z4.object({
-  installationId: z4.string(),
-  engagementId: z4.string()
-}).strict();
-var startBuildRequestSchema = z4.object({
-  engagementId: z4.string()
-}).strict();
-var startBuildResponseSchema = z4.object({
-  engagementId: z4.string(),
-  status: lifecycleStatusSchema,
-  enqueuedAt: utcIso86012
-}).strict();
-var acceptanceOutcomeSchema = z4.object({
-  verdict: z4.enum(["clean", "defects"]),
-  findings: z4.number().int().nonnegative(),
-  findingsDetail: z4.array(z4.object({ summary: z4.string() }).strict())
-}).strict();
-var PHASE_CLOSE_REASON_MAX = 1900;
-var phaseCloseDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("done-when-met"),
-    /** Who is closing the phase. */
-    actor: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is closing it anyway. */
-    actor: z4.string(),
-    /**
-     * Why, in their own words. Bounded: the reason is kept on the phase's
-     * permanent record of its own close, and that record refuses anything
-     * longer — so an over-long reason is refused here, before the close is
-     * attempted, rather than failing the close itself.
-     */
-    reason: z4.string().max(PHASE_CLOSE_REASON_MAX)
-  }).strict()
-]);
-var acceptPhaseRequestSchema = z4.object({
-  phase: z4.string(),
-  acceptanceOutcome: acceptanceOutcomeSchema,
-  close: phaseCloseDecisionSchema.optional()
-}).strict();
-var coeFindingRequestSchema = z4.object({
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable()
-}).strict();
-var coeFindingResponseSchema = z4.object({
-  findingId: z4.string(),
-  engagementId: z4.string(),
-  phase: z4.string(),
-  description: z4.string(),
-  addRateTag: z4.enum(["seam-new", "seam-repeat", "model-limitation"]),
-  mappedPatternRef: z4.string().nullable(),
-  createdAt: utcIso86012
-}).strict();
-var operatorFindingResponseSchema = z4.object({
-  // The finding just recorded.
-  finding: coeFindingResponseSchema,
-  // Every finding recorded for that phase, oldest first, including this one.
-  phaseFindings: z4.array(coeFindingResponseSchema),
-  // Whether the phase's finding rate was recalculated to include this finding.
-  figuresRecomputed: z4.boolean()
-}).strict();
-var phaseNotOnRecordRefusalSchema = wireErrorSchema.extend({
-  // Always this value for this refusal.
-  error: z4.literal("PhaseNotOnRecord"),
-  // The phases that can take a finding, sorted.
-  phases: z4.array(z4.string())
-}).strict();
-var phaseEntryDecisionSchema = z4.discriminatedUnion("decision", [
-  z4.object({
-    decision: z4.literal("entry-condition-met"),
-    /** Who attests. */
-    actor: z4.string(),
-    /** What makes the entry condition hold, in the attester's own words. */
-    evidence: z4.string()
-  }).strict(),
-  z4.object({
-    decision: z4.literal("override"),
-    /** Who is opening it anyway. */
-    actor: z4.string(),
-    /** Why, in the operator's own words. */
-    reason: z4.string()
-  }).strict()
-]);
-var PHASE_ENTRY_DECISION_KINDS = [
-  "entry-condition-met",
-  "override"
-];
-var PHASE_CLOSE_DECISION_KINDS = ["phase-closed", "phase-close-override"];
-var phaseDecisionKindSchema = z4.enum([
-  ...PHASE_ENTRY_DECISION_KINDS,
-  ...PHASE_CLOSE_DECISION_KINDS
-]);
-var openPhaseRequestSchema = z4.object({
-  phase: z4.string().nullable(),
-  entry: phaseEntryDecisionSchema
-}).strict();
-var phaseEntryDecisionRecordSchema = z4.object({
-  decisionId: z4.string(),
-  decision: z4.enum(PHASE_ENTRY_DECISION_KINDS),
-  actor: z4.string(),
-  /** The evidence (attestation) or the reason (override) — one basis per row. */
-  justification: z4.string(),
-  blockingFinding: z4.string().nullable(),
-  decidedAt: utcIso86012
-}).strict();
-var openPhaseResponseSchema = z4.object({
-  engagement: engagementStatusResponseSchema,
-  /** What is open now. `null` is project scope. */
-  phase: z4.string().nullable(),
-  /** What was open before this decision. `null` is project scope. */
-  previousPhase: z4.string().nullable(),
-  decision: phaseEntryDecisionRecordSchema
-}).strict();
 
 // ../events/dist/state.js
-import { z as z5 } from "zod";
-var utcIso86013 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+import { z as z3 } from "zod";
+var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var STATE_RECORD_FORMAT = "halfcycle-state-record/v1";
-var stepIdSchema = z5.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
-var methodVersionSchema = z5.string().regex(/^\d+\.\d+\.\d+$/);
+var stepIdSchema = z3.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
+var methodVersionSchema = z3.string().regex(/^\d+\.\d+\.\d+$/);
 var anchorPathRegex = /^(?!\/)(?!.*#)(?!method\/)(?!(.*\/)?docs\/method\/).+$/;
-var recordKindSchema = z5.enum(["artefact", "step-run", "gate", "intervention"]);
-var methodLayerSchema = z5.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
-var evidenceKindSchema = z5.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
-var declarableEvidenceKindSchema = z5.enum(["anchor", "diff", "repro", "question-answer"]);
-var dispositionSchema = z5.enum([
+var recordKindSchema = z3.enum(["artefact", "step-run", "gate", "intervention"]);
+var methodLayerSchema = z3.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
+var evidenceKindSchema = z3.enum(["anchor", "diff", "repro", "question-answer", "no-op"]);
+var declarableEvidenceKindSchema = z3.enum(["anchor", "diff", "repro", "question-answer"]);
+var dispositionSchema = z3.enum([
   "prevented",
   "corrected-in-spec",
   "corrected-in-scope",
@@ -484,20 +321,20 @@ var dispositionSchema = z5.enum([
   "surfaced",
   "filed-forward"
 ]);
-var mechanismSchema = z5.enum(["guard", "verdict", "served-step", "method-step"]);
-var artefactStateSchema = z5.enum(["created", "updated"]);
+var mechanismSchema = z3.enum(["guard", "verdict", "served-step", "method-step"]);
+var artefactStateSchema = z3.enum(["created", "updated"]);
 var QUALIFIED_OUTCOMES = ["declined", "parked"];
-var qualifiedOutcomeSchema = z5.enum(QUALIFIED_OUTCOMES);
+var qualifiedOutcomeSchema = z3.enum(QUALIFIED_OUTCOMES);
 function isQualifiedOutcome(outcome) {
   return QUALIFIED_OUTCOMES.includes(outcome);
 }
-var runOutcomeSchema = z5.enum([
+var runOutcomeSchema = z3.enum([
   "completed",
   "attempted-failed",
   ...QUALIFIED_OUTCOMES
 ]);
-var gateKindSchema = z5.enum(["approval", "mechanical"]);
-var gateVerdictSchema = z5.enum(["pass", "fail", ...QUALIFIED_OUTCOMES]);
+var gateKindSchema = z3.enum(["approval", "mechanical"]);
+var gateVerdictSchema = z3.enum(["pass", "fail", ...QUALIFIED_OUTCOMES]);
 function outcomeReasonIssue(outcome, reason) {
   if (isQualifiedOutcome(outcome) && reason === void 0) {
     return { message: `outcomeReason is required when the outcome is '${outcome}'` };
@@ -509,142 +346,527 @@ function outcomeReasonIssue(outcome, reason) {
   }
   return null;
 }
-var anchorEvidenceSchema = z5.object({
-  kind: z5.literal("anchor"),
-  path: z5.string().regex(anchorPathRegex),
+var anchorEvidenceSchema = z3.object({
+  kind: z3.literal("anchor"),
+  path: z3.string().regex(anchorPathRegex),
   // Optional 1-based line number within the file at `path`. Present when the
   // writer knows the exact line; omitted — never `0`, never `null` — when it
   // does not, because a line number is not always obtainable. Absence is a
   // valid, permanent state here, not a gap meant to be filled in later.
-  line: z5.number().optional()
+  line: z3.number().optional()
 }).strict();
-var diffEvidenceSchema = z5.object({
-  kind: z5.literal("diff"),
-  ref: z5.string()
+var diffEvidenceSchema = z3.object({
+  kind: z3.literal("diff"),
+  ref: z3.string()
 }).strict();
-var reproEvidenceSchema = z5.object({
-  kind: z5.literal("repro"),
-  steps: z5.string().max(2e3)
+var reproEvidenceSchema = z3.object({
+  kind: z3.literal("repro"),
+  steps: z3.string().max(2e3)
 }).strict();
-var questionAnswerEvidenceSchema = z5.object({
-  kind: z5.literal("question-answer"),
-  question: z5.string().max(2e3),
-  before: z5.string().max(2e3),
-  after: z5.string().max(2e3)
+var questionAnswerEvidenceSchema = z3.object({
+  kind: z3.literal("question-answer"),
+  question: z3.string().max(2e3),
+  before: z3.string().max(2e3),
+  after: z3.string().max(2e3)
 }).strict();
-var noOpEvidenceSchema = z5.object({
-  kind: z5.literal("no-op"),
-  inspected: z5.string().max(2e3),
-  unchangedBecause: z5.string().max(2e3)
+var noOpEvidenceSchema = z3.object({
+  kind: z3.literal("no-op"),
+  inspected: z3.string().max(2e3),
+  unchangedBecause: z3.string().max(2e3)
 }).strict();
-var evidenceSchema = z5.discriminatedUnion("kind", [
+var evidenceSchema = z3.discriminatedUnion("kind", [
   anchorEvidenceSchema,
   diffEvidenceSchema,
   reproEvidenceSchema,
   questionAnswerEvidenceSchema,
   noOpEvidenceSchema
 ]);
-var stateRecordEnvelopeSchema = z5.object({
-  format: z5.literal(STATE_RECORD_FORMAT),
+var stateRecordEnvelopeSchema = z3.object({
+  format: z3.literal(STATE_RECORD_FORMAT),
   recordKind: recordKindSchema,
-  recordId: z5.string().uuid(),
+  recordId: z3.string().uuid(),
   methodVersion: methodVersionSchema,
-  engagementId: z5.string(),
+  engagementId: z3.string(),
   stepId: stepIdSchema,
   // Immutable: names when the thing happened, never when a later disposition
   // moved.
-  occurredAt: utcIso86013,
+  occurredAt: utcIso8601,
   // Equal to `occurredAt` on first write; advances on each re-emit OF A FINDING.
   // Carried on the shared envelope so a "when did this last change" query is
   // kind-agnostic. Kept rather than generalised to `updatedAt` because
   // `disposition` is the only field any re-emit may change (§5.3).
-  dispositionAt: utcIso86013,
+  dispositionAt: utcIso8601,
   evidence: evidenceSchema,
   // Which phase of the project this record belongs to, if any. Present on
   // records written during phase-scoped work; absent on records that run once
   // for the whole project rather than per phase. Absence is meaningful on its
   // own — it is never replaced with a placeholder value, and it is read as
   // "satisfies any phase", not as "unknown".
-  phase: z5.string().optional()
+  phase: z3.string().optional()
 });
-var artefactRefSchema = z5.object({
-  name: z5.string(),
-  parent: z5.string()
+var artefactRefSchema = z3.object({
+  name: z3.string(),
+  parent: z3.string()
 }).strict();
-var coverageSchema = z5.object({
-  asked: z5.number().int().nonnegative(),
-  answered: z5.number().int().nonnegative()
+var coverageSchema = z3.object({
+  asked: z3.number().int().nonnegative(),
+  answered: z3.number().int().nonnegative()
 }).strict().superRefine((coverage, ctx) => {
   if (coverage.answered > coverage.asked) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["answered"],
       message: "answered cannot be more than asked"
     });
   }
 });
 var artefactRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z5.literal("artefact"),
+  recordKind: z3.literal("artefact"),
   artefactRef: artefactRefSchema,
   // Some layer wrote it, by construction — an empty array is not a legitimate
   // state, so the schema says so.
