@zalom/plastic 1.0.0-beta.25 → 1.0.0-beta.27

package/PLASTIC.md

@@ -362,9 +362,64 @@ each station.
 | Why | `spec.md` | owner writes refresh the lease (lock file mtime heartbeat) | gate-check requires the intent file with `## Intent` before spec.md; lock-gate admits only the owner or a delegate | savepoint `Why started`, `Why spec.md created` |
 | How | `plan.md`, `actions/`, `checklist.md` | heartbeat on writes; the code gate stays closed until plan.md plus checklist.md exist | gate-check requires spec.md before plan.md, and plan.md plus actions/ before checklist.md | savepoint `How started`, `How plan.md created`, `How checklist.md created`, `Exec started` |
 | Exec | code on the intent branch, checklist checked off | heartbeat; code edits confined to the provisioned worktree; delegates write under the owner's lock; bash, interpreter, and MCP writes gated the same way | code-gate, worktree-gate, bash-gate, lock-gate | checklist boxes; savepoint milestones |
-| End (done) | `outcome.md`, INDEX moves to Completed | ordered End tail: verify, merge and remove worktrees, disarm clears `delivery.lock`, only then is the bridge purge-eligible | gate-check blocks outcome.md while checklist items are unchecked | savepoint `Done delivered` (or `abandoned`); takeover audits, if any, remain in savepoint.md |
+| End (done) | mandatory `outcome.md` (`disposition: delivered\|abandoned`), INDEX moves to Completed or Abandoned | ordered End tail: verify, merge and remove worktrees, disarm clears `delivery.lock`, then the bridge is purge-eligible, and the QMD reindex runs LAST (after purge) | gate-check blocks outcome.md while checklist items are unchecked | savepoint `Done delivered` (or `abandoned`); takeover audits, if any, remain in savepoint.md |
 | Maintenance (any stage) | `revisions.md` move-and-record entries | future `maintenance.lock` (short TTL), mutually exclusive with `delivery.lock` in either direction; 108 ships the schema seam only, the implementation follows intent 93 in a chained intent | acquisition refuses while the other lock type is fresh; a terminal intent with no lock held is read-only | dated, rule-tagged `revisions.md` entry; savepoint untouched |
 
