halfcycle 0.4.14 → 0.4.15

package/dist/index.js

@@ -1,9 +1,9 @@
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, posix, relative, resolve } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, posix as posix2, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../core/dist/guard-record.js
@@ -122,9 +122,10 @@ var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
 var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
 var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
 var USER_PROMPT_SCOPE_REL = ".claude/hooks/user-prompt-scope.sh";
+var USER_PROMPT_FINDINGS_REL = ".claude/hooks/user-prompt-findings.sh";
 var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
 var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
-var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent)$";
+var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
 function hookCommand(script, verb) {
   const invocation = `bash "$CLAUDE_PROJECT_DIR"/${script}`;
   return verb === void 0 ? invocation : `${invocation} ${verb}`;
@@ -158,6 +159,13 @@ var HALFCYCLE_HOOK_WIRING = [
     command: hookCommand(USER_PROMPT_SCOPE_REL),
     script: USER_PROMPT_SCOPE_REL
   },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 10,
+    command: hookCommand(USER_PROMPT_FINDINGS_REL),
+    script: USER_PROMPT_FINDINGS_REL
+  },
   {
     event: "PreToolUse",
     matcher: PRE_TOOL_USE_MATCHER,
@@ -1243,8 +1251,9 @@ var SCOPE_PART_STATUSES = ["approved", "waiting"];
 var scopePartStatusSchema = z10.enum(SCOPE_PART_STATUSES);
 var SCOPE_ACTS = ["approve", "send-back"];
 var scopeActSchema = z10.enum(SCOPE_ACTS);
-var SCOPE_GIVEN_IN = ["console", "chat"];
+var SCOPE_GIVEN_IN = ["console", "chat", "autonomy"];
 var scopeGivenInSchema = z10.enum(SCOPE_GIVEN_IN);
+var APPROVED_IN_ADVANCE_SENTENCE = "approved in advance by your autonomy setting";
 var scopeNoteSchema = descriptionText(SCOPE_NOTE_MAX);
 var scopeNoteWireSchema = z10.string().max(SCOPE_NOTE_MAX);
 var SCOPE_PART_VERDICTS = ["ok", "change"];
@@ -1275,7 +1284,8 @@ var phasePlanRecordedSchema = z10.object({
   typedApprovalOffered: z10.boolean(),
   reportedAt: utcIso8601,
   carriedFrom: z10.array(carriedFromEntrySchema).min(1).max(PHASE_PLAN_CHANGES_MAX).optional(),
-  movedUp: planMovedUpSchema.optional()
+  movedUp: planMovedUpSchema.optional(),
+  givenIn: scopeGivenInSchema.optional()
 }).strict();
 var phasePlanRefusedSchema = z10.object({
   outcome: z10.literal("refused"),
@@ -2282,6 +2292,15 @@ var REVIEW_PART_CHANGES = Object.freeze([...PHASE_PLAN_CHANGE_KINDS, "not-in-pla
 var reviewPartChangeSchema = z17.enum(REVIEW_PART_CHANGES);
 var REVIEW_DECISIONS = Object.freeze(["accepted", "carried", "dropped"]);
 var reviewDecisionSchema = z17.enum(REVIEW_DECISIONS);
+var reviewGivenInSchema = scopeGivenInSchema.extract(["autonomy"]);
+var DECIDED_BY_AUTONOMY_SENTENCE = "decided by your autonomy setting";
+function checkReviewGivenIn(v, ctx) {
+  if (v.givenIn === void 0)
+    return;
+  if (v.decision !== "accepted" && v.decision !== "carried") {
+    ctx.addIssue({ code: "custom", path: ["givenIn"], message: "is present only on a part accepted or carried" });
+  }
+}
 function actOf(decision) {
   if (decision === "accepted")
     return "accept";
@@ -2347,6 +2366,25 @@ var reviewRefusedSchema = z17.object({
 function bareReviewOutcome(outcome) {
   return z17.object({ outcome: z17.literal(outcome) }).strict();
 }
+var reviewClosedByAutonomySchema = z17.object({
+  outcome: z17.literal("closed-by-autonomy"),
+  accepted: z17.number().int().min(0).max(REVIEW_PARTS_MAX),
+  carried: z17.number().int().min(0).max(REVIEW_PARTS_MAX)
+}).strict().refine((v) => v.accepted + v.carried <= REVIEW_PARTS_MAX, {
+  message: "cannot exceed the parts a round holds",
+  path: ["carried"]
+});
+var AUTONOMY_WAIT_REASONS = ["unchecked-claims", "built-without-approval"];
+var autonomyWaitReasonSchema = z17.enum(AUTONOMY_WAIT_REASONS);
+var reviewAutonomyWaitsSchema = z17.object({
+  outcome: z17.literal("autonomy-waits"),
+  reason: autonomyWaitReasonSchema,
+  count: z17.number().int().min(1),
+  parts: z17.array(z17.object({ part: systemPartIdSchema, name: systemPartSchema.shape.name }).strict()).min(1).max(REVIEW_PARTS_MAX)
+}).strict().refine((v) => v.reason !== "built-without-approval" || v.count === v.parts.length, {
+  message: "counts the parts it names",
+  path: ["count"]
+});
 var openReviewResultSchema = z17.discriminatedUnion("outcome", [
   reviewOpenedSchema,
   reviewTasksOpenSchema,
@@ -2355,7 +2393,9 @@ var openReviewResultSchema = z17.discriminatedUnion("outcome", [
   reviewOutstandingSchema,
   reviewCleanOverFindingsSchema,
   reviewRefusedSchema,
-  bareReviewOutcome("unavailable")
+  bareReviewOutcome("unavailable"),
+  reviewClosedByAutonomySchema,
+  reviewAutonomyWaitsSchema
 ]);
 var reviewPhaseNotOpenSchema = z17.object({
   statusCode: z17.literal(409),
@@ -2469,6 +2509,7 @@ var reviewViewPartSchema = z17.object({
   decidable: z17.boolean(),
   waiting: z17.boolean(),
   decision: reviewDecisionSchema.optional(),
+  givenIn: reviewGivenInSchema.optional(),
   reason: reviewNoteSchema.optional(),
   carriedTo: reviewCarriedToSchema.optional(),
   sentBack: z17.array(reviewSentBackSchema),
@@ -2496,6 +2537,7 @@ var reviewViewPartSchema = z17.object({
   if (v.change === "not-in-plan" && !v.built) {
     ctx.addIssue({ code: "custom", path: ["built"], message: "is always true for a part outside the plan" });
   }
+  checkReviewGivenIn(v, ctx);
 });
 var reviewPhaseNumberSchema = z17.number().int().min(1).nullable();
 var phaseReviewNoneSchema = z17.object({
@@ -2590,6 +2632,7 @@ var recordReviewPartSchema = z18.object({
   built: z18.boolean(),
   builtWithoutApproval: z18.boolean(),
   decision: reviewDecisionSchema,
+  givenIn: reviewGivenInSchema.optional(),
   reason: reviewNoteSchema.optional(),
   carriedTo: reviewCarriedToSchema.optional(),
   sentBack: z18.array(reviewSentBackSchema),
@@ -2603,6 +2646,7 @@ var recordReviewPartSchema = z18.object({
   if (v.carriedTo !== void 0 !== (v.decision === "carried")) {
     ctx.addIssue({ code: "custom", path: ["carriedTo"], message: "is present exactly on a carry" });
   }
+  checkReviewGivenIn(v, ctx);
 });
 var SPINE_ORDER = boardGateNameSchema.options;
 var recordReviewGatesSchema = z18.array(recordReviewGateSchema).superRefine((gates, ctx) => {
@@ -2898,6 +2942,251 @@ var phaseRecordResponseSchema = z22.discriminatedUnion("outcome", [
   phaseRecordRefusedSchema
 ]);
 
+// ../events/dist/owner-waits.js
+import { z as z23 } from "zod";
+var OWNER_WAIT_ITEMS = Object.freeze([
+  Object.freeze({ id: "delete-users-data", words: "Deleting or replacing data people already have." }),
+  Object.freeze({
+    id: "change-promises",
+    words: "Changing what the product promises its users, such as pricing, terms or privacy."
+  }),
+  Object.freeze({ id: "spend-or-sign-up", words: "Anything that costs money or signs up for a service." }),
+  Object.freeze({ id: "publish-or-release", words: "Publishing or releasing to users." }),
+  Object.freeze({ id: "reshape-shared-data", words: "Dropping or reshaping stored data that other parts read." }),
+  Object.freeze({ id: "change-standing-rule", words: "Changing a standing rule." })
+]);
+var OWNER_WAIT_ITEM_IDS = Object.freeze(OWNER_WAIT_ITEMS.map((item) => item.id));
+var ownerWaitItemIdSchema = z23.enum(OWNER_WAIT_ITEM_IDS);
+var OWNER_WAIT_FIXED_COUNT = OWNER_WAIT_ITEMS.length;
+var OWNER_WAIT_ADDITIONS_MAX = 20;
+var OWNER_WAIT_TEXT_MAX = 240;
+var ownerWaitItemRefSchema = z23.union([
+  z23.number().int().min(1),
+  z23.string().uuid({ message: "must be a number from 1 to 6, or the id shown beside an added item" })
+]);
+var ownerWaitText = descriptionText(OWNER_WAIT_TEXT_MAX);
+var ownerWaitAddRequestSchema = z23.object({
+  engagementId: z23.string().min(1),
+  text: ownerWaitText,
+  reason: ownerWaitText
+}).strict();
+var ownerWaitAddResultSchema = z23.discriminatedUnion("outcome", [
+  z23.object({ outcome: z23.literal("added"), id: z23.string().uuid(), addedAt: utcIso8601 }).strict(),
+  z23.object({ outcome: z23.literal("refused"), reason: z23.literal("too-many") }).strict()
+]);
+var ownerWaitUndoableSchema = z23.enum(["yes", "no"]);
+var ownerWaitDeclareRequestSchema = z23.object({
+  engagementId: z23.string().min(1),
+  item: ownerWaitItemRefSchema,
+  question: ownerWaitText,
+  recommendation: ownerWaitText,
+  task: buildTaskIdSchema.optional(),
+  by: agentNameSchema.optional(),
+  undoable: ownerWaitUndoableSchema.optional(),
+  how: statementText(STATEMENT_MAX).optional()
+}).strict().refine((r) => r.undoable === "yes" === (r.how !== void 0), {
+  message: "says how to undo it exactly when it can be undone",
+  path: ["how"]
+});
+var OWNER_WAIT_DECLARE_REFUSALS = ["no-open-phase", "unknown-item", "say-if-undoable"];
+var ownerWaitDeclareResultSchema = z23.discriminatedUnion("outcome", [
+  z23.object({ outcome: z23.literal("recorded"), id: z23.string().uuid(), say: z23.string().min(1) }).strict(),
+  z23.object({
+    outcome: z23.literal("go-ahead"),
+    id: z23.string().uuid(),
+    callId: z23.number().int().positive(),
+    say: z23.string().min(1)
+  }).strict(),
+  z23.object({ outcome: z23.literal("refused"), reason: z23.enum(OWNER_WAIT_DECLARE_REFUSALS) }).strict()
+]);
+var ownerWaitAddedItemSchema = z23.object({
+  id: z23.string().uuid(),
+  words: z23.string().min(1),
+  reason: z23.string().min(1),
+  addedAt: utcIso8601
+}).strict();
+var ownerWaitListSchema = z23.object({
+  fixed: z23.array(z23.object({ id: ownerWaitItemIdSchema, words: z23.string().min(1) }).strict()).length(OWNER_WAIT_FIXED_COUNT),
+  added: z23.array(ownerWaitAddedItemSchema).max(OWNER_WAIT_ADDITIONS_MAX)
+}).strict();
+var ownerWaitDeclarationSchema = z23.object({
+  id: z23.string().uuid(),
+  fixedItem: ownerWaitItemIdSchema.nullable(),
+  addition: z23.object({ id: z23.string().uuid(), words: z23.string().min(1) }).strict().nullable(),
+  question: z23.string().min(1),
+  recommendation: z23.string().min(1),
+  task: buildTaskIdSchema.nullable(),
+  declaredAt: utcIso8601
+}).strict().refine((d) => d.fixedItem === null !== (d.addition === null), {
+  message: "names exactly one item: a fixed one or an added one",
+  path: ["fixedItem"]
+});
+var ownerWaitDeclarationsSchema = z23.object({ declarations: z23.array(ownerWaitDeclarationSchema) }).strict();
+var OWNER_WAIT_TOO_MANY = `This project already has ${String(OWNER_WAIT_ADDITIONS_MAX)} things added to what waits for the owner. Ask the owner to take one off in the console first.`;
+
+// ../events/dist/autonomy.js
+import { z as z24 } from "zod";
+var AUTONOMY_CHANGED_IN = ["console", "chat"];
+var autonomyChangedInSchema = z24.enum(AUTONOMY_CHANGED_IN);
+var autonomySettingsSchema = z24.object({
+  on: z24.boolean(),
+  // whether builds run on their own
+  mayPublish: z24.boolean(),
+  // whether builds may publish or release without waiting
+  maySpend: z24.boolean(),
+  // whether builds may spend money or sign up without waiting
+  changedAt: utcIso8601.nullable(),
+  // when the setting last changed; null if never
+  changedIn: autonomyChangedInSchema.nullable()
+  // where it last changed; null if never
+}).strict().refine((v) => v.changedAt === null === (v.changedIn === null), {
+  message: "says when and where it changed, or neither",
+  path: ["changedIn"]
+});
+var autonomyChangeRequestSchema = z24.object({
+  on: z24.boolean(),
+  // the switch
+  mayPublish: z24.boolean(),
+  // the publish box
+  maySpend: z24.boolean()
+  // the spend box
+}).strict();
+var AUTONOMY_CHAT_ACTS = ["on", "off"];
+var autonomyChatActSchema = z24.enum(AUTONOMY_CHAT_ACTS);
+var autonomyChatRequestSchema = z24.object({
+  act: autonomyChatActSchema
+  // what the owner typed
+}).strict();
+var autonomyChatResultSchema = z24.discriminatedUnion("outcome", [
+  z24.object({
+    outcome: z24.literal("recorded"),
+    on: z24.boolean()
+    // whether builds now run on their own
+  }).strict(),
+  z24.object({ outcome: z24.literal("not-owner") }).strict(),
+  z24.object({ outcome: z24.literal("no-owner") }).strict(),
+  z24.object({ outcome: z24.literal("not-offered") }).strict(),
+  z24.object({ outcome: z24.literal("unavailable") }).strict()
+]);
+var autonomyStateSchema = z24.object({
+  on: z24.boolean(),
+  // whether builds run on their own
+  mayPublish: z24.boolean(),
+  // whether builds may publish or release without waiting
+  maySpend: z24.boolean()
+  // whether builds may spend money or sign up without waiting
+}).strict();
+var autonomyStateFileSchema = autonomyStateSchema.extend({
+  readAt: utcIso8601
+  // when this copy was read from Halfcycle
+}).strict();
+var AUTONOMY_STATE_FILE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var AUTONOMY_ACTIVITY_KINDS = ["went-ahead", "waiting", "approved", "closed", "waiting-on-owner"];
+var autonomyActivityKindSchema = z24.enum(AUTONOMY_ACTIVITY_KINDS);
+var autonomyActivityRowSchema = z24.object({
+  kind: autonomyActivityKindSchema,
+  // what happened
+  phase: scopePhaseSchema,
+  // the phase it happened in
+  question: ownerWaitText.optional(),
+  // the agent's question, for a decision
+  chose: ownerWaitText.optional(),
+  // what the agent chose or recommends, for a decision
+  undoable: ownerWaitUndoableSchema.optional(),
+  // whether the agent says it can be undone
+  how: statementText(STATEMENT_MAX).optional(),
+  // how to undo it, when it can be
+  at: utcIso8601
+  // when it happened
+}).strict().superRefine((row, ctx) => {