-  writtenByLayers: z5.array(methodLayerSchema).min(1),
+  writtenByLayers: z3.array(methodLayerSchema).min(1),
   state: artefactStateSchema
 }).strict();
 var stepRunRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z5.literal("step-run"),
+  recordKind: z3.literal("step-run"),
   runOutcome: runOutcomeSchema,
-  failureReason: z5.string().optional(),
-  outcomeReason: z5.string().max(2e3).optional()
+  failureReason: z3.string().optional(),
+  outcomeReason: z3.string().max(2e3).optional()
 }).strict().superRefine((rec, ctx) => {
   if (rec.runOutcome === "attempted-failed" && rec.failureReason === void 0) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["failureReason"],
       message: "failureReason is required when runOutcome is 'attempted-failed'"
     });
   }
   if (rec.runOutcome !== "attempted-failed" && rec.failureReason !== void 0) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z3.ZodIssueCode.custom,
       path: ["failureReason"],
       message: "failureReason is only present when runOutcome is 'attempted-failed'"
     });
   }
   const issue = outcomeReasonIssue(rec.runOutcome, rec.outcomeReason);
   if (issue) {
-    ctx.addIssue({ code: z5.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
   }
 });
 var gateRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z5.literal("gate"),
+  recordKind: z3.literal("gate"),
   gateKind: gateKindSchema,
   verdict: gateVerdictSchema,
-  actor: z5.string(),
-  outcomeReason: z5.string().max(2e3).optional(),
+  actor: z3.string(),
+  outcomeReason: z3.string().max(2e3).optional(),
   coverage: coverageSchema.optional()
 }).strict().superRefine((rec, ctx) => {
   const issue = outcomeReasonIssue(rec.verdict, rec.outcomeReason);
   if (issue) {
-    ctx.addIssue({ code: z5.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
+    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["outcomeReason"], ...issue });
   }
 });
 var interventionRecordSchema = stateRecordEnvelopeSchema.extend({
-  recordKind: z5.literal("intervention"),
+  recordKind: z3.literal("intervention"),
   layer: methodLayerSchema,
   mechanism: mechanismSchema,
   severity: severitySchema,
   disposition: dispositionSchema,
-  summary: z5.string().max(2e3),
+  summary: z3.string().max(2e3),
   coverage: coverageSchema.optional()
 }).strict();
-var stateRecordSchema = z5.discriminatedUnion("recordKind", [
+var stateRecordSchema = z3.discriminatedUnion("recordKind", [
   artefactRecordSchema,
   stepRunRecordSchema,
   gateRecordSchema,
   interventionRecordSchema
 ]);
 
+// ../events/dist/control-characters.js
+var CONTROL_CHARACTER_CLASS = "\\p{Cc}";
+var CONTROL_CHARACTER = new RegExp(CONTROL_CHARACTER_CLASS, "u");
+function hasControlCharacter(text) {
+  return CONTROL_CHARACTER.test(text);
+}
+
+// ../events/dist/phase-identity.js
+var PHASE_SEGMENT_PREFIX = "phase-";
+var PHASE_NAME_MAX_BYTES = 200;
+function isValidPhaseIdentity(identity) {
+  if (typeof identity === "number")
+    return Number.isInteger(identity) && identity >= 0;
+  if (typeof identity !== "string")
+    return false;
+  if (identity === "")
+    return false;
+  if (identity.includes("/"))
+    return false;
+  if (identity.includes("\\"))
+    return false;
+  if (identity.startsWith("."))
+    return false;
+  if (hasControlCharacter(identity))
+    return false;
+  if (utf8ByteLength(identity) > PHASE_NAME_MAX_BYTES)
+    return false;
+  return true;
+}
+function utf8ByteLength(text) {
+  let bytes = 0;
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    bytes += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+  }
+  return bytes;
+}
+var InvalidPhaseIdentityError = class extends Error {
+  /** The value that was refused, exactly as supplied. */
+  identity;
+  constructor(identity, allowedLocation) {
+    const subject = allowedLocation === void 0 ? "a file" : "a Build Record";
+    const where = allowedLocation === void 0 ? "" : `
+  Records are written only into ${allowedLocation.replace(/\\/g, "/")}/. Nothing was written.`;
+    super(`that phase identity cannot name ${subject}.
+  identity: ${describeIdentity(identity)}` + where);
+    this.name = "InvalidPhaseIdentityError";
+    this.identity = identity;
+  }
+};
+function assertValidPhaseIdentity(identity, allowedLocation) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity, allowedLocation);
+  }
+}
+function renderPhaseSegment(identity) {
+  if (!isValidPhaseIdentity(identity)) {
+    throw new InvalidPhaseIdentityError(identity);
+  }
+  return `${PHASE_SEGMENT_PREFIX}${identity}`;
+}
+function describeIdentity(identity) {
+  if (identity === "")
+    return "(empty)";
+  if (typeof identity === "string")
+    return identity;
+  if (identity === null)
+    return "null";
+  if (identity === void 0)
+    return "none supplied";
+  if (typeof identity === "number" || typeof identity === "boolean")
+    return String(identity);
+  if (Array.isArray(identity))
+    return "(a list)";
+  if (typeof identity === "object")
+    return "(an object)";
+  return `(a ${typeof identity})`;
+}
+
+// ../events/dist/build-record.js
+var BUILD_RECORD_V2_FORMAT = "halfcycle-build-record/v2";
+var STATEMENT_MAX = 2e3;
+var DEVIATION_MAX = 500;
+var DEVIATIONS_MAX = 20;
+var ACTOR_MAX = 200;
+var FINDING_MAX = 500;
+var FINDINGS_SHOWN_MAX = 50;
+var PHASE_CLOSE_REASON_MAX = 1900;
+var closeCommitSchema = z4.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full commit hash: 40 or 64 lowercase hex characters");
+var walkVerdictSchema = z4.enum(["clean", "defects"]);
+var closeDecisionSchema = z4.enum(["done-when-met", "override"]);
+function plainText(max) {
+  const base = max === void 0 ? z4.string() : z4.string().max(max);
+  return base.refine((v) => !hasControlCharacter(v), {
+    message: "must be one line with no control characters (no line breaks, tabs or NUL)"
+  }).refine((v) => !hasLoneSurrogate(v), { message: LONE_SURROGATE_MESSAGE });
+}
+function statementText(max) {
+  return plainText(max).refine((v) => !looksLikeSecret(v), {
+    message: "looks like a password or key \u2014 rephrase it"
+  });
+}
+var closeActorSchema = plainText(ACTOR_MAX);
+var phaseNameSchema = z4.string().refine((v) => isValidPhaseIdentity(v), {
+  message: `must be a phase name: not empty, no slash or backslash, not starting with a dot, no control characters, at most ${PHASE_NAME_MAX_BYTES} bytes`
+});
+var closeStatementsSchema = z4.object({
+  thesis: statementText(STATEMENT_MAX).nullable(),
+  outcome: statementText(STATEMENT_MAX).nullable(),
+  deviations: z4.array(statementText(DEVIATION_MAX)).max(DEVIATIONS_MAX),
+  closeCommit: closeCommitSchema.nullable()
+}).strict();
+var closedBySchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("account"), email: plainText().nullable() }).strict(),
+  z4.object({ kind: z4.literal("no-account") }).strict(),
+  z4.object({ kind: z4.literal("account-removed") }).strict(),
+  z4.object({ kind: z4.literal("not-recorded") }).strict()
+]);
+var unfinishedStepSchema = z4.object({
+  stepId: plainText(),
+  state: z4.enum(["parked", "failed"])
+}).strict();
+var crossedSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("none") }).strict(),
+  z4.object({ kind: z4.literal("unfinished-steps"), steps: z4.array(unfinishedStepSchema).min(1) }).strict(),
+  z4.object({ kind: z4.literal("clean-over-findings"), findings: z4.number().int().min(1) }).strict(),
+  z4.object({ kind: z4.literal("not-recorded") }).strict()
+]);
+var seatCoverageSchema = z4.object({
+  enrolled: z4.number().int().nonnegative(),
+  conformant: z4.number().int().nonnegative()
+}).strict().refine((c) => c.conformant <= c.enrolled, {
+  message: "conformant cannot exceed enrolled",
+  path: ["conformant"]
+});
+var observedCloseSchema = z4.object({
+  sequence: z4.number().int().min(1),
+  closedAt: utcIso8601,
+  closedBy: closedBySchema,
+  crossed: crossedSchema,
+  seatCoverage: seatCoverageSchema.nullable()
+}).strict();
+var couldNotRunCheckSchema = z4.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  reason: plainText()
+}).strict();
+var firedCheckSchema = z4.object({
+  check: plainText(),
+  description: plainText().nullable(),
+  severity: severitySchema,
+  explanation: plainText().nullable(),
+  occurrences: z4.number().int().min(1)
+}).strict();
+var phaseChecksSchema = z4.discriminatedUnion("state", [
+  z4.object({ state: z4.literal("not-observed") }).strict(),
+  z4.object({
+    state: z4.literal("nothing-fired"),
+    runs: z4.number().int().min(1),
+    couldNotRun: z4.array(couldNotRunCheckSchema)
+  }).strict(),
+  z4.object({
+    state: z4.literal("fired"),
+    runs: z4.number().int().min(1),
+    couldNotRun: z4.array(couldNotRunCheckSchema),
+    fired: z4.array(firedCheckSchema).min(1)
+  }).strict()
+]);
+var observedSchema = z4.object({
+  engagementId: plainText(),
+  methodVersion: methodVersionSchema,
+  closes: z4.array(observedCloseSchema).min(1),
+  checks: phaseChecksSchema
+}).strict().superRefine((o, ctx) => {
+  o.closes.forEach((close, i) => {
+    if (close.sequence !== i + 1) {
+      ctx.addIssue({
+        code: "custom",
+        message: "closes must be numbered 1, 2, 3 \u2026 in order with no gap",
+        path: ["closes", i, "sequence"]
+      });
+    }
+  });
+});
+var attestedWalkSchema = z4.object({
+  verdict: walkVerdictSchema,
+  findings: z4.array(plainText(FINDING_MAX)).max(FINDINGS_SHOWN_MAX),
+  findingsNotShown: z4.number().int().nonnegative()
+}).strict();
+var attestedStatementsSchema = z4.object({
+  thesis: plainText(STATEMENT_MAX).nullable(),
+  outcome: plainText(STATEMENT_MAX).nullable(),
+  deviations: z4.array(plainText(DEVIATION_MAX)).max(DEVIATIONS_MAX)
+}).strict();
+var attestedCloseSchema = z4.object({
+  sequence: z4.number().int().min(1),
+  decision: closeDecisionSchema,
+  actor: plainText(ACTOR_MAX).nullable(),
+  reason: plainText(PHASE_CLOSE_REASON_MAX).nullable(),
+  walk: attestedWalkSchema.nullable(),
+  closeCommit: closeCommitSchema.nullable(),
+  statements: attestedStatementsSchema
+}).strict();
+var attestedSchema = z4.object({
+  closes: z4.array(attestedCloseSchema)
+}).strict();
+var buildRecordV2Schema = z4.object({
+  format: z4.literal(BUILD_RECORD_V2_FORMAT),
+  phase: phaseNameSchema,
+  observed: observedSchema,
+  attested: attestedSchema
+}).strict().superRefine((record2, ctx) => {
+  const observedBySequence = new Map(record2.observed.closes.map((c) => [c.sequence, c]));
+  const attestedSequences = record2.attested.closes.map((c) => c.sequence);
+  const sameSet = attestedSequences.length === observedBySequence.size && new Set(attestedSequences).size === attestedSequences.length && attestedSequences.every((s) => observedBySequence.has(s));
+  if (!sameSet) {
+    ctx.addIssue({
+      code: "custom",
+      message: "attested closes must match the observed closes one for one, by sequence",
+      path: ["attested", "closes"]
+    });
+  }
+  record2.attested.closes.forEach((close, i) => {
+    if (close.decision === "override" !== (close.reason !== null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "reason is given exactly when the decision is override",
+        path: ["attested", "closes", i, "reason"]
+      });
+    }
+    const observed = observedBySequence.get(close.sequence);
+    if (observed !== void 0 && observed.closedBy.kind === "account-removed" !== (close.actor === null)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "actor is empty exactly when the closing account was removed",
+        path: ["attested", "closes", i, "actor"]
+      });
+    }
+  });
+});
+
+// ../events/dist/engagement-lifecycle.js
+var utcIso86012 = z5.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+var engagementTypeSchema = z5.enum(["client"]);
+var lifecycleStatusSchema = z5.enum(["active", "delivering", "closed"]);
+var createEngagementRequestSchema = z5.object({
+  name: z5.string(),
+  region: z5.string(),
+  engagementType: engagementTypeSchema
+}).strict();
+var createEngagementResponseSchema = z5.object({
+  engagementId: z5.string(),
+  name: z5.string(),
+  region: z5.string(),
+  status: lifecycleStatusSchema,
+  createdAt: utcIso86012,
+  sessionToken: z5.string()
+}).strict();
+var engagementStatusResponseSchema = z5.object({
+  engagementId: z5.string(),
+  name: z5.string(),
+  region: z5.string(),
+  status: lifecycleStatusSchema,
+  installLinked: z5.boolean(),
+  createdAt: utcIso86012,
+  updatedAt: utcIso86012
+}).strict();
+var linkInstallationRequestSchema = z5.object({
+  installationId: z5.string(),
+  engagementId: z5.string()
+}).strict();
+var startBuildRequestSchema = z5.object({
+  engagementId: z5.string()
+}).strict();
+var startBuildResponseSchema = z5.object({
+  engagementId: z5.string(),
+  status: lifecycleStatusSchema,
+  enqueuedAt: utcIso86012
+}).strict();
+var acceptanceOutcomeSchema = z5.object({
+  verdict: walkVerdictSchema,
+  findings: z5.number().int().nonnegative(),
+  findingsDetail: z5.array(z5.object({ summary: z5.string().refine((v) => !hasLoneSurrogate(v), { message: LONE_SURROGATE_MESSAGE }) }).strict())
+}).strict();
+var phaseCloseDecisionSchema = z5.discriminatedUnion("decision", [
+  z5.object({
+    decision: z5.literal(closeDecisionSchema.enum["done-when-met"]),
+    /** Who is closing the phase. */
+    actor: closeActorSchema
+  }).strict(),
+  z5.object({
+    decision: z5.literal(closeDecisionSchema.enum.override),
+    /** Who is closing it anyway. */
+    actor: closeActorSchema,
+    /**
+     * Why, in their own words. Bounded: the reason is kept on the phase's
+     * permanent record of its own close, and that record refuses anything
+     * longer — so an over-long reason is refused here, before the close is
+     * attempted, rather than failing the close itself.
