@zalom/plastic 1.0.0-beta.2 → 1.0.0-beta.21

package/scripts/insight-append

@@ -0,0 +1,51 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# insight-append - the blessed write path for an intent's `## Insights` section
+# (intent 82). A thin CLI wrapper over Insights.append_insight: it formats the
+# `{utc-iso8601} · {stage} · {author}` prefix, validates it, and appends one
+# entry at the bottom of the section (creating the section or file if absent).
+#
+# Sibling to scripts/spawn-preamble and scripts/agent-report. The library's
+# `now:` seam is the test seam; the CLI uses the default Time.now, which is fine
+# because determinism is covered at the library level (test/insights_test.rb).
+#
+# Usage:
+#   insight-append <intent_dir> <text> --stage S --author A
+#
+# Exit codes: 0 (entry appended), 2 (usage).
+
+require_relative "lib/insights"
+
+def parse_args(argv)
+  stage = nil
+  author = nil
+  positional = []
+  i = 0
+  while i < argv.length
+    case argv[i]
+    when "--stage"
+      stage = argv[i + 1]
+      i += 2
+    when "--author"
+      author = argv[i + 1]
+      i += 2
+    else
+      positional << argv[i]
+      i += 1
+    end
+  end
+  [positional[0], positional[1], stage, author]
+end
+
+intent_dir, text, stage, author = parse_args(ARGV)
+
+if [intent_dir, text, stage, author].any? { |v| v.nil? || v.to_s.empty? }
+  warn "usage: insight-append <intent_dir> <text> --stage S --author A"
+  exit 2
+end
+
+entry = Insights.append_insight(File.expand_path(intent_dir), text,
+                                stage: stage, author: author)
+puts "appended: #{entry}"

package/scripts/lib/bridge.rb

@@ -6,6 +6,8 @@ require "yaml"
 require "fileutils"
 require "tempfile"
 require "digest"
+require "socket"
+require_relative "worktree"
 
 module Bridge
   STAGES = %w[what why how exec done].freeze
@@ -18,13 +20,15 @@ module Bridge
   # (<id>--<slug>.md) is never sentineled; it is born complete.
   PLACEHOLDER_SENTINEL = "<!-- plastic:placeholder -->"
 
-  # Stale-bridge purge window (intent 67). The bridge file is ephemeral
-  # live-session gate state, NOT a continuation source: an intent is resumed from
-  # its savepoint.md ledger, never from a /tmp bridge. So any bridge older than
-  # this window is dead weight and safe to purge, regardless of arm state. No
-  # real session stays live for two days, so a 48h cutoff never removes a bridge
-  # an active run depends on.
-  PURGE_AGE_SECONDS = 48 * 3600   # 48 hours
+  # Bridge cleanup is terminal-state, not age-based (intent 80). A bridge is dead
+  # weight ONLY once its intent is terminal (no longer in its store's INDEX.md
+  # `## Active` block); such bridges are purged. An Active intent's bridge is kept
+  # unconditionally, because while the intent is live the bridge is still load-
+  # bearing: it is the continuation signal (a parked or interrupted run resumes
+  # from it) and the anti-collision lock (it keys the per-session statusline so
+  # parallel sessions do not overwrite each other). An age window was the wrong
+  # axis: it left dead bridges resident for ~2 days AND could reap bridges of
+  # interrupted-but-still-active intents, which are exactly the ones to preserve.
 
   def self.intent_file(intent_dir)
     dir_name = File.basename(intent_dir)
@@ -57,12 +61,19 @@ module Bridge
     "auto-" + Digest::SHA256.hexdigest("#{store}/#{intent_id}")[0, 10]
   end
 
-  # Resolve a bridge session: first non-empty of explicit, CLAUDE_SESSION_ID,
-  # then a derived key. Never returns nil/empty. Whitespace-only counts as empty.
+  # Resolve a bridge session: first non-empty of explicit (the stdin session_id),
+  # CLAUDE_CODE_SESSION_ID, then a derived key. Never returns nil/empty.
+  # Whitespace-only counts as empty.
+  #
+  # The CLAUDE_CODE_SESSION_ID fallback (intent 79) carries the bg/headless real
+  # session id (Claude Code passes session_id on stdin, not via an env var; the
+  # headless id lives in CLAUDE_CODE_SESSION_ID). Keying by the real id (instead of
+  # a derived hash) lets the statusline, which receives that same id on stdin, find
+  # the bridge by direct filename lookup.
   def self.resolve_session(explicit, intent_id:, store:)
     return explicit.to_s.strip unless blank?(explicit)
-    env = ENV["CLAUDE_SESSION_ID"]
-    return env.to_s.strip unless blank?(env)
+    code_env = ENV["CLAUDE_CODE_SESSION_ID"]
+    return code_env.to_s.strip unless blank?(code_env)
     derive_key(store, intent_id)
   end
 
@@ -103,6 +114,22 @@ module Bridge
     end
     return nil if parsed.empty?
 
