halfcycle 0.4.14 → 0.4.15

package/dist/cli.js

@@ -1,15 +1,14 @@
 #!/usr/bin/env node
 
 // dist/bin.js
-import { existsSync as existsSync9, realpathSync as realpathSync4, statSync, writeSync as writeSync2 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { existsSync as existsSync12, statSync as statSync2, writeSync as writeSync3 } from "node:fs";
 
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, posix, relative, resolve } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, posix as posix2, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../core/dist/guard-record.js
@@ -139,6 +138,7 @@ function parseAccountStoreText(raw) {
 
 // ../core/dist/hook-wiring.js
 var SETTINGS_REL = ".claude/settings.json";
+var LOCAL_SETTINGS_REL = ".claude/settings.local.json";
 var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var PRE_FILTER_SHELL_FILENAME = "pre-tool-use-filter.sh";
 var PRE_FILTER_FUNCTION = "halfcycle_pt_skip";
@@ -146,9 +146,10 @@ var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
 var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
 var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
 var USER_PROMPT_SCOPE_REL = ".claude/hooks/user-prompt-scope.sh";
+var USER_PROMPT_FINDINGS_REL = ".claude/hooks/user-prompt-findings.sh";
 var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
 var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
-var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent)$";
+var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
 function hookCommand(script, verb) {
   const invocation = `bash "$CLAUDE_PROJECT_DIR"/${script}`;
   return verb === void 0 ? invocation : `${invocation} ${verb}`;
@@ -182,6 +183,13 @@ var HALFCYCLE_HOOK_WIRING = [
     command: hookCommand(USER_PROMPT_SCOPE_REL),
     script: USER_PROMPT_SCOPE_REL
   },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 10,
+    command: hookCommand(USER_PROMPT_FINDINGS_REL),
+    script: USER_PROMPT_FINDINGS_REL
+  },
   {
     event: "PreToolUse",
     matcher: PRE_TOOL_USE_MATCHER,
@@ -631,9 +639,9 @@ function waitsFor(tasks) {
   const n = tasks.length;
   const positionsOf = /* @__PURE__ */ new Map();
   tasks.forEach((task, i) => {
-    const list = positionsOf.get(task.id);
-    if (list)
-      list.push(i);
+    const list2 = positionsOf.get(task.id);
+    if (list2)
+      list2.push(i);
     else
       positionsOf.set(task.id, [i]);
   });
@@ -759,17 +767,17 @@ function hasBit(bits, i) {
 function isComparedKind(task) {
   return task.kind === "build" || task.kind === "spec";
 }
-function firstDifference(plan, list) {
+function firstDifference(plan, list2) {
   const planIds = new Set(plan.map((task) => task.id));
-  const listIds = new Set(list.map((task) => task.id));
+  const listIds = new Set(list2.map((task) => task.id));
   for (const task of plan)
     if (!listIds.has(task.id))
       return `"${task.id}"`;
-  for (const task of list)
+  for (const task of list2)
     if (!planIds.has(task.id))
       return `"${task.id}"`;
   const listDeps = /* @__PURE__ */ new Map();
-  for (const task of list) {
+  for (const task of list2) {
     const deps = listDeps.get(task.id) ?? /* @__PURE__ */ new Set();
     for (const dep of task.dependsOn)
       deps.add(dep);
@@ -788,7 +796,7 @@ function firstDifference(plan, list) {
       if (!theirs.has(dep))
         return `"${task.id}" \u2192 "${dep}"`;
   }
-  for (const task of list) {
+  for (const task of list2) {
     const ours = planDeps.get(task.id);
     for (const dep of task.dependsOn)
       if (!ours.has(dep))
@@ -1005,10 +1013,10 @@ function checkTaskPlan(plan, request) {
     }
   }
   lines.push(...placementLines(tasks, before));
-  const refused2 = lines.some((line) => line.refuses);
-  if (!refused2)
+  const refused3 = lines.some((line) => line.refuses);
+  if (!refused3)
     lines.push({ code: "P", text: taskPlanLineText.P(), refuses: false });
-  return { lines, refused: refused2 };
+  return { lines, refused: refused3 };
 }
 
 // ../events/dist/result.js
@@ -1688,15 +1696,15 @@ function crossFieldProblems(raw) {
       ids.add(part.id);
     }
     if (typeof part.lane === "string" && typeof part.slot === "number") {
-      const place = `${part.lane}\0${part.slot}`;
-      const earlier = placed.get(place);
+      const place2 = `${part.lane}\0${part.slot}`;
+      const earlier = placed.get(place2);
       if (earlier !== void 0) {
         problems.push({
           path: `parts.${i}.slot`,
           message: `${quoted(parts[earlier].id)} already sits in lane ${shown(part.lane)} at slot ${part.slot}`
         });
       } else {
-        placed.set(place, i);
+        placed.set(place2, i);
       }
     }
     if (typeof part.outside === "boolean" && Array.isArray(part.owns)) {
@@ -2181,8 +2189,9 @@ var SCOPE_PART_STATUSES = ["approved", "waiting"];
 var scopePartStatusSchema = z10.enum(SCOPE_PART_STATUSES);
 var SCOPE_ACTS = ["approve", "send-back"];
 var scopeActSchema = z10.enum(SCOPE_ACTS);
-var SCOPE_GIVEN_IN = ["console", "chat"];
+var SCOPE_GIVEN_IN = ["console", "chat", "autonomy"];
 var scopeGivenInSchema = z10.enum(SCOPE_GIVEN_IN);
+var APPROVED_IN_ADVANCE_SENTENCE = "approved in advance by your autonomy setting";
 var scopeNoteSchema = descriptionText(SCOPE_NOTE_MAX);
 var scopeNoteWireSchema = z10.string().max(SCOPE_NOTE_MAX);
 var SCOPE_PART_VERDICTS = ["ok", "change"];
@@ -2213,7 +2222,8 @@ var phasePlanRecordedSchema = z10.object({
   typedApprovalOffered: z10.boolean(),
   reportedAt: utcIso8601,
   carriedFrom: z10.array(carriedFromEntrySchema).min(1).max(PHASE_PLAN_CHANGES_MAX).optional(),
-  movedUp: planMovedUpSchema.optional()
+  movedUp: planMovedUpSchema.optional(),
+  givenIn: scopeGivenInSchema.optional()
 }).strict();
 var phasePlanRefusedSchema = z10.object({
   outcome: z10.literal("refused"),
@@ -4029,6 +4039,15 @@ var REVIEW_PART_CHANGES = Object.freeze([...PHASE_PLAN_CHANGE_KINDS, "not-in-pla
 var reviewPartChangeSchema = z20.enum(REVIEW_PART_CHANGES);
 var REVIEW_DECISIONS = Object.freeze(["accepted", "carried", "dropped"]);
 var reviewDecisionSchema = z20.enum(REVIEW_DECISIONS);
+var reviewGivenInSchema = scopeGivenInSchema.extract(["autonomy"]);
+var DECIDED_BY_AUTONOMY_SENTENCE = "decided by your autonomy setting";
+function checkReviewGivenIn(v, ctx) {
+  if (v.givenIn === void 0)
+    return;
+  if (v.decision !== "accepted" && v.decision !== "carried") {
+    ctx.addIssue({ code: "custom", path: ["givenIn"], message: "is present only on a part accepted or carried" });
+  }
+}
 function actOf(decision) {
   if (decision === "accepted")
     return "accept";
@@ -4111,6 +4130,25 @@ var reviewRefusedSchema = z20.object({
 function bareReviewOutcome(outcome) {
   return z20.object({ outcome: z20.literal(outcome) }).strict();
 }
+var reviewClosedByAutonomySchema = z20.object({
+  outcome: z20.literal("closed-by-autonomy"),
+  accepted: z20.number().int().min(0).max(REVIEW_PARTS_MAX),
+  carried: z20.number().int().min(0).max(REVIEW_PARTS_MAX)
+}).strict().refine((v) => v.accepted + v.carried <= REVIEW_PARTS_MAX, {
+  message: "cannot exceed the parts a round holds",
+  path: ["carried"]
+});
+var AUTONOMY_WAIT_REASONS = ["unchecked-claims", "built-without-approval"];
+var autonomyWaitReasonSchema = z20.enum(AUTONOMY_WAIT_REASONS);
+var reviewAutonomyWaitsSchema = z20.object({
+  outcome: z20.literal("autonomy-waits"),
+  reason: autonomyWaitReasonSchema,
+  count: z20.number().int().min(1),
+  parts: z20.array(z20.object({ part: systemPartIdSchema, name: systemPartSchema.shape.name }).strict()).min(1).max(REVIEW_PARTS_MAX)
+}).strict().refine((v) => v.reason !== "built-without-approval" || v.count === v.parts.length, {
+  message: "counts the parts it names",
+  path: ["count"]
+});
 var openReviewResultSchema = z20.discriminatedUnion("outcome", [
   reviewOpenedSchema,
   reviewTasksOpenSchema,
@@ -4119,7 +4157,9 @@ var openReviewResultSchema = z20.discriminatedUnion("outcome", [
   reviewOutstandingSchema,
   reviewCleanOverFindingsSchema,
   reviewRefusedSchema,
-  bareReviewOutcome("unavailable")
+  bareReviewOutcome("unavailable"),
+  reviewClosedByAutonomySchema,
+  reviewAutonomyWaitsSchema
 ]);
 var reviewPhaseNotOpenSchema = z20.object({
   statusCode: z20.literal(409),
@@ -4233,6 +4273,7 @@ var reviewViewPartSchema = z20.object({
   decidable: z20.boolean(),
   waiting: z20.boolean(),
   decision: reviewDecisionSchema.optional(),
+  givenIn: reviewGivenInSchema.optional(),
   reason: reviewNoteSchema.optional(),
   carriedTo: reviewCarriedToSchema.optional(),
   sentBack: z20.array(reviewSentBackSchema),
@@ -4260,6 +4301,7 @@ var reviewViewPartSchema = z20.object({
   if (v.change === "not-in-plan" && !v.built) {
     ctx.addIssue({ code: "custom", path: ["built"], message: "is always true for a part outside the plan" });
   }
+  checkReviewGivenIn(v, ctx);
 });
 var reviewPhaseNumberSchema = z20.number().int().min(1).nullable();
 var phaseReviewNoneSchema = z20.object({
@@ -4354,6 +4396,7 @@ var recordReviewPartSchema = z21.object({
   built: z21.boolean(),
   builtWithoutApproval: z21.boolean(),
   decision: reviewDecisionSchema,
+  givenIn: reviewGivenInSchema.optional(),
   reason: reviewNoteSchema.optional(),
   carriedTo: reviewCarriedToSchema.optional(),
   sentBack: z21.array(reviewSentBackSchema),
@@ -4367,6 +4410,7 @@ var recordReviewPartSchema = z21.object({
   if (v.carriedTo !== void 0 !== (v.decision === "carried")) {
     ctx.addIssue({ code: "custom", path: ["carriedTo"], message: "is present exactly on a carry" });
   }
+  checkReviewGivenIn(v, ctx);
 });
 var SPINE_ORDER = boardGateNameSchema.options;
 var recordReviewGatesSchema = z21.array(recordReviewGateSchema).superRefine((gates, ctx) => {
@@ -4899,7 +4943,12 @@ var ownerWaitDeclareRequestSchema = z31.object({
 var OWNER_WAIT_DECLARE_REFUSALS = ["no-open-phase", "unknown-item", "say-if-undoable"];
 var ownerWaitDeclareResultSchema = z31.discriminatedUnion("outcome", [
   z31.object({ outcome: z31.literal("recorded"), id: z31.string().uuid(), say: z31.string().min(1) }).strict(),
-  z31.object({ outcome: z31.literal("go-ahead"), id: z31.string().uuid(), callId: z31.string().uuid(), say: z31.string().min(1) }).strict(),
+  z31.object({
+    outcome: z31.literal("go-ahead"),
+    id: z31.string().uuid(),
+    callId: z31.number().int().positive(),
+    say: z31.string().min(1)
+  }).strict(),
   z31.object({ outcome: z31.literal("refused"), reason: z31.enum(OWNER_WAIT_DECLARE_REFUSALS) }).strict()
 ]);
 var ownerWaitAddedItemSchema = z31.object({
@@ -5101,6 +5150,201 @@ function paceAllowedNowOf(k) {
 }
 var PACE_AGENTS_TOO_MANY = `Run at most ${String(PACE_AGENTS_MAX)} agents at once.`;
 
+// ../events/dist/autonomy.js
+import { z as z33 } from "zod";
+var AUTONOMY_CHANGED_IN = ["console", "chat"];
+var autonomyChangedInSchema = z33.enum(AUTONOMY_CHANGED_IN);
+var autonomySettingsSchema = z33.object({
+  on: z33.boolean(),
+  // whether builds run on their own
+  mayPublish: z33.boolean(),
+  // whether builds may publish or release without waiting
+  maySpend: z33.boolean(),
+  // whether builds may spend money or sign up without waiting
+  changedAt: utcIso8601.nullable(),
+  // when the setting last changed; null if never
+  changedIn: autonomyChangedInSchema.nullable()
+  // where it last changed; null if never
+}).strict().refine((v) => v.changedAt === null === (v.changedIn === null), {
+  message: "says when and where it changed, or neither",
+  path: ["changedIn"]
+});
+var autonomyChangeRequestSchema = z33.object({
+  on: z33.boolean(),
+  // the switch
+  mayPublish: z33.boolean(),
+  // the publish box
+  maySpend: z33.boolean()
+  // the spend box
+}).strict();
+var AUTONOMY_CHAT_ACTS = ["on", "off"];
+var autonomyChatActSchema = z33.enum(AUTONOMY_CHAT_ACTS);
+var autonomyChatRequestSchema = z33.object({
+  act: autonomyChatActSchema
+  // what the owner typed
+}).strict();
+var autonomyChatResultSchema = z33.discriminatedUnion("outcome", [
+  z33.object({
+    outcome: z33.literal("recorded"),
+    on: z33.boolean()
+    // whether builds now run on their own
+  }).strict(),
+  z33.object({ outcome: z33.literal("not-owner") }).strict(),
+  z33.object({ outcome: z33.literal("no-owner") }).strict(),
+  z33.object({ outcome: z33.literal("not-offered") }).strict(),
+  z33.object({ outcome: z33.literal("unavailable") }).strict()
+]);
+var autonomyStateSchema = z33.object({
+  on: z33.boolean(),
+  // whether builds run on their own
+  mayPublish: z33.boolean(),
+  // whether builds may publish or release without waiting
+  maySpend: z33.boolean()
+  // whether builds may spend money or sign up without waiting
+}).strict();
+var autonomyStateFileSchema = autonomyStateSchema.extend({
+  readAt: utcIso8601
+  // when this copy was read from Halfcycle
+}).strict();
+var AUTONOMY_STATE_FILE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var AUTONOMY_ACTIVITY_KINDS = ["went-ahead", "waiting", "approved", "closed", "waiting-on-owner"];
+var autonomyActivityKindSchema = z33.enum(AUTONOMY_ACTIVITY_KINDS);
+var autonomyActivityRowSchema = z33.object({
+  kind: autonomyActivityKindSchema,
+  // what happened
+  phase: scopePhaseSchema,
+  // the phase it happened in
+  question: ownerWaitText.optional(),
+  // the agent's question, for a decision
+  chose: ownerWaitText.optional(),
+  // what the agent chose or recommends, for a decision
+  undoable: ownerWaitUndoableSchema.optional(),
+  // whether the agent says it can be undone
+  how: statementText(STATEMENT_MAX).optional(),
+  // how to undo it, when it can be
+  at: utcIso8601
+  // when it happened
+}).strict().superRefine((row, ctx) => {
+  const decision = row.kind === "went-ahead" || row.kind === "waiting";
+  if (decision && row.question === void 0) {
+    ctx.addIssue({ code: "custom", message: "a decision says its question", path: ["question"] });
+  }
+  if (!decision) {
+    for (const key of ["question", "chose", "undoable", "how"]) {
+      if (row[key] !== void 0) {
+        ctx.addIssue({ code: "custom", message: "only a decision carries this", path: [key] });
+      }
+    }
+  }
+  if (row.kind === "went-ahead") {
+    if (row.chose === void 0) {
+      ctx.addIssue({ code: "custom", message: "a decision that went ahead says what was chosen", path: ["chose"] });
+    }
+    if (row.undoable === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: "a decision that went ahead says whether it can be undone",
+        path: ["undoable"]
+      });
+    }
+  }
+  if (row.kind === "waiting" && (row.undoable !== void 0 || row.how !== void 0)) {
+    ctx.addIssue({ code: "custom", message: "a waiting decision has not been made yet", path: ["undoable"] });
+  }
+  if (row.kind === "went-ahead" && row.undoable === "yes" !== (row.how !== void 0)) {
+    ctx.addIssue({ code: "custom", message: "says how to undo it exactly when it can be undone", path: ["how"] });
+  }
+});
+var autonomyActivitySchema = z33.object({
+  rows: z33.array(autonomyActivityRowSchema)
+  // newest first
+}).strict();
+var savedIdSchema = z33.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lower-case letters, digits and single hyphens");
+var SAVED_REF_PREFIX = "refs/halfcycle/saved/";
+function savedRefOf(id) {
+  return `${SAVED_REF_PREFIX}${id}`;
+}
+var SAVED_KEEP_MS = 7 * 24 * 60 * 60 * 1e3;
+var SAVED_DIR_NAME = "saved";
+var SAVED_FILE_NAME = "saved.json";
+var SAVED_COPIES_DIR_NAME = "files";
+var SAVED_REPOSITORY_FILE_NAME = "repository";
+var SAVED_HALF_WRITTEN_GRACE_MS = 6e4;
+function savedPruneAnswer(save, here) {
+  const old = (t) => !Number.isFinite(t) || here.now - t > SAVED_KEEP_MS;
+  if (save.refMadeAt !== null) {
+    if (!old(save.refMadeAt))
+      return "keep";
+    return save.folderChangedAt === null ? "remove-ref" : "remove-ref-then-folder";
+  }
+  if (save.folderChangedAt === null || !Number.isFinite(save.folderChangedAt))
+    return "keep";
+  const ours = save.folderRepository === null || here.repository !== null && save.folderRepository === here.repository;
+  const wait = ours ? SAVED_HALF_WRITTEN_GRACE_MS : SAVED_KEEP_MS;
+  return here.now - save.folderChangedAt > wait ? "remove-folder" : "keep";
+}
+function isProjectRelativePath(p) {
+  if (p.length === 0 || hasControlCharacter(p))
+    return false;
+  if (p.startsWith("/") || p.startsWith("\\") || /^[A-Za-z]:/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((segment) => segment !== "" && windowsNameOf(segment) !== "" && !isGitFolderSegment(segment));
+}
+function windowsNameOf(segment) {
+  return segment.replace(/[\u200b-\u200f\u202a-\u202e\u2060-\u2064\u206a-\u206f\ufeff]/g, "").split(":")[0].replace(/[. ]+$/, "").toLowerCase();
+}
+function isGitFolderSegment(segment) {
+  const t = windowsNameOf(segment);
+  return t === ".git" || /^git~\d+$/.test(t);
+}
+var SAVED_PATH_KEPT_IN = ["commit", "copy"];
+var savedPathSchema = z33.object({
+  path: z33.string().max(4096).refine(isProjectRelativePath, { message: "must be a path inside the project" }),
+  // the file, relative to the project
+  keptIn: z33.enum(SAVED_PATH_KEPT_IN)
+  // in the save's commit, or copied beside this file
+}).strict();
+var savedCommitSchema = z33.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full commit hash");
+var savedBranchSchema = z33.object({
+  name: z33.string().min(1).max(255).refine((n) => !hasControlCharacter(n) && !n.startsWith("-") && !n.includes("..") && n !== "HEAD", {
+    message: "must be a branch name"
+  }),
+  // the branch's name
+  commit: savedCommitSchema
+  // the commit it pointed at
+}).strict();
+var savedSchema = z33.object({
+  id: savedIdSchema,
+  // what restore is typed with
+  savedAt: utcIso8601,
+  // when the copy was made
+  ref: z33.string().min(1),
+  // where the saved commit is kept
+  what: z33.string().min(1).max(2e3),
+  // what the action would have changed, in words
+  paths: z33.array(savedPathSchema),
+  // every saved file
+  branches: z33.array(savedBranchSchema)
+  // every saved line of work
+}).strict().refine((s) => s.ref === savedRefOf(s.id), { message: "must be the ref of this save", path: ["ref"] });
+function autonomyA13(accepted, carried) {
+  return `Your autonomy setting accepted the ${String(accepted)} built parts and carried ${String(carried)} unbuilt parts forward. The phase is closed.`;
+}
+function autonomyA14(count, parts) {
+  return `The phase waits for you: ${String(count)} tests the agents said pass were not run by Halfcycle, so ${namesOf(parts)} wait for you too. Only you can accept or reject those tests and decide those parts. See the console's review.`;
+}
+function autonomyA15(count) {
+  return `The phase waits for you: ${String(count)} parts were built without an approved scope, and only you can decide them.`;
+}
+function namesOf(names) {
+  if (names.length <= 1)
+    return names[0] ?? "";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1] ?? ""}`;
+}
+function autonomyC8(agent, question2, chose) {
+  return `${agent} decided "${question2}" without asking you, under your autonomy setting: chose "${chose}". It is on the list of things that wait for you, so it was sent to you as it was made.`;
+}
+
 // ../events/dist/work-words.js
 var CALLS_HEADING = "Calls made without asking you";
 var CALLS_EXPLAINED = "These are the decisions the agents recorded taking on their own, each against a stated default. Halfcycle lists what they recorded; it cannot see a call an agent did not record.";
@@ -5473,45 +5717,64 @@ function mintIdentity(targetRepoRoot) {
     note: PROJECT_IDENTITY_NOTE
   };
 }
-function repairRemoteCredential(targetRepoRoot) {
-  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+function plannedRemoteRepair(targetRepoRoot) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   let onDisk;
   try {
     const parsed = JSON.parse(readFileSync3(path, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-      return;
+      return null;
     onDisk = parsed;
   } catch {
-    return;
+    return null;
   }
   const storedRemote = onDisk.remote ?? null;
   const remote = redactRemoteCredential(storedRemote);
   if (remote === storedRemote)
-    return;
-  const identity = {
+    return null;
+  return serializeProjectIdentity({
     projectId: onDisk.projectId ?? "",
     rootCommit: onDisk.rootCommit ?? null,
     remote,
     note: PROJECT_IDENTITY_NOTE
-  };
+  });
+}
+function replaceProjectIdentityFile(targetRepoRoot, text) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    writeFileSync3(temporary, serializeProjectIdentity(identity), { encoding: "utf-8", flag: "wx" });
+    writeFileSync3(temporary, text, { encoding: "utf-8", flag: "wx" });
     renameSync(temporary, path);
   } catch {
   } finally {
     rmSync(temporary, { force: true });
   }
 }
+function planProjectIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
+  if (!existsSync(path)) {
+    return { action: "add", after: serializeProjectIdentity(mintIdentity(targetRepoRoot)) };
+  }
+  const repaired = plannedRemoteRepair(targetRepoRoot);
+  if (repaired !== null)
+    return { action: "change", after: repaired };
+  let current;
+  try {
+    current = readFileSync3(path, "utf-8");
+  } catch {
+    current = null;
+  }
+  return { action: "leave", after: current };
+}
 function serializeProjectIdentity(identity) {
   return JSON.stringify(identity, null, 2) + "\n";
 }
-function createProjectIdentityFile(targetRepoRoot) {
+function createProjectIdentityFile(targetRepoRoot, text) {
   const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   mkdirSync3(dirname2(path), { recursive: true });
   const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    writeFileSync3(temporary, serializeProjectIdentity(mintIdentity(targetRepoRoot)), {
+    writeFileSync3(temporary, text ?? serializeProjectIdentity(mintIdentity(targetRepoRoot)), {
       encoding: "utf-8",
       flag: "wx"
     });
@@ -5526,6 +5789,10 @@ function createProjectIdentityFile(targetRepoRoot) {
   }
 }
 
+// dist/install-plan.js
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5, posix } from "node:path";
+
 // dist/install-manifest.js
 import { Buffer as Buffer2 } from "node:buffer";
 import { createHash } from "node:crypto";
@@ -5589,10 +5856,10 @@ function stringArray(value, field) {
   return value;
 }
 function hashArray(value, field) {
-  const list = stringArray(value, field);
-  if (!list.every((v) => HEX64.test(v)))
+  const list2 = stringArray(value, field);
+  if (!list2.every((v) => HEX64.test(v)))
     throw new UnreadableManifestError(`"${field}" holds a value that is not a hash`);
-  return list;
+  return list2;
 }
 function bool(value, field) {
   if (typeof value !== "boolean")
@@ -5824,6 +6091,448 @@ function union(a, b) {
   return [.../* @__PURE__ */ new Set([...a, ...b])];
 }
 
+// dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join4 } from "node:path";
+var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
+var HALFCYCLE_STATE_NOTE = [
+  "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
+  "record of what this project has done, and it is never updated as work happens.",
+  'An empty or missing "layers" means the install-time scan found no pre-existing',
+  "artefacts on disk \u2014 it does NOT mean nothing has been done since, and it is not",
+  "evidence that any step is unfinished or any approval is outstanding.",
+  "The authoritative position lives in the Halfcycle service: call the",
+  "halfcycle_resolve tool to ask where this project stands. Do not answer that",
+  "question from this file."
+].join(" ");
+var LAYER_ARTEFACT_PATHS = {
+  l0: ["ENGAGEMENT.md"],
+  l1: ["docs/product-spec.md"],
+  l2: ["docs/architecture-overview.md"],
+  l3: ["docs/invariants.md"],
+  l4: ["docs/features"],
+  l5: ["docs/phases"]
+};
+function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const layers = {};
+  for (const [layer, paths] of Object.entries(LAYER_ARTEFACT_PATHS)) {
+    const found = paths.filter((p) => existsSync2(join4(targetRepo, p)));
+    if (found.length > 0) {
+      layers[layer] = {
+        value: "asserted",
+        source: "bootstrap-scan",
+        foundPaths: found,
+        scannedAt
+      };
+    }
+  }
+  return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
+}
+var BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
+function planBootstrapScan(targetRepo) {
+  const statePath = join4(targetRepo, BOOTSTRAP_STATE_REL);
+  if (existsSync2(statePath)) {
+    const existing = JSON.parse(readFileSync4(statePath, "utf-8"));
+    return { state: existing, text: null };
+  }
+  const state = scanLayers(targetRepo);
+  return { state, text: JSON.stringify(state, null, 2) + "\n" };
+}
+function writeBootstrapState(targetRepo, text) {
+  mkdirSync4(join4(targetRepo, ".halfcycle"), { recursive: true });
+  writeFileSync4(join4(targetRepo, BOOTSTRAP_STATE_REL), text, "utf-8");
+}
+
+// dist/install-plan.js
+var PENDING = /* @__PURE__ */ Symbol("pending");
+var YOURS = "a file of yours with the same name; Halfcycle will not touch it";
+var SAME = "already as Halfcycle would write it";
+var PREVIEW_WORDS = Object.freeze({
+  command: {
+    add: "a command your coding agent can run to take the next Halfcycle step",
+    change: "a newer version of this Halfcycle command",
+    leave: SAME,
+    yours: YOURS
+  },
+  "check-script": {
+    add: "a check Halfcycle runs before and after your agent's actions",
+    change: "a newer version of this Halfcycle check",
+    leave: SAME,
+    yours: YOURS
+  },
+  settings: {
+    add: "your coding agent's settings, with the checks Halfcycle runs",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "server-entry": {
+    add: "tells your coding agent how to reach Halfcycle's service",
+    change: "adds Halfcycle's entry; your own entries stay as they are",
+    leave: "already has Halfcycle's entry",
+    yours: YOURS
+  },
+  "ignore-list": {
+    add: "keeps Halfcycle's files for this computer only out of git",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "line-endings": {
+    add: "keeps Halfcycle's checks working in a Windows copy of this project",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "halfcycle-folder": {
+    add: "a file in Halfcycle's own folder",
+    change: "a newer version of this file in Halfcycle's own folder",
+    leave: SAME,
+    yours: YOURS
+  },
+  runner: {
+    add: "the program Halfcycle's checks run",
+    change: "a newer version of the program Halfcycle's checks run",
+    leave: SAME,
+    yours: YOURS
+  },
+  "captured-index": {
+    add: "the list of real examples your project's tests are checked against",
+    change: "a newer version of this list",
+    leave: SAME,
+    yours: YOURS
+  },
+  "old-sign-in": {
+    add: "an older Halfcycle sign-in",
+    change: "takes out an older Halfcycle sign-in; your own lines stay as they are",
+    leave: "an older Halfcycle sign-in that cannot be moved yet; left as it is",
+    yours: YOURS
+  }
+});
+var kindTable;
+function kinds() {
+  kindTable ??= /* @__PURE__ */ new Map([
+    [".claude/hooks/guard-runner.sh", "check-script"],
+    [".claude/hooks/user-prompt-reminder.sh", "check-script"],
+    [".claude/hooks/user-prompt-scope.sh", "check-script"],
+    [".claude/hooks/user-prompt-findings.sh", "check-script"],
+    [".claude/hooks/session-end-marker.sh", "check-script"],
+    [".claude/hooks/session-start-marker.sh", "check-script"],
+    [SETTINGS_REL, "settings"],
+    [MCP_REGISTRATION_REL, "server-entry"],
+    [GITIGNORE_REL, "ignore-list"],
+    [GITATTRIBUTES_REL, "line-endings"],
+    [VENDORED_BIN_REL, "runner"],
+    [CREW_ROSTER_REL, "halfcycle-folder"],
+    [BUNDLE_PIN_REL, "halfcycle-folder"],
+    [PROJECT_IDENTITY_REL, "halfcycle-folder"],
+    [BOOTSTRAP_STATE_REL, "halfcycle-folder"],
+    [INSTALL_MANIFEST_REL, "halfcycle-folder"],
+    [RETIRED_MCP_HEADERS_HELPER_REL, "halfcycle-folder"],
+    [LEGACY_CI_STANZA_REL, "halfcycle-folder"],
+    [CAPTURED_INDEX_REL, "captured-index"],
+    [LEGACY_ENV_LOCAL_REL, "old-sign-in"]
+  ]);
+  return kindTable;
+}
+function previewKindOf(rel) {
+  if (/^\.claude\/commands\/[^/]+\.md$/.test(rel))
+    return "command";
+  return kinds().get(rel);
+}
+function kindOf(rel) {
+  const kind = previewKindOf(rel);
+  if (kind === void 0)
+    throw new Error(`[halfcycle] the installer plans ${rel}, which has no preview words.`);
+  return kind;
+}
+var STEPS = /* @__PURE__ */ new WeakMap();
+function planInstall(options) {
+  const { targetRepo, engagementId, engagementType, credential, home, env, createdByAccountId } = options;
+  const preview = engagementId === void 0;
+  if (!preview) {
+    assertEngagementId(engagementId);
+    if (engagementType === void 0) {
+      throw new Error("[halfcycle] a plan for a project needs its kind as well as its id.");
+    }
+  }
+  if (!existsSync3(targetRepo)) {
+    throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
+  }
+  const writeSet = closedWriteSet();
+  const previous = readPreviousManifest(targetRepo);
+  const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
+  const { version, commands } = planCommandStubs(targetRepo, previous, writeSet);
+  const vendored = planVendoredBinary(targetRepo);
+  let settings;
+  try {
+    settings = planSettings(targetRepo, previous, home, env);
+  } catch (err) {
+    if (err instanceof SettingsParseRefused)
+      return Object.freeze({ entries: [], outside: [], refusal: err.message });
+    throw err;
+  }
+  const hooks = planHookScripts(targetRepo);
+  const ciStanza = planLegacyCiStanzaRemoval(targetRepo);
+  const mcp = planMcpRegistration(targetRepo, preview ? "pending" : credential);
+  const mcpHelper = mcp.kind === "none" ? null : planMcpHeadersHelperRemoval(targetRepo);
+  const gitignore = planGitignore(targetRepo);
+  const gitattributes = planGitattributes(targetRepo);
+  const identity = planProjectIdentity(targetRepo);
+  if (identity.after === null)
+    readFileSync5(join5(targetRepo, PROJECT_IDENTITY_REL));
+  const credentialPlan = !preview && credential !== void 0 ? planEngagementCredential(credential, engagementId, home) : null;
+  const credentialWrite = credentialPlan === null ? null : { outcome: credentialPlan.outcome, existed: credentialPlan.existed, path: engagementEnvPath(engagementId, home) };
+  const storedAfter = credentialPlan?.storedAfter ?? (preview ? Object.fromEntries(ENGAGEMENT_ENV_KEYS.map((key) => [key, "supplied at sign-in"])) : readEngagementEnv(engagementId, home) ?? {});
+  const legacy = migrateLegacyEnvLocal(targetRepo, storedAfter);
+  const pin = preview ? planBundlePinPreview(targetRepo, version, home) : planBundlePin(targetRepo, version, engagementId, engagementType, createdByAccountId, credential?.methodVersion);
+  const crew = planCrewRoster(targetRepo);
+  const scan = { text: planBootstrapScan(targetRepo).text };
+  const steps = {
+    targetRepo,
+    version,
+    engagementId,
+    engagementType,
+    credential: preview ? void 0 : credential,
+    home,
+    writeSet,
+    previous,
+    dirsBefore,
+    commands,
+    vendored,
+    settings,
+    hooks,
+    ciStanza,
+    mcp,
+    mcpHelper,
+    gitignore,
+    gitattributes,
+    identity,
+    credentialWrite,
+    legacy,
+    pin,
+    crew,
+    scan
+  };
+  const record2 = preview ? null : planInstallRecord(targetRepo, accountInstall(steps, predicted(steps)).manifestText);
+  const plan = Object.freeze({
+    entries: Object.freeze(entriesOf(steps, record2)),
+    outside: Object.freeze(outsideOf(steps))
+  });
+  STEPS.set(plan, steps);
+  return plan;
+}
+function predicted(steps) {
+  const after = /* @__PURE__ */ new Map();
+  const dirs = /* @__PURE__ */ new Set();
+  const lands = (rel, text, writes) => {
+    after.set(rel, text);
+    if (!writes)
+      return;
+    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir))
+      dirs.add(dir);
+  };
+  const file = (planned) => {
+    if (planned.outcome !== "collided")
+      lands(planned.rel, planned.text, planned.outcome === "written");
+  };
+  steps.commands.forEach(file);
+  file(steps.vendored);
+  file(steps.settings.file);
+  steps.hooks.forEach(file);
+  if (steps.mcp.kind === "write")
+    lands(MCP_REGISTRATION_REL, steps.mcp.text, steps.mcp.outcome !== "skipped");
+  if (steps.identity.after !== null)
+    lands(PROJECT_IDENTITY_REL, steps.identity.after, steps.identity.action === "add");
+  if (steps.pin !== null)
+    file(steps.pin);
+  file(steps.crew);
+  if (steps.scan.text !== null)
+    lands(BOOTSTRAP_STATE_REL, steps.scan.text, true);
+  const mergeAfter = (planned) => planned.outcome === "written" ? planned.after : planned.before;
+  return {
+    ciStanza: steps.ciStanza,
+    mcpHelper: steps.mcpHelper,
+    gitignore: steps.gitignore.outcome,
+    gitignoreAfter: mergeAfter(steps.gitignore),
+    gitattributes: steps.gitattributes.outcome,
+    gitattributesAfter: mergeAfter(steps.gitattributes),
+    credential: steps.credentialWrite?.outcome ?? null,
+    legacy: steps.legacy,
+    bytesAfter: (rel) => {
+      const text = after.get(rel);
+      if (text === void 0)
+        throw new Error(`[halfcycle] the plan has no bytes for ${rel}.`);
+      return Buffer.from(text, "utf-8");
+    },
+    dirExistsAfter: (dir) => steps.dirsBefore.has(dir) || dirs.has(dir),
+    stateExistsAfter: true
+  };
+}
+function entriesOf(steps, record2) {
+  const { targetRepo } = steps;
+  const entries = [];
+  const fromFile = (planned) => {
+    const kind = kindOf(planned.rel);
+    if (planned.outcome === "written") {
+      entries.push({ path: planned.rel, action: planned.replacedExisting ? "change" : "add", kind, bytes: planned.text });
+    } else if (planned.outcome === "collided") {
+      entries.push({ path: planned.rel, action: "leave", kind, bytes: null, yours: true });
+    } else {
+      entries.push({ path: planned.rel, action: "leave", kind, bytes: null });
+    }
+  };
+  const retired = (rel, decided) => {
+    if (decided === null || decided === "absent")
+      return;
+    if (decided === "removed")
+      entries.push({ path: rel, action: "remove", kind: kindOf(rel), bytes: null });
+    else if (decided === "kept-foreign")
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null, yours: true });
+    else
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null });
+  };
+  const merge = (rel, planned) => {
+    if (planned.outcome === "written" && planned.after !== null) {
+      entries.push({ path: rel, action: planned.before === null ? "add" : "change", kind: kindOf(rel), bytes: planned.after });
+    } else if (planned.before !== null || planned.outcome === "failed") {
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null });
+    }
+  };
+  const pending = (rel) => {
+    const there = existsSync3(join5(targetRepo, rel));
+    entries.push({ path: rel, action: there ? "change" : "add", kind: kindOf(rel), bytes: PENDING });
+  };
+  steps.commands.forEach(fromFile);
+  fromFile(steps.vendored);
+  const settings = steps.settings;
+  entries.push(settings.file.outcome === "written" ? { path: SETTINGS_REL, action: settings.preexisted ? "change" : "add", kind: "settings", bytes: settings.file.text } : { path: SETTINGS_REL, action: "leave", kind: "settings", bytes: null });
+  steps.hooks.forEach(fromFile);
+  retired(LEGACY_CI_STANZA_REL, steps.ciStanza);
+  const mcp = steps.mcp;
+  if (mcp.kind === "write") {
+    const action = mcp.outcome === "written" ? "add" : mcp.outcome === "merged" ? "change" : "leave";
+    entries.push({ path: MCP_REGISTRATION_REL, action, kind: "server-entry", bytes: action === "leave" ? null : mcp.text });
+  } else if (mcp.kind === "pending") {
+    pending(MCP_REGISTRATION_REL);
+  } else {
+    entries.push({ path: MCP_REGISTRATION_REL, action: "leave", kind: "server-entry", bytes: null });
+  }
+  retired(RETIRED_MCP_HEADERS_HELPER_REL, steps.mcpHelper);
+  merge(GITIGNORE_REL, steps.gitignore);
+  merge(GITATTRIBUTES_REL, steps.gitattributes);
+  const identity = steps.identity;
+  entries.push({
+    path: PROJECT_IDENTITY_REL,
+    action: identity.action,
+    kind: "halfcycle-folder",
+    bytes: identity.action === "leave" ? null : identity.after
+  });
+  const legacy = steps.legacy;
+  if (legacy.outcome === "removed") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "remove", kind: "old-sign-in", bytes: null });
+  } else if (legacy.outcome === "stripped") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "change", kind: "old-sign-in", bytes: legacy.keptText ?? null });
+  } else if (legacy.outcome !== "absent") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "leave", kind: "old-sign-in", bytes: null });
+  }
+  if (steps.pin === null)
+    pending(BUNDLE_PIN_REL);
+  else
+    fromFile(steps.pin);
+  fromFile(steps.crew);
+  entries.push(steps.scan.text !== null ? { path: BOOTSTRAP_STATE_REL, action: "add", kind: "halfcycle-folder", bytes: steps.scan.text } : { path: BOOTSTRAP_STATE_REL, action: "leave", kind: "halfcycle-folder", bytes: null });
+  if (record2 === null)
+    pending(INSTALL_MANIFEST_REL);
+  else
+    fromFile(record2);
+  return entries;
+}
+function outsideOf(steps) {
+  if (steps.engagementId === void 0) {
+    const outside = [{ kind: "sign-in", path: null, action: "pending" }];
+    if (!projectPinned(steps.targetRepo))
+      outside.push({ kind: "new-project" });
+    return outside;
+  }
+  const write = steps.credentialWrite;
+  if (write === null)
+    return [];
+  const action = write.outcome === "skipped" ? "leave" : write.existed ? "change" : "add";
+  return [{ kind: "sign-in", path: write.path, action }];
+}
+function projectPinned(targetRepo) {
+  try {
+    const id = readBundlePin(targetRepo)?.engagementId;
+    return typeof id === "string" && id.trim() !== "";
+  } catch {
+    return false;
+  }
+}
+function applyInstallPlan(plan) {
+  if (plan.refusal !== void 0)
+    throw new SettingsParseRefused(plan.refusal);
+  const steps = STEPS.get(plan);
+  if (steps === void 0)
+    throw new Error("[halfcycle] only a plan made by planInstall can be applied.");
+  const { targetRepo, engagementId, pin } = steps;
+  if (engagementId === void 0 || pin === null || steps.mcp.kind === "pending") {
+    throw new Error("[halfcycle] a preview cannot be applied: it is still waiting for the service.");
+  }
+  for (const command of steps.commands)
+    putPlannedFile(targetRepo, command);
+  putPlannedFile(targetRepo, steps.vendored);
+  putPlannedFile(targetRepo, steps.settings.file);
+  for (const hook of steps.hooks)
+    putPlannedFile(targetRepo, hook);
+  const ciStanza = steps.ciStanza === "removed" ? removePlannedRetiredFile(targetRepo, LEGACY_CI_STANZA_REL) : steps.ciStanza;
+  putPlannedMcp(targetRepo, steps.mcp);
+  const mcpHelper = steps.mcpHelper === "removed" ? removePlannedRetiredFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL) : steps.mcpHelper;
+  const gitignore = putPlannedGitignore(targetRepo, steps.gitignore);
+  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+  const gitignoreAfter = existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null;
+  const gitattributes = putPlannedGitattributes(targetRepo, steps.gitattributes);
+  const gitattributesAfter = readTextOrNull(join5(targetRepo, GITATTRIBUTES_REL));
+  writeProjectIdentity(targetRepo, steps.identity);
+  const credential = steps.credential;
+  const credentialOutcome = steps.credentialWrite !== null && credential !== void 0 ? writeEngagementCredential(credential, engagementId, steps.home) : null;
+  const stored = readEngagementEnv(engagementId, steps.home) ?? {};
+  const legacy = applyLegacyMigration(targetRepo, migrateLegacyEnvLocal(targetRepo, stored));
+  writeBundlePin(targetRepo, pin, []);
+  putPlannedFile(targetRepo, steps.crew);
+  if (steps.scan.text !== null)
+    writeBootstrapState(targetRepo, steps.scan.text);
+  const { report, installManifest, manifestText } = accountInstall(steps, {
+    ciStanza,
+    mcpHelper,
+    gitignore,
+    gitignoreAfter,
+    gitattributes,
+    gitattributesAfter,
+    credential: credentialOutcome,
+    legacy,
+    bytesAfter: (rel) => readFileSync5(join5(targetRepo, rel)),
+    dirExistsAfter: (dir) => existsSync3(join5(targetRepo, dir)),
+    stateExistsAfter: existsSync3(join5(targetRepo, BOOTSTRAP_STATE_REL))
+  });
+  const record2 = planInstallRecord(targetRepo, manifestText);
+  putPlannedFile(targetRepo, record2);
+  recordInstallRecord(report, record2);
+  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
+  return {
+    version: steps.version,
+    writtenPaths: report.writtenPaths,
+    skippedPaths: report.skippedPaths,
+    mergedPaths: report.mergedPaths,
+    collidedPaths: report.collidedPaths,
+    editedCollidedPaths: report.editedCollidedPaths,
+    replacedPaths: report.replacedPaths,
+    bootstrapScanRan: steps.scan.text !== null,
+    legacyCredentialKept: legacy.outcome === "kept" ? { keys: legacy.unbacked, missing: legacy.missingForAdoption } : null,
+    notShared
+  };
+}
+
 // dist/mcp-endpoint.js
 var MCP_ENDPOINT_PATH = "/mcp";
 function mcpEndpointUrl(origin) {
@@ -5903,56 +6612,6 @@ function mergePermissions(existing, generated, retiredOurs) {
   return result;
 }
 