+     */
+    reason: z5.string().max(PHASE_CLOSE_REASON_MAX).refine((v) => !hasLoneSurrogate(v), { message: LONE_SURROGATE_MESSAGE })
+  }).strict()
+]);
+var acceptPhaseRequestSchema = z5.object({
+  phase: phaseNameSchema,
+  acceptanceOutcome: acceptanceOutcomeSchema,
+  close: phaseCloseDecisionSchema.optional(),
+  statements: closeStatementsSchema.optional()
+}).strict();
+var coeFindingRequestSchema = z5.object({
+  phase: z5.string(),
+  description: z5.string(),
+  addRateTag: z5.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z5.string().nullable()
+}).strict();
+var coeFindingResponseSchema = z5.object({
+  findingId: z5.string(),
+  engagementId: z5.string(),
+  phase: z5.string(),
+  description: z5.string(),
+  addRateTag: z5.enum(["seam-new", "seam-repeat", "model-limitation"]),
+  mappedPatternRef: z5.string().nullable(),
+  createdAt: utcIso86012
+}).strict();
+var operatorFindingResponseSchema = z5.object({
+  // The finding just recorded.
+  finding: coeFindingResponseSchema,
+  // Every finding recorded for that phase, oldest first, including this one.
+  phaseFindings: z5.array(coeFindingResponseSchema),
+  // Whether the phase's finding rate was recalculated to include this finding.
+  figuresRecomputed: z5.boolean()
+}).strict();
+var phaseNotOnRecordRefusalSchema = wireErrorSchema.extend({
+  // Always this value for this refusal.
+  error: z5.literal("PhaseNotOnRecord"),
+  // The phases that can take a finding, sorted.
+  phases: z5.array(z5.string())
+}).strict();
+var phaseEntryDecisionSchema = z5.discriminatedUnion("decision", [
+  z5.object({
+    decision: z5.literal("entry-condition-met"),
+    /** Who attests. */
+    actor: z5.string(),
+    /** What makes the entry condition hold, in the attester's own words. */
+    evidence: z5.string()
+  }).strict(),
+  z5.object({
+    decision: z5.literal("override"),
+    /** Who is opening it anyway. */
+    actor: z5.string(),
+    /** Why, in the operator's own words. */
+    reason: z5.string()
+  }).strict()
+]);
+var PHASE_ENTRY_DECISION_KINDS = [
+  "entry-condition-met",
+  "override"
+];
+var PHASE_CLOSE_DECISION_KINDS = ["phase-closed", "phase-close-override"];
+var phaseDecisionKindSchema = z5.enum([
+  ...PHASE_ENTRY_DECISION_KINDS,
+  ...PHASE_CLOSE_DECISION_KINDS
+]);
+var openPhaseRequestSchema = z5.object({
+  phase: phaseNameSchema.nullable(),
+  entry: phaseEntryDecisionSchema
+}).strict();
+var phaseEntryDecisionRecordSchema = z5.object({
+  decisionId: z5.string(),
+  decision: z5.enum(PHASE_ENTRY_DECISION_KINDS),
+  actor: z5.string(),
+  /** The evidence (attestation) or the reason (override) — one basis per row. */
+  justification: z5.string(),
+  blockingFinding: z5.string().nullable(),
+  decidedAt: utcIso86012
+}).strict();
+var openPhaseResponseSchema = z5.object({
+  engagement: engagementStatusResponseSchema,
+  /** What is open now. `null` is project scope. */
+  phase: z5.string().nullable(),
+  /** What was open before this decision. `null` is project scope. */
+  previousPhase: z5.string().nullable(),
+  decision: phaseEntryDecisionRecordSchema
+}).strict();
+
 // ../events/dist/crew.js
 import { z as z6 } from "zod";
 var crewGroupSchema = z6.enum(["builder", "reviewer", "always-on"]);
@@ -841,7 +1063,7 @@ var CREW_CALLSIGNS = CREW_ROSTER.map((member) => member.callsign);
 
 // ../events/dist/device-auth.js
 import { z as z7 } from "zod";
-var utcIso86014 = z7.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
+var utcIso86013 = z7.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var DEVICE_AUTH_STATUS = {
   /** The poll: minted, nobody has acted yet. Keep polling. 200. */
   PENDING: "pending",
@@ -886,7 +1108,7 @@ var deviceAuthStartResponseSchema = z7.object({
   deviceCode: z7.string().min(1),
   userCode: z7.string().min(1),
   verificationUrl: z7.string().min(1),
-  expiresAt: utcIso86014,
+  expiresAt: utcIso86013,
   pollIntervalMs: z7.number().int().positive()
 }).strict();
 var devicePollPendingSchema = z7.object({
@@ -897,7 +1119,7 @@ var devicePollApprovedSchema = z7.object({
   status: z7.literal(DEVICE_AUTH_STATUS.APPROVED),
   accountId: z7.string().min(1),
   credential: z7.string().min(1),
-  expiresAt: utcIso86014
+  expiresAt: utcIso86013
 }).strict();
 var deviceAuthRefusalSchema = z7.object({
   status: z7.enum([
@@ -961,86 +1183,25 @@ function loopbackVerificationUrl(verificationUrl, target) {
 import { z as z8 } from "zod";
 var NOT_THIS_ACCOUNT_REASON = "not-this-account";
 var JOIN_REFUSAL_STATUS = 403;
-var notThisAccountRefusalSchema = z8.object({
-  statusCode: z8.literal(JOIN_REFUSAL_STATUS),
-  error: z8.string(),
-  message: z8.string(),
-  reason: z8.literal(NOT_THIS_ACCOUNT_REASON)
-}).strict();
-var joinRefusalSchema = z8.union([notThisAccountRefusalSchema, wireErrorSchema]);
-function isNotThisAccountRefusal(body) {
-  return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
-}
-
-// ../events/dist/account-identity.js
-import { z as z9 } from "zod";
-var accountIdentitySchema = z9.object({
-  accountId: z9.string().min(1),
-  email: z9.string().min(1).optional()
-}).strict();
-function safeParseAccountIdentity(payload) {
-  return accountIdentitySchema.safeParse(payload);
-}
-
-// ../events/dist/phase-identity.js
-var PHASE_SEGMENT_PREFIX = "phase-";
-function isValidPhaseIdentity(identity) {
-  if (typeof identity === "number")
-    return Number.isInteger(identity) && identity >= 0;
-  if (typeof identity !== "string")
-    return false;
-  if (identity === "")
-    return false;
-  if (identity.includes("/"))
-    return false;
-  if (identity.includes("\\"))
-    return false;
-  if (identity.includes("\0"))
-    return false;
-  if (identity.startsWith("."))
-    return false;
-  return true;
-}
-var InvalidPhaseIdentityError = class extends Error {
-  /** The value that was refused, exactly as supplied. */
-  identity;
-  constructor(identity, allowedLocation) {
-    const subject = allowedLocation === void 0 ? "a file" : "a Build Record";
-    const where = allowedLocation === void 0 ? "" : `
-  Records are written only into ${allowedLocation.replace(/\\/g, "/")}/. Nothing was written.`;
-    super(`that phase identity cannot name ${subject}.
-  identity: ${describeIdentity(identity)}` + where);
-    this.name = "InvalidPhaseIdentityError";
-    this.identity = identity;
-  }
-};
-function assertValidPhaseIdentity(identity, allowedLocation) {
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity, allowedLocation);
-  }
-}
-function renderPhaseSegment(identity) {
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity);
-  }
-  return `${PHASE_SEGMENT_PREFIX}${identity}`;
+var notThisAccountRefusalSchema = z8.object({
+  statusCode: z8.literal(JOIN_REFUSAL_STATUS),
+  error: z8.string(),
+  message: z8.string(),
+  reason: z8.literal(NOT_THIS_ACCOUNT_REASON)
+}).strict();
+var joinRefusalSchema = z8.union([notThisAccountRefusalSchema, wireErrorSchema]);
+function isNotThisAccountRefusal(body) {
+  return typeof body === "object" && body !== null && body.reason === NOT_THIS_ACCOUNT_REASON;
 }
-function describeIdentity(identity) {
-  if (identity === "")
-    return "(empty)";
-  if (typeof identity === "string")
-    return identity;
-  if (identity === null)
-    return "null";
-  if (identity === void 0)
-    return "none supplied";
-  if (typeof identity === "number" || typeof identity === "boolean")
-    return String(identity);
-  if (Array.isArray(identity))
-    return "(a list)";
-  if (typeof identity === "object")
-    return "(an object)";
-  return `(a ${typeof identity})`;
+
+// ../events/dist/account-identity.js
+import { z as z9 } from "zod";
+var accountIdentitySchema = z9.object({
+  accountId: z9.string().min(1),
+  email: z9.string().min(1).optional()
+}).strict();
+function safeParseAccountIdentity(payload) {
+  return accountIdentitySchema.safeParse(payload);
 }
 
 // ../events/dist/credential-wire.js
@@ -1054,10 +1215,47 @@ var engagementCredentialResponseSchema = z10.object({
 }).strict();
 var ciTokenExchangeResponseSchema = z10.object({
   token: z10.string(),
-  expiresAt: utcIso86013,
+  expiresAt: utcIso8601,
   engagementId: z10.string()
 }).strict();
 
+// ../events/dist/phase-record.js
+import { z as z11 } from "zod";
+var phaseRecordRefusalReasonSchema = z11.enum([
+  "still-open",
+  "reopened",
+  "never-opened",
+  "never-closed",
+  "closed-before-records"
+]);
+var phaseRecordRecordSchema = z11.object({
+  outcome: z11.literal("record"),
+  phase: phaseNameSchema,
+  record: buildRecordV2Schema
+}).strict().refine((body) => body.record.phase === body.phase, {
+  message: "the record is for a different phase than the one asked for",
+  path: ["record", "phase"]
+});
+var phaseRecordWithheldSchema = z11.object({
+  outcome: z11.literal("withheld"),
+  phase: phaseNameSchema,
+  sequence: z11.number().int().min(1),
+  closedAt: utcIso8601,
+  message: z11.string()
+}).strict();
+var phaseRecordRefusedSchema = wireErrorSchema.extend({
+  outcome: z11.literal("refused"),
+  phase: phaseNameSchema,
+  statusCode: z11.literal(409),
+  error: z11.literal("PhaseRecordRefused"),
+  reason: phaseRecordRefusalReasonSchema
+}).strict();
+var phaseRecordResponseSchema = z11.discriminatedUnion("outcome", [
+  phaseRecordRecordSchema,
+  phaseRecordWithheldSchema,
+  phaseRecordRefusedSchema
+]);
+
 // dist/engagement-credential.js
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { platform as platform2 } from "node:os";
@@ -2989,12 +3187,12 @@ function escapeHtml(value) {
 }
 function completionPage(result, engagementId) {
   const approved = result === LOOPBACK_RESULT.APPROVED;
-  const headline = approved ? "Signed in. You can close this tab and return to your terminal." : "Sign-in declined. Nothing was created. You can close this tab.";
+  const headline2 = approved ? "Signed in. You can close this tab and return to your terminal." : "Sign-in declined. Nothing was created. You can close this tab.";
   const onward = approved ? onwardTarget(engagementId) : null;
   const href = onward === null ? "" : escapeHtml(onward.href);
   const refresh = onward === null ? "" : `<meta http-equiv="refresh" content="${COMPLETION_REDIRECT_SECONDS};url=${href}">`;
   const successLink = onward === null ? "" : `<p><a href="${href}" style="color:#19d3ff">${escapeHtml(onward.label)}</a></p>`;
-  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="referrer" content="no-referrer">' + refresh + `<title>Halfcycle</title></head><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0a;color:#fafafa;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif"><div style="max-width:26rem;padding:2rem;text-align:center"><p>${headline}</p>${successLink}</div></body></html>`;
+  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="referrer" content="no-referrer">' + refresh + `<title>Halfcycle</title></head><body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0a0a0a;color:#fafafa;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif"><div style="max-width:26rem;padding:2rem;text-align:center"><p>${headline2}</p>${successLink}</div></body></html>`;
 }
 function isLoopbackPeer(remoteAddress) {
   if (remoteAddress === void 0)
@@ -4220,193 +4418,250 @@ async function probeMcpOrigin(mcpUrl) {
   return { reached: true, serverName: name };
 }
 
-// dist/build-record/types.js
-var BUILD_RECORD_FORMAT = "halfcycle-build-record/v1";
-function projectSeedGuard(fired, includeExplanation) {
-  const seed = {
-    patternRef: fired.patternRef,
-    severity: fired.severity
-  };
-  if (includeExplanation && fired.explanation)
-    seed.explanation = fired.explanation;
-  return seed;
-}
-
-// dist/build-record/sources.js
-import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
-import { createHash as createHash3 } from "node:crypto";
-import { join as join8 } from "node:path";
+// dist/build-record/write.js
+import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeSync } from "node:fs";
+import { basename as basename2, join as join6, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
 
-// dist/build-record/close-record.js
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
-var CLOSE_RECORD_FORMAT = "halfcycle-phase-close/v1";
-var BUILD_RECORD_ZONE_B_DIR = join6(ZONE_B_DIR, "build-record");
-var InvalidCloseRecordError = class extends Error {
-  constructor(path, detail) {
-    super(`[build-record] the phase close record at ${path} cannot be read \u2014 ${detail}`);
-    this.name = "InvalidCloseRecordError";
-  }
-};
-function closeRecordPath(repoRoot, phase) {
-  assertValidPhaseIdentity(phase, BUILD_RECORD_ZONE_B_DIR);
-  return join6(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phase)}.close.json`);
-}
-function resolveCloseAtHead(repoRoot) {
-  try {
-    const closeCommit = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--short", "HEAD"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    const closedDate = execFileSync3("git", ["-C", repoRoot, "show", "-s", "--format=%cs", "HEAD"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (closeCommit === "" || closedDate === "")
