halfcycle 0.3.36 → 0.3.38

package/dist/bin.js

@@ -230,6 +230,15 @@ function looksLikeSecret(text) {
   return false;
 }
 
+// ../core/dist/mcp-registration.js
+var MCP_REGISTRATION_REL = ".mcp.json";
+var MCP_SERVER_KEY = "halfcycle";
+
+// ../core/dist/shell-quote.js
+function quoteForShell(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
@@ -602,9 +611,14 @@ var closedBySchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("account-removed") }).strict(),
   z4.object({ kind: z4.literal("not-recorded") }).strict()
 ]);
+var STEP_NAME_MAX = 200;
+var stepNameSchema = plainText(STEP_NAME_MAX).refine((v) => v.trim().length > 0, {
+  message: "must not be blank"
+});
 var unfinishedStepSchema = z4.object({
   stepId: plainText(),
-  state: z4.enum(["parked", "failed"])
+  state: z4.enum(["parked", "failed"]),
+  name: stepNameSchema.optional()
 }).strict();
 var crossedSchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("none") }).strict(),
@@ -1213,14 +1227,28 @@ var engagementCredentialResponseSchema = z10.object({
   sessionToken: z10.string(),
   mcpUrl: z10.string(),
   guardUrl: z10.string(),
-  controlTelemetryUrl: z10.string()
+  controlTelemetryUrl: z10.string(),
+  methodVersion: z10.string().optional(),
+  consoleUrl: z10.string().optional()
 }).strict();
 var ciTokenExchangeResponseSchema = z10.object({
   token: z10.string(),
   expiresAt: utcIso8601,
   engagementId: z10.string()
 }).strict();
+var NO_CREDENTIAL_PLACEHOLDER = "halfcycle:no-credential";
+var NOT_THIS_ACCOUNT_PLACEHOLDER = "halfcycle:not-this-account";
+var UPDATE_CLAUDE_CODE_PLACEHOLDER = "halfcycle:update-claude-code";
 var SWITCH_ACCOUNT_ANSWER = 'answer "s" when asked';
+var NO_CREDENTIAL_SENTENCE = 'Halfcycle is not connected: this machine has no working Halfcycle credential for this project. Run "npx halfcycle" in the project folder to sign in again.';
+var NOT_THIS_ACCOUNT_SENTENCE = `Halfcycle is not connected: this project belongs to another Halfcycle account. To switch, run "npx halfcycle" in this project and ${SWITCH_ACCOUNT_ANSWER}.`;
+var UPDATE_CLAUDE_CODE_SENTENCE = "Halfcycle is not connected: this Claude Code version does not name the server it connects to, so no credential was sent. Update Claude Code, then reopen.";
+var NO_NODE_SENTENCE = "Halfcycle is not connected: Node is not installed, or not on the path this session uses, so nothing here is checked. Install Node, then reopen.";
+var PLACEHOLDER_SENTENCES = Object.freeze({
+  [NO_CREDENTIAL_PLACEHOLDER]: NO_CREDENTIAL_SENTENCE,
+  [NOT_THIS_ACCOUNT_PLACEHOLDER]: NOT_THIS_ACCOUNT_SENTENCE,
+  [UPDATE_CLAUDE_CODE_PLACEHOLDER]: UPDATE_CLAUDE_CODE_SENTENCE
+});
 
 // ../events/dist/phase-record.js
 import { z as z11 } from "zod";
@@ -2001,7 +2029,7 @@ var WRITE_ALLOWLIST = [
   ".halfcycle/bin",
   "docs/build-records",
   "test/fixtures/captured",
-  ".mcp.json",
+  MCP_REGISTRATION_REL,
   ".gitattributes",
   ZONE_B_DIR
 ];
@@ -2374,6 +2402,20 @@ exec node "$PROJECT_DIR/${VENDORED_BIN_REL}" "$@"
 }
 var GENERATED_SESSION_START_HEADER = "# Session-start marker \u2014 generated by";
 var SESSION_ID_FROM_HOOK_INPUT_SH = `SESSION_ID="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);process.stdout.write(typeof j.session_id==="string"?j.session_id:"")}catch{process.stdout.write("")}})' 2>/dev/null || true)"`;
+var REPO_HASH_FROM_ROOT_SH = `HASH="$(printf '%s' "$REPO_ROOT" | node -e 'const c=[];process.stdin.on("data",d=>c.push(d)).on("end",()=>{process.stdout.write(require("node:crypto").createHash("sha256").update(Buffer.concat(c)).digest("hex").slice(0,12))})' 2>/dev/null || true)"`;
+function noNodeReplyShell() {
+  const reply = JSON.stringify({
+    systemMessage: NO_NODE_SENTENCE,
+    hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: NO_NODE_SENTENCE }
+  });
+  if (reply.includes("'")) {
+    throw new Error("[bundle install] the no-Node notice cannot be single-quoted; refusing to write the session-start script.");
+  }
+  return `if ! command -v node >/dev/null 2>&1; then
+  printf '%s\\n' '${reply}'
+  exit 0
+fi`;
+}
 function generateSessionStartMarker() {
   return `#!/usr/bin/env bash
 ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
@@ -2382,10 +2424,15 @@ ${GENERATED_SESSION_START_HEADER} the Halfcycle installer.
 # it began instead of only against the latest commit. The session id comes in on
 # stdin with the hook input; without one, the older session-less name is written
 # and the stop-time check compares against the latest commit as it used to.
+#
+# Without Node nothing Halfcycle installs here can run, so this says so once and
+# writes no marker.
+${noNodeReplyShell()}
 INPUT="$(cat 2>/dev/null || true)"
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
 MARKER_DIR="\${TMPDIR:-/tmp}"
 MARKER_DIR="\${MARKER_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
@@ -2395,64 +2442,6 @@ else
   MARKER_FILE="\${MARKER_DIR}/halfcycle-session-\${HASH}.ref"
 fi
 git -C "$REPO_ROOT" rev-parse HEAD > "$MARKER_FILE" 2>/dev/null || true
-
-# ---------------------------------------------------------------------------
-# STANDING GUARD-COVERAGE STATEMENT (T-27; two arms since T-02b).