-// dist/scan.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join4 } from "node:path";
-var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
-var HALFCYCLE_STATE_NOTE = [
-  "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
-  "record of what this project has done, and it is never updated as work happens.",
-  'An empty or missing "layers" means the install-time scan found no pre-existing',
-  "artefacts on disk \u2014 it does NOT mean nothing has been done since, and it is not",
-  "evidence that any step is unfinished or any approval is outstanding.",
-  "The authoritative position lives in the Halfcycle service: call the",
-  "halfcycle_resolve tool to ask where this project stands. Do not answer that",
-  "question from this file."
-].join(" ");
-var LAYER_ARTEFACT_PATHS = {
-  l0: ["ENGAGEMENT.md"],
-  l1: ["docs/product-spec.md"],
-  l2: ["docs/architecture-overview.md"],
-  l3: ["docs/invariants.md"],
-  l4: ["docs/features"],
-  l5: ["docs/phases"]
-};
-function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  const layers = {};
-  for (const [layer, paths] of Object.entries(LAYER_ARTEFACT_PATHS)) {
-    const found = paths.filter((p) => existsSync2(join4(targetRepo, p)));
-    if (found.length > 0) {
-      layers[layer] = {
-        value: "asserted",
-        source: "bootstrap-scan",
-        foundPaths: found,
-        scannedAt
-      };
-    }
-  }
-  return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
-}
-var BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
-function runBootstrapScan(targetRepo) {
-  const statePath = join4(targetRepo, BOOTSTRAP_STATE_REL);
-  if (existsSync2(statePath)) {
-    const existing = JSON.parse(readFileSync4(statePath, "utf-8"));
-    return { state: existing, ran: false };
-  }
-  const state = scanLayers(targetRepo);
-  mkdirSync4(join4(targetRepo, ".halfcycle"), { recursive: true });
-  writeFileSync4(statePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
-  return { state, ran: true };
-}
-
 // dist/install.js
 function renderNotShared(finding) {
   const rule = `rule "${finding.pattern}" in ${finding.source}, line ${finding.line}`;
@@ -5967,36 +6626,36 @@ var __dirname = dirname3(__filename);
 function findBundleRoot(startDir) {
   let candidate = startDir;
   for (let i = 0; i < 4; i++) {
-    const manifest = join5(candidate, ".claude-plugin", "plugin.json");
+    const manifest = join6(candidate, ".claude-plugin", "plugin.json");
     try {
-      if (existsSync3(manifest))
+      if (existsSync4(manifest))
         return candidate;
     } catch {
     }
     candidate = dirname3(candidate);
   }
-  return join5(startDir, "..");
+  return join6(startDir, "..");
 }
 var BUNDLE_ROOT = findBundleRoot(__dirname);
 function resolveVendoredBinary() {
   const candidates = [
-    join5(BUNDLE_ROOT, "bin", "bin.bundle.mjs"),
-    join5(BUNDLE_ROOT, "..", "runner", "dist", "bin.bundle.mjs")
+    join6(BUNDLE_ROOT, "bin", "bin.bundle.mjs"),
+    join6(BUNDLE_ROOT, "..", "runner", "dist", "bin.bundle.mjs")
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate))
+    if (existsSync4(candidate))
       return candidate;
   }
   throw new Error(`[halfcycle] Cannot find the self-contained guard binary bin.bundle.mjs. This copy of the halfcycle package is incomplete \u2014 reinstall it, or rebuild it if you are working on it. Looked in: ${candidates.join(", ")}.`);
 }
 function resolvePreFilterShell() {
   const candidates = [
-    join5(BUNDLE_ROOT, "bin", PRE_FILTER_SHELL_FILENAME),
-    join5(BUNDLE_ROOT, "..", "runner", "dist", PRE_FILTER_SHELL_FILENAME)
+    join6(BUNDLE_ROOT, "bin", PRE_FILTER_SHELL_FILENAME),
+    join6(BUNDLE_ROOT, "..", "runner", "dist", PRE_FILTER_SHELL_FILENAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate))
-      return readFileSync5(candidate, "utf-8");
+    if (existsSync4(candidate))
+      return readFileSync6(candidate, "utf-8");
   }
   throw new Error(`[halfcycle] Cannot find ${PRE_FILTER_SHELL_FILENAME}. This copy of the halfcycle package is incomplete \u2014 reinstall it, or rebuild it if you are working on it. Looked in: ${candidates.join(", ")}.`);
 }
@@ -6025,7 +6684,7 @@ function isAllowlisted(targetRelPath) {
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
 function capturedIndexScaffold() {
-  return join5(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
+  return join6(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
 }
 var GITIGNORE_REL = ".gitignore";
 var GITATTRIBUTES_REL = ".gitattributes";
@@ -6063,7 +6722,7 @@ function closedWriteSet() {
   const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL, GITATTRIBUTES_REL]);
   const dirs = /* @__PURE__ */ new Set();
   for (const path of [...files, ...merged]) {
-    for (let dir = posix.dirname(path); dir !== "."; dir = posix.dirname(dir))
+    for (let dir = posix2.dirname(path); dir !== "."; dir = posix2.dirname(dir))
       dirs.add(dir);
   }
   const ownedDirs = new Set([...dirs].filter((dir) => `${dir}/`.startsWith(INSTALLER_OWNED_DIR)));
@@ -6087,11 +6746,11 @@ function closedWriteSet() {
 function sha256OfWhatThisVersionWrites(commands) {
   const out = /* @__PURE__ */ new Map();
   const fromFile = (rel, src) => {
-    if (existsSync3(src))
-      out.set(rel, fileSha256(readFileSync5(src)));
+    if (existsSync4(src))
+      out.set(rel, fileSha256(readFileSync6(src)));
   };
   for (const cmd of commands)
-    fromFile(commandStubRel(cmd.name), join5(BUNDLE_ROOT, ".claude-plugin", cmd.path));
+    fromFile(commandStubRel(cmd.name), join6(BUNDLE_ROOT, ".claude-plugin", cmd.path));
   for (const [rel, content] of hookScriptsThisVersionWrites())
     out.set(rel, fileSha256(content));
   fromFile(CAPTURED_INDEX_REL, capturedIndexScaffold());
@@ -6104,17 +6763,17 @@ function bytesAreOurs(path, bytes, recorded, writeSet) {
 }
 function readPreviousManifest(targetRepo) {
   try {
-    return parseManifest(readFileSync5(join5(targetRepo, INSTALL_MANIFEST_REL), "utf-8"));
+    return parseManifest(readFileSync6(join6(targetRepo, INSTALL_MANIFEST_REL), "utf-8"));
   } catch {
     return null;
   }
 }
-function noteFile(draft, targetRepo, rel, outcome) {
+function noteFile(draft, rel, outcome, after) {
   if (outcome === "collided") {
     recordCollision(draft, rel);
     return;
   }
-  recordInstalledFile(draft, rel, readFileSync5(join5(targetRepo, rel)));
+  recordInstalledFile(draft, rel, after(rel));
 }
 function recordSettingsMerge(draft, existing, generated, preexisted, merged) {
   const generatedHooks = generated.hooks ?? {};
@@ -6203,11 +6862,11 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
   const collided = new Set(collidedPaths);
   const dirVerdicts = /* @__PURE__ */ new Map();
   const travelsThroughPlainDirs = (rel) => {
-    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir)) {
+    for (let dir = posix2.dirname(rel); dir !== "."; dir = posix2.dirname(dir)) {
       let plain = dirVerdicts.get(dir);
       if (plain === void 0) {
-        const abs = join5(targetRepo, dir);
-        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join5(abs, ".git")) === null;
+        const abs = join6(targetRepo, dir);
+        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join6(abs, ".git")) === null;
         dirVerdicts.set(dir, plain);
       }
       if (!plain)
@@ -6221,7 +6880,7 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
       ...merged,
       INSTALL_MANIFEST_REL
     ])
-  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join5(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
+  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join6(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
   const ignored = readIgnoredPaths(targetRepo, paths);
   if (ignored === null)
     return null;
@@ -6244,7 +6903,7 @@ function lstatOrNull(path) {
 }
 function readFileOrNull(path) {
   try {
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   } catch {
     return null;
   }
@@ -6253,28 +6912,33 @@ function isPlainObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readPluginManifest() {
-  const manifestPath = join5(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
-  const raw = readFileSync5(manifestPath, "utf-8");
+  const manifestPath = join6(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
+  const raw = readFileSync6(manifestPath, "utf-8");
   return JSON.parse(raw);
 }
-function copyManifestCommands(manifest, targetRepo, report, draft, writeSet) {
-  for (const cmd of manifest.commands ?? []) {
-    const srcFile = join5(BUNDLE_ROOT, ".claude-plugin", cmd.path);
-    if (!existsSync3(srcFile)) {
+function planManifestCommands(manifest, targetRepo, previous, writeSet) {
+  const recordedFiles = new Map((previous?.files ?? []).filter((file) => writeSet.files.has(file.path)).map((file) => [file.path, file]));
+  return (manifest.commands ?? []).map((cmd) => {
+    const srcFile = join6(BUNDLE_ROOT, ".claude-plugin", cmd.path);
+    if (!existsSync4(srcFile)) {
       throw new Error(`[halfcycle] plugin.json declares command "${cmd.name}" at "${cmd.path}", but no file exists there (${srcFile}). The manifest and commands/ must agree.`);
     }
     const rel = commandStubRel(cmd.name);
-    const destFile = join5(targetRepo, rel);
-    const content = readFileSync5(srcFile, "utf-8");
-    const recorded = draft.files.get(rel);
-    const { outcome, replacedExisting } = writeCollisionSafe(destFile, targetRepo, content, (current) => bytesAreOurs(rel, current, recorded, writeSet));
-    record(report, outcome, rel);
-    if (replacedExisting)
-      report.replacedPaths.push(rel);
-    if (outcome === "collided" && recorded !== void 0)
-      report.editedCollidedPaths.push(rel);
-    noteFile(draft, targetRepo, rel, outcome);
+    const content = readFileSync6(srcFile, "utf-8");
+    const recorded = recordedFiles.get(rel);
+    const planned = decideCollisionSafe(join6(targetRepo, rel), targetRepo, content, (current) => bytesAreOurs(rel, current, recorded, writeSet));
+    return { ...planned, editedCollided: planned.outcome === "collided" && recorded !== void 0 };
+  });
+}
+function putPlannedFile(targetRepoRoot, planned) {
+  if (planned.outcome !== "written")
+    return;
+  if (!isAllowlisted(planned.rel)) {
+    throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${planned.rel}". Only the method surface and scaffolding paths are writable.`);
   }
+  const target = join6(targetRepoRoot, planned.rel);
+  mkdirSync5(dirname3(target), { recursive: true });
+  writeFileSync5(target, planned.text, "utf-8");
 }
 function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
@@ -6287,71 +6951,66 @@ function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths)
   writeFileSync5(targetAbsPath, content, "utf-8");
   writtenPaths.push(rel);
 }
-function writeCollisionSafe(targetAbsPath, targetRepoRoot, content, isOurs) {
+function decideCollisionSafe(targetAbsPath, targetRepoRoot, content, isOurs) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
-  let replacedExisting = false;
-  const current = existsSync3(targetAbsPath) ? readFileSync5(targetAbsPath) : null;
+  const current = existsSync4(targetAbsPath) ? readFileSync6(targetAbsPath) : null;
   const text = inLineEndingOf(current?.toString("utf-8") ?? null, content);
-  if (current !== null) {
-    if (current.toString("utf-8") === text)
-      return { outcome: "skipped", replacedExisting: false };
-    if (!isOurs(current))
-      return { outcome: "collided", replacedExisting: false };
-    replacedExisting = true;
-  }
-  mkdirSync5(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync5(targetAbsPath, text, "utf-8");
-  return { outcome: "written", replacedExisting };
+  if (current === null)
+    return { rel, text, outcome: "written", replacedExisting: false };
+  if (current.toString("utf-8") === text)
+    return { rel, text, outcome: "skipped", replacedExisting: false };
+  if (!isOurs(current))
+    return { rel, text, outcome: "collided", replacedExisting: false };
+  return { rel, text, outcome: "written", replacedExisting: true };
 }
 var INSTALLER_OWNED_DIR = ".halfcycle/";
 function writeOwned(targetAbsPath, targetRepoRoot, content) {
+  const planned = decideOwned(targetAbsPath, targetRepoRoot, content);
+  putPlannedFile(targetRepoRoot, planned);
+  return planned.outcome;
+}
+function decideOwned(targetAbsPath, targetRepoRoot, content) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
   if (!rel.startsWith(INSTALLER_OWNED_DIR)) {
-    throw new Error(`[halfcycle] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (writeOwnedGenerated) rather than assumed from where it sits.`);
+    throw new Error(`[halfcycle] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (decideOwnedGenerated) rather than assumed from where it sits.`);
   }
   const current = readFileOrNull(targetAbsPath);
   const text = inLineEndingOf(current, content);
   if (current === text)
-    return "skipped";
-  mkdirSync5(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync5(targetAbsPath, text, "utf-8");
-  return "written";
+    return { rel, text, outcome: "skipped", replacedExisting: false };
+  return { rel, text, outcome: "written", replacedExisting: existsSync4(targetAbsPath) };
 }
 var GENERATED_HEADER_LINE_INDEX = 1;
-function writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker) {
+function decideOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
-  let replacedExisting = false;
-  if (existsSync3(targetAbsPath)) {
-    const current = readFileSync5(targetAbsPath, "utf-8");
-    if (current === content)
-      return { outcome: "skipped", replacedExisting: false };
-    const headerLine = current.split("\n")[GENERATED_HEADER_LINE_INDEX] ?? "";
-    if (!headerLine.startsWith(generatedMarker))
-      return { outcome: "collided", replacedExisting: false };
-    replacedExisting = true;
+  if (!existsSync4(targetAbsPath))
+    return { rel, text: content, outcome: "written", replacedExisting: false };
+  const current = readFileSync6(targetAbsPath, "utf-8");
+  if (current === content)
+    return { rel, text: content, outcome: "skipped", replacedExisting: false };
+  const headerLine = current.split("\n")[GENERATED_HEADER_LINE_INDEX] ?? "";
+  if (!headerLine.startsWith(generatedMarker)) {
+    return { rel, text: content, outcome: "collided", replacedExisting: false };
   }
-  mkdirSync5(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync5(targetAbsPath, content, "utf-8");
-  return { outcome: "written", replacedExisting };
+  return { rel, text: content, outcome: "written", replacedExisting: true };
 }
-function recordOwnedGenerated(report, targetAbsPath, targetRepoRoot, content, generatedMarker, rel) {
-  const { outcome, replacedExisting } = writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker);
-  record(report, outcome, rel);
-  if (replacedExisting)
-    report.replacedPaths.push(rel);
-  return outcome;
+function recordOwnedGenerated(report, planned) {
+  record(report, planned.outcome, planned.rel);
+  if (planned.replacedExisting)
+    report.replacedPaths.push(planned.rel);
+  return planned.outcome;
 }
 function recordOwned(report, targetAbsPath, targetRepoRoot, content, rel) {
-  const existedBefore = existsSync3(targetAbsPath);
+  const existedBefore = existsSync4(targetAbsPath);
   const outcome = writeOwned(targetAbsPath, targetRepoRoot, content);
   record(report, outcome, rel);
   if (outcome === "written" && existedBefore)
@@ -6373,8 +7032,8 @@ var DENY_PATTERNS = [
 ];
 var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
 function readExistingSettings(targetRepo) {
-  const settingsPath = join5(targetRepo, SETTINGS_REL);
-  return existsSync3(settingsPath) ? JSON.parse(readFileSync5(settingsPath, "utf-8")) : void 0;
+  const settingsPath = join6(targetRepo, SETTINGS_REL);
+  return existsSync4(settingsPath) ? JSON.parse(readFileSync6(settingsPath, "utf-8")) : void 0;
 }
 var SettingsParseRefused = class extends Error {
   constructor(message) {
@@ -6383,11 +7042,11 @@ var SettingsParseRefused = class extends Error {
   }
 };
 function settingsParseRefusal(targetRepo, err) {
-  const file = join5(targetRepo, SETTINGS_REL);
+  const file = join6(targetRepo, SETTINGS_REL);
   const offset = /position (\d+)/.exec(err instanceof Error ? err.message : "")?.[1];
   let where = "";
   if (offset !== void 0) {
-    const before = readFileSync5(file, "utf-8").slice(0, Number(offset)).split("\n");
+    const before = readFileSync6(file, "utf-8").slice(0, Number(offset)).split("\n");
     where = ` (line ${before.length}, column ${before[before.length - 1].length + 1})`;
   }
   return `${file} could not be read as JSON${where} \u2014 fix it and run "npx halfcycle" again.`;
@@ -6398,18 +7057,18 @@ var HALFCYCLE_STATUS_LINE = Object.freeze({
   command: 'bash "$CLAUDE_PROJECT_DIR"/.claude/hooks/guard-runner.sh statusline'
 });
 function statusLineSetElsewhere(targetRepo, home = homedir2(), env = process.env) {
-  const places = [join5(targetRepo, ".claude", "settings.local.json"), join5(home, ".claude", "settings.json")];
+  const places = [join6(targetRepo, ".claude", "settings.local.json"), join6(home, ".claude", "settings.json")];
   const configDir = env["CLAUDE_CONFIG_DIR"];
   if (configDir !== void 0 && configDir !== "") {
-    const expanded = configDir === "~" ? home : configDir.startsWith("~/") ? join5(home, configDir.slice(2)) : configDir;
-    places.push(join5(isAbsolute2(expanded) ? expanded : resolve(expanded), "settings.json"));
+    const expanded = configDir === "~" ? home : configDir.startsWith("~/") ? join6(home, configDir.slice(2)) : configDir;
+    places.push(join6(isAbsolute2(expanded) ? expanded : resolve(expanded), "settings.json"));
   }
   return places.some((path) => {
-    if (!existsSync3(path))
+    if (!existsSync4(path))
       return false;
     let value;
     try {
-      value = JSON.parse(readFileSync5(path, "utf-8"));
+      value = JSON.parse(readFileSync6(path, "utf-8"));
     } catch {
       return true;
     }
@@ -6646,6 +7305,10 @@ ${GENERATED_SESSION_END_HEADER} the Halfcycle installer.
 # written at session start. Deletion happens HERE and not at stop time: the stop
 # hook runs at the end of every turn, and deleting the marker there would throw
 # away the session's starting point for every later turn.
+#
+# Also removes the two small files this session may have left behind for its
+# checks to hand findings across turns, both named by this session's id alone,
+# with no fallback name to remove when there is none.
 INPUT="$(cat 2>/dev/null || true)"
 
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
@@ -6666,6 +7329,8 @@ rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}.eval" 2>/dev/null || true
 if [ -n "$SESSION_ID" ]; then
   rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.ref" 2>/dev/null || true
   rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.eval" 2>/dev/null || true
+  rm -f "\${MARKER_DIR}/halfcycle-findings-\${SESSION_ID}.json" 2>/dev/null || true
+  rm -f "\${MARKER_DIR}/halfcycle-own-\${SESSION_ID}.jsonl" 2>/dev/null || true
 fi
 exit 0
 `;
@@ -6725,19 +7390,20 @@ function generateUserPromptScopeHook() {
   return `#!/usr/bin/env bash
 ${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer, now also for the close review.
 #
-# Lets the owner of this project approve a phase's scope, or send it back, and
-# decide one part of a phase's close review, by typing one line as the whole
-# prompt in their own Claude Code session: "approve <phase>", "send back
-# <phase>: <note>", "accept <phase>/<part>", "question <phase>/<part>: <words>",
-# "carry <phase>/<part>: <words>" or "drop <phase>/<part>: <words>".
+# Lets the owner of this project approve a phase's scope, or send it back,
+# decide one part of a phase's close review, or turn builds running on their
+# own on or off, by typing one line as the whole prompt in their own Claude
+# Code session: "approve <phase>", "send back <phase>: <note>", "accept
+# <phase>/<part>", "question <phase>/<part>: <words>", "carry <phase>/<part>:
+# <words>", "drop <phase>/<part>: <words>", "autonomy on" or "autonomy off".
 #
 # AN ORDINARY PROMPT STARTS NOTHING. This script reads the hook input once and
 # looks only at the start of the prompt's value. Unless the prompt begins, after
 # any whitespace (typed, or escaped in the input), with "approve ", "send back ",
-# "accept ", "question ", "carry " or "drop ", in any case, it exits 0 with no
-# output, and Node never starts. A quote inside any other field arrives escaped,
-# so no other field (the folder the session is in, for one) can read as the
-# start of the prompt.
+# "accept ", "question ", "carry ", "drop " or "autonomy ", in any case, it exits
+# 0 with no output, and Node never starts. A quote inside any other field arrives
+# escaped, so no other field (the folder the session is in, for one) can read as
+# the start of the prompt.
 #
 # Otherwise it finds the project root from its own location, never from the
 # folder the session has moved to, and hands the same input to the guard
@@ -6758,7 +7424,7 @@ IFS= read -r -d '' HC_INPUT || true
 # \\u escape, or as the UTF-8 bytes of a Unicode space. Compared byte for byte.
 HC_LEAD='[[:space:]]|\\\\[nrtf]|\\\\u(000[9a-d]|0020|00a0|1680|200[0-9a]|202[89f]|205f|3000|feff)'
 HC_LEAD="$HC_LEAD|"$'\\xc2\\xa0|\\xe1\\x9a\\x80|\\xe2\\x80[\\x80-\\x8a\\xa8\\xa9\\xaf]|\\xe2\\x81\\x9f|\\xe3\\x80\\x80|\\xef\\xbb\\xbf'
-if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back|accept|question|carry|drop) "; then
+if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back|accept|question|carry|drop|autonomy) "; then
   exit 0
 fi
 
