@zalom/plastic 1.1.0 → 1.1.1

package/PLASTIC.md

@@ -167,8 +167,10 @@ and Exec, spins up the team above, and works the dashboard's dispatchable queue.
 `human_only` (intents that need a person); auto mode consumes the former.
 
 **Model contract.** Every agent in `agents/*.md` pins an explicit Claude Code model alias in
-its own frontmatter: `opus`, `sonnet`, or `haiku`. Never `inherit`, never Fable. Aliases track
-"latest per tier" so no Plastic release is required to advance a tier. The tier by role:
+its own frontmatter: `opus`, `sonnet`, or `haiku`. Never `inherit`, never Fable by default,
+unless an explicit `agents.models.<name>` config override names Fable for that role, in which
+case the override is honored as written. Aliases track "latest per tier" so no Plastic release
+is required to advance a tier. The tier by role:
 `plastic-enforcer`, `plastic-brainstorming`, `plastic-planner` are `opus`;
 `plastic-spec-specialist`, `plastic-executor`, `plastic-intent-curator`,
 `plastic-future-intent-researcher`, `plastic-intent-discovery` are `sonnet`.

package/README.md

@@ -136,8 +136,8 @@ Walk this once in
 | Family | Commands |
 | ------ | -------- |
 | Mode | `plastic-tutorial`, `plastic-auto` |
-| Intent | `plastic-intent-creating`, `plastic-intent-starting`, `plastic-intent-brainstorming`, `plastic-intent-grilling`, `plastic-intent-speccing`, `plastic-intent-planning`, `plastic-intent-executing`, `plastic-intent-ending`, `plastic-intent-continuing`, `plastic-intent-researching` |
-| Project and delivery | `plastic-project-creating`, `plastic-roadmap`, `plastic-releasing` |
+| Intent | `plastic-continuing`, `plastic-intent-creating`, `plastic-intent-starting`, `plastic-intent-brainstorming`, `plastic-intent-grilling`, `plastic-intent-speccing`, `plastic-intent-planning`, `plastic-intent-executing`, `plastic-intent-ending`, `plastic-intent-continuing`, `plastic-intent-researching` |
+| Project and delivery | `plastic-project-creating`, `plastic-project-continuing`, `plastic-roadmap`, `plastic-roadmap-continuing`, `plastic-releasing` |
 | Skill | `plastic-skill-creating`, `plastic-skill-evaluating` |
 | Product | `plastic-install`, `plastic-update`, `plastic-uninstall`, `plastic-rollback`, `plastic-doctor`, `plastic-humanizer` |
 
@@ -165,7 +165,7 @@ Plastic is developed through Plastic.
 The roadmap, intent history, plans, decisions, and outcomes
 behind releases are part of the repository, not a hidden process.
 
-See the current [roadmap](ROADMAP.md) and [changelog](CHANGELOG.md).
+[changelog](CHANGELOG.md).
 
 ## Documentation
 

package/agents/plastic-enforcer.md

@@ -12,7 +12,9 @@ You are the Plastic Enforcer. You ARE the auto orchestrator, spanning the whole
 orchestrating main session on the best available thinking model (Fable, Opus, or whatever
 supersedes them) for the sharpest gating and synthesis. This is advice only: it changes no
 behavior and blocks nothing if ignored. It concerns the human's MAIN session; dispatched
-subagents keep their pinned tier and never resolve to Fable.
+subagents keep their pinned tier and never resolve to Fable, unless an explicit
+`agents.models.<name>` config override names Fable for that role, in which case the override
+is honored as written.
 
 ## Your Responsibilities
 
@@ -42,7 +44,8 @@ dispatch also resolve the target agent's model through the config chain (`read-c
 agents.models.<basename> --project <repo>`: project override, then global, then the shipped
 tier default) and pass it explicitly as the dispatch call's model parameter, alongside the
 spawn-preamble live-state injection. Never rely on the dispatched role's frontmatter alone. A
-resolved subagent model is never Fable.
+resolved subagent model is never Fable, unless an explicit `agents.models.<name>` config
+override names Fable for that role, in which case the override is honored as written.
 5. **Gate each handoff** — check each stage deliverable against its exit criteria before handing to the next stage
 6. **Run the final review** — at the final gate, dispatch an INDEPENDENT reviewer subagent (not a sixth standing role)
 