-#
-# A repository with no credential on this machine is UNGUARDED: the PostToolUse
-# hook will find nothing to evaluate with, and it says so once per edit, after
-# the edit. This says it once, up front, before anything is written \u2014 which is
-# the one thing a session-start hook can do that nothing else can.
-#
-# TWO REASONS TO HAVE NO CREDENTIAL, TWO DIFFERENT THINGS TO SAY (T-02b,
-# solo-project-ownership \u2014 outcome B). "You have not signed in here yet" is
-# fixed by re-running the installer; "this is not your project" is permanent,
-# and the same remedy would send the reader in a circle forever. The two are
-# told apart by HALFCYCLE_ENV_NOT_THIS_ACCOUNT, set by \`halfcycle_env_file\`
-# below from a machine-level marker beside the credential store.
-#
-# Everything below runs in a SUBSHELL: it sources a credential store, and a
-# session-start hook must not leak an engagement's variables into whatever the
-# editor runs next. Any failure inside it is swallowed; this script's exit
-# status is 0 either way, and the marker above has already been written.
-# ---------------------------------------------------------------------------
-${engagementResolutionShell()}
-
-(
-  if halfcycle_env_file "$REPO_ROOT"; then
-    set -a
-    . "$HALFCYCLE_ENV_FILE"
-    set +a
-  fi
-  if [ "$HALFCYCLE_ENV_NOT_THIS_ACCOUNT" = "1" ]; then
-    # OUTCOME B (T-02b, solo-project-ownership). This is not the missing-keys
-    # case below wearing different words: there is nothing to fix, and the loop
-    # that follows is skipped entirely rather than run and then overridden \u2014 a
-    # repository whose credential is absent for THIS reason must never be told
-    # to re-run the installer, which can never obtain one for it.
-    echo "[halfcycle] This project belongs to another Halfcycle account, so nothing here is checked."
-    echo "[halfcycle] Your work carries on exactly as it would without Halfcycle \u2014 no edit is"
-    echo "[halfcycle] evaluated, and nothing you do is reported as having passed."
-    echo "[halfcycle] Halfcycle is Solo today \u2014 one developer per project \u2014 with Team plans coming."
-    echo "[halfcycle] Ask the project's owner for view access."
-    echo "[halfcycle] If this account is wrong, sign in as the one that owns the project and run"
-    echo "[halfcycle] \\"npx halfcycle\\" again."
-  else
-    hc_missing=""
-    for hc_key in ${GUARD_COVERAGE_REQUIRED_KEYS.join(" ")}; do
-      eval "hc_value=\\\${$hc_key:-}"
-      if [ -z "$hc_value" ]; then hc_missing="$hc_missing $hc_key"; fi
-    done
-    if [ -n "$hc_missing" ]; then
-      echo "[halfcycle] NO GUARD COVERAGE IN THIS REPOSITORY. Nothing will evaluate the edits made in"
-      echo "[halfcycle] this session: this machine has no Halfcycle credential for it, so the guard hook"
-      echo "[halfcycle] has nothing to call with (missing:$hc_missing)."
-      echo "[halfcycle] Run \\"npx halfcycle\\" in this repository to fix it \u2014 it signs you in through your"
-      echo "[halfcycle] browser if needed, writes the credential to \\$HOME/.halfcycle outside this tree,"
-      echo "[halfcycle] and needs nothing configured first."
-    fi
-  fi
-) 2>/dev/null || true
 exit 0
 `;
 }
@@ -2468,7 +2457,8 @@ INPUT="$(cat 2>/dev/null || true)"
 
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 if [ -z "$REPO_ROOT" ]; then exit 0; fi
-HASH="$(printf '%s' "$REPO_ROOT" | shasum -a 256 | cut -c1-12)"
+${REPO_HASH_FROM_ROOT_SH}
+if [ -z "$HASH" ]; then exit 0; fi
 
 # The session id arrives on stdin as part of the hook payload. Empty when absent.
 ${SESSION_ID_FROM_HOOK_INPUT_SH}
@@ -2588,8 +2578,6 @@ function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeade
   }
   return "removed";
 }
-var MCP_REGISTRATION_REL = ".mcp.json";
-var MCP_SERVER_KEY = "halfcycle";
 var MCP_HEADERS_HELPER_COMMAND = `node -e "${[
   `const p=require('path'),f=require('fs'),c=require('child_process');`,
   `let d=process.cwd();`,
@@ -2732,9 +2720,10 @@ function previousPinForEngagement(targetRepoRoot, engagementId) {
 function nonEmpty(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, accountId, writtenPaths) {
+function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, accountId, methodVersion, writtenPaths) {
   const previous = previousPinForEngagement(targetRepoRoot, engagementId);
   const carried = nonEmpty(accountId) ?? nonEmpty(previous?.accountId);
+  const carriedMethodVersion = nonEmpty(methodVersion) ?? nonEmpty(previous?.methodVersion);
   const installedAt = nonEmpty(previous?.installedAt) ?? (/* @__PURE__ */ new Date()).toISOString();
   const projectPage = projectPageUrl(engagementId);
   const pin = {
@@ -2743,6 +2732,7 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, a
     engagementType,
     installedAt,
     ...carried !== void 0 ? { accountId: carried } : {},
+    ...carriedMethodVersion !== void 0 ? { methodVersion: carriedMethodVersion } : {},
     ...projectPage !== void 0 ? { projectPage } : {}
   };
   const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
@@ -2818,7 +2808,7 @@ function checkDrift(targetRepoRoot) {
   const pin = readBundlePin(targetRepoRoot);
   const installed = pin?.version ?? null;
   const current = manifest.version;
-  return { drifted: installed !== current, installed, current };
+  return { drifted: installed !== current, installed, current, methodVersion: pin?.methodVersion ?? null };
