@zalom/plastic 1.7.0 → 1.8.0

package/scripts/doctor.rb

@@ -26,9 +26,10 @@ require_relative "lib/hook_registry"
 require_relative "lib/lock"
 require_relative "lib/bridge"
 require_relative "lib/agent_models"
-require_relative "lib/legacy_bookend_amnesty"
+require_relative "lib/outcome_guard"
 require_relative "lib/skill_lint"
 require_relative "lib/config_asks"
+require_relative "lib/power_tools"
 
 # Diagnostic engine, instantiable with an injected store/agent map so tests can
 # run it hermetically (no eval, no global-constant rewriting).
@@ -48,11 +49,6 @@ class Doctor
   # (intent 60). Alias it here so the two can never drift.
   REQUIRED_FRONTMATTER_FIELDS = IntentValidator::REQUIRED_FIELDS
 
-  # Single source of truth for the pre-161 legacy Done-bookend amnesty list
-  # lives in LegacyBookendAmnesty (intent 170a). Alias it here so the two can
-  # never drift.
-  LEGACY_BOOKEND_AMNESTY = LegacyBookendAmnesty::LIST
-
   CLAUDE_HOOK_EVENTS = %w[SessionStart PreCompact PostToolUse UserPromptSubmit].freeze
 
   # Launchers the installer places in the agent's hooks dir that are NOT hooks
@@ -93,10 +89,9 @@ class Doctor
   end
 
   def initialize(plastic_home: DEFAULT_PLASTIC_HOME, agents: DEFAULT_AGENTS,
-                  bookend_amnesty: LEGACY_BOOKEND_AMNESTY, runner: Doctor.default_runner)
+                  runner: Doctor.default_runner)
     @plastic_home = plastic_home
     @agents = agents
-    @bookend_amnesty = bookend_amnesty
     @runner = runner
   end
 
@@ -112,6 +107,8 @@ class Doctor
     #   :global    — --store global
     #   "<slug>"   — --store <slug> (a single project)
     store = nil
+    intent = nil
+    disposition = nil
 
     i = 0
     while i < argv.length
@@ -127,6 +124,12 @@ class Doctor
       when "--core"
         core = true
         i += 1
+      when "--intent"
+        intent = argv[i + 1]
+        i += 2
+      when "--disposition"
+        disposition = argv[i + 1]
+        i += 2
       when "--store"
         nxt = argv[i + 1]
         if nxt && !nxt.start_with?("-")
@@ -144,7 +147,7 @@ class Doctor
       end
     end
 
-    { agent: agent, help: help, core: core, store: store }
+    { agent: agent, help: help, core: core, store: store, intent: intent, disposition: disposition }
   end
 
   def show_help
@@ -163,6 +166,11 @@ class Doctor
         --store [WHICH] Run only the store/conventions checks. WHICH may be:
                         global (global store only), a project slug (that project
                         only), or omitted (all stores). 3-state pass/warn/fail.
+        --intent ID     Per-intent structure gate at intent-end (intent 222): one
+                        closing intent only, never a store sweep. Pair with
+                        --store <key> to disambiguate an id that collides across
+                        stores, and --disposition delivered|abandoned to fold in
+                        the outcome.md disposition check. 3-state pass/warn/fail.
         -h, --help      Show this help
 
       Output:
@@ -366,6 +374,45 @@ class Doctor
     checks
   end
 
+  # --- Check category: global store availability (core-only, D1) ---
+  #
+  # Narrow, core-appropriate version of check_global_store: presence/readability only, zero
+  # content scanning. check_global_store (above) is store/full-scope and includes
+  # orphaned_intents / ghost_references, both explicitly forbidden at core by D1.
+  def check_global_store_available
+    checks = []
+
+    if File.directory?(plastic_home)
+      checks << check(
+        category: "global_store", name: "global_store_reachable", status: "pass",
+        message: "Global store directory reachable at #{tilde(plastic_home)}"
+      )
+    else
+      checks << check(
+        category: "global_store", name: "global_store_reachable", status: "fail",
+        message: "Global store directory not found at #{tilde(plastic_home)}",
+        fixable: true, fix_hint: "Run the Plastic installer to bootstrap the store"
+      )
+      return checks
+    end
+
+    index_path = File.join(plastic_home, "INDEX.md")
+    if File.exist?(index_path)
+      checks << check(
+        category: "global_store", name: "global_index_reachable", status: "pass",
+        message: "INDEX.md exists"
+      )
+    else
+      checks << check(
+        category: "global_store", name: "global_index_reachable", status: "fail",
+        message: "INDEX.md not found at #{tilde(index_path)}",
+        fixable: true, fix_hint: "Run the Plastic installer to bootstrap the store"
+      )
+    end
+
+    checks
+  end
+
   # --- Check category 2: Conventions ---
 