package/agents/plastic-future-intent-researcher.md

@@ -31,4 +31,4 @@ You are the Plastic Future Intent Researcher. Your role is to pick up parked fut
 - You never modify `## Insights` or `## Outcome` sections — those belong to the worker
 - You use Read, WebSearch, WebFetch, and Bash (read-only grep/find) for research
 - You never change status fields — status is convention-derived from INDEX.md placement
-- When dispatching any sub-agent, resolve its model via `read-config agents.models.<basename> --project <repo>` and pass it explicitly at dispatch, never relying on inherited frontmatter; a resolved subagent model is never Fable
+- When dispatching any sub-agent, resolve its model via `read-config agents.models.<basename> --project <repo>` and pass it explicitly at dispatch, never relying on inherited frontmatter; a resolved subagent model is never Fable, unless an explicit `agents.models.<name>` config override names Fable for that role, in which case the override is honored as written

package/hooks/check-update

@@ -5,7 +5,7 @@
 # upgrade target instead of blindly trusting the `latest` tag.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PLASTIC_HOME="$HOME/.plastic"
+PLASTIC_HOME="${PLASTIC_HOME:-$HOME/.plastic}"
 CACHE_DIR="$PLASTIC_HOME/.cache"
 CACHE_FILE="$CACHE_DIR/update-check.json"
 VERSION_FILE="$PLASTIC_HOME/VERSION"

package/hooks/continue

@@ -23,7 +23,7 @@ if echo "$MESSAGE" | grep -iq '\bcontinue\b'; then
 {
   "hookSpecificOutput": {
     "hookEventName": "UserPromptSubmit",
-    "additionalContext": "PLASTIC CONTINUE — The user wants to resume previous work.\n\nRead ~/.plastic/INDEX.md and follow the continuing skill workflow."
+    "additionalContext": "PLASTIC CONTINUE: The user wants to resume previous work.\n\nRead ~/.plastic/INDEX.md and follow the plastic-continuing skill workflow."
   }
 }
 HOOKJSON

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/dashboard.rb

@@ -33,7 +33,7 @@ def today
 end
 
 # A generic "about a month" threshold, not tuned to any one store's item count.
-# Deliberately independent from plastic-intent-continuing's separate stale_threshold_days
+# Deliberately independent from plastic-project-continuing's separate stale_threshold_days
 # config: that one is a proactive boot-time triage nudge, this is a board annotation.
 # Unifying the two is a follow-up, not this intent.
 STALE_DAYS = 30
@@ -355,10 +355,7 @@ LIFECYCLE_GLYPH = { "what" => "○", "why" => "◔", "how" => "◑", "exec" => "
 DISPOSITION_GLYPH = { "drive" => "▸", "defer" => "⇢", "research" => "⊙", "triage" => "⚑" }.freeze
 LEGEND = "legend  ○ What ◔ Why ◑ How ◕ Exec ● Done │ ▸drive ⇢defer ⊙research ⚑triage │ ⇡unblocked"
 
-# Markdown board glyphs (intent 37). Quadrant signatures + per-line bullets.
-QUADRANT_BULLET = {
-  "quick_win" => "⚡", "next_big" => "★", "defer" => "→", "triage" => "⚑",
-}.freeze
+# Markdown board glyphs (intent 37). Status signature for the project active/future lists.
 STATUS_GLYPH = { "active" => "◑", "completed" => "●", "future" => "○" }.freeze
 
 # ---------------------------------------------------------------------------
@@ -375,10 +372,10 @@ end
 CELL_CAP = 6
 
 # Markdown-board caps (Task 5, D6/D7): the ASCII renderer already caps via CELL_CAP/
-# cap_cell, but the Markdown board's matrix_data quadrants and the project board's
+# cap_cell, but the Markdown board's next_work list and the project board's
 # active/future lists had no cap and no per-line truncation, so a large store printed
 # hundreds of full-length lines. These two constants fix that on the Markdown side only.
-MATRIX_DATA_CAP = 8
+NEXT_WORK_CAP = 8
 INTENT_LINE_MAX_CHARS = 120
 
 def matrix(records, scope_tag: false)
@@ -584,31 +581,39 @@ def intent_line(rec, bullet)
     scope: rec[:scope], line: "#{bullet} #{rec[:id]} #{text}#{note}".rstrip }
 end
 