 }
 function writeProjectIdentity(targetRepo) {
   const path = join5(targetRepo, PROJECT_IDENTITY_REL);
@@ -3049,7 +3039,7 @@ async function install(options) {
     case "absent":
       break;
   }
-  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, accountId, report.writtenPaths);
+  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, accountId, credential?.methodVersion, report.writtenPaths);
   noteFile(draft, targetRepo, BUNDLE_PIN_REL, "written");
   noteFile(draft, targetRepo, CREW_ROSTER_REL, writeCrewRoster(targetRepo, report));
   const scanResult = runBootstrapScan(targetRepo);
@@ -3180,6 +3170,7 @@ async function bindLoopback(env = process.env, engagementId) {
   const state = randomBytes(32).toString("hex");
   let pending = null;
   let deliver = null;
+  let abandon = null;
   const server = createServer(createCallbackHandler(state, (callback) => {
     if (deliver)
       deliver(callback);
@@ -3221,12 +3212,18 @@ async function bindLoopback(env = process.env, engagementId) {
           clearInterval(ticker);
         clearTimeout(timer);
         deliver = null;
+        abandon = null;
         resolve4(value);
       };
       const timer = setTimeout(() => finish(null), Math.max(0, timeoutMs));
       deliver = finish;
+      abandon = () => finish(null);
     }),
-    close: () => closeServer(server)
+    close: () => {
+      if (abandon !== null)
+        abandon();
+      return closeServer(server);
+    }
   };
 }
 function closeServer(server) {
@@ -3260,8 +3257,13 @@ function defaultSleep(ms) {
 function browserOpenCommand(os, url) {
   if (os === "darwin")
     return { command: "open", args: [url] };
-  if (os === "win32")
-    return { command: "cmd", args: ["/c", "start", "", url] };
+  if (os === "win32") {
+    return {
+      command: "cmd.exe",
+      args: ["/d", "/s", "/c", `"start "" "${url}""`],
+      windowsVerbatimArguments: true
+    };
+  }
   return { command: "xdg-open", args: [url] };
 }
 function isOpenableUrl(url) {
@@ -3272,19 +3274,35 @@ function isOpenableUrl(url) {
     return false;
   }
 }
+function hasWin32UnsafeOpenerChars(url) {
+  if (url.includes('"') || url.includes("%"))
+    return true;
+  for (let i = 0; i < url.length; i++) {
+    const code = url.charCodeAt(i);
+    if (code <= 31 || code === 127)
+      return true;
+  }
+  return false;
+}
 var BROWSER_OPEN_GRACE_MS = 3e3;
-async function openBrowser(url, env = process.env) {
+async function openBrowser(url, env = process.env, os = platform3(), spawnImpl = spawn) {
   if ((env["HALFCYCLE_NO_BROWSER"] ?? "").trim() !== "") {
     return { opened: false, reason: "HALFCYCLE_NO_BROWSER is set in this environment" };
   }
   if (!isOpenableUrl(url)) {
     return { opened: false, reason: "the sign-in address is not an http(s) URL this CLI will open" };
   }
-  const { command, args: args2 } = browserOpenCommand(platform3(), url);
+  if (os === "win32" && hasWin32UnsafeOpenerChars(url)) {
+    return {
+      opened: false,
+      reason: 'the sign-in address holds a " or %, or a control character, this opener will not pass to cmd.exe on Windows'
+    };
+  }
+  const { command, args: args2, windowsVerbatimArguments } = browserOpenCommand(os, url);
   return new Promise((resolve4) => {
     let child;
     try {
-      child = spawn(command, args2, { stdio: "ignore", env });
+      child = spawnImpl(command, args2, { stdio: "ignore", env, windowsVerbatimArguments });
     } catch (err) {
       resolve4({
         opened: false,
@@ -3356,82 +3374,107 @@ function tryRefusal(body) {
   }
   return { status: candidate.status, message: candidate.message };
 }
+async function askControlOnce(tokenUrl, started) {
+  let body;
+  try {
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode: started.deviceCode })
+    });
+    body = await res.json().catch(() => null);
+  } catch {
+    return null;
+  }
+  const parsed = devicePollResponseSchema.safeParse(body);
+  return parsed.success ? parsed.data : null;
+}
+function tokenUrlFor(serviceUrl) {
+  return `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+}
+function localDeadline(started) {
+  return new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
+}
 async function pollForCredential(serviceUrl, started, deps = {}) {
   const write = deps.write ?? defaultWrite;
   const sleep = deps.sleep ?? defaultSleep;
   const now = deps.now ?? Date.now;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
+  const url = tokenUrlFor(serviceUrl);
   const interval = started.pollIntervalMs;
-  const deadline = new Date(started.expiresAt).getTime() + interval * DEADLINE_SLACK_INTERVALS;
+  const deadline = localDeadline(started);
   const startedAt = now();
   let announcedAt = startedAt;
   for (; ; ) {
-    let body;
-    let reachable = true;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch {
-      reachable = false;
-    }
-    if (reachable) {
-      const parsed = devicePollResponseSchema.safeParse(body);
-      if (parsed.success) {
-        const answer = parsed.data;
-        if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-          return answer;
-        if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-          throw new SignInRefused(answer.status, answer.message);
-        }
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
       }
     }
     if (now() >= deadline) {