+  const decision = row.kind === "went-ahead" || row.kind === "waiting";
+  if (decision && row.question === void 0) {
+    ctx.addIssue({ code: "custom", message: "a decision says its question", path: ["question"] });
+  }
+  if (!decision) {
+    for (const key of ["question", "chose", "undoable", "how"]) {
+      if (row[key] !== void 0) {
+        ctx.addIssue({ code: "custom", message: "only a decision carries this", path: [key] });
+      }
+    }
+  }
+  if (row.kind === "went-ahead") {
+    if (row.chose === void 0) {
+      ctx.addIssue({ code: "custom", message: "a decision that went ahead says what was chosen", path: ["chose"] });
+    }
+    if (row.undoable === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: "a decision that went ahead says whether it can be undone",
+        path: ["undoable"]
+      });
+    }
+  }
+  if (row.kind === "waiting" && (row.undoable !== void 0 || row.how !== void 0)) {
+    ctx.addIssue({ code: "custom", message: "a waiting decision has not been made yet", path: ["undoable"] });
+  }
+  if (row.kind === "went-ahead" && row.undoable === "yes" !== (row.how !== void 0)) {
+    ctx.addIssue({ code: "custom", message: "says how to undo it exactly when it can be undone", path: ["how"] });
+  }
+});
+var autonomyActivitySchema = z24.object({
+  rows: z24.array(autonomyActivityRowSchema)
+  // newest first
+}).strict();
+var savedIdSchema = z24.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lower-case letters, digits and single hyphens");
+var SAVED_REF_PREFIX = "refs/halfcycle/saved/";
+function savedRefOf(id) {
+  return `${SAVED_REF_PREFIX}${id}`;
+}
+var SAVED_KEEP_MS = 7 * 24 * 60 * 60 * 1e3;
+function isProjectRelativePath(p) {
+  if (p.length === 0 || hasControlCharacter(p))
+    return false;
+  if (p.startsWith("/") || p.startsWith("\\") || /^[A-Za-z]:/.test(p))
+    return false;
+  return p.split(/[\\/]/).every((segment) => segment !== "" && windowsNameOf(segment) !== "" && !isGitFolderSegment(segment));
+}
+function windowsNameOf(segment) {
+  return segment.replace(/[\u200b-\u200f\u202a-\u202e\u2060-\u2064\u206a-\u206f\ufeff]/g, "").split(":")[0].replace(/[. ]+$/, "").toLowerCase();
+}
+function isGitFolderSegment(segment) {
+  const t = windowsNameOf(segment);
+  return t === ".git" || /^git~\d+$/.test(t);
+}
+var SAVED_PATH_KEPT_IN = ["commit", "copy"];
+var savedPathSchema = z24.object({
+  path: z24.string().max(4096).refine(isProjectRelativePath, { message: "must be a path inside the project" }),
+  // the file, relative to the project
+  keptIn: z24.enum(SAVED_PATH_KEPT_IN)
+  // in the save's commit, or copied beside this file
+}).strict();
+var savedCommitSchema = z24.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/, "must be a full commit hash");
+var savedBranchSchema = z24.object({
+  name: z24.string().min(1).max(255).refine((n) => !hasControlCharacter(n) && !n.startsWith("-") && !n.includes("..") && n !== "HEAD", {
+    message: "must be a branch name"
+  }),
+  // the branch's name
+  commit: savedCommitSchema
+  // the commit it pointed at
+}).strict();
+var savedSchema = z24.object({
+  id: savedIdSchema,
+  // what restore is typed with
+  savedAt: utcIso8601,
+  // when the copy was made
+  ref: z24.string().min(1),
+  // where the saved commit is kept
+  what: z24.string().min(1).max(2e3),
+  // what the action would have changed, in words
+  paths: z24.array(savedPathSchema),
+  // every saved file
+  branches: z24.array(savedBranchSchema)
+  // every saved line of work
+}).strict().refine((s) => s.ref === savedRefOf(s.id), { message: "must be the ref of this save", path: ["ref"] });
+function autonomyC8(agent, question, chose) {
+  return `${agent} decided "${question}" without asking you, under your autonomy setting: chose "${chose}". It is on the list of things that wait for you, so it was sent to you as it was made.`;
+}
+
 // ../events/dist/work-words.js
 var CALLS_HEADING = "Calls made without asking you";
 var CALLS_EXPLAINED = "These are the decisions the agents recorded taking on their own, each against a stated default. Halfcycle lists what they recorded; it cannot see a call an agent did not record.";
@@ -3207,44 +3496,68 @@ function mintIdentity(targetRepoRoot) {
   };
 }
 function repairRemoteCredential(targetRepoRoot) {
-  const path = join3(targetRepoRoot, ".halfcycle", "project.json");
+  const repaired = plannedRemoteRepair(targetRepoRoot);
+  if (repaired !== null)
+    replaceProjectIdentityFile(targetRepoRoot, repaired);
+}
+function plannedRemoteRepair(targetRepoRoot) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   let onDisk;
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-      return;
+      return null;
     onDisk = parsed;
   } catch {
-    return;
+    return null;
   }
   const storedRemote = onDisk.remote ?? null;
   const remote = redactRemoteCredential(storedRemote);
   if (remote === storedRemote)
-    return;
-  const identity = {
+    return null;
+  return serializeProjectIdentity({
     projectId: onDisk.projectId ?? "",
     rootCommit: onDisk.rootCommit ?? null,
     remote,
     note: PROJECT_IDENTITY_NOTE
-  };
+  });
+}
+function replaceProjectIdentityFile(targetRepoRoot, text) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    writeFileSync2(temporary, serializeProjectIdentity(identity), { encoding: "utf-8", flag: "wx" });
+    writeFileSync2(temporary, text, { encoding: "utf-8", flag: "wx" });
     renameSync(temporary, path);
   } catch {
   } finally {
     rmSync(temporary, { force: true });
   }
 }
+function planProjectIdentity(targetRepoRoot) {
+  const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
+  if (!existsSync(path)) {
+    return { action: "add", after: serializeProjectIdentity(mintIdentity(targetRepoRoot)) };
+  }
+  const repaired = plannedRemoteRepair(targetRepoRoot);
+  if (repaired !== null)
+    return { action: "change", after: repaired };
+  let current;
+  try {
+    current = readFileSync2(path, "utf-8");
+  } catch {
+    current = null;
+  }
+  return { action: "leave", after: current };
+}
 function serializeProjectIdentity(identity) {
   return JSON.stringify(identity, null, 2) + "\n";
 }
-function createProjectIdentityFile(targetRepoRoot) {
+function createProjectIdentityFile(targetRepoRoot, text) {
   const path = join3(targetRepoRoot, PROJECT_IDENTITY_REL);
   mkdirSync2(dirname2(path), { recursive: true });
   const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try {
-    writeFileSync2(temporary, serializeProjectIdentity(mintIdentity(targetRepoRoot)), {
+    writeFileSync2(temporary, text ?? serializeProjectIdentity(mintIdentity(targetRepoRoot)), {
       encoding: "utf-8",
       flag: "wx"
     });
@@ -3259,6 +3572,10 @@ function createProjectIdentityFile(targetRepoRoot) {
   }
 }
 
+// dist/install-plan.js
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { join as join5, posix } from "node:path";
+
 // dist/install-manifest.js
 import { Buffer as Buffer2 } from "node:buffer";
 import { createHash } from "node:crypto";
@@ -3557,6 +3874,469 @@ function union(a, b) {
   return [.../* @__PURE__ */ new Set([...a, ...b])];
 }
 
+// dist/scan.js
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
+var HALFCYCLE_STATE_NOTE = [
+  "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
+  "record of what this project has done, and it is never updated as work happens.",
+  'An empty or missing "layers" means the install-time scan found no pre-existing',
+  "artefacts on disk \u2014 it does NOT mean nothing has been done since, and it is not",
+  "evidence that any step is unfinished or any approval is outstanding.",
+  "The authoritative position lives in the Halfcycle service: call the",
+  "halfcycle_resolve tool to ask where this project stands. Do not answer that",
+  "question from this file."
+].join(" ");
+var LAYER_ARTEFACT_PATHS = {
+  l0: ["ENGAGEMENT.md"],
+  l1: ["docs/product-spec.md"],
+  l2: ["docs/architecture-overview.md"],
+  l3: ["docs/invariants.md"],
+  l4: ["docs/features"],
+  l5: ["docs/phases"]
+};
+function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const layers = {};
+  for (const [layer, paths] of Object.entries(LAYER_ARTEFACT_PATHS)) {
+    const found = paths.filter((p) => existsSync2(join4(targetRepo, p)));
+    if (found.length > 0) {
+      layers[layer] = {
+        value: "asserted",
+        source: "bootstrap-scan",
+        foundPaths: found,
+        scannedAt
+      };
+    }
+  }
+  return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
+}
+var BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
+function runBootstrapScan(targetRepo) {
+  const planned = planBootstrapScan(targetRepo);
+  if (planned.text !== null)
+    writeBootstrapState(targetRepo, planned.text);
+  return { state: planned.state, ran: planned.text !== null };
+}
+function planBootstrapScan(targetRepo) {
+  const statePath = join4(targetRepo, BOOTSTRAP_STATE_REL);
+  if (existsSync2(statePath)) {
+    const existing = JSON.parse(readFileSync3(statePath, "utf-8"));
+    return { state: existing, text: null };
+  }
+  const state = scanLayers(targetRepo);
+  return { state, text: JSON.stringify(state, null, 2) + "\n" };
+}
+function writeBootstrapState(targetRepo, text) {
+  mkdirSync3(join4(targetRepo, ".halfcycle"), { recursive: true });
+  writeFileSync3(join4(targetRepo, BOOTSTRAP_STATE_REL), text, "utf-8");
+}
+function mergeWithRecords(state, layersWithRealRecords) {
+  const merged = {};
+  const allLayers = /* @__PURE__ */ new Set([
+    ...Object.keys(state.layers),
+    ...layersWithRealRecords
+  ]);
+  for (const layer of allLayers) {
+    if (layersWithRealRecords.has(layer)) {
+      merged[layer] = "complete";
+    } else if (state.layers[layer]) {
+      merged[layer] = "asserted";
+    }
+  }
+  return merged;
+}
+
+// dist/install-plan.js
+var PENDING = /* @__PURE__ */ Symbol("pending");
+var YOURS = "a file of yours with the same name; Halfcycle will not touch it";
+var SAME = "already as Halfcycle would write it";
+var PREVIEW_WORDS = Object.freeze({
+  command: {
+    add: "a command your coding agent can run to take the next Halfcycle step",
+    change: "a newer version of this Halfcycle command",
+    leave: SAME,
+    yours: YOURS
+  },
+  "check-script": {
+    add: "a check Halfcycle runs before and after your agent's actions",
+    change: "a newer version of this Halfcycle check",
+    leave: SAME,
+    yours: YOURS
+  },
+  settings: {
+    add: "your coding agent's settings, with the checks Halfcycle runs",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "server-entry": {
+    add: "tells your coding agent how to reach Halfcycle's service",
+    change: "adds Halfcycle's entry; your own entries stay as they are",
+    leave: "already has Halfcycle's entry",
+    yours: YOURS
+  },
+  "ignore-list": {
+    add: "keeps Halfcycle's files for this computer only out of git",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "line-endings": {
+    add: "keeps Halfcycle's checks working in a Windows copy of this project",
+    change: "adds the lines Halfcycle needs; your own lines stay as they are",
+    leave: "already has the lines Halfcycle needs",
+    yours: YOURS
+  },
+  "halfcycle-folder": {
+    add: "a file in Halfcycle's own folder",
+    change: "a newer version of this file in Halfcycle's own folder",
+    leave: SAME,
+    yours: YOURS
+  },
+  runner: {
+    add: "the program Halfcycle's checks run",
+    change: "a newer version of the program Halfcycle's checks run",
+    leave: SAME,
+    yours: YOURS
+  },
+  "captured-index": {
+    add: "the list of real examples your project's tests are checked against",
+    change: "a newer version of this list",
+    leave: SAME,
+    yours: YOURS
+  },
+  "old-sign-in": {
+    add: "an older Halfcycle sign-in",
+    change: "takes out an older Halfcycle sign-in; your own lines stay as they are",
+    leave: "an older Halfcycle sign-in that cannot be moved yet; left as it is",
+    yours: YOURS
+  }
+});
+var kindTable;
+function kinds() {
+  kindTable ??= /* @__PURE__ */ new Map([
+    [".claude/hooks/guard-runner.sh", "check-script"],
+    [".claude/hooks/user-prompt-reminder.sh", "check-script"],
+    [".claude/hooks/user-prompt-scope.sh", "check-script"],
+    [".claude/hooks/user-prompt-findings.sh", "check-script"],
+    [".claude/hooks/session-end-marker.sh", "check-script"],
+    [".claude/hooks/session-start-marker.sh", "check-script"],
+    [SETTINGS_REL, "settings"],
+    [MCP_REGISTRATION_REL, "server-entry"],
+    [GITIGNORE_REL, "ignore-list"],
+    [GITATTRIBUTES_REL, "line-endings"],
+    [VENDORED_BIN_REL, "runner"],
+    [CREW_ROSTER_REL, "halfcycle-folder"],
+    [BUNDLE_PIN_REL, "halfcycle-folder"],
+    [PROJECT_IDENTITY_REL, "halfcycle-folder"],
+    [BOOTSTRAP_STATE_REL, "halfcycle-folder"],
+    [INSTALL_MANIFEST_REL, "halfcycle-folder"],
+    [RETIRED_MCP_HEADERS_HELPER_REL, "halfcycle-folder"],
+    [LEGACY_CI_STANZA_REL, "halfcycle-folder"],
+    [CAPTURED_INDEX_REL, "captured-index"],
+    [LEGACY_ENV_LOCAL_REL, "old-sign-in"]
+  ]);
+  return kindTable;
+}
+function previewKindOf(rel) {
+  if (/^\.claude\/commands\/[^/]+\.md$/.test(rel))
+    return "command";
+  return kinds().get(rel);
+}
+function kindOf(rel) {
+  const kind = previewKindOf(rel);
+  if (kind === void 0)
+    throw new Error(`[halfcycle] the installer plans ${rel}, which has no preview words.`);
+  return kind;
+}
+var STEPS = /* @__PURE__ */ new WeakMap();
+function planInstall(options) {
