@zalom/plastic 1.14.0 → 2.0.0-alpha.1

package/scripts/doctor.rb

@@ -21,7 +21,7 @@ require_relative "lib/store_discovery"
 require_relative "lib/links_projection"
 require_relative "lib/links_section"
 require_relative "lib/lock"
-require_relative "lib/bridge"
+require_relative "lib/savepoint"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
 require_relative "lib/skill_lint"
@@ -29,6 +29,7 @@ require_relative "lib/config_asks"
 require_relative "lib/power_tools"
 require_relative "lib/preflight"
 require_relative "lib/ruby_probe"
+require_relative "lib/doctor_session_ledger"
 
 # Diagnostic engine, instantiable with an injected store/agent map so tests can
 # run it hermetically (no eval, no global-constant rewriting).
@@ -37,6 +38,7 @@ require_relative "lib/ruby_probe"
 # store, conventions, intent and CLI halves, so Doctor stays one class with one
 # public surface.
 class Doctor
+  include DoctorSessionLedger
 
   REQUIRED_INDEX_SECTIONS = ["## Active", "## Future", "## Clusters", "## Abandoned", "## Completed"].freeze
 
@@ -431,7 +433,7 @@ class Doctor
         message: "#{bad_sections.size} intent file(s) have non-sanctioned ## sections",
         details: bad_sections.map { |b| "#{b[:dir]}: #{b[:issues].join(", ")}" },
         fixable: true,
-        fix_hint: "Dispatch plastic-store-curating to relocate each unsanctioned section into the " \
+        fix_hint: "Relocate each unsanctioned section into the " \
                   "intent's revisions.md via move-and-record (a missing required section is restored " \
                   "or reprojected instead); see plastic-conventions > references/maintenance-and-revisions.md"
       )
@@ -553,9 +555,9 @@ class Doctor
 # suppress) is exactly what makes the row dead.
 def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, active:, excluded_rules: [])
   outcome = File.join(dir, "outcome.md")
-  outcome_real = Bridge.stage_file_present?(outcome)
+  outcome_real = Savepoint.stage_file_present?(outcome)
   findings = { conflict: nil, phantom: nil, gap: [], operational_gap: [], excluded: [],
-               excluded_rules_fired: [], stalled: nil }
+               excluded_rules_fired: [], stalled: nil, unbackfilled: [], excluded_backfill: [] }
 
   # HARD conflict: the deliverable exists but INDEX still says Active. This
   # is the one true INDEX-wins disagreement, so it stays a fail.
@@ -569,7 +571,7 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
   # the generic replacement for the frozen 170a amnesty list is simply "never suppress" -
   # the message already labels a terminal phantom report-only, so dropping the id-based
   # suppression is strictly more general and needs no per-store state at all).
-  phantom_lines = Bridge.savepoint_phantom_lines(dir)
+  phantom_lines = Savepoint.savepoint_phantom_lines(dir)
   if phantom_lines.any?
     detail = phantom_lines.map { |line, reason| "#{line} (#{reason})" }.join("; ")
     scope_note = terminal ? "terminal in INDEX, report-only (immutable history)" : "live intent, auto-rebuildable"
@@ -583,7 +585,7 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
   if terminal && !outcome_real
     state = File.exist?(outcome) ? "still a placeholder" : "missing"
     findings[:gap] << "#{label}: terminal in INDEX but outcome.md is #{state} " \
-                     "(delivery claim - never fabricated)"
+                     "(delivery claim; written at close by end-intent since intent 308)"
   end
 
   if terminal
@@ -603,6 +605,21 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
     end
     findings[:excluded_rules_fired] << "savepoint_operational" if suppressed && findings[:excluded].any?
 
