@zalom/plastic 1.14.1 → 2.0.0-alpha.10

package/scripts/doctor.rb

@@ -21,7 +21,7 @@ require_relative "lib/store_discovery"
 require_relative "lib/links_projection"
 require_relative "lib/links_section"
 require_relative "lib/lock"
-require_relative "lib/bridge"
+require_relative "lib/savepoint"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
 require_relative "lib/skill_lint"
@@ -29,6 +29,7 @@ require_relative "lib/config_asks"
 require_relative "lib/power_tools"
 require_relative "lib/preflight"
 require_relative "lib/ruby_probe"
+require_relative "lib/doctor_session_ledger"
 
 # Diagnostic engine, instantiable with an injected store/agent map so tests can
 # run it hermetically (no eval, no global-constant rewriting).
@@ -37,6 +38,7 @@ require_relative "lib/ruby_probe"
 # store, conventions, intent and CLI halves, so Doctor stays one class with one
 # public surface.
 class Doctor
+  include DoctorSessionLedger
 
   REQUIRED_INDEX_SECTIONS = ["## Active", "## Future", "## Clusters", "## Abandoned", "## Completed"].freeze
 
@@ -286,6 +288,167 @@ class Doctor
   # content scanning. check_global_store (above) is store/full-scope and includes
   # orphaned_intents / ghost_references, both explicitly forbidden at core by D1.
 