       throw new SignInRefused(SIGN_IN_TIMED_OUT, SIGN_IN_TIMEOUT_MESSAGE);
     }
-    if (now() - announcedAt >= STILL_WAITING_MS) {
+    if (now() - announcedAt >= (deps.stillWaitingMs ?? STILL_WAITING_MS)) {
       announcedAt = now();
-      write(`[halfcycle] Still waiting for the browser (${Math.round((announcedAt - startedAt) / 1e3)}s). Code: ${started.userCode}
-`);
+      write(stillWaitingLine(announcedAt - startedAt, started));
     }
     await sleep(interval);
   }
 }
+function stillWaitingLine(elapsedMs, started) {
+  return `[halfcycle] Still waiting for the browser (${Math.round(elapsedMs / 1e3)}s). Code: ${started.userCode}
+`;
+}
 var LOOPBACK_TIMEOUT_MESSAGE = "Sign-in timed out: the browser never came back to this terminal. Nothing was created. Run the command again \u2014 or, if this machine cannot hand the browser back (a remote session, a container), run it with HALFCYCLE_NO_BROWSER=1 to use the code-based sign-in instead.";
-var LOOPBACK_COLLECT_ATTEMPTS = 3;
-async function collectDecidedCredential(serviceUrl, started, deps) {
-  const sleep = deps.sleep ?? defaultSleep;
-  const url = `${serviceUrl.replace(/\/+$/, "")}/auth/device/token`;
-  let lastProblem = LOOPBACK_TIMEOUT_MESSAGE;
-  for (let attempt = 0; attempt < LOOPBACK_COLLECT_ATTEMPTS; attempt++) {
-    if (attempt > 0)
-      await sleep(started.pollIntervalMs);
-    let body;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ deviceCode: started.deviceCode })
-      });
-      body = await res.json().catch(() => null);
-    } catch (err) {
-      lastProblem = `The browser finished signing you in, but this terminal could not reach the Halfcycle service to collect the credential: ${err instanceof Error ? err.message : String(err)}. Run the command again.`;
-      continue;
+async function pollBesideLoopback(serviceUrl, started, wake, deps) {
+  const sleep = deps.sleep;
+  const now = deps.now ?? Date.now;
+  const url = tokenUrlFor(serviceUrl);
+  const deadline = localDeadline(started);
+  let arrived = false;
+  let spent = false;
+  let interrupt = null;
+  void wake.then(() => {
+    arrived = true;
+    if (interrupt !== null)
+      interrupt();
+  });
+  for (; ; ) {
+    const answer = await askControlOnce(url, started);
+    if (answer !== null) {
+      if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
+        return answer;
+      if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
+        throw new SignInRefused(answer.status, answer.message);
+      }
+    }
+    if (now() >= deadline) {
+      throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
     }
-    const parsed = devicePollResponseSchema.safeParse(body);
-    if (!parsed.success)
+    if (arrived && !spent) {
+      spent = true;
       continue;
-    const answer = parsed.data;
-    if (answer.status === DEVICE_AUTH_STATUS.APPROVED)
-      return answer;
-    if (answer.status !== DEVICE_AUTH_STATUS.PENDING) {
-      throw new SignInRefused(answer.status, answer.message);
     }
+    if (sleep === void 0) {
+      await new Promise((resolve4) => {
+        const timer = setTimeout(resolve4, started.pollIntervalMs);
+        interrupt = () => {
+          clearTimeout(timer);
+          resolve4();
+        };
+      });
+    } else {
+      await new Promise((resolve4) => {
+        interrupt = resolve4;
+        void sleep(started.pollIntervalMs).then(resolve4);
+      });
+    }
+    interrupt = null;
+    if (arrived)
+      spent = true;
   }
-  throw new SignInRefused(SIGN_IN_TIMED_OUT, lastProblem);
 }
 async function signIn(serviceUrl, deps = {}) {
   const write = deps.write ?? defaultWrite;
@@ -3456,24 +3499,16 @@ async function signIn(serviceUrl, deps = {}) {
       const url = loopbackVerificationUrl(started.verificationUrl, bind.target);
       const attempt = await openBrowser(url, env);
       if (attempt.opened) {
-        write(`[halfcycle] Opened your browser to finish signing in. This terminal is waiting.
+        write(`[halfcycle] Opened your browser to finish signing in. Code: ${started.userCode}. This terminal is waiting.
 `);
-        const deadline = new Date(started.expiresAt).getTime() + started.pollIntervalMs * DEADLINE_SLACK_INTERVALS;
-        const callback = await bind.waitForCallback({
-          timeoutMs: deadline - now(),
-          onStillWaiting: (elapsed) => (
-            // NO CODE IN THIS LINE. The device-code path prints the code here
-            // because a human is comparing it; on this path there is nothing to
-            // compare and criterion 1 is that none is displayed AT ALL.
-            write(`[halfcycle] Still waiting for the browser (${Math.round(elapsed / 1e3)}s).
-`)
-          )
+        const startedAt = now();
+        const redirect = bind.waitForCallback({
+          timeoutMs: localDeadline(started) - startedAt,
+          onStillWaiting: (elapsed) => write(stillWaitingLine(elapsed, started)),
+          stillWaitingMs: deps.stillWaitingMs ?? STILL_WAITING_MS
         });
+        const approved = await pollBesideLoopback(serviceUrl, started, redirect.then(() => void 0), deps);
         await closeListener();
-        if (callback === null) {
-          throw new SignInRefused(SIGN_IN_TIMED_OUT, LOOPBACK_TIMEOUT_MESSAGE);
-        }
-        const approved = await collectDecidedCredential(serviceUrl, started, deps);
         write(`[halfcycle] Signed in as account ${approved.accountId} \u2014 continuing.