   # When `scopes` is a non-nil Array of scope strings (e.g. ["global"] or
@@ -608,172 +655,205 @@ class Doctor
     stores
   end
 
-  def check_done_signals(scopes: nil)
-    conflicts = [] # canonical INDEX-wins disagreement (fail)
-    gaps = []      # terminal completeness gaps on immutable/legacy history (warn)
-    stalled = []   # terminal but End tail unfinished (warn)
-    phantoms = []  # savepoint.md line(s) disk evidence contradicts (warn, never fail; intent 134)
-
-    done_signal_stores(scopes).each do |store|
-      index_sections_by_dir(store[:index]).each do |dirname, in_sections|
-        dir = File.join(store[:store_dir], dirname)
-        next unless File.directory?(dir)
-
-        terminal = (in_sections & ["Completed", "Abandoned"]).any?
-        active = in_sections.include?("Active") && !terminal
-        outcome = File.join(dir, "outcome.md")
-        outcome_real = Bridge.stage_file_present?(outcome)
-        label = "#{store[:scope]} store/#{dirname}"
-
-        # HARD conflict: the deliverable exists but INDEX still says Active. This
-        # is the one true INDEX-wins disagreement, so it stays a fail.
-        if active && outcome_real
-          conflicts << "#{label}: outcome.md is real but the intent is still under ## Active " \
-                       "(INDEX is canonical — move it to its terminal section or revert outcome.md)"
-        end
+# Per-directory done-signal findings for ONE intent dir (intent 222): the shared unit both
+# check_done_signals's store-wide loop (211's territory, unchanged severities) and the new
+# per-intent check (check_intent_end) call, so the two surfaces can never independently
+# drift on what counts as a phantom line or a completeness gap. Returns
+# {conflict:, phantom:, gap:, stalled:} where conflict/phantom/stalled are nil or a finding
+# string, and gap is an ARRAY (0, 1, or 2 strings): the original inline code pushed the
+# "outcome missing" gap and the "audit echo missing" gap as two SEPARATE, independent `if`
+# blocks (never elsif), so a single terminal dir missing BOTH can legitimately contribute
+# two distinct gap strings in the same pass; collapsing that into one nilable field would
+# silently drop one of the two on a dir where both are true (verified against
+# test/doctor_done_signals_test.rb's fixtures before this extraction, per plan.md Step 3).
+def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, active:)
+  outcome = File.join(dir, "outcome.md")
+  outcome_real = Bridge.stage_file_present?(outcome)
+  findings = { conflict: nil, phantom: nil, gap: [], operational_gap: [], stalled: nil }
+
+  # HARD conflict: the deliverable exists but INDEX still says Active. This
+  # is the one true INDEX-wins disagreement, so it stays a fail.
+  if active && outcome_real
+    findings[:conflict] = "#{label}: outcome.md is real but the intent is still under ## Active " \
+                          "(INDEX is canonical - move it to its terminal section or revert outcome.md)"
+  end
+
+  # Savepoint truthfulness (advisory, never fail; intent 134). Terminal phantom lines are
+  # ALWAYS report-only (immutable history), with no suppression by id or scope (intent 211:
+  # the generic replacement for the frozen 170a amnesty list is simply "never suppress" -
+  # the message already labels a terminal phantom report-only, so dropping the id-based
+  # suppression is strictly more general and needs no per-store state at all).
+  phantom_lines = Bridge.savepoint_phantom_lines(dir)
+  if phantom_lines.any?
+    detail = phantom_lines.map { |line, reason| "#{line} (#{reason})" }.join("; ")
+    scope_note = terminal ? "terminal in INDEX, report-only (immutable history)" : "live intent, auto-rebuildable"
+    findings[:phantom] = "#{label}: #{phantom_lines.size} phantom savepoint line(s) contradicted by " \
+                         "disk, #{scope_note}: #{detail}"
+  end
+
+  # Delivery-claim gap (intent 211, 219 D6): a missing/placeholder outcome.md on a terminal
+  # intent is never fabricated, so this is unrepairable by construction. Reported informational
+  # only (signals_complete, always status "pass" - see check_done_signals).
+  if terminal && !outcome_real
+    state = File.exist?(outcome) ? "still a placeholder" : "missing"
+    findings[:gap] << "#{label}: terminal in INDEX but outcome.md is #{state} " \
+                     "(delivery claim - never fabricated)"
+  end
+
+  if terminal
+    # Operational gap (intent 211, 219 D6): savepoint.md missing entirely (not previously
+    # checked at all) or present but missing the Done bookend - both are minimally
+    # reconstructible via maintenance-run --tool rebuild-savepoint, so this is repairable and
+    # reported as a fixable warn (savepoint_operational).
+    savepoint = File.join(dir, "savepoint.md")
+    if !File.exist?(savepoint)
+      findings[:operational_gap] << "#{label}: terminal in INDEX but savepoint.md is missing " \
+                                    "entirely (operational - reconstructible)"
+    elsif File.read(savepoint) !~ /\bDone\b.*\b(delivered|abandoned)\b/
+      findings[:operational_gap] << "#{label}: terminal in INDEX but savepoint.md has no " \
+                                    "`Done delivered|abandoned` line (operational - reconstructible)"
+    end
+
+    # Stalled completion: unchanged, never consulted amnesty.
+    if File.exist?(Lock.path(dir))
+      note = Lock.fresh?(dir) ? "delivery.lock still present (post-done window not closed)"
+                              : "delivery.lock is present and STALE"
+      findings[:stalled] = "#{label}: #{note} - the End tail did not finish"
+    end
+  end
+
+  findings
+end
 