+### What "intent done" means (intent 93)
+
+Done is one law with three signals, and they must agree. INDEX `## Completed` /
+`## Abandoned` is the single canonical terminal marker: it is the store-wide ledger a fresh
+session reads first, so it wins on any conflict. `outcome.md` is the "deliverable exists"
+signal, and the savepoint `Done delivered|abandoned` line is the audit echo. All three must
+agree; when they disagree, INDEX is authoritative and `doctor` flags the mismatch (the
+`done_signals` check: `outcome.md` real but still under `## Active`, or terminal without a
+real `outcome.md`, or a terminal intent whose savepoint carries no `Done` line).
+
+`outcome.md` is mandatory at every terminal transition, delivered and abandoned alike. It
+self-declares its disposition through a `disposition: delivered|abandoned` frontmatter
+header. The delivered path authors it with the result; the abandoned path authors it with
+the abandonment reason and no longer leaves the scaffolded placeholder sentinel in place.
+
+The canonical End tail runs in this order, and the QMD reindex is always LAST, after the
+purge: `outcome.md -> INDEX terminal -> savepoint Done -> commit -> disarm (Worktree.release
+-> Lock.release -> purge) -> QMD reindex`. Running the reindex last keeps the index from
+ever referencing a bridge or lock that disarm is about to remove.
+
+The post-done access window is lock-bounded: `[INDEX terminal -> Lock.release]`. Through it
+the completing session keeps full read and write access to the terminal directory and no
+purge can fire (108's lock-held keep-guard keeps the bridge while `delivery.lock` exists).
+Once the lock is released the window closes: the bridge becomes purge-eligible and the
+directory is frozen. A crash mid-tail is recovered by stale-lock reclaim plus finishing the
+tail; `doctor` surfaces this as a "stalled completion" (terminal in INDEX but the lock is
+still present or stale). Finishing the tail is FINISHING a completion, never a reactivation:
+a done intent is never moved back to `## Active`.
+
+Terminal immutability (the contract intent 112 enforces): a terminal directory is writable
+ONLY while a lock is held. The delivery lock covers the completing session's End tail up to
+`Lock.release`; the maintenance lock covers sanctioned structural move-and-record edits
+after. Terminal with no lock held is frozen. There are only two locks in the system,
+delivery and maintenance (108 D11). This governs WRITES only: reads of a terminal intent are
+always allowed and unbounded (curator reindex, dashboards, and future intents that reference
+its id or chain), so a done intent stays fully readable forever. Intent 93 states this rule;
+intent 112 builds the gate that enforces it.
+
+Fail-safe lock doctrine (the contract intent 111 implements): the lock system never traps a
+session or burns credits. When a gate cannot verify lock integrity it fails open, degrading
+to advisory (warn) rather than hard-blocking. Repair is orchestrator-driven: on a lock-issue
+signal the orchestrator inspects and repairs the lock automatically, and the human
+`plastic-lock` command is a fallback path, not the trigger. Intent 93 states this doctrine;
+intent 111 builds the fail-open behavior, the lock-liveness surface, the lock-issue message,
+and the auto-repair.
+
+Scope split. Intent 93 ships doctrine plus the low-risk reconciliation that needs no new
+lock: the canonical done-marker and three-signal reconciliation, the mandatory `outcome.md`
+plus `disposition` header at both terminals, the End tail with the reindex moved last, the
+`done_signals` doctor check (three-signal agreement plus stalled-completion detection), and
+the lock-bounded post-done window with its keep-guard test. Intent 111 owns the lock
+liveness surface, the lock-issue message, orchestrator auto-repair, and the fail-open
+behavior itself. Intent 112 owns the maintenance lock and the immutability gate (it inherits
+fail-open from 111). Intent 4a1b1 owns deep agent stuck-detection and is not superseded.
+
 ## Deprecation Process
 
 Deprecations live in `deprecations.yml` and are shown at SessionStart. While Plastic is

package/agents/plastic-intent-curator.md

@@ -32,7 +32,10 @@ You are the Plastic Intent Curator. Your role is to maintain the health and navi
 2. Read `~/.plastic/INDEX.md` (or project INDEX.md) to understand current organization
 3. Compare: are there intents not in any cluster? Missing from Active/Completed/Abandoned? Status mismatches?
 4. Make targeted edits to INDEX.md and intent frontmatter/links
-5. On a terminal-state transition: whenever you move an intent to Completed OR Abandoned, refresh the QMD index for that store so the new outcome (or abandonment rationale) is searchable. This is mandatory on any terminal-state move and a no-op when QMD is absent, and it runs in the background so it never blocks: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`
+5. On a terminal-state transition (Completed OR Abandoned), run the closing acts in the canonical End-tail order (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`):
+   a. Author a real `outcome.md` in the intent directory from `~/.plastic/templates/outcome.md`, with the frontmatter `disposition: delivered` for a completed intent or `disposition: abandoned` for an abandoned one. `outcome.md` is MANDATORY at every terminal, delivered and abandoned alike: on abandon it records the abandonment reason and replaces the scaffolded placeholder sentinel (never leave `outcome.md` a placeholder at a terminal).
+   b. Stamp the terminal savepoint bookend (intent 81) recording the disposition. Idempotent.
+   c. Refresh the QMD index for that store LAST, after the terminal move, outcome.md, and savepoint, so the new outcome (or abandonment rationale) is searchable. This is mandatory on any terminal-state move and a no-op when QMD is absent, and it runs in the background so it never blocks: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`
 6. Structural maintenance is move-and-record: remove the misplaced section, file, or ref from its artifact, then create or append `revisions.md` in that intent directory (copy the FORM from `~/.plastic/templates/revisions.md`). One entry per relocated item, newest at the bottom: a `## Revision vN - YYYY-MM-DD-HH:MM` header, a one-sentence `Why` ending with `[rule: <tag>]`, `Prior location`, and either `Content held` (verbatim) or a one-line `Change` for a frontmatter edit. For a stray file, embed its full content and delete the original. The violation-tag catalog is canonical in PLASTIC.md.
 7. Report what you changed
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "1.0.0-beta.25",
+  "version": "1.0.0-beta.27",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/doctor.rb