+    # Unbackfilled documents (intent 308): spec.md or plan.md missing or still the
+    # placeholder, or no real action file, on a terminal intent. Every one of these is
+    # written from the record by `scaffold-intent backfill`, so this is repairable and
+    # reported as a fixable warn (backfilled_complete). Its exclusions go to their OWN
+    # bucket so savepoint_operational's consumed/dead-row bookkeeping above never sees them.
+    backfill_gaps = %w[spec.md plan.md].reject { |f| Savepoint.stage_file_present?(File.join(dir, f)) }
+    backfill_gaps << "actions/" unless Savepoint.has_real_action?(dir)
+    if backfill_gaps.any?
+      suppressed_backfill = excluded_rules.include?("backfilled_complete")
+      target = suppressed_backfill ? findings[:excluded_backfill] : findings[:unbackfilled]
+      target << "#{label}: terminal in INDEX but #{backfill_gaps.join(", ")} " \
+                "#{backfill_gaps.size == 1 ? "is" : "are"} missing or still a placeholder (backfillable)"
+      findings[:excluded_rules_fired] << "backfilled_complete" if suppressed_backfill
+    end
+
     # Stalled completion: unchanged, never consulted amnesty.
     if File.exist?(Lock.path(dir))
       note = Lock.fresh?(dir) ? "delivery.lock still present (post-done window not closed)"
@@ -626,6 +643,9 @@ def check_done_signals(scopes: nil)
   dead_row_paths = []
   stalled = []
   phantoms = []
+  unbackfilled = []       # spec/plan/actions gaps on terminal intents (intent 308) - repairable
+  excluded_backfill = []  # backfill gaps knowingly exempted via doctor-exclusions (intent 308)
+  dead_rows_by_rule = Hash.new { |h, k| h[k] = [] }
 
   done_signal_stores(scopes).each do |store|
     exclusions = DoctorExclusions.load(store[:index])
@@ -634,7 +654,7 @@ def check_done_signals(scopes: nil)
       exclusion_error_paths << exclusions[:path]
     end
 
-    consumed = { "savepoint_operational" => [] }
+    consumed = { "savepoint_operational" => [], "backfilled_complete" => [] }
     # `known_ids` (post-review fix): every intent id with a REAL DIRECTORY in this store, scanned
     # directly from disk - independent of INDEX.md. An id can have a directory on disk without
     # being listed in INDEX (a de-indexed "ghost"), and the walk below alone would never visit it;
@@ -672,6 +692,11 @@ def check_done_signals(scopes: nil)
       phantoms << findings[:phantom] if findings[:phantom]
       gaps.concat(findings[:gap])
       operational_gaps.concat(findings[:operational_gap])
+      unbackfilled.concat(findings[:unbackfilled])
+      if findings[:excluded_backfill].any?
+        excluded_backfill.concat(findings[:excluded_backfill])
+        exclusion_paths << exclusions[:path]
+      end
       if findings[:excluded].any?
         excluded.concat(findings[:excluded])
         exclusion_paths << exclusions[:path]
@@ -692,7 +717,9 @@ def check_done_signals(scopes: nil)
                else
                  "names an intent with no current #{row[:rule]} finding"
                end
-      dead_rows << "#{store[:scope]}: #{exclusions[:path]}: #{row[:rule]} #{row[:id]} - #{reason}"
+      dead_row = "#{store[:scope]}: #{exclusions[:path]}: #{row[:rule]} #{row[:id]} - #{reason}"
+      dead_rows << dead_row
+      dead_rows_by_rule[row[:rule]] << dead_row
       dead_row_paths << exclusions[:path]
     end
   end
@@ -733,7 +760,7 @@ def check_done_signals(scopes: nil)
     checks << check(
       category: "done_signals", name: "signals_complete", status: "pass",
       message: "#{gaps.size} terminal intent#{gaps.size == 1 ? "" : "s"} missing a real outcome.md " \
-               "(delivery claim - never fabricated; informational only, does not affect doctor's exit code)",
+               "(delivery claim; end-intent writes outcome.md at close since intent 308, so this is pre-308 history or a close outside end-intent; informational only, does not affect doctor's exit code)",
       details: gaps
     )
   end
@@ -750,10 +777,19 @@ def check_done_signals(scopes: nil)
   # suppressed nothing this run. It is purely informational, exactly like `exclusion_suffix` - it
   # never changes status on any of the three branches below, because a stale governance-record row
   # is bookkeeping drift, not a store regression (219 D6 is untouched: no disposition is invented).
-  exclusion_suffix = excluded.empty? ? "" : " (#{excluded.size} excluded via #{exclusion_paths.join(", ")})"
-  dead_suffix = dead_rows.empty? ? "" : " (#{dead_rows.size} dead row#{dead_rows.size == 1 ? "" : "s"} " \
-                                        "in #{dead_row_paths.join(", ")}, suppressing nothing - prune with " \
-                                        "`maintenance-run --tool register-exclusions --prune`)"
+  # Per rule (intent 308): savepoint_operational and backfilled_complete each fold in only
+  # their own exclusions and dead rows, so one check never carries the other's counts.
+  suffixes = lambda do |excluded_rows, dead|
+    ex = excluded_rows.empty? ? "" : " (#{excluded_rows.size} excluded via #{exclusion_paths.join(", ")})"
+    dd = dead.empty? ? "" : " (#{dead.size} dead row#{dead.size == 1 ? "" : "s"} " \
+                            "in #{dead_row_paths.join(", ")}, suppressing nothing - prune with " \
+                            "`maintenance-run --tool register-exclusions --prune`)"
+    [ex, dd]
+  end
+  savepoint_dead = dead_rows_by_rule["savepoint_operational"]
+  backfill_dead = dead_rows_by_rule["backfilled_complete"]
+  exclusion_suffix, dead_suffix = suffixes.call(excluded, savepoint_dead)
+  backfill_exclusion_suffix, backfill_dead_suffix = suffixes.call(excluded_backfill, backfill_dead)
 