-# Cap a raw record list to MATRIX_DATA_CAP entries, then map to intent_line-shaped
+# Cap a raw record list to NEXT_WORK_CAP entries, then map to intent_line-shaped
 # hashes, appending a plain "+N more" line (no id, not a real record) when truncated.
 # Caps the record list first so the "+N more" entry never goes through intent_line.
 def cap_lines(list, bullet)
-  capped = list.first(MATRIX_DATA_CAP)
+  capped = list.first(NEXT_WORK_CAP)
   lines = capped.map { |r| intent_line(r, bullet) }
-  if list.size > MATRIX_DATA_CAP
+  if list.size > NEXT_WORK_CAP
     lines << { id: "", intent: "", created: "", bullet: bullet, scope: "",
-               line: "#{bullet} +#{list.size - MATRIX_DATA_CAP} more" }
+               line: "#{bullet} +#{list.size - NEXT_WORK_CAP} more" }
   end
   lines
 end
 
-def matrix_data(records)
-  cells = { "quick_win" => [], "next_big" => [], "defer" => [], "triage" => [] }
-  research = []
-  records.each do |r|
-    if %w[research exploration].include?(r[:type]) then research << r
-    else cells[r[:quadrant]] << r end
+# Flat, rank-ordered "most-valuable next work" list (intent 149). Replaces the
+# quadrant-keyed matrix_data with a single list ranked by the same rank_key every
+# other ordering uses, capped at NEXT_WORK_CAP with a trailing "+N more" marker
+# when the pool overflows. No grid glyph on the line; the prose surface supplies
+# its own bullet.
+def next_work(records)
+  ranked = records.sort_by { |r| rank_key(r) }
+  capped = ranked.first(NEXT_WORK_CAP)
+  lines = capped.map do |r|
+    text = r[:intent].to_s
+    text = "#{text[0, INTENT_LINE_MAX_CHARS]}…" if text.length > INTENT_LINE_MAX_CHARS
+    { id: r[:id], intent: r[:intent], scope: r[:scope], lifecycle: r[:lifecycle],
+      value: r[:value].to_s, disposition: r[:disposition], flags: r[:flags],
+      line: "#{r[:id]} #{text}" }
   end
-  by_created_desc = ->(list) { list.sort_by { |r| invert_ts(r[:created]) } }
-  out = {}
-  cells.each { |q, list| out[q] = cap_lines(by_created_desc.call(list), QUADRANT_BULLET[q]) }
-  out["research"] = cap_lines(by_created_desc.call(research), "🔬")
-  out
+  if ranked.size > NEXT_WORK_CAP
+    lines << { id: "", intent: "", scope: "", lifecycle: "", value: "", disposition: "",
+               flags: [], line: "+#{ranked.size - NEXT_WORK_CAP} more" }
+  end
+  lines
 end
 
 def short_description(scope)
@@ -654,7 +659,7 @@ def render_data_global(records)
   { mode: "global", date: today.to_s,
     store_health: store_health(:global),
     recently_worked: recently_worked(records),
-    matrix: matrix_data(matrix_pool),
+    next_work: next_work(matrix_pool),
     counts: counts_of(global),
     projects: projs,
     project_totals: {
@@ -671,7 +676,7 @@ def render_data_project(records, slug)
     store_health: store_health(slug),
     description: short_description(scope),
     recently_worked: recently_worked(records, project_scope: scope),
-    matrix: matrix_data(matrix_pool),
+    next_work: next_work(matrix_pool),
     counts: counts_of(scoped),
     active: cap_lines(scoped.select { |r| r[:status] == "active" }
                             .sort_by { |r| invert_ts(r[:last_accessed_at]) }, STATUS_GLYPH["active"]),

package/scripts/doctor.rb

@@ -23,6 +23,8 @@ require_relative "lib/links_section"
 require_relative "lib/hook_registry"
 require_relative "lib/lock"
 require_relative "lib/bridge"
+require_relative "lib/agent_models"
+require_relative "lib/legacy_bookend_amnesty"
 
 # Diagnostic engine, instantiable with an injected store/agent map so tests can
 # run it hermetically (no eval, no global-constant rewriting).
@@ -41,6 +43,11 @@ class Doctor
   # (intent 60). Alias it here so the two can never drift.
   REQUIRED_FRONTMATTER_FIELDS = IntentValidator::REQUIRED_FIELDS
 