+  # Row E (spec D8, spec 315b): #check_core_files's own `version_match` only ever
+  # compares the SELECTED harness's `<dir>/plastic/VERSION` against the global
+  # VERSION, so a second installed harness left behind on an old version is never
+  # version-checked at all -- exactly how ten stale 1.14.1 Codex registrations
+  # survived a `pass`. This runs the same comparison for EVERY installed harness
+  # (agent_dir on disk), named `version_match_<key>` so the existing `version_match`
+  # name and position stay reserved for the selected harness (pinned tests:
+  # test/doctor_test.rb:1846,1861,1873). Full tier only (`run_checks`); never
+  # `run_core_checks`, which is `binary: true` and runs on the session-start boot
+  # path, where a second-harness warn would become a boot-time error for every user.
+  def check_harness_versions
+    global_version = read_version
+    return [] unless global_version
+
+    agents.filter_map do |key, config|
+      next unless config.is_a?(Hash) && File.directory?(config[:dir].to_s)
+
+      agent_version_path = File.join(config[:dir], "plastic", "VERSION")
+      name = "version_match_#{key}"
+
+      if !File.exist?(agent_version_path)
+        check(
+          category: "core_files", name: name, status: "warn",
+          message: "#{config[:name]}'s agent-side VERSION file not found at #{tilde(agent_version_path)}",
+          fixable: true,
+          fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or plastic-rollback to a prior version"
+        )
+      else
+        agent_version = File.read(agent_version_path).strip
+        if global_version == agent_version
+          check(
+            category: "core_files", name: name, status: "pass",
+            message: "Global VERSION (#{global_version}) matches #{config[:name]}'s agent-side VERSION"
+          )
+        else
+          check(
+            category: "core_files", name: name, status: "warn",
+            message: "Version mismatch for #{config[:name]}: global=#{global_version}, agent=#{agent_version}",
+            details: [
+              "#{tilde(File.join(plastic_home, "VERSION"))}: #{global_version}",
+              "#{tilde(agent_version_path)}: #{agent_version}",
+            ],
+            fixable: true,
+            fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or plastic-rollback to a prior version"
+          )
+        end
+      end
+    end
+  end
+
+  # The Codex hook NAME expected per event, keyed off HookRegistry's own
+  # constants rather than a full built command string: naming it, not the
+  # literal dispatcher path, is what #check_codex_stale_registrations needs,
+  # so this never depends on plastic_home resolving to the same install the
+  # live hooks.json's commands were written under.
+  def codex_expected_names_by_event
+    names = {}
+    post_order = HookRegistry.events["PostToolUse"].flat_map { |g| g["hooks"].map { |h| h["name"] } }
+    names["PostToolUse"] = HookRegistry::CODEX_POST_HOOKS & post_order
+
+    HookRegistry::CODEX_LIVE_STATE_EVENTS.each do |event|
+      names[event] = HookRegistry.events[event].flat_map { |g| g["hooks"].map { |h| h["name"] } }
+    end
+
+    end_order = HookRegistry.events["SessionEnd"].flat_map { |g| g["hooks"].map { |h| h["name"] } }
+    names["SessionEnd"] = HookRegistry::CODEX_SESSION_END_HOOKS & end_order
+    names
+  end
+
+  # Row E (spec D8, spec 315b): #codex_hooks_registered_check computes
+  # `want - got` and iterates `expected.each`, so it can see a MISSING registration
+  # but never an EXTRA one, and it can never even visit an event `expected` does not
+  # list at all (a retired event such as PreToolUse, which a stale ~/.codex/hooks.json
+  # can still carry). This scans the UNION of expected and live event keys instead, so
+  # a stale registration parked in a retired event is visible. Compares hook NAMES
+  # (see #codex_expected_names_by_event), not full command strings: a full-command
+  # comparison would embed this Doctor instance's own `plastic_home` in the expected
+  # dispatcher path, which is only guaranteed to match the live hooks.json's own
+  # dispatcher path in a real, single install, never a test that fakes one without the
+  # other. Full tier only (`run_checks`); never `run_core_checks` (D8).
+  #
+  # Post-execution review item 5: name-only comparison alone is blind to two real
+  # cases, both closed here without reintroducing any plastic_home coupling: (a) the
+  # SAME (event, name) pair registered more than once (each copy's name is
+  # individually expected, so a "not in the expected set" scan never sees the
+  # duplicate), and (b) a correctly-named entry whose dispatcher path is an OLD
+  # install, different from the path every OTHER Plastic entry in this same file
+  # actually uses -- the "correct" path here is whichever path the file's own
+  # majority of entries already agrees on, never a path this Doctor instance derives
+  # from its own plastic_home.
+  def check_codex_stale_registrations
+    config = agents["codex"]
+    return [] unless config.is_a?(Hash) && File.directory?(config[:dir].to_s)
+
+    home_dir = config[:home_dir] || config[:dir]
+    hooks_json = File.join(home_dir, "hooks.json")
+    data = read_json_safe(hooks_json)
+    return [] if data.nil? || !data.is_a?(Hash)
+
+    expected_names = codex_expected_names_by_event
+    live = data["hooks"].is_a?(Hash) ? data["hooks"] : {}
+
+    # One pass over every live Plastic entry (event, hook name, and the literal
+    # dispatcher-path token it actually invokes), shared by all three checks below.
+    entries = []
+    (expected_names.keys | live.keys).each do |event|
+      Array(live[event]).each do |group|
+        Array(group["hooks"]).each do |h|
+          cmd = h["command"]
+          next unless HookRegistry.codex_purge_command?(cmd)
+
+          dispatcher_path = cmd.to_s.split(/\s+/).reject(&:empty?).first.to_s.delete("\"'")
+          name = HookRegistry.command_basenames(cmd).last
+          entries << { event: event, name: name, dispatcher_path: dispatcher_path, cmd: cmd }
+        end
+      end
+    end
+
+    stale = []
+
+    # Not in the expected name set for this event at all (the original check).
+    entries.each do |e|
+      want_names = Array(expected_names[e[:event]])
+      stale << "#{e[:event]}: #{e[:cmd]}" unless want_names.include?(e[:name])
+    end
+
+    # (a) the same (event, name) pair registered more than once.
+    entries.group_by { |e| [e[:event], e[:name]] }.each_value do |group|
+      next if group.size <= 1
+
+      group.each { |e| stale << "#{e[:event]}: #{e[:cmd]} (duplicate registration of #{e[:name]})" }
+    end
+
+    # (b) a dispatcher path that differs from the path every other Plastic entry in
+    # this same file actually uses.
+    unless entries.empty?
+      majority_path = entries.map { |e| e[:dispatcher_path] }.tally.max_by { |(_path, count)| count }&.first
+      entries.each do |e|
+        next if e[:dispatcher_path] == majority_path
+
+        stale << "#{e[:event]}: #{e[:cmd]} (dispatcher path #{e[:dispatcher_path]} differs from " \
+                  "this file's other Plastic entries at #{majority_path})"
+      end
+    end
+
+    stale.uniq!
+
+    if stale.empty?
+      [check(
+        category: "agent_registration", name: "codex_stale_registrations", status: "pass",
+        message: "No stale Plastic Codex registrations found outside the expected hook set"
+      )]
+    else
+      [check(
+        category: "agent_registration", name: "codex_stale_registrations", status: "warn",
+        message: "#{stale.size} stale Codex registration(s) found outside the expected hook set",
+        details: stale, fixable: true,
+        fix_hint: "Re-run the Plastic installer with --codex --reinstall to purge stale entries"
+      )]
+    end
+  end
   # --- Check category 2: Conventions ---
 