 `);
         return {
@@ -3578,7 +3613,7 @@ function planeRefusal(detail) {
     reason: typeof candidate.reason === "string" ? candidate.reason : void 0
   };
 }
-var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements and /board/enter-codes. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
+var CONTROL_ORIGIN_HINT = `This CLI talks to ${DEFAULT_CONTROL_ORIGIN}; it must be the CONTROL origin \u2014 the one that serves /engagements. The MCP server runs at a different address, and the platform supplies that one itself; you configure neither.`;
 async function createEngagement(baseUrl, name, credential, derivedName) {
   return requestEngagementValues(
     `${baseUrl.replace(/\/+$/, "")}/engagements`,
@@ -3658,12 +3693,16 @@ async function requestEngagementValues(url, requestBody, credential, shape) {
     }).join(", ");
     throw new Error(`[bundle install] ${shape.action} response from ${url} is not the credential response this CLI is built to read (${fields}). ${shape.nothingHappened}. Either that service is a different version from this installer, or ${url} is not a Halfcycle service.`);
   }
+  const consoleUrl = typeof body.consoleUrl === "string" && body.consoleUrl.trim() !== "" ? body.consoleUrl.trim() : void 0;
+  const methodVersion = typeof body.methodVersion === "string" && body.methodVersion.trim() !== "" ? body.methodVersion.trim() : void 0;
   return {
     engagementId: body.engagementId,
     sessionToken: body.sessionToken,
     mcpUrl: body.mcpUrl.trim().replace(/\/+$/, ""),
     guardUrl: body.guardUrl.trim().replace(/\/+$/, ""),
-    ...controlTelemetryUrl !== void 0 ? { controlTelemetryUrl } : {}
+    ...controlTelemetryUrl !== void 0 ? { controlTelemetryUrl } : {},
+    ...consoleUrl !== void 0 ? { consoleUrl } : {},
+    ...methodVersion !== void 0 ? { methodVersion } : {}
   };
 }
 
@@ -4274,37 +4313,6 @@ async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps =
   }
 }
 
-// dist/mint-board-code.js
-async function mintBoardEnterCode(baseUrl, sessionToken) {
-  const url = `${baseUrl.replace(/\/+$/, "")}/board/enter-codes`;
-  let res;
-  try {
-    res = await fetch(url, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${sessionToken}`
-      },
-      body: "{}"
-    });
-  } catch (err) {
-    throw new Error(`[bundle install] Could not reach the Halfcycle board mint endpoint at ${url}: ${err instanceof Error ? err.message : String(err)}.`);
-  }
-  if (!res.ok) {
-    throw new Error(`[bundle install] Board code mint failed: ${url} returned ${res.status}.`);
-  }
-  const body = await res.json().catch(() => null);
-  if (!body || typeof body.enterCode !== "string" || typeof body.engagementId !== "string" || typeof body.boardUrl !== "string" || typeof body.expiresAt !== "string") {
-    throw new Error(`[bundle install] Board code mint response from ${url} did not carry {enterCode, engagementId, boardUrl, expiresAt}.`);
-  }
-  return {
-    enterCode: body.enterCode,
-    engagementId: body.engagementId,
-    boardUrl: body.boardUrl,
-    expiresAt: body.expiresAt
-  };
-}
-
 // dist/probe-mcp.js
 var PROBE_TIMEOUT_MS = 5e3;
 async function probeMcpOrigin(mcpUrl, token) {
@@ -4386,20 +4394,127 @@ import { basename as basename2, join as join6, resolve as resolve2, relative as
 
 // dist/build-record/render-v2.js
 var HIDDEN = /[\p{Cc}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/u;
-var MARKDOWN_SPECIAL = /* @__PURE__ */ new Set(["\\", "`", "*", "_", "[", "]", "<", "|", "~", "#", "&", "$"]);
+var SPACE = new RegExp("\\p{Zs}", "u");
+var WORD = /[\p{L}\p{N}]/u;
+var ASCII_PUNCTUATION = /[!-/:-@[-`{-~]/;
+var CHARACTER_REFERENCE = /^#?[A-Za-z0-9]+;/;
+var PAIRED = ["*", "_", "~", "$"];
+function codeSpanMask(cps) {
+  const mask = cps.map(() => false);
+  const runs = [];
+  for (let i = 0; i < cps.length; ) {
+    if (cps[i] !== "`") {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < cps.length && cps[j] === "`")
+      j++;
+    runs.push({ start: i, length: j - i });
+    i = j;
+  }
+  for (let k = 0; k < runs.length; ) {
+    const open = runs[k];
+    let m = k + 1;
+    while (m < runs.length && runs[m].length !== open.length)
+      m++;
+    if (m === runs.length) {
+      k++;
+      continue;
+    }
+    const close = runs[m];
+    for (let i = open.start; i < close.start + close.length; i++)
+      mask[i] = true;
+    k = m + 1;
+  }
+  return mask;
+}
+function escapeMask(cps, inSpan) {
+  const n = cps.length;
+  const escape = cps.map(() => false);
+  const isSpace = (i) => i >= 0 && i < n && SPACE.test(cps[i]) && !HIDDEN.test(cps[i]);
+  const isWord = (i) => i >= 0 && i < n && WORD.test(cps[i]);
+  const rest = (i) => cps.slice(i).join("");
+  for (let i = 0; i < n; i++) {
+    if (inSpan[i])
+      continue;
+    const ch = cps[i];
+    const next = i + 1 < n ? cps[i + 1] : null;
+    switch (ch) {
+      case "\\":
+        escape[i] = next === null || ASCII_PUNCTUATION.test(next);
+        break;
+      case "<":
+        escape[i] = next !== null && !isSpace(i + 1) && rest(i + 1).includes(">");
+        break;
+      case "&":
+        escape[i] = CHARACTER_REFERENCE.test(rest(i + 1));
+        break;
+      case "]":
+        escape[i] = next === "(";
+        break;
+      case "[":
+      case "{":
+        escape[i] = (next === "+" || next === "-") && (rest(i + 2).includes(`${next}]`) || rest(i + 2).includes(`${next}}`));
+        break;
+      default:
+        break;
+    }
+  }
+  for (let i = 0; i < n; ) {
+    if (inSpan[i] || cps[i] !== "#") {
+      i++;
+      continue;
+    }
+    let j = i;
+    while (j < n && cps[j] === "#" && !inSpan[j])
+      j++;
+    let k = j;
+    while (k < n && isSpace(k))
+      k++;
+    if (k === n && (i === 0 || isSpace(i - 1)))
+      for (let m = i; m < j; m++)
+        escape[m] = true;
+    i = j;
+  }
+  for (const c of PAIRED) {
+    const live = [];
+    for (let i = 0; i < n; ) {
+      if (inSpan[i] || cps[i] !== c) {
+        i++;
+        continue;
+      }
+      let j = i;
+      while (j < n && cps[j] === c && !inSpan[j])
+        j++;
+      const inert = c !== "$" && (isSpace(i - 1) && isSpace(j) || c === "_" && isWord(i - 1) && isWord(j));