@@ -6771,16 +7437,62 @@ set +e
 exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-submit <<<"$HC_INPUT"
 `;
 }
-var CI_STANZA_KNOWN_HEADER_HASHES = [
-  "b225800b2d699811f32ac213238cbf81c35b5e6a74114bdf55e39cd9d7e2928f",
-  "674181735460f051af7c157222cf851fc3000fb3b8af3a10ea0bde9fe5eaba1f",
-  "d17bde608a6fec54a63cb934a28d88acc8babc205334b5ee84d4ed6ee219d340",
-  "85e71d3f6551977b241a28468f121ee4d1c4edef40a2c4dc1aa6f2f737ebd037"
-];
-function isTrackedAndClean(targetRepo, relPath) {
-  try {
-    execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
-      stdio: "ignore",
+var GENERATED_USER_PROMPT_FINDINGS_HEADER = "# Findings hand-over \u2014 generated by";
+function generateUserPromptFindingsHook() {
+  return `#!/usr/bin/env bash
+${GENERATED_USER_PROMPT_FINDINGS_HEADER} the Halfcycle installer.
+#
+# At the person's next message, before the agent starts, hands it the details of
+# whatever Halfcycle's checks found at an earlier turn end, once.
+#
+# AN ORDINARY PROMPT STARTS NOTHING. With no findings file for this session, this
+# script reads its session id with a bash regex (no node) and exits 0 with no
+# output once it finds no file \u2014 node and grep never start.
+trap 'exit 0' ERR
+set -e
+
+HC_INPUT=""
+IFS= read -r -d '' HC_INPUT || true
+
+# The session id, read with a bash regex held in a variable (a quoted operand to
+# =~ is read as a literal string, not a pattern). An id holding anything outside
+# [A-Za-z0-9-] cannot close the match and leaves this empty, which is read below
+# exactly like no session id at all.
+HC_SESSION_RE='"session_id"[[:space:]]*:[[:space:]]*"([A-Za-z0-9-]+)"'
+HC_SESSION_ID=""
+if [[ "$HC_INPUT" =~ $HC_SESSION_RE ]]; then
+  HC_SESSION_ID="\${BASH_REMATCH[1]}"
+fi
+if [ -z "$HC_SESSION_ID" ]; then
+  exit 0
+fi
+
+HC_FINDINGS_DIR="\${TMPDIR:-/tmp}"
+HC_FINDINGS_DIR="\${HC_FINDINGS_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
+HC_FINDINGS_FILE="\${HC_FINDINGS_DIR}/halfcycle-findings-\${HC_SESSION_ID}.json"
+if [ ! -f "$HC_FINDINGS_FILE" ]; then
+  exit 0
+fi
+
+HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
+export CLAUDE_PROJECT_DIR="$HC_PROJECT_ROOT"
+
+trap - ERR
+set +e
+exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-findings <<<"$HC_INPUT"
+`;
+}
+var CI_STANZA_KNOWN_HEADER_HASHES = [
+  "b225800b2d699811f32ac213238cbf81c35b5e6a74114bdf55e39cd9d7e2928f",
+  "674181735460f051af7c157222cf851fc3000fb3b8af3a10ea0bde9fe5eaba1f",
+  "d17bde608a6fec54a63cb934a28d88acc8babc205334b5ee84d4ed6ee219d340",
+  "85e71d3f6551977b241a28468f121ee4d1c4edef40a2c4dc1aa6f2f737ebd037"
+];
+function isTrackedAndClean(targetRepo, relPath) {
+  try {
+    execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
+      stdio: "ignore",
       env: gitEnvForNamedRepo()
     });
   } catch {
@@ -6797,15 +7509,19 @@ function isTrackedAndClean(targetRepo, relPath) {
   return true;
 }
 function removeLegacyCiStanza(targetRepo) {
-  return removeRetiredGeneratedFile(targetRepo, ".halfcycle/ci-stanza.yml", 0, CI_STANZA_KNOWN_HEADER_HASHES);
+  return removeRetiredGeneratedFile(targetRepo, LEGACY_CI_STANZA_REL, 0, CI_STANZA_KNOWN_HEADER_HASHES);
 }
 function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeaderHashes) {
-  const path = join5(targetRepo, rel);
-  if (!existsSync3(path))
+  const decided = decideRetiredRemoval(targetRepo, rel, headerLineIndex, knownHeaderHashes);
+  return decided === "removed" ? removePlannedRetiredFile(targetRepo, rel) : decided;
+}
+function decideRetiredRemoval(targetRepo, rel, headerLineIndex, knownHeaderHashes) {
+  const path = join6(targetRepo, rel);
+  if (!existsSync4(path))
     return "absent";
   let raw;
   try {
-    raw = readFileSync5(path, "utf-8");
+    raw = readFileSync6(path, "utf-8");
   } catch {
     return "failed";
   }
@@ -6815,13 +7531,20 @@ function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeade
     return "kept-foreign";
   if (!isTrackedAndClean(targetRepo, rel))
     return "kept-uncommitted";
+  return "removed";
+}
+function removePlannedRetiredFile(targetRepo, rel) {
   try {
-    rmSync2(path);
+    rmSync2(join6(targetRepo, rel));
   } catch {
     return "failed";
   }
   return "removed";
 }
+var LEGACY_CI_STANZA_REL = ".halfcycle/ci-stanza.yml";
+function planLegacyCiStanzaRemoval(targetRepo) {
+  return decideRetiredRemoval(targetRepo, LEGACY_CI_STANZA_REL, 0, CI_STANZA_KNOWN_HEADER_HASHES);
+}
 var MCP_HEADERS_HELPER_COMMAND = `node -e "${nodeFloorProgram([
   `const p=require('path'),f=require('fs'),c=require('child_process');`,
   `let d=process.cwd();`,
@@ -6840,13 +7563,14 @@ var MCP_HEADERS_KNOWN_HEADER_HASHES = [
   "37a733ea588b3361b2bbfd86c44e0c95da30d7af6acffd1243ece83c811f0af2",
   "6732ec6d2d2bf7cb33017749a3d021b59af653dcd07c3811693b5a242d44b1a1"
 ];
-function removeRetiredMcpHeadersHelper(targetRepo) {
-  return removeRetiredGeneratedFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL, 1, MCP_HEADERS_KNOWN_HEADER_HASHES);
+function planMcpHeadersHelperRemoval(targetRepo) {
+  return decideRetiredRemoval(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL, 1, MCP_HEADERS_KNOWN_HEADER_HASHES);
 }
 var OWNED_GENERATED_HEADERS = {
   ".claude/hooks/guard-runner.sh": GENERATED_GUARD_RUNNER_HEADER,
   ".claude/hooks/user-prompt-reminder.sh": GENERATED_USER_PROMPT_REMINDER_HEADER,
   ".claude/hooks/user-prompt-scope.sh": GENERATED_USER_PROMPT_SCOPE_HEADER,
+  ".claude/hooks/user-prompt-findings.sh": GENERATED_USER_PROMPT_FINDINGS_HEADER,
   ".claude/hooks/session-end-marker.sh": GENERATED_SESSION_END_HEADER,
   ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER
 };
@@ -6856,6 +7580,7 @@ function hookScriptsThisVersionWrites() {
     [".claude/hooks/session-end-marker.sh", generateSessionEndMarker()],
     [".claude/hooks/user-prompt-reminder.sh", generateUserPromptReminderHook()],
     [".claude/hooks/user-prompt-scope.sh", generateUserPromptScopeHook()],
+    [".claude/hooks/user-prompt-findings.sh", generateUserPromptFindingsHook()],
     [".claude/hooks/session-start-marker.sh", generateSessionStartMarker()]
   ];
 }
@@ -6909,23 +7634,26 @@ function gitignoreCovers(content) {
   const lines = new Set(content.split("\n").map((l) => l.trim()));
   return REQUIRED_GITIGNORE_ENTRIES.every((entry) => lines.has(entry));
 }
-function reconcileGitignore(targetRepo) {
-  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+function planGitignore(targetRepo) {
+  const gitignorePath = join6(targetRepo, GITIGNORE_REL);
   const header = GITIGNORE_HEADER;
+  const before = existsSync4(gitignorePath) ? readFileSync6(gitignorePath, "utf-8") : null;
+  if (before === null) {
+    return { before, after: [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n", outcome: "written" };
+  }
+  if (gitignoreCovers(before))
+    return { before, after: before, outcome: "skipped" };
+  const existingLines = new Set(before.split("\n").map((l) => l.trim()));
+  const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
+  const eol = lineEndingOf(before);
+  const suffix = (before.endsWith("\n") ? "" : eol) + eol + [header, ...toAdd].join(eol) + eol;
+  return { before, after: before + suffix, outcome: "written" };
+}
+function putPlannedGitignore(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.after === null)
+    return planned.outcome;
   try {
-    if (!existsSync3(gitignorePath)) {
-      const body = [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n";
-      writeFileSync5(gitignorePath, body, "utf-8");
-      return "written";
-    }
-    const existing = readFileSync5(gitignorePath, "utf-8");
-    if (gitignoreCovers(existing))
-      return "skipped";
-    const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
-    const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
-    const eol = lineEndingOf(existing);
-    const suffix = (existing.endsWith("\n") ? "" : eol) + eol + [header, ...toAdd].join(eol) + eol;
-    writeFileSync5(gitignorePath, existing + suffix, "utf-8");
+    writeFileSync5(join6(targetRepo, GITIGNORE_REL), planned.after, "utf-8");
     return "written";
   } catch {
     return "failed";
@@ -6934,7 +7662,7 @@ function reconcileGitignore(targetRepo) {
 var GITATTRIBUTES_HEADER = "# Halfcycle \u2014 generated scripts keep LF line endings";
 function readTextOrNull(path) {
   try {
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   } catch {
     return null;
   }
@@ -6943,26 +7671,31 @@ function lfRules(paths) {
   return [...paths].filter((path) => path.endsWith(".sh")).map((path) => `${path} text eol=lf`);
 }
 var REQUIRED_GITATTRIBUTES_RULES = lfRules(Object.keys(OWNED_GENERATED_HEADERS));
-function reconcileGitattributes(targetRepo) {
-  const path = join5(targetRepo, GITATTRIBUTES_REL);
+function planGitattributes(targetRepo) {
+  const path = join6(targetRepo, GITATTRIBUTES_REL);
   const rules = REQUIRED_GITATTRIBUTES_RULES;
-  const routed = [];
+  const before = readTextOrNull(path);
+  if (lstatOrNull(path)?.isSymbolicLink() === true)
+    return { before, after: before, outcome: "failed" };
+  if (!existsSync4(path)) {
+    return { before, after: [GITATTRIBUTES_HEADER, ...rules].join("\n") + "\n", outcome: "written" };
+  }
+  if (before === null)
+    return { before, after: null, outcome: "failed" };
+  const present = new Set(before.split("\n").map((l) => l.trim()));
+  const toAdd = rules.filter((rule) => !present.has(rule));
+  if (toAdd.length === 0)
+    return { before, after: before, outcome: "skipped" };
+  const eol = lineEndingOf(before);
+  const separator = before === "" ? "" : before.endsWith("\n") ? eol : eol + eol;
+  const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join(eol) + eol;
+  return { before, after: before + suffix, outcome: "written" };
+}
+function putPlannedGitattributes(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.after === null)
+    return planned.outcome;
   try {
-    if (lstatOrNull(path)?.isSymbolicLink() === true)
-      return "failed";
-    if (!existsSync3(path)) {
-      writeAllowlisted(path, targetRepo, [GITATTRIBUTES_HEADER, ...rules].join("\n") + "\n", routed);
-      return "written";
-    }
-    const existing = readFileSync5(path, "utf-8");
-    const present = new Set(existing.split("\n").map((l) => l.trim()));
-    const toAdd = rules.filter((rule) => !present.has(rule));
-    if (toAdd.length === 0)
-      return "skipped";
-    const eol = lineEndingOf(existing);
-    const separator = existing === "" ? "" : existing.endsWith("\n") ? eol : eol + eol;
-    const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join(eol) + eol;
-    writeAllowlisted(path, targetRepo, existing + suffix, routed);
+    writeAllowlisted(join6(targetRepo, GITATTRIBUTES_REL), targetRepo, planned.after, []);
     return "written";
   } catch {
     return "failed";
@@ -6981,7 +7714,7 @@ function previousPinForEngagement(targetRepoRoot, engagementId) {
 function nonEmpty(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, createdByAccountId, methodVersion, writtenPaths) {
+function planBundlePin(targetRepoRoot, version, engagementId, engagementType, createdByAccountId, methodVersion) {
   const previous = previousPinForEngagement(targetRepoRoot, engagementId);
   const carried = pinCreatedByAccountId(previous) ?? nonEmpty(createdByAccountId);
   const carriedMethodVersion = nonEmpty(methodVersion) ?? nonEmpty(previous?.methodVersion);
@@ -6996,9 +7729,39 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, c
     ...carriedMethodVersion !== void 0 ? { methodVersion: carriedMethodVersion } : {},
     ...projectPage !== void 0 ? { projectPage } : {}
   };
-  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
-  const pinText = inLineEndingOf(readFileOrNull(pinPath), JSON.stringify(pin, null, 2) + "\n");
-  writeAllowlisted(pinPath, targetRepoRoot, pinText, writtenPaths);
+  const current = readFileOrNull(join6(targetRepoRoot, BUNDLE_PIN_REL));
+  const text = inLineEndingOf(current, JSON.stringify(pin, null, 2) + "\n");
+  return {
+    rel: BUNDLE_PIN_REL,
+    text,
+    outcome: current === text ? "skipped" : "written",
+    replacedExisting: current !== null && current !== text
+  };
+}
+function planBundlePinPreview(targetRepoRoot, version, home) {
+  let existing;
+  try {
+    existing = readBundlePin(targetRepoRoot);
+  } catch {
+    return null;
+  }
+  if (existing === null || nonEmpty(existing.engagementId) === void 0 || existing.engagementType === void 0) {
+    return null;
+  }
+  let pinned;
+  try {
+    pinned = readPinnedEngagement(targetRepoRoot, home);
+  } catch {
+    return null;
+  }
+  if (pinned === null || pinned.engagementId !== existing.engagementId || pinned.credential === void 0) {
+    return null;
+  }
+  return planBundlePin(targetRepoRoot, version, existing.engagementId, existing.engagementType, void 0, void 0);
+}
+function writeBundlePin(targetRepoRoot, planned, writtenPaths) {
+  const pinPath = join6(targetRepoRoot, BUNDLE_PIN_REL);
+  writeAllowlisted(pinPath, targetRepoRoot, planned.text, writtenPaths);
 }
 function updatePinnedMethodVersion(repoRoot, engagementId, version) {
   let pin;
@@ -7009,7 +7772,7 @@ function updatePinnedMethodVersion(repoRoot, engagementId, version) {
   }
   if (pin === null || pin.engagementId !== engagementId)
     return;
-  const pinPath = join5(repoRoot, BUNDLE_PIN_REL);
+  const pinPath = join6(repoRoot, BUNDLE_PIN_REL);
   const updated = { ...pin, methodVersion: version };
   const pinText = inLineEndingOf(readFileOrNull(pinPath), JSON.stringify(updated, null, 2) + "\n");
   try {
@@ -7029,17 +7792,17 @@ function renderCrewRoster() {
 }
 function writeCrewRoster(targetRepoRoot, report) {
   const rendered = renderCrewRoster();
-  const crewPath = join5(targetRepoRoot, CREW_ROSTER_REL);
+  const crewPath = join6(targetRepoRoot, CREW_ROSTER_REL);
   return recordOwned(report, crewPath, targetRepoRoot, rendered, CREW_ROSTER_REL);
 }
 function pinCreatedByAccountId(pin) {
   return nonEmpty(pin?.createdByAccountId) ?? nonEmpty(pin?.accountId);
 }
 function readBundlePin(targetRepoRoot) {
-  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
-  if (!existsSync3(pinPath))
+  const pinPath = join6(targetRepoRoot, BUNDLE_PIN_REL);
+  if (!existsSync4(pinPath))
     return null;
-  return JSON.parse(readFileSync5(pinPath, "utf-8"));
+  return JSON.parse(readFileSync6(pinPath, "utf-8"));
 }
 function readPinnedEngagement(targetRepoRoot, home) {
   const pin = readBundlePin(targetRepoRoot);
@@ -7062,7 +7825,7 @@ function readPinnedEngagement(targetRepoRoot, home) {
 }
 function readLegacyEnvLocal(targetRepoRoot) {
   try {
-    return parseEnvText(readFileSync5(join5(targetRepoRoot, LEGACY_ENV_LOCAL_REL), "utf-8"));
+    return parseEnvText(readFileSync6(join6(targetRepoRoot, LEGACY_ENV_LOCAL_REL), "utf-8"));
   } catch {
     return null;
   }
@@ -7100,15 +7863,32 @@ function checkDrift(targetRepoRoot) {
   const current = manifest.version;
   return { drifted: installed !== current, installed, current, methodVersion: pin?.methodVersion ?? null };
 }
-function writeProjectIdentity(targetRepo) {
-  if (existsSync3(join5(targetRepo, PROJECT_IDENTITY_REL))) {
-    repairRemoteCredential(targetRepo);
-    return "skipped";
+function writeProjectIdentity(targetRepo, planned, probe = false) {
+  if (planned.action === "add" || probe) {
+    createProjectIdentityFile(targetRepo, planned.after ?? void 0);
   }
-  createProjectIdentityFile(targetRepo);
-  return "written";
+  if (planned.action === "change" && planned.after !== null)
+    replaceProjectIdentityFile(targetRepo, planned.after);
+  return planned.action === "add" ? "written" : "skipped";
 }
 function writeEngagementCredential(credential, engagementId, home) {
+  return writeEngagementEnv(engagementId, engagementCredentialValues(credential, engagementId), home);
+}
+function planEngagementCredential(credential, engagementId, home) {
+  let existing;
+  try {
+    existing = readFileSync6(engagementEnvPath(engagementId, home), "utf-8");
+  } catch {
+    existing = null;
+  }
+  const reconciled = reconcileEnvText2(existing, engagementCredentialValues(credential, engagementId));
+  return {
+    outcome: existing === reconciled ? "skipped" : "written",
+    existed: existing !== null,
+    storedAfter: parseEnvText(reconciled)
+  };
+}
+function engagementCredentialValues(credential, engagementId) {
   const values = {
     HALFCYCLE_SERVICE_URL: credential.serviceUrl,
     // T-22 — the second origin, persisted for the developer and for any tool that
@@ -7136,16 +7916,16 @@ function writeEngagementCredential(credential, engagementId, home) {
     // telemetry origin, same as every other optional field on `DeviceCredential`.
     CONTROL_TELEMETRY_URL: credential.controlTelemetryUrl ?? ""
   };
-  return writeEngagementEnv(engagementId, values, home);
+  return values;
 }
 var LEGACY_ENV_LOCAL_REL = ".env.local";
 function migrateLegacyEnvLocal(targetRepo, stored) {
-  const path = join5(targetRepo, LEGACY_ENV_LOCAL_REL);
-  if (!existsSync3(path))
+  const path = join6(targetRepo, LEGACY_ENV_LOCAL_REL);
+  if (!existsSync4(path))
     return { outcome: "absent", unbacked: [], missingForAdoption: [] };
   let raw;
   try {
-    raw = readFileSync5(path, "utf-8");
+    raw = readFileSync6(path, "utf-8");
   } catch {
     return { outcome: "failed", unbacked: [], missingForAdoption: [] };
   }
@@ -7166,24 +7946,91 @@ function migrateLegacyEnvLocal(targetRepo, stored) {
     return !ours.has(line.slice(0, eq).replace(/^\s*export\s+/, "").trim());
   });
   const substantive = kept.filter((line) => line.trim() !== "" && !line.trim().startsWith("# Halfcycle"));
+  if (substantive.length === 0)
+    return { outcome: "removed", unbacked: [], missingForAdoption: [] };
+  return { outcome: "stripped", unbacked: [], missingForAdoption: [], keptText: kept.join("\n") };
+}
+function applyLegacyMigration(targetRepo, decided) {
+  const path = join6(targetRepo, LEGACY_ENV_LOCAL_REL);
   try {
-    if (substantive.length === 0) {
+    if (decided.outcome === "removed") {
       rmSync2(path);
-      return { outcome: "removed", unbacked: [], missingForAdoption: [] };
+      return decided;
+    }
+    if (decided.outcome === "stripped" && decided.keptText !== void 0) {
+      writeFileSync5(path, decided.keptText, "utf-8");
+      return decided;
     }
-    writeFileSync5(path, kept.join("\n"), "utf-8");
-    return { outcome: "stripped", unbacked: [], missingForAdoption: [] };
+    return decided;
   } catch {
     return { outcome: "failed", unbacked: [], missingForAdoption: [] };
   }
 }
 async function install(options) {
-  const { targetRepo, engagementId, engagementType, credential, home, createdByAccountId } = options;
-  assertEngagementId(engagementId);
-  if (!existsSync3(targetRepo)) {
-    throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
-  }
+  return applyInstallPlan(planInstall(options));
+}
+function planCommandStubs(targetRepo, previous, writeSet) {
   const manifest = readPluginManifest();
+  return { version: manifest.version, commands: planManifestCommands(manifest, targetRepo, previous, writeSet) };
+}
+function planVendoredBinary(targetRepo) {
+  return decideOwned(join6(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs"), targetRepo, readFileSync6(resolveVendoredBinary(), "utf-8"));
+}
+function planSettings(targetRepo, previous, home, env) {
+  const settingsPath = join6(targetRepo, SETTINGS_REL);
+  const preexisted = existsSync4(settingsPath);
+  const generated = JSON.parse(generateSettingsJson());
+  let existing;
+  try {
+    existing = readExistingSettings(targetRepo) ?? {};
+  } catch (err) {
+    throw new SettingsParseRefused(settingsParseRefusal(targetRepo, err));
+  }
+  const retiredOurs = retiredRulesThisInstallAdded(previous);
+  const statusLine = statusLineSetElsewhere(targetRepo, home, env) ? void 0 : HALFCYCLE_STATUS_LINE;
+  const merged = mergeSettings(existing, generated, retiredOurs, statusLine);
+  const current = readFileOrNull(settingsPath);
+  const text = inLineEndingOf(current, JSON.stringify(merged, null, 2) + "\n");
+  const file = {
+    rel: SETTINGS_REL,
+    text,
+    // Identical bytes are not rewritten; the report still names the file as merged or
+    // written by whether it was there, as it always has.
+    outcome: current === text ? "skipped" : "written",
+    replacedExisting: false
+  };
+  return { file, preexisted, existing, generated, merged, retiredOurs };
+}
+function planHookScripts(targetRepo) {
+  return hookScriptsThisVersionWrites().map(([rel, content]) => decideOwnedGenerated(join6(targetRepo, rel), targetRepo, content, OWNED_GENERATED_HEADERS[rel]));
+}
+function planMcpRegistration(targetRepo, credential) {
+  const mcpPath = join6(targetRepo, MCP_REGISTRATION_REL);
+  const existing = existsSync4(mcpPath) ? readFileSync6(mcpPath, "utf-8") : null;
+  if (credential === void 0)
+    return { kind: "none", existing };
+  if (credential === "pending")
+    return { kind: "pending", existing };
+  const text = inLineEndingOf(existing, generateMcpRegistration(existing, credential.mcpUrl));
+  const outcome = existing === null ? "written" : existing !== text ? "merged" : "skipped";
+  return { kind: "write", existing, text, outcome };
+}
+function putPlannedMcp(targetRepo, planned) {
+  if (planned.kind !== "write" || planned.outcome === "skipped")
+    return;
+  writeAllowlisted(join6(targetRepo, MCP_REGISTRATION_REL), targetRepo, planned.text, []);
+}
+function planCrewRoster(targetRepo) {
+  return decideOwned(join6(targetRepo, CREW_ROSTER_REL), targetRepo, renderCrewRoster());
+}
+function planInstallRecord(targetRepo, text) {
+  return decideOwned(join6(targetRepo, INSTALL_MANIFEST_REL), targetRepo, text);
+}
+function accountInstall(steps, actual) {
+  const { targetRepo, writeSet, pin } = steps;
+  if (pin === null || steps.mcp.kind === "pending" || steps.engagementId === void 0) {
+    throw new Error("[halfcycle] a plan still waiting for the service cannot be applied or recorded.");
+  }
   const report = {
     writtenPaths: [],
     skippedPaths: [],
@@ -7192,38 +8039,22 @@ async function install(options) {
     editedCollidedPaths: [],
     replacedPaths: []
   };
-  const writeSet = closedWriteSet();
-  const draft = startManifest(readPreviousManifest(targetRepo), (path) => writeSet.files.has(path), (path) => writeSet.dirs.has(path));
-  const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
-  copyManifestCommands(manifest, targetRepo, report, draft, writeSet);
-  const vendoredBinSrc = resolveVendoredBinary();
-  const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  const vendoredOutcome = recordOwned(report, vendoredBinDest, targetRepo, readFileSync5(vendoredBinSrc, "utf-8"), VENDORED_BIN_REL);
-  noteFile(draft, targetRepo, VENDORED_BIN_REL, vendoredOutcome);
-  const settingsPath = join5(targetRepo, SETTINGS_REL);
-  const settingsPreexisted = existsSync3(settingsPath);
-  const generatedSettings = JSON.parse(generateSettingsJson());
-  let existingSettings;
-  try {
-    existingSettings = readExistingSettings(targetRepo) ?? {};
-  } catch (err) {
-    throw new SettingsParseRefused(settingsParseRefusal(targetRepo, err));
-  }
-  const retiredOurs = retiredRulesThisInstallAdded(draft.previous);
-  const statusLine = statusLineSetElsewhere(targetRepo, home, options.env) ? void 0 : HALFCYCLE_STATUS_LINE;
-  const mergedSettings = mergeSettings(existingSettings, generatedSettings, retiredOurs, statusLine);
-  recordSettingsMerge(draft, existingSettings, generatedSettings, settingsPreexisted, mergedSettings);
-  recordDenyRetired(draft, retiredOurs.map((rule) => sha256Hex(rule)));
-  const mergedSettingsText = inLineEndingOf(readFileOrNull(settingsPath), JSON.stringify(mergedSettings, null, 2) + "\n");
-  mkdirSync5(dirname3(settingsPath), { recursive: true });
-  writeFileSync5(settingsPath, mergedSettingsText, "utf-8");
-  (settingsPreexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
-  for (const [rel, content] of hookScriptsThisVersionWrites()) {
-    const hookPath = join5(targetRepo, rel);
-    const outcome = recordOwnedGenerated(report, hookPath, targetRepo, content, OWNED_GENERATED_HEADERS[rel], rel);
-    noteFile(draft, targetRepo, rel, outcome);
-  }
-  switch (removeLegacyCiStanza(targetRepo)) {
+  const draft = startManifest(steps.previous, (path) => writeSet.files.has(path), (path) => writeSet.dirs.has(path));
+  for (const command of steps.commands) {
+    recordOwnedGenerated(report, command);
+    if (command.editedCollided)
+      report.editedCollidedPaths.push(command.rel);
+    noteFile(draft, command.rel, command.outcome, actual.bytesAfter);
+  }
+  noteFile(draft, VENDORED_BIN_REL, recordOwnedGenerated(report, steps.vendored), actual.bytesAfter);
+  const settings = steps.settings;
+  recordSettingsMerge(draft, settings.existing, settings.generated, settings.preexisted, settings.merged);
+  recordDenyRetired(draft, settings.retiredOurs.map((rule) => sha256Hex(rule)));
+  (settings.preexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
+  for (const hook of steps.hooks) {
+    noteFile(draft, hook.rel, recordOwnedGenerated(report, hook), actual.bytesAfter);
+  }
+  switch (actual.ciStanza) {
     case "removed":
       report.writtenPaths.push(".halfcycle/ci-stanza.yml (REMOVED \u2014 Halfcycle no longer generates this file)");
       break;
@@ -7239,20 +8070,17 @@ async function install(options) {
     case "absent":
       break;
   }
-  if (credential) {
-    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
-    const existingMcp = existsSync3(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
-    const mcpContent = inLineEndingOf(existingMcp, generateMcpRegistration(existingMcp, credential.mcpUrl));
-    recordMcpMerge(draft, existingMcp, mcpContent);
-    if (existingMcp === null) {
-      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.writtenPaths);
-    } else if (existingMcp !== mcpContent) {
-      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.mergedPaths);
-    } else {
+  const mcp = steps.mcp;
+  if (mcp.kind === "write") {
+    recordMcpMerge(draft, mcp.existing, mcp.text);
+    if (mcp.outcome === "written")
+      report.writtenPaths.push(MCP_REGISTRATION_REL);
+    else if (mcp.outcome === "merged")
+      report.mergedPaths.push(MCP_REGISTRATION_REL);
+    else
       report.skippedPaths.push(MCP_REGISTRATION_REL);
-    }
     const helperRel = RETIRED_MCP_HEADERS_HELPER_REL;
-    switch (removeRetiredMcpHeadersHelper(targetRepo)) {
+    switch (actual.mcpHelper) {
       case "removed":
         recordRemovedFile(draft, helperRel);
         report.writtenPaths.push(`${helperRel} (REMOVED \u2014 Halfcycle no longer uses this file)`);
@@ -7267,43 +8095,36 @@ async function install(options) {
         report.skippedPaths.push(`${helperRel} (could not be removed \u2014 Halfcycle no longer uses this file, DELETE IT BY HAND)`);
         break;
       case "absent":
+      case null:
         break;
     }
   } else {
     report.skippedPaths.push(`${MCP_REGISTRATION_REL} (no MCP origin \u2014 no credential supplied)`);
-    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
-    if (existsSync3(mcpPath))
-      recordMcpAdoptionOnly(draft, readFileSync5(mcpPath, "utf-8"));
+    if (mcp.existing !== null)
+      recordMcpAdoptionOnly(draft, mcp.existing);
   }
-  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
-  const gitignoreBefore = existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null;
-  const gitignoreOutcome = reconcileGitignore(targetRepo);
-  recordGitignoreReconcile(draft, gitignoreBefore, existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null, writeSet);
-  if (gitignoreOutcome === "failed") {
+  recordGitignoreReconcile(draft, steps.gitignore.before, actual.gitignoreAfter, writeSet);
+  if (actual.gitignore === "failed") {
     report.skippedPaths.push(".gitignore (write failed \u2014 see credential refusal)");
   } else {
-    record(report, gitignoreOutcome, ".gitignore");
+    record(report, actual.gitignore, ".gitignore");
   }
-  const gitattributesPath = join5(targetRepo, GITATTRIBUTES_REL);
-  const gitattributesBefore = readTextOrNull(gitattributesPath);
-  const gitattributesOutcome = reconcileGitattributes(targetRepo);
-  recordGitattributesReconcile(draft, gitattributesBefore, readTextOrNull(gitattributesPath), writeSet);
-  if (gitattributesOutcome === "failed") {
+  recordGitattributesReconcile(draft, steps.gitattributes.before, actual.gitattributesAfter, writeSet);
+  if (actual.gitattributes === "failed") {
     report.skippedPaths.push(`${GITATTRIBUTES_REL} (write failed \u2014 a clone made with core.autocrlf=true may check the hook scripts out with CRLF line endings)`);
   } else {
-    record(report, gitattributesOutcome, GITATTRIBUTES_REL);
+    record(report, actual.gitattributes, GITATTRIBUTES_REL);
   }
-  const identityOutcome = writeProjectIdentity(targetRepo);
+  const identityOutcome = steps.identity.action === "add" ? "written" : "skipped";
   record(report, identityOutcome, PROJECT_IDENTITY_REL);
-  noteFile(draft, targetRepo, PROJECT_IDENTITY_REL, identityOutcome);
-  const credentialPath = engagementEnvPath(engagementId, home);
-  if (credential) {
-    record(report, writeEngagementCredential(credential, engagementId, home), credentialPath);
+  noteFile(draft, PROJECT_IDENTITY_REL, identityOutcome, actual.bytesAfter);
+  const credentialPath = engagementEnvPath(steps.engagementId, steps.home);
+  if (actual.credential !== null) {
+    record(report, actual.credential, credentialPath);
   } else {
     report.skippedPaths.push(`${credentialPath} (no credential supplied)`);
   }
-  const stored = readEngagementEnv(engagementId, home) ?? {};
-  const migration = migrateLegacyEnvLocal(targetRepo, stored);
+  const migration = actual.legacy;
   switch (migration.outcome) {
     case "removed":
       report.writtenPaths.push(".env.local (REMOVED \u2014 the credential now lives outside this repository)");
@@ -7320,32 +8141,22 @@ async function install(options) {
     case "absent":
       break;
   }
-  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, createdByAccountId, credential?.methodVersion, report.writtenPaths);
-  noteFile(draft, targetRepo, BUNDLE_PIN_REL, "written");
-  noteFile(draft, targetRepo, CREW_ROSTER_REL, writeCrewRoster(targetRepo, report));
-  const scanResult = runBootstrapScan(targetRepo);
-  if (existsSync3(join5(targetRepo, BOOTSTRAP_STATE_REL)))
+  if (pin.outcome === "written")
+    report.writtenPaths.push(BUNDLE_PIN_REL);
+  noteFile(draft, BUNDLE_PIN_REL, "written", actual.bytesAfter);
+  noteFile(draft, CREW_ROSTER_REL, recordOwnedGenerated(report, steps.crew), actual.bytesAfter);
+  if (actual.stateExistsAfter)
     recordPerMachineFile(draft, BOOTSTRAP_STATE_REL);
   for (const dir of writeSet.dirs) {
-    if (!dirsBefore.has(dir) && existsSync3(join5(targetRepo, dir)))
+    if (!steps.dirsBefore.has(dir) && actual.dirExistsAfter(dir))
       recordCreatedDir(draft, dir);
   }
   const installManifest = finishManifest(draft);
   assertManifestInWriteSet(installManifest, writeSet);
-  recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
-  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
-  return {
-    version: manifest.version,
-    writtenPaths: report.writtenPaths,
-    skippedPaths: report.skippedPaths,
-    mergedPaths: report.mergedPaths,
-    collidedPaths: report.collidedPaths,
-    editedCollidedPaths: report.editedCollidedPaths,
-    replacedPaths: report.replacedPaths,
-    bootstrapScanRan: scanResult.ran,
-    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
-    notShared
-  };
+  return { report, installManifest, manifestText: serializeManifest(installManifest) };
+}
+function recordInstallRecord(report, planned) {
+  recordOwnedGenerated(report, planned);
 }
 var SELF_BUILD_GITIGNORE_REL = ".halfcycle/.gitignore";
 var SELF_BUILD_GITIGNORE_TEXT = "bin/\n";
@@ -7359,7 +8170,7 @@ function mcpHasHalfcycleEntry(text) {
 function installSelfBuild(options) {
   const { targetRepo, engagementId, credential, freshlyMinted, home } = options;
   assertEngagementId(engagementId);
-  if (!existsSync3(targetRepo)) {
+  if (!existsSync4(targetRepo)) {
     throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
   }
   const report = {
@@ -7370,7 +8181,7 @@ function installSelfBuild(options) {
     editedCollidedPaths: [],
     replacedPaths: []
   };
-  const at = (rel) => join5(targetRepo, rel);
+  const at = (rel) => join6(targetRepo, rel);
   const version = readPluginManifest().version;
   const existingMcp = readFileOrNull(at(MCP_REGISTRATION_REL));
   const mcpText = existingMcp === null || !mcpHasHalfcycleEntry(existingMcp) ? inLineEndingOf(existingMcp, generateMcpRegistration(existingMcp, credential.mcpUrl)) : null;
@@ -7381,17 +8192,17 @@ function installSelfBuild(options) {
   if (mcpText !== null) {
     writeAllowlisted(at(MCP_REGISTRATION_REL), targetRepo, mcpText, report.writtenPaths);
   }
-  if (!existsSync3(at(VENDORED_BIN_REL))) {
-    recordOwned(report, at(VENDORED_BIN_REL), targetRepo, readFileSync5(resolveVendoredBinary(), "utf-8"), VENDORED_BIN_REL);
+  if (!existsSync4(at(VENDORED_BIN_REL))) {
+    recordOwned(report, at(VENDORED_BIN_REL), targetRepo, readFileSync6(resolveVendoredBinary(), "utf-8"), VENDORED_BIN_REL);
   }
-  if (!existsSync3(at(SELF_BUILD_GITIGNORE_REL))) {
+  if (!existsSync4(at(SELF_BUILD_GITIGNORE_REL))) {
     writeAllowlisted(at(SELF_BUILD_GITIGNORE_REL), targetRepo, SELF_BUILD_GITIGNORE_TEXT, report.writtenPaths);
   }
-  if (!existsSync3(at(CREW_ROSTER_REL))) {
+  if (!existsSync4(at(CREW_ROSTER_REL))) {
     writeCrewRoster(targetRepo, report);
   }
-  if (!existsSync3(at(BUNDLE_PIN_REL))) {
-    writeBundlePin(targetRepo, version, engagementId, "self-build", void 0, credential.methodVersion, report.writtenPaths);
+  if (!existsSync4(at(BUNDLE_PIN_REL))) {
+    writeBundlePin(targetRepo, planBundlePin(targetRepo, version, engagementId, "self-build", void 0, credential.methodVersion), report.writtenPaths);
   }
   return { writtenPaths: report.writtenPaths, credentialWritten };
 }
@@ -7507,14 +8318,14 @@ async function bindLoopback(env = process.env, engagementId) {
     else
       pending = callback;
   }, engagementId));
-  const bindProblem = await new Promise((resolve7) => {
+  const bindProblem = await new Promise((resolve8) => {
     const onError = (err) => {
-      resolve7(`${err.code ?? "bind failed"} on ${LOOPBACK_REDIRECT_HOST}:${wanted.port}`);
+      resolve8(`${err.code ?? "bind failed"} on ${LOOPBACK_REDIRECT_HOST}:${wanted.port}`);
     };
     server.once("error", onError);
     server.listen({ host: LOOPBACK_REDIRECT_HOST, port: wanted.port }, () => {
       server.removeListener("error", onError);
-      resolve7(null);
+      resolve8(null);
     });
   });
   if (bindProblem !== null) {
@@ -7530,9 +8341,9 @@ async function bindLoopback(env = process.env, engagementId) {
     bound: true,
     target: { port: address.port, state },
     boundAddress: address.address,
-    waitForCallback: ({ timeoutMs, onStillWaiting, stillWaitingMs = DEFAULT_STILL_WAITING_MS }) => new Promise((resolve7) => {
+    waitForCallback: ({ timeoutMs, onStillWaiting, stillWaitingMs = DEFAULT_STILL_WAITING_MS }) => new Promise((resolve8) => {
       if (pending !== null) {
-        resolve7(pending);
+        resolve8(pending);
         return;
       }
       const startedAt = Date.now();
@@ -7543,7 +8354,7 @@ async function bindLoopback(env = process.env, engagementId) {
         clearTimeout(timer);
         deliver = null;
         abandon = null;
-        resolve7(value);
+        resolve8(value);
       };
       const timer = setTimeout(() => finish(null), Math.max(0, timeoutMs));
       deliver = finish;
@@ -7557,9 +8368,9 @@ async function bindLoopback(env = process.env, engagementId) {
   };
 }
 function closeServer(server) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     server.closeAllConnections();
-    server.close(() => resolve7());
+    server.close(() => resolve8());
   });
 }
 