-      return null;
-    return { closeCommit, closedDate };
-  } catch {
-    return null;
+// dist/build-record/render-v2.js
+var HIDDEN = /[\p{Cc}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/u;
+var MARKDOWN_SPECIAL = /* @__PURE__ */ new Set(["\\", "`", "*", "_", "[", "]", "<", "|", "~", "#", "&", "$"]);
+function printRecordText(text) {
+  if (text === "")
+    return "(blank)";
+  let out = "";
+  for (const ch of text) {
+    if (HIDDEN.test(ch)) {
+      out += `U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}`;
+    } else if (MARKDOWN_SPECIAL.has(ch)) {
+      out += `\\${ch}`;
+    } else {
+      out += ch;
+    }
   }
+  return out;
 }
-function writeCloseRecord(repoRoot, phase) {
-  let path;
-  try {
-    path = closeRecordPath(repoRoot, phase);
-  } catch (err) {
-    return { recorded: false, path: null, reason: err instanceof Error ? err.message : String(err) };
-  }
-  const at = resolveCloseAtHead(repoRoot);
-  if (at === null) {
-    return {
-      recorded: false,
-      path,
-      reason: `the commit could not be read from ${repoRoot} \u2014 there is no git available, no repository there, or no commit in it yet`
-    };
-  }
-  const record2 = {
-    format: CLOSE_RECORD_FORMAT,
-    phase,
-    closeCommit: at.closeCommit,
-    closedDate: at.closedDate
+function makePrinter() {
+  let hidden = false;
+  return {
+    text(value) {
+      if (!hidden && HIDDEN.test(value))
+        hidden = true;
+      return printRecordText(value);
+    },
+    sawHidden() {
+      return hidden;
+    }
   };
-  try {
-    mkdirSync5(dirname3(path), { recursive: true });
-    writeFileSync5(path, JSON.stringify(record2, null, 2) + "\n", "utf-8");
-  } catch (err) {
-    return { recorded: false, path, reason: err instanceof Error ? err.message : String(err) };
-  }
-  return { recorded: true, path, closeCommit: at.closeCommit, closedDate: at.closedDate };
 }
-function parseCloseRecord(path, parsed) {
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new InvalidCloseRecordError(path, "it does not hold a record");
-  }
-  const record2 = parsed;
-  if (record2.format !== CLOSE_RECORD_FORMAT) {
-    throw new InvalidCloseRecordError(path, `it is not a ${CLOSE_RECORD_FORMAT} record (it says ${JSON.stringify(record2.format)})`);
-  }
-  const commit = record2.closeCommit;
-  const date = record2.closedDate;
-  const missing = [];
-  if (typeof commit !== "string" || commit.trim() === "")
-    missing.push("closeCommit");
-  if (typeof date !== "string" || date.trim() === "")
-    missing.push("closedDate");
-  if (missing.length > 0) {
-    throw new InvalidCloseRecordError(path, `${missing.join(" and ")} ${missing.length === 1 ? "is" : "are"} not recorded in it. A close records the commit and its date together or records neither, so a file carrying one of them was edited by hand.`);
+function counted(n, one, many) {
+  return `${String(n)} ${n === 1 ? one : many}`;
+}
+var TITLE_PREFIX = "# Build Record: ";
+var HEADER_WHAT = "This is the Build Record for one phase of a software project run with the Halfcycle method. A phase is a stage of the work with an agreed finish line; this record says how this one ended.";
+var HEADER_REGISTERS = "Two kinds of content are kept apart here. Lines under **Observed by Halfcycle** come from Halfcycle's own records, made as the work happened. Lines under **Stated by the client** are quoted, and are the client's own word: Halfcycle did not check them. Halfcycle witnessed the method being run. The client attests the code.";
+var HEADER_KEPT = "Halfcycle derived this record and kept it when the phase closed, and changes it afterwards in one way only: if an account that closed this phase is later deleted, its email is removed, and so is the name given at any close Halfcycle recorded as made by that account. The client's Halfcycle command-line tool wrote this file from that kept copy when the phase closed or when it was fetched again, so a later deletion changes the kept copy and reaches this file at the next fetch; the same record, as data, is in the .json file of the same name beside this one. If the phase is closed again, this file is replaced by a new record that describes every close, this one included.";
+var HEADER_HIDDEN = "Some text in this record contains characters that do not print. Each is shown as U+ and its code of four or more hex digits; the .json file holds the text exactly.";
+var OBSERVED_LABEL = "**Observed by Halfcycle**";
+var STATED_LABEL = "**Stated by the client** \u2014 Halfcycle did not check these.";
+var MISMATCHED_HALVES = "This Build Record could not be written: its two parts describe different closes.";
+function renderChecks(checks, p) {
+  const blocks = ["## Checks during this phase", OBSERVED_LABEL];
+  if (checks.state === "not-observed") {
+    blocks.push("**Nothing was observed.** Halfcycle has no record of any check running during this phase, so this record cannot say whether the work had problems. This is not a clean result.");
+    return blocks;
+  }
+  const runs = counted(checks.runs, "check run", "check runs");
+  if (checks.state === "nothing-fired") {
+    blocks.push(`**Checks ran and found nothing.** Halfcycle recorded ${runs} during this phase, and no check found a problem.`);
+  } else {
+    blocks.push(`**Checks found problems.** Halfcycle recorded ${runs} during this phase. Each check that found something is listed by what it checks, in plain words, then how serious it is, what it found, and the name your terminal prints for it.`);
+    blocks.push(renderFired(checks.fired, p));
   }
-  if (typeof record2.phase !== "string" && typeof record2.phase !== "number") {
-    throw new InvalidCloseRecordError(path, "it does not say which phase closed");
+  if (checks.couldNotRun.length === 0) {
+    blocks.push("No check reported that it could not run.");
+  } else {
+    blocks.push("**Some checks could not run.** They neither passed nor failed during this phase:");
+    blocks.push(renderCouldNotRun(checks.couldNotRun, p));
   }
-  return {
-    format: CLOSE_RECORD_FORMAT,
-    phase: record2.phase,
-    closeCommit: commit,
-    closedDate: date
-  };
+  return blocks;
 }
-
-// dist/build-record/write.js
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename2, join as join7, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
-
-// dist/build-record/template.js
-function severityLabel(seed) {
-  return `\`${seed.patternRef}\` (severity \`${seed.severity}\`)`;
+function renderFired(fired, p) {
+  const lines = [];
+  for (const entry of fired) {
+    lines.push(entry.description === null ? "- Check: A check found something here, and no plain-language description of it is on record." : `- Check: ${p.text(entry.description)}`);
+    lines.push(`  - Seriousness: ${seriousness(entry.severity)}`);
+    lines.push(`  - Found: ${counted(entry.occurrences, "time", "times")} during this phase.`);
+    lines.push(`  - What it found: ${entry.explanation === null ? "Not included in this record." : p.text(entry.explanation)}`);
+    lines.push(`  - The name your terminal prints for this check: ${p.text(entry.check)}`);
+  }
+  return lines.join("\n");
 }
-var NOT_RECORDED = "not recorded";
-function renderCloseLine(record2) {
-  const status = `**Status:** ${record2.status.toUpperCase()}`;
-  const closed = `**Closed:** ${record2.closedDate ?? NOT_RECORDED}`;
-  const commit = record2.closeCommit === null ? `**Close commit:** ${NOT_RECORDED}` : `**Close commit:** \`${record2.closeCommit}\``;
-  return `${status} \xB7 ${closed} \xB7 ${commit}`;
+function seriousness(severity) {
+  switch (severity) {
+    case "block":
+      return "serious, it blocks the work.";
+    case "warn":
+      return "a warning.";
+    case "info":
+      return "for information only.";
+  }
 }
-function renderCloseProvenance(record2) {
-  return record2.closeCommit === null && record2.closedDate === null ? "*The close date and the commit were not recorded when this phase closed, so this record does not name them. Nothing has been substituted for them.*" : "*The close date and the commit are the client's own assertion about their own repository, written down when the phase was closed. Halfcycle did not observe them and does not check them.*";
+function renderCouldNotRun(entries, p) {
+  const lines = [];
+  for (const entry of entries) {
+    lines.push(entry.description === null ? "- Check: A check could not run here, and no plain-language description of it is on record." : `- Check: ${p.text(entry.description)}`);
+    lines.push(`  - Why it could not run: ${p.text(entry.reason)}`);
+    lines.push(`  - The name your terminal prints for this check: ${p.text(entry.check)}`);
+  }
+  return lines.join("\n");
 }
-function renderDoneWhenRows(record2) {
-  const rows = [];
-  for (const [key, dw] of Object.entries(record2.acceptance.doneWhen)) {
-    const mark = dw.result === "pass" ? "\u2705" : dw.result === "dropped" ? "\u2014" : dw.result;
-    rows.push(`| ${key} | ${mark} | ${dw.detail} |`);
+function headline(observed, attested) {
+  const met = attested.decision === "done-when-met";
+  switch (observed.crossed.kind) {
+    case "none":
+      return met ? "**Closed cleanly.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met." : "**Closed by override.** Halfcycle saw nothing outstanding, and the person closing the phase chose to override rather than state its finish conditions were met.";
+    case "unfinished-steps":
+    case "clean-over-findings":
+      return met ? "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase stated its finish conditions were met anyway." : "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase chose to override it.";
+    case "not-recorded":
+      return met ? "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase stated its finish conditions were met." : "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase chose to override.";
+  }
+}
+function closedAtText(closedAt, p) {
+  const m = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(?:\.\d+)?Z$/.exec(closedAt);
+  return m === null ? p.text(closedAt) : `${m[1]} ${m[2]} UTC`;
+}
+function signedInAs(closedBy, p) {
+  switch (closedBy.kind) {
+    case "account":
+      return closedBy.email === null ? "an account with no email address on file" : `the account ${p.text(closedBy.email)}`;
+    case "no-account":
+      return "a credential not linked to any person's account";
+    case "account-removed":
+      return "an account that has since been deleted";
+    case "not-recorded":
+      return "not recorded for this close";
+  }
+}
+function outstanding(crossed, p) {
+  switch (crossed.kind) {
+    case "none":
+      return ["- Outstanding work Halfcycle could see: none."];
+    case "not-recorded":
+      return ["- Outstanding work Halfcycle could see: not recorded for this close."];
+    case "clean-over-findings":
+      return [
+        `- Outstanding work Halfcycle could see: ${counted(crossed.findings, "problem", "problems")} recorded against this phase.`
+      ];
+    case "unfinished-steps":
+      return [
+        `- Outstanding work Halfcycle could see: ${counted(crossed.steps.length, "step", "steps")} of the method left unfinished. Each is shown by the method's own label for it:`,
+        ...crossed.steps.map((step) => `  - Step: ${p.text(step.stepId)} \u2014 ${step.state === "failed" ? "failed" : "set aside unfinished"}`)
+      ];
+  }
+}
+function machines(coverage) {
+  const label = "- Machines signed in on this project at the close: ";
+  if (coverage === null)
+    return `${label}not recorded.`;
+  if (coverage.enrolled === 0)
+    return `${label}none.`;
+  return `${label}${String(coverage.enrolled)}, of which ${String(coverage.conformant)} had Halfcycle's checks working as set up.`;
+}
+function walkLines(walk, p) {
+  const label = "> - Acceptance walk (the finished work tried as a user would, by someone other than its builder): ";
+  if (walk === null)
+    return [`${label}none reported.`];
+  const lines = [
+    `${label}${walk.verdict === "clean" ? "reported as finding no problems." : "reported as finding problems."}`
+  ];
+  walk.findings.forEach((finding, i) => {
+    lines.push(`>   - Finding ${String(i + 1)}: ${p.text(finding)}`);
+  });
+  if (walk.findingsNotShown > 0) {
+    lines.push(`>   - And ${counted(walk.findingsNotShown, "more finding", "more findings")} not shown here.`);
   }
-  return rows.join("\n");
+  return lines;
+}
+function statedOrNot(value, p) {
+  return value === null ? "Not stated by the client." : p.text(value);
 }
-function renderBuildRecordMarkdown(record2) {
-  const { phase } = record2;
-  const companion = `${renderPhaseSegment(phase.id)}.json`;
-  const guardsList = record2.seedGuards.map(severityLabel).join(", ");
+function renderStated(attested, p) {
   const lines = [
-    // Fixed prose (vault-canonical template) + projected title slots.