+  # Single source of truth for the pre-161 legacy Done-bookend amnesty list
+  # lives in LegacyBookendAmnesty (intent 170a). Alias it here so the two can
+  # never drift.
+  LEGACY_BOOKEND_AMNESTY = LegacyBookendAmnesty::LIST
+
   CLAUDE_HOOK_SCRIPTS = %w[
     plastic-session-start
     plastic-check-update
@@ -66,9 +73,11 @@ class Doctor
 
   attr_reader :plastic_home, :agents
 
-  def initialize(plastic_home: DEFAULT_PLASTIC_HOME, agents: DEFAULT_AGENTS)
+  def initialize(plastic_home: DEFAULT_PLASTIC_HOME, agents: DEFAULT_AGENTS,
+                  bookend_amnesty: LEGACY_BOOKEND_AMNESTY)
     @plastic_home = plastic_home
     @agents = agents
+    @bookend_amnesty = bookend_amnesty
   end
 
   # --- Flag parsing ---
@@ -577,6 +586,7 @@ class Doctor
     conflicts = [] # canonical INDEX-wins disagreement (fail)
     gaps = []      # terminal completeness gaps on immutable/legacy history (warn)
     stalled = []   # terminal but End tail unfinished (warn)
+    phantoms = []  # savepoint.md line(s) disk evidence contradicts (warn, never fail; intent 134)
 
     done_signal_stores(scopes).each do |store|
       index_sections_by_dir(store[:index]).each do |dirname, in_sections|
@@ -596,6 +606,24 @@ class Doctor
                        "(INDEX is canonical — move it to its terminal section or revert outcome.md)"
         end
 
+        # Savepoint truthfulness (advisory, never fail; intent 134): a line the disk contradicts
+        # (a phantom milestone, a duplicate pair, or a state line with an absent prerequisite).
+        # Live intents auto-rebuild via plastic-intent-savepoint; terminal intents are immutable,
+        # so a phantom there is report-only. Composition with intent 170a: a pre-161 legacy intent
+        # on the frozen bookend amnesty is grandfathered here too. Its immutable history carries
+        # known pre-convention drift (the same class the audit-echo gap forgives), so it must not
+        # resurface through this advisory. The suppression is scope-qualified exactly like the
+        # audit-echo amnesty; every live intent and every non-amnestied terminal still fires.
+        phantom_lines = Bridge.savepoint_phantom_lines(dir)
+        phantom_id = dirname.split("--", 2).first
+        phantom_amnestied = terminal && @bookend_amnesty.fetch(store[:scope], []).include?(phantom_id)
+        if phantom_lines.any? && !phantom_amnestied
+          detail = phantom_lines.map { |line, reason| "#{line} (#{reason})" }.join("; ")
+          scope_note = terminal ? "terminal in INDEX, report-only (immutable history)" : "live intent, auto-rebuildable"
+          phantoms << "#{label}: #{phantom_lines.size} phantom savepoint line(s) contradicted by " \
+                      "disk, #{scope_note}: #{detail}"
+        end
+
         # Completeness gap (warn, not fail): a terminal intent whose outcome.md is
         # missing/placeholder. Legacy terminal intents predate this convention and
         # are immutable, so this is advisory, never breakage.
@@ -608,11 +636,18 @@ class Doctor
         next unless terminal
 
         # Audit echo (weakest signal, D1): the savepoint should carry a
-        # `Done delivered|abandoned` line. Missing on legacy history -> advisory gap.
+        # `Done delivered|abandoned` line. Missing on legacy history -> advisory
+        # gap, unless the (scope, id) is on the frozen pre-161 amnesty list
+        # (intent 170a). The amnesty is scope-qualified: an id on the list for
+        # one scope does not grandfather the same id in another scope.
         savepoint = File.join(dir, "savepoint.md")
         if File.exist?(savepoint) && File.read(savepoint) !~ /\bDone\b.*\b(delivered|abandoned)\b/
-          gaps << "#{label}: terminal in INDEX but savepoint.md has no " \
-                  "`Done delivered|abandoned` line (audit echo missing)"
+          id = dirname.split("--", 2).first
+          amnestied = @bookend_amnesty.fetch(store[:scope], []).include?(id)
+          unless amnestied
+            gaps << "#{label}: terminal in INDEX but savepoint.md has no " \
+                    "`Done delivered|abandoned` line (audit echo missing)"
+          end
         end
 
         # Stalled completion: the End tail never released the delivery lock, so the
@@ -682,6 +717,26 @@ class Doctor
       )
     end
 
