diff --git a/BUILD-LOG.md b/BUILD-LOG.md
index 70cbe5b5..5f16fc47 100644
--- a/BUILD-LOG.md
+++ b/BUILD-LOG.md
@@ -362,3 +362,42 @@ Session forking verified. `main` merged with M11, tagged `session-fork-v1`; rele
 Interactive TUI agent launched and verified; TOOLS.md reference shipped. `main` merged with M13, tagged `interactive-agent-v1`; release 0.0.8 active.
 
 
+
+---
+
+## Phase 16: Run-record retention (M10) — recorded retroactively
+
+- Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled entry; the original phase entry was lost to editor races - see correction note below)
+- Summary: `mosaic-task.mjs prune [--keep=N] [--yes]` - keep newest N run records, dry-run by default, append-only `.pruned.log` receipt, sessions/workspaces/state untouched. 8 suite cases.
+- Observed: dry-run deletes nothing; keep-N honored; newest kept; receipt written; isolation asserted.
+- Correction (recorded): suite-hardening edits (prune section config scoping, duplicate helper removal) were applied in the same phase.
+
+## Phase 17: Conductor auto-apply policy (M12) — recorded retroactively
+
+- Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
+- Summary: `conductor-policy.json` (tracked, strictly validated: enabled switch, path allowlist, gating suites) + `scripts/conductor-apply.sh <runId>` - succeeded-run check, clean target tree, allowlist, syntax gates, apply, suites, attribution commit; any failure reverts; push never automatic. 17 sandbox suite cases.
+- Observed: all gates green; suite-failure auto-revert verified; disabled policy refuses with exit 2.
+- Decision recorded: review moves to after-the-fact (history revertible) for worker patches under the policy; push remains explicit.
+
+## Phase 18: Live user context (M14) — recorded retroactively
+
+- Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
+- Summary: USER.md removed from immutable contracts (wrong owner - user info is user-owned live context); `<dataRoot>/user/*.md` dispatched (sorted) into every agent launch's generated prompt; bootstrap seeds `user/USER.md` once; loader layers now governance -> persona -> identity -> mission -> user.
+- Observed: user edit propagates to next launch (TUI or headless) without rebuilds; contract-only prompts unchanged when no user dir present.
+- Correction (recorded): first implementation pass did not regenerate the container - caught by owner test (edits to repo/mirror copies of USER.md did not propagate; the design, not the test, was the defect).
+
+## Phase 19: Agent seats + roles/ convention (M15) — recorded retroactively
+
+- Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
+- Summary: `agents/<name>/` holds `agent.json` (strict validation: version, name, role?, capabilities?, workspace?, session?) + `SOUL.md` persona; `agent.sh` validates, copies runtime SOUL to `dataRoot/agents/<name>/`, sets `MOSAIC_AGENT_SOUL_FILE`; loader fills the SOUL slot from the seat persona (contract SOUL = default); identity section gains role; per-agent default workspace; compose passthroughs.
+- Observed: launch with seat definition replaces the contract persona in the generated prompt; role in identity; seat record written once; suites green; RELEASE 0.0.10 packaged, health-gated activated.
+- Correction (recorded): RELEASE was not bumped when container content changed - tag r0.0.9 rebuilt with different content (invariant lapse; r0.0.9 was never active). Restored: RELEASE 0.0.10 packaged beside, health-gated, activated.
+- Conventions recorded per owner direction: repository root holds bootstrap-required configuration only; role contracts live in `roles/`.
+
+## Backfill note
+
+Phases 16-19 were recorded retroactively on 2026-09-03 after editor-session races
+left them unwritten at the time of work. Ground truth for each entry: the git
+history (commit subjects/bodies), the Gitea milestone/issue records (#32, #34,
+#35, #36), and the suite files themselves. No facts were reconstructed from
+memory alone.