-    `# Build Record \u2014 Phase ${phase.id}: ${phase.name}`,
-    "",
-    `**Format:** \`${record2.format}\` (markdown + JSON pair; portable, readable without Halfcycle systems)`,
-    "",
-    "> This Build Record was assembled automatically at phase close by `npx halfcycle close-phase`. Every data field below is projected from the companion JSON \u2014 no record content is hand-authored.",
-    "",
-    `**Engagement:** ${record2.engagement} (${record2.engagementType})`,
-    `**Phase:** ${phase.id} \u2014 ${phase.name}`,
-    renderCloseLine(record2),
-    `**Companion:** [\`${companion}\`](${companion})`,
-    "",
-    renderCloseProvenance(record2),
-    "",
-    "## What this phase proved",
-    "",
-    `${record2.thesis} **Thesis held: ${record2.thesisHeld ? "yes" : "no"}.**`,
-    "",
-    "## Delivered",
-    "",
-    `- **Packages:** ${record2.delivered.packages.join(", ")}`,
-    `- **Services:** ${record2.delivered.services.join(", ")}`,
-    `- **Tools:** ${record2.delivered.tools.join(", ")}`,
-    `- **Dogfood:** ${record2.delivered.dogfood}`,
-    "",
-    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guard firing was recorded on this machine during this phase.",
-    "",
-    `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
-    "",
-    `**Verdict:** ${record2.acceptance.verdict} \xB7 **Findings:** ${record2.acceptance.findings}`,
-    "",
-    "| Done-when | Result | Evidence |",
-    "|---|---|---|",
-    renderDoneWhenRows(record2),
-    ""
+    attested.decision === "done-when-met" ? "> - Decision: the phase's agreed finish conditions were met." : "> - Decision: close the phase by override, without stating its finish conditions were met.",
+    `> - Name given: ${attested.actor === null ? "removed with the account that made this close" : p.text(attested.actor)}`,
+    `> - Reason given: ${attested.reason === null ? "none." : p.text(attested.reason)}`,
+    ...walkLines(attested.walk, p),
+    `> - Code closed at (commit): ${statedOrNot(attested.closeCommit, p)}`,
+    `> - What the phase set out to prove: ${statedOrNot(attested.statements.thesis, p)}`,
+    `> - What came out of it: ${statedOrNot(attested.statements.outcome, p)}`
   ];
-  if (record2.acceptance.inv002ProdBypassProbe) {
-    lines.push(`**Production bypass probe:** ${record2.acceptance.inv002ProdBypassProbe.result} \u2014 ${record2.acceptance.inv002ProdBypassProbe.detail}`, "");
+  const deviations = attested.statements.deviations;
+  if (deviations.length === 0) {
+    lines.push("> - Changes from the plan: None stated by the client.");
+  } else {
+    lines.push("> - Changes from the plan:");
+    deviations.forEach((deviation, i) => {
+      lines.push(`>   - Change ${String(i + 1)}: ${p.text(deviation)}`);
+    });
   }
-  lines.push("## Gates that earned their keep", "", `**${record2.gatesEarnedKeep.defectsCaughtPreHuman}** defects were caught by the gates before the human walk; the walk itself found **${record2.gatesEarnedKeep.bugsReachingHumanWalk}**. Named: ${record2.gatesEarnedKeep.named.join("; ")}.`, "", "## Instruments", "", `- **Marginal-cost self-accounting:** ${record2.instruments.marginalCostSelfAccounting}`, `- **COE add-rate:** seam-new ${record2.instruments.coeAddRate.seamNew}, seam-repeat ${record2.instruments.coeAddRate.seamRepeat}, model-limitation ${record2.instruments.coeAddRate.modelLimitation}. ${record2.instruments.coeAddRate.notes}`, "", "## Invariants exercised", "", record2.invariantsExercised.join(", "), "", "## Deviations & decisions recorded", "", ...record2.deviations.map((d) => `- ${d}`), "", "## Tasks", "", `- **Planned:** ${record2.tasks.planned} \xB7 **Landed:** ${record2.tasks.landed} \xB7 **Cancelled:** ${record2.tasks.cancelled.length > 0 ? record2.tasks.cancelled.join(", ") : "none"}`, "");
   return lines.join("\n");
 }
+function renderClose(heading, observed, attested, p) {
+  return [
+    heading,
+    headline(observed, attested),
+    OBSERVED_LABEL,
+    [
+      `- Closed at: ${closedAtText(observed.closedAt, p)}`,
+      `- Signed in as: ${signedInAs(observed.closedBy, p)}`,
+      ...outstanding(observed.crossed, p),
+      machines(observed.seatCoverage)
+    ].join("\n"),
+    STATED_LABEL,
+    renderStated(attested, p)
+  ];
+}
+function renderBuildRecordV2Markdown(record2) {
+  const p = makePrinter();
+  const attestedBySequence = /* @__PURE__ */ new Map();
+  for (const close of record2.attested.closes)
+    attestedBySequence.set(close.sequence, close);
+  const observedSequences = new Set(record2.observed.closes.map((c) => c.sequence));
+  if (attestedBySequence.size !== record2.attested.closes.length || observedSequences.size !== record2.observed.closes.length || attestedBySequence.size !== observedSequences.size || [...observedSequences].some((s) => !attestedBySequence.has(s))) {
+    throw new Error(MISMATCHED_HALVES);
+  }
+  const phase = p.text(record2.phase);
+  const closes = [...record2.observed.closes].sort((a, b) => a.sequence - b.sequence);
+  const total = closes.length;
+  const latest = closes[total - 1];
+  const body = [
+    `Phase: ${phase} (the name the client gave it)`,
+    OBSERVED_LABEL,
+    [
+      `- Method version: ${p.text(record2.observed.methodVersion)}. This is the version of the Halfcycle method the project was run under; it does not change during a project.`,
+      `- Halfcycle's reference for this project: ${p.text(record2.observed.engagementId)}`,
+      `- Record format: ${p.text(record2.format)}`
+    ].join("\n"),
+    total === 1 ? "This phase was closed once." : `This phase was closed ${String(total)} times. The latest close is described first; each earlier close follows, as it was recorded when it was made.`,
+    ...renderChecks(record2.observed.checks, p),
+    ...renderClose(total === 1 ? "## The close" : `## The latest close (close ${String(latest.sequence)} of ${String(total)})`, latest, attestedBySequence.get(latest.sequence), p)
+  ];
+  if (total > 1) {
+    body.push("## Earlier closes");
+    for (const close of closes.slice(0, -1)) {
+      body.push(...renderClose(`### Close ${String(close.sequence)} of ${String(total)}`, close, attestedBySequence.get(close.sequence), p));
+    }
+  }
+  const header = [`${TITLE_PREFIX}${phase}`, HEADER_WHAT, HEADER_REGISTERS, HEADER_KEPT];
+  if (p.sawHidden())
+    header.push(HEADER_HIDDEN);
+  return `${[...header, ...body].join("\n\n")}
+`;
+}
 
 // dist/build-record/write.js
-var BUILD_RECORD_DIR = join7("docs", "build-records");
-function serialiseRecordJson(record2) {
-  return JSON.stringify(record2, null, 2) + "\n";
-}
+var BUILD_RECORD_DIR = join6("docs", "build-records");
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve2(candidate));
   const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute2(rel) && rel === basename2(rel);
@@ -4414,230 +4669,221 @@ function assertInsideOutDir(outDir, candidate, identity) {
     throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
   }
 }
-function writeBuildRecord(repoRoot, record2) {
-  const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
-  const identity = record2.phase.id;
-  if (!isValidPhaseIdentity(identity)) {
-    throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
+function createExclusiveOnDisk(path, text) {
+  const fd = openSync(path, "wx");
+  try {
+    writeSync(fd, text);
+  } catch (err) {
+    closeSync(fd);
+    rmSync2(path, { force: true });
+    throw err;
   }
-  const segment = renderPhaseSegment(identity);
-  const jsonPath = join7(outDir, `${segment}.json`);
-  const mdPath = join7(outDir, `${segment}.md`);
-  assertInsideOutDir(outDir, jsonPath, identity);
-  assertInsideOutDir(outDir, mdPath, identity);
-  mkdirSync6(outDir, { recursive: true });
-  writeFileSync6(jsonPath, serialiseRecordJson(record2), "utf-8");
-  writeFileSync6(mdPath, renderBuildRecordMarkdown(record2), "utf-8");
-  return { jsonPath, mdPath };
+  closeSync(fd);
 }
-
-// dist/build-record/sources.js
-var MissingSourceError = class extends Error {
-  constructor(sourceName, detail) {
-    super(`[build-record] missing required source: ${sourceName} \u2014 ${detail}`);
-    this.name = "MissingSourceError";
-  }
+function renameOnDisk(from, to) {
+  renameSync(from, to);
+}
+var NODE_RECORD_PAIR_IO = {
+  createExclusive: createExclusiveOnDisk,
+  rename: renameOnDisk
 };
-function projectSeedGuards(runs) {
-  const byRef = /* @__PURE__ */ new Map();
-  for (const run of runs) {
-    if (!run.result)
-      continue;
-    for (const fired of run.result.guardsFired) {
-      const seed = projectSeedGuard(
-        fired,
-        /* includeExplanation */
-        false
-      );
-      const existing = byRef.get(seed.patternRef);
-      if (!existing) {
-        byRef.set(seed.patternRef, seed);
-      } else if (existing.severity !== seed.severity) {
-        byRef.set(seed.patternRef, pickHigherSeverity(existing, seed));
-      }
-    }
-  }
-  return [...byRef.values()].sort((a, b) => a.patternRef.localeCompare(b.patternRef));
+function serialiseServedRecord(rawRecord) {
+  return JSON.stringify(rawRecord, null, 2) + "\n";
 }
-var SEVERITY_ORDINAL = { info: 0, warn: 1, block: 2 };
-function pickHigherSeverity(a, b) {
-  return (SEVERITY_ORDINAL[a.severity] ?? -1) >= (SEVERITY_ORDINAL[b.severity] ?? -1) ? a : b;
+function isEexist(err) {
+  return typeof err === "object" && err !== null && err.code === "EEXIST";
 }
-function normalizeLegacyLine(parsed) {
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return parsed;
+function readIfPresent(path) {
+  try {
+    return readFileSync6(path, "utf-8");
+  } catch {
+    return null;
   }
-  const record2 = parsed;
-  if (record2["outcome"] !== void 0)
-    return parsed;
-  return {
-    ...record2,
-    runId: record2["runId"] ?? syntheticRunId(record2),
-    outcome: "evaluated"
-  };
 }
-function syntheticRunId(record2) {
-  const key = [
-    record2["engagementId"],
-    record2["occurredAt"],
-    record2["runType"],
-    record2["phase"]
-  ].join("|");
-  const hex = createHash3("sha256").update(`legacy-guard-eval-run:${key}`).digest("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
-}
-function readGuardEvalLog(logDir, phaseId) {
-  const logPath = join8(logDir, `${renderPhaseSegment(phaseId)}.jsonl`);
-  if (!existsSync4(logPath)) {
-    throw new MissingSourceError("guard-eval log", `no runner guard-eval log at ${logPath} for phase ${phaseId}`);
-  }
-  const raw = readFileSync6(logPath, "utf-8");
-  const runs = [];
-  for (const line of raw.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed === "")
-      continue;
-    const parsed = JSON.parse(trimmed);
-    runs.push(guardEvalRunSchema.parse(normalizeLegacyLine(parsed)));
+function isOwnEarlierRecord(existingText, served) {
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(existingText);
+  } catch {
+    return false;
   }
-  return runs;
+  const existing = buildRecordV2Schema.safeParse(parsedJson);
+  if (!existing.success)
+    return false;
+  const old = existing.data;
+  if (old.observed.engagementId !== served.observed.engagementId)
+    return false;
+  if (old.phase !== served.phase)
+    return false;
+  const oldCloses = old.observed.closes.length;
+  const newCloses = served.observed.closes.length;
+  if (oldCloses < newCloses)
+    return true;
+  if (oldCloses > newCloses)
+    return false;
+  const oldSequences = new Set(old.observed.closes.map((c) => c.sequence));
+  return served.observed.closes.every((c) => oldSequences.has(c.sequence));
 }
-function readOrchestrationState(phasesDir, phaseId) {
-  const statePath = join8(phasesDir, `${renderPhaseSegment(phaseId)}-orchestration-state.json`);
-  if (!existsSync4(statePath)) {
