out/_snap/

Hashes of out/ under a name: what existed when.

What it holds

Files NN-<label>.sha256, each a header line and one line per file in out/ with its sha256, size, the snap time and its path. Labels seen in the sources: <leg>-<UTC stamp> or cut-<cut>-<leg>-<stamp> at every close, and move-<move>-<n> for a move.

Who writes it, and when

close.sh takes one at every close with the trusted snap.py. The analyst takes one for each categorization move (snap.py NN move-<move>-<n>); contract rule 18: snaps are write-once, and nobody deletes one.

Why it exists

A move snap lets "a reviewer find the state before and after" (STANDING §2); E1 checks every move snap from C2 to D3 against history.jsonl. The analyst may read _snap/ at any time (STANDING §2: "read them when you like"); it holds hashes only, so protocol_guard.py closes only _probe and _transcripts before E1.

Where

out/_snap/.

Checked against: tools/snap.py, harness/close.sh, harness/protocol_guard.py, CLAUDE.md, STANDING-INSTRUCTIONS.md §2, CONTRACT-aggregator.md rule 18, stages/STAGE-E1-formalizing-audit.md.