+    # savepoint_truthful: advisory only, never fails the run (intent 134). A phantom line on a
+    # live intent auto-rebuilds; on terminal (immutable) history it stays report-only.
+    if phantoms.empty?
+      checks << check(
+        category: "done_signals", name: "savepoint_truthful", status: "pass",
+        message: "No savepoint.md lines are contradicted by disk (phantom-line check clean)"
+      )
+    else
+      checks << check(
+        category: "done_signals", name: "savepoint_truthful", status: "warn",
+        message: "#{phantoms.size} intent#{phantoms.size == 1 ? "" : "s"} carry savepoint.md " \
+                 "line(s) contradicted by disk (advisory; terminal history stays report-only)",
+        details: phantoms, fixable: true,
+        fix_hint: "For a live (Active) intent, run plastic-intent-savepoint to rebuild via " \
+                  "Bridge.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
+                  "a phantom there stays advisory unless an explicit human grant authorizes the " \
+                  "124a manual Done-bookend repair."
+      )
+    end
+
     checks
   end
 
@@ -1271,9 +1326,85 @@ class Doctor
       end
     end
 
+    checks += check_agent_model_drift(agent_key)
+
     checks
   end
 
+  # agent_model_drift - advisory (never fail) config-vs-frontmatter comparison
+  # for every installed <agent_dir>/agents/plastic-*.md file (intent 170, D1).
+  # Resolution mirrors read-config's own precedence (project override -> global
+  # override -> shipped AgentModels::TIER_DEFAULTS), reusing AgentModels'
+  # `override_map` directly so this stays hermetically DI-testable (no
+  # shell-out to `read-config`, no ENV/global seam). There is no live project
+  # scope at doctor-run time for a globally-installed agent file, so the
+  # project layer is empty here; the resolver still supports one, matching the
+  # same `override_map(project_config:, global_config:)` shape the installer
+  # already calls.
+  #
+  # Classification per installed agent basename:
+  #   - no `agents.models.<basename>` override AND frontmatter == resolved
+  #     default -> pass (clean)
+  #   - no override AND frontmatter != resolved default -> warn (real drift)
+  #   - an override IS configured -> pass/informational, LISTED as a
+  #     sanctioned override, regardless of whether frontmatter matches (that
+  #     mismatch is the override working, e.g. `plastic-brainstorming: fable`)
+  #   - zero installed agent files -> pass (nothing to check)
+  # This check never returns "fail".
+  def check_agent_model_drift(agent_key)
+    agent_config = agents[agent_key]
+    return [] unless agent_config
+
+    agents_dir = File.join(agent_config[:dir], "agents")
+    installed = Dir.glob(File.join(agents_dir, "plastic-*.md")).sort
+
+    if installed.empty?
+      return [check(
+        category: "core_files", name: "agent_model_drift", status: "pass",
+        message: "No installed plastic-* agent files to check for model drift"
+      )]
+    end
+
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml")) || {}
+    overrides = AgentModels.override_map(project_config: {}, global_config: global_config)
+
+    drifted = []
+    sanctioned = []
+
+    installed.each do |path|
+      basename = File.basename(path, ".md")
+      installed_model = (parse_frontmatter(path) || {})["model"]
+      resolved_default = AgentModels::TIER_DEFAULTS[basename]
+      override = overrides[basename]
+
+      if override
+        sanctioned << "#{basename}: frontmatter=#{installed_model.inspect}, sanctioned override=#{override.inspect}"
+      elsif installed_model != resolved_default
+        drifted << "#{basename}: frontmatter=#{installed_model.inspect}, resolved default=#{resolved_default.inspect}"
+      end
+    end
+
+    if drifted.empty?
+      message = if sanctioned.empty?
+                  "No agent-model drift (#{installed.size} installed agent(s) match the resolved default)"
+                else
+                  "No unsanctioned agent-model drift; #{sanctioned.size} sanctioned override(s) in effect"
+                end
+      [check(
+        category: "core_files", name: "agent_model_drift", status: "pass",
+        message: message,
+        details: sanctioned
+      )]
+    else
+      [check(
+        category: "core_files", name: "agent_model_drift", status: "warn",
+        message: "#{drifted.size} installed agent(s) have unsanctioned model drift vs the config-resolved default",
+        details: drifted + sanctioned,
+        fixable: false
+      )]
+    end
+  end
+
   # --- Check category: manifest sync (binary core integrity) ---
 
   # Verify, for BOTH the global manifest and the agent-side manifest, that every
@@ -1801,4 +1932,4 @@ class Doctor
 
 end
 
-Doctor.new.cli(ARGV) if $PROGRAM_NAME == __FILE__
+Doctor.new(plastic_home: ENV.fetch("PLASTIC_HOME") { Doctor::DEFAULT_PLASTIC_HOME }).cli(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/hook-continue