   # When `scopes` is a non-nil Array of scope strings (e.g. ["global"] or
@@ -431,7 +594,7 @@ class Doctor
         message: "#{bad_sections.size} intent file(s) have non-sanctioned ## sections",
         details: bad_sections.map { |b| "#{b[:dir]}: #{b[:issues].join(", ")}" },
         fixable: true,
-        fix_hint: "Dispatch plastic-store-curating to relocate each unsanctioned section into the " \
+        fix_hint: "Relocate each unsanctioned section into the " \
                   "intent's revisions.md via move-and-record (a missing required section is restored " \
                   "or reprojected instead); see plastic-conventions > references/maintenance-and-revisions.md"
       )
@@ -553,9 +716,9 @@ class Doctor
 # suppress) is exactly what makes the row dead.
 def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, active:, excluded_rules: [])
   outcome = File.join(dir, "outcome.md")
-  outcome_real = Bridge.stage_file_present?(outcome)
+  outcome_real = Savepoint.stage_file_present?(outcome)
   findings = { conflict: nil, phantom: nil, gap: [], operational_gap: [], excluded: [],
-               excluded_rules_fired: [], stalled: nil }
+               excluded_rules_fired: [], stalled: nil, unbackfilled: [], excluded_backfill: [] }
 
   # HARD conflict: the deliverable exists but INDEX still says Active. This
   # is the one true INDEX-wins disagreement, so it stays a fail.
@@ -569,7 +732,7 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
   # the generic replacement for the frozen 170a amnesty list is simply "never suppress" -
   # the message already labels a terminal phantom report-only, so dropping the id-based
   # suppression is strictly more general and needs no per-store state at all).
-  phantom_lines = Bridge.savepoint_phantom_lines(dir)
+  phantom_lines = Savepoint.savepoint_phantom_lines(dir)
   if phantom_lines.any?
     detail = phantom_lines.map { |line, reason| "#{line} (#{reason})" }.join("; ")
     scope_note = terminal ? "terminal in INDEX, report-only (immutable history)" : "live intent, auto-rebuildable"
@@ -583,7 +746,7 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
   if terminal && !outcome_real
     state = File.exist?(outcome) ? "still a placeholder" : "missing"
     findings[:gap] << "#{label}: terminal in INDEX but outcome.md is #{state} " \
-                     "(delivery claim - never fabricated)"
+                     "(delivery claim; written at close by end-intent since intent 308)"
   end
 
   if terminal
@@ -603,6 +766,21 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
     end
     findings[:excluded_rules_fired] << "savepoint_operational" if suppressed && findings[:excluded].any?
 
+    # Unbackfilled documents (intent 308): spec.md or plan.md missing or still the
+    # placeholder, or no real action file, on a terminal intent. Every one of these is
+    # written from the record by `scaffold-intent backfill`, so this is repairable and
+    # reported as a fixable warn (backfilled_complete). Its exclusions go to their OWN
+    # bucket so savepoint_operational's consumed/dead-row bookkeeping above never sees them.
+    backfill_gaps = %w[spec.md plan.md].reject { |f| Savepoint.stage_file_present?(File.join(dir, f)) }
+    backfill_gaps << "actions/" unless Savepoint.has_real_action?(dir)
+    if backfill_gaps.any?
+      suppressed_backfill = excluded_rules.include?("backfilled_complete")
+      target = suppressed_backfill ? findings[:excluded_backfill] : findings[:unbackfilled]
+      target << "#{label}: terminal in INDEX but #{backfill_gaps.join(", ")} " \
+                "#{backfill_gaps.size == 1 ? "is" : "are"} missing or still a placeholder (backfillable)"
+      findings[:excluded_rules_fired] << "backfilled_complete" if suppressed_backfill
+    end
+
     # Stalled completion: unchanged, never consulted amnesty.
     if File.exist?(Lock.path(dir))
       note = Lock.fresh?(dir) ? "delivery.lock still present (post-done window not closed)"
@@ -626,6 +804,9 @@ def check_done_signals(scopes: nil)
   dead_row_paths = []
   stalled = []
   phantoms = []
+  unbackfilled = []       # spec/plan/actions gaps on terminal intents (intent 308) - repairable
+  excluded_backfill = []  # backfill gaps knowingly exempted via doctor-exclusions (intent 308)
+  dead_rows_by_rule = Hash.new { |h, k| h[k] = [] }
 