+      if (!inert)
+        live.push({ start: i, end: j });
+      i = j;
+    }
+    if (live.length < 2)
+      continue;
+    for (const run of live)
+      for (let m = run.start; m < run.end; m++)
+        escape[m] = true;
+  }
+  return escape;
+}
 function printRecordText(text) {
   if (text === "")
     return "(blank)";
+  const cps = [...text];
+  const escape = escapeMask(cps, codeSpanMask(cps));
   let out = "";
-  for (const ch of text) {
+  cps.forEach((ch, i) => {
     if (HIDDEN.test(ch)) {
       out += `U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}`;
-    } else if (MARKDOWN_SPECIAL.has(ch)) {
+    } else if (escape[i]) {
       out += `\\${ch}`;
     } else {
       out += ch;
     }
-  }
+  });
   return out;
 }
 function makePrinter() {
@@ -4489,12 +4604,18 @@ function headline(observed, attested, checks) {
       if (problemsReported) {
         return "**Closed with problems reported.** Halfcycle saw nothing outstanding, and the person closing the phase reported problems found in its acceptance walk.";
       }
-      return checks === "not-observed" ? "**Closed with nothing outstanding, but no checks ran.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met, but Halfcycle has no record of any check running during this phase, so this is not a clean result." : "**Closed cleanly.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met.";
+      return checks === "not-observed" ? "**Closed with nothing outstanding, but no check on record.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met, but Halfcycle has no record of any check running during this phase, so this is not a clean result." : "**Closed cleanly.** Halfcycle saw nothing outstanding, and the person closing the phase stated its finish conditions were met.";
     case "unfinished-steps":
     case "clean-over-findings":
-      return met ? "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase stated its finish conditions were met anyway." : "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase chose to override it.";
+      if (!met) {
+        return "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase chose to override it.";
+      }
+      return problemsReported ? "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase closed it as it stood, reporting problems found in its acceptance walk." : "**Closed over outstanding work.** Halfcycle saw work still outstanding, and the person closing the phase stated its finish conditions were met anyway.";
     case "not-recorded":
-      return met ? "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase stated its finish conditions were met." : "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase chose to override.";
+      if (!met) {
+        return "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase chose to override.";
+      }
+      return problemsReported ? "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase reported problems found in its acceptance walk." : "**Outstanding work not recorded.** Halfcycle has no record of what was outstanding at this close. The person closing the phase stated its finish conditions were met.";
   }
 }
 function closedAtText(closedAt, p) {
@@ -4513,30 +4634,38 @@ function signedInAs(closedBy, p) {
       return "not recorded for this close";
   }
 }
+var OUTSTANDING_LABEL = "- Outstanding work in Halfcycle's own records of this phase (the method's steps, and problems recorded against the phase): ";
 function outstanding(crossed, p) {
   switch (crossed.kind) {
     case "none":
-      return ["- Outstanding work Halfcycle could see: none."];
+      return [`${OUTSTANDING_LABEL}none.`];
     case "not-recorded":
-      return ["- Outstanding work Halfcycle could see: not recorded for this close."];
+      return [`${OUTSTANDING_LABEL}not recorded for this close.`];
     case "clean-over-findings":
-      return [
-        `- Outstanding work Halfcycle could see: ${counted(crossed.findings, "problem", "problems")} recorded against this phase.`
-      ];
+      return [`${OUTSTANDING_LABEL}${counted(crossed.findings, "problem", "problems")} recorded against this phase.`];
     case "unfinished-steps":
       return [
-        `- Outstanding work Halfcycle could see: ${counted(crossed.steps.length, "step", "steps")} of the method left unfinished. Each is shown by the method's own label for it:`,
-        ...crossed.steps.map((step) => `  - Step: ${p.text(step.stepId)} \u2014 ${step.state === "failed" ? "failed" : "set aside unfinished"}`)
+        `${OUTSTANDING_LABEL}${counted(crossed.steps.length, "step", "steps")} of the method left unfinished. ${shownBy(crossed.steps)}`,
+        ...crossed.steps.map((step) => `  - Step: ${p.text(step.name ?? step.stepId)} \u2014 ${step.state === "failed" ? "failed" : "set aside unfinished"}`)
       ];
   }
 }
-function machines(coverage) {
+function shownBy(steps) {
+  const named = steps.filter((s) => s.name !== void 0).length;
+  if (named === 0)
+    return "Each is shown by the method's own label for it:";
+  if (named === steps.length)
+    return "Each is shown by the method's own name for it:";
+  return "Each is shown by the method's own name for it, or by its label where the record holds no name:";
+}
+function machines(coverage, checks) {
   const label = "- Computers signed in to Halfcycle for this project when the phase closed: ";
   if (coverage === null)
     return `${label}not recorded.`;
   if (coverage.enrolled === 0)
     return `${label}none.`;
-  return `${label}${String(coverage.enrolled)}. Of these, ${String(coverage.conformant)} had reported Halfcycle's checks as fully set up.`;
+  const line = `${label}${String(coverage.enrolled)}. Of these, ${String(coverage.conformant)} had reported Halfcycle's checks as fully set up.`;
+  return checks === "not-observed" && coverage.conformant > 0 ? `${line} Set up is not the same as running: Halfcycle has no record of any check running during this phase.` : line;
 }
 function walkLines(walk, p) {
   const label = "> - Acceptance walk (the finished work tried as a user would, by someone other than its builder): ";
@@ -4556,9 +4685,15 @@ function walkLines(walk, p) {