@@ -7582,7 +8393,7 @@ function defaultWrite(text) {
   process.stdout.write(text);
 }
 function defaultSleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 function browserOpenCommand(os, url) {
   if (os === "darwin")
@@ -7629,12 +8440,12 @@ async function openBrowser(url, env = process.env, os = platform3(), spawnImpl =
     };
   }
   const { command, args: args2, windowsVerbatimArguments } = browserOpenCommand(os, url);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let child;
     try {
       child = spawnImpl(command, args2, { stdio: "ignore", env, windowsVerbatimArguments });
     } catch {
-      resolve7({ opened: false, reason: `${command} could not be run` });
+      resolve8({ opened: false, reason: `${command} could not be run` });
       return;
     }
     let settled = false;
@@ -7643,7 +8454,7 @@ async function openBrowser(url, env = process.env, os = platform3(), spawnImpl =
         return;
       settled = true;
       clearTimeout(timer);
-      resolve7(attempt);
+      resolve8(attempt);
     };
     const timer = setTimeout(() => {
       child.unref();
@@ -7788,17 +8599,17 @@ async function pollBesideLoopback(serviceUrl, started, wake, deps) {
       continue;
     }
     if (sleep === void 0) {
-      await new Promise((resolve7) => {
-        const timer = setTimeout(resolve7, started.pollIntervalMs);
+      await new Promise((resolve8) => {
+        const timer = setTimeout(resolve8, started.pollIntervalMs);
         interrupt = () => {
           clearTimeout(timer);
-          resolve7();
+          resolve8();
         };
       });
     } else {
-      await new Promise((resolve7) => {
-        interrupt = resolve7;
-        void sleep(started.pollIntervalMs).then(resolve7);
+      await new Promise((resolve8) => {
+        interrupt = resolve8;
+        void sleep(started.pollIntervalMs).then(resolve8);
       });
     }
     interrupt = null;
@@ -8074,8 +8885,8 @@ async function switchAccount(serviceUrl, opts = {}) {
 function writeToStdout(text) {
   process.stdout.write(text);
 }
-async function replaceRefusedCredential(serviceUrl, refused2, opts = {}) {
-  if (refused2.source !== "stored")
+async function replaceRefusedCredential(serviceUrl, refused3, opts = {}) {
+  if (refused3.source !== "stored")
     return null;
   forgetStoredCredential(serviceUrl, opts.home);
   (opts.write ?? writeToStdout)(`[halfcycle] Your saved Halfcycle sign-in was refused \u2014 signing you in again.
@@ -8420,9 +9231,9 @@ function wrongAccountVisibility(act) {
 async function askLine(question2) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    return await new Promise((resolve7) => {
-      rl.once("close", () => resolve7(""));
-      rl.question(question2).then(resolve7, () => resolve7(""));
+    return await new Promise((resolve8) => {
+      rl.once("close", () => resolve8(""));
+      rl.question(question2).then(resolve8, () => resolve8(""));
     });
   } finally {
     rl.close();
@@ -8658,8 +9469,8 @@ async function joinPinnedEngagement(serviceUrl, engagementId, targetRepo, deps =
 
 // dist/pre-create-checks.js
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync6, realpathSync } from "node:fs";
-import { delimiter, dirname as dirname4, join as join6 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync7, realpathSync } from "node:fs";
+import { delimiter, dirname as dirname4, join as join7 } from "node:path";
 var KEPT_FOLDER_ID_LINE = 'Nothing on the Halfcycle service needs undoing, and this folder keeps its project id, so running "npx halfcycle" again picks up where it left off.';
 var PreCreateRefused = class extends Error {
   constructor(message) {
@@ -8702,7 +9513,7 @@ function refuseSystemFolder(targetRepo, platform6 = process.platform) {
 function refuseInsideProject(targetRepo) {
   let folder = realOrLiteral(targetRepo);
   for (let parent = dirname4(folder); parent !== folder; folder = parent, parent = dirname4(parent)) {
-    if (existsSync4(join6(parent, BUNDLE_PIN_REL))) {
+    if (existsSync5(join7(parent, BUNDLE_PIN_REL))) {
       throw new PreCreateRefused(`${targetRepo} is inside the Halfcycle project at ${parent} \u2014 open that folder in Claude Code instead, or run "npx halfcycle" in a folder outside it.`);
     }
   }
@@ -8725,35 +9536,43 @@ async function offerGitForWindows() {
     return true;
   throw new PreCreateRefused(`Git for Windows is needed and is not installed \u2014 install it with "${GIT_INSTALL_COMMAND}" or from ${GIT_DOWNLOAD_PAGE}, then open a new terminal and run "npx halfcycle" again.`);
 }
-function hasGitBash(env) {
-  const onPath = (env["PATH"] ?? "").split(delimiter).filter((dir) => dir !== "" && existsSync4(join6(dir, "git.exe"))).map((dir) => join6(dir, "..", "bin", "bash.exe"));
+function gitBashPath(env) {
+  const onPath = (env["PATH"] ?? "").split(delimiter).filter((dir) => dir !== "" && existsSync5(join7(dir, "git.exe"))).map((dir) => join7(dir, "..", "bin", "bash.exe"));
   const candidates = [
     env["CLAUDE_CODE_GIT_BASH_PATH"],
     ...onPath,
-    env["ProgramFiles"] === void 0 ? void 0 : join6(env["ProgramFiles"], "Git", "bin", "bash.exe")
+    env["ProgramFiles"] === void 0 ? void 0 : join7(env["ProgramFiles"], "Git", "bin", "bash.exe")
   ];
-  return candidates.some((file) => file !== void 0 && file !== "" && existsSync4(file));
+  return candidates.find((file) => file !== void 0 && file !== "" && existsSync5(file));
+}
+function hasGitBash(env) {
+  return gitBashPath(env) !== void 0;
 }
 function runWingetInstall() {
   return spawnSync("winget", [...GIT_INSTALL_ARGS], { stdio: "inherit" }).status === 0;
 }
+function unreadableProjectRefusal(targetRepo) {
+  return `${join7(targetRepo, PROJECT_IDENTITY_REL)} could not be read as a Halfcycle project file \u2014 delete the .halfcycle folder in ${targetRepo} and run "npx halfcycle" again to start a new project here.`;
+}
+function cannotWriteRefusal(targetRepo) {
+  return `cannot write to ${targetRepo} \u2014 run "npx halfcycle" in a folder you can write to.`;
+}
 function claimFolderId(targetRepo) {
+  const planned = planProjectIdentity(targetRepo);
   try {
-    createProjectIdentityFile(targetRepo);
+    writeProjectIdentity(targetRepo, planned, true);
   } catch {
-    throw new PreCreateRefused(`cannot write to ${targetRepo} \u2014 run "npx halfcycle" in a folder you can write to.`);
+    throw new PreCreateRefused(cannotWriteRefusal(targetRepo));
   }
-  repairRemoteCredential(targetRepo);
   const folderId = readFolderId(targetRepo);
-  if (folderId === void 0) {
-    throw new PreCreateRefused(`${join6(targetRepo, PROJECT_IDENTITY_REL)} could not be read as a Halfcycle project file \u2014 delete the .halfcycle folder in ${targetRepo} and run "npx halfcycle" again to start a new project here.`);
-  }
+  if (folderId === void 0)
+    throw new PreCreateRefused(unreadableProjectRefusal(targetRepo));
   return folderId;
 }
 function readFolderId(targetRepo) {
   let folderId;
   try {
-    const text = readFileSync6(join6(targetRepo, PROJECT_IDENTITY_REL), "utf-8");
+    const text = readFileSync7(join7(targetRepo, PROJECT_IDENTITY_REL), "utf-8");
     folderId = JSON.parse(text)?.projectId;
   } catch {
     return void 0;
@@ -8769,20 +9588,420 @@ function checkSettingsParse(targetRepo) {
   }
 }
 
+// dist/folder-refusals.js
+import { realpathSync as realpathSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+function folderMissingRefusal(targetRepo) {
+  return `halfcycle: no such directory: ${targetRepo}`;
+}
+function folderIsFileRefusal(targetRepo) {
+  return `halfcycle: ${targetRepo} is a file \u2014 run "npx halfcycle" with a project folder instead.`;
+}
+function monorepoRefusal(targetRepo) {
+  return `halfcycle: refusing to install into the Halfcycle monorepo itself (${targetRepo}).
+  The bare form installs into the CURRENT directory, and this directory is the
+  product's own source tree \u2014 installing here would write over tracked files.
+  To see what this CLI does:      halfcycle --help
+  To install into a real project: halfcycle <path-to-that-repo>`;
+}
+function homeFolderRefusal(targetRepo) {
+  return `halfcycle: refusing to set up in your home folder (${targetRepo}). Run "npx halfcycle" inside a project folder.`;
+}
+function isHomeFolder(dir) {
+  try {
+    const target = realpathSync2(dir);
+    const home = realpathSync2(homedir3());
+    return process.platform === "win32" ? target.toLowerCase() === home.toLowerCase() : target === home;
+  } catch {
+    return false;
+  }
+}
+
+// dist/preview.js
+import { accessSync, constants, existsSync as existsSync6, readFileSync as readFileSync9, statSync } from "node:fs";
+import { join as join9 } from "node:path";
+
+// dist/halfcycle-monorepo.js
+import { readFileSync as readFileSync8 } from "node:fs";
+import { join as join8 } from "node:path";
+var MONOREPO_PACKAGE_NAME = "halfcycle-monorepo";
+function isHalfcycleMonorepo(dir) {
+  try {
+    const pkg = JSON.parse(readFileSync8(join8(dir, "package.json"), "utf-8"));
+    return pkg.name === MONOREPO_PACKAGE_NAME;
+  } catch {
+    return false;
+  }
+}
+function isSelfBuildInstallForm(engagementIdArg, engagementTypeArg) {
+  return engagementIdArg !== void 0 && engagementTypeArg === "self-build";
+}
+
+// dist/preview.js
+var CLAUDE_MD_REL = "CLAUDE.md";
+var AGENTS_IMPORT_LINE = "@AGENTS.md";
+var WORDS = {
+  intro: "Halfcycle would set up this folder like this. Nothing has been written.",
+  remove: "an older Halfcycle file this version no longer uses",
+  claudeMdWillAdd: "already holds your own instructions; your first session will add one line to it, pointing to AGENTS.md",
+  claudeMdAlreadyPoints: "already holds your own instructions, including the line pointing to AGENTS.md",
+  signIn: "  This project's sign-in, kept on this computer for you only, in your home folder's .halfcycle folder.",
+  newProject: "  A new project on Halfcycle's service for this folder, made when you sign in.",
+  gitForWindows: "  Git for Windows, which Claude Code needs: setting up will ask before installing it with winget.",
+  firstSession: "Your first session will then write your project's own files as you answer its questions, starting with AGENTS.md and CLAUDE.md, which hold your project's own instructions.",
+  toSetUp: `To set up for real, run: ${HALFCYCLE_COMMAND}`,
+  planFailed: "halfcycle: setting up this folder would stop on a file that could not be read. Nothing has been written; fix that file, then run the preview again."
+};
+function runPreview(targetRepo, options) {
+  const refusal2 = previewRefusal(targetRepo, options);
+  if (refusal2 !== void 0)
+    return { refusal: refusal2 };
+  let plan;
+  try {
+    plan = planInstall({ targetRepo, env: options.env, home: options.home });
+  } catch {
+    return { refusal: WORDS.planFailed };
+  }
+  if (plan.refusal !== void 0)
+    return { refusal: plan.refusal };
+  return {
+    text: renderPreview(plan, gitBashPath(options.env) === void 0 && options.platform === "win32", claudeMdLine(targetRepo))
+  };
+}
+function claudeMdLine(targetRepo) {
+  const path = join9(targetRepo, CLAUDE_MD_REL);
+  if (!existsSync6(path))
+    return void 0;
+  let text;
+  try {
+    text = readFileSync9(path, "utf-8");
+  } catch {
+    return WORDS.claudeMdWillAdd;
+  }
+  return text.includes(AGENTS_IMPORT_LINE) ? WORDS.claudeMdAlreadyPoints : WORDS.claudeMdWillAdd;
+}
+function previewRefusal(targetRepo, options) {
+  if (!existsSync6(targetRepo))
+    return folderMissingRefusal(targetRepo);
+  if (!statSync(targetRepo).isDirectory())
+    return folderIsFileRefusal(targetRepo);
+  if (isHalfcycleMonorepo(targetRepo))
+    return monorepoRefusal(targetRepo);
+  if (isHomeFolder(targetRepo))
+    return homeFolderRefusal(targetRepo);
+  try {
+    refuseSystemFolder(targetRepo, options.platform);
+    refuseInsideProject(targetRepo);
+  } catch (err) {
+    if (err instanceof PreCreateRefused)
+      return err.message;
+    throw err;
+  }
+  try {
+    accessSync(targetRepo, constants.W_OK);
+  } catch {
+    return cannotWriteRefusal(targetRepo);
+  }
+  if (existsSync6(join9(targetRepo, PROJECT_IDENTITY_REL)) && readFolderId(targetRepo) === void 0) {
+    return unreadableProjectRefusal(targetRepo);
+  }
+  try {
+    checkSettingsParse(targetRepo);
+  } catch (err) {
+    if (err instanceof PreCreateRefused)
+      return err.message;
+    throw err;
+  }
+  return void 0;
+}
+function wordsOf(entry) {
+  const words = PREVIEW_WORDS[entry.kind];
+  switch (entry.action) {
+    case "add":
+      return words.add;
+    case "change":
+      return words.change;
+    case "remove":
+      return WORDS.remove;
+    case "leave":
+      return entry.yours === true ? words.yours : words.leave;
+  }
+}
+var HEADINGS = [
+  ["add", "Add:"],
+  ["change", "Change:"],
+  ["remove", "Remove:"],
+  ["leave", "Leave alone:"]
+];
+function outsideLine2(outside) {
+  return outside.kind === "sign-in" ? WORDS.signIn : WORDS.newProject;
+}
+function renderPreview(plan, missingGitForWindows, claudeMdWords) {
+  const lines = [WORDS.intro];
+  for (const [action, heading] of HEADINGS) {
+    const rows = plan.entries.filter((entry) => entry.action === action);
+    const claudeMdRow = action === "leave" && claudeMdWords !== void 0;
+    if (rows.length === 0 && !claudeMdRow)
+      continue;
+    lines.push("", heading);
+    for (const entry of rows)
+      lines.push(`  ${entry.path} \u2014 ${wordsOf(entry)}`);
+    if (claudeMdRow)
+      lines.push(`  ${CLAUDE_MD_REL} \u2014 ${claudeMdWords}`);
+  }
+  lines.push("", "Outside this folder:");
+  for (const outside of plan.outside)
+    lines.push(outsideLine2(outside));
+  if (missingGitForWindows)
+    lines.push(WORDS.gitForWindows);
+  lines.push("", WORDS.firstSession, "", WORDS.toSetUp);
+  return lines.join("\n");
+}
+
+// dist/doctor.js
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
+import { join as join10 } from "node:path";
+var GUARD_RUNNER_REL2 = ".claude/hooks/guard-runner.sh";
+var CONNECTION_VERB = "check-connection";
+var WRAPPER_TIMEOUT_MS = 3e4;
+var SIGNED_OUT_KINDS = ["not-signed-in", "other-account", "signed-out"];
+var NOT_CONNECTED_KINDS = ["update-claude-code", "cannot-reach", "service-problem"];
+var KNOWN_KINDS = ["connected", "not-registered", ...SIGNED_OUT_KINDS, ...NOT_CONNECTED_KINDS];
+function runDoctor(root, options) {
+  const current = packageVersion();
+  const installed = installedVersion(root);
+  const upToDate = installed === current;
+  const setUp = setUpLine(root, upToDate);
+  let running = setUp.state === "no" ? { state: "not-run" } : startWrapper(root, options);
+  if (setUp.state === "yes" && running.state === "answered" && running.kind === "not-registered") {
+    running = failed(repairSentence());
+  }
+  const checksRunning = checksRunningLine(running);
+  const connection = connectionLines(running);
+  const version = upToDate ? { ok: true, text: `Up to date: yes (${current}).` } : { ok: false, text: versionNoLine(installed, current) };
+  const lines = [setUp.line, connection.signedIn, connection.connected, checksRunning, version];
+  const failing = lines.filter((line) => !line.ok).length;
+  const closing = failing === 0 ? "Everything is working." : `${failing} of these need fixing; each line above says what to do.`;
+  return {
+    text: [...lines.map((line) => line.text), closing].join("\n"),
+    exitCode: failing === 0 ? 0 : 1
+  };
+}
+function setUpLine(root, upToDate) {
+  if (!existsSync7(join10(root, BUNDLE_PIN_REL))) {
+    return {
+      state: "no",
+      line: {
+        ok: false,
+        text: `Set up: no. Halfcycle is not set up in this folder. To set it up, run ${HALFCYCLE_COMMAND} here.`
+      }
+    };
+  }
+  const missing = [];
+  if (!pinNamesProject(root))
+    missing.push("Halfcycle's project record");
+  if (!existsSync7(join10(root, INSTALL_MANIFEST_REL)))
+    missing.push("the install record");
+  if (!existsSync7(join10(root, VENDORED_BIN_REL)))
+    missing.push("Halfcycle's check program");
+  if (!mcpNamesServer(root))
+    missing.push("Halfcycle's server entry");
+  if (upToDate && !settingsRegisterEveryCommand(root))
+    missing.push("the checks in your settings");
+  if (missing.length === 0)
+    return { state: "yes", line: { ok: true, text: "Set up: yes." } };
+  return {
+    state: "not-complete",
+    line: {
+      ok: false,
+      text: `Set up: not complete. Missing: ${naturalList(missing)}. To put it back, run ${HALFCYCLE_COMMAND} here; nothing of yours is changed.`
+    }
+  };
+}
+function pinNamesProject(root) {
+  try {
+    const pin = readBundlePin(root);
+    return typeof pin?.engagementId === "string" && pin.engagementId !== "";
+  } catch {
+    return false;
+  }
+}
+function mcpNamesServer(root) {
+  const parsed = readJson(join10(root, MCP_REGISTRATION_REL));
+  if (!isObject(parsed) || !isObject(parsed["mcpServers"]))
+    return false;
+  const entry = parsed["mcpServers"][MCP_SERVER_KEY];
+  return isObject(entry) && typeof entry["url"] === "string";
+}
+function settingsRegisterEveryCommand(root) {
+  const parsed = readJson(join10(root, SETTINGS_REL));
+  if (!isObject(parsed) || !isObject(parsed["hooks"]))
+    return false;
+  const registered = /* @__PURE__ */ new Set();
+  for (const groups of Object.values(parsed["hooks"])) {
+    if (!Array.isArray(groups))
+      continue;
+    for (const group of groups) {
+      if (!isObject(group) || !Array.isArray(group["hooks"]))
+        continue;
+      for (const hook of group["hooks"]) {
+        if (isObject(hook) && typeof hook["command"] === "string")
+          registered.add(hook["command"]);
+      }
+    }
+  }
+  return HALFCYCLE_HOOK_WIRING.every((entry) => registered.has(entry.command));
+}
+function startWrapper(root, options) {
+  const disabledIn = settingsDisablingHooks(root);
+  if (disabledIn !== void 0) {
+    return failed(`Checks running: no. Your settings turn off every check (${disabledIn}, "disableAllHooks"). Remove that line, then open a new session.`);
+  }
+  let shell = "bash";
+  if (options.platform === "win32") {
+    const gitBash = gitBashPath(options.env);
+    if (gitBash === void 0) {
+      return failed("Checks running: no. Claude Code needs Git for Windows to run Halfcycle's checks. Install it, then open a new session.");
+    }
+    shell = gitBash;
+  }
+  const wrapper = join10(root, GUARD_RUNNER_REL2);
+  if (!existsSync7(wrapper))
+    return failed(repairSentence());
+  const run = spawnSync2(shell, [wrapper, CONNECTION_VERB], {
+    cwd: root,
+    env: { ...options.env, CLAUDE_PROJECT_DIR: root },
+    encoding: "utf-8",
+    timeout: WRAPPER_TIMEOUT_MS,
+    windowsHide: true
+  });
+  if (run.error !== void 0 || run.status === null)
+    return failed(repairSentence());
+  if (run.status === 127) {
+    return failed(`Checks running: no. ${NO_NODE_SENTENCE}`);
+  }
+  if (run.status !== 0) {
+    if (String(run.stderr).includes("Halfcycle needs Node")) {
+      return failed(`Checks running: no. Halfcycle's checks need Node ${NODE_FLOOR_MAJOR} or newer. Install it, then open a new session.`);
+    }
+    return failed(repairSentence());
+  }
+  const answer = parseAnswer(String(run.stdout));
+  if (answer === void 0)
+    return failed(repairSentence());
+  return { state: "answered", ...answer };
+}
+function settingsDisablingHooks(root) {
+  for (const rel of [SETTINGS_REL, LOCAL_SETTINGS_REL]) {
+    const parsed = readJson(join10(root, rel));
+    if (isObject(parsed) && parsed["disableAllHooks"] === true)
+      return rel;
+  }
+  return void 0;
+}
+function parseAnswer(stdout) {
+  const last = stdout.split("\n").map((line) => line.trim()).filter((line) => line !== "").pop();
+  if (last === void 0)
+    return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(last);
+  } catch {
+    return void 0;
+  }
+  if (!isObject(parsed) || typeof parsed["kind"] !== "string" || !KNOWN_KINDS.includes(parsed["kind"]))
+    return void 0;
+  const sentence = parsed["sentence"];
+  if (sentence !== null && typeof sentence !== "string")
+    return void 0;
+  if (parsed["kind"] !== "not-registered" && typeof sentence !== "string")
+    return void 0;
+  return { kind: parsed["kind"], sentence };
+}
+function checksRunningLine(running) {
+  if (running.state === "not-run")
+    return notChecked("Checks running", "Set up");
+  if (running.state === "failed")
+    return running.line;
+  return { ok: true, text: "Checks running: yes." };
+}
+function failed(text) {
+  return { state: "failed", line: { ok: false, text } };
+}
+function repairSentence() {
+  return `Checks running: no. Halfcycle's check could not start. To repair it, run ${HALFCYCLE_COMMAND} here.`;
+}
+function connectionLines(running) {
+  if (running.state !== "answered") {
+    return { signedIn: notChecked("Signed in", "Checks running"), connected: notChecked("Connected", "Checks running") };
+  }
+  const { kind, sentence } = running;
+  if (kind === "not-registered") {
+    return { signedIn: notChecked("Signed in", "Set up"), connected: notChecked("Connected", "Set up") };
+  }
+  if (kind === "connected") {
+    return { signedIn: { ok: true, text: "Signed in: yes." }, connected: { ok: true, text: "Connected: yes." } };
+  }
+  if (SIGNED_OUT_KINDS.includes(kind)) {
+    return {
+      signedIn: { ok: false, text: `Signed in: no. ${sentence ?? ""}`.trimEnd() },
+      connected: notChecked("Connected", "Signed in")
+    };
+  }
+  return {
+    signedIn: { ok: true, text: "Signed in: yes." },
+    connected: { ok: false, text: `Connected: no. ${sentence ?? ""}`.trimEnd() }
+  };
+}
+function installedVersion(root) {
+  try {
+    return checkDrift(root).installed;
+  } catch {
+    return null;
+  }
+}
+function versionNoLine(installed, current) {
+  if (installed === null) {
+    return `Up to date: no. This folder has no Halfcycle version recorded; the newest is ${current}. To set it up, run ${HALFCYCLE_COMMAND} here.`;
+  }
+  return `Up to date: no. This folder has Halfcycle ${installed}; the newest is ${current}. To update, run ${HALFCYCLE_COMMAND} here.`;
+}
+function notChecked(check, earlier) {
+  return { ok: false, text: `${check}: not checked, because ${earlier} is not working yet.` };
+}
+function naturalList(items) {
+  if (items.length <= 1)
+    return items.join("");
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+function readJson(path) {
+  if (!existsSync7(path))
+    return void 0;
+  try {
+    return JSON.parse(readFileSync10(path, "utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // dist/claude-plan.js
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
 import { platform as platform4 } from "node:os";
-import { dirname as dirname5, join as join7 } from "node:path";
+import { dirname as dirname5, join as join11 } from "node:path";
 var CLAUDE_PLAN_FILENAME = "claude-plan.json";
 var PLAN_QUESTION_TRIES = 3;
 var SEND_TIMEOUT_MS = 5e3;
 var SETTINGS_PAGE_SEGMENT = "settings";
 function claudePlanPath(home) {
-  return join7(halfcycleHome(home), CLAUDE_PLAN_FILENAME);
+  return join11(halfcycleHome(home), CLAUDE_PLAN_FILENAME);
 }
 function readRememberedClaudePlan(home) {
   try {
-    const parsed = claudePlanRequestSchema.safeParse(JSON.parse(readFileSync7(claudePlanPath(home), "utf-8")));
+    const parsed = claudePlanRequestSchema.safeParse(JSON.parse(readFileSync11(claudePlanPath(home), "utf-8")));
     return parsed.success ? parsed.data.claudePlan : void 0;
   } catch {
     return void 0;
@@ -8853,6 +10072,8 @@ async function setupClaudePlan(input, deps) {
       }
       return { kind: "remembered", plan: remembered, sent };
     }
+    if (deps.assumeYes === true)
+      return { kind: "no-person" };
     let plan = null;
     for (let tries = 0; tries < PLAN_QUESTION_TRIES && plan === null; tries++) {
       plan = claudePlanFromAnswer(await deps.ask(`${CLAUDE_PLAN_QUESTION} `));
@@ -8866,22 +10087,6 @@ async function setupClaudePlan(input, deps) {
   }
 }
 