   done_signal_stores(scopes).each do |store|
     exclusions = DoctorExclusions.load(store[:index])
@@ -634,7 +815,7 @@ def check_done_signals(scopes: nil)
       exclusion_error_paths << exclusions[:path]
     end
 
-    consumed = { "savepoint_operational" => [] }
+    consumed = { "savepoint_operational" => [], "backfilled_complete" => [] }
     # `known_ids` (post-review fix): every intent id with a REAL DIRECTORY in this store, scanned
     # directly from disk - independent of INDEX.md. An id can have a directory on disk without
     # being listed in INDEX (a de-indexed "ghost"), and the walk below alone would never visit it;
@@ -672,6 +853,11 @@ def check_done_signals(scopes: nil)
       phantoms << findings[:phantom] if findings[:phantom]
       gaps.concat(findings[:gap])
       operational_gaps.concat(findings[:operational_gap])
+      unbackfilled.concat(findings[:unbackfilled])
+      if findings[:excluded_backfill].any?
+        excluded_backfill.concat(findings[:excluded_backfill])
+        exclusion_paths << exclusions[:path]
+      end
       if findings[:excluded].any?
         excluded.concat(findings[:excluded])
         exclusion_paths << exclusions[:path]
@@ -692,7 +878,9 @@ def check_done_signals(scopes: nil)
                else
                  "names an intent with no current #{row[:rule]} finding"
                end
-      dead_rows << "#{store[:scope]}: #{exclusions[:path]}: #{row[:rule]} #{row[:id]} - #{reason}"
+      dead_row = "#{store[:scope]}: #{exclusions[:path]}: #{row[:rule]} #{row[:id]} - #{reason}"
+      dead_rows << dead_row
+      dead_rows_by_rule[row[:rule]] << dead_row
       dead_row_paths << exclusions[:path]
     end
   end
@@ -733,7 +921,7 @@ def check_done_signals(scopes: nil)
     checks << check(
       category: "done_signals", name: "signals_complete", status: "pass",
       message: "#{gaps.size} terminal intent#{gaps.size == 1 ? "" : "s"} missing a real outcome.md " \
-               "(delivery claim - never fabricated; informational only, does not affect doctor's exit code)",
+               "(delivery claim; end-intent writes outcome.md at close since intent 308, so this is pre-308 history or a close outside end-intent; informational only, does not affect doctor's exit code)",
       details: gaps
     )
   end
@@ -750,10 +938,19 @@ def check_done_signals(scopes: nil)
   # suppressed nothing this run. It is purely informational, exactly like `exclusion_suffix` - it
   # never changes status on any of the three branches below, because a stale governance-record row
   # is bookkeeping drift, not a store regression (219 D6 is untouched: no disposition is invented).
-  exclusion_suffix = excluded.empty? ? "" : " (#{excluded.size} excluded via #{exclusion_paths.join(", ")})"
-  dead_suffix = dead_rows.empty? ? "" : " (#{dead_rows.size} dead row#{dead_rows.size == 1 ? "" : "s"} " \
-                                        "in #{dead_row_paths.join(", ")}, suppressing nothing - prune with " \
-                                        "`maintenance-run --tool register-exclusions --prune`)"
+  # Per rule (intent 308): savepoint_operational and backfilled_complete each fold in only
+  # their own exclusions and dead rows, so one check never carries the other's counts.
+  suffixes = lambda do |excluded_rows, dead|
+    ex = excluded_rows.empty? ? "" : " (#{excluded_rows.size} excluded via #{exclusion_paths.join(", ")})"
+    dd = dead.empty? ? "" : " (#{dead.size} dead row#{dead.size == 1 ? "" : "s"} " \
+                            "in #{dead_row_paths.join(", ")}, suppressing nothing - prune with " \
+                            "`maintenance-run --tool register-exclusions --prune`)"
+    [ex, dd]
+  end
+  savepoint_dead = dead_rows_by_rule["savepoint_operational"]
+  backfill_dead = dead_rows_by_rule["backfilled_complete"]
+  exclusion_suffix, dead_suffix = suffixes.call(excluded, savepoint_dead)
+  backfill_exclusion_suffix, backfill_dead_suffix = suffixes.call(excluded_backfill, backfill_dead)
 