   if exclusion_errors.any?
     checks << check(
@@ -762,7 +798,7 @@ def check_done_signals(scopes: nil)
                "missing an operational savepoint.md or its Done echo, and " \
                "#{exclusion_errors.size} doctor-exclusions error#{exclusion_errors.size == 1 ? "" : "s"} " \
                "(a malformed exclusion file never suppresses a finding)#{exclusion_suffix}#{dead_suffix}",
-      details: operational_gaps + exclusion_errors + dead_rows, fixable: true,
+      details: operational_gaps + exclusion_errors + savepoint_dead, fixable: true,
       fix_hint: "Fix the malformed doctor-exclusions file(s) (#{exclusion_error_paths.join(", ")}) - " \
                 "format `rule_name id id id`, blank lines and # comments ignored - then reconstruct " \
                 "any remaining real gap via `maintenance-run --tool rebuild-savepoint --intent <id> " \
@@ -774,7 +810,7 @@ def check_done_signals(scopes: nil)
       category: "done_signals", name: "savepoint_operational", status: "pass",
       message: "No terminal intent is missing an operational savepoint.md or its Done echo" \
                "#{exclusion_suffix}#{dead_suffix}",
-      details: dead_rows
+      details: savepoint_dead
     )
   else
     checks << check(
@@ -782,13 +818,50 @@ def check_done_signals(scopes: nil)
       message: "#{operational_gaps.size} terminal intent#{operational_gaps.size == 1 ? "" : "s"} " \
                "missing an operational savepoint.md or its Done echo (reconstructible)" \
                "#{exclusion_suffix}#{dead_suffix}",
-      details: operational_gaps + dead_rows, fixable: true,
+      details: operational_gaps + savepoint_dead, fixable: true,
       fix_hint: "Reconstruct the minimal two-line started/Done echo via " \
                 "`maintenance-run --tool rebuild-savepoint --intent <id> --apply` (197-conformant: " \
                 "receipt-before-write via RevisionsWriter, one intent per invocation, owner-approval-gated)."
     )
   end
 
+  # backfilled_complete (intent 308): spec.md, plan.md, or a real action file missing on a
+  # terminal intent. Same three branches as savepoint_operational: a malformed exclusion
+  # file is always loud, a clean set passes with its own exclusion and dead-row counts
+  # folded in, a real gap set warns with the backfill verb as the fix.
+  backfill_hint = "Write the missing documents from the record via " \
+                  "`scaffold-intent backfill --store <store> --id <id> --disposition " \
+                  "<delivered|abandoned>` (never touches real content, one intent per invocation)."
+  if exclusion_errors.any?
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "warn",
+      message: "#{unbackfilled.size} terminal intent#{unbackfilled.size == 1 ? "" : "s"} " \
+               "missing a backfillable document, and #{exclusion_errors.size} doctor-exclusions " \
+               "error#{exclusion_errors.size == 1 ? "" : "s"} (a malformed exclusion file never " \
+               "suppresses a finding)#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: unbackfilled + exclusion_errors + backfill_dead, fixable: true,
+      fix_hint: "Fix the malformed doctor-exclusions file(s) (#{exclusion_error_paths.join(", ")}), " \
+                "then write the missing documents from the record via `scaffold-intent backfill " \
+                "--store <store> --id <id> --disposition <delivered|abandoned>`."
+    )
+  elsif unbackfilled.empty?
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "pass",
+      message: "Every terminal intent carries a real spec.md, plan.md, and action file" \
+               "#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: backfill_dead
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "warn",
+      message: "#{unbackfilled.size} terminal intent#{unbackfilled.size == 1 ? "" : "s"} " \
+               "missing a backfillable document (spec.md, plan.md, or a real action file)" \
+               "#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: unbackfilled + backfill_dead, fixable: true,
+      fix_hint: backfill_hint
+    )
+  end
+
   if stalled.empty?
     checks << check(
       category: "done_signals", name: "stalled_completion", status: "pass",
@@ -818,8 +891,8 @@ def check_done_signals(scopes: nil)
       message: "#{phantoms.size} intent#{phantoms.size == 1 ? "" : "s"} carry savepoint.md " \
                "line(s) contradicted by disk (advisory; terminal history stays report-only)",
       details: phantoms, fixable: true,
-      fix_hint: "For a live (Active) intent, run plastic-intent-savepoint to rebuild via " \
-                "Bridge.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
+      fix_hint: "For a live (Active) intent, rebuild the ledger via " \
+                "Savepoint.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
                 "a phantom there stays advisory unless an explicit human grant authorizes the " \
                 "124a manual Done-bookend repair."
     )
@@ -991,9 +1064,9 @@ end
   INTENT_END_LIFECYCLE_FILES = %w[spec.md plan.md checklist.md outcome.md].freeze
 