-// dist/halfcycle-monorepo.js
-import { readFileSync as readFileSync8 } from "node:fs";
-import { join as join8 } from "node:path";
-var MONOREPO_PACKAGE_NAME = "halfcycle-monorepo";
-function isHalfcycleMonorepo(dir) {
-  try {
-    const pkg = JSON.parse(readFileSync8(join8(dir, "package.json"), "utf-8"));
-    return pkg.name === MONOREPO_PACKAGE_NAME;
-  } catch {
-    return false;
-  }
-}
-function isSelfBuildInstallForm(engagementIdArg, engagementTypeArg) {
-  return engagementIdArg !== void 0 && engagementTypeArg === "self-build";
-}
-
 // dist/probe-mcp.js
 var PROBE_TIMEOUT_MS = 5e3;
 async function probeMcpOrigin(mcpUrl, token) {
@@ -8936,8 +10141,8 @@ async function probeMcpOrigin(mcpUrl, token) {
 
 // dist/claude-version-probe.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync5, realpathSync as realpathSync2 } from "node:fs";
-import { delimiter as delimiter2, join as join9 } from "node:path";
+import { existsSync as existsSync8, realpathSync as realpathSync3 } from "node:fs";
+import { delimiter as delimiter2, join as join12 } from "node:path";
 function probeClaudeCodeVersion(timeoutMs, deps = {}) {
   const platform6 = deps.platform ?? process.platform;
   const exec = deps.exec ?? execFileSync3;
@@ -8974,10 +10179,10 @@ var INSTALL_METHOD_RULES = [
 function probeClaudeCodeInstallMethod(deps = {}) {
   const env = deps.env ?? process.env;
   const platform6 = deps.platform ?? process.platform;
-  const exists = deps.exists ?? existsSync5;
+  const exists = deps.exists ?? existsSync8;
   const realpath = deps.realpath ?? ((file) => {
     try {
-      return realpathSync2(file);
+      return realpathSync3(file);
     } catch {
       return file;
     }
@@ -8986,7 +10191,7 @@ function probeClaudeCodeInstallMethod(deps = {}) {
   const dirs = (env["PATH"] ?? "").split(delimiter2).filter((dir) => dir !== "");
   for (const dir of dirs) {
     for (const name of names) {
-      const file = join9(dir, name);
+      const file = join12(dir, name);
       if (!exists(file))
         continue;
       const real = realpath(file);
@@ -8997,8 +10202,8 @@ function probeClaudeCodeInstallMethod(deps = {}) {
 }
 
 // dist/build-record/write.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, rmSync as rmSync4 } from "node:fs";
-import { basename as basename2, join as join10, resolve as resolve3, relative as relative2, isAbsolute as isAbsolute3 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, rmSync as rmSync4 } from "node:fs";
+import { basename as basename2, join as join13, resolve as resolve3, relative as relative2, isAbsolute as isAbsolute3 } from "node:path";
 
 // dist/build-record/render-v2.js
 var HIDDEN = /[\p{Cc}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/u;
@@ -9390,10 +10595,14 @@ function renderClose(heading, observed, attested, checks, p, closingRound = fals
   ];
 }
 var REVIEW_LABEL = "**Recorded by Halfcycle from the owner's review.** Each part the review held, and how the project's owner decided it. A line marked as the agent's is the agent's own answer, not Halfcycle's.";
+var REVIEW_LABEL_WITH_AUTONOMY = `**Recorded by Halfcycle from the owner's review.** Each part the review held, and how it was decided: by the project's owner, unless the part says it was ${DECIDED_BY_AUTONOMY_SENTENCE}. A line marked as the agent's is the agent's own answer, not Halfcycle's.`;
 var REVIEW_NO_PARTS = "The review had no parts, so it closed on one accept that names no part.";
 function approvalLine(approval) {
   if (approval.kind === "none")
     return "Built without an approved scope.";
+  if (approval.givenIn === "autonomy") {
+    return `Plan version ${String(approval.planVersion)} was ${APPROVED_IN_ADVANCE_SENTENCE}.`;
+  }
   const where = approval.givenIn === "console" ? "in the console" : "in their own session";
   return `Scope approved by the project's owner, plan version ${String(approval.planVersion)}, ${where}.`;
 }
@@ -9407,8 +10616,11 @@ function decisionText(part, p) {
       return `Dropped: ${p.text(part.reason ?? "")}`;
   }
 }
+var DECIDED_BY_AUTONOMY_LINE = `${DECIDED_BY_AUTONOMY_SENTENCE.charAt(0).toUpperCase()}${DECIDED_BY_AUTONOMY_SENTENCE.slice(1)}.`;
 function reviewPartLines(part, p) {
   const lines = [`- ${p.itemStart(part.name)} \u2014 ${decisionText(part, p)}`];
+  if (part.givenIn === "autonomy")
+    lines.push(`  - ${DECIDED_BY_AUTONOMY_LINE}`);
   const code = codeLinkLine(part.codeLink);
   if (code !== void 0)
     lines.push(`  - ${p.text(code)}`);
@@ -9428,7 +10640,8 @@ function removalsLine(record2, p) {
 }
 function renderReview(record2, p) {
   const review = record2.review;
-  const blocks = ["## The owner's review", REVIEW_LABEL, approvalLine(review.approval)];
+  const label = review.parts.some((part) => part.givenIn === "autonomy") ? REVIEW_LABEL_WITH_AUTONOMY : REVIEW_LABEL;
+  const blocks = ["## The owner's review", label, approvalLine(review.approval)];
   blocks.push(review.parts.length === 0 ? REVIEW_NO_PARTS : review.parts.flatMap((part) => reviewPartLines(part, p)).join("\n"));
   const removals = removalsLine(record2, p);
   if (removals !== null)
@@ -9440,10 +10653,9 @@ function renderCalls(calls, p) {
     return [`## ${CALLS_HEADING}`, NO_CALLS_LINE];
   const lines = calls.flatMap((c) => {
     const by = p.itemStart(c.by);
-    return [
-      `- ${callMadeLine({ by, question: p.text(c.question), chose: p.text(c.chose), statedDefault: p.text(c.statedDefault) })}`,
-      `  - ${callUndoLine({ by: p.text(c.by), undoable: c.undoable, how: c.how === null ? null : p.text(c.how) })}`
-    ];
+    const undo = `  - ${callUndoLine({ by: p.text(c.by), undoable: c.undoable, how: c.how === null ? null : p.text(c.how) })}`;
+    const head = c.kind === "listed" ? autonomyC8(by, p.text(c.question), p.text(c.chose)) : callMadeLine({ by, question: p.text(c.question), chose: p.text(c.chose), statedDefault: p.text(c.statedDefault) });
+    return [`- ${head}`, undo];
   });
   return [`## ${CALLS_HEADING}`, CALLS_EXPLAINED, lines.join("\n")];
 }
@@ -9543,7 +10755,7 @@ function renderBuildRecordV2Markdown(record2) {
 }
 
 // dist/build-record/pair-io.js
-import { closeSync, openSync, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync3, writeSync } from "node:fs";
+import { closeSync, openSync, readFileSync as readFileSync12, renameSync as renameSync2, rmSync as rmSync3, writeSync } from "node:fs";
 function createExclusiveOnDisk(path, data) {
   const bytes = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
   const fd = openSync(path, "wx");
@@ -9574,7 +10786,7 @@ function isEexist(err) {
 }
 function readIfPresent(path) {
   try {
-    return readFileSync9(path, "utf-8");
+    return readFileSync12(path, "utf-8");
   } catch {
     return null;
   }
@@ -9606,7 +10818,7 @@ function replaceOne(io, tmp, finalPath, text) {
 }
 
 // dist/build-record/write.js
-var BUILD_RECORD_DIR = join10("docs", "build-records");
+var BUILD_RECORD_DIR = join13("docs", "build-records");
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve3(candidate));
   const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute3(rel) && rel === basename2(rel);
@@ -9644,8 +10856,8 @@ function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_P
   }
   const outDir = resolve3(repoRoot, BUILD_RECORD_DIR);
   const segment = renderPhaseSegment(phase);
-  const jsonPath = join10(outDir, `${segment}.json`);
-  const mdPath = join10(outDir, `${segment}.md`);
+  const jsonPath = join13(outDir, `${segment}.json`);
+  const mdPath = join13(outDir, `${segment}.md`);
   const jsonTmp = `${jsonPath}.tmp`;
   const mdTmp = `${mdPath}.tmp`;
   for (const candidate of [jsonPath, mdPath, jsonTmp, mdTmp]) {
@@ -9659,7 +10871,7 @@ function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_P
   }
   const existingJson = readIfPresent(jsonPath);
   if (existingJson === null) {
-    return { kind: "in-the-way", path: existsSync6(jsonPath) ? jsonPath : mdPath };
+    return { kind: "in-the-way", path: existsSync9(jsonPath) ? jsonPath : mdPath };
   }
   if (existingJson === jsonText) {
     replaceOne(io, mdTmp, mdPath, mdText);
@@ -9686,8 +10898,8 @@ function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_P
 import { relative as relative3 } from "node:path";
 
 // dist/open-phase.js
-import { readFileSync as readFileSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { readFileSync as readFileSync13 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // dist/close-phase.js
 import { execFile, execFileSync as execFileSync4 } from "node:child_process";
@@ -9771,7 +10983,7 @@ function readObserveLine(stdout) {
 function runRunnerChild(binary, args2, credential, repoRoot, readLine, fallback) {
   if (binary instanceof Error)
     return Promise.resolve(fallback);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
       execFile(process.execPath, [binary, ...args2], {
         cwd: repoRoot,
@@ -9781,10 +10993,10 @@ function runRunnerChild(binary, args2, credential, repoRoot, readLine, fallback)
         windowsHide: true
       }, (err, stdout) => {
         const stopped = err !== null && err.killed === true;
-        resolve7(stopped || typeof stdout !== "string" ? fallback : readLine(stdout));
+        resolve8(stopped || typeof stdout !== "string" ? fallback : readLine(stdout));
       });
     } catch {
-      resolve7(fallback);
+      resolve8(fallback);
     }
   });
 }
@@ -9997,6 +11209,14 @@ function closeStepReport(phase, attempt, engagementId) {
         case "unavailable":
           stderr.push(`${REFUSED} the Halfcycle service could not open the review just now. Nothing was sent to the owner. Run this again in a few minutes.`);
           break;
+        case "closed-by-autonomy":
+          stdout.push(autonomyA13(answer.accepted, answer.carried));
+          exitCode = 0;
+          break;
+        case "autonomy-waits":
+          stdout.push(answer.reason === "unchecked-claims" ? autonomyA14(answer.count, answer.parts.map((p) => p.name)) : autonomyA15(answer.count));
+          exitCode = 0;
+          break;
         default:
           return assertNever2(answer);
       }
@@ -10168,7 +11388,7 @@ function readRepoCredential(repoRoot, env = process.env, home) {
   if (pinned !== null)
     assertEngagementId(pinned);
   const fromStore = pinned === null ? null : readEngagementEnv(pinned, home);
-  const looked = pinned === null ? `${join11(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
+  const looked = pinned === null ? `${join14(repoRoot, ".halfcycle", "bundle.json")} (which names no engagement)` : engagementEnvPath(pinned, home);
   const values = {};
   for (const key of OPEN_PHASE_ENV_KEYS) {
     const value = (env[key] ?? fromStore?.[key] ?? "").trim();
@@ -10185,7 +11405,7 @@ function readRepoCredential(repoRoot, env = process.env, home) {
 }
 function readPinnedEngagementId(repoRoot) {
   try {
-    const pin = JSON.parse(readFileSync10(join11(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
+    const pin = JSON.parse(readFileSync13(join14(repoRoot, ".halfcycle", "bundle.json"), "utf-8"));
     const id = pin[PIN_ENGAGEMENT_ID_FIELD];
     return typeof id === "string" && id !== "" ? id : null;
   } catch {
@@ -10404,12 +11624,12 @@ async function readPhaseWork(credential, phase) {
 
 // dist/system-report.js
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { readFileSync as readFileSync11 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { join as join15 } from "node:path";
 function readDescriptionFile(repoRoot) {
   let text;
   try {
-    text = readFileSync11(join12(repoRoot, SYSTEM_DESCRIPTION_REL), "utf-8");
+    text = readFileSync14(join15(repoRoot, SYSTEM_DESCRIPTION_REL), "utf-8");
   } catch (err) {
     const code = err.code;
     return code === "ENOENT" || code === "ENOTDIR" ? { kind: "missing" } : { kind: "unreadable" };
@@ -10423,18 +11643,18 @@ function readDescriptionFile(repoRoot) {
 function problemPlace(raw, path) {
   if (path === "")
     return SYSTEM_DESCRIPTION_REL;
-  const [list, index] = path.split(".");
+  const [list2, index] = path.split(".");
   const position = Number(index);
   if (!Number.isInteger(position) || position < 0)
     return path;
-  const items = typeof raw === "object" && raw !== null ? raw[list ?? ""] : void 0;
+  const items = typeof raw === "object" && raw !== null ? raw[list2 ?? ""] : void 0;
   const item = Array.isArray(items) ? items[position] : void 0;
   const fields = typeof item === "object" && item !== null ? item : {};
-  if (list === "parts") {
+  if (list2 === "parts") {
     const id = fields["id"];
     return typeof id === "string" && id !== "" ? `${path} (part "${id}")` : `${path} (part ${position + 1})`;
   }
-  if (list === "connections") {
+  if (list2 === "connections") {
     const from = fields["from"];
     const to = fields["to"];
     return typeof from === "string" && typeof to === "string" ? `${path} (connection "${from}" to "${to}")` : `${path} (connection ${position + 1})`;
@@ -10633,12 +11853,12 @@ async function runSystem(repoRoot, deps) {
 }
 
 // dist/plan.js
-import { existsSync as existsSync8, readFileSync as readFileSync14 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync17 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // dist/draw/write.js
-import { closeSync as closeSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync12, readSync, realpathSync as realpathSync3, rmSync as rmSync5 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join13, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { closeSync as closeSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync15, readSync, realpathSync as realpathSync4, rmSync as rmSync5 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join16, relative as relative4, resolve as resolve4, sep } from "node:path";
 var DOCS_DIR = "docs";
 var DIAGRAMS_DIR = "diagrams";
 var DIAGRAM_DIR_REL = `${DOCS_DIR}/${DIAGRAMS_DIR}`;
@@ -10694,9 +11914,9 @@ function embedImageLink(base, doc) {
 }
 function diagramPaths(repoRoot, base) {
   const root = resolve4(repoRoot);
-  const dir = join13(root, DOCS_DIR, DIAGRAMS_DIR);
+  const dir = join16(root, DOCS_DIR, DIAGRAMS_DIR);
   const names = fileNames(base);
-  const file = Object.fromEntries(DIAGRAM_FILES.map((which) => [which, join13(dir, names[which])]));
+  const file = Object.fromEntries(DIAGRAM_FILES.map((which) => [which, join16(dir, names[which])]));
   return { repoRoot: root, dir, file };
 }
 function diagramRel(base, which) {
@@ -10725,7 +11945,7 @@ function isInside(outer, inner) {
 function checkDiagramPlace(paths) {
   let root;
   try {
-    root = realpathSync3(paths.repoRoot);
+    root = realpathSync4(paths.repoRoot);
   } catch {
     return { ok: false, why: `the folder ${paths.repoRoot} could not be opened. Check the path, then run this again.` };
   }
@@ -10738,7 +11958,7 @@ function checkDiagramPlace(paths) {
   }
   let real;
   try {
-    real = realpathSync3(ancestor);
+    real = realpathSync4(ancestor);
   } catch {
     return {
       ok: false,
@@ -10791,7 +12011,7 @@ function readExistingSet(paths) {
     if (!stat.isFile())
       return { ok: false, inTheWay: which, temp: false };
     try {
-      found[which] = readFileSync12(paths.file[which]);
+      found[which] = readFileSync15(paths.file[which]);
     } catch {
       return { ok: false, inTheWay: which, temp: false };
     }
@@ -10883,9 +12103,9 @@ function sameBytes(a, b) {
 }
 function writeDiagramSet(repoRoot, base, set, io = NODE_RECORD_PAIR_IO) {
   const paths = diagramPaths(repoRoot, base);
-  const place = checkDiagramPlace(paths);
-  if (!place.ok)
-    return { kind: "unsafe", why: place.why };
+  const place2 = checkDiagramPlace(paths);
+  if (!place2.ok)
+    return { kind: "unsafe", why: place2.why };
   const read = readExistingSet(paths);
   if (!read.ok)
     return { kind: "in-the-way", file: read.inTheWay, temp: read.temp };
@@ -10955,10 +12175,10 @@ function restore(io, paths, renamed, existing) {
 }
 
 // dist/change.js
-import { join as join15 } from "node:path";
+import { join as join18 } from "node:path";
 
 // dist/cli-contract.js
-var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase", "system", "draw", "plan", "review", "check-tasks", "uninstall", "change", "pace", "prove"];
+var CLI_VERBS = ["install", "check-drift", "build-record", "open-phase", "close-phase", "system", "draw", "plan", "review", "check-tasks", "uninstall", "change", "pace", "prove", "preview", "doctor", "restore"];
 var CONTRACTS = [
   { verb: "install", required: [], conditional: [] },
   { verb: "check-drift", required: [], conditional: [] },
@@ -10971,6 +12191,9 @@ var CONTRACTS = [
   { verb: "uninstall", required: [], conditional: [] },
   { verb: "pace", required: [], conditional: [] },
   { verb: "prove", required: [], conditional: [] },
+  { verb: "preview", required: [], conditional: [] },
+  { verb: "doctor", required: [], conditional: [] },
+  { verb: "restore", required: [], conditional: [] },
   {
     verb: "open-phase",
     required: [
@@ -11149,8 +12372,8 @@ function placeholderRefusal(verb, tokens) {
 }
 