@@ -21,6 +21,8 @@ require_relative "lib/graph_rebuild"
 require_relative "lib/links_projection"
 require_relative "lib/links_section"
 require_relative "lib/hook_registry"
+require_relative "lib/lock"
+require_relative "lib/bridge"
 
 # Diagnostic engine, instantiable with an injected store/agent map so tests can
 # run it hermetically (no eval, no global-constant rewriting).
@@ -505,6 +507,184 @@ class Doctor
     checks
   end
 
+  # --- Check: the three done-signals agree + stalled completion (intent 93) ---
+  #
+  # "Done" is one law with three signals that MUST agree: INDEX
+  # `## Completed`/`## Abandoned` is the single canonical terminal marker;
+  # `outcome.md` is the "deliverable exists" signal (real, non-placeholder, with a
+  # `disposition:` header); the savepoint `Done` line is the audit echo. INDEX
+  # wins on conflict. This check flags any disagreement, and separately surfaces a
+  # "stalled completion": an intent that is terminal in INDEX but whose End tail
+  # never released its `delivery.lock` (the post-done window never closed). Read
+  # only, dependency-light: it uses INDEX parsing, file presence, the placeholder
+  # sentinel, and `Lock.fresh?` — no new lock, no 111 lock-liveness surface.
+
+  # For one store's INDEX.md, map each referenced intent directory name to the
+  # `## ...` section(s) it appears under: { "<id>--<slug>" => ["Active", ...] }.
+  def index_sections_by_dir(index_path)
+    sections = Hash.new { |h, k| h[k] = [] }
+    return sections unless File.exist?(index_path)
+
+    current = nil
+    File.foreach(index_path) do |line|
+      if (m = line.match(/^##\s+(.+?)\s*$/))
+        current = m[1]
+        next
+      end
+      next unless current
+
+      line.scan(%r{store/([\w][\w.-]*?)(?:/|\))}) do |(dirname)|
+        sections[dirname] << current unless sections[dirname].include?(current)
+      end
+    end
+    sections
+  end
+
+  # Stores to reconcile: the global store plus each project store, filtered by
+  # `scopes` (nil = all) exactly like check_conventions.
+  def done_signal_stores(scopes)
+    stores = []
+
+    if scopes.nil? || scopes.include?("global")
+      stores << {
+        scope: "global",
+        index: File.join(plastic_home, "INDEX.md"),
+        store_dir: File.join(plastic_home, "store"),
+      }
+    end
+
+    projects_root = File.join(plastic_home, "projects")
+    if File.directory?(projects_root)
+      Dir.children(projects_root).sort.each do |project|
+        scope = "project:#{project}"
+        next unless scopes.nil? || scopes.include?(scope)
+
+        store_dir = File.join(projects_root, project, "store")
+        next unless File.directory?(store_dir)
+
+        stores << {
+          scope: scope,
+          index: File.join(projects_root, project, "INDEX.md"),
+          store_dir: store_dir,
+        }
+      end
+    end
+
+    stores
+  end
+
+  def check_done_signals(scopes: nil)
+    conflicts = [] # canonical INDEX-wins disagreement (fail)
+    gaps = []      # terminal completeness gaps on immutable/legacy history (warn)
+    stalled = []   # terminal but End tail unfinished (warn)
+
+    done_signal_stores(scopes).each do |store|
+      index_sections_by_dir(store[:index]).each do |dirname, in_sections|
+        dir = File.join(store[:store_dir], dirname)
+        next unless File.directory?(dir)
+
+        terminal = (in_sections & ["Completed", "Abandoned"]).any?
+        active = in_sections.include?("Active") && !terminal
+        outcome = File.join(dir, "outcome.md")
+        outcome_real = Bridge.stage_file_present?(outcome)
+        label = "#{store[:scope]} store/#{dirname}"
+
+        # HARD conflict: the deliverable exists but INDEX still says Active. This
+        # is the one true INDEX-wins disagreement, so it stays a fail.
+        if active && outcome_real
+          conflicts << "#{label}: outcome.md is real but the intent is still under ## Active " \
+                       "(INDEX is canonical — move it to its terminal section or revert outcome.md)"
+        end
+
+        # Completeness gap (warn, not fail): a terminal intent whose outcome.md is
+        # missing/placeholder. Legacy terminal intents predate this convention and
+        # are immutable, so this is advisory, never breakage.
+        if terminal && !outcome_real
+          state = File.exist?(outcome) ? "still a placeholder" : "missing"
+          gaps << "#{label}: terminal in INDEX but outcome.md is #{state} " \
+                  "(author outcome.md with the disposition header)"
+        end
+
+        next unless terminal
+
+        # Audit echo (weakest signal, D1): the savepoint should carry a
+        # `Done delivered|abandoned` line. Missing on legacy history -> advisory gap.
+        savepoint = File.join(dir, "savepoint.md")