   def intent_lifecycle_artifacts_check(intent_dir, disposition)
-    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Bridge.stage_file_present?(File.join(intent_dir, f)) }
-    unless Bridge.stage_file_present?(Bridge.intent_file(intent_dir))
-      missing = [File.basename(Bridge.intent_file(intent_dir))] + missing
+    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Savepoint.stage_file_present?(File.join(intent_dir, f)) }
+    unless Savepoint.stage_file_present?(Savepoint.intent_file(intent_dir))
+      missing = [File.basename(Savepoint.intent_file(intent_dir))] + missing
     end
 
     outcome_note = nil
@@ -1014,7 +1087,7 @@ end
 
   def intent_checklist_complete_check(intent_dir)
     path = File.join(intent_dir, "checklist.md")
-    unless Bridge.stage_file_present?(path)
+    unless Savepoint.stage_file_present?(path)
       return check(category: "intent_end", name: "intent_checklist_complete", status: "pass",
                     message: "n/a: checklist.md absent or placeholder (flagged above if that is a gap)")
     end
@@ -1074,7 +1147,8 @@ end
   # Terminal-gated (281 D3): done_signal_findings_for_dir only ever produces this finding
   # inside `if terminal`, so honoring the exclusion for a still-Active intent would suppress a
   # strictly larger set of facts than the rule id names - and would let a mistyped id silence
-  # the live, repairable warning scripts/end-intent's pre-write gate exists to raise.
+  # the live, repairable warning scripts/end-intent's structure self-check exists to raise
+  # (a report, never a refusal, since intent 308).
   #
   # Never raises: DoctorExclusions is fail-open by contract (274 D5) and index_sections_by_dir
   # returns an empty map for a missing INDEX.
@@ -1131,9 +1205,9 @@ end
     first_line = File.read(savepoint).each_line.find { |l| !l.strip.empty? }.to_s.strip
     parts = first_line.split(/\s{2,}/)
     born_pair = parts.length >= 3 ? [parts[1], parts[2]] : nil
-    expected_pair = Bridge.savepoint_milestone(intent_dir, File.basename(Bridge.intent_file(intent_dir)))
+    expected_pair = Savepoint.savepoint_milestone(intent_dir, File.basename(Savepoint.intent_file(intent_dir)))
 
-    phantoms = Bridge.savepoint_phantom_lines(intent_dir)
+    phantoms = Savepoint.savepoint_phantom_lines(intent_dir)
     problems = []
     problems << "born line #{born_pair.inspect} does not match the expected #{expected_pair.inspect}" \
       if born_pair != expected_pair
@@ -1147,7 +1221,7 @@ end
       check(category: "intent_end", name: "intent_savepoint_truthful", status: "warn",
             message: "#{problems.size} savepoint truthfulness issue(s) (advisory, never blocking)",
             details: problems,
-            fixable: true, fix_hint: "Run plastic-intent-savepoint to rebuild via Bridge.rebuild_savepoint")
+            fixable: true, fix_hint: "Rebuild the ledger via Savepoint.rebuild_savepoint")
     end
   end
 
@@ -1270,7 +1344,7 @@ end
     checks << graph_finding_check(
       "graph_i4_danglers", i4,
       "Every sources/chain id resolves to a real intent (I4)",
-      "Dispatch plastic-store-curating to record the dangling sources/chain edge as a " \
+      "Record the dangling sources/chain edge as a " \
       "broken-source/broken-chain move-and-record entry in the intent's revisions.md (see " \
       "plastic-conventions > references/maintenance-and-revisions.md), or restore the missing intent"
     )
@@ -1297,18 +1371,6 @@ end
 
 
 