-    throw new MissingSourceError("orchestration state", `no orchestration-state file at ${statePath} for phase ${phaseId}`);
+function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_PAIR_IO) {
+  if (!isValidPhaseIdentity(phase)) {
+    throw new InvalidPhaseIdentityError(phase, BUILD_RECORD_DIR);
+  }
+  const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
+  const segment = renderPhaseSegment(phase);
+  const jsonPath = join6(outDir, `${segment}.json`);
+  const mdPath = join6(outDir, `${segment}.md`);
+  const jsonTmp = `${jsonPath}.tmp`;
+  const mdTmp = `${mdPath}.tmp`;
+  for (const candidate of [jsonPath, mdPath, jsonTmp, mdTmp]) {
+    assertInsideOutDir(outDir, candidate, phase);
+  }
+  const jsonText = serialiseServedRecord(rawRecord);
+  const mdText = renderBuildRecordV2Markdown(record2);
+  mkdirSync5(outDir, { recursive: true });
+  let createdJson = false;
+  try {
+    io.createExclusive(jsonPath, jsonText);
+    createdJson = true;
+    io.createExclusive(mdPath, mdText);
+    return { kind: "created", jsonPath, mdPath };
+  } catch (err) {
+    if (createdJson)
+      rmSync2(jsonPath, { force: true });
+    if (!isEexist(err))
+      throw err;
   }
-  const parsed = JSON.parse(readFileSync6(statePath, "utf-8"));
-  if (!parsed.tasks || typeof parsed.tasks !== "object") {
-    throw new MissingSourceError("orchestration state", `${statePath} has no tasks map`);
+  const existingJson = readIfPresent(jsonPath);
+  if (existingJson === null) {
+    return { kind: "in-the-way", path: existsSync4(jsonPath) ? jsonPath : mdPath };
   }
-  const tasks = {};
-  for (const [id, t] of Object.entries(parsed.tasks)) {
-    if (!t || typeof t.status !== "string") {
-      throw new MissingSourceError("orchestration state", `task ${id} has no status`);
-    }
-    tasks[id] = { status: t.status };
+  if (existingJson === jsonText) {
+    replaceOne(io, mdTmp, mdPath, mdText);
+    return { kind: "up-to-date", jsonPath, mdPath };
   }
-  return { tasks };
-}
-function readPhaseClose(repoRoot, phaseId) {
-  const path = closeRecordPath(repoRoot, phaseId);
-  if (!existsSync4(path))
-    return { closeCommit: null, closedDate: null };
-  let parsed;
+  if (!isOwnEarlierRecord(existingJson, record2)) {
+    return { kind: "in-the-way", path: jsonPath };
+  }
+  replaceOne(io, jsonTmp, jsonPath, jsonText);
   try {
-    parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    replaceOne(io, mdTmp, mdPath, mdText);
   } catch (err) {
-    throw new InvalidCloseRecordError(path, `it is not readable JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const record2 = parseCloseRecord(path, parsed);
-  if (renderPhaseSegment(record2.phase) !== renderPhaseSegment(phaseId)) {
-    throw new InvalidCloseRecordError(path, `it records the close of ${String(record2.phase)}, not of ${String(phaseId)}`);
+    try {
+      replaceOne(io, jsonTmp, jsonPath, existingJson);
+    } catch {
+      rmSync2(jsonPath, { force: true });
+    }
+    throw err;
   }
-  return { closeCommit: record2.closeCommit, closedDate: record2.closedDate };
+  return { kind: "replaced", jsonPath, mdPath };
 }
-function validateNarrated(narrated) {
-  const req = (v, name) => {
-    if (v === void 0 || v === null || v === "") {
-      throw new MissingSourceError("narrated artefact", `${name} is missing`);
-    }
-  };
-  req(narrated.engagement, "engagement");
-  req(narrated.engagementType, "engagementType");
-  req(narrated.phase?.name, "phase.name");
-  assertValidPhaseIdentity(narrated.phase?.id, BUILD_RECORD_DIR);
-  req(narrated.status, "status");
-  req(narrated.thesis, "thesis");
-  req(narrated.delivered, "delivered");
-  req(narrated.acceptance, "acceptance");
-  req(narrated.acceptance?.verdict, "acceptance.verdict");
-  req(narrated.gatesEarnedKeep, "gatesEarnedKeep");
-  req(narrated.instruments, "instruments");
-  if (!Array.isArray(narrated.deviations)) {
-    throw new MissingSourceError("narrated artefact", "deviations must be an array");
-  }
-  return narrated;
-}
-function loadSources(opts) {
-  const orchestration = readOrchestrationState(opts.phasesDir, opts.phaseId);
-  const guardEvalRuns = readGuardEvalLog(opts.guardEvalLogDir, opts.phaseId);
-  const close = readPhaseClose(opts.repoRoot, opts.phaseId);
-  const narrated = validateNarrated(opts.narrated);
-  if (!Array.isArray(opts.touchedInvariants)) {
-    throw new MissingSourceError("feature-spec Touches", "touchedInvariants must be an array");
+function replaceOne(io, tmp, finalPath, text) {
+  rmSync2(tmp, { force: true });
+  try {
+    io.createExclusive(tmp, text);
+    io.rename(tmp, finalPath);
+  } catch (err) {
+    rmSync2(tmp, { force: true });
+    throw err;
   }
-  return {
-    orchestration,
-    narrated,
-    close,
-    guardEvalRuns,
-    touchedInvariants: opts.touchedInvariants
-  };
 }
 
-// dist/build-record/assemble.js
-var LANDED_STATES = /* @__PURE__ */ new Set(["merged", "done"]);
-var CANCELLED_STATE = "cancelled";
-function deriveTasks(orchestration) {
-  const ids = Object.keys(orchestration.tasks);
-  const cancelled = ids.filter((id) => orchestration.tasks[id].status === CANCELLED_STATE).sort((a, b) => a.localeCompare(b));
-  const landed = ids.filter((id) => LANDED_STATES.has(orchestration.tasks[id].status)).length;
-  return { planned: ids.length, landed, cancelled };
-}
-function deriveThesisHeld(acceptance) {
-  if (acceptance.verdict !== "clean")
-    return false;
-  for (const dw of Object.values(acceptance.doneWhen)) {
-    if (dw.result === "dropped")
-      continue;
-    if (dw.result !== "pass")
-      return false;
-  }
-  return true;
+// dist/build-record/obtain.js
+import { relative as relative3 } from "node:path";
+var REFUSAL_FOLLOW_UP = {
+  "still-open": "Nothing was written. The record is produced when the phase closes.",
+  "reopened": "Nothing was written. A new record is produced when the phase closes again.",
+  "never-opened": "Nothing was written. Check the name: it must match the phase name exactly as it was opened.",
+  "never-closed": "Nothing was written.",
+  "closed-before-records": "Nothing was written."
+};
+var REFUSAL_REASONS = phaseRecordRefusalReasonSchema.options;
+function buildRecordUrl(credential, phase) {
+  return `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/phases/${encodeURIComponent(phase)}/build-record`;
 }
-function deriveInvariantsExercised(touched) {
-  return [...new Set(touched)].sort((a, b) => a.localeCompare(b));
+function isMissingRoute(status, body) {
+  if (status !== 404 || typeof body !== "object" || body === null)
+    return false;
+  const { error, message } = body;
+  return error === "Not Found" && typeof message === "string" && /^Route GET .* not found\.$/s.test(message);
 }
-function assembleBuildRecord(sources) {
-  const { narrated, close, orchestration } = sources;
+async function obtainBuildRecord(credential, repoRoot, phase, io = NODE_RECORD_PAIR_IO) {
+  const url = buildRecordUrl(credential, phase);
+  let res;
+  let text;
+  try {
+    res = await fetch(url, {
+      method: "GET",
+      headers: { authorization: `Bearer ${credential.token}` }
+    });
+    text = await res.text();
+  } catch (err) {
+    return {
+      kind: "unavailable",
+      why: `could not reach the Halfcycle service at ${url}: ${err instanceof Error ? err.message : String(err)}.`
+    };
+  }
+  let raw = null;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    raw = null;
+  }
+  const parsed = phaseRecordResponseSchema.safeParse(raw);
+  if (parsed.success) {
+    const answer = parsed.data;
+    if (answer.phase !== phase) {
+      return {
+        kind: "unavailable",
+        why: `the service answered for a different phase than the one asked for, so nothing was written.`
+      };
+    }
+    if (answer.outcome === "withheld")
+      return { kind: "withheld", message: answer.message };
+    if (answer.outcome === "refused") {
+      return { kind: "refused", reason: answer.reason, message: answer.message };
+    }
+    const rawRecord = raw.record;
+    let result;
+    try {
+      result = writeRecordPair(repoRoot, phase, rawRecord, answer.record, io);
+    } catch (err) {
+      return {
+        kind: "unavailable",
+        why: `the record arrived but could not be written: ${err instanceof Error ? err.message : String(err)}. Nothing was left half written.`
+      };
+    }
+    if (result.kind === "in-the-way") {
+      return { kind: "exists", path: relative3(repoRoot, result.path) };
+    }
+    return {
+      kind: "written",
+      jsonPath: relative3(repoRoot, result.jsonPath),
+      mdPath: relative3(repoRoot, result.mdPath)
+    };
+  }
+  if (isMissingRoute(res.status, raw)) {
+    return { kind: "unavailable", why: "this Halfcycle service does not provide Build Records yet." };
+  }
+  const message = typeof raw === "object" && raw !== null && typeof raw.message === "string" ? raw.message : null;
+  if (res.ok) {
+    return {
+      kind: "unavailable",
+      why: `the service's answer was not a Build Record this version of the CLI can read, so nothing was written.`
+    };
+  }
   return {
-    format: BUILD_RECORD_FORMAT,
-    engagement: narrated.engagement,
-    engagementType: narrated.engagementType,
-    phase: { id: narrated.phase.id, name: narrated.phase.name },
-    status: narrated.status,
-    closedDate: close.closedDate,
-    closeCommit: close.closeCommit,
-    thesis: narrated.thesis,
-    thesisHeld: deriveThesisHeld(narrated.acceptance),
-    delivered: narrated.delivered,
-    seedGuards: projectSeedGuards(sources.guardEvalRuns),
-    acceptance: narrated.acceptance,
-    gatesEarnedKeep: narrated.gatesEarnedKeep,
-    instruments: narrated.instruments,
-    invariantsExercised: deriveInvariantsExercised(sources.touchedInvariants),
-    deviations: narrated.deviations,
-    tasks: deriveTasks(orchestration)
+    kind: "unavailable",
+    why: `the service answered ${res.status}${message === null ? "." : `: ${message}`}`
   };
 }
-
-// dist/build-record/index.js
-function assemblePhaseBuildRecord(opts) {
-  const sources = loadSources({
-    repoRoot: opts.repoRoot,
-    phasesDir: opts.phasesDir,
-    guardEvalLogDir: opts.guardEvalLogDir,
-    phaseId: opts.phaseId,
-    narrated: opts.narrated,
-    touchedInvariants: opts.touchedInvariants
-  });
-  const record2 = assembleBuildRecord(sources);
-  return writeBuildRecord(opts.repoRoot, record2);
+function refetchCommand(phase) {
+  const quoted = /^[A-Za-z0-9._+-]+$/.test(phase) ? phase : `'${phase.replace(/'/g, `'\\''`)}'`;
+  return `npx halfcycle@latest build-record ${quoted}`;
 }
 
 // dist/open-phase.js
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join7 } from "node:path";
 var OpenPhaseRefused = class extends Error {
   status;
   finding;
@@ -4658,7 +4904,7 @@ function readRepoCredential(repoRoot, env = process.env, home) {
   if (pinned !== null)
     assertEngagementId(pinned);
   const fromStore = pinned === null ? null : readEngagementEnv(pinned, home);
-  const looked = pinned === null ? `${join9(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
+  const looked = pinned === null ? `${join7(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
   const values = {};
   for (const key of OPEN_PHASE_ENV_KEYS) {
     const value = (env[key] ?? fromStore?.[key] ?? "").trim();
@@ -4675,7 +4921,7 @@ function readRepoCredential(repoRoot, env = process.env, home) {
 }
 function readPinnedEngagementId(repoRoot) {
   try {
-    const pin = JSON.parse(readFileSync7(join9(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
+    const pin = JSON.parse(readFileSync7(join7(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