+    has_session = !blank?(session)
+
+    # Strict per-session ownership (intent 90): when the caller HAS a session, a foreign
+    # session's bridge is NEVER a valid resolution. Own-session and the derived-key case both
+    # reduce to candidate["session"] == session (the derived key IS the session that armed the
+    # bridge). A caller that owns no bridge resolves to nil, so its gates fail open instead of
+    # inheriting another session's armed intent.
+    #
+    # When the caller has NO session (truly headless, intent 52), keep the legacy degraded
+    # selection below so a single armed derived-key bridge is still discoverable - the hook
+    # cannot know the session there, and a lone armed intent must still gate.
+    if has_session
+      parsed = parsed.select { |c| c[:data]["session"].to_s == session.to_s }
+      return nil if parsed.empty?
+    end
+
     auto = parsed.select { |c| c[:data].dig("build", "auto") == true }
     pool = auto.empty? ? parsed : auto
 
@@ -116,31 +143,71 @@ module Bridge
           cwd_abs.start_with?("#{store_abs}/") ||
           store_abs.start_with?("#{cwd_abs}/")
       end
-      pool = matching unless matching.empty?
+      # Hard cwd filter when the caller has a session (intent 90): a non-matching store
+      # excludes the candidate outright. Without a session, keep the best-effort revert
+      # (intent 52) so a lone armed bridge is still found when cwd does not overlap its store.
+      pool = has_session ? matching : (matching.empty? ? pool : matching)
     end
 
     pool.max_by { |c| c[:mtime] }&.fetch(:data)
   end
 
-  # --- Stale-bridge purge (intent 67) ---------------------------------------
-  #
-  # Remove stale tmp/plastic-*.json bridge files so discover_bridge's per-fire
-  # scan stays bounded. Best-effort and non-raising: returns the array of removed
-  # paths. Continuation does not depend on these files (an intent resumes from its
-  # savepoint.md ledger), so the only safety rule is age: a bridge older than
-  # max_age_seconds is purged regardless of arm state, while anything newer is kept
-  # (it may be a live run). The current session's own bridge is never purged
+  # --- Terminal-state bridge purge (intent 80) -------------------------------
+
+  # True iff the intent is Active in its store's INDEX.md. An INDEX.md lives at
+  # the PARENT of the store/ dir the bridge records, so we resolve it from the
+  # bridge's intent.store. Non-raising: any failure (missing/unreadable INDEX,
+  # bad arg) returns false, which means "not active" so the caller treats the
+  # bridge as purgeable. `index_active_ids` is a pure-data test seam: when an
+  # Array of id strings is supplied, membership is checked against it directly
+  # with no file read.
+  def self.intent_active?(intent_id, store:, index_active_ids: nil)
+    target = intent_id.to_s
+    return index_active_ids.include?(target) if index_active_ids.is_a?(Array)
+
+    index = File.join(File.dirname(store.to_s), "INDEX.md")
+    return false unless File.exist?(index)
+
+    in_active = false
+    File.foreach(index) do |line|
+      stripped = line.chomp
+      if stripped == "## Active"
+        in_active = true
+        next
+      end
+      next unless in_active
+      break if stripped.start_with?("## ") # next section ends the Active block
+      m = stripped.match(/^- \[(\S+) +—/)
+      return true if m && m[1] == target
+    end
+    false
+  rescue StandardError
+    false
+  end
+
+  # Remove tmp/plastic-*.json bridge files whose intent is terminal, so
+  # discover_bridge's per-fire scan stays bounded. Best-effort and non-raising:
+  # returns the array of removed paths. A bridge is purged when it cannot be
+  # parsed, has no intent.id, has no intent.store, or its intent is not Active in
+  # its store's INDEX.md. An Active intent's bridge is kept (continuation signal +
+  # anti-collision lock), and the current session's own bridge is never purged
   # (preserves the disarm_auto contract that it stays readable). Wired into
   # arm_auto and disarm_auto so both manual and auto delivery keep the temp dir
-  # clean.
-  def self.purge_stale_bridges(session:, now: Time.now, max_age_seconds: PURGE_AGE_SECONDS,
-                               tmp: tmp_dir)
+  # clean at deterministic work boundaries.
+  def self.purge_done_bridges(session:, tmp: tmp_dir)
     current = path(session, tmp: tmp)
     removed = []
     Dir.glob(File.join(tmp, "plastic-*.json")).each do |f|
       next if f == current
       begin
-        next if (now - File.mtime(f)) < max_age_seconds
+        data = JSON.parse(File.read(f)) rescue nil
+        keep = false
+        if data
+          id = data.dig("intent", "id")
+          store = data.dig("intent", "store")
+          keep = !blank?(id) && !blank?(store) && intent_active?(id, store: store)
+        end
+        next if keep
         File.delete(f)
         removed << f
       rescue Errno::ENOENT
@@ -152,7 +219,7 @@ module Bridge
     end
     removed
   rescue => e
-    $stderr.puts "plastic: purge_stale_bridges failed: #{e.message}"
+    $stderr.puts "plastic: purge_done_bridges failed: #{e.message}"
     removed || []
   end
 