 // dist/build-record/write-change.js
-import { existsSync as existsSync7, mkdirSync as mkdirSync9 } from "node:fs";
-import { basename as basename3, isAbsolute as isAbsolute5, join as join14, relative as relative5, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync9 } from "node:fs";
+import { basename as basename3, isAbsolute as isAbsolute5, join as join17, relative as relative5, resolve as resolve5 } from "node:path";
 
 // dist/build-record/render-change.js
 function counted2(n, one, many) {
@@ -11295,7 +12518,7 @@ function renderChangeRecordMarkdown(record2) {
 }
 
 // dist/build-record/write-change.js
-var CHANGE_RECORD_DIR = join14("docs", "build-records", "changes");
+var CHANGE_RECORD_DIR = join17("docs", "build-records", "changes");
 var InvalidChangeIdError = class extends Error {
   id;
   constructor(id) {
@@ -11315,8 +12538,8 @@ function writeChangeRecordPair(repoRoot, sortingId, rawRecord, record2, io = NOD
   if (!checked.success)
     throw new InvalidChangeIdError(sortingId);
   const outDir = resolve5(repoRoot, CHANGE_RECORD_DIR);
-  const jsonPath = join14(outDir, `${checked.data}.json`);
-  const mdPath = join14(outDir, `${checked.data}.md`);
+  const jsonPath = join17(outDir, `${checked.data}.json`);
+  const mdPath = join17(outDir, `${checked.data}.md`);
   const mdTmp = `${mdPath}.tmp`;
   for (const candidate of [jsonPath, mdPath, mdTmp]) {
     assertInsideChangeDir(outDir, candidate, sortingId);
@@ -11329,7 +12552,7 @@ function writeChangeRecordPair(repoRoot, sortingId, rawRecord, record2, io = NOD
   }
   const existingJson = readIfPresent(jsonPath);
   if (existingJson === null) {
-    return { kind: "in-the-way", path: existsSync7(jsonPath) ? jsonPath : mdPath };
+    return { kind: "in-the-way", path: existsSync10(jsonPath) ? jsonPath : mdPath };
   }
   if (existingJson !== jsonText)
     return { kind: "in-the-way", path: jsonPath };
@@ -11592,7 +12815,7 @@ function writePairLines(deps, repoRoot, sortingId, found) {
       };
     }
     return {
-      stdout: `[halfcycle] Its record is in ${join15(CHANGE_RECORD_DIR, `${sortingId}.md`)}.
+      stdout: `[halfcycle] Its record is in ${join18(CHANGE_RECORD_DIR, `${sortingId}.md`)}.
 `,
       stderr: "",
       ok: true
@@ -11831,24 +13054,24 @@ function runChange(repoRoot, args2, deps) {
 }
 
 // dist/shown-record.js
-import { chmodSync as chmodSync4, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync10, readFileSync as readFileSync16, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { platform as platform5 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join19 } from "node:path";
 function updateShownRecord(engagementId, update, home) {
   let temp = null;
   try {
     const dir = engagementStateDir(engagementId, home);
-    const path = join16(dir, SHOWN_PLANS_FILENAME);
+    const path = join19(dir, SHOWN_PLANS_FILENAME);
     let current;
     try {
-      current = parseShownRecord(readFileSync13(path, "utf-8"));
+      current = parseShownRecord(readFileSync16(path, "utf-8"));
     } catch {
       current = { entries: [], reviews: [] };
     }
     const next = update(current);
     const body = serialiseShownRecord(next);
     mkdirSync10(dir, { recursive: true, mode: 448 });
-    temp = join16(dir, `.${SHOWN_PLANS_FILENAME}.${process.pid}.tmp`);
+    temp = join19(dir, `.${SHOWN_PLANS_FILENAME}.${process.pid}.tmp`);
     writeFileSync7(temp, body, { mode: 384 });
     if (platform5() !== "win32")
       chmodSync4(temp, 384);
@@ -11907,9 +13130,9 @@ function parsePlanArgs(argv) {
 function planProblemPlace(raw, fileRel, path) {
   if (path === "")
     return fileRel;
-  const [list, index] = path.split(".");
+  const [list2, index] = path.split(".");
   const position = Number(index);
-  if (list !== "changes" || !Number.isInteger(position) || position < 0)
+  if (list2 !== "changes" || !Number.isInteger(position) || position < 0)
     return path;
   const changes = typeof raw === "object" && raw !== null ? raw["changes"] : void 0;
   const item = Array.isArray(changes) ? changes[position] : void 0;
@@ -11925,7 +13148,7 @@ function readAndCheckPlan(repoRoot, phase, description, verb) {
   const fileRel = planFileRel(phase);
   let text;
   try {
-    text = readFileSync14(join17(repoRoot, fileRel), "utf-8");
+    text = readFileSync17(join20(repoRoot, fileRel), "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -12017,7 +13240,8 @@ async function reportPhasePlan(credential, plan, descriptionVersion) {
           changedParts: answer.changedParts,
           typedApprovalOffered: answer.typedApprovalOffered,
           carriedFrom: answer.carriedFrom,
-          movedUp: answer.movedUp
+          movedUp: answer.movedUp,
+          givenIn: answer.givenIn
         };
       case "refused":
         return { kind: "refused", problems: answer.problems };
@@ -12080,7 +13304,7 @@ function removalOwedLines(verb, parts) {
 function redrawLine(repoRoot, phase) {
   let exists;
   try {
-    exists = existsSync8(join17(repoRoot, DIAGRAM_DIR_REL, embedImageName(phaseDiagramBase(phase))));
+    exists = existsSync11(join20(repoRoot, DIAGRAM_DIR_REL, embedImageName(phaseDiagramBase(phase))));
   } catch {
     return null;
   }
@@ -12094,14 +13318,14 @@ function movedUpLines(movedUp) {
 ${nextSayLine(movedUp.next.say)}
 `;
 }
-function planStateSentence(state) {
+function planStateSentence(state, givenIn) {
   switch (state) {
     case "waiting":
       return "Waiting for the owner's approval.";
     case "approved":
-      return "The owner has approved this plan.";
+      return givenIn === "autonomy" ? `The plan was ${APPROVED_IN_ADVANCE_SENTENCE}.` : "The owner has approved this plan.";
     case "partly-stale":
-      return "The owner approved an earlier plan; the parts marked as changed wait for the owner's approval.";
+      return givenIn === "autonomy" ? `The plan was ${APPROVED_IN_ADVANCE_SENTENCE}; the parts marked as changed wait for the owner's approval.` : "The owner approved an earlier plan; the parts marked as changed wait for the owner's approval.";
     case "sent-back":
       return "The owner sent this plan back. Change it to answer the owner's notes, then run this again.";
   }
@@ -12172,7 +13396,7 @@ async function runPlan(repoRoot, phase, show, deps) {
   }
   const shownPhase = String(plan.phase);
   const recorded = `[halfcycle] Plan for "${shownPhase}" recorded: plan version ${outcome.version}.`;
-  const stateSentence = planStateSentence(outcome.state);
+  const stateSentence = planStateSentence(outcome.state, outcome.givenIn);
   const redraw = redrawLine(repoRoot, phase) ?? "";
   const moved = outcome.movedUp === void 0 ? "" : `${movedUpLines(outcome.movedUp)}`;
   if (!show)
@@ -12329,9 +13553,9 @@ Paste this into ${where}:
 }
 function localRefusal(repoRoot, base) {
   const paths = diagramPaths(repoRoot, base);
-  const place = checkDiagramPlace(paths);
-  if (!place.ok)
-    return `${P} ${place.why}
+  const place2 = checkDiagramPlace(paths);
+  if (!place2.ok)
+    return `${P} ${place2.why}
 `;
   const read = readExistingSet(paths);
   if (!read.ok)
@@ -12478,8 +13702,8 @@ async function writeDrawOutcome(repoRoot, deps, outcome, target, warnings, canno
 }
 
 // dist/check-tasks.js
-import { readFileSync as readFileSync15 } from "node:fs";
-import { join as join18 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join21 } from "node:path";
 var CHECK_TASKS_USAGE = `${HALFCYCLE_COMMAND} check-tasks <phase> [--with-task-list] [--repo <root>]`;
 function parseCheckTasksArgs(argv) {
   const positionals = [];
@@ -12515,7 +13739,7 @@ function issuePlace(rel, path) {
 function readJsonFile(repoRoot, rel, parse) {
   let text;
   try {
-    text = readFileSync15(join18(repoRoot, rel), "utf-8");
+    text = readFileSync18(join21(repoRoot, rel), "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -12593,13 +13817,13 @@ function splitProveInvocation(words) {
 function runProveChild(binary, credential, repoRoot, words, deps = {}) {
   const out = deps.stdout ?? process.stdout;
   const err = deps.stderr ?? process.stderr;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let settled = false;
     const finish = (code) => {
       if (settled)
         return;
       settled = true;
-      resolve7(code);
+      resolve8(code);
     };
     let child;
     try {
@@ -12681,6 +13905,17 @@ function sentBackInRound(part, round) {
   return part.sentBack.some((s) => s.round === round);
 }
 function partStatus(part, round) {
+  const settled = settledStatus(part);
+  if (settled !== void 0) {
+    return part.givenIn === "autonomy" ? `${settled}, ${DECIDED_BY_AUTONOMY_SENTENCE}` : settled;
+  }
+  if (awaitingAnswer(part))
+    return "Waiting for the agent's answer";
+  if (sentBackInRound(part, round))
+    return "Sent back, waiting for the next round";
+  return "Waits for your decision";
+}
+function settledStatus(part) {
   switch (part.decision) {
     case "accepted":
       return "Accepted";
@@ -12689,13 +13924,8 @@ function partStatus(part, round) {
     case "dropped":
       return "Dropped";
     case void 0:
-      break;
+      return void 0;
   }
-  if (awaitingAnswer(part))
-    return "Waiting for the agent's answer";
-  if (sentBackInRound(part, round))
-    return "Sent back, waiting for the next round";
-  return "Waits for your decision";
 }
 function taskStateWord(state) {
   switch (state) {
@@ -12791,10 +14021,10 @@ var CALLS_HEADING2 = "Calls made without asking you";
 var CALLS_SUBHEADING = "These are the decisions the agents recorded taking on their own, each against a stated default. Halfcycle lists what they recorded; it cannot see a call an agent did not record.";
 var NO_CALLS_LINE2 = "No agent recorded a call made without asking in this phase.";
 function callLines2(call) {
-  return [
-    `${call.by} decided "${call.question}": chose "${call.chose}". The stated default was "${call.statedDefault}".`,
-    call.undoable === "yes" ? `${call.by} says this can be undone: "${call.how}"` : `${call.by} says this cannot be undone.`
-  ];
+  const undo = callUndoLine({ by: call.by, undoable: call.undoable, how: call.how });
+  if (call.kind === "listed")
+    return [autonomyC8(call.by, call.question, call.chose), undo];
+  return [callMadeLine({ by: call.by, question: call.question, chose: call.chose, statedDefault: call.statedDefault }), undo];
 }
 function callsSectionLines(calls) {
   const lines = [CALLS_HEADING2, CALLS_SUBHEADING];
@@ -13010,9 +14240,9 @@ async function runReviewAnswer(repoRoot, phase, part, answer, deps) {
 }
 
 // dist/uninstall.js
-import { lstatSync as lstatSync3, readFileSync as readFileSync16, readdirSync, rmSync as rmSync6, rmdirSync, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname7, join as join19, relative as relative6, sep as sep2 } from "node:path";
+import { lstatSync as lstatSync3, readFileSync as readFileSync19, readdirSync, rmSync as rmSync6, rmdirSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname7, join as join22, relative as relative6, sep as sep2 } from "node:path";
 var REMOVE_CREDENTIAL_FLAG = "--remove-credential";
 function parseUninstallArgs(args2) {
   let removeCredential = false;
@@ -13038,7 +14268,7 @@ function lexists(path) {
 function symlinkOnPath(root, rel) {
   let current = root;
   for (const segment of rel.split("/")) {
-    current = join19(current, segment);
+    current = join22(current, segment);
     try {
       if (lstatSync3(current).isSymbolicLink())
         return true;
@@ -13060,13 +14290,13 @@ function readMergedJson(targetRepo, rule) {
   const { rel } = rule;
   if (symlinkOnPath(targetRepo, rel))
     return { state: "symlink" };
-  const path = join19(targetRepo, rel);
+  const path = join22(targetRepo, rel);
   if (!lexists(path))
     return { state: "absent" };
   let text;
   let value;
   try {
-    text = readFileSync16(path, "utf-8");
+    text = readFileSync19(path, "utf-8");
   } catch {
     text = "";
   }
@@ -13083,15 +14313,15 @@ function readMergedJson(targetRepo, rule) {
 }
 function validate(options, rules) {
   const { targetRepo, removeCredential, home } = options;
-  const manifestPath = join19(targetRepo, INSTALL_MANIFEST_REL);
-  const pinPath = join19(targetRepo, BUNDLE_PIN_REL);
+  const manifestPath = join22(targetRepo, INSTALL_MANIFEST_REL);
+  const pinPath = join22(targetRepo, BUNDLE_PIN_REL);
   if (symlinkOnPath(targetRepo, INSTALL_MANIFEST_REL) || symlinkOnPath(targetRepo, BUNDLE_PIN_REL)) {
     throw new Refusal(`.halfcycle, or a file Halfcycle keeps in it, is a symbolic link here, so nothing was followed and nothing was removed.`);
   }
   let manifest = null;
   if (lexists(manifestPath)) {
     try {
-      manifest = parseManifest(readFileSync16(manifestPath, "utf-8"));
+      manifest = parseManifest(readFileSync19(manifestPath, "utf-8"));
     } catch (err) {
       const why = err instanceof UnreadableManifestError ? err.message : "it could not be read";
       throw new Refusal(`${INSTALL_MANIFEST_REL} cannot be read (${why}), so nothing was removed. Restore it from git, or run "${HALFCYCLE_COMMAND}" once to rewrite it, then run "${HALFCYCLE_COMMAND} uninstall" again.`);
@@ -13101,7 +14331,7 @@ function validate(options, rules) {
   let pinReadable = true;
   if (lexists(pinPath)) {
     try {
-      const pin = JSON.parse(readFileSync16(pinPath, "utf-8"));
+      const pin = JSON.parse(readFileSync19(pinPath, "utf-8"));
       const id = isPlainObject3(pin) ? pin[PIN_ENGAGEMENT_ID_FIELD] : void 0;
       engagementId = typeof id === "string" && id !== "" ? id : void 0;
     } catch {
@@ -13125,7 +14355,7 @@ function validate(options, rules) {
       throw new Refusal(`the project id in ${BUNDLE_PIN_REL} is not a valid Halfcycle project id, so it cannot name a folder on this machine. Nothing was removed, here or under ~/.halfcycle.`);
     }
     if (engagementId !== void 0) {
-      const expectedParent = join19(home ?? homedir3(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME);
+      const expectedParent = join22(home ?? homedir4(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME);
       if (dirname7(engagementStateDir(engagementId, home)) !== expectedParent) {
         throw new Refusal(`the project id in ${BUNDLE_PIN_REL} does not name a folder under ~/.halfcycle/engagements. Nothing was removed.`);
       }
@@ -13149,7 +14379,7 @@ function mergedFileRules(writeSet) {
 function writeBack(targetRepo, rel, current, next, lists, name) {
   if (next === current)
     return;
-  const path = join19(targetRepo, rel);
+  const path = join22(targetRepo, rel);
   try {
     if (next === null) {
       rmSync6(path);
@@ -13166,7 +14396,7 @@ function statusLineClaimedFromTree(targetRepo, writeSet) {
   try {
     if (symlinkOnPath(targetRepo, SETTINGS_REL))
       return {};
-    const value = JSON.parse(readFileSync16(join19(targetRepo, SETTINGS_REL), "utf-8"));
+    const value = JSON.parse(readFileSync19(join22(targetRepo, SETTINGS_REL), "utf-8"));
     if (!isPlainObject3(value) || !("statusLine" in value))
       return {};
     const hash = canonicalSha256(value["statusLine"]);
@@ -13180,7 +14410,7 @@ function noRecord(targetRepo, writeSet) {
   const claim = (rel, header, lines) => {
     let text;
     try {
-      text = symlinkOnPath(targetRepo, rel) ? "" : readFileSync16(join19(targetRepo, rel), "utf-8");
+      text = symlinkOnPath(targetRepo, rel) ? "" : readFileSync19(join22(targetRepo, rel), "utf-8");
     } catch {
       text = "";
     }
@@ -13233,11 +14463,11 @@ function ourMcpServers(value) {
 }
 function unmergeSettings(value, rec, writeSet) {
   let changed = false;
-  const refused2 = [];
+  const refused3 = [];
   const commands = new Set(writeSet.hookCommands);
   const denyHashes = rec.denyAddedSha256.filter((h) => writeSet.denyRuleSha256.has(h));
   if (denyHashes.length < rec.denyAddedSha256.length) {
-    refused2.push(`${SETTINGS_REL}: a deny rule the install record names but Halfcycle never adds (it was kept)`);
+    refused3.push(`${SETTINGS_REL}: a deny rule the install record names but Halfcycle never adds (it was kept)`);
   }
   const hooks = value["hooks"];
   if (isPlainObject3(hooks)) {
@@ -13307,7 +14537,7 @@ function unmergeSettings(value, rec, writeSet) {
       value["$schema"] = rec.schemaBefore;
     changed = true;
   }
-  return { changed, refused: refused2 };
+  return { changed, refused: refused3 };
 }
 function unmergeMcp(value, rec) {
   const servers = value["mcpServers"];
@@ -13411,7 +14641,7 @@ function lastOccurrence(text, block) {
 }
 function coveredPathExists(targetRepo, line) {
   const path = line.trim().replace(/^\//, "").replace(/\/$/, "");
-  return path !== "" && lexists(join19(targetRepo, path));
+  return path !== "" && lexists(join22(targetRepo, path));
 }
 function selfBuildMergedFileRules() {
   return {
@@ -13424,7 +14654,7 @@ function removeSelfBuildOwnedFile(targetRepo, rel, lists, name) {
     name(lists.leftAlone, `${rel} (a symbolic link, or inside one \u2014 not followed)`, rel);
     return;
   }
-  const abs = join19(targetRepo, rel);
+  const abs = join22(targetRepo, rel);
   let isFile;
   try {
     isFile = lstatSync3(abs).isFile();
@@ -13448,10 +14678,10 @@ function removeSelfBuildCrewRoster(targetRepo, lists, name) {
     name(lists.leftAlone, `${rel} (a symbolic link, or inside one \u2014 not followed)`, rel);
     return;
   }
-  const abs = join19(targetRepo, rel);
+  const abs = join22(targetRepo, rel);
   let bytes;
   try {
-    bytes = readFileSync16(abs);
+    bytes = readFileSync19(abs);
   } catch {
     return;
   }
@@ -13473,7 +14703,7 @@ function removeSelfBuildCrewRoster(targetRepo, lists, name) {
 function removeSelfBuildEmptyDir(targetRepo, dir, lists, name) {
   if (symlinkOnPath(targetRepo, dir))
     return;
-  const abs = join19(targetRepo, dir);
+  const abs = join22(targetRepo, dir);
   try {
     if (!lstatSync3(abs).isDirectory() || readdirSync(abs).length > 0)
       return;
@@ -13507,9 +14737,9 @@ function uninstallSelfBuild(options) {
     throw err;
   }
   const { targetRepo } = options;
-  const pinExisted = lexists(join19(targetRepo, BUNDLE_PIN_REL));
-  const name = (list, text, _path) => {
-    list.push(text);
+  const pinExisted = lexists(join22(targetRepo, BUNDLE_PIN_REL));
+  const name = (list2, text, _path) => {
+    list2.push(text);
   };
   applyMergedJson(targetRepo, rules.mcp, checked.mcp, true, result, name, (value) => ({
     changed: unmergeMcp(value, BEFORE_UNKNOWN_MCP).changed,
@@ -13557,15 +14787,15 @@ function uninstall(options) {
   const manifest = checked.manifest ?? noRecord(targetRepo, writeSet);
   const deleteWhenEmpty = (created) => created || checked.manifest === null;
   const named = /* @__PURE__ */ new Set();
-  const name = (list, text, path) => {
-    list.push(text);
+  const name = (list2, text, path) => {
+    list2.push(text);
     if (path !== void 0)
       named.add(path);
   };
   const settingsEmptyGoes = deleteWhenEmpty(manifest.settings.created);
   applyMergedJson(targetRepo, rules.settings, checked.settings, settingsEmptyGoes, result, name, (value) => {
-    const { changed, refused: refused2 } = unmergeSettings(value, manifest.settings, writeSet);
-    for (const note of refused2)
+    const { changed, refused: refused3 } = unmergeSettings(value, manifest.settings, writeSet);
+    for (const note of refused3)
       name(result.leftAlone, note);
     return { changed, adopted: manifest.settings.adopted };
   });
@@ -13610,7 +14840,7 @@ function uninstall(options) {
   const gitattributes = manifest.gitattributes ?? { created: false, appended: [] };
   trimAppendedFile(targetRepo, gitattributes, deleteWhenEmpty(gitattributes.created), gitattributesRules(writeSet), result, name);
   const foundNothing = result.removed.length + result.restored.length + result.kept.length + result.failed.length === 0 && result.keptIgnoreLines.length === 0;
-  if (checked.manifest === null && !lexists(join19(targetRepo, BUNDLE_PIN_REL)) && foundNothing) {
+  if (checked.manifest === null && !lexists(join22(targetRepo, BUNDLE_PIN_REL)) && foundNothing) {
     return { outcome: "not-installed", exitCode: 0, ...result, credential: nothingToSay };
   }
   const credential = handleCredential(options, checked);
@@ -13618,7 +14848,7 @@ function uninstall(options) {
   if (result.failed.length === 0 && !credentialFailed) {
     removeInstalledFile(targetRepo, BUNDLE_PIN_REL, recorded.get(BUNDLE_PIN_REL), writeSet, result, name);
     try {
-      rmSync6(join19(targetRepo, INSTALL_MANIFEST_REL), { force: true });
+      rmSync6(join22(targetRepo, INSTALL_MANIFEST_REL), { force: true });
       named.add(INSTALL_MANIFEST_REL);
     } catch {
       name(result.failed, INSTALL_MANIFEST_REL, INSTALL_MANIFEST_REL);
@@ -13653,7 +14883,7 @@ function applyMergedJson(targetRepo, rule, file, deleteWhenEmpty, lists, name, e
     return;
   const empty = Object.keys(value).length === 0 && deleteWhenEmpty;
   writeBack(targetRepo, rel, file.text, empty ? null : inLineEndingOf(file.text, serializeJson(value)), lists, name);
-  if (adopted && lexists(join19(targetRepo, rel))) {
+  if (adopted && lexists(join22(targetRepo, rel))) {
     name(lists.leftAlone, `${rel} (Halfcycle's hooks were taken out. There is no record of this file from before the install, so a permission rule or "$schema" Halfcycle added may still be there \u2014 it cannot be told apart from your own)`, rel);
   }
 }
@@ -13666,7 +14896,7 @@ function removeInstalledFile(targetRepo, path, entry, writeSet, lists, name) {
     name(lists.leftAlone, `${path} (a symbolic link, or inside one \u2014 not followed)`, path);
     return;
   }
-  const abs = join19(targetRepo, path);
+  const abs = join22(targetRepo, path);
   let isFile;
   try {
     isFile = lstatSync3(abs).isFile();
@@ -13680,7 +14910,7 @@ function removeInstalledFile(targetRepo, path, entry, writeSet, lists, name) {
   if (!writeSet.ownedDirs.has(path.slice(0, path.lastIndexOf("/")))) {
     let bytes;
     try {
-      bytes = readFileSync16(abs);
+      bytes = readFileSync19(abs);
     } catch {
       name(lists.failed, path, path);
       return;
@@ -13700,7 +14930,7 @@ function removeInstalledFile(targetRepo, path, entry, writeSet, lists, name) {
 function removeEmptyDir(targetRepo, dir, writeSet, lists, name) {
   if (!writeSet.dirs.has(dir) || symlinkOnPath(targetRepo, dir))
     return;
-  const abs = join19(targetRepo, dir);
+  const abs = join22(targetRepo, dir);
   try {
     if (!lstatSync3(abs).isDirectory() || readdirSync(abs).length > 0)
       return;
@@ -13719,10 +14949,10 @@ function trimAppendedFile(targetRepo, rec, deleteWhenEmpty, rules, lists, name)
     name(lists.leftAlone, `${rel} (a symbolic link \u2014 not followed)`, rel);
     return [];
   }
-  const path = join19(targetRepo, rel);
+  const path = join22(targetRepo, rel);
   let before;
   try {
-    before = readFileSync16(path, "utf-8");
+    before = readFileSync19(path, "utf-8");
   } catch {
     return [];
   }
@@ -13766,16 +14996,16 @@ function filesUnder(root, rel) {
   const walk = (dirRel) => {
     let names;
     try {
-      if (!lstatSync3(join19(root, dirRel)).isDirectory())
+      if (!lstatSync3(join22(root, dirRel)).isDirectory())
         return;
-      names = readdirSync(join19(root, dirRel));
+      names = readdirSync(join22(root, dirRel));
     } catch {
       return;
     }
     for (const entry of names.sort()) {
       const childRel = `${dirRel}/${entry}`;
       try {
-        if (lstatSync3(join19(root, childRel)).isDirectory())
+        if (lstatSync3(join22(root, childRel)).isDirectory())
           walk(childRel);
         else
           out.push(childRel);
@@ -13788,7 +15018,7 @@ function filesUnder(root, rel) {
   return out;
 }
 function shownPath(path, home) {
-  const base = home ?? homedir3();
+  const base = home ?? homedir4();
   const rel = relative6(base, path);
   const under = rel !== "" && !rel.startsWith("..") && !rel.startsWith(sep2);
   return `${under ? `~/${rel.split(sep2).join("/")}` : path}/`;
@@ -13847,8 +15077,8 @@ function renderUninstallReport(result, home) {
 }
 