+        if File.exist?(savepoint) && File.read(savepoint) !~ /\bDone\b.*\b(delivered|abandoned)\b/
+          gaps << "#{label}: terminal in INDEX but savepoint.md has no " \
+                  "`Done delivered|abandoned` line (audit echo missing)"
+        end
+
+        # Stalled completion: the End tail never released the delivery lock, so the
+        # post-done window `[INDEX terminal -> Lock.release]` never closed.
+        if File.exist?(Lock.path(dir))
+          note = Lock.fresh?(dir) ? "delivery.lock still present (post-done window not closed)"
+                                  : "delivery.lock is present and STALE"
+          stalled << "#{label}: #{note} — the End tail did not finish"
+        end
+      end
+    end
+
+    checks = []
+
+    # signals_agree: only the canonical INDEX-wins conflict is a hard fail, so
+    # `doctor` never goes red on immutable legacy terminal intents.
+    if conflicts.empty?
+      checks << check(
+        category: "done_signals", name: "signals_agree", status: "pass",
+        message: "No done-signal conflicts (no intent has a real outcome.md while still Active)"
+      )
+    else
+      checks << check(
+        category: "done_signals", name: "signals_agree", status: "fail",
+        message: "#{conflicts.size} done-signal conflict#{conflicts.size == 1 ? "" : "s"} " \
+                 "(INDEX ## Completed/## Abandoned is canonical; a real outcome.md must not stay Active)",
+        details: conflicts, fixable: true,
+        fix_hint: "Reconcile to INDEX (canonical): move the intent to its terminal section, or revert " \
+                  "outcome.md to a placeholder. Deliverable-exists but still-Active is the one done-signal " \
+                  "state that must never persist."
+      )
+    end
+
+    # signals_complete: terminal completeness gaps are advisory (warn), because
+    # completed intents are immutable and legacy history predates this convention.
+    if gaps.empty?
+      checks << check(
+        category: "done_signals", name: "signals_complete", status: "pass",
+        message: "Every terminal intent carries a real outcome.md and a Done savepoint echo"
+      )
+    else
+      checks << check(
+        category: "done_signals", name: "signals_complete", status: "warn",
+        message: "#{gaps.size} terminal completeness gap#{gaps.size == 1 ? "" : "s"} " \
+                 "(outcome.md or the savepoint Done echo is missing; advisory on immutable history)",
+        details: gaps, fixable: true,
+        fix_hint: "For live terminals, author a real outcome.md with the `disposition:` header via the " \
+                  "completion/abandon path (plastic-auto or plastic-intent-curator) and stamp the terminal " \
+                  "savepoint. Legacy terminal intents are immutable, so pre-convention gaps stay advisory."
+      )
+    end
+
+    if stalled.empty?
+      checks << check(
+        category: "done_signals", name: "stalled_completion", status: "pass",
+        message: "No stalled completions (every terminal intent released its delivery lock)"
+      )
+    else
+      checks << check(
+        category: "done_signals", name: "stalled_completion", status: "warn",
+        message: "#{stalled.size} stalled completion#{stalled.size == 1 ? "" : "s"} " \
+                 "(terminal in INDEX but the End tail did not finish)",
+        details: stalled, fixable: true,
+        fix_hint: "Finish the End tail via stale-lock reclaim: `plastic-lock reclaim`, then complete the " \
+                  "tail (Worktree.release -> Lock.release -> purge -> QMD reindex last). This FINISHES a " \
+                  "completion; it is NOT a reactivation of a done intent."
+      )
+    end
+
+    checks
+  end
+
   # Build the cross-store node maps (basename + label per store) + relocation map
   # from ALL stores, then for every intent compute its canonical `## Links`
   # projection and flag any whose ACTUAL `## Links` section differs (membership or
@@ -839,9 +1019,9 @@ class Doctor
         groups = group.is_a?(Array) ? group : [group]
         live = settings.dig("hooks", event) || []
         groups.each do |g|
-          match = live.find { |h| h.is_a?(Hash) && h["matcher"] == g["matcher"] }
+          matches = live.select { |h| h.is_a?(Hash) && h["matcher"] == g["matcher"] }
           wanted = g["hooks"].map { |h| h["command"] }
-          got = match ? Array(match["hooks"]).map { |h| h["command"] } : []
+          got = matches.flat_map { |m| Array(m["hooks"]).map { |h| h["command"] } }
           missing = wanted - got
           diffs << "#{event}[#{g['matcher']}] missing: #{missing.join(', ')}" unless missing.empty?
         end
@@ -1457,6 +1637,7 @@ class Doctor
     all_checks += check_project_stores
     all_checks += check_deprecations
     all_checks += check_qmd
+    all_checks += check_done_signals
 