@@ -19,9 +19,9 @@ cockpit, _err, status = Open3.capture3("ruby", dashboard, "continue")
 exit 0 unless status.success? && !cockpit.strip.empty?
 
 context = cockpit.rstrip +
-  "\n\nFollow the plastic-intent-continuing skill workflow to resume: " \
-  "if active intents exist, read their state and resume; otherwise offer the " \
-  "Value×Effort matrix items above, surfacing any stale (Nd) / ⚑ triage intents."
+  "\n\nFollow the plastic-continuing skill workflow to resume: " \
+  "if active intents exist, read their state and resume; otherwise surface the " \
+  "most-valuable next work and any stale or triage intents from the board above."
 
 payload = {
   "hookSpecificOutput" => {

package/scripts/install.rb

@@ -168,4 +168,5 @@ class Install < InstallerCore
   end
 end
 
-exit(Install.new(package_root: ENV["PLASTIC_PACKAGE_ROOT"] || File.expand_path("..", __dir__)).cli(ARGV)) if $PROGRAM_NAME == __FILE__
+exit(Install.new(package_root: ENV["PLASTIC_PACKAGE_ROOT"] || File.expand_path("..", __dir__),
+                 plastic_home: ENV.fetch("PLASTIC_HOME") { InstallerCore::DEFAULT_PLASTIC_HOME }).cli(ARGV)) if $PROGRAM_NAME == __FILE__

package/scripts/lib/bridge.rb

@@ -640,6 +640,75 @@ module Bridge
     lines.length
   end
 
+  # --- Phantom-line detection (intent 134) ------------------------------------
+  #
+  # A companion to the ledger, not a new writer: pure, disk-only, hermetic (no bridge or
+  # session resolution, no writes), matching intent 52's savepoint-decoupling precedent. Under
+  # a gate-routing misfire (bug 131) or an out-of-band merge (124a's precedent), a ledger line
+  # can go stale or duplicate without the file evidence agreeing. This detects, never repairs;
+  # repair is `rebuild_savepoint` (live intents) or the 124a manual Done-bookend recipe
+  # (terminal intents, human-granted only).
+
+  # (stage, milestone) -> basename, for every file-landing milestone this intent_dir could have
+  # produced (the intent file plus the four lifecycle artifacts). Reuses savepoint_milestone so
+  # the mapping never drifts from the one the writer itself uses.
+  def self.savepoint_file_landing_pairs(intent_dir)
+    basenames = [File.basename(intent_file(intent_dir)), "spec.md", "plan.md", "checklist.md", "outcome.md"]
+    basenames.each_with_object({}) do |basename, map|
+      pair = savepoint_milestone(intent_dir, basename)
+      map[pair] = basename if pair
+    end
+  end
+
+  # A `started` state line's real prerequisite is the PRECEDING stage's artifact, not its own
+  # (a `started` line legitimately fires before its own stage's file is real by design). `Exec
+  # started` additionally requires plan.md, since Exec cannot start before How produced it too.
+  SAVEPOINT_STATE_PREREQUISITES = {
+    ["How", "started"] => ["spec.md"],
+    ["Exec", "started"] => ["plan.md", "checklist.md"],
+  }.freeze
+
+  # Raw (stripped) ledger lines whose disk evidence contradicts them, each paired with a short
+  # reason: [line, reason]. Three phantom classes (D5):
+  #   - a file-landing milestone whose file is absent or still a sentinel placeholder;
+  #   - a duplicate (stage, milestone) pair (the later occurrence is the phantom);
+  #   - a state line (`How started` / `Exec started`) whose stage prerequisites are absent.
+  # A clean ledger, or an absent one, returns [].
+  def self.savepoint_phantom_lines(intent_dir)
+    path = File.join(intent_dir, SAVEPOINT_FILE)
+    return [] unless File.exist?(path)
+
+    landing = savepoint_file_landing_pairs(intent_dir)
+    seen = []
+    phantoms = []
+
+    File.read(path).each_line do |raw|
+      line = raw.strip
+      next if line.empty?
+      parts = line.split(/\s{2,}/)
+      next if parts.length < 3
+      pair = [parts[1], parts[2]]
+
+      if seen.include?(pair)
+        phantoms << [line, "duplicate (stage, milestone) pair"]
+        next
+      end
+      seen << pair
+
+      if (basename = landing[pair]) && !stage_file_present?(File.join(intent_dir, basename))
+        phantoms << [line, "milestone file absent or still a sentinel placeholder"]
+        next
+      end
+
+      prereqs = SAVEPOINT_STATE_PREREQUISITES[pair]
+      if prereqs && prereqs.any? { |b| !stage_file_present?(File.join(intent_dir, b)) }
+        phantoms << [line, "state line prerequisite absent on disk"]
+      end
+    end
+
+    phantoms
+  end
+
   def self.derive(session, intent_id:, intent_dir:, store:, name:, tmp: tmp_dir)
     stage = derive_stage(intent_dir)
     has = has_files(intent_dir)
@@ -913,6 +982,18 @@ module Bridge
                   name: name, tmp: tmp)
     data["build"]["auto"] = auto
     data["lock"] = lock_cache(lock_data)
+
+    # Provision the per-intent worktrees so the rebuilt bridge carries
+    # worktree.code (intent 136). Without it, cwd/edited-path selection has no
+    # key: the repaired intent loses its own code gate and a concurrent sibling
+    # wins the tie-break. Idempotent (reuse dir / reattach branch) and fail-open
+    # for non-git / global-only, exactly as `arm` does; never break the repair.
+    begin
+      Worktree.provision(data)
+    rescue => e
+      $stderr.puts "plastic: worktree provision raised during repair, continuing unprovisioned: #{e.message}"
+    end
+
     write(key, data, tmp: tmp)
     actions << "bridge rebuilt from disk (stage #{data['build']['stage']})"
 