@@ -224,6 +291,51 @@ module Bridge
     end
   end
 
+  # --- Gate-boundary narration (intent 84, Lever 1) -------------------------
+  #
+  # ONE concise sentence that states what happened AND what's next, preserving
+  # the `Next: ...` hint the agent consumes. Pure and side-effect-free so the
+  # hook stays a thin caller and the formatter is unit-testable in isolation.
+  # No "Stage transition: X -> Y" prose, no arrow; a colon/parentheses carry the
+  # stage word. Returns a single line (no embedded newlines).
+  STAGE_LABELS = {
+    "what" => "What", "why" => "Why", "how" => "How",
+    "exec" => "Exec", "done" => "Done"
+  }.freeze
+
+  NEXT_HINTS = {
+    "why" => "write spec.md",
+    "how" => "Why complete. Invoke plastic-auto to deliver autonomously, or write plan.md manually.",
+    "exec" => "How complete. Invoke plastic-auto or plastic-executing-plan to execute, or work through the checklist manually.",
+    "done" => "Exec complete. Intent must be completed now — write outcome.md, update INDEX.md, auto-commit. Use plastic-auto or do it manually."
+  }.freeze
+
+  def self.stage_label(stage)
+    STAGE_LABELS[stage] || stage.to_s
+  end
+
+  # Build the gate-hook `additionalContext` sentence.
+  #   transition:      "PLASTIC: How reached (plan.md written). Next: <hint>"
+  #   same-stage write: "PLASTIC: plan.md written (How). Next: <hint>"
+  # `new_missing` (missing files for the new stage) takes precedence over the
+  # stage hint, exactly as before, so the `Next:` content is unchanged.
+  def self.gate_narration(old_stage:, new_stage:, basename:, new_missing:, next_hints: NEXT_HINTS)
+    head = if old_stage != new_stage
+             "PLASTIC: #{stage_label(new_stage)} reached (#{basename} written)."
+           else
+             "PLASTIC: #{basename} written (#{stage_label(new_stage)})."
+           end
+
+    nxt =
+      if Array(new_missing).any?
+        "Next: #{Array(new_missing).join(", ")}"
+      elsif next_hints[new_stage]
+        "Next: #{next_hints[new_stage]}"
+      end
+
+    nxt ? "#{head} #{nxt}" : head
+  end
+
   # --- Cycle-step savepoint ledger (intent 34) ------------------------------
   #
   # savepoint.md is a deterministic, append-only, one-line-per-milestone ledger
@@ -256,8 +368,31 @@ module Bridge
     end.compact
   end
 