     summarize(all_checks, agent_key)
   end
@@ -1483,9 +1664,9 @@ class Doctor
     all_checks =
       case store
       when :all
-        check_global_store + check_project_stores + check_conventions
+        check_global_store + check_project_stores + check_conventions + check_done_signals
       when :global
-        check_global_store + check_conventions(scopes: ["global"])
+        check_global_store + check_conventions(scopes: ["global"]) + check_done_signals(scopes: ["global"])
       else
         all_checks_for_project_slug(store)
       end
@@ -1508,7 +1689,8 @@ class Doctor
     end
 
     check_project_store(slug, projects[slug]) +
-      check_conventions(scopes: ["project:#{slug}"])
+      check_conventions(scopes: ["project:#{slug}"]) +
+      check_done_signals(scopes: ["project:#{slug}"])
   end
 
   # Roll a list of checks up into the standard result envelope.

package/skills/auto/SKILL.md

@@ -209,7 +209,10 @@ During initial project creation, all decisions are non-destructive by definition
 ## Completion
 
 1. Verify all checklist items are checked
-2. Write `outcome.md` with detailed results
+2. Write `outcome.md` with detailed results, from `${CLAUDE_PLUGIN_ROOT}/templates/outcome.md`.
+   Set the frontmatter `disposition: delivered` (this is the delivered terminal). `outcome.md`
+   is mandatory at every terminal and self-declares its disposition (see the canonical done-marker
+   and End tail in PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`).
 3. Write `## Outcome` summary in the intent file (1-2 sentences)
 4. **Release (if configured)**
    1. Detect project — match CWD against paths in `~/.plastic/projects.yml` to find the project slug. If no match, skip to step 5 (default commit-only behavior).
@@ -236,14 +239,7 @@ During initial project creation, all decisions are non-destructive by definition
    ```
    (Use `"abandoned"` instead when the intent is being moved to `## Abandoned`.) Idempotent.
 7. Auto-commit: `cd <store-root> && git add . && git commit -m "feat: deliver intent <ID> — <name>"`
-8. On completion, ALWAYS refresh the QMD search index for this store (no-op when QMD is absent).
-   It runs in the background so it never blocks the turn:
-   ```bash
-   ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async
-   ```
-   Completion is the lifecycle event that keeps the search index fresh. `<store-root>` is the
-   store that holds this intent (the global store or the project store).
-9. Disarm the lifecycle gate (auto delivery is finished):
+8. Disarm the lifecycle gate (auto delivery is finished):
    ```bash
    ruby -r ~/.plastic/scripts/lib/bridge -e 'Bridge.disarm_auto(ENV["CLAUDE_CODE_SESSION_ID"])'
    ```
@@ -266,6 +262,16 @@ During initial project creation, all decisions are non-destructive by definition
    removed, so the integrated work is not lost. It does this with `Worktree.finish(bridge_data,
    merge: true)` (merge-then-remove). Never leave an orphaned worktree, and run `git worktree
    prune` if you hit a stale reference.
+9. QMD reindex LAST (canonical End tail). AFTER disarm has released the worktrees, cleared the
+   `delivery.lock`, and purged the bridge, refresh the QMD search index for this store (no-op when
+   QMD is absent). It runs in the background so it never blocks the turn:
+   ```bash
+   ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async
+   ```
+   Completion is the lifecycle event that keeps the search index fresh. `<store-root>` is the store
+   that holds this intent (the global store or the project store). The reindex is the LAST End-tail
+   step, run after purge, so the index never references a bridge or lock that is about to disappear
+   (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`).
 10. Notify user: "Intent [ID] — [name] delivered. [1-2 sentence summary]. See outcome.md for details."
 