   if exclusion_errors.any?
     checks << check(
@@ -762,7 +959,7 @@ def check_done_signals(scopes: nil)
                "missing an operational savepoint.md or its Done echo, and " \
                "#{exclusion_errors.size} doctor-exclusions error#{exclusion_errors.size == 1 ? "" : "s"} " \
                "(a malformed exclusion file never suppresses a finding)#{exclusion_suffix}#{dead_suffix}",
-      details: operational_gaps + exclusion_errors + dead_rows, fixable: true,
+      details: operational_gaps + exclusion_errors + savepoint_dead, fixable: true,
       fix_hint: "Fix the malformed doctor-exclusions file(s) (#{exclusion_error_paths.join(", ")}) - " \
                 "format `rule_name id id id`, blank lines and # comments ignored - then reconstruct " \
                 "any remaining real gap via `maintenance-run --tool rebuild-savepoint --intent <id> " \
@@ -774,7 +971,7 @@ def check_done_signals(scopes: nil)
       category: "done_signals", name: "savepoint_operational", status: "pass",
       message: "No terminal intent is missing an operational savepoint.md or its Done echo" \
                "#{exclusion_suffix}#{dead_suffix}",
-      details: dead_rows
+      details: savepoint_dead
     )
   else
     checks << check(
@@ -782,13 +979,50 @@ def check_done_signals(scopes: nil)
       message: "#{operational_gaps.size} terminal intent#{operational_gaps.size == 1 ? "" : "s"} " \
                "missing an operational savepoint.md or its Done echo (reconstructible)" \
                "#{exclusion_suffix}#{dead_suffix}",
-      details: operational_gaps + dead_rows, fixable: true,
+      details: operational_gaps + savepoint_dead, fixable: true,
       fix_hint: "Reconstruct the minimal two-line started/Done echo via " \
                 "`maintenance-run --tool rebuild-savepoint --intent <id> --apply` (197-conformant: " \
                 "receipt-before-write via RevisionsWriter, one intent per invocation, owner-approval-gated)."
     )
   end
 
+  # backfilled_complete (intent 308): spec.md, plan.md, or a real action file missing on a
+  # terminal intent. Same three branches as savepoint_operational: a malformed exclusion
+  # file is always loud, a clean set passes with its own exclusion and dead-row counts
+  # folded in, a real gap set warns with the backfill verb as the fix.
+  backfill_hint = "Write the missing documents from the record via " \
+                  "`scaffold-intent backfill --store <store> --id <id> --disposition " \
+                  "<delivered|abandoned>` (never touches real content, one intent per invocation)."
+  if exclusion_errors.any?
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "warn",
+      message: "#{unbackfilled.size} terminal intent#{unbackfilled.size == 1 ? "" : "s"} " \
+               "missing a backfillable document, and #{exclusion_errors.size} doctor-exclusions " \
+               "error#{exclusion_errors.size == 1 ? "" : "s"} (a malformed exclusion file never " \
+               "suppresses a finding)#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: unbackfilled + exclusion_errors + backfill_dead, fixable: true,
+      fix_hint: "Fix the malformed doctor-exclusions file(s) (#{exclusion_error_paths.join(", ")}), " \
+                "then write the missing documents from the record via `scaffold-intent backfill " \
+                "--store <store> --id <id> --disposition <delivered|abandoned>`."
+    )
+  elsif unbackfilled.empty?
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "pass",
+      message: "Every terminal intent carries a real spec.md, plan.md, and action file" \
+               "#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: backfill_dead
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "backfilled_complete", status: "warn",
+      message: "#{unbackfilled.size} terminal intent#{unbackfilled.size == 1 ? "" : "s"} " \
+               "missing a backfillable document (spec.md, plan.md, or a real action file)" \
+               "#{backfill_exclusion_suffix}#{backfill_dead_suffix}",
+      details: unbackfilled + backfill_dead, fixable: true,
+      fix_hint: backfill_hint
+    )
+  end
+
   if stalled.empty?
     checks << check(
       category: "done_signals", name: "stalled_completion", status: "pass",
@@ -818,8 +1052,8 @@ def check_done_signals(scopes: nil)
       message: "#{phantoms.size} intent#{phantoms.size == 1 ? "" : "s"} carry savepoint.md " \
                "line(s) contradicted by disk (advisory; terminal history stays report-only)",
       details: phantoms, fixable: true,
-      fix_hint: "For a live (Active) intent, run plastic-intent-savepoint to rebuild via " \
-                "Bridge.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
+      fix_hint: "For a live (Active) intent, rebuild the ledger via " \
+                "Savepoint.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
                 "a phantom there stays advisory unless an explicit human grant authorizes the " \
                 "124a manual Done-bookend repair."
     )
@@ -991,9 +1225,9 @@ end
   INTENT_END_LIFECYCLE_FILES = %w[spec.md plan.md checklist.md outcome.md].freeze
 