-  # claude_hooks_implemented (intent 244, the Claude twin of intent 200's Codex
-  # check): the edit-path gates now live as branches inside one dispatcher,
-  # which is exactly the shape that let links-gate ship registered and dead on
-  # Codex. HookRegistry::GATE_TOOLS is the registry side; scripts/hook-edit-gates
-  # is the implementation side. Checked in BOTH directions, so a registered gate
-  # with no branch (always allows, silently) and a branch nobody registers
-  # (dead code) are both reported.
-  #
-  # Read as plain text, never required: the dispatcher has top-level side effects
-  # (it reads $stdin and exits), the same reason codex_dispatcher_gate_names reads
-  # scripts/codex-hook as text.
-
   # Plastic skills install as ~/.claude/skills/plastic-<name>/SKILL.md. Pass if at
   # least one such skill is present.
 
@@ -1357,7 +1419,7 @@ end
   # dispatcher is an executable script with real top-level side effects (it reads
   # $stdin and may exit), so it can never be required or executed to introspect it,
   # only read as plain text, mirroring codex_agent_toml_well_formed? above. Pulls
-  # gate names from the STATE_HOOKS and SHELL_HOOKS %w[] literals, plus the `when
+  # hook names from the STATE_HOOKS %w[] literal, plus the `when
   # "<name>"` labels of the top-level `case gate` statement (stopping at its
   # trailing `else`). Line-shape dependent, not AST-safe, disclosed as such in
   # docs; the healthy-install pass test against the REAL dispatcher is what proves
@@ -1407,7 +1469,7 @@ end
   # Classification per installed agent basename, checked in this order:
   #   1. an `agents.models.<basename>` override IS configured -> sanctioned,
   #      pass/informational, LISTED regardless of whether frontmatter matches
-  #      (that mismatch is the override working, e.g. plastic-brainstorming: fable).
+  #      (that mismatch is the override working, e.g. plastic-executor: fable).
   #   2. no override AND basename is a TIER_DEFAULTS key -> compare frontmatter
   #      to that default; match is pass (clean), mismatch is real drift (warn).
   #   3. no override AND basename is a CONSULTATION_AGENTS member -> not a
@@ -2178,6 +2240,7 @@ end
     all_checks += check_qmd
     all_checks += check_ruby_runtime
     all_checks += check_done_signals(scopes: ["global"])
+    all_checks += check_session_ledger(scopes: ["global"])
     all_checks += check_skill_lint
     all_checks += check_install_integrity
 
@@ -2228,10 +2291,10 @@ end
       case store
       when :all
         check_global_store + check_project_stores + check_conventions + check_done_signals +
-          check_qmd(detector: qmd_detector, runner: qmd_runner)
+          check_session_ledger + check_qmd(detector: qmd_detector, runner: qmd_runner)
       when :global
         check_global_store + check_conventions(scopes: ["global"]) +
-          check_done_signals(scopes: ["global"]) +
+          check_done_signals(scopes: ["global"]) + check_session_ledger(scopes: ["global"]) +
           check_qmd(detector: qmd_detector, runner: qmd_runner, collection: "plastic-global")
       else
         all_checks_for_project_slug(store, qmd_detector: qmd_detector, qmd_runner: qmd_runner,