-  # Append a milestone line for file_path if (and only if) it is a milestone
-  # not already recorded. Returns true when a line was written, false otherwise.
+  # (stage, milestone) pairs already recorded in the ledger. The pair (not the
+  # milestone text alone) is the dedup key, because state-from-ledger lines like
+  # `Why  started` and `How  started` share the milestone text "started" while
+  # being distinct events (intent 81).
+  def self.savepoint_recorded_pairs(intent_dir)
+    f = File.join(intent_dir, SAVEPOINT_FILE)
+    return [] unless File.exist?(f)
+    File.read(f).each_line.filter_map do |line|
+      parts = line.strip.split(/\s{2,}/)
+      parts.length >= 3 ? [parts[1], parts[2]] : nil
+    end
+  end
+
+  # Append one ledger line for (stage, milestone) unless that pair is already
+  # recorded. The single append primitive shared by every line class. Returns
+  # true when a line was written, false when it was a no-op.
+  def self.append_savepoint_line(intent_dir, stage, milestone, now)
+    return false if savepoint_recorded_pairs(intent_dir).include?([stage, milestone])
+    line = "#{now.utc.iso8601}  #{stage}  #{milestone}\n"
+    File.open(File.join(intent_dir, SAVEPOINT_FILE), "a") { |io| io.write(line) }
+    true
+  end
+
+  # Append the artifact-landing milestone for file_path if (and only if) it is a
+  # milestone not already recorded. Returns true when a line was written.
   def self.append_savepoint(intent_dir, file_path, now: Time.now)
     basename = File.basename(file_path)
     stage, milestone = savepoint_milestone(intent_dir, basename)
@@ -265,11 +400,62 @@ module Bridge
     # A sentinel-marked lifecycle file logs NO milestone (the stage is not real
     # yet). The intent file is never sentineled, so it still logs its What line.
     return false unless stage_file_present?(File.join(intent_dir, basename))
-    return false if savepoint_recorded_milestones(intent_dir).include?(milestone)
 
-    line = "#{now.utc.iso8601}  #{stage}  #{milestone}\n"
-    File.open(File.join(intent_dir, SAVEPOINT_FILE), "a") { |io| io.write(line) }
-    true
+    append_savepoint_line(intent_dir, stage, milestone, now)
+  end
+
+  # --- State-from-ledger: pre-stage, exec-start, and terminal lines (81) ------
+  #
+  # On top of intent 34's artifact-landing milestones, the ledger gains:
+  #   - `started` lines, one per cycle stage entry (pre-stage, written by the
+  #     PreToolUse savepoint hook the moment a stage's artifact is first written);
+  #   - an `Exec  started` companion emitted when checklist.md lands;
+  #   - a terminal `Done  delivered|abandoned` line written by the completion path.
+  # None of these are derivable from files on disk, so they are deliberately NOT
+  # part of savepoint_milestone and are never regenerated by rebuild_savepoint:
+  # a rebuilt ledger is the file-landing skeleton, the live ledger is richer.
+
+  # Map a written filename to the [stage, "started"] pre-stage milestone, or nil.
+  # spec.md => entering Why, plan.md => entering How. checklist.md/outcome.md do
+  # not open a stage (checklist's Exec-start is the append_exec_started companion).
+  def self.savepoint_started_milestone(basename)
+    case basename
+    when "spec.md" then ["Why", "started"]
+    when "plan.md" then ["How", "started"]
+    end
+  end
+
+  # Append the pre-stage `started` line for file_path, iff: the basename opens a
+  # stage, the stage is genuinely starting (its artifact is not yet a REAL file,
+  # so a sentinel placeholder still counts as "starting"), and the pair is not
+  # already recorded. Returns true when a line was written.
+  def self.append_started_savepoint(intent_dir, file_path, now: Time.now)
+    basename = File.basename(file_path)
+    stage, milestone = savepoint_started_milestone(basename)
+    return false unless milestone
+    return false if stage_file_present?(File.join(intent_dir, basename))
+
+    append_savepoint_line(intent_dir, stage, milestone, now)
+  end
+
+  # Append the `Exec  started` companion (emitted when checklist.md lands, in the
+  # same PostToolUse event as the `How  checklist.md created` line). Idempotent.
+  def self.append_exec_started(intent_dir, now: Time.now)
+    append_savepoint_line(intent_dir, "Exec", "started", now)
+  end
+
+  TERMINAL_DISPOSITIONS = %w[delivered abandoned].freeze
+
+  # Append the terminal bookend `Done  delivered|abandoned`, written by the
+  # completion path when an intent transfers to INDEX's Completed/Abandoned
+  # section. Idempotent per disposition. Raises on an unknown disposition.
+  def self.append_terminal_savepoint(intent_dir, disposition, now: Time.now)
+    unless TERMINAL_DISPOSITIONS.include?(disposition)
+      raise ArgumentError,
+            "disposition must be one of #{TERMINAL_DISPOSITIONS.join(', ')}, got #{disposition.inspect}"
+    end
+
+    append_savepoint_line(intent_dir, "Done", disposition, now)
   end
 