 ## Error Handling

package/skills/executing-plan/SKILL.md

@@ -70,12 +70,12 @@ After all tasks complete, dispatch a final reviewer for the entire implementatio
 ### Step 4: Update Intent and Complete
 Capture observations in `## Insights`. When ALL checklist items are checked:
 
-1. Write `outcome.md` with detailed results in the intent directory, using the `${CLAUDE_PLUGIN_ROOT}/templates/outcome.md` form
+1. Write `outcome.md` with detailed results in the intent directory, using the `${CLAUDE_PLUGIN_ROOT}/templates/outcome.md` form. Set the frontmatter `disposition: delivered` (the delivered terminal). `outcome.md` is mandatory at every terminal and self-declares its disposition (canonical done-marker in PLASTIC.md).
 2. Write `## Outcome` summary in the intent file (1-2 sentences)
 3. Move intent from `## Active` to `## Completed` in INDEX.md (with today's date)
 4. Update cluster entries to show `_(completed)_`
 5. Auto-commit: `cd <store-root> && git add . && git commit -m "feat: complete intent <ID> — <name>"`
-6. On completion, ALWAYS refresh the QMD search index for this store (no-op when QMD is absent), running in the background so it never blocks the turn: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`. Completion is the lifecycle event that keeps the search index fresh.
+6. QMD reindex LAST (canonical End tail). As the final End-tail step, after the terminal move and any disarm, ALWAYS refresh the QMD search index for this store (no-op when QMD is absent), running in the background so it never blocks the turn: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`. Completion is the lifecycle event that keeps the search index fresh, and the reindex runs last so the index never references a bridge or lock that is about to disappear (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`).
 
 **This is NOT optional.** An intent with all checklist items done but no Outcome is a broken state. Complete the intent immediately — do not leave it for later.
 
@@ -96,12 +96,12 @@ For each task:
 ### Step 3: Update Intent and Complete
 Capture observations in `## Insights`. When ALL checklist items are checked:
 
-1. Write `outcome.md` with detailed results in the intent directory, using the `${CLAUDE_PLUGIN_ROOT}/templates/outcome.md` form
+1. Write `outcome.md` with detailed results in the intent directory, using the `${CLAUDE_PLUGIN_ROOT}/templates/outcome.md` form. Set the frontmatter `disposition: delivered` (the delivered terminal). `outcome.md` is mandatory at every terminal and self-declares its disposition (canonical done-marker in PLASTIC.md).
 2. Write `## Outcome` summary in the intent file (1-2 sentences)
 3. Move intent from `## Active` to `## Completed` in INDEX.md (with today's date)
 4. Update cluster entries to show `_(completed)_`
 5. Auto-commit: `cd <store-root> && git add . && git commit -m "feat: complete intent <ID> — <name>"`
-6. On completion, ALWAYS refresh the QMD search index for this store (no-op when QMD is absent), running in the background so it never blocks the turn: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`. Completion is the lifecycle event that keeps the search index fresh.
+6. QMD reindex LAST (canonical End tail). As the final End-tail step, after the terminal move and any disarm, ALWAYS refresh the QMD search index for this store (no-op when QMD is absent), running in the background so it never blocks the turn: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`. Completion is the lifecycle event that keeps the search index fresh, and the reindex runs last so the index never references a bridge or lock that is about to disappear (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`).
 