package/scripts/lib/dashboard_banner.rb

@@ -26,16 +26,15 @@ module DashboardBanner
     line
   end
 
-  # The id of the top-ranked next_big candidate, when the payload's matrix carries
-  # exactly the shape dashboard.rb emits (a "next_big" list of {id, ...} hashes,
-  # already rank-sorted). Returns nil for any other shape rather than raising.
+  # The id of the top-ranked "drive" candidate, when the payload's next_work list
+  # carries the shape dashboard.rb emits (an Array of {id, disposition, ...}
+  # hashes, already rank-sorted). Returns nil for any other shape rather than
+  # raising.
   def next_big_thing_id(payload)
-    matrix = payload["matrix"]
-    return nil unless matrix.is_a?(Hash)
-    list = matrix["next_big"]
-    return nil unless list.is_a?(Array) && !list.empty?
-    top = list.first
-    return nil unless top.is_a?(Hash)
+    list = payload["next_work"]
+    return nil unless list.is_a?(Array)
+    top = list.find { |entry| entry.is_a?(Hash) && entry["disposition"] == "drive" }
+    return nil unless top
     id = top["id"].to_s
     id.empty? ? nil : id
   end

package/scripts/lib/installer_core.rb

@@ -12,7 +12,7 @@ require_relative "agent_models"
 # Shared installer machinery, instantiable with injected package root / store / agent
 # map so the verb scripts (install/update/uninstall/rollback) and their tests can run
 # hermetically (no eval, no global-constant rewriting). Mirrors the DI recipe proven in
-# doctor.rb / install.rb (intents 30a, 30a1). Library only — no CLI, no $PROGRAM_NAME guard.
+# doctor.rb / install.rb (intents 30a, 30a1). Library only - no CLI, no $PROGRAM_NAME guard.
 class InstallerCore
   DEFAULT_PLASTIC_HOME = File.join(Dir.home, ".plastic")
 
@@ -54,7 +54,7 @@ class InstallerCore
     STABILITY[ch] || 2
   end
 
-  # --- Semver (§11) — parse/compare, shared by update + rollback ---
+  # --- Semver (§11) - parse/compare, shared by update + rollback ---
 
   def semver_parse(version)
     m = /\A(\d+)\.(\d+)\.(\d+)(?:-(.+))?\z/.match(version.to_s.strip)
@@ -95,7 +95,7 @@ class InstallerCore
     semver_compare(a, b) == 1
   end
 