+  const { targetRepo, engagementId, engagementType, credential, home, env, createdByAccountId } = options;
+  const preview = engagementId === void 0;
+  if (!preview) {
+    assertEngagementId(engagementId);
+    if (engagementType === void 0) {
+      throw new Error("[halfcycle] a plan for a project needs its kind as well as its id.");
+    }
+  }
+  if (!existsSync3(targetRepo)) {
+    throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
+  }
+  const writeSet = closedWriteSet();
+  const previous = readPreviousManifest(targetRepo);
+  const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
+  const { version, commands } = planCommandStubs(targetRepo, previous, writeSet);
+  const vendored = planVendoredBinary(targetRepo);
+  let settings;
+  try {
+    settings = planSettings(targetRepo, previous, home, env);
+  } catch (err) {
+    if (err instanceof SettingsParseRefused)
+      return Object.freeze({ entries: [], outside: [], refusal: err.message });
+    throw err;
+  }
+  const hooks = planHookScripts(targetRepo);
+  const ciStanza = planLegacyCiStanzaRemoval(targetRepo);
+  const mcp = planMcpRegistration(targetRepo, preview ? "pending" : credential);
+  const mcpHelper = mcp.kind === "none" ? null : planMcpHeadersHelperRemoval(targetRepo);
+  const gitignore = planGitignore(targetRepo);
+  const gitattributes = planGitattributes(targetRepo);
+  const identity = planProjectIdentity(targetRepo);
+  if (identity.after === null)
+    readFileSync4(join5(targetRepo, PROJECT_IDENTITY_REL));
+  const credentialPlan = !preview && credential !== void 0 ? planEngagementCredential(credential, engagementId, home) : null;
+  const credentialWrite = credentialPlan === null ? null : { outcome: credentialPlan.outcome, existed: credentialPlan.existed, path: engagementEnvPath(engagementId, home) };
+  const storedAfter = credentialPlan?.storedAfter ?? (preview ? Object.fromEntries(ENGAGEMENT_ENV_KEYS.map((key) => [key, "supplied at sign-in"])) : readEngagementEnv(engagementId, home) ?? {});
+  const legacy = migrateLegacyEnvLocal(targetRepo, storedAfter);
+  const pin = preview ? planBundlePinPreview(targetRepo, version, home) : planBundlePin(targetRepo, version, engagementId, engagementType, createdByAccountId, credential?.methodVersion);
+  const crew = planCrewRoster(targetRepo);
+  const scan = { text: planBootstrapScan(targetRepo).text };
+  const steps = {
+    targetRepo,
+    version,
+    engagementId,
+    engagementType,
+    credential: preview ? void 0 : credential,
+    home,
+    writeSet,
+    previous,
+    dirsBefore,
+    commands,
+    vendored,
+    settings,
+    hooks,
+    ciStanza,
+    mcp,
+    mcpHelper,
+    gitignore,
+    gitattributes,
+    identity,
+    credentialWrite,
+    legacy,
+    pin,
+    crew,
+    scan
+  };
+  const record2 = preview ? null : planInstallRecord(targetRepo, accountInstall(steps, predicted(steps)).manifestText);
+  const plan = Object.freeze({
+    entries: Object.freeze(entriesOf(steps, record2)),
+    outside: Object.freeze(outsideOf(steps))
+  });
+  STEPS.set(plan, steps);
+  return plan;
+}
+function predicted(steps) {
+  const after = /* @__PURE__ */ new Map();
+  const dirs = /* @__PURE__ */ new Set();
+  const lands = (rel, text, writes) => {
+    after.set(rel, text);
+    if (!writes)
+      return;
+    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir))
+      dirs.add(dir);
+  };
+  const file = (planned) => {
+    if (planned.outcome !== "collided")
+      lands(planned.rel, planned.text, planned.outcome === "written");
+  };
+  steps.commands.forEach(file);
+  file(steps.vendored);
+  file(steps.settings.file);
+  steps.hooks.forEach(file);
+  if (steps.mcp.kind === "write")
+    lands(MCP_REGISTRATION_REL, steps.mcp.text, steps.mcp.outcome !== "skipped");
+  if (steps.identity.after !== null)
+    lands(PROJECT_IDENTITY_REL, steps.identity.after, steps.identity.action === "add");
+  if (steps.pin !== null)
+    file(steps.pin);
+  file(steps.crew);
+  if (steps.scan.text !== null)
+    lands(BOOTSTRAP_STATE_REL, steps.scan.text, true);
+  const mergeAfter = (planned) => planned.outcome === "written" ? planned.after : planned.before;
+  return {
+    ciStanza: steps.ciStanza,
+    mcpHelper: steps.mcpHelper,
+    gitignore: steps.gitignore.outcome,
+    gitignoreAfter: mergeAfter(steps.gitignore),
+    gitattributes: steps.gitattributes.outcome,
+    gitattributesAfter: mergeAfter(steps.gitattributes),
+    credential: steps.credentialWrite?.outcome ?? null,
+    legacy: steps.legacy,
+    bytesAfter: (rel) => {
+      const text = after.get(rel);
+      if (text === void 0)
+        throw new Error(`[halfcycle] the plan has no bytes for ${rel}.`);
+      return Buffer.from(text, "utf-8");
+    },
+    dirExistsAfter: (dir) => steps.dirsBefore.has(dir) || dirs.has(dir),
+    stateExistsAfter: true
+  };
+}
+function entriesOf(steps, record2) {
+  const { targetRepo } = steps;
+  const entries = [];
+  const fromFile = (planned) => {
+    const kind = kindOf(planned.rel);
+    if (planned.outcome === "written") {
+      entries.push({ path: planned.rel, action: planned.replacedExisting ? "change" : "add", kind, bytes: planned.text });
+    } else if (planned.outcome === "collided") {
+      entries.push({ path: planned.rel, action: "leave", kind, bytes: null, yours: true });
+    } else {
+      entries.push({ path: planned.rel, action: "leave", kind, bytes: null });
+    }
+  };
+  const retired = (rel, decided) => {
+    if (decided === null || decided === "absent")
+      return;
+    if (decided === "removed")
+      entries.push({ path: rel, action: "remove", kind: kindOf(rel), bytes: null });
+    else if (decided === "kept-foreign")
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null, yours: true });
+    else
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null });
+  };
+  const merge = (rel, planned) => {
+    if (planned.outcome === "written" && planned.after !== null) {
+      entries.push({ path: rel, action: planned.before === null ? "add" : "change", kind: kindOf(rel), bytes: planned.after });
+    } else if (planned.before !== null || planned.outcome === "failed") {
+      entries.push({ path: rel, action: "leave", kind: kindOf(rel), bytes: null });
+    }
+  };
+  const pending = (rel) => {
+    const there = existsSync3(join5(targetRepo, rel));
+    entries.push({ path: rel, action: there ? "change" : "add", kind: kindOf(rel), bytes: PENDING });
+  };
+  steps.commands.forEach(fromFile);
+  fromFile(steps.vendored);
+  const settings = steps.settings;
+  entries.push(settings.file.outcome === "written" ? { path: SETTINGS_REL, action: settings.preexisted ? "change" : "add", kind: "settings", bytes: settings.file.text } : { path: SETTINGS_REL, action: "leave", kind: "settings", bytes: null });
+  steps.hooks.forEach(fromFile);
+  retired(LEGACY_CI_STANZA_REL, steps.ciStanza);
+  const mcp = steps.mcp;
+  if (mcp.kind === "write") {
+    const action = mcp.outcome === "written" ? "add" : mcp.outcome === "merged" ? "change" : "leave";
+    entries.push({ path: MCP_REGISTRATION_REL, action, kind: "server-entry", bytes: action === "leave" ? null : mcp.text });
+  } else if (mcp.kind === "pending") {
+    pending(MCP_REGISTRATION_REL);
+  } else {
+    entries.push({ path: MCP_REGISTRATION_REL, action: "leave", kind: "server-entry", bytes: null });
+  }
+  retired(RETIRED_MCP_HEADERS_HELPER_REL, steps.mcpHelper);
+  merge(GITIGNORE_REL, steps.gitignore);
+  merge(GITATTRIBUTES_REL, steps.gitattributes);
+  const identity = steps.identity;
+  entries.push({
+    path: PROJECT_IDENTITY_REL,
+    action: identity.action,
+    kind: "halfcycle-folder",
+    bytes: identity.action === "leave" ? null : identity.after
+  });
+  const legacy = steps.legacy;
+  if (legacy.outcome === "removed") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "remove", kind: "old-sign-in", bytes: null });
+  } else if (legacy.outcome === "stripped") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "change", kind: "old-sign-in", bytes: legacy.keptText ?? null });
+  } else if (legacy.outcome !== "absent") {
+    entries.push({ path: LEGACY_ENV_LOCAL_REL, action: "leave", kind: "old-sign-in", bytes: null });
+  }
+  if (steps.pin === null)
+    pending(BUNDLE_PIN_REL);
+  else
+    fromFile(steps.pin);
+  fromFile(steps.crew);
+  entries.push(steps.scan.text !== null ? { path: BOOTSTRAP_STATE_REL, action: "add", kind: "halfcycle-folder", bytes: steps.scan.text } : { path: BOOTSTRAP_STATE_REL, action: "leave", kind: "halfcycle-folder", bytes: null });
+  if (record2 === null)
+    pending(INSTALL_MANIFEST_REL);
+  else
+    fromFile(record2);
+  return entries;
+}
+function outsideOf(steps) {
+  if (steps.engagementId === void 0) {
+    const outside = [{ kind: "sign-in", path: null, action: "pending" }];
+    if (!projectPinned(steps.targetRepo))
+      outside.push({ kind: "new-project" });
+    return outside;
+  }
+  const write = steps.credentialWrite;
+  if (write === null)
+    return [];
+  const action = write.outcome === "skipped" ? "leave" : write.existed ? "change" : "add";
+  return [{ kind: "sign-in", path: write.path, action }];
+}
+function projectPinned(targetRepo) {
+  try {
+    const id = readBundlePin(targetRepo)?.engagementId;
+    return typeof id === "string" && id.trim() !== "";
+  } catch {
+    return false;
+  }
+}
+function applyInstallPlan(plan) {
+  if (plan.refusal !== void 0)
+    throw new SettingsParseRefused(plan.refusal);
+  const steps = STEPS.get(plan);
+  if (steps === void 0)
+    throw new Error("[halfcycle] only a plan made by planInstall can be applied.");
+  const { targetRepo, engagementId, pin } = steps;
+  if (engagementId === void 0 || pin === null || steps.mcp.kind === "pending") {
+    throw new Error("[halfcycle] a preview cannot be applied: it is still waiting for the service.");
+  }
+  for (const command of steps.commands)
+    putPlannedFile(targetRepo, command);
+  putPlannedFile(targetRepo, steps.vendored);
+  putPlannedFile(targetRepo, steps.settings.file);
+  for (const hook of steps.hooks)
+    putPlannedFile(targetRepo, hook);
+  const ciStanza = steps.ciStanza === "removed" ? removePlannedRetiredFile(targetRepo, LEGACY_CI_STANZA_REL) : steps.ciStanza;
+  putPlannedMcp(targetRepo, steps.mcp);
+  const mcpHelper = steps.mcpHelper === "removed" ? removePlannedRetiredFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL) : steps.mcpHelper;
+  const gitignore = putPlannedGitignore(targetRepo, steps.gitignore);
+  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+  const gitignoreAfter = existsSync3(gitignorePath) ? readFileSync4(gitignorePath, "utf-8") : null;
+  const gitattributes = putPlannedGitattributes(targetRepo, steps.gitattributes);
+  const gitattributesAfter = readTextOrNull(join5(targetRepo, GITATTRIBUTES_REL));
+  writeProjectIdentity(targetRepo, steps.identity);
+  const credential = steps.credential;
+  const credentialOutcome = steps.credentialWrite !== null && credential !== void 0 ? writeEngagementCredential(credential, engagementId, steps.home) : null;
+  const stored = readEngagementEnv(engagementId, steps.home) ?? {};
+  const legacy = applyLegacyMigration(targetRepo, migrateLegacyEnvLocal(targetRepo, stored));
+  writeBundlePin(targetRepo, pin, []);
+  putPlannedFile(targetRepo, steps.crew);
+  if (steps.scan.text !== null)
+    writeBootstrapState(targetRepo, steps.scan.text);
+  const { report, installManifest, manifestText } = accountInstall(steps, {
+    ciStanza,
+    mcpHelper,
+    gitignore,
+    gitignoreAfter,
+    gitattributes,
+    gitattributesAfter,
+    credential: credentialOutcome,
+    legacy,
+    bytesAfter: (rel) => readFileSync4(join5(targetRepo, rel)),
+    dirExistsAfter: (dir) => existsSync3(join5(targetRepo, dir)),
+    stateExistsAfter: existsSync3(join5(targetRepo, BOOTSTRAP_STATE_REL))
+  });
+  const record2 = planInstallRecord(targetRepo, manifestText);
+  putPlannedFile(targetRepo, record2);
+  recordInstallRecord(report, record2);
+  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
+  return {
+    version: steps.version,
+    writtenPaths: report.writtenPaths,
+    skippedPaths: report.skippedPaths,
+    mergedPaths: report.mergedPaths,
+    collidedPaths: report.collidedPaths,
+    editedCollidedPaths: report.editedCollidedPaths,
+    replacedPaths: report.replacedPaths,
+    bootstrapScanRan: steps.scan.text !== null,
+    legacyCredentialKept: legacy.outcome === "kept" ? { keys: legacy.unbacked, missing: legacy.missingForAdoption } : null,
+    notShared
+  };
+}
+
 // dist/mcp-endpoint.js
 var MCP_ENDPOINT_PATH = "/mcp";
 function mcpEndpointUrl(origin) {
@@ -3636,71 +4416,6 @@ function mergePermissions(existing, generated, retiredOurs) {
   return result;
 }
 
-// dist/scan.js
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
-var HALFCYCLE_STATE_FORMAT = "halfcycle-state-file/v1";
-var HALFCYCLE_STATE_NOTE = [
-  "This file is a local cache written ONCE when Halfcycle was installed. It is not a",
-  "record of what this project has done, and it is never updated as work happens.",
-  'An empty or missing "layers" means the install-time scan found no pre-existing',
-  "artefacts on disk \u2014 it does NOT mean nothing has been done since, and it is not",
-  "evidence that any step is unfinished or any approval is outstanding.",
-  "The authoritative position lives in the Halfcycle service: call the",
-  "halfcycle_resolve tool to ask where this project stands. Do not answer that",
-  "question from this file."