     const id = pin[PIN_ENGAGEMENT_ID_FIELD];
     return typeof id === "string" && id !== "" ? id : null;
   } catch {
@@ -4739,6 +4985,35 @@ async function openPhase(credential, phase, entry, home) {
 }
 
 // dist/close-phase.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+var NO_STATEMENTS = { thesis: null, outcome: null, deviations: [] };
+function readCloseCommit(repoRoot) {
+  if (repoRoot === void 0) {
+    return {
+      read: false,
+      reason: "no repository was named for this close, so there was nowhere to read a commit from"
+    };
+  }
+  let out;
+  try {
+    out = execFileSync3("git", ["-C", repoRoot, "rev-parse", "HEAD"], {
+      encoding: "utf-8",
+      env: gitEnvForNamedRepo(),
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch (err) {
+    const missingGit = typeof err === "object" && err !== null && err.code === "ENOENT";
+    return {
+      read: false,
+      reason: missingGit ? "git is not available on this machine" : "this folder is not a git repository, or it has no commit yet"
+    };
+  }
+  const checked = closeCommitSchema.safeParse(out);
+  if (!checked.success) {
+    return { read: false, reason: "git did not answer with a full commit hash" };
+  }
+  return { read: true, commit: checked.data };
+}
 var ClosePhaseRefused = class extends Error {
   status;
   finding;
@@ -4751,14 +5026,28 @@ var ClosePhaseRefused = class extends Error {
     this.name = "ClosePhaseRefused";
   }
 };
-async function closePhase(credential, phase, outcome, close, home, repoRoot) {
-  const parsed = acceptanceOutcomeSchema.safeParse(outcome);
-  if (!parsed.success) {
-    throw new Error(`[halfcycle] That is not an acceptance outcome this platform accepts: ${parsed.error.issues.map((i) => i.message).join("; ")}.`);
+var CloseRequestInvalid = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloseRequestInvalid";
   }
-  const parsedClose = phaseCloseDecisionSchema.safeParse(close);
-  if (!parsedClose.success) {
-    throw new Error(`[halfcycle] That is not a phase-close decision this platform accepts: ${parsedClose.error.issues.map((i) => `${i.path.join(".") || "(decision)"}: ${i.message}`).join("; ")}.`);
+};
+async function closePhase(credential, phase, outcome, close, home, repoRoot, stated = NO_STATEMENTS) {
+  const closeCommit = readCloseCommit(repoRoot);
+  const body = {
+    phase,
+    acceptanceOutcome: outcome,
+    close,
+    statements: {
+      thesis: stated.thesis,
+      outcome: stated.outcome,
+      deviations: stated.deviations,
+      closeCommit: closeCommit.read ? closeCommit.commit : null
+    }
+  };
+  const parsed = acceptPhaseRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CloseRequestInvalid(`that close is not one this platform accepts, so nothing was sent: ${parsed.error.issues.map((i) => `${describeIssuePath(i.path)}: ${i.message}`).join("; ")}.`);
   }
   const url = `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/accept`;
   let res;
@@ -4769,7 +5058,7 @@ async function closePhase(credential, phase, outcome, close, home, repoRoot) {
         "content-type": "application/json",
         authorization: `Bearer ${credential.token}`
       },
-      body: JSON.stringify({ phase, acceptanceOutcome: outcome, close })
+      body: JSON.stringify(body)
     });
   } catch (err) {
     throw new Error(`[halfcycle] Could not reach the Halfcycle service at ${url}: ${err instanceof Error ? err.message : String(err)}. The phase was not closed.`);
@@ -4781,17 +5070,24 @@ async function closePhase(credential, phase, outcome, close, home, repoRoot) {
     const code = typeof body2?.error === "string" ? body2.error : void 0;
     throw new ClosePhaseRefused(res.status, message, finding, code);
   }
-  const body = await res.json().catch(() => null);
-  if (!body || typeof body.engagementId !== "string" || typeof body.status !== "string") {
+  const answer = await res.json().catch(() => null);
+  if (!answer || typeof answer.engagementId !== "string" || typeof answer.status !== "string") {
     throw new Error(`[halfcycle] The response from ${url} did not carry { engagementId, status }. The phase may or may not have closed \u2014 read the engagement's status before retrying.`);
   }
-  const closeRecord = repoRoot === void 0 ? {
-    recorded: false,
-    path: null,
-    reason: "no repository was named for this close, so there was nowhere to read a commit from"
-  } : writeCloseRecord(repoRoot, phase);
   const stampFailure = writePhaseStamp(credential.engagementId, null, home);
-  return { engagementId: body.engagementId, status: body.status, stampFailure, closeRecord };
+  return { engagementId: answer.engagementId, status: answer.status, stampFailure, closeCommit };
+}
+function describeIssuePath(path) {
+  const [head, field] = path;
+  if (head === "statements" && field === "thesis")
+    return "--thesis";
+  if (head === "statements" && field === "outcome")
+    return "--outcome";
+  if (head === "statements" && field === "deviations")
+    return "--deviation";
+  if (head === "phase")
+    return "the phase name";
+  return path.map(String).join(".") || "(the close)";
 }
 
 // dist/cli-contract.js
@@ -4908,9 +5204,9 @@ var PLACEHOLDERS = {
 };
 
 // dist/uninstall.js
-import { lstatSync as lstatSync2, readFileSync as readFileSync8, readdirSync, rmSync as rmSync2, rmdirSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { lstatSync as lstatSync2, readFileSync as readFileSync8, readdirSync, rmSync as rmSync3, rmdirSync, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join10, relative as relative3, sep } from "node:path";
+import { dirname as dirname3, join as join8, relative as relative4, sep } from "node:path";
 var REMOVE_CREDENTIAL_FLAG = "--remove-credential";
 function parseUninstallArgs(args2) {
   let removeCredential = false;
@@ -4936,7 +5232,7 @@ function lexists(path) {
 function symlinkOnPath(root, rel) {
   let current = root;
   for (const segment of rel.split("/")) {
-    current = join10(current, segment);
+    current = join8(current, segment);
     try {
       if (lstatSync2(current).isSymbolicLink())
         return true;
@@ -4957,7 +5253,7 @@ var Refusal = class extends Error {
 function readMergedJson(targetRepo, rel) {
   if (symlinkOnPath(targetRepo, rel))
     return { state: "symlink" };
-  const path = join10(targetRepo, rel);
+  const path = join8(targetRepo, rel);
   if (!lexists(path))
     return { state: "absent" };
   let value;
@@ -4973,8 +5269,8 @@ function readMergedJson(targetRepo, rel) {
 }
 function validate(options) {
   const { targetRepo, removeCredential, home } = options;
-  const manifestPath = join10(targetRepo, INSTALL_MANIFEST_REL);
-  const pinPath = join10(targetRepo, BUNDLE_PIN_REL);
+  const manifestPath = join8(targetRepo, INSTALL_MANIFEST_REL);
+  const pinPath = join8(targetRepo, BUNDLE_PIN_REL);
   if (symlinkOnPath(targetRepo, INSTALL_MANIFEST_REL) || symlinkOnPath(targetRepo, BUNDLE_PIN_REL)) {
     throw new Refusal(`.halfcycle, or a file Halfcycle keeps in it, is a symbolic link here, so nothing was followed and nothing was removed.`);
   }
@@ -5018,8 +5314,8 @@ function validate(options) {
       throw new Refusal(`the project id in ${BUNDLE_PIN_REL} is not a valid Halfcycle project id, so it cannot name a folder on this machine. Nothing was removed, here or under ~/.halfcycle.`);
     }
     if (engagementId !== void 0) {
-      const expectedParent = join10(home ?? homedir2(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME);
-      if (dirname4(engagementStateDir(engagementId, home)) !== expectedParent) {
+      const expectedParent = join8(home ?? homedir2(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME);
+      if (dirname3(engagementStateDir(engagementId, home)) !== expectedParent) {
         throw new Refusal(`the project id in ${BUNDLE_PIN_REL} does not name a folder under ~/.halfcycle/engagements. Nothing was removed.`);
       }
     }
@@ -5170,7 +5466,7 @@ function trimGitignore(targetRepo, text, rec, writeSet) {
 }
 function coveredPathExists(targetRepo, line) {
   const path = line.trim().replace(/^\//, "").replace(/\/$/, "");
-  return path !== "" && lexists(join10(targetRepo, path));
+  return path !== "" && lexists(join8(targetRepo, path));
 }
 function uninstall(options) {
   const result = {
@@ -5228,7 +5524,7 @@ function uninstall(options) {
     removeRecordedFile(targetRepo, entry, writeSet, result, name);
   }
   for (const path of manifest.leftAlone) {
-    if (lexists(join10(targetRepo, path)))
+    if (lexists(join8(targetRepo, path)))
       name(result.leftAlone, path, path);
   }
   switch (removeLegacyCiStanza(targetRepo)) {
@@ -5260,10 +5556,10 @@ function uninstall(options) {
     const pinEntry = manifest.files.find((f) => f.path === BUNDLE_PIN_REL);
     if (pinEntry !== void 0)
       removeRecordedFile(targetRepo, pinEntry, writeSet, result, name);
-    else if (lexists(join10(targetRepo, BUNDLE_PIN_REL)))
+    else if (lexists(join8(targetRepo, BUNDLE_PIN_REL)))
       name(result.leftAlone, BUNDLE_PIN_REL, BUNDLE_PIN_REL);
     try {
-      rmSync2(join10(targetRepo, INSTALL_MANIFEST_REL), { force: true });
+      rmSync3(join8(targetRepo, INSTALL_MANIFEST_REL), { force: true });
       named.add(INSTALL_MANIFEST_REL);
     } catch {
       name(result.failed, INSTALL_MANIFEST_REL, INSTALL_MANIFEST_REL);
@@ -5293,14 +5589,14 @@ function applyMergedJson(targetRepo, rel, file, lists, name, edit) {
   const { changed, created, adopted, keptNote } = edit(value);
   if (keptNote !== void 0)
     name(lists.kept, keptNote, rel);
-  const path = join10(targetRepo, rel);
+  const path = join8(targetRepo, rel);
   const empty = Object.keys(value).length === 0;
   try {
     if (empty && created && !adopted) {
-      rmSync2(path);
+      rmSync3(path);
       name(lists.removed, rel, rel);
     } else if (changed) {
-      writeFileSync7(path, serializeJson(value), "utf-8");
+      writeFileSync5(path, serializeJson(value), "utf-8");
       name(lists.restored, rel, rel);
     }
     if (adopted && lexists(path)) {
@@ -5320,7 +5616,7 @@ function removeRecordedFile(targetRepo, entry, writeSet, lists, name) {
     name(lists.leftAlone, `${path} (a symbolic link, or inside one \u2014 not followed)`, path);
     return;
   }
-  const abs = join10(targetRepo, path);
+  const abs = join8(targetRepo, path);
   let isFile;
   try {
     isFile = lstatSync2(abs).isFile();
@@ -5345,7 +5641,7 @@ function removeRecordedFile(targetRepo, entry, writeSet, lists, name) {
     }
   }
   try {
-    rmSync2(abs);
+    rmSync3(abs);
     name(lists.removed, path, path);
   } catch {
     name(lists.failed, path, path);
@@ -5354,7 +5650,7 @@ function removeRecordedFile(targetRepo, entry, writeSet, lists, name) {
 function removeEmptyCreatedDir(targetRepo, dir, writeSet, lists, name) {
   if (!writeSet.dirs.has(dir) || symlinkOnPath(targetRepo, dir))
     return;
-  const abs = join10(targetRepo, dir);
+  const abs = join8(targetRepo, dir);
   try {
     if (!lstatSync2(abs).isDirectory() || readdirSync(abs).length > 0)
       return;
@@ -5374,7 +5670,7 @@ function trimGitignoreFile(targetRepo, rec, writeSet, lists, name) {
     name(lists.leftAlone, `${GITIGNORE_REL} (a symbolic link \u2014 not followed)`, GITIGNORE_REL);
     return;
   }
-  const path = join10(targetRepo, GITIGNORE_REL);
+  const path = join8(targetRepo, GITIGNORE_REL);
   let before;
   try {
     before = readFileSync8(path, "utf-8");
@@ -5392,10 +5688,10 @@ function trimGitignoreFile(targetRepo, rec, writeSet, lists, name) {
     return;
   try {
     if (text === "" && rec.created) {
-      rmSync2(path);
+      rmSync3(path);
       name(lists.removed, GITIGNORE_REL, GITIGNORE_REL);