 function statedOrNot(value, p) {
   return value === null ? "Not stated by the client." : p.text(value);
 }
+function decisionLine(attested) {
+  if (attested.decision === "override") {
+    return "> - Decision: close the phase by override, without stating its finish conditions were met.";
+  }
+  return attested.walk !== null && attested.walk.verdict === "defects" ? "> - Decision: close the phase as it stood, with the problems its acceptance walk found." : "> - Decision: the phase's agreed finish conditions were met.";
+}
 function renderStated(attested, p) {
   const lines = [
-    attested.decision === "done-when-met" ? "> - Decision: the phase's agreed finish conditions were met." : "> - Decision: close the phase by override, without stating its finish conditions were met.",
+    decisionLine(attested),
     `> - Name given: ${attested.actor === null ? "removed with the account that made this close" : p.text(attested.actor)}`,
     `> - Reason given: ${attested.reason === null ? "none." : p.text(attested.reason)}`,
     ...walkLines(attested.walk, p),
@@ -4586,7 +4721,7 @@ function renderClose(heading, observed, attested, checks, p) {
       `- Closed at: ${closedAtText(observed.closedAt, p)}`,
       `- Signed in as: ${signedInAs(observed.closedBy, p)}`,
       ...outstanding(observed.crossed, p),
-      machines(observed.seatCoverage)
+      machines(observed.seatCoverage, checks)
     ].join("\n"),
     STATED_LABEL,
     renderStated(attested, p)
@@ -4847,8 +4982,7 @@ async function obtainBuildRecord(credential, repoRoot, phase, io = NODE_RECORD_P
   };
 }
 function refetchCommand(phase) {
-  const quoted = /^[A-Za-z0-9._+-]+$/.test(phase) ? phase : `'${phase.replace(/'/g, `'\\''`)}'`;
-  return `npx halfcycle@latest build-record ${quoted}`;
+  return `npx halfcycle@latest build-record ${quoteForShell(phase)}`;
 }
 
 // dist/open-phase.js
@@ -4857,10 +4991,12 @@ import { join as join7 } from "node:path";
 var OpenPhaseRefused = class extends Error {
   status;
   finding;
-  constructor(status, message, finding) {
+  previousPhase;
+  constructor(status, message, finding, previousPhase = null) {
     super(message);
     this.status = status;
     this.finding = finding;
+    this.previousPhase = previousPhase;
     this.name = "OpenPhaseRefused";
   }
 };
@@ -4939,7 +5075,8 @@ async function openPhase(credential, phase, entry, home) {
     const body2 = await res.json().catch(() => null);
     const message = typeof body2?.message === "string" ? body2.message : `${url} returned ${res.status}.`;
     const finding = typeof body2?.finding === "string" ? body2.finding : null;
-    throw new OpenPhaseRefused(res.status, message, finding);
+    const previousPhase = typeof body2?.previousPhase === "string" ? body2.previousPhase : null;
+    throw new OpenPhaseRefused(res.status, message, finding, previousPhase);
   }
   const body = await res.json().catch(() => null);
   if (!body || !(typeof body.phase === "string" || body.phase === null) || !(typeof body.previousPhase === "string" || body.previousPhase === null) || typeof body.decision !== "object" || body.decision === null || typeof body.decision.decisionId !== "string") {
@@ -5165,7 +5302,7 @@ function requirementMessage(verb, flag) {
 function runnableInvocation(verb, phase) {
   const contract = contractFor(verb);
   const flags = (contract?.required ?? []).map((req) => `${req.flag} ${PLACEHOLDERS[req.flag] ?? '"\u2026"'}`).join(" ");
-  return `halfcycle ${verb} ${phase}${flags ? ` ${flags}` : ""}`;
+  return `halfcycle ${verb} ${quoteForShell(phase)}${flags ? ` ${flags}` : ""}`;
 }
 var PLACEHOLDERS = {
   "--verdict": "<clean|defects>",
@@ -6092,7 +6229,12 @@ ${USAGE}`);
             // T-10 — optional; absent on a plane that has not configured
             // CONTROL_TELEMETRY_URL yet. `writeEngagementCredential` writes '' for
             // an absent value, never `undefined` verbatim.
-            controlTelemetryUrl: joined.controlTelemetryUrl
+            controlTelemetryUrl: joined.controlTelemetryUrl,
+            // T-01 (Connect Phase 4 follow-ups) — optional; absent on a control
+            // deployment that predates it. The join route's own stamped pin,
+            // which can be older than this deployment's current default.
+            consoleUrl: joined.consoleUrl,
+            methodVersion: joined.methodVersion
           };
           foundLine = `this repo is pinned to one of your projects \u2014 joining it as you (${shortId(joined.engagementId)})`;
         }
@@ -6116,7 +6258,12 @@ ${USAGE}`);
           // T-10 — the FOURTH origin, optional. Absent on a plane that has not
           // configured CONTROL_TELEMETRY_URL yet; the runner's own telemetry
           // emission is fail-open on that absence.
-          controlTelemetryUrl: created.controlTelemetryUrl
+          controlTelemetryUrl: created.controlTelemetryUrl,
+          // T-01 (Connect Phase 4 follow-ups) — optional; absent on a control
+          // deployment that predates it. The create route's own deployment
+          // default at the moment this engagement was stamped.
+          consoleUrl: created.consoleUrl,
+          methodVersion: created.methodVersion
         };
         foundLine = `no Halfcycle project here yet \u2014 creating one (${shortId(created.engagementId)})`;
         if (verbose) {
@@ -6209,22 +6356,23 @@ ${USAGE}`);
       if (result.notShared)
         process.stdout.write(`${renderNotShared(result.notShared)}
 `);
+      if (credential) {
+        process.stdout.write("[halfcycle] Commit the files Halfcycle set up here, so every copy of this project runs the same checks.\n");
+      }
       if (credential) {
         process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project
 `);
-        process.stdout.write(`[halfcycle] Claude Code will also ask permission the first time Halfcycle needs to look up your next step. Choose allow \u2014 without it nothing can run.
+        process.stdout.write(`[halfcycle] Claude Code will then ask whether to use a new MCP server. The cursor starts on "Continue without using this MCP server" \u2014 choose to use it instead; without it Halfcycle will not connect.