package/scripts/end-intent

@@ -28,8 +28,12 @@
 #      file that exists while no session identity resolves from ANY source
 #      also refuses (exit 4) rather than ever reaching Lock.takeover with a
 #      blank session, which would delete the lock file and then crash.
-#   1. Guard outcome.md (exit 2, authors nothing, on any failure), then stamp
-#      the intent file's `## Outcome` section with --outcome-summary if given.
+#   1. Backfill (intent 308): write spec.md, plan.md, actions/ACTION_1.md, and
+#      outcome.md from the record wherever a file is missing or still the
+#      placeholder (BackfillIntent; real content is never touched). Then run
+#      doctor's per-intent structure check and OutcomeGuard as a self-check
+#      that reports on stderr and proceeds. Then stamp the intent file's
+#      `## Outcome` section with --outcome-summary if given.
 #   2. Move the intent's INDEX.md line from `## Active` into `## Completed`
 #      (delivered) or `## Abandoned` (abandoned), dated today, appending
 #      --index-note (if given). Accepts a real em dash OR a plain hyphen as
@@ -37,23 +41,21 @@
 #      always EMITS the real em dash on write. An id that resolves to neither
 #      `## Active` nor the terminal section is a loud failure (exit 1); an id
 #      already correctly in the terminal section is a quiet, idempotent success.
-#   3. Append the savepoint `Done` bookend (Bridge.append_terminal_savepoint).
+#   3. Append the savepoint `Done` bookend (Savepoint.append_terminal_savepoint).
 #   4. Commit the store repo, unless --no-commit.
-#   5. Disarm (intent 188, D2/D16): check the code worktree (resolved from the
-#      bridge) for uncommitted changes first (exit 5 if dirty, unless
-#      --discard-worktree-changes); call the disarm seam (default
-#      Bridge.disarm_auto); verify the durable lock file is actually gone
-#      afterward. The /tmp bridge is only a cache (AGENTS.md): when no bridge
-#      resolves at all (a wiped /tmp, a resumed job under a new session id),
-#      the durable lock file is released directly instead, LOUDLY (a warning
-#      that a worktree may be orphaned), rather than stranding a committed,
-#      terminal intent still holding its lock.
+#   5. Disarm (intent 188, D2/D16; intent 307): check the code worktree (derived
+#      from projects.yml and the intent id, Arm.worktree_block) for uncommitted
+#      changes first (exit 5 if dirty, unless --discard-worktree-changes); call the
+#      disarm seam (default Arm.disarm: worktree released, lock cleared, the session
+#      pointer back on the day ledger); verify the durable lock file is actually gone
+#      afterward, and release it directly when a foreign-keyed disarm left it (the
+#      /tmp bridge this step once read was removed in 2.0, intent 307).
 #
 # Exit codes:
 #   0  ok - the intent is closed and no delivery.lock remains.
 #   1  usage/resolution failure, OR an id that resolves to neither ## Active
 #      nor the terminal section (D11). Deliberately double duty; see plan.md.
-#   2  the outcome.md guard refused; authors nothing.
+#   2  retired in 2.0 (intent 308): the outcome.md guard reports and proceeds.
 #   3  steps 1-4 already committed, but the delivery lock genuinely could not
 #      be cleared (not a bridge cache miss; see step 5 above).
 #   4  pre-flight refusal: a FRESH foreign lock is held by a live,
@@ -63,19 +65,19 @@
 #      (git status itself failed: corrupt index, git missing, not a repo);
 #      refused before removal; pass --discard-worktree-changes to override
 #      deliberately.
-#   6  the doctor per-intent structure gate refused (checklist incomplete,
-#      links out of projection, intent-file malformed, or a lifecycle artifact
-#      missing/placeholder); named reasons on stderr; authors nothing
-#      (intent 222).
+#   6  retired in 2.0 (intent 308): the structure check reports and proceeds.
 
 require "fileutils"
 require "date"
 require "open3"
 require "pathname"
 require_relative "lib/bridge"
+require_relative "lib/arm"
+require_relative "lib/savepoint"
 require_relative "lib/lock"
 require_relative "lib/intent_validator"
 require_relative "lib/outcome_guard"
+require_relative "lib/backfill_intent"
 