-].join(" ");
-var LAYER_ARTEFACT_PATHS = {
-  l0: ["ENGAGEMENT.md"],
-  l1: ["docs/product-spec.md"],
-  l2: ["docs/architecture-overview.md"],
-  l3: ["docs/invariants.md"],
-  l4: ["docs/features"],
-  l5: ["docs/phases"]
-};
-function scanLayers(targetRepo, scannedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  const layers = {};
-  for (const [layer, paths] of Object.entries(LAYER_ARTEFACT_PATHS)) {
-    const found = paths.filter((p) => existsSync2(join4(targetRepo, p)));
-    if (found.length > 0) {
-      layers[layer] = {
-        value: "asserted",
-        source: "bootstrap-scan",
-        foundPaths: found,
-        scannedAt
-      };
-    }
-  }
-  return { format: HALFCYCLE_STATE_FORMAT, note: HALFCYCLE_STATE_NOTE, layers };
-}
-var BOOTSTRAP_STATE_REL = ".halfcycle/state.json";
-function runBootstrapScan(targetRepo) {
-  const statePath = join4(targetRepo, BOOTSTRAP_STATE_REL);
-  if (existsSync2(statePath)) {
-    const existing = JSON.parse(readFileSync3(statePath, "utf-8"));
-    return { state: existing, ran: false };
-  }
-  const state = scanLayers(targetRepo);
-  mkdirSync3(join4(targetRepo, ".halfcycle"), { recursive: true });
-  writeFileSync3(statePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
-  return { state, ran: true };
-}
-function mergeWithRecords(state, layersWithRealRecords) {
-  const merged = {};
-  const allLayers = /* @__PURE__ */ new Set([
-    ...Object.keys(state.layers),
-    ...layersWithRealRecords
-  ]);
-  for (const layer of allLayers) {
-    if (layersWithRealRecords.has(layer)) {
-      merged[layer] = "complete";
-    } else if (state.layers[layer]) {
-      merged[layer] = "asserted";
-    }
-  }
-  return merged;
-}
-
 // dist/install.js
 var ZONE_B_DIR = ".workbench";
 var __filename = fileURLToPath(import.meta.url);
@@ -3708,36 +4423,36 @@ var __dirname = dirname3(__filename);
 function findBundleRoot(startDir) {
   let candidate = startDir;
   for (let i = 0; i < 4; i++) {
-    const manifest = join5(candidate, ".claude-plugin", "plugin.json");
+    const manifest = join6(candidate, ".claude-plugin", "plugin.json");
     try {
-      if (existsSync3(manifest))
+      if (existsSync4(manifest))
         return candidate;
     } catch {
     }
     candidate = dirname3(candidate);
   }
-  return join5(startDir, "..");
+  return join6(startDir, "..");
 }
 var BUNDLE_ROOT = findBundleRoot(__dirname);
 function resolveVendoredBinary() {
   const candidates = [
-    join5(BUNDLE_ROOT, "bin", "bin.bundle.mjs"),
-    join5(BUNDLE_ROOT, "..", "runner", "dist", "bin.bundle.mjs")
+    join6(BUNDLE_ROOT, "bin", "bin.bundle.mjs"),
+    join6(BUNDLE_ROOT, "..", "runner", "dist", "bin.bundle.mjs")
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate))
+    if (existsSync4(candidate))
       return candidate;
   }
   throw new Error(`[halfcycle] Cannot find the self-contained guard binary bin.bundle.mjs. This copy of the halfcycle package is incomplete \u2014 reinstall it, or rebuild it if you are working on it. Looked in: ${candidates.join(", ")}.`);
 }
 function resolvePreFilterShell() {
   const candidates = [
-    join5(BUNDLE_ROOT, "bin", PRE_FILTER_SHELL_FILENAME),
-    join5(BUNDLE_ROOT, "..", "runner", "dist", PRE_FILTER_SHELL_FILENAME)
+    join6(BUNDLE_ROOT, "bin", PRE_FILTER_SHELL_FILENAME),
+    join6(BUNDLE_ROOT, "..", "runner", "dist", PRE_FILTER_SHELL_FILENAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync3(candidate))
-      return readFileSync4(candidate, "utf-8");
+    if (existsSync4(candidate))
+      return readFileSync5(candidate, "utf-8");
   }
   throw new Error(`[halfcycle] Cannot find ${PRE_FILTER_SHELL_FILENAME}. This copy of the halfcycle package is incomplete \u2014 reinstall it, or rebuild it if you are working on it. Looked in: ${candidates.join(", ")}.`);
 }
@@ -3766,7 +4481,7 @@ function isAllowlisted(targetRelPath) {
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
 function capturedIndexScaffold() {
-  return join5(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
+  return join6(BUNDLE_ROOT, "scaffolding", "test", "fixtures", "captured", "manifest.json");
 }
 var GITIGNORE_REL = ".gitignore";
 var GITATTRIBUTES_REL = ".gitattributes";
@@ -3804,7 +4519,7 @@ function closedWriteSet() {
   const merged = /* @__PURE__ */ new Set([SETTINGS_REL, MCP_REGISTRATION_REL, GITIGNORE_REL, GITATTRIBUTES_REL]);
   const dirs = /* @__PURE__ */ new Set();
   for (const path of [...files, ...merged]) {
-    for (let dir = posix.dirname(path); dir !== "."; dir = posix.dirname(dir))
+    for (let dir = posix2.dirname(path); dir !== "."; dir = posix2.dirname(dir))
       dirs.add(dir);
   }
   const ownedDirs = new Set([...dirs].filter((dir) => `${dir}/`.startsWith(INSTALLER_OWNED_DIR)));
@@ -3828,11 +4543,11 @@ function closedWriteSet() {
 function sha256OfWhatThisVersionWrites(commands) {
   const out = /* @__PURE__ */ new Map();
   const fromFile = (rel, src) => {
-    if (existsSync3(src))
-      out.set(rel, fileSha256(readFileSync4(src)));
+    if (existsSync4(src))
+      out.set(rel, fileSha256(readFileSync5(src)));
   };
   for (const cmd of commands)
-    fromFile(commandStubRel(cmd.name), join5(BUNDLE_ROOT, ".claude-plugin", cmd.path));
+    fromFile(commandStubRel(cmd.name), join6(BUNDLE_ROOT, ".claude-plugin", cmd.path));
   for (const [rel, content] of hookScriptsThisVersionWrites())
     out.set(rel, fileSha256(content));
   fromFile(CAPTURED_INDEX_REL, capturedIndexScaffold());
@@ -3845,17 +4560,17 @@ function bytesAreOurs(path, bytes, recorded, writeSet) {
 }
 function readPreviousManifest(targetRepo) {
   try {
-    return parseManifest(readFileSync4(join5(targetRepo, INSTALL_MANIFEST_REL), "utf-8"));
+    return parseManifest(readFileSync5(join6(targetRepo, INSTALL_MANIFEST_REL), "utf-8"));
   } catch {
     return null;
   }
 }
-function noteFile(draft, targetRepo, rel, outcome) {
+function noteFile(draft, rel, outcome, after) {
   if (outcome === "collided") {
     recordCollision(draft, rel);
     return;
   }
-  recordInstalledFile(draft, rel, readFileSync4(join5(targetRepo, rel)));
+  recordInstalledFile(draft, rel, after(rel));
 }
 function recordSettingsMerge(draft, existing, generated, preexisted, merged) {
   const generatedHooks = generated.hooks ?? {};
@@ -3944,11 +4659,11 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
   const collided = new Set(collidedPaths);
   const dirVerdicts = /* @__PURE__ */ new Map();
   const travelsThroughPlainDirs = (rel) => {
-    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir)) {
+    for (let dir = posix2.dirname(rel); dir !== "."; dir = posix2.dirname(dir)) {
       let plain = dirVerdicts.get(dir);
       if (plain === void 0) {
-        const abs = join5(targetRepo, dir);
-        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join5(abs, ".git")) === null;
+        const abs = join6(targetRepo, dir);
+        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join6(abs, ".git")) === null;
         dirVerdicts.set(dir, plain);
       }
       if (!plain)
@@ -3962,7 +4677,7 @@ function findNotShared(targetRepo, manifest, collidedPaths) {
       ...merged,
       INSTALL_MANIFEST_REL
     ])
-  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join5(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
+  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join6(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
   const ignored = readIgnoredPaths(targetRepo, paths);
   if (ignored === null)
     return null;
@@ -3985,7 +4700,7 @@ function lstatOrNull(path) {
 }
 function readFileOrNull(path) {
   try {
-    return readFileSync4(path, "utf-8");
+    return readFileSync5(path, "utf-8");
   } catch {
     return null;
   }
@@ -3994,28 +4709,33 @@ function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readPluginManifest() {
-  const manifestPath = join5(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
-  const raw = readFileSync4(manifestPath, "utf-8");
+  const manifestPath = join6(BUNDLE_ROOT, ".claude-plugin", "plugin.json");
+  const raw = readFileSync5(manifestPath, "utf-8");
   return JSON.parse(raw);
 }
-function copyManifestCommands(manifest, targetRepo, report, draft, writeSet) {
-  for (const cmd of manifest.commands ?? []) {
-    const srcFile = join5(BUNDLE_ROOT, ".claude-plugin", cmd.path);
-    if (!existsSync3(srcFile)) {
+function planManifestCommands(manifest, targetRepo, previous, writeSet) {
+  const recordedFiles = new Map((previous?.files ?? []).filter((file) => writeSet.files.has(file.path)).map((file) => [file.path, file]));
+  return (manifest.commands ?? []).map((cmd) => {
+    const srcFile = join6(BUNDLE_ROOT, ".claude-plugin", cmd.path);
+    if (!existsSync4(srcFile)) {
       throw new Error(`[halfcycle] plugin.json declares command "${cmd.name}" at "${cmd.path}", but no file exists there (${srcFile}). The manifest and commands/ must agree.`);
     }
     const rel = commandStubRel(cmd.name);
-    const destFile = join5(targetRepo, rel);
-    const content = readFileSync4(srcFile, "utf-8");
-    const recorded = draft.files.get(rel);
-    const { outcome, replacedExisting } = writeCollisionSafe(destFile, targetRepo, content, (current) => bytesAreOurs(rel, current, recorded, writeSet));
-    record(report, outcome, rel);
-    if (replacedExisting)
-      report.replacedPaths.push(rel);
-    if (outcome === "collided" && recorded !== void 0)
-      report.editedCollidedPaths.push(rel);
-    noteFile(draft, targetRepo, rel, outcome);
+    const content = readFileSync5(srcFile, "utf-8");
+    const recorded = recordedFiles.get(rel);
+    const planned = decideCollisionSafe(join6(targetRepo, rel), targetRepo, content, (current) => bytesAreOurs(rel, current, recorded, writeSet));
+    return { ...planned, editedCollided: planned.outcome === "collided" && recorded !== void 0 };
+  });
+}
+function putPlannedFile(targetRepoRoot, planned) {
+  if (planned.outcome !== "written")
+    return;
+  if (!isAllowlisted(planned.rel)) {
+    throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${planned.rel}". Only the method surface and scaffolding paths are writable.`);
   }
+  const target = join6(targetRepoRoot, planned.rel);
+  mkdirSync4(dirname3(target), { recursive: true });
+  writeFileSync4(target, planned.text, "utf-8");
 }
 function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
@@ -4028,76 +4748,58 @@ function writeAllowlisted(targetAbsPath, targetRepoRoot, content, writtenPaths)
   writeFileSync4(targetAbsPath, content, "utf-8");
   writtenPaths.push(rel);
 }
-function writeCollisionSafe(targetAbsPath, targetRepoRoot, content, isOurs) {
+function decideCollisionSafe(targetAbsPath, targetRepoRoot, content, isOurs) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
-  let replacedExisting = false;
-  const current = existsSync3(targetAbsPath) ? readFileSync4(targetAbsPath) : null;
+  const current = existsSync4(targetAbsPath) ? readFileSync5(targetAbsPath) : null;
   const text = inLineEndingOf(current?.toString("utf-8") ?? null, content);
-  if (current !== null) {
-    if (current.toString("utf-8") === text)
-      return { outcome: "skipped", replacedExisting: false };
-    if (!isOurs(current))
-      return { outcome: "collided", replacedExisting: false };
-    replacedExisting = true;
-  }
-  mkdirSync4(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync4(targetAbsPath, text, "utf-8");
-  return { outcome: "written", replacedExisting };
+  if (current === null)
+    return { rel, text, outcome: "written", replacedExisting: false };
+  if (current.toString("utf-8") === text)
+    return { rel, text, outcome: "skipped", replacedExisting: false };
+  if (!isOurs(current))
+    return { rel, text, outcome: "collided", replacedExisting: false };
+  return { rel, text, outcome: "written", replacedExisting: true };
 }
 var INSTALLER_OWNED_DIR = ".halfcycle/";
-function writeOwned(targetAbsPath, targetRepoRoot, content) {
+function decideOwned(targetAbsPath, targetRepoRoot, content) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
   if (!rel.startsWith(INSTALLER_OWNED_DIR)) {
-    throw new Error(`[halfcycle] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (writeOwnedGenerated) rather than assumed from where it sits.`);
+    throw new Error(`[halfcycle] Path-ownership violation: attempted to claim "${rel}" by path. Only ${INSTALLER_OWNED_DIR} is owned outright by this installer; everywhere else a differing file may be a developer's, so ownership must be proved from the file's own contents (decideOwnedGenerated) rather than assumed from where it sits.`);
   }
   const current = readFileOrNull(targetAbsPath);
   const text = inLineEndingOf(current, content);
   if (current === text)
-    return "skipped";
-  mkdirSync4(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync4(targetAbsPath, text, "utf-8");
-  return "written";
+    return { rel, text, outcome: "skipped", replacedExisting: false };
+  return { rel, text, outcome: "written", replacedExisting: existsSync4(targetAbsPath) };
 }
 var GENERATED_HEADER_LINE_INDEX = 1;
-function writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker) {
+function decideOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker) {
   const rel = relative(targetRepoRoot, targetAbsPath).replace(/\\/g, "/");
   if (!isAllowlisted(rel)) {
     throw new Error(`[halfcycle] Write-allowlist violation: attempted to write "${rel}". Only the method surface and scaffolding paths are writable.`);
   }
-  let replacedExisting = false;
-  if (existsSync3(targetAbsPath)) {
-    const current = readFileSync4(targetAbsPath, "utf-8");
-    if (current === content)
-      return { outcome: "skipped", replacedExisting: false };
-    const headerLine = current.split("\n")[GENERATED_HEADER_LINE_INDEX] ?? "";
-    if (!headerLine.startsWith(generatedMarker))
-      return { outcome: "collided", replacedExisting: false };
-    replacedExisting = true;
+  if (!existsSync4(targetAbsPath))
+    return { rel, text: content, outcome: "written", replacedExisting: false };
+  const current = readFileSync5(targetAbsPath, "utf-8");
+  if (current === content)
+    return { rel, text: content, outcome: "skipped", replacedExisting: false };
+  const headerLine = current.split("\n")[GENERATED_HEADER_LINE_INDEX] ?? "";
+  if (!headerLine.startsWith(generatedMarker)) {
+    return { rel, text: content, outcome: "collided", replacedExisting: false };
   }
-  mkdirSync4(dirname3(targetAbsPath), { recursive: true });
-  writeFileSync4(targetAbsPath, content, "utf-8");
-  return { outcome: "written", replacedExisting };
+  return { rel, text: content, outcome: "written", replacedExisting: true };
 }
-function recordOwnedGenerated(report, targetAbsPath, targetRepoRoot, content, generatedMarker, rel) {
-  const { outcome, replacedExisting } = writeOwnedGenerated(targetAbsPath, targetRepoRoot, content, generatedMarker);
-  record(report, outcome, rel);
-  if (replacedExisting)
-    report.replacedPaths.push(rel);
-  return outcome;
-}
-function recordOwned(report, targetAbsPath, targetRepoRoot, content, rel) {
-  const existedBefore = existsSync3(targetAbsPath);
-  const outcome = writeOwned(targetAbsPath, targetRepoRoot, content);
-  record(report, outcome, rel);
-  if (outcome === "written" && existedBefore)
-    report.replacedPaths.push(rel);
-  return outcome;
+function recordOwnedGenerated(report, planned) {
+  record(report, planned.outcome, planned.rel);
+  if (planned.replacedExisting)
+    report.replacedPaths.push(planned.rel);
+  return planned.outcome;
 }
 function record(report, outcome, rel) {
   const bucket = {
@@ -4114,8 +4816,8 @@ var DENY_PATTERNS = [
 ];
 var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
 function readExistingSettings(targetRepo) {
-  const settingsPath = join5(targetRepo, SETTINGS_REL);
-  return existsSync3(settingsPath) ? JSON.parse(readFileSync4(settingsPath, "utf-8")) : void 0;
+  const settingsPath = join6(targetRepo, SETTINGS_REL);
+  return existsSync4(settingsPath) ? JSON.parse(readFileSync5(settingsPath, "utf-8")) : void 0;
 }
 var SettingsParseRefused = class extends Error {
   constructor(message) {
@@ -4124,11 +4826,11 @@ var SettingsParseRefused = class extends Error {
   }
 };
 function settingsParseRefusal(targetRepo, err) {
-  const file = join5(targetRepo, SETTINGS_REL);
+  const file = join6(targetRepo, SETTINGS_REL);
   const offset = /position (\d+)/.exec(err instanceof Error ? err.message : "")?.[1];
   let where = "";
   if (offset !== void 0) {
-    const before = readFileSync4(file, "utf-8").slice(0, Number(offset)).split("\n");
+    const before = readFileSync5(file, "utf-8").slice(0, Number(offset)).split("\n");
     where = ` (line ${before.length}, column ${before[before.length - 1].length + 1})`;
   }
   return `${file} could not be read as JSON${where} \u2014 fix it and run "npx halfcycle" again.`;
@@ -4139,18 +4841,18 @@ var HALFCYCLE_STATUS_LINE = Object.freeze({
   command: 'bash "$CLAUDE_PROJECT_DIR"/.claude/hooks/guard-runner.sh statusline'
 });
 function statusLineSetElsewhere(targetRepo, home = homedir2(), env = process.env) {
-  const places = [join5(targetRepo, ".claude", "settings.local.json"), join5(home, ".claude", "settings.json")];
+  const places = [join6(targetRepo, ".claude", "settings.local.json"), join6(home, ".claude", "settings.json")];
   const configDir = env["CLAUDE_CONFIG_DIR"];
   if (configDir !== void 0 && configDir !== "") {
-    const expanded = configDir === "~" ? home : configDir.startsWith("~/") ? join5(home, configDir.slice(2)) : configDir;
-    places.push(join5(isAbsolute2(expanded) ? expanded : resolve(expanded), "settings.json"));
+    const expanded = configDir === "~" ? home : configDir.startsWith("~/") ? join6(home, configDir.slice(2)) : configDir;
+    places.push(join6(isAbsolute2(expanded) ? expanded : resolve(expanded), "settings.json"));
   }
   return places.some((path) => {
-    if (!existsSync3(path))
+    if (!existsSync4(path))
       return false;
     let value;
     try {
-      value = JSON.parse(readFileSync4(path, "utf-8"));
+      value = JSON.parse(readFileSync5(path, "utf-8"));
     } catch {
       return true;
     }
@@ -4387,6 +5089,10 @@ ${GENERATED_SESSION_END_HEADER} the Halfcycle installer.