 `);
       }
-      if (credential) {
-        try {
-          const minted = await mintBoardEnterCode(credential.serviceUrl, credential.token);
-          process.stdout.write(`[halfcycle] Your project's page \u2014 how it is going, the agents working on it, and your other projects (first visit): ${minted.boardUrl}
+      if (credential?.consoleUrl !== void 0) {
+        const colour = decideColour(currentEnvironment(quiet));
+        process.stdout.write(`${ink("key", `[halfcycle] Your project's console: ${credential.consoleUrl}`, colour)}
 `);
-          process.stdout.write(`[halfcycle] First-visit code \u2014 single use, expires ${minted.expiresAt}; paste it on that page, and re-run this installer for a fresh one: ${minted.enterCode}
+      }
+      if (credential?.methodVersion !== void 0) {
+        process.stdout.write(`[halfcycle] Method version: ${credential.methodVersion}
 `);
-        } catch {
-          process.stdout.write("[halfcycle] Your project's page: no first-visit code was issued just now \u2014 re-run this installer to get one.\n");
-        }
       }
       process.exit(0);
     } catch (err) {
@@ -6271,7 +6419,9 @@ ${USAGE}`);
       return;
     }
     try {
-      const { drifted, installed, current } = checkDrift(targetRepo2);
+      const { drifted, installed, current, methodVersion } = checkDrift(targetRepo2);
+      process.stdout.write(`[halfcycle-bundle] Method version: ${methodVersion ?? "not recorded"}
+`);
       if (drifted) {
         process.stdout.write(`[halfcycle-bundle] DRIFT DETECTED: installed=${installed ?? "none"} current=${current}
 [halfcycle-bundle] Re-run "halfcycle-bundle install ${targetRepo2}" to sync.
@@ -6343,8 +6493,13 @@ ${USAGE}`);
       const opened = await openPhase(credential, toProjectScope ? null : phaseArg, entry);
       const what = opened.phase === null ? "project scope" : `phase "${opened.phase}"`;
       const from = opened.previousPhase === null ? "project scope" : `phase "${opened.previousPhase}"`;
-      process.stdout.write(`[halfcycle] Moved from ${from} to ${what}.
+      if (opened.previousPhase === opened.phase) {
+        process.stdout.write(opened.phase === null ? "[halfcycle] Already at project scope \u2014 nothing moved.\n" : `[halfcycle] Phase "${opened.phase}" is already open \u2014 nothing moved.
+`);
+      } else {
+        process.stdout.write(`[halfcycle] Moved from ${from} to ${what}.
 `);
+      }
       process.stdout.write(`[halfcycle] Recorded as ${opened.decision.decision} by ${opened.decision.actor} at ${opened.decision.decidedAt}.
 `);
       if (opened.decision.blockingFinding) {
@@ -6361,8 +6516,7 @@ halfcycle open-phase: until ${opened.stampFailure.path} can be written, guard ev
       process.exit(0);
     } catch (err) {
       if (err instanceof InvalidPhaseIdentityError) {
-        process.stderr.write(`halfcycle open-phase: ${err.message}
-halfcycle open-phase: a phase name has to work as a single folder name on this machine \u2014 that is what this machine files its guard evaluations under. Nothing was opened.
+        process.stderr.write(`halfcycle open-phase: '${String(err.identity)}' cannot be used as a phase name \u2014 it has to work as a single folder name on this machine. Nothing was opened.
 `);
         process.exit(2);
         return;
@@ -6375,8 +6529,7 @@ halfcycle open-phase: a phase name has to work as a single folder name on this m
 `);
         }
         if (err.status === 409) {
-          const stuck = err.finding?.match(/^phase '([^']+)' is still open/)?.[1];
-          process.stderr.write(`halfcycle open-phase: close the phase first \u2014 \`${runnableInvocation("close-phase", stuck ?? "<phase>")}\` (add --finding "\u2026" once per finding when the verdict is defects) \u2014 or re-run with --override --reason "\u2026", which is recorded, not waived.
+          process.stderr.write(`halfcycle open-phase: close the phase first \u2014 \`${runnableInvocation("close-phase", err.previousPhase ?? "<phase>")}\` (add --finding "\u2026" once per finding when the verdict is defects) \u2014 or re-run with --override --reason "\u2026", which is recorded, not waived.
 `);
         }
         process.exit(1);
@@ -6487,17 +6640,22 @@ halfcycle close-phase: until ${closed.stampFailure.path} can be written, guard e
         return;
       }
       if (err instanceof ClosePhaseRefused) {
+        if (err.finding) {
+          process.stderr.write(`halfcycle close-phase: refused (${err.status}).
+`);
+          process.stderr.write(`halfcycle close-phase: outstanding work \u2014 ${plainOutstandingFinding(err.finding)}
+`);
+          process.stderr.write(`halfcycle close-phase: close it anyway with \`halfcycle close-phase ${quoteForShell(phaseArg)} --verdict ${verdict} --actor ${quoteForShell(closeActor)} --override --reason "\u2026"\` \u2014 recorded, not waived.
+`);
+          process.exit(1);
+          return;
+        }
         process.stderr.write(`halfcycle close-phase: refused (${err.status}). ${err.message}
 `);
         if (err.status === 400) {
           process.stderr.write("halfcycle close-phase: Nothing was closed.\n");
         }
-        if (err.finding) {
-          process.stderr.write(`halfcycle close-phase: outstanding work \u2014 ${err.finding}
-`);
-          process.stderr.write(`halfcycle close-phase: close it anyway with \`halfcycle close-phase ${phaseArg} --verdict ${verdict} --actor "${closeActor}" --override --reason "\u2026"\` \u2014 recorded, not waived.
-`);
-        } else if (err.code === "PhaseAlreadyClosed") {
+        if (err.code === "PhaseAlreadyClosed") {
           process.stderr.write("halfcycle close-phase: to close a phase again, open it again first.\nhalfcycle close-phase: To get a closed phase's Build Record: npx halfcycle@latest build-record <the phase that closed>\n");
         }
         process.exit(1);
@@ -6536,6 +6694,9 @@ function readStatementFlags(argv) {
   }
   return { thesis, outcome, deviations };
 }
+function plainOutstandingFinding(finding) {
+  return finding.replace(/\(attempted-failed\)/g, "(attempted, and did not finish)");
+}
 function writtenLines(written) {
   return `[halfcycle] Build Record written:
   ${written.mdPath}