 // dist/banner-facts.js
-import { readFileSync as readFileSync17 } from "node:fs";
-import { basename as basename4, join as join20, resolve as resolve6 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { basename as basename4, join as join23, resolve as resolve6 } from "node:path";
 var BRAND_URL = "halfcycle.ai";
 var TAGLINE = [
   "Fewer cycles.",
@@ -13861,7 +15091,7 @@ var TAGLINE_NARROW = [
 ];
 function bundleVersion() {
   try {
-    const pkg = JSON.parse(readFileSync17(join20(BUNDLE_ROOT, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync20(join23(BUNDLE_ROOT, "package.json"), "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -14005,13 +15235,13 @@ function runPaceChild(binary, credential, repoRoot, args2, deps = {}) {
   if (binary instanceof Error)
     return Promise.resolve({ code: 1, stdout: "" });
   const err = deps.stderr ?? process.stderr;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let settled = false;
     const done = (output) => {
       if (settled)
         return;
       settled = true;
-      resolve7(output);
+      resolve8(output);
     };
     try {
       const child = spawn3(process.execPath, [binary, "pace", ...args2], {
@@ -14090,6 +15320,424 @@ async function runPace(repoRoot, start, deps) {
 `, stderr: "", exitCode: 0 };
 }
 
+// dist/restore.js
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { closeSync as closeSync3, fchmodSync, lstatSync as lstatSync4, mkdirSync as mkdirSync11, openSync as openSync3, readdirSync as readdirSync2, readFileSync as readFileSync21, readlinkSync, realpathSync as realpathSync5, rmSync as rmSync7, symlinkSync, writeSync as writeSync2 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join24, resolve as resolve7 } from "node:path";
+var RESTORE_USAGE = `${HALFCYCLE_COMMAND} restore [<id>]`;
+function parseRestoreArgs(rest) {
+  if (rest.length > 1)
+    return { ok: false };
+  const first = rest[0];
+  if (first !== void 0 && first.startsWith("-"))
+    return { ok: false };
+  return { ok: true, id: first };
+}
+var LIST_COMMAND = `${HALFCYCLE_COMMAND} restore`;
+function runRestore(cwd, id, options = {}) {
+  const now = options.now ?? Date.now;
+  const top = git2(cwd, ["rev-parse", "--show-toplevel"]);
+  if (!top.ok || top.text.trim() === "") {
+    return refused2("This folder is not in a project kept with git, so Halfcycle has saved nothing here to bring back.");
+  }
+  const root = realOrSelf(top.text.trim());
+  const engagementId = pinnedEngagement(root);
+  if (engagementId === null) {
+    return refused2(`Halfcycle is not set up in this project, so it has saved nothing here. To set it up, run: ${HALFCYCLE_COMMAND}`);
+  }
+  const folder = join24(options.home ?? homedir5(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SAVED_DIR_NAME);
+  const refs = savedRefs(root);
+  if (refs === null)
+    return refused2("Halfcycle could not read the saved copies in this project, so nothing was put back.");
+  pruneAtRestore(root, folder, refs, now());
+  for (const [saveId, madeAt] of [...refs]) {
+    const answer = savedPruneAnswer({ refMadeAt: madeAt, folderChangedAt: 0, folderRepository: null }, { repository: null, now: now() });
+    if (answer !== "keep")
+      refs.delete(saveId);
+  }
+  if (id === void 0)
+    return list(root, folder, refs);
+  return restoreOne(root, folder, refs, id);
+}
+function refused2(line) {
+  return { stdout: "", stderr: `${line}
+`, exitCode: 1 };
+}
+function list(root, folder, refs) {
+  const rows = [];
+  for (const [id, at] of refs) {
+    const saved = readSaved(folder, id);
+    if (saved !== null)
+      rows.push({ id, at, what: saved.what });
+  }
+  if (rows.length === 0) {
+    return {
+      stdout: "Nothing has been saved in this project in the last 7 days, so there is nothing to bring back.\n",
+      stderr: "",
+      exitCode: 0
+    };
+  }
+  rows.sort((a, b) => b.at - a.at || (a.id < b.id ? 1 : -1));
+  const lines = rows.map((r) => `  ${r.id}  saved ${whenOf(r.at)}: ${printable(r.what)}`);
+  return {
+    stdout: `Saved copies you can bring back, newest first (each is kept for 7 days):
+${lines.join("\n")}
+To bring one back, run: ${LIST_COMMAND} <id>
+`,
+    stderr: "",
+    exitCode: 0
+  };
+}
+function whenOf(ms) {
+  if (!Number.isFinite(ms))
+    return "at an unknown time";
+  return `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function printable(text) {
+  return text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
+}
+function restoreOne(root, folder, refs, rawId) {
+  const valid = savedIdSchema.safeParse(rawId);
+  const named = valid.success ? `"${rawId}"` : "with that name";
+  if (!valid.success || !refs.has(rawId)) {
+    return refused2(`No saved copy ${named} is kept in this project. Saved copies are kept for 7 days. To see the ones there are, run: ${LIST_COMMAND}`);
+  }
+  const id = valid.data;
+  const saved = readSaved(folder, id);
+  if (saved === null)
+    return refused2(`The saved copy "${id}" could not be read, so nothing was put back.`);
+  const ref = savedRefOf(id);
+  const out = { back: [], already: [], left: [] };
+  const seen = /* @__PURE__ */ new Set();
+  const fromCommit = [];
+  for (const p of saved.paths) {
+    if (seen.has(p.path))
+      continue;
+    seen.add(p.path);
+    if (insideGitFolder(p.path)) {
+      out.left.push(`${p.path}: it is inside git's own folder, which restore never writes`);
+      continue;
+    }
+    if (p.keptIn === "commit")
+      fromCommit.push(p.path);
+    else
+      restoreCopy(root, join24(folder, id), p.path, out);
+  }
+  if (fromCommit.length > 0)
+    restoreFromCommit(root, ref, fromCommit, out);
+  restoreLines(root, ref, saved, out);
+  const parts = [];
+  if (out.back.length > 0)
+    parts.push(`Put back from the saved copy ${id}:
+${out.back.map((l) => `  ${l}`).join("\n")}`);
+  else
+    parts.push(`Nothing was put back from the saved copy ${id}.`);
+  if (out.already.length > 0)
+    parts.push(`Already as saved:
+${out.already.map((l) => `  ${l}`).join("\n")}`);
+  if (out.left.length > 0)
+    parts.push(`Left as they are:
+${out.left.map((l) => `  ${l}`).join("\n")}`);
+  return { stdout: `${parts.join("\n")}
+`, stderr: "", exitCode: out.left.length > 0 ? 1 : 0 };
+}
+var MOVE_AWAY = "move it away and run this again to bring back the saved one";
+function insideGitFolder(rel) {
+  return rel.split(/[\\/]/).some(isGitFolderSegment);
+}
+function makeFolders(root, rel) {
+  const segments = rel.split("/");
+  let at = root;
+  for (let i = 0; i < segments.length - 1; i++) {
+    at = join24(at, segments[i]);
+    const shown2 = segments.slice(0, i + 1).join("/");
+    let st = lstatOrNull3(at);
+    if (st === null) {
+      try {
+        mkdirSync11(at);
+      } catch {
+      }
+      st = lstatOrNull3(at);
+    }
+    if (st === null)
+      return "its folder could not be made";
+    if (st.isSymbolicLink())
+      return `${shown2} is a link now, and restore never writes through a link`;
+    if (!st.isDirectory())
+      return `${shown2} is a file now, where a folder is needed; ${MOVE_AWAY}`;
+  }
+  return null;
+}
+function place(root, rel, content, out) {
+  const abs = join24(root, rel);
+  const there = lstatOrNull3(abs);
+  if (there !== null) {
+    if (sameAs(abs, there, content))
+      out.already.push(rel);
+    else
+      out.left.push(`${rel}: something is there now; ${MOVE_AWAY}`);
+    return;
+  }
+  const blocked = makeFolders(root, rel);
+  if (blocked !== null) {
+    out.left.push(`${rel}: ${blocked}`);
+    return;
+  }
+  try {
+    if ("link" in content) {
+      symlinkSync(content.link, abs);
+    } else {
+      const fd = openSync3(abs, "wx", 384);
+      try {
+        let off = 0;
+        while (off < content.bytes.length)
+          off += writeSync2(fd, content.bytes, off, content.bytes.length - off);
+        fchmodSync(fd, content.mode);
+      } finally {
+        closeSync3(fd);
+      }
+    }
+    out.back.push(rel);
+  } catch (e) {
+    const code = e.code;
+    out.left.push(code === "EEXIST" ? `${rel}: something is there now; ${MOVE_AWAY}` : `${rel}: it could not be written here`);
+  }
+}
+function sameAs(abs, st, content) {
+  try {
+    if ("link" in content)
+      return st.isSymbolicLink() && readlinkSync(abs) === content.link;
+    return st.isFile() && readFileSync21(abs).equals(content.bytes);
+  } catch {
+    return false;
+  }
+}
+function restoreCopy(root, saveDir, rel, out) {
+  const segments = rel.split("/");
+  let at = saveDir;
+  const chain = [SAVED_COPIES_DIR_NAME, ...segments];
+  for (let i = 0; i < chain.length - 1; i++) {
+    at = join24(at, chain[i]);
+    const st2 = lstatOrNull3(at);
+    if (st2 === null || st2.isSymbolicLink() || !st2.isDirectory()) {
+      out.left.push(`${rel}: the saved copy does not hold it`);
+      return;
+    }
+  }
+  const src = join24(at, chain[chain.length - 1]);
+  const st = lstatOrNull3(src);
+  try {
+    if (st !== null && st.isSymbolicLink())
+      return place(root, rel, { link: readlinkSync(src) }, out);
+    if (st !== null && st.isFile())
+      return place(root, rel, { bytes: readFileSync21(src), mode: st.mode & 511 }, out);
+  } catch {
+  }
+  out.left.push(`${rel}: the saved copy does not hold it`);
+}
+function restoreFromCommit(root, ref, rels, out) {
+  const entries = /* @__PURE__ */ new Map();
+  for (let i = 0; i < rels.length; i += 200) {
+    const chunk = rels.slice(i, i + 200);
+    const listed = git2(root, ["--literal-pathspecs", "ls-tree", "-z", "--full-tree", `${ref}^{commit}`, "--", ...chunk]);
+    if (!listed.ok) {
+      for (const rel of rels)
+        out.left.push(`${rel}: the saved copy could not be read`);
+      return;
+    }
+    for (const rec of listed.text.split("\0")) {
+      const tab = rec.indexOf("	");
+      if (tab < 0)
+        continue;
+      const [mode, type, object] = rec.slice(0, tab).split(" ");
+      if (type === "blob" && mode !== void 0 && object !== void 0)
+        entries.set(rec.slice(tab + 1), { mode, object });
+    }
+  }
+  const objects = [...new Set([...entries.values()].map((e) => e.object))];
+  const blobs = objects.length === 0 ? /* @__PURE__ */ new Map() : readBlobs(root, objects);
+  for (const rel of rels) {
+    const entry = entries.get(rel);
+    const bytes = entry === void 0 ? void 0 : blobs?.get(entry.object);
+    if (entry === void 0 || bytes === void 0) {
+      out.left.push(`${rel}: the saved copy does not hold it`);
+      continue;
+    }
+    if (entry.mode === "120000")
+      place(root, rel, { link: bytes.toString("utf-8") }, out);
+    else
+      place(root, rel, { bytes, mode: entry.mode === "100755" ? 493 : 420 }, out);
+  }
+}
+function readBlobs(root, objects) {
+  const r = spawnSync3("git", ["cat-file", "--batch"], {
+    cwd: root,
+    env: gitEnvForNamedRepo(),
+    input: `${objects.join("\n")}
+`,
+    maxBuffer: 1024 * 1024 * 1024
+  });
+  if (r.status !== 0 || !Buffer.isBuffer(r.stdout))
+    return null;
+  const out = /* @__PURE__ */ new Map();
+  const buf = r.stdout;
+  let at = 0;
+  while (at < buf.length) {
+    const nl = buf.indexOf(10, at);
+    if (nl < 0)
+      break;
+    const [object, type, size] = buf.subarray(at, nl).toString("utf-8").split(" ");
+    if (type !== "blob" || object === void 0 || size === void 0)
+      return null;
+    const n = Number(size);
+    out.set(object, Buffer.from(buf.subarray(nl + 1, nl + 1 + n)));
+    at = nl + 1 + n + 1;
+  }
+  return out;
+}
+function restoreLines(root, ref, saved, out) {
+  if (saved.branches.length === 0)
+    return;
+  const parents = git2(root, ["rev-list", "--parents", "-n", "1", `${ref}^{commit}`]);
+  const held = new Set(parents.ok ? parents.text.trim().split(/\s+/).slice(1) : []);
+  for (const b of saved.branches) {
+    const shown2 = `the line of work "${b.name}"`;
+    const full = `refs/heads/${b.name}`;
+    if (!git2(root, ["check-ref-format", full]).ok) {
+      out.left.push(`${shown2}: its name cannot be used`);
+      continue;
+    }
+    if (!held.has(b.commit)) {
+      out.left.push(`${shown2}: the saved copy does not hold its commit`);
+      continue;
+    }
+    const now = git2(root, ["rev-parse", "--verify", "--quiet", `${full}^{commit}`]);
+    if (now.ok && now.text.trim() !== "") {
+      if (now.text.trim() === b.commit)
+        out.already.push(`${shown2}, at its saved commit ${b.commit.slice(0, 12)}`);
+      else
+        out.left.push(`${shown2}: one with this name exists now; rename it and run this again to bring back the saved one`);
+      continue;
+    }
+    const made = git2(root, ["update-ref", "--no-deref", full, b.commit, ""]);
+    if (made.ok)
+      out.back.push(`${shown2}, at its saved commit ${b.commit.slice(0, 12)}`);
+    else
+      out.left.push(`${shown2}: it could not be made here, perhaps because another line of work's name is in the way`);
+  }
+}
+function pinnedEngagement(root) {
+  try {
+    const pin = JSON.parse(readFileSync21(join24(root, BUNDLE_PIN_REL), "utf-8"));
+    return isEngagementId(pin.engagementId) ? pin.engagementId : null;
+  } catch {
+    return null;
+  }
+}
+function savedRefs(root) {
+  const listed = git2(root, ["for-each-ref", "--format=%(refname)%00%(committerdate:unix)", SAVED_REF_PREFIX]);
+  if (!listed.ok)
+    return null;
+  const refs = /* @__PURE__ */ new Map();
+  for (const line of listed.text.split("\n")) {
+    const [name, when] = line.split("\0");
+    if (name === void 0 || when === void 0 || !name.startsWith(SAVED_REF_PREFIX))
+      continue;
+    const id = name.slice(SAVED_REF_PREFIX.length);
+    if (savedIdSchema.safeParse(id).success)
+      refs.set(id, Number(when) * 1e3);
+  }
+  return refs;
+}
+function readSaved(folder, id) {
+  const dir = join24(folder, id);
+  const st = lstatOrNull3(dir);
+  if (st === null || !st.isDirectory())
+    return null;
+  const file = join24(dir, SAVED_FILE_NAME);
+  const fst = lstatOrNull3(file);
+  if (fst === null || !fst.isFile())
+    return null;
+  try {
+    const parsed = savedSchema.safeParse(JSON.parse(readFileSync21(file, "utf-8")));
+    return parsed.success && parsed.data.id === id ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function pruneAtRestore(root, folder, refs, now) {
+  try {
+    const common = git2(root, ["rev-parse", "--git-common-dir"]);
+    const repository = common.ok && common.text.trim() !== "" ? realOrSelf(resolve7(root, common.text.trim())) : null;
+    let names = [];
+    try {
+      names = readdirSync2(folder);
+    } catch {
+      names = [];
+    }
+    const here = /* @__PURE__ */ new Set();
+    for (const id of names) {
+      if (!savedIdSchema.safeParse(id).success)
+        continue;
+      here.add(id);
+      const dir = join24(folder, id);
+      const st = lstatOrNull3(dir);
+      const answer = savedPruneAnswer({
+        refMadeAt: refs.get(id) ?? null,
+        folderChangedAt: st !== null && st.isDirectory() ? st.mtimeMs : null,
+        folderRepository: markedRepository(dir)
+      }, { repository, now });
+      if (answer === "remove-folder")
+        rmSync7(dir, { recursive: true, force: true });
+      else if (answer === "remove-ref-then-folder" && git2(root, ["update-ref", "-d", savedRefOf(id)]).ok) {
+        refs.delete(id);
+        rmSync7(dir, { recursive: true, force: true });
+      } else if (answer === "remove-ref" && git2(root, ["update-ref", "-d", savedRefOf(id)]).ok) {
+        refs.delete(id);
+      }
+    }
+    for (const [id, madeAt] of [...refs]) {
+      if (here.has(id))
+        continue;
+      const answer = savedPruneAnswer({ refMadeAt: madeAt, folderChangedAt: null, folderRepository: null }, { repository, now });
+      if (answer === "remove-ref" && git2(root, ["update-ref", "-d", savedRefOf(id)]).ok)
+        refs.delete(id);
+    }
+  } catch {
+  }
+}
+function markedRepository(dir) {
+  try {
+    const text = readFileSync21(join24(dir, SAVED_REPOSITORY_FILE_NAME), "utf-8").trim();
+    return text === "" ? null : text;
+  } catch {
+    return null;
+  }
+}
+function git2(cwd, args2) {
+  try {
+    const r = spawnSync3("git", args2, { cwd, encoding: "utf-8", env: gitEnvForNamedRepo(), maxBuffer: 64 * 1024 * 1024 });
+    return r.status === 0 ? { ok: true, text: r.stdout ?? "" } : { ok: false };
+  } catch {
+    return { ok: false };
+  }
+}
+function lstatOrNull3(p) {
+  try {
+    return lstatSync4(p);
+  } catch {
+    return null;
+  }
+}
+function realOrSelf(p) {
+  try {
+    return realpathSync5(p);
+  } catch {
+    return p;
+  }
+}
+
 // dist/bin.js
 var ASSUME_YES_FLAGS = /* @__PURE__ */ new Set(["--yes", "-y"]);
 var QUIET_FLAGS = /* @__PURE__ */ new Set(["--quiet", "-q"]);
@@ -14162,6 +15810,13 @@ var USAGE = `  ${HALFCYCLE_COMMAND} [install] [target-repo] [engagement-id] [sel
   ${PACE_USAGE}
          suggest how many agents this build should run at once, and for how long; with no flag, how
          many may start right now
+  ${HALFCYCLE_COMMAND} preview [folder]
+         show what setting up this folder would add, change, remove or leave alone; writes nothing
+  ${HALFCYCLE_COMMAND} doctor
+         check this folder: set up, signed in, connected, checks running, up to date; says what to do for each one that is not; changes nothing
+  ${RESTORE_USAGE}
+         list the copies Halfcycle saved before a change it let through, or bring one back; never
+         replaces a file or a line of work that exists now
   ${HALFCYCLE_COMMAND} uninstall [${REMOVE_CREDENTIAL_FLAG}]
          take out what the installer added to this project, keeping anything you changed
          ${REMOVE_CREDENTIAL_FLAG}: also remove this machine's credential for the project, which every
@@ -14172,15 +15827,6 @@ var USAGE = `  ${HALFCYCLE_COMMAND} [install] [target-repo] [engagement-id] [sel
 
   Support: hello@halfcycle.ai
 `;
-function isHomeFolder(dir) {
-  try {
-    const target = realpathSync4(dir);
-    const home = realpathSync4(homedir4());
-    return process.platform === "win32" ? target.toLowerCase() === home.toLowerCase() : target === home;
-  } catch {
-    return false;
-  }
-}
 var RETIRED_VERBS = /* @__PURE__ */ new Map([
   ["ci", '"ci" was removed \u2014 CI setup is part of your project, not Halfcycle']
 ]);
@@ -14278,34 +15924,65 @@ ${USAGE}`);
     process.exit(0);
     return;
   }
+  if (cmd === "preview") {
+    const outcome = runPreview(rest[0] ?? process.cwd(), { env: process.env, platform: process.platform });
+    if ("refusal" in outcome) {
+      process.stderr.write(`${outcome.refusal}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(`${outcome.text}
+`);
+    return;
+  }
+  if (cmd === "doctor") {
+    const report = runDoctor(process.cwd(), { env: process.env, platform: process.platform });
+    process.stdout.write(`${report.text}
+`);
+    process.exitCode = report.exitCode;
+    return;
+  }
+  if (cmd === "restore") {
+    const parsed = parseRestoreArgs(rest);
+    if (!parsed.ok) {
+      process.stderr.write(`halfcycle restore: usage: ${RESTORE_USAGE}
+`);
+      process.exitCode = 2;
+      return;
+    }
+    const run = runRestore(process.cwd(), parsed.id);
+    if (run.stdout !== "")
+      process.stdout.write(run.stdout);
+    if (run.stderr !== "")
+      process.stderr.write(run.stderr);
+    process.exitCode = run.exitCode;
+    return;
+  }
   if (installArm) {
     const engagementIdArg = positionals[1];
     const engagementTypeRaw = positionals[2] ?? "client";
-    if (!existsSync9(targetRepo)) {
-      process.stderr.write(`halfcycle: no such directory: ${targetRepo}
+    if (!existsSync12(targetRepo)) {
+      process.stderr.write(`${folderMissingRefusal(targetRepo)}
 `);
       process.exit(1);
       return;
     }
-    if (!statSync(targetRepo).isDirectory()) {
-      process.stderr.write(`halfcycle: ${targetRepo} is a file \u2014 run "npx halfcycle" with a project folder instead.
+    if (!statSync2(targetRepo).isDirectory()) {
+      process.stderr.write(`${folderIsFileRefusal(targetRepo)}
 `);
       process.exit(1);
       return;
     }
     const selfBuild = isHalfcycleMonorepo(targetRepo);
     if (selfBuild && !isSelfBuildInstallForm(engagementIdArg, positionals[2])) {
-      process.stderr.write(`halfcycle: refusing to install into the Halfcycle monorepo itself (${targetRepo}).
-  The bare form installs into the CURRENT directory, and this directory is the
-  product's own source tree \u2014 installing here would write over tracked files.
-  To see what this CLI does:      halfcycle --help
-  To install into a real project: halfcycle <path-to-that-repo>
+      process.stderr.write(`${monorepoRefusal(targetRepo)}
 `);
       process.exit(1);
       return;
     }
     if (isHomeFolder(targetRepo)) {
-      process.stderr.write(`halfcycle: refusing to set up in your home folder (${targetRepo}). Run "npx halfcycle" inside a project folder.
+      process.stderr.write(`${homeFolderRefusal(targetRepo)}
 `);
       process.exit(1);
       return;
@@ -14324,7 +16001,7 @@ ${USAGE}`);
       const kept = readFolderId(targetRepo) !== void 0 ? `${KEPT_FOLDER_ID_LINE}
 ` : "";
       try {
-        writeSync2(2, `halfcycle: interrupted.
+        writeSync3(2, `halfcycle: interrupted.
 ${kept}`);
       } catch {
       }
@@ -14573,7 +16250,7 @@ ${PROJECT_RESET_LINE}
         process.stdout.write(`[halfcycle] Method version: ${credential.methodVersion}
 `);
       }
-      await setupClaudePlan({ serviceUrl: credential?.serviceUrl ?? serviceUrl, engagementId, ownsProject, consoleUrl }, { interactive: () => isInteractiveRun(), ask: askLine, write: (text) => process.stdout.write(text) });
+      await setupClaudePlan({ serviceUrl: credential?.serviceUrl ?? serviceUrl, engagementId, ownsProject, consoleUrl }, { interactive: () => isInteractiveRun(), assumeYes, ask: askLine, write: (text) => process.stdout.write(text) });
       if (checks.gitInstalled) {
         process.stdout.write(`[halfcycle] Git for Windows is installed. Open a new terminal before starting Claude Code.
 `);