   # Reconstruct the ledger from files on disk (timestamps from mtimes), in
@@ -320,6 +506,23 @@ module Bridge
         "context_pct" => 0,
         "warning_at" => 80,
         "critical_at" => 90
+      },
+      # Worktree isolation block (intent 73c). Born unprovisioned; arm_auto calls
+      # Worktree.provision to fill it. code/store are abs paths or null.
+      "worktree" => {
+        "code" => nil,
+        "code_branch" => nil,
+        "store" => nil,
+        "store_branch" => nil,
+        "provisioned" => false
+      },
+      # Delivery lock block (intent 73c). The bridge IS the lock; the owner is
+      # whoever armed it. Born unowned; arm_auto stamps owner_session/pid/etc.
+      "lock" => {
+        "owner_session" => nil,
+        "pid" => nil,
+        "acquired_at" => nil,
+        "host" => nil
       }
     }
 
@@ -386,13 +589,32 @@ module Bridge
   # (mid-session intent creation). Re-derives intent state, then sets build.auto.
   def self.arm_auto(session, intent_id:, intent_dir:, store:, name:)
     key = resolve_session(session, intent_id: intent_id, store: store)
-    if blank?(session) && blank?(ENV["CLAUDE_SESSION_ID"])
+    if blank?(session) && blank?(ENV["CLAUDE_CODE_SESSION_ID"])
       $stderr.puts "plastic: no session id available; arming auto with derived bridge key #{key}"
     end
     data = derive(key, intent_id: intent_id, intent_dir: intent_dir, store: store, name: name)
     data["build"]["auto"] = true
+
+    # Acquire the delivery lock: this armed bridge is now the single owner of the
+    # intent's delivery (intent 73c). Stamp owner + pid liveness fields.
+    data["lock"] = {
+      "owner_session" => key,
+      "pid" => Process.pid,
+      "acquired_at" => Time.now.utc.iso8601,
+      "host" => (Socket.gethostname rescue nil)
+    }
+
+    # Provision the per-intent worktrees (mandatory code worktree for project
+    # intents; fail-open for non-git / global-only). Never let a provision error
+    # break arming: the lock and auto flag still matter.
+    begin
+      Worktree.provision(data)
+    rescue => e
+      $stderr.puts "plastic: worktree provision raised, continuing unprovisioned: #{e.message}"
+    end
+
     write(key, data)
-    purge_stale_bridges(session: key)
+    purge_done_bridges(session: key)
     data
   end
 
@@ -402,8 +624,18 @@ module Bridge
     return nil unless data
     data["build"] ||= {}
     data["build"]["auto"] = false
+
+    # Release the worktrees the matching arm provisioned (intent 73c). Non-fatal:
+    # a release error must not block disarming. CLEANUP (73c3) refines the
+    # merge-vs-remove policy on the completion/release path.
+    begin
+      Worktree.release(data)
+    rescue => e
+      $stderr.puts "plastic: worktree release raised, continuing: #{e.message}"
+    end
+
     write(session, data)
-    purge_stale_bridges(session: session)
+    purge_done_bridges(session: session)
     data
   end
 