 # written at session start. Deletion happens HERE and not at stop time: the stop
 # hook runs at the end of every turn, and deleting the marker there would throw
 # away the session's starting point for every later turn.
+#
+# Also removes the two small files this session may have left behind for its
+# checks to hand findings across turns, both named by this session's id alone,
+# with no fallback name to remove when there is none.
 INPUT="$(cat 2>/dev/null || true)"
 
 REPO_ROOT="\${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
@@ -4407,6 +5113,8 @@ rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}.eval" 2>/dev/null || true
 if [ -n "$SESSION_ID" ]; then
   rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.ref" 2>/dev/null || true
   rm -f "\${MARKER_DIR}/halfcycle-session-\${HASH}-\${SESSION_ID}.eval" 2>/dev/null || true
+  rm -f "\${MARKER_DIR}/halfcycle-findings-\${SESSION_ID}.json" 2>/dev/null || true
+  rm -f "\${MARKER_DIR}/halfcycle-own-\${SESSION_ID}.jsonl" 2>/dev/null || true
 fi
 exit 0
 `;
@@ -4466,19 +5174,20 @@ function generateUserPromptScopeHook() {
   return `#!/usr/bin/env bash
 ${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer, now also for the close review.
 #
-# Lets the owner of this project approve a phase's scope, or send it back, and
-# decide one part of a phase's close review, by typing one line as the whole
-# prompt in their own Claude Code session: "approve <phase>", "send back
-# <phase>: <note>", "accept <phase>/<part>", "question <phase>/<part>: <words>",
-# "carry <phase>/<part>: <words>" or "drop <phase>/<part>: <words>".
+# Lets the owner of this project approve a phase's scope, or send it back,
+# decide one part of a phase's close review, or turn builds running on their
+# own on or off, by typing one line as the whole prompt in their own Claude
+# Code session: "approve <phase>", "send back <phase>: <note>", "accept
+# <phase>/<part>", "question <phase>/<part>: <words>", "carry <phase>/<part>:
+# <words>", "drop <phase>/<part>: <words>", "autonomy on" or "autonomy off".
 #
 # AN ORDINARY PROMPT STARTS NOTHING. This script reads the hook input once and
 # looks only at the start of the prompt's value. Unless the prompt begins, after
 # any whitespace (typed, or escaped in the input), with "approve ", "send back ",
-# "accept ", "question ", "carry " or "drop ", in any case, it exits 0 with no
-# output, and Node never starts. A quote inside any other field arrives escaped,
-# so no other field (the folder the session is in, for one) can read as the
-# start of the prompt.
+# "accept ", "question ", "carry ", "drop " or "autonomy ", in any case, it exits
+# 0 with no output, and Node never starts. A quote inside any other field arrives
+# escaped, so no other field (the folder the session is in, for one) can read as
+# the start of the prompt.
 #
 # Otherwise it finds the project root from its own location, never from the
 # folder the session has moved to, and hands the same input to the guard
@@ -4499,7 +5208,7 @@ IFS= read -r -d '' HC_INPUT || true
 # \\u escape, or as the UTF-8 bytes of a Unicode space. Compared byte for byte.
 HC_LEAD='[[:space:]]|\\\\[nrtf]|\\\\u(000[9a-d]|0020|00a0|1680|200[0-9a]|202[89f]|205f|3000|feff)'
 HC_LEAD="$HC_LEAD|"$'\\xc2\\xa0|\\xe1\\x9a\\x80|\\xe2\\x80[\\x80-\\x8a\\xa8\\xa9\\xaf]|\\xe2\\x81\\x9f|\\xe3\\x80\\x80|\\xef\\xbb\\xbf'
-if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back|accept|question|carry|drop) "; then
+if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back|accept|question|carry|drop|autonomy) "; then
   exit 0
 fi
 
@@ -4512,6 +5221,52 @@ set +e
 exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-submit <<<"$HC_INPUT"
 `;
 }
+var GENERATED_USER_PROMPT_FINDINGS_HEADER = "# Findings hand-over \u2014 generated by";
+function generateUserPromptFindingsHook() {
+  return `#!/usr/bin/env bash
+${GENERATED_USER_PROMPT_FINDINGS_HEADER} the Halfcycle installer.
+#
+# At the person's next message, before the agent starts, hands it the details of
+# whatever Halfcycle's checks found at an earlier turn end, once.
+#
+# AN ORDINARY PROMPT STARTS NOTHING. With no findings file for this session, this
+# script reads its session id with a bash regex (no node) and exits 0 with no
+# output once it finds no file \u2014 node and grep never start.
+trap 'exit 0' ERR
+set -e
+
+HC_INPUT=""
+IFS= read -r -d '' HC_INPUT || true
+
+# The session id, read with a bash regex held in a variable (a quoted operand to
+# =~ is read as a literal string, not a pattern). An id holding anything outside
+# [A-Za-z0-9-] cannot close the match and leaves this empty, which is read below
+# exactly like no session id at all.
+HC_SESSION_RE='"session_id"[[:space:]]*:[[:space:]]*"([A-Za-z0-9-]+)"'
+HC_SESSION_ID=""
+if [[ "$HC_INPUT" =~ $HC_SESSION_RE ]]; then
+  HC_SESSION_ID="\${BASH_REMATCH[1]}"
+fi
+if [ -z "$HC_SESSION_ID" ]; then
+  exit 0
+fi
+
+HC_FINDINGS_DIR="\${TMPDIR:-/tmp}"
+HC_FINDINGS_DIR="\${HC_FINDINGS_DIR%/}"    # strip trailing slash (macOS TMPDIR ends in /)
+HC_FINDINGS_FILE="\${HC_FINDINGS_DIR}/halfcycle-findings-\${HC_SESSION_ID}.json"
+if [ ! -f "$HC_FINDINGS_FILE" ]; then
+  exit 0
+fi
+
+HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
+export CLAUDE_PROJECT_DIR="$HC_PROJECT_ROOT"
+
+trap - ERR
+set +e
+exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-findings <<<"$HC_INPUT"
+`;
+}
 var CI_STANZA_KNOWN_HEADER_HASHES = [
   "b225800b2d699811f32ac213238cbf81c35b5e6a74114bdf55e39cd9d7e2928f",
   "674181735460f051af7c157222cf851fc3000fb3b8af3a10ea0bde9fe5eaba1f",
@@ -4537,16 +5292,13 @@ function isTrackedAndClean(targetRepo, relPath) {
   }
   return true;
 }
-function removeLegacyCiStanza(targetRepo) {
-  return removeRetiredGeneratedFile(targetRepo, ".halfcycle/ci-stanza.yml", 0, CI_STANZA_KNOWN_HEADER_HASHES);
-}
-function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeaderHashes) {
-  const path = join5(targetRepo, rel);
-  if (!existsSync3(path))
+function decideRetiredRemoval(targetRepo, rel, headerLineIndex, knownHeaderHashes) {
+  const path = join6(targetRepo, rel);
+  if (!existsSync4(path))
     return "absent";
   let raw;
   try {
-    raw = readFileSync4(path, "utf-8");
+    raw = readFileSync5(path, "utf-8");
   } catch {
     return "failed";
   }
@@ -4556,13 +5308,20 @@ function removeRetiredGeneratedFile(targetRepo, rel, headerLineIndex, knownHeade
     return "kept-foreign";
   if (!isTrackedAndClean(targetRepo, rel))
     return "kept-uncommitted";
+  return "removed";
+}
+function removePlannedRetiredFile(targetRepo, rel) {
   try {
-    rmSync2(path);
+    rmSync2(join6(targetRepo, rel));
   } catch {
     return "failed";
   }
   return "removed";
 }
+var LEGACY_CI_STANZA_REL = ".halfcycle/ci-stanza.yml";
+function planLegacyCiStanzaRemoval(targetRepo) {
+  return decideRetiredRemoval(targetRepo, LEGACY_CI_STANZA_REL, 0, CI_STANZA_KNOWN_HEADER_HASHES);
+}
 var MCP_HEADERS_HELPER_COMMAND = `node -e "${nodeFloorProgram([
   `const p=require('path'),f=require('fs'),c=require('child_process');`,
   `let d=process.cwd();`,
@@ -4581,13 +5340,14 @@ var MCP_HEADERS_KNOWN_HEADER_HASHES = [
   "37a733ea588b3361b2bbfd86c44e0c95da30d7af6acffd1243ece83c811f0af2",
   "6732ec6d2d2bf7cb33017749a3d021b59af653dcd07c3811693b5a242d44b1a1"
 ];
-function removeRetiredMcpHeadersHelper(targetRepo) {
-  return removeRetiredGeneratedFile(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL, 1, MCP_HEADERS_KNOWN_HEADER_HASHES);
+function planMcpHeadersHelperRemoval(targetRepo) {
+  return decideRetiredRemoval(targetRepo, RETIRED_MCP_HEADERS_HELPER_REL, 1, MCP_HEADERS_KNOWN_HEADER_HASHES);
 }
 var OWNED_GENERATED_HEADERS = {
   ".claude/hooks/guard-runner.sh": GENERATED_GUARD_RUNNER_HEADER,
   ".claude/hooks/user-prompt-reminder.sh": GENERATED_USER_PROMPT_REMINDER_HEADER,
   ".claude/hooks/user-prompt-scope.sh": GENERATED_USER_PROMPT_SCOPE_HEADER,
+  ".claude/hooks/user-prompt-findings.sh": GENERATED_USER_PROMPT_FINDINGS_HEADER,
   ".claude/hooks/session-end-marker.sh": GENERATED_SESSION_END_HEADER,
   ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER
 };
@@ -4597,6 +5357,7 @@ function hookScriptsThisVersionWrites() {
     [".claude/hooks/session-end-marker.sh", generateSessionEndMarker()],
     [".claude/hooks/user-prompt-reminder.sh", generateUserPromptReminderHook()],
     [".claude/hooks/user-prompt-scope.sh", generateUserPromptScopeHook()],
+    [".claude/hooks/user-prompt-findings.sh", generateUserPromptFindingsHook()],
     [".claude/hooks/session-start-marker.sh", generateSessionStartMarker()]
   ];
 }
@@ -4650,23 +5411,26 @@ function gitignoreCovers(content) {
   const lines = new Set(content.split("\n").map((l) => l.trim()));
   return REQUIRED_GITIGNORE_ENTRIES.every((entry) => lines.has(entry));
 }
-function reconcileGitignore(targetRepo) {
-  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
+function planGitignore(targetRepo) {
+  const gitignorePath = join6(targetRepo, GITIGNORE_REL);
   const header = GITIGNORE_HEADER;
+  const before = existsSync4(gitignorePath) ? readFileSync5(gitignorePath, "utf-8") : null;
+  if (before === null) {
+    return { before, after: [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n", outcome: "written" };
+  }
+  if (gitignoreCovers(before))
+    return { before, after: before, outcome: "skipped" };
+  const existingLines = new Set(before.split("\n").map((l) => l.trim()));
+  const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
+  const eol = lineEndingOf(before);
+  const suffix = (before.endsWith("\n") ? "" : eol) + eol + [header, ...toAdd].join(eol) + eol;
+  return { before, after: before + suffix, outcome: "written" };
+}
+function putPlannedGitignore(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.after === null)
+    return planned.outcome;
   try {
-    if (!existsSync3(gitignorePath)) {
-      const body = [header, ...REQUIRED_GITIGNORE_ENTRIES].join("\n") + "\n";
-      writeFileSync4(gitignorePath, body, "utf-8");
-      return "written";
-    }
-    const existing = readFileSync4(gitignorePath, "utf-8");
-    if (gitignoreCovers(existing))
-      return "skipped";
-    const existingLines = new Set(existing.split("\n").map((l) => l.trim()));
-    const toAdd = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !existingLines.has(entry));
-    const eol = lineEndingOf(existing);
-    const suffix = (existing.endsWith("\n") ? "" : eol) + eol + [header, ...toAdd].join(eol) + eol;
-    writeFileSync4(gitignorePath, existing + suffix, "utf-8");
+    writeFileSync4(join6(targetRepo, GITIGNORE_REL), planned.after, "utf-8");
     return "written";
   } catch {
     return "failed";
@@ -4675,7 +5439,7 @@ function reconcileGitignore(targetRepo) {
 var GITATTRIBUTES_HEADER = "# Halfcycle \u2014 generated scripts keep LF line endings";
 function readTextOrNull(path) {
   try {
-    return readFileSync4(path, "utf-8");
+    return readFileSync5(path, "utf-8");
   } catch {
     return null;
   }
@@ -4684,26 +5448,31 @@ function lfRules(paths) {
   return [...paths].filter((path) => path.endsWith(".sh")).map((path) => `${path} text eol=lf`);
 }
 var REQUIRED_GITATTRIBUTES_RULES = lfRules(Object.keys(OWNED_GENERATED_HEADERS));
-function reconcileGitattributes(targetRepo) {
-  const path = join5(targetRepo, GITATTRIBUTES_REL);
+function planGitattributes(targetRepo) {
+  const path = join6(targetRepo, GITATTRIBUTES_REL);
   const rules = REQUIRED_GITATTRIBUTES_RULES;
-  const routed = [];
+  const before = readTextOrNull(path);
+  if (lstatOrNull(path)?.isSymbolicLink() === true)
+    return { before, after: before, outcome: "failed" };
+  if (!existsSync4(path)) {
+    return { before, after: [GITATTRIBUTES_HEADER, ...rules].join("\n") + "\n", outcome: "written" };
+  }
+  if (before === null)
+    return { before, after: null, outcome: "failed" };
+  const present = new Set(before.split("\n").map((l) => l.trim()));