 **This is NOT optional.** Complete the intent immediately when work is done.
 

package/skills/intent-curator/SKILL.md

@@ -38,9 +38,10 @@ The agent handles:
 - Cluster management (create, merge, rename)
 - Orphan detection
 
-When an intent reaches a terminal state — moved to Completed OR Abandoned — do two things as the closing act of the transfer:
+When an intent reaches a terminal state — moved to Completed OR Abandoned — do these things as the closing act of the transfer, in the canonical End-tail order (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`):
 
-1. Stamp the terminal savepoint bookend (intent 81), so the ledger's last line records the disposition: `ruby -r ~/.plastic/scripts/lib/bridge -e 'Bridge.append_terminal_savepoint("<intent_dir>", "delivered")'` (use `"abandoned"` for an abandoned intent). Idempotent.
-2. Refresh the QMD index for the affected store (no-op when QMD absent), running in the background so it never blocks: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`.
+1. Author a real `outcome.md` in the intent directory from `~/.plastic/templates/outcome.md`, with the frontmatter `disposition: delivered` for a completed intent or `disposition: abandoned` for an abandoned one. `outcome.md` is MANDATORY at every terminal, delivered and abandoned alike: on abandon it records the abandonment reason and replaces the scaffolded placeholder sentinel (never leave `outcome.md` a placeholder at a terminal).
+2. Stamp the terminal savepoint bookend (intent 81), so the ledger's last line records the disposition: `ruby -r ~/.plastic/scripts/lib/bridge -e 'Bridge.append_terminal_savepoint("<intent_dir>", "delivered")'` (use `"abandoned"` for an abandoned intent). Idempotent.
+3. Refresh the QMD index for the affected store LAST, after the terminal move and savepoint (no-op when QMD absent), running in the background so it never blocks: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`.
 
 After the agent completes, report what changed.

package/skills/managing-index/SKILL.md

@@ -41,7 +41,11 @@ Topic-based groupings. Manually curated. Create a new cluster when 3+ intents sh
 ### Completed
 All completed intents with dates. Links preserved, never deleted.
 
-When you move an intent INTO Completed or Abandoned, stamp the terminal savepoint bookend as the closing act of the transfer (intent 81), so the ledger's last line records the disposition: `ruby -r ~/.plastic/scripts/lib/bridge -e 'Bridge.append_terminal_savepoint("<intent_dir>", "delivered")'` (use `"abandoned"` for an abandoned intent). Idempotent.
+When you move an intent INTO Completed or Abandoned, run the closing acts of the transfer in the canonical End-tail order (see PLASTIC.md `## Delivery Isolation and the Single-Owner Lock`):
+
+1. Author a real `outcome.md` in the intent directory from `~/.plastic/templates/outcome.md`, with the frontmatter `disposition: delivered` for a completed intent or `disposition: abandoned` for an abandoned one. `outcome.md` is MANDATORY at every terminal, delivered and abandoned alike: on abandon it records the abandonment reason and replaces the scaffolded placeholder sentinel (never leave `outcome.md` a placeholder at a terminal).
+2. Stamp the terminal savepoint bookend (intent 81), so the ledger's last line records the disposition: `ruby -r ~/.plastic/scripts/lib/bridge -e 'Bridge.append_terminal_savepoint("<intent_dir>", "delivered")'` (use `"abandoned"` for an abandoned intent). Idempotent.
+3. Refresh the QMD index for that store LAST, after the terminal move and savepoint (no-op when QMD is absent), in the background so it never blocks: `ruby ~/.plastic/scripts/qmd-sync reindex --store <store-root> --async`.
 
 ## Workflow
 

package/templates/outcome.md

@@ -1,3 +1,6 @@
+---
+disposition: delivered|abandoned
+---
 # Outcome: <intent name>
 
 ## Summary