@@ -441,6 +673,114 @@ module Bridge
       "(blocked edit: #{file_abs})"
   end
 
+  # --- Worktree isolation gate (intent 73c2) ---
+
+  # Returns a reason String to BLOCK, or nil to ALLOW. Two independent rules,
+  # both fail-open by construction:
+  #
+  #   1. When the bridge has a provisioned code worktree, a code edit (a target
+  #      outside ~/.plastic and outside this intent's store dir) MUST land inside
+  #      worktree["code"]; otherwise BLOCK and name the expected worktree path.
+  #   2. When the target lives inside ANOTHER intent's store dir whose bridge lock
+  #      is held by a LIVE non-owner session, BLOCK (non-owner edit to an active
+  #      intent).
+  #
+  # Fails open (returns nil) when provisioned is false (non-git / global-only) or
+  # the bridge carries no worktree/lock blocks. Logs nothing on the allow path.
+  def self.worktree_gate_decision(bridge_data, file_path, home: Dir.home, current_session: nil)
+    return nil unless bridge_data.is_a?(Hash)
+    return nil if blank?(file_path)
+
+    file_abs = File.expand_path(file_path.to_s)
+    plastic_home = File.expand_path(File.join(home, ".plastic"))
+    under_plastic = file_abs == plastic_home || file_abs.start_with?("#{plastic_home}/")
+
+    intent_info = bridge_data["intent"] || {}
+    store = intent_info["store"]
+    dir = intent_info["dir"]
+    intent_dir_abs = (store && dir) ? File.expand_path("#{store}/#{dir}") : nil
+    under_own_intent = intent_dir_abs &&
+                       (file_abs == intent_dir_abs || file_abs.start_with?("#{intent_dir_abs}/"))
+
+    # Rule 1: provisioned code worktree confines project-code edits.
+    worktree = bridge_data["worktree"] || {}
+    if worktree["provisioned"] == true
+      code = worktree["code"].to_s
+      # Project code = outside ~/.plastic and outside this intent's store dir.
+      is_project_code = !under_plastic && !under_own_intent
+      if is_project_code && !blank?(code)
+        code_abs = File.expand_path(code)
+        inside_code = file_abs == code_abs || file_abs.start_with?("#{code_abs}/")
+        unless inside_code
+          id = intent_info["id"]
+          return "intent #{id} is isolated to its worktree — edit project code " \
+                 "inside #{code_abs}, not the shared checkout. (blocked edit: #{file_abs})"
+        end
+      end
+    end
+
+    # Rule 2: do not edit another intent's locked, live store dir.
+    if under_plastic
+      reason = non_owner_store_edit_reason(file_abs, plastic_home, intent_dir_abs,
+                                           home: home, current_session: current_session,
+                                           own_session: bridge_data["session"])
+      return reason if reason
+    end
+
+    nil
+  end
+
+  # Helper for rule 2. A store dir is `<plastic_home>/store/{id}--{slug}` (global)
+  # or `<plastic_home>/projects/{slug}/store/{id}--{slug}` (project). When the
+  # edit target sits inside such a dir that is NOT this intent's own dir, and a
+  # live non-owner session holds that intent's bridge lock, BLOCK.
+  def self.non_owner_store_edit_reason(file_abs, plastic_home, own_intent_dir_abs,
+                                       home:, current_session:, own_session:)
+    return nil if own_intent_dir_abs &&
+                  (file_abs == own_intent_dir_abs || file_abs.start_with?("#{own_intent_dir_abs}/"))
+
+    parsed = parse_store_target(file_abs, plastic_home)
+    return nil unless parsed
+
+    session = blank?(current_session) ? own_session : current_session
+    held = Worktree.lock_held_by_other?(
+      intent_id: parsed[:id], store: parsed[:store],
+      current_session: session, home: home,
+    )
+    return nil unless held
+
+    "intent #{parsed[:id]} is owned by another live session — its delivery lock " \
+      "is held elsewhere. Back off; do not edit #{file_abs}."
+  end
+
+  # Resolve an edit target inside a store to {id:, store:} for the intent dir it
+  # belongs to, or nil if the path is not inside an `{id}--{slug}` intent dir.
+  def self.parse_store_target(file_abs, plastic_home)
+    rels = []
+    global_store = File.join(plastic_home, "store")
+    if file_abs.start_with?("#{global_store}/")
+      rels << [file_abs[(global_store.length + 1)..], global_store]
+    end
+    projects = File.join(plastic_home, "projects")
+    if file_abs.start_with?("#{projects}/")
+      tail = file_abs[(projects.length + 1)..].to_s
+      parts = tail.split(File::SEPARATOR)
+      if parts.length >= 2 && parts[1] == "store"
+        pstore = File.join(projects, parts[0], "store")
+        rels << [file_abs[(pstore.length + 1)..], pstore]
+      end
+    end
+
+    rels.each do |rel, store_dir|
+      next if blank?(rel)
+      first = rel.split(File::SEPARATOR).first.to_s
+      idx = first.index("--")
+      next unless idx && idx > 0
+      return { id: first[0...idx], store: store_dir }
+    end
+    nil
+  end
+
   # --- Bash-edit gate (intent 27a) ---
 
   # Extract the set of file paths a Bash command writes to. Conservative by