+  const toAdd = rules.filter((rule) => !present.has(rule));
+  if (toAdd.length === 0)
+    return { before, after: before, outcome: "skipped" };
+  const eol = lineEndingOf(before);
+  const separator = before === "" ? "" : before.endsWith("\n") ? eol : eol + eol;
+  const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join(eol) + eol;
+  return { before, after: before + suffix, outcome: "written" };
+}
+function putPlannedGitattributes(targetRepo, planned) {
+  if (planned.outcome !== "written" || planned.after === null)
+    return planned.outcome;
   try {
-    if (lstatOrNull(path)?.isSymbolicLink() === true)
-      return "failed";
-    if (!existsSync3(path)) {
-      writeAllowlisted(path, targetRepo, [GITATTRIBUTES_HEADER, ...rules].join("\n") + "\n", routed);
-      return "written";
-    }
-    const existing = readFileSync4(path, "utf-8");
-    const present = new Set(existing.split("\n").map((l) => l.trim()));
-    const toAdd = rules.filter((rule) => !present.has(rule));
-    if (toAdd.length === 0)
-      return "skipped";
-    const eol = lineEndingOf(existing);
-    const separator = existing === "" ? "" : existing.endsWith("\n") ? eol : eol + eol;
-    const suffix = separator + [GITATTRIBUTES_HEADER, ...toAdd].join(eol) + eol;
-    writeAllowlisted(path, targetRepo, existing + suffix, routed);
+    writeAllowlisted(join6(targetRepo, GITATTRIBUTES_REL), targetRepo, planned.after, []);
     return "written";
   } catch {
     return "failed";
@@ -4722,7 +5491,7 @@ function previousPinForEngagement(targetRepoRoot, engagementId) {
 function nonEmpty(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
-function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, createdByAccountId, methodVersion, writtenPaths) {
+function planBundlePin(targetRepoRoot, version, engagementId, engagementType, createdByAccountId, methodVersion) {
   const previous = previousPinForEngagement(targetRepoRoot, engagementId);
   const carried = pinCreatedByAccountId(previous) ?? nonEmpty(createdByAccountId);
   const carriedMethodVersion = nonEmpty(methodVersion) ?? nonEmpty(previous?.methodVersion);
@@ -4737,9 +5506,39 @@ function writeBundlePin(targetRepoRoot, version, engagementId, engagementType, c
     ...carriedMethodVersion !== void 0 ? { methodVersion: carriedMethodVersion } : {},
     ...projectPage !== void 0 ? { projectPage } : {}
   };
-  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
-  const pinText = inLineEndingOf(readFileOrNull(pinPath), JSON.stringify(pin, null, 2) + "\n");
-  writeAllowlisted(pinPath, targetRepoRoot, pinText, writtenPaths);
+  const current = readFileOrNull(join6(targetRepoRoot, BUNDLE_PIN_REL));
+  const text = inLineEndingOf(current, JSON.stringify(pin, null, 2) + "\n");
+  return {
+    rel: BUNDLE_PIN_REL,
+    text,
+    outcome: current === text ? "skipped" : "written",
+    replacedExisting: current !== null && current !== text
+  };
+}
+function planBundlePinPreview(targetRepoRoot, version, home) {
+  let existing;
+  try {
+    existing = readBundlePin(targetRepoRoot);
+  } catch {
+    return null;
+  }
+  if (existing === null || nonEmpty(existing.engagementId) === void 0 || existing.engagementType === void 0) {
+    return null;
+  }
+  let pinned;
+  try {
+    pinned = readPinnedEngagement(targetRepoRoot, home);
+  } catch {
+    return null;
+  }
+  if (pinned === null || pinned.engagementId !== existing.engagementId || pinned.credential === void 0) {
+    return null;
+  }
+  return planBundlePin(targetRepoRoot, version, existing.engagementId, existing.engagementType, void 0, void 0);
+}
+function writeBundlePin(targetRepoRoot, planned, writtenPaths) {
+  const pinPath = join6(targetRepoRoot, BUNDLE_PIN_REL);
+  writeAllowlisted(pinPath, targetRepoRoot, planned.text, writtenPaths);
 }
 function renderCrewRoster() {
   const doc = {
@@ -4749,19 +5548,40 @@ function renderCrewRoster() {
   return `${JSON.stringify(doc, null, 2)}
 `;
 }
-function writeCrewRoster(targetRepoRoot, report) {
-  const rendered = renderCrewRoster();
-  const crewPath = join5(targetRepoRoot, CREW_ROSTER_REL);
-  return recordOwned(report, crewPath, targetRepoRoot, rendered, CREW_ROSTER_REL);
-}
 function pinCreatedByAccountId(pin) {
   return nonEmpty(pin?.createdByAccountId) ?? nonEmpty(pin?.accountId);
 }
 function readBundlePin(targetRepoRoot) {
-  const pinPath = join5(targetRepoRoot, BUNDLE_PIN_REL);
-  if (!existsSync3(pinPath))
+  const pinPath = join6(targetRepoRoot, BUNDLE_PIN_REL);
+  if (!existsSync4(pinPath))
+    return null;
+  return JSON.parse(readFileSync5(pinPath, "utf-8"));
+}
+function readPinnedEngagement(targetRepoRoot, home) {
+  const pin = readBundlePin(targetRepoRoot);
+  const engagementId = pin?.engagementId;
+  if (engagementId === void 0 || engagementId === "")
+    return null;
+  assertEngagementId(engagementId);
+  const stored = readEngagementEnv(engagementId, home);
+  const fromStore = stored === null ? void 0 : toCredential(stored);
+  if (fromStore !== void 0) {
+    return { engagementId, credential: fromStore, fromLegacyEnvLocal: false };
+  }
+  const legacy = readLegacyEnvLocal(targetRepoRoot);
+  const fromLegacy = legacy === null ? void 0 : toCredential(legacy);
+  return {
+    engagementId,
+    credential: fromLegacy,
+    fromLegacyEnvLocal: fromLegacy !== void 0
+  };
+}
+function readLegacyEnvLocal(targetRepoRoot) {
+  try {
+    return parseEnvText(readFileSync5(join6(targetRepoRoot, LEGACY_ENV_LOCAL_REL), "utf-8"));
+  } catch {
     return null;
-  return JSON.parse(readFileSync4(pinPath, "utf-8"));
+  }
 }
 var CREDENTIAL_REQUIRED_KEYS = [
   "HALFCYCLE_SERVICE_URL",
@@ -4774,6 +5594,18 @@ function missingRequiredKeys(found) {
   const resolved = { ...found, HALFCYCLE_SERVICE_URL: serviceUrl };
   return CREDENTIAL_REQUIRED_KEYS.filter((key) => (resolved[key] ?? "") === "");
 }
+function toCredential(found) {
+  if (missingRequiredKeys(found).length > 0)
+    return void 0;
+  const controlTelemetryUrl = found["CONTROL_TELEMETRY_URL"];
+  return {
+    serviceUrl: (process.env["HALFCYCLE_SERVICE_URL"]?.trim() ?? "") || (found["HALFCYCLE_SERVICE_URL"] ?? ""),
+    token: found["HALFCYCLE_TOKEN"] ?? "",
+    mcpUrl: found["HALFCYCLE_MCP_URL"] ?? "",
+    guardUrl: found["GUARD_SERVICE_URL"] ?? "",
+    ...controlTelemetryUrl ? { controlTelemetryUrl } : {}
+  };
+}
 function checkDrift(targetRepoRoot) {
   const manifest = readPluginManifest();
   const pin = readBundlePin(targetRepoRoot);
@@ -4781,15 +5613,32 @@ function checkDrift(targetRepoRoot) {
   const current = manifest.version;
   return { drifted: installed !== current, installed, current, methodVersion: pin?.methodVersion ?? null };
 }
-function writeProjectIdentity(targetRepo) {
-  if (existsSync3(join5(targetRepo, PROJECT_IDENTITY_REL))) {
-    repairRemoteCredential(targetRepo);
-    return "skipped";
+function writeProjectIdentity(targetRepo, planned, probe = false) {
+  if (planned.action === "add" || probe) {
+    createProjectIdentityFile(targetRepo, planned.after ?? void 0);
   }
-  createProjectIdentityFile(targetRepo);
-  return "written";
+  if (planned.action === "change" && planned.after !== null)
+    replaceProjectIdentityFile(targetRepo, planned.after);
+  return planned.action === "add" ? "written" : "skipped";
 }
 function writeEngagementCredential(credential, engagementId, home) {
+  return writeEngagementEnv(engagementId, engagementCredentialValues(credential, engagementId), home);
+}
+function planEngagementCredential(credential, engagementId, home) {
+  let existing;
+  try {
+    existing = readFileSync5(engagementEnvPath(engagementId, home), "utf-8");
+  } catch {
+    existing = null;
+  }
+  const reconciled = reconcileEnvText2(existing, engagementCredentialValues(credential, engagementId));
+  return {
+    outcome: existing === reconciled ? "skipped" : "written",
+    existed: existing !== null,
+    storedAfter: parseEnvText(reconciled)
+  };
+}
+function engagementCredentialValues(credential, engagementId) {
   const values = {
     HALFCYCLE_SERVICE_URL: credential.serviceUrl,
     // T-22 — the second origin, persisted for the developer and for any tool that
@@ -4817,16 +5666,16 @@ function writeEngagementCredential(credential, engagementId, home) {
     // telemetry origin, same as every other optional field on `DeviceCredential`.
     CONTROL_TELEMETRY_URL: credential.controlTelemetryUrl ?? ""
   };
-  return writeEngagementEnv(engagementId, values, home);
+  return values;
 }
 var LEGACY_ENV_LOCAL_REL = ".env.local";
 function migrateLegacyEnvLocal(targetRepo, stored) {
-  const path = join5(targetRepo, LEGACY_ENV_LOCAL_REL);
-  if (!existsSync3(path))
+  const path = join6(targetRepo, LEGACY_ENV_LOCAL_REL);
+  if (!existsSync4(path))
     return { outcome: "absent", unbacked: [], missingForAdoption: [] };
   let raw;
   try {
-    raw = readFileSync4(path, "utf-8");
+    raw = readFileSync5(path, "utf-8");
   } catch {
     return { outcome: "failed", unbacked: [], missingForAdoption: [] };
   }
@@ -4847,24 +5696,91 @@ function migrateLegacyEnvLocal(targetRepo, stored) {
     return !ours.has(line.slice(0, eq).replace(/^\s*export\s+/, "").trim());
   });
   const substantive = kept.filter((line) => line.trim() !== "" && !line.trim().startsWith("# Halfcycle"));
+  if (substantive.length === 0)
+    return { outcome: "removed", unbacked: [], missingForAdoption: [] };
+  return { outcome: "stripped", unbacked: [], missingForAdoption: [], keptText: kept.join("\n") };
+}
+function applyLegacyMigration(targetRepo, decided) {
+  const path = join6(targetRepo, LEGACY_ENV_LOCAL_REL);
   try {
-    if (substantive.length === 0) {
+    if (decided.outcome === "removed") {
       rmSync2(path);
-      return { outcome: "removed", unbacked: [], missingForAdoption: [] };
+      return decided;
+    }
+    if (decided.outcome === "stripped" && decided.keptText !== void 0) {
+      writeFileSync4(path, decided.keptText, "utf-8");
+      return decided;
     }
-    writeFileSync4(path, kept.join("\n"), "utf-8");
-    return { outcome: "stripped", unbacked: [], missingForAdoption: [] };
+    return decided;
   } catch {
     return { outcome: "failed", unbacked: [], missingForAdoption: [] };
   }
 }
 async function install(options) {
-  const { targetRepo, engagementId, engagementType, credential, home, createdByAccountId } = options;
-  assertEngagementId(engagementId);
-  if (!existsSync3(targetRepo)) {
-    throw new Error(`[halfcycle] Target repo does not exist: ${targetRepo}`);
-  }
+  return applyInstallPlan(planInstall(options));
+}
+function planCommandStubs(targetRepo, previous, writeSet) {
   const manifest = readPluginManifest();
+  return { version: manifest.version, commands: planManifestCommands(manifest, targetRepo, previous, writeSet) };
+}
+function planVendoredBinary(targetRepo) {
+  return decideOwned(join6(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs"), targetRepo, readFileSync5(resolveVendoredBinary(), "utf-8"));
+}
+function planSettings(targetRepo, previous, home, env) {
+  const settingsPath = join6(targetRepo, SETTINGS_REL);
+  const preexisted = existsSync4(settingsPath);
+  const generated = JSON.parse(generateSettingsJson());
+  let existing;
+  try {
+    existing = readExistingSettings(targetRepo) ?? {};
+  } catch (err) {
+    throw new SettingsParseRefused(settingsParseRefusal(targetRepo, err));
+  }
+  const retiredOurs = retiredRulesThisInstallAdded(previous);
+  const statusLine = statusLineSetElsewhere(targetRepo, home, env) ? void 0 : HALFCYCLE_STATUS_LINE;
+  const merged = mergeSettings(existing, generated, retiredOurs, statusLine);
+  const current = readFileOrNull(settingsPath);
+  const text = inLineEndingOf(current, JSON.stringify(merged, null, 2) + "\n");
+  const file = {
+    rel: SETTINGS_REL,
+    text,
+    // Identical bytes are not rewritten; the report still names the file as merged or
+    // written by whether it was there, as it always has.