-  # --- versions.json ledger (append-only JSONL — one object per line) ---
+  # --- versions.json ledger (append-only JSONL - one object per line) ---
 
   def ledger_path
     File.join(plastic_home, "versions.json")
@@ -242,6 +242,7 @@ class InstallerCore
       "scripts/lib/qmd_hook.rb" => "scripts/lib/qmd_hook.rb",
       "scripts/lib/power_tools.rb" => "scripts/lib/power_tools.rb",
       "scripts/lib/agent_models.rb" => "scripts/lib/agent_models.rb",
+      "scripts/lib/release_guard.rb" => "scripts/lib/release_guard.rb",
       "scripts/hook-code-gate" => "scripts/hook-code-gate",
       "scripts/hook-lock-gate" => "scripts/hook-lock-gate",
       "scripts/hook-bash-gate" => "scripts/hook-bash-gate",
@@ -260,6 +261,10 @@ class InstallerCore
       "scripts/lib/dashboard_banner.rb" => "scripts/lib/dashboard_banner.rb",
       "scripts/lib/qmd_sync.rb" => "scripts/lib/qmd_sync.rb",
       "scripts/qmd-sync" => "scripts/qmd-sync",
+      "scripts/lib/roadmap_savepoint.rb" => "scripts/lib/roadmap_savepoint.rb",
+      "scripts/roadmap-savepoint" => "scripts/roadmap-savepoint",
+      "scripts/lib/roadmap_queue.rb" => "scripts/lib/roadmap_queue.rb",
+      "scripts/roadmap-next" => "scripts/roadmap-next",
       "scripts/lib/intent_validator.rb" => "scripts/lib/intent_validator.rb",
       "scripts/lib/graph_rebuild.rb" => "scripts/lib/graph_rebuild.rb",
       "scripts/lib/frontmatter_writer.rb" => "scripts/lib/frontmatter_writer.rb",
@@ -271,6 +276,7 @@ class InstallerCore
       "scripts/rebuild-graph" => "scripts/rebuild-graph",
       "scripts/validate-intent" => "scripts/validate-intent",
       "scripts/new-intent" => "scripts/new-intent",
+      "scripts/end-intent" => "scripts/end-intent",
       "scripts/hook-create-gate" => "scripts/hook-create-gate",
       "templates/intent.md" => "templates/intent.md",
       "templates/spec.md" => "templates/spec.md",
@@ -287,6 +293,7 @@ class InstallerCore
       "scripts/update.rb" => "scripts/update.rb",
       "scripts/uninstall.rb" => "scripts/uninstall.rb",
       "scripts/rollback.rb" => "scripts/rollback.rb",
+      "scripts/lib/legacy_bookend_amnesty.rb" => "scripts/lib/legacy_bookend_amnesty.rb",
       "scripts/doctor.rb" => "scripts/doctor.rb",
       "scripts/dashboard.rb" => "scripts/dashboard.rb",
     }

package/scripts/lib/legacy_bookend_amnesty.rb

@@ -0,0 +1,35 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# Intent 170a - A2 cutoff amnesty for the legacy savepoint Done-bookend gap.
+#
+# Frozen 2026-07-10. Pre-161 terminal intents predate
+# Bridge.append_terminal_savepoint, so their savepoint.md never got a
+# `Done delivered|abandoned` line. This list grandfathers exactly those,
+# keyed by store scope plus intent id, so doctor's signals_complete check
+# stops counting them as gaps. Every intent NOT on this list still warns if
+# its savepoint lacks the Done bookend, including any new terminal intent
+# going forward. This is a frozen historical snapshot: it must never grow.
+# Regenerating it requires re-running the exact predicate below against the
+# real store and reviewing the diff, never appending ad hoc.
+#
+# Predicate used to build this list (2026-07-10): for each store in
+# Doctor#done_signal_stores(nil), each dir in index_sections_by_dir(index),
+# terminal = the dir's INDEX section is Completed or Abandoned, gap =
+# savepoint.md exists AND does not match
+# /\bDone\b.*\b(delivered|abandoned)\b/.
+#
+# This does NOT grandfather the separate outcome.md completeness gap
+# (checked independently at scripts/doctor.rb:603-607); some of these ids
+# may still warn on that axis.
+module LegacyBookendAmnesty
+  LIST = {
+    "global" => %w[1a 1a2 23].freeze,
+    "project:plastic" => %w[
+      1 11 121a 124 128 13 13b 15 158 158a 159 160 163 1a 1b1a3 22 30a1a 34
+      36a 36a1 37 38 39 45 45a 49 4a 4a1 4a1c1 50 52 54 55 56 58 59 60b 65
+      66 66a 66b 66c 66c1 67 68 71 72 73b 73c 73c1 73c2 73c3 74 77 79 80 83
+      84 85a 9
+    ].freeze,
+  }.freeze
+end