   def intent_lifecycle_artifacts_check(intent_dir, disposition)
-    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Bridge.stage_file_present?(File.join(intent_dir, f)) }
-    unless Bridge.stage_file_present?(Bridge.intent_file(intent_dir))
-      missing = [File.basename(Bridge.intent_file(intent_dir))] + missing
+    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Savepoint.stage_file_present?(File.join(intent_dir, f)) }
+    unless Savepoint.stage_file_present?(Savepoint.intent_file(intent_dir))
+      missing = [File.basename(Savepoint.intent_file(intent_dir))] + missing
     end
 
     outcome_note = nil
@@ -1014,7 +1248,7 @@ end
 
   def intent_checklist_complete_check(intent_dir)
     path = File.join(intent_dir, "checklist.md")
-    unless Bridge.stage_file_present?(path)
+    unless Savepoint.stage_file_present?(path)
       return check(category: "intent_end", name: "intent_checklist_complete", status: "pass",
                     message: "n/a: checklist.md absent or placeholder (flagged above if that is a gap)")
     end
@@ -1074,7 +1308,8 @@ end
   # Terminal-gated (281 D3): done_signal_findings_for_dir only ever produces this finding
   # inside `if terminal`, so honoring the exclusion for a still-Active intent would suppress a
   # strictly larger set of facts than the rule id names - and would let a mistyped id silence
-  # the live, repairable warning scripts/end-intent's pre-write gate exists to raise.
+  # the live, repairable warning scripts/end-intent's structure self-check exists to raise
+  # (a report, never a refusal, since intent 308).
   #
   # Never raises: DoctorExclusions is fail-open by contract (274 D5) and index_sections_by_dir
   # returns an empty map for a missing INDEX.
@@ -1131,9 +1366,9 @@ end
     first_line = File.read(savepoint).each_line.find { |l| !l.strip.empty? }.to_s.strip
     parts = first_line.split(/\s{2,}/)
     born_pair = parts.length >= 3 ? [parts[1], parts[2]] : nil
-    expected_pair = Bridge.savepoint_milestone(intent_dir, File.basename(Bridge.intent_file(intent_dir)))
+    expected_pair = Savepoint.savepoint_milestone(intent_dir, File.basename(Savepoint.intent_file(intent_dir)))
 
-    phantoms = Bridge.savepoint_phantom_lines(intent_dir)
+    phantoms = Savepoint.savepoint_phantom_lines(intent_dir)
     problems = []
     problems << "born line #{born_pair.inspect} does not match the expected #{expected_pair.inspect}" \
       if born_pair != expected_pair
@@ -1147,7 +1382,7 @@ end
       check(category: "intent_end", name: "intent_savepoint_truthful", status: "warn",
             message: "#{problems.size} savepoint truthfulness issue(s) (advisory, never blocking)",
             details: problems,
-            fixable: true, fix_hint: "Run plastic-intent-savepoint to rebuild via Bridge.rebuild_savepoint")
+            fixable: true, fix_hint: "Rebuild the ledger via Savepoint.rebuild_savepoint")
     end
   end
 