 DISPOSITIONS = %w[delivered abandoned].freeze
 
@@ -169,44 +171,41 @@ def resolve_plastic_home_and_scope(store)
   end
 end
 
-# Doctor's per-intent structure gate (intent 222), a pre-write step: FAIL refuses the close
-# (exit 6, authors nothing), WARN prints an advisory note and proceeds, PASS proceeds
-# silently, and an unexpected exception from the gate call itself is rescued and treated as
-# a skipped gate (fail-open on a crash: a broken gate must never wedge a close).
-#
-# `gate:` is an injected seam (mirrors run_disarm's own bridge_reader:/disarm: pattern
-# below) defaulting to the real Doctor.new(...).run_intent_check(...) call; tests load this
-# script in-process (as test/end_intent_disarm_toctou_test.rb already does for run_disarm)
-# and inject a raising stub to prove the fail-open contract, with no eval/ENV/global seam.
+# Backfill (intent 308): write the judgment documents that are missing or still the
+# placeholder from the record (BackfillIntent). Fail-open: a crash here warns and the
+# close proceeds, the same contract as the structure check below.
+def run_backfill(intent_dir, store:, id:, disposition:, summary:)
+  result = BackfillIntent.run(intent_dir: intent_dir, store: store, id: id,
+                              disposition: disposition, summary: summary)
+  result[:written].each { |rel| warn "end-intent: backfilled #{rel} from the record" }
+  result[:notes].each { |note| warn "end-intent: backfill note: #{note}" }
+rescue StandardError => e
+  warn "end-intent: backfill crashed (#{e.message}); proceeding without it"
+end
+
+# Doctor's per-intent structure check (intent 222; a self-check since intent 308). Runs
+# after the backfill and REPORTS: every FAIL or WARN check prints its named reason on
+# stderr and the close proceeds. Nothing here exits; a gap end-intent cannot write itself
+# (an unchecked box, a malformed intent file, links out of projection) is the owner's to
+# fix afterward, and doctor --intent keeps reporting it. A crash is rescued the same way.
+# Injected `gate:` seam: tests drive the real Doctor against a hermetic home, or a raising
+# stub to prove the fail-open contract, with no eval/ENV/global seam.
 #
-# Disposition is deliberately NOT passed to the real gate call (intent 222 executor
-# decision): the existing outcome-only guard immediately following this call already owns
-# disposition-matching (exit 2), and intent_lifecycle_artifacts unconditionally checks
-# outcome.md PRESENCE via Bridge.stage_file_present? regardless of disposition, so passing
-# it here would make this gate re-check the SAME disposition match the old guard already
-# owns, needlessly widening which exit-2 fixtures become exit-6. doctor.rb --intent called
-# directly (with --disposition) still exercises the fold-in per D2/acceptance criteria.
-def run_structure_gate(id, store:, gate: ->(gate_home, gate_scope) {
+# Disposition is deliberately NOT passed to the real gate call: OutcomeGuard.reason,
+# called right after this in main, already owns disposition-matching, and
+# intent_lifecycle_artifacts checks outcome.md PRESENCE regardless of disposition.
+def run_structure_check(id, store:, gate: ->(gate_home, gate_scope) {
   require_relative "doctor"
   Doctor.new(plastic_home: gate_home).run_intent_check(id, store: gate_scope)
 })
   gate_home, gate_scope = resolve_plastic_home_and_scope(store)
-  gate_verdict = gate.call(gate_home, gate_scope)
-  case gate_verdict[:status]
-  when "fail"
-    gate_verdict[:checks].select { |c| c[:status] == "fail" }.each do |c|
-      detail = Array(c[:details]).any? ? " (#{Array(c[:details]).join("; ")})" : ""
-      warn "end-intent: structure gate refused: #{c[:name]}: #{c[:message]}#{detail}"
-    end
-    exit 6
-  when "warn"
-    gate_verdict[:checks].select { |c| c[:status] == "warn" }.each do |c|
-      detail = Array(c[:details]).any? ? " (#{Array(c[:details]).join("; ")})" : ""
-      warn "end-intent: structure gate warning (proceeding): #{c[:name]}: #{c[:message]}#{detail}"
-    end
+  verdict = gate.call(gate_home, gate_scope)
+  verdict[:checks].select { |c| %w[fail warn].include?(c[:status]) }.each do |c|
+    detail = Array(c[:details]).any? ? " (#{Array(c[:details]).join("; ")})" : ""
+    warn "end-intent: structure check: #{c[:name]}: #{c[:message]}#{detail}"
   end
 rescue StandardError => e
-  warn "end-intent: structure gate crashed (#{e.message}); proceeding without it"
+  warn "end-intent: structure check crashed (#{e.message}); proceeding without it"
 end
 
 # outcome.md guard: see OutcomeGuard.reason (scripts/lib/outcome_guard.rb, extracted intent 222)
@@ -459,21 +458,21 @@ end
 
 # --- step 5: disarm (D2/D16, intent 188) ------------------------------------
 #
-# Injected seams (D2): bridge_reader defaults to the real Bridge.read (so the
-# dirty-worktree check can resolve the code worktree path without disarming
-# first), disarm defaults to the real Bridge.disarm_auto. Tests may inject
+# Injected seams (D2, re-pointed by intent 307): worktree_reader defaults to
+# Arm.worktree_block (so the dirty-worktree check can resolve the code worktree
+# path without disarming first), disarm defaults to Arm.disarm. Tests may inject
 # fakes for in-process unit coverage of this function; the subprocess-driven
 # end-to-end tests exercise the real defaults against a hermetic tmp home.
 #
 # Returns :ok, :dirty (exit 5), or :lock_remains (exit 3). A blank session
 # (D3's "no lock at all" fallback case) is a clean no-op: :ok, nothing touched.
 def run_disarm(intent_dir, id, session, discard_worktree_changes:,
-               bridge_reader: ->(sess, iid) { Bridge.read(sess, intent_id: iid) },
-               disarm: ->(sess, iid) { Bridge.disarm_auto(sess, intent_id: iid) })
+               worktree_reader: ->(dir) { Arm.worktree_block(intent_dir: dir) },
+               disarm: ->(sess, dir) { Arm.disarm(intent_dir: dir, session: sess) })
   return :ok if Bridge.blank?(session)
 