+    outcome: current === text ? "skipped" : "written",
+    replacedExisting: false
+  };
+  return { file, preexisted, existing, generated, merged, retiredOurs };
+}
+function planHookScripts(targetRepo) {
+  return hookScriptsThisVersionWrites().map(([rel, content]) => decideOwnedGenerated(join6(targetRepo, rel), targetRepo, content, OWNED_GENERATED_HEADERS[rel]));
+}
+function planMcpRegistration(targetRepo, credential) {
+  const mcpPath = join6(targetRepo, MCP_REGISTRATION_REL);
+  const existing = existsSync4(mcpPath) ? readFileSync5(mcpPath, "utf-8") : null;
+  if (credential === void 0)
+    return { kind: "none", existing };
+  if (credential === "pending")
+    return { kind: "pending", existing };
+  const text = inLineEndingOf(existing, generateMcpRegistration(existing, credential.mcpUrl));
+  const outcome = existing === null ? "written" : existing !== text ? "merged" : "skipped";
+  return { kind: "write", existing, text, outcome };
+}
+function putPlannedMcp(targetRepo, planned) {
+  if (planned.kind !== "write" || planned.outcome === "skipped")
+    return;
+  writeAllowlisted(join6(targetRepo, MCP_REGISTRATION_REL), targetRepo, planned.text, []);
+}
+function planCrewRoster(targetRepo) {
+  return decideOwned(join6(targetRepo, CREW_ROSTER_REL), targetRepo, renderCrewRoster());
+}
+function planInstallRecord(targetRepo, text) {
+  return decideOwned(join6(targetRepo, INSTALL_MANIFEST_REL), targetRepo, text);
+}
+function accountInstall(steps, actual) {
+  const { targetRepo, writeSet, pin } = steps;
+  if (pin === null || steps.mcp.kind === "pending" || steps.engagementId === void 0) {
+    throw new Error("[halfcycle] a plan still waiting for the service cannot be applied or recorded.");
+  }
   const report = {
     writtenPaths: [],
     skippedPaths: [],
@@ -4873,38 +5789,22 @@ async function install(options) {
     editedCollidedPaths: [],
     replacedPaths: []
   };
-  const writeSet = closedWriteSet();
-  const draft = startManifest(readPreviousManifest(targetRepo), (path) => writeSet.files.has(path), (path) => writeSet.dirs.has(path));
-  const dirsBefore = new Set([...writeSet.dirs].filter((dir) => existsSync3(join5(targetRepo, dir))));
-  copyManifestCommands(manifest, targetRepo, report, draft, writeSet);
-  const vendoredBinSrc = resolveVendoredBinary();
-  const vendoredBinDest = join5(targetRepo, ".halfcycle", "bin", "bin.bundle.mjs");
-  const vendoredOutcome = recordOwned(report, vendoredBinDest, targetRepo, readFileSync4(vendoredBinSrc, "utf-8"), VENDORED_BIN_REL);
-  noteFile(draft, targetRepo, VENDORED_BIN_REL, vendoredOutcome);
-  const settingsPath = join5(targetRepo, SETTINGS_REL);
-  const settingsPreexisted = existsSync3(settingsPath);
-  const generatedSettings = JSON.parse(generateSettingsJson());
-  let existingSettings;
-  try {
-    existingSettings = readExistingSettings(targetRepo) ?? {};
-  } catch (err) {
-    throw new SettingsParseRefused(settingsParseRefusal(targetRepo, err));
-  }
-  const retiredOurs = retiredRulesThisInstallAdded(draft.previous);
-  const statusLine = statusLineSetElsewhere(targetRepo, home, options.env) ? void 0 : HALFCYCLE_STATUS_LINE;
-  const mergedSettings = mergeSettings(existingSettings, generatedSettings, retiredOurs, statusLine);
-  recordSettingsMerge(draft, existingSettings, generatedSettings, settingsPreexisted, mergedSettings);
-  recordDenyRetired(draft, retiredOurs.map((rule) => sha256Hex(rule)));
-  const mergedSettingsText = inLineEndingOf(readFileOrNull(settingsPath), JSON.stringify(mergedSettings, null, 2) + "\n");
-  mkdirSync4(dirname3(settingsPath), { recursive: true });
-  writeFileSync4(settingsPath, mergedSettingsText, "utf-8");
-  (settingsPreexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
-  for (const [rel, content] of hookScriptsThisVersionWrites()) {
-    const hookPath = join5(targetRepo, rel);
-    const outcome = recordOwnedGenerated(report, hookPath, targetRepo, content, OWNED_GENERATED_HEADERS[rel], rel);
-    noteFile(draft, targetRepo, rel, outcome);
-  }
-  switch (removeLegacyCiStanza(targetRepo)) {
+  const draft = startManifest(steps.previous, (path) => writeSet.files.has(path), (path) => writeSet.dirs.has(path));
+  for (const command of steps.commands) {
+    recordOwnedGenerated(report, command);
+    if (command.editedCollided)
+      report.editedCollidedPaths.push(command.rel);
+    noteFile(draft, command.rel, command.outcome, actual.bytesAfter);
+  }
+  noteFile(draft, VENDORED_BIN_REL, recordOwnedGenerated(report, steps.vendored), actual.bytesAfter);
+  const settings = steps.settings;
+  recordSettingsMerge(draft, settings.existing, settings.generated, settings.preexisted, settings.merged);
+  recordDenyRetired(draft, settings.retiredOurs.map((rule) => sha256Hex(rule)));
+  (settings.preexisted ? report.mergedPaths : report.writtenPaths).push(".claude/settings.json");
+  for (const hook of steps.hooks) {
+    noteFile(draft, hook.rel, recordOwnedGenerated(report, hook), actual.bytesAfter);
+  }
+  switch (actual.ciStanza) {
     case "removed":
       report.writtenPaths.push(".halfcycle/ci-stanza.yml (REMOVED \u2014 Halfcycle no longer generates this file)");
       break;
@@ -4920,20 +5820,17 @@ async function install(options) {
     case "absent":
       break;
   }
-  if (credential) {
-    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
-    const existingMcp = existsSync3(mcpPath) ? readFileSync4(mcpPath, "utf-8") : null;
-    const mcpContent = inLineEndingOf(existingMcp, generateMcpRegistration(existingMcp, credential.mcpUrl));
-    recordMcpMerge(draft, existingMcp, mcpContent);
-    if (existingMcp === null) {
-      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.writtenPaths);
-    } else if (existingMcp !== mcpContent) {
-      writeAllowlisted(mcpPath, targetRepo, mcpContent, report.mergedPaths);
-    } else {
+  const mcp = steps.mcp;
+  if (mcp.kind === "write") {
+    recordMcpMerge(draft, mcp.existing, mcp.text);
+    if (mcp.outcome === "written")
+      report.writtenPaths.push(MCP_REGISTRATION_REL);
+    else if (mcp.outcome === "merged")
+      report.mergedPaths.push(MCP_REGISTRATION_REL);
+    else
       report.skippedPaths.push(MCP_REGISTRATION_REL);
-    }
     const helperRel = RETIRED_MCP_HEADERS_HELPER_REL;
-    switch (removeRetiredMcpHeadersHelper(targetRepo)) {
+    switch (actual.mcpHelper) {
       case "removed":
         recordRemovedFile(draft, helperRel);
         report.writtenPaths.push(`${helperRel} (REMOVED \u2014 Halfcycle no longer uses this file)`);
@@ -4948,43 +5845,36 @@ async function install(options) {
         report.skippedPaths.push(`${helperRel} (could not be removed \u2014 Halfcycle no longer uses this file, DELETE IT BY HAND)`);
         break;
       case "absent":
+      case null:
         break;
     }
   } else {
     report.skippedPaths.push(`${MCP_REGISTRATION_REL} (no MCP origin \u2014 no credential supplied)`);
-    const mcpPath = join5(targetRepo, MCP_REGISTRATION_REL);
-    if (existsSync3(mcpPath))
-      recordMcpAdoptionOnly(draft, readFileSync4(mcpPath, "utf-8"));
+    if (mcp.existing !== null)
+      recordMcpAdoptionOnly(draft, mcp.existing);
   }
-  const gitignorePath = join5(targetRepo, GITIGNORE_REL);
-  const gitignoreBefore = existsSync3(gitignorePath) ? readFileSync4(gitignorePath, "utf-8") : null;
-  const gitignoreOutcome = reconcileGitignore(targetRepo);
-  recordGitignoreReconcile(draft, gitignoreBefore, existsSync3(gitignorePath) ? readFileSync4(gitignorePath, "utf-8") : null, writeSet);
-  if (gitignoreOutcome === "failed") {
+  recordGitignoreReconcile(draft, steps.gitignore.before, actual.gitignoreAfter, writeSet);
+  if (actual.gitignore === "failed") {
     report.skippedPaths.push(".gitignore (write failed \u2014 see credential refusal)");
   } else {
-    record(report, gitignoreOutcome, ".gitignore");
+    record(report, actual.gitignore, ".gitignore");
   }
-  const gitattributesPath = join5(targetRepo, GITATTRIBUTES_REL);
-  const gitattributesBefore = readTextOrNull(gitattributesPath);
-  const gitattributesOutcome = reconcileGitattributes(targetRepo);
-  recordGitattributesReconcile(draft, gitattributesBefore, readTextOrNull(gitattributesPath), writeSet);
-  if (gitattributesOutcome === "failed") {
+  recordGitattributesReconcile(draft, steps.gitattributes.before, actual.gitattributesAfter, writeSet);
+  if (actual.gitattributes === "failed") {
     report.skippedPaths.push(`${GITATTRIBUTES_REL} (write failed \u2014 a clone made with core.autocrlf=true may check the hook scripts out with CRLF line endings)`);
   } else {
-    record(report, gitattributesOutcome, GITATTRIBUTES_REL);
+    record(report, actual.gitattributes, GITATTRIBUTES_REL);
   }
-  const identityOutcome = writeProjectIdentity(targetRepo);
+  const identityOutcome = steps.identity.action === "add" ? "written" : "skipped";
   record(report, identityOutcome, PROJECT_IDENTITY_REL);
-  noteFile(draft, targetRepo, PROJECT_IDENTITY_REL, identityOutcome);
-  const credentialPath = engagementEnvPath(engagementId, home);
-  if (credential) {
-    record(report, writeEngagementCredential(credential, engagementId, home), credentialPath);
+  noteFile(draft, PROJECT_IDENTITY_REL, identityOutcome, actual.bytesAfter);
+  const credentialPath = engagementEnvPath(steps.engagementId, steps.home);
+  if (actual.credential !== null) {
+    record(report, actual.credential, credentialPath);
   } else {
     report.skippedPaths.push(`${credentialPath} (no credential supplied)`);
   }
-  const stored = readEngagementEnv(engagementId, home) ?? {};
-  const migration = migrateLegacyEnvLocal(targetRepo, stored);
+  const migration = actual.legacy;
   switch (migration.outcome) {
     case "removed":
       report.writtenPaths.push(".env.local (REMOVED \u2014 the credential now lives outside this repository)");
@@ -5001,32 +5891,22 @@ async function install(options) {
     case "absent":
       break;
   }
-  writeBundlePin(targetRepo, manifest.version, engagementId, engagementType, createdByAccountId, credential?.methodVersion, report.writtenPaths);
-  noteFile(draft, targetRepo, BUNDLE_PIN_REL, "written");
-  noteFile(draft, targetRepo, CREW_ROSTER_REL, writeCrewRoster(targetRepo, report));
-  const scanResult = runBootstrapScan(targetRepo);
-  if (existsSync3(join5(targetRepo, BOOTSTRAP_STATE_REL)))
+  if (pin.outcome === "written")
+    report.writtenPaths.push(BUNDLE_PIN_REL);
+  noteFile(draft, BUNDLE_PIN_REL, "written", actual.bytesAfter);
+  noteFile(draft, CREW_ROSTER_REL, recordOwnedGenerated(report, steps.crew), actual.bytesAfter);
+  if (actual.stateExistsAfter)
     recordPerMachineFile(draft, BOOTSTRAP_STATE_REL);
   for (const dir of writeSet.dirs) {
-    if (!dirsBefore.has(dir) && existsSync3(join5(targetRepo, dir)))
+    if (!steps.dirsBefore.has(dir) && actual.dirExistsAfter(dir))
       recordCreatedDir(draft, dir);
   }
   const installManifest = finishManifest(draft);
   assertManifestInWriteSet(installManifest, writeSet);
-  recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
-  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
-  return {
-    version: manifest.version,
-    writtenPaths: report.writtenPaths,
-    skippedPaths: report.skippedPaths,
-    mergedPaths: report.mergedPaths,
-    collidedPaths: report.collidedPaths,
-    editedCollidedPaths: report.editedCollidedPaths,
-    replacedPaths: report.replacedPaths,
-    bootstrapScanRan: scanResult.ran,
-    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
-    notShared
-  };
+  return { report, installManifest, manifestText: serializeManifest(installManifest) };
+}
+function recordInstallRecord(report, planned) {
+  recordOwnedGenerated(report, planned);
 }
 
 // dist/control-origin.js
@@ -5185,8 +6065,8 @@ async function requestEngagementValues(method, url, requestBody, credential, sha
 }
 
 // dist/setup/manifest.js
-import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join6, posix as posix2 } from "node:path";
+import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, join as join7, posix as posix3 } from "node:path";
 var DECLARED_ROOT_FILES = ["CLAUDE.md", "AGENTS.md", "ENGAGEMENT.md"];
 var DECLARED_DIR_PREFIX = "docs";
 var RESERVED_METHOD_PATH = "docs/method";
@@ -5197,7 +6077,7 @@ function normalise(path) {
   const slashed = path.replace(/\\/g, "/");
   if (slashed.trim() === "")
     return "";
-  return posix2.normalize(slashed).replace(/\/+$/, "");
+  return posix3.normalize(slashed).replace(/\/+$/, "");
 }
 function isUnder(candidate, prefix) {
   return candidate === prefix || candidate.startsWith(prefix + "/");
@@ -5271,7 +6151,7 @@ function firstSymlinkOnPath(targetRepo, path) {
   const segments = path.split("/").filter((s) => s.length > 0);
   let walked = targetRepo;
   for (let i = 0; i < segments.length; i++) {
-    walked = join6(walked, segments[i]);
+    walked = join7(walked, segments[i]);
     try {
       if (lstatSync2(walked).isSymbolicLink())
         return segments.slice(0, i + 1).join("/");
@@ -5289,12 +6169,12 @@ function symlinkEntry(path, link, isDirectoryRow) {
   };
 }
 function applyFileRow(targetRepo, path, content) {
-  const abs = join6(targetRepo, path);
+  const abs = join7(targetRepo, path);
   const link = firstSymlinkOnPath(targetRepo, path);
   if (link !== null)
     return symlinkEntry(path, link, false);
-  if (existsSync4(abs)) {
-    const current = readFileSync5(abs, "utf-8");
+  if (existsSync5(abs)) {
+    const current = readFileSync6(abs, "utf-8");
     return current === content ? { path, outcome: "already-present", note: "already present and correct \u2014 nothing written" } : { path, outcome: "left-alone", note: "you already own this file \u2014 left exactly as it was" };
   }
   mkdirSync5(dirname4(abs), { recursive: true });
@@ -5302,17 +6182,17 @@ function applyFileRow(targetRepo, path, content) {
   return { path, outcome: "created", note: "created" };