     } else {
-      writeFileSync7(path, text, "utf-8");
+      writeFileSync5(path, text, "utf-8");
       name(lists.restored, GITIGNORE_REL, GITIGNORE_REL);
     }
   } catch {
@@ -5421,8 +5717,8 @@ function handleCredential(options, checked) {
   try {
     if (lstatSync2(dir).isSymbolicLink())
       return { kind: "failed", dir, reason: "it is a symbolic link" };
-    rmSync2(engagementEnvPath(engagementId, home), { force: true });
-    rmSync2(notThisAccountMarkerPath(engagementId, home), { force: true });
+    rmSync3(engagementEnvPath(engagementId, home), { force: true });
+    rmSync3(notThisAccountMarkerPath(engagementId, home), { force: true });
     if (readdirSync(dir).length === 0)
       rmdirSync(dir);
   } catch (err) {
@@ -5435,16 +5731,16 @@ function filesUnder(root, rel) {
   const walk = (dirRel) => {
     let names;
     try {
-      if (!lstatSync2(join10(root, dirRel)).isDirectory())
+      if (!lstatSync2(join8(root, dirRel)).isDirectory())
         return;
-      names = readdirSync(join10(root, dirRel));
+      names = readdirSync(join8(root, dirRel));
     } catch {
       return;
     }
     for (const entry of names.sort()) {
       const childRel = `${dirRel}/${entry}`;
       try {
-        if (lstatSync2(join10(root, childRel)).isDirectory())
+        if (lstatSync2(join8(root, childRel)).isDirectory())
           walk(childRel);
         else
           out.push(childRel);
@@ -5458,7 +5754,7 @@ function filesUnder(root, rel) {
 }
 function shownPath(path, home) {
   const base = home ?? homedir2();
-  const rel = relative3(base, path);
+  const rel = relative4(base, path);
   const under = rel !== "" && !rel.startsWith("..") && !rel.startsWith(sep);
   return `${under ? `~/${rel.split(sep).join("/")}` : path}/`;
 }
@@ -5518,7 +5814,7 @@ function renderUninstallReport(result, home) {
 // dist/banner-facts.js
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { readFileSync as readFileSync9 } from "node:fs";
-import { basename as basename3, join as join11, resolve as resolve3 } from "node:path";
+import { basename as basename3, join as join9, resolve as resolve3 } from "node:path";
 var BRAND_URL = "halfcycle.ai";
 var TAGLINE = [
   "Fewer cycles.",
@@ -5531,7 +5827,7 @@ var TAGLINE_NARROW = [
 ];
 function bundleVersion() {
   try {
-    const pkg = JSON.parse(readFileSync9(join11(BUNDLE_ROOT, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync9(join9(BUNDLE_ROOT, "package.json"), "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -5681,8 +5977,11 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
          --yes / -y: use this machine's saved sign-in without being asked
   halfcycle check-drift <target-repo>
   halfcycle build-record <phase> [--repo <root>]
+         fetch a closed phase's Build Record again and write it into docs/build-records/
   halfcycle open-phase <phase|--none> --actor "\u2026" (--evidence "\u2026" | --override --reason "\u2026") [--repo <root>]
   halfcycle close-phase <phase> --verdict <clean|defects> --actor "\u2026" [--finding "\u2026"]\u2026 [--override --reason "\u2026"] [--repo <root>]
+         [--thesis "\u2026"] [--outcome "\u2026"] [--deviation "\u2026"]\u2026
+         close the phase and write its Build Record into docs/build-records/
   halfcycle uninstall [${REMOVE_CREDENTIAL_FLAG}]
          take out what the installer added to this project, keeping anything you changed
          ${REMOVE_CREDENTIAL_FLAG}: also remove this machine's credential for the project, which every
@@ -5695,7 +5994,7 @@ var USAGE = `  halfcycle [install] [target-repo] [engagement-id] [self-build|cli
 `;
 function isHalfcycleMonorepo(dir) {
   try {
-    const pkg = JSON.parse(readFileSync10(join12(dir, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync10(join10(dir, "package.json"), "utf-8"));
     return pkg.name === "halfcycle-monorepo";
   } catch {
     return false;
@@ -6002,31 +6301,24 @@ ${USAGE}`);
     return;
   }
   if (cmd === "build-record") {
-    const phaseArg = rest[0];
-    const repoRoot = rest.includes("--repo") ? rest[rest.indexOf("--repo") + 1] : process.cwd();
+    const phaseArg = firstPositional(rest);
+    const repoRoot = flagValue(rest, "--repo") ?? process.cwd();
     if (phaseArg === void 0) {
       process.stderr.write("halfcycle: usage: halfcycle build-record <phase> [--repo <root>]\n");
       process.exit(1);
       return;
     }
-    const phaseId = phaseArg;
     try {
-      assertValidPhaseIdentity(phaseId, BUILD_RECORD_DIR);
-      const inputPath = join12(repoRoot, BUILD_RECORD_ZONE_B_DIR, `${renderPhaseSegment(phaseId)}.input.json`);
-      const input = JSON.parse(readFileSync10(inputPath, "utf-8"));
-      const result = assemblePhaseBuildRecord({
-        repoRoot,
-        phasesDir: join12(repoRoot, "docs", "phases"),
-        guardEvalLogDir: input.guardEvalLogDir ?? join12(repoRoot, ".workbench", "guard-eval-log"),
-        phaseId,
-        narrated: input.narrated,
-        touchedInvariants: input.touchedInvariants
-      });
-      process.stdout.write(`[halfcycle] Build Record written:
-  ${result.jsonPath}
-  ${result.mdPath}
-`);
-      process.exit(0);
+      assertValidPhaseIdentity(phaseArg, BUILD_RECORD_DIR);
+      const credential = readRepoCredential(repoRoot);
+      const obtained = await obtainBuildRecord(credential, repoRoot, phaseArg);
+      if (obtained.kind === "written") {
+        process.stdout.write(writtenLines(obtained));
+        process.exit(0);
+        return;
+      }
+      process.stderr.write(notWrittenLines("build-record", obtained, phaseArg));
+      process.exit(1);
     } catch (err) {
       process.stderr.write(`halfcycle build-record failed: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -6159,26 +6451,36 @@ halfcycle open-phase: a phase name has to work as a single folder name on this m
       process.exit(2);
       return;
     }
+    const stated = readStatementFlags(rest);
+    if (typeof stated === "string") {
+      process.stderr.write(`halfcycle close-phase: ${stated} needs a value after it.
+`);
+      process.exit(2);
+      return;
+    }
     try {
       const credential = readRepoCredential(repoRoot);
       const closed = await closePhase(credential, phaseArg, {
         verdict,
         findings: findingsDetail.length,
         findingsDetail
-      }, closeDecision, void 0, repoRoot);
+      }, closeDecision, void 0, repoRoot, stated);
       process.stdout.write(`[halfcycle] Phase "${phaseArg}" closed as ${verdict}${findingsDetail.length > 0 ? ` with ${findingsDetail.length} finding(s)` : ""} by ${closeDecision.actor}. The engagement is now ${closed.status}.
 `);
       if (closeDecision.decision === "override") {
         process.stdout.write(`[halfcycle] This close was an OVERRIDE: ${closeDecision.reason}
 `);
       }
-      if (closed.closeRecord.recorded) {
-        process.stdout.write(`[halfcycle] Closed at commit ${closed.closeRecord.closeCommit} (${closed.closeRecord.closedDate}). The Build Record for this phase will name it.
+      if (!closed.closeCommit.read) {
+        process.stderr.write(`halfcycle close-phase: the commit this phase closed at could not be read (${closed.closeCommit.reason}), so its Build Record shows the commit as not stated.
 `);
+      }
+      const obtained = await obtainBuildRecord(credential, repoRoot, phaseArg);
+      const recordWritten = obtained.kind === "written";
+      if (obtained.kind === "written") {
+        process.stdout.write(writtenLines(obtained));
       } else {
-        process.stderr.write(`halfcycle close-phase: the phase closed, but the commit it closed at was not recorded on this machine: ${closed.closeRecord.reason}
-halfcycle close-phase: this phase's Build Record will say the close commit and the close date were not recorded.
-`);
+        process.stderr.write(notWrittenLines("close-phase", obtained, phaseArg));
       }
       process.stdout.write(`[halfcycle] Open the next phase with: halfcycle open-phase <phase> --actor "you" --evidence "\u2026"
 `);
@@ -6186,21 +6488,28 @@ halfcycle close-phase: this phase's Build Record will say the close commit and t
         process.stderr.write(`halfcycle close-phase: the phase closed, but this machine's record of it could not be cleared: ${closed.stampFailure.reason}
 halfcycle close-phase: until ${closed.stampFailure.path} can be written, guard evaluations here are still filed under the phase you just closed.
 `);
-        process.exit(1);
-        return;
       }
-      process.exit(0);
+      process.exit(recordWritten && !closed.stampFailure ? 0 : 1);
     } catch (err) {
+      if (err instanceof CloseRequestInvalid) {
+        process.stderr.write(`halfcycle close-phase: ${err.message}
+`);
+        process.exit(2);
+        return;
+      }
       if (err instanceof ClosePhaseRefused) {
         process.stderr.write(`halfcycle close-phase: refused (${err.status}). ${err.message}
 `);
+        if (err.status === 400) {
+          process.stderr.write("halfcycle close-phase: Nothing was closed.\n");
+        }
         if (err.finding) {
           process.stderr.write(`halfcycle close-phase: outstanding work \u2014 ${err.finding}
 `);
           process.stderr.write(`halfcycle close-phase: close it anyway with \`halfcycle close-phase ${phaseArg} --verdict ${verdict} --actor "${closeActor}" --override --reason "\u2026"\` \u2014 recorded, not waived.
 `);
         } else if (err.code === "PhaseAlreadyClosed") {
-          process.stderr.write("halfcycle close-phase: this phase is already closed \u2014 open the next one instead of accepting it twice.\n");
+          process.stderr.write("halfcycle close-phase: to close a phase again, open it again first.\nhalfcycle close-phase: To get a closed phase's Build Record: npx halfcycle@latest build-record <the phase that closed>\n");
         }
         process.exit(1);
         return;
@@ -6217,6 +6526,56 @@ Usage:
 ${USAGE}`);
   process.exit(1);
 }
+function readStatementFlags(argv) {
+  let thesis = null;
+  let outcome = null;
+  const deviations = [];
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag !== "--thesis" && flag !== "--outcome" && flag !== "--deviation")
+      continue;
+    const value = argv[i + 1];
+    if (value === void 0 || value.startsWith("--"))
+      return flag;
+    if (flag === "--thesis")
+      thesis = value;
+    else if (flag === "--outcome")
+      outcome = value;
+    else
+      deviations.push(value);
+    i++;
+  }
+  return { thesis, outcome, deviations };
+}
+function writtenLines(written) {
+  return `[halfcycle] Build Record written:
+  ${written.mdPath}
+  ${written.jsonPath}
+`;
+}
+function notWrittenLines(verb, outcome, phase) {
+  const prefix = `halfcycle ${verb}:`;
+  const lead = verb === "close-phase" ? `${prefix} the phase closed, but no Build Record was written. ` : `${prefix} `;
+  switch (outcome.kind) {
+    case "exists":
+      return `${lead}A file is already at ${outcome.path} and it is not this phase's earlier record, so it was left as it is.
+${prefix} Move it away, then run: ${refetchCommand(phase)}
+`;
+    case "withheld":
+      return `${lead}${outcome.message}
+${prefix} Fetch it later with: ${refetchCommand(phase)}
+`;
+    case "refused":
+      return `${lead}${outcome.message}
+${prefix} ${REFUSAL_FOLLOW_UP[outcome.reason]}
+` + (verb === "close-phase" ? `${prefix} Fetch it later with: ${refetchCommand(phase)}
+` : "");
+    case "unavailable":
+      return `${lead}The Build Record could not be fetched: ${outcome.why}
+${prefix} Fetch it later with: ${refetchCommand(phase)}
+`;
+  }
+}
 function flagValue(argv, name) {
   const i = argv.indexOf(name);
   if (i < 0 || i + 1 >= argv.length)