-  data = bridge_reader.call(session, id)
-  worktree_code = data.is_a?(Hash) ? data.dig("worktree", "code") : nil
+  block = worktree_reader.call(intent_dir)
+  worktree_code = block.is_a?(Hash) ? block["code"] : nil
 
   if worktree_code && Dir.exist?(worktree_code)
     begin
@@ -505,16 +504,15 @@ def run_disarm(intent_dir, id, session, discard_worktree_changes:,
     end
   end
 
-  disarm.call(session, id)
+  disarm.call(session, intent_dir)
 
-  # The /tmp bridge is only a cache; the durable lock file is the truth
-  # (AGENTS.md). `disarm_auto` no-ops entirely when no bridge resolves (a wiped
-  # /tmp, a resumed job under a new session id), which would otherwise strand a
-  # committed, terminal intent still holding its lock: the exact stalled
-  # completion this intent forbids. Pre-flight has already established that this
-  # session is the owner, a delegate, or the post-takeover owner, so clearing
-  # the durable lock directly IS safe, PROVIDED the lock actually present here
-  # is still ours to clear.
+  # The durable lock file is the truth (AGENTS.md). Arm.disarm releases as the
+  # lock's recorded owner, so a lock a delegate or a post-takeover owner is
+  # closing under a different key can survive it; that would strand a committed,
+  # terminal intent still holding its lock, the exact stalled completion this
+  # intent forbids. Pre-flight has already established that this session is the
+  # owner, a delegate, or the post-takeover owner, so clearing the durable lock
+  # directly IS safe, PROVIDED the lock actually present here is still ours to clear.
   #
   # TOCTOU fix (post-review hardening, intent 188): the first version of this
   # fallback read the lock's OWN recorded owner and handed it straight back to
@@ -556,8 +554,8 @@ def run_disarm(intent_dir, id, session, discard_worktree_changes:,
   end
 
   unless File.exist?(Lock.path(intent_dir))
-    if data.nil?
-      warn "end-intent: no bridge resolved for session #{session.inspect} (intent #{id}); " \
+    if block.nil?
+      warn "end-intent: no worktree block could be derived for intent #{id}; " \
            "the delivery lock was cleared directly from disk, but any worktree this intent " \
            "provisioned was NOT removed. Run /plastic-doctor to check for an orphaned worktree."
     end
@@ -621,16 +619,10 @@ def main(argv)
     exit 4
   end
 
-  run_structure_gate(id, store: store)
-
-  reason = OutcomeGuard.reason(intent_dir, disposition)
-  if reason
-    warn "end-intent: #{reason}"
-    exit 2
-  end
-
   if opts[:dry_run]
     puts "end-intent: dry run for #{File.basename(intent_dir)} (#{disposition})"
+    targets = BackfillIntent.targets_for(intent_dir)
+    puts "  would backfill: #{targets.empty? ? "(nothing)" : targets.join(", ")}"
     puts "  would stamp ## Outcome: #{opts[:outcome_summary].inspect}" if opts[:outcome_summary]
     puts "  would move INDEX.md entry from ## Active to #{index_target_heading(disposition)} (#{index_path})"
     puts "  would append index note: #{opts[:index_note].inspect}" if opts[:index_note]
@@ -653,9 +645,18 @@ def main(argv)
     end
   end
 
+  # 1. Backfill from the record (intent 308), then the structure self-check and the
+  # outcome guard, both report-only since 308.
+  run_backfill(intent_dir, store: store, id: id, disposition: disposition,
+               summary: opts[:outcome_summary])
+  run_structure_check(id, store: store)
+
+  reason = OutcomeGuard.reason(intent_dir, disposition)
+  warn "end-intent: outcome.md: #{reason} (proceeding; doctor --intent #{id} reports it)" if reason
+
   # 1b. Intent-file `## Outcome` summary stamp (no-op unless given).
   if opts[:outcome_summary]
-    intent_file = Bridge.intent_file(intent_dir)
+    intent_file = Savepoint.intent_file(intent_dir)
     if File.exist?(intent_file)
       original = File.read(intent_file)
       updated = stamp_outcome_summary(original, opts[:outcome_summary])
@@ -682,7 +683,7 @@ def main(argv)
   end
 
   # 3. Savepoint Done bookend (idempotent).
-  Bridge.append_terminal_savepoint(intent_dir, disposition)
+  Savepoint.append_terminal_savepoint(intent_dir, disposition)
 
   # 4. Store auto-commit, unless --no-commit. Scoped to this intent's own paths (D17):
   # never git add -A.