 }
 function applySectionRow(targetRepo, path, heading, body) {
-  const abs = join6(targetRepo, path);
+  const abs = join7(targetRepo, path);
   const link = firstSymlinkOnPath(targetRepo, path);
   if (link !== null)
     return symlinkEntry(path, link, false);
   const section = renderSection(heading, body);
-  if (!existsSync4(abs)) {
+  if (!existsSync5(abs)) {
     mkdirSync5(dirname4(abs), { recursive: true });
     writeFileSync5(abs, section, "utf-8");
     return { path, outcome: "created", note: `created, with a "${heading}" section` };
   }
-  const existing = readFileSync5(abs, "utf-8");
+  const existing = readFileSync6(abs, "utf-8");
   if (hasSection(existing, heading)) {
     return {
       path,
@@ -5329,11 +6209,11 @@ function applySectionRow(targetRepo, path, heading, body) {
   };
 }
 function applyDirectoryRow(targetRepo, path) {
-  const abs = join6(targetRepo, path);
+  const abs = join7(targetRepo, path);
   const link = firstSymlinkOnPath(targetRepo, path);
   if (link !== null)
     return symlinkEntry(path, link, true);
-  if (existsSync4(abs)) {
+  if (existsSync5(abs)) {
     const kind = statSync(abs).isDirectory() ? "directory" : "file";
     return kind === "directory" ? { path: `${path}/`, outcome: "already-present", note: "already there \u2014 nothing written" } : { path, outcome: "left-alone", note: "you already own this path \u2014 left exactly as it was" };
   }
@@ -5341,7 +6221,7 @@ function applyDirectoryRow(targetRepo, path) {
   return { path: `${path}/`, outcome: "created", note: "created" };
 }
 function applySetupWrites(targetRepo, rows) {
-  if (!existsSync4(targetRepo)) {
+  if (!existsSync5(targetRepo)) {
     throw new Error(`[halfcycle setup] The project directory does not exist: ${targetRepo}`);
   }
   assertNoConflictingDuplicates(rows);
@@ -5431,11 +6311,13 @@ var SetupManifest = class {
 // dist/setup/rows.js
 var FLAT_FILE_TRACKER_HOME = "docs/tasks";
 function contextIndexRow(heading, body) {
-  return { path: "CLAUDE.md", kind: "section", heading, body };
+  return { path: "AGENTS.md", kind: "section", heading, body };
 }
-function agentsPointerRow(content) {
-  return { path: "AGENTS.md", kind: "file", content };
+function agentsPointerRow() {
+  return { path: "CLAUDE.md", kind: "section", heading: AGENTS_POINTER_HEADING, body: AGENTS_POINTER_BODY };
 }
+var AGENTS_POINTER_HEADING = "Shared agent instructions";
+var AGENTS_POINTER_BODY = "@AGENTS.md";
 function layerDocumentRow(path, content) {
   return { path, kind: "file", content };
 }
@@ -5450,8 +6332,8 @@ function trackerHomeRow(home = FLAT_FILE_TRACKER_HOME) {
 }
 
 // dist/setup/discovery.js
-import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync, statSync as statSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync7, readdirSync, statSync as statSync2 } from "node:fs";
+import { join as join8 } from "node:path";
 function renderAnchor(anchor) {
   return anchor.kind === "file" ? `${anchor.path}:${anchor.line}` : `$ ${anchor.command}`;
 }
@@ -5475,8 +6357,8 @@ function lineOf(text, needle) {
   return null;
 }
 function readOrNull(repo, rel) {
-  const abs = join7(repo, rel);
-  return existsSync5(abs) && statSync2(abs).isFile() ? readFileSync6(abs, "utf-8") : null;
+  const abs = join8(repo, rel);
+  return existsSync6(abs) && statSync2(abs).isFile() ? readFileSync7(abs, "utf-8") : null;
 }
 function anchoredIn(repo, rel, needle, value) {
   const text = readOrNull(repo, rel);
@@ -5488,8 +6370,8 @@ function anchoredIn(repo, rel, needle, value) {
   return { value, anchor: { kind: "file", path: rel, line } };
 }
 function presenceAnchor(repo, rel) {
-  const abs = join7(repo, rel);
-  if (!existsSync5(abs))
+  const abs = join8(repo, rel);
+  if (!existsSync6(abs))
     return null;
   return statSync2(abs).isDirectory() ? { kind: "command", command: `ls -d ${rel}`, output: `${rel}/` } : { kind: "file", path: rel, line: 1 };
 }
@@ -5528,9 +6410,10 @@ function firstMatch(items, f) {
   }
   return null;
 }
+var CONTEXT_INDEX_FILES = ["AGENTS.md", "CLAUDE.md"];
 function ciWorkflows(repo) {
-  const dir = join7(repo, ".github", "workflows");
-  if (!existsSync5(dir) || !statSync2(dir).isDirectory())
+  const dir = join8(repo, ".github", "workflows");
+  if (!existsSync6(dir) || !statSync2(dir).isDirectory())
     return [];
   return readdirSync(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml")).sort();
 }
@@ -5538,21 +6421,21 @@ function existingLayerDocuments(repo) {
   const found = [];
   for (const paths of Object.values(LAYER_ARTEFACT_PATHS)) {
     for (const p of paths ?? []) {
-      if (existsSync5(join7(repo, p)))
+      if (existsSync6(join8(repo, p)))
         found.push(p);
     }
   }
   return found.sort();
 }
 function discoverRepository(targetRepo) {
-  if (!existsSync5(targetRepo)) {
+  if (!existsSync6(targetRepo)) {
     throw new Error(`[halfcycle setup] The project directory does not exist: ${targetRepo}`);
   }
   const findings = [];
   const questions = [];
   settleOrAsk("project-language", firstMatch(MANIFESTS, ([file, needle, language]) => anchoredIn(targetRepo, file, needle, language)), "What is this project written in?", findings, questions);
   settleOrAsk("package-manager", firstMatch(LOCKFILES, ([file, manager]) => anchoredByPresence(targetRepo, file, manager)), "Which package manager does this project use?", findings, questions);
-  settleOrAsk("repo-structure", firstMatch(WORKSPACE_MARKERS, ([file, needle, shape]) => anchoredIn(targetRepo, file, needle, shape)) ?? (existsSync5(join7(targetRepo, "package.json")) || existsSync5(join7(targetRepo, "go.mod")) || existsSync5(join7(targetRepo, "pyproject.toml")) ? anchoredByPresence(targetRepo, "package.json", "a single-package repository") ?? anchoredByPresence(targetRepo, "go.mod", "a single-package repository") ?? anchoredByPresence(targetRepo, "pyproject.toml", "a single-package repository") : null), "Is this one repository for one product, or one of several?", findings, questions);
+  settleOrAsk("repo-structure", firstMatch(WORKSPACE_MARKERS, ([file, needle, shape]) => anchoredIn(targetRepo, file, needle, shape)) ?? (existsSync6(join8(targetRepo, "package.json")) || existsSync6(join8(targetRepo, "go.mod")) || existsSync6(join8(targetRepo, "pyproject.toml")) ? anchoredByPresence(targetRepo, "package.json", "a single-package repository") ?? anchoredByPresence(targetRepo, "go.mod", "a single-package repository") ?? anchoredByPresence(targetRepo, "pyproject.toml", "a single-package repository") : null), "Is this one repository for one product, or one of several?", findings, questions);
   const workflows = ciWorkflows(targetRepo);
   settleOrAsk("ci-strategy", workflows.length > 0 ? {
     value: `GitHub Actions \u2014 ${workflows.length === 1 ? "one workflow" : `${workflows.length} workflows`}: ${workflows.join(", ")}`,
@@ -5560,7 +6443,7 @@ function discoverRepository(targetRepo) {
   } : null, "How does this project run CI?", findings, questions);
   const layerDocs = existingLayerDocuments(targetRepo);
   settleOrAsk("existing-layer-documents", layerDocs.length > 0 ? anchoredByPresence(targetRepo, layerDocs[0], `already written: ${layerDocs.join(", ")}`) : null, "Which of the project documents already exist?", findings, questions);
-  settleOrAsk("context-index", anchoredByPresence(targetRepo, "CLAUDE.md", "a context index is already in place"), "Where should the project context index live?", findings, questions);
+  settleOrAsk("context-index", firstMatch(CONTEXT_INDEX_FILES, (rel) => anchoredByPresence(targetRepo, rel, "a context index is already in place")), "Where should the project context index live?", findings, questions);
   settleOrAsk("tracker", anchoredByPresence(targetRepo, "docs/tasks", "a flat-file task directory is already in place") ?? anchoredByPresence(targetRepo, ".github/ISSUE_TEMPLATE", "GitHub Issues is already in use"), "Where should tasks live?", findings, questions);
   settleOrAsk("push-policy", null, "How does work reach the default branch?", findings, questions);
   settleOrAsk("branch-policy", null, "How are branches organised for a piece of work?", findings, questions);
@@ -6023,10 +6906,14 @@ function renderClose(heading, observed, attested, checks, p, closingRound = fals
   ];
 }
 var REVIEW_LABEL = "**Recorded by Halfcycle from the owner's review.** Each part the review held, and how the project's owner decided it. A line marked as the agent's is the agent's own answer, not Halfcycle's.";
+var REVIEW_LABEL_WITH_AUTONOMY = `**Recorded by Halfcycle from the owner's review.** Each part the review held, and how it was decided: by the project's owner, unless the part says it was ${DECIDED_BY_AUTONOMY_SENTENCE}. A line marked as the agent's is the agent's own answer, not Halfcycle's.`;
 var REVIEW_NO_PARTS = "The review had no parts, so it closed on one accept that names no part.";
 function approvalLine(approval) {
   if (approval.kind === "none")
     return "Built without an approved scope.";
+  if (approval.givenIn === "autonomy") {
+    return `Plan version ${String(approval.planVersion)} was ${APPROVED_IN_ADVANCE_SENTENCE}.`;
+  }
   const where = approval.givenIn === "console" ? "in the console" : "in their own session";
   return `Scope approved by the project's owner, plan version ${String(approval.planVersion)}, ${where}.`;
 }
@@ -6040,8 +6927,11 @@ function decisionText(part, p) {
       return `Dropped: ${p.text(part.reason ?? "")}`;
   }
 }
+var DECIDED_BY_AUTONOMY_LINE = `${DECIDED_BY_AUTONOMY_SENTENCE.charAt(0).toUpperCase()}${DECIDED_BY_AUTONOMY_SENTENCE.slice(1)}.`;
 function reviewPartLines(part, p) {
   const lines = [`- ${p.itemStart(part.name)} \u2014 ${decisionText(part, p)}`];
+  if (part.givenIn === "autonomy")
+    lines.push(`  - ${DECIDED_BY_AUTONOMY_LINE}`);
   const code = codeLinkLine(part.codeLink);
   if (code !== void 0)
     lines.push(`  - ${p.text(code)}`);
@@ -6061,7 +6951,8 @@ function removalsLine(record2, p) {
 }
 function renderReview(record2, p) {
   const review = record2.review;
-  const blocks = ["## The owner's review", REVIEW_LABEL, approvalLine(review.approval)];
+  const label = review.parts.some((part) => part.givenIn === "autonomy") ? REVIEW_LABEL_WITH_AUTONOMY : REVIEW_LABEL;
+  const blocks = ["## The owner's review", label, approvalLine(review.approval)];
   blocks.push(review.parts.length === 0 ? REVIEW_NO_PARTS : review.parts.flatMap((part) => reviewPartLines(part, p)).join("\n"));
   const removals = removalsLine(record2, p);
   if (removals !== null)
@@ -6073,10 +6964,9 @@ function renderCalls(calls, p) {
     return [`## ${CALLS_HEADING}`, NO_CALLS_LINE];
   const lines = calls.flatMap((c) => {
     const by = p.itemStart(c.by);
-    return [
-      `- ${callMadeLine({ by, question: p.text(c.question), chose: p.text(c.chose), statedDefault: p.text(c.statedDefault) })}`,
-      `  - ${callUndoLine({ by: p.text(c.by), undoable: c.undoable, how: c.how === null ? null : p.text(c.how) })}`
-    ];
+    const undo = `  - ${callUndoLine({ by: p.text(c.by), undoable: c.undoable, how: c.how === null ? null : p.text(c.how) })}`;
+    const head = c.kind === "listed" ? autonomyC8(by, p.text(c.question), p.text(c.chose)) : callMadeLine({ by, question: p.text(c.question), chose: p.text(c.chose), statedDefault: p.text(c.statedDefault) });
+    return [`- ${head}`, undo];
   });
   return [`## ${CALLS_HEADING}`, CALLS_EXPLAINED, lines.join("\n")];
 }
@@ -6176,11 +7066,11 @@ function renderBuildRecordV2Markdown(record2) {
 }
 
 // dist/build-record/write.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, rmSync as rmSync4 } from "node:fs";
-import { basename, join as join8, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute3 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, rmSync as rmSync4 } from "node:fs";
+import { basename, join as join9, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute3 } from "node:path";
 
 // dist/build-record/pair-io.js
-import { closeSync, openSync, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync3, writeSync } from "node:fs";
+import { closeSync, openSync, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync3, writeSync } from "node:fs";
 function createExclusiveOnDisk(path, data) {
   const bytes = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
   const fd = openSync(path, "wx");
@@ -6211,7 +7101,7 @@ function isEexist(err) {
 }
 function readIfPresent(path) {
   try {
-    return readFileSync7(path, "utf-8");
+    return readFileSync8(path, "utf-8");
   } catch {
     return null;
   }
@@ -6243,7 +7133,7 @@ function replaceOne(io, tmp, finalPath, text) {
 }
 
 // dist/build-record/write.js
-var BUILD_RECORD_DIR = join8("docs", "build-records");
+var BUILD_RECORD_DIR = join9("docs", "build-records");
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve2(candidate));
   const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute3(rel) && rel === basename(rel);
@@ -6281,8 +7171,8 @@ function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_P
   }
   const outDir = resolve2(repoRoot, BUILD_RECORD_DIR);
   const segment = renderPhaseSegment(phase);
-  const jsonPath = join8(outDir, `${segment}.json`);
-  const mdPath = join8(outDir, `${segment}.md`);
+  const jsonPath = join9(outDir, `${segment}.json`);
+  const mdPath = join9(outDir, `${segment}.md`);
   const jsonTmp = `${jsonPath}.tmp`;
   const mdTmp = `${mdPath}.tmp`;
   for (const candidate of [jsonPath, mdPath, jsonTmp, mdTmp]) {
@@ -6296,7 +7186,7 @@ function writeRecordPair(repoRoot, phase, rawRecord, record2, io = NODE_RECORD_P
   }
   const existingJson = readIfPresent(jsonPath);
   if (existingJson === null) {
-    return { kind: "in-the-way", path: existsSync6(jsonPath) ? jsonPath : mdPath };
+    return { kind: "in-the-way", path: existsSync7(jsonPath) ? jsonPath : mdPath };
   }
   if (existingJson === jsonText) {
     replaceOne(io, mdTmp, mdPath, mdText);