@@ -1270,7 +1505,7 @@ end
     checks << graph_finding_check(
       "graph_i4_danglers", i4,
       "Every sources/chain id resolves to a real intent (I4)",
-      "Dispatch plastic-store-curating to record the dangling sources/chain edge as a " \
+      "Record the dangling sources/chain edge as a " \
       "broken-source/broken-chain move-and-record entry in the intent's revisions.md (see " \
       "plastic-conventions > references/maintenance-and-revisions.md), or restore the missing intent"
     )
@@ -1297,18 +1532,6 @@ end
 
 
 
-  # claude_hooks_implemented (intent 244, the Claude twin of intent 200's Codex
-  # check): the edit-path gates now live as branches inside one dispatcher,
-  # which is exactly the shape that let links-gate ship registered and dead on
-  # Codex. HookRegistry::GATE_TOOLS is the registry side; scripts/hook-edit-gates
-  # is the implementation side. Checked in BOTH directions, so a registered gate
-  # with no branch (always allows, silently) and a branch nobody registers
-  # (dead code) are both reported.
-  #
-  # Read as plain text, never required: the dispatcher has top-level side effects
-  # (it reads $stdin and exits), the same reason codex_dispatcher_gate_names reads
-  # scripts/codex-hook as text.
-
   # Plastic skills install as ~/.claude/skills/plastic-<name>/SKILL.md. Pass if at
   # least one such skill is present.
 
@@ -1357,7 +1580,7 @@ end
   # dispatcher is an executable script with real top-level side effects (it reads
   # $stdin and may exit), so it can never be required or executed to introspect it,
   # only read as plain text, mirroring codex_agent_toml_well_formed? above. Pulls
-  # gate names from the STATE_HOOKS and SHELL_HOOKS %w[] literals, plus the `when
+  # hook names from the STATE_HOOKS %w[] literal, plus the `when
   # "<name>"` labels of the top-level `case gate` statement (stopping at its
   # trailing `else`). Line-shape dependent, not AST-safe, disclosed as such in
   # docs; the healthy-install pass test against the REAL dispatcher is what proves
@@ -1407,7 +1630,7 @@ end
   # Classification per installed agent basename, checked in this order:
   #   1. an `agents.models.<basename>` override IS configured -> sanctioned,
   #      pass/informational, LISTED regardless of whether frontmatter matches
-  #      (that mismatch is the override working, e.g. plastic-brainstorming: fable).
+  #      (that mismatch is the override working, e.g. plastic-executor: fable).
   #   2. no override AND basename is a TIER_DEFAULTS key -> compare frontmatter
   #      to that default; match is pass (clean), mismatch is real drift (warn).
   #   3. no override AND basename is a CONSULTATION_AGENTS member -> not a
@@ -2173,11 +2396,14 @@ end
     all_checks += check_conventions(scopes: ["global"])
     all_checks += check_agent_registration(agent_key)
     all_checks += check_core_files(agent_key)
+    all_checks += check_harness_versions
+    all_checks += check_codex_stale_registrations
     all_checks += check_deprecations
     all_checks += check_config_asks(agent_key)
     all_checks += check_qmd
     all_checks += check_ruby_runtime
     all_checks += check_done_signals(scopes: ["global"])
+    all_checks += check_session_ledger(scopes: ["global"])
     all_checks += check_skill_lint
     all_checks += check_install_integrity
 
@@ -2228,10 +2454,10 @@ end
       case store
       when :all
         check_global_store + check_project_stores + check_conventions + check_done_signals +
-          check_qmd(detector: qmd_detector, runner: qmd_runner)
+          check_session_ledger + check_qmd(detector: qmd_detector, runner: qmd_runner)
       when :global
         check_global_store + check_conventions(scopes: ["global"]) +
-          check_done_signals(scopes: ["global"]) +
+          check_done_signals(scopes: ["global"]) + check_session_ledger(scopes: ["global"]) +
           check_qmd(detector: qmd_detector, runner: qmd_runner, collection: "plastic-global")
       else
         all_checks_for_project_slug(store, qmd_detector: qmd_detector, qmd_runner: qmd_runner,