-        # Savepoint truthfulness (advisory, never fail; intent 134): a line the disk contradicts
-        # (a phantom milestone, a duplicate pair, or a state line with an absent prerequisite).
-        # Live intents auto-rebuild via plastic-intent-savepoint; terminal intents are immutable,
-        # so a phantom there is report-only. Composition with intent 170a: a pre-161 legacy intent
-        # on the frozen bookend amnesty is grandfathered here too. Its immutable history carries
-        # known pre-convention drift (the same class the audit-echo gap forgives), so it must not
-        # resurface through this advisory. The suppression is scope-qualified exactly like the
-        # audit-echo amnesty; every live intent and every non-amnestied terminal still fires.
-        phantom_lines = Bridge.savepoint_phantom_lines(dir)
-        phantom_id = dirname.split("--", 2).first
-        phantom_amnestied = terminal && @bookend_amnesty.fetch(store[:scope], []).include?(phantom_id)
-        if phantom_lines.any? && !phantom_amnestied
-          detail = phantom_lines.map { |line, reason| "#{line} (#{reason})" }.join("; ")
-          scope_note = terminal ? "terminal in INDEX, report-only (immutable history)" : "live intent, auto-rebuildable"
-          phantoms << "#{label}: #{phantom_lines.size} phantom savepoint line(s) contradicted by " \
-                      "disk, #{scope_note}: #{detail}"
-        end
+def check_done_signals(scopes: nil)
+  conflicts = []
+  gaps = []              # delivery-claim (outcome.md) gaps only - legacy, informational
+  operational_gaps = []  # savepoint gaps (missing file, or missing Done echo) - repairable
+  stalled = []
+  phantoms = []
 
-        # Completeness gap (warn, not fail): a terminal intent whose outcome.md is
-        # missing/placeholder. Legacy terminal intents predate this convention and
-        # are immutable, so this is advisory, never breakage.
-        if terminal && !outcome_real
-          state = File.exist?(outcome) ? "still a placeholder" : "missing"
-          gaps << "#{label}: terminal in INDEX but outcome.md is #{state} " \
-                  "(author outcome.md with the disposition header)"
-        end
+  done_signal_stores(scopes).each do |store|
+    index_sections_by_dir(store[:index]).each do |dirname, in_sections|
+      dir = File.join(store[:store_dir], dirname)
+      next unless File.directory?(dir)
 
-        next unless terminal
-
-        # Audit echo (weakest signal, D1): the savepoint should carry a
-        # `Done delivered|abandoned` line. Missing on legacy history -> advisory
-        # gap, unless the (scope, id) is on the frozen pre-161 amnesty list
-        # (intent 170a). The amnesty is scope-qualified: an id on the list for
-        # one scope does not grandfather the same id in another scope.
-        savepoint = File.join(dir, "savepoint.md")
-        if File.exist?(savepoint) && File.read(savepoint) !~ /\bDone\b.*\b(delivered|abandoned)\b/
-          id = dirname.split("--", 2).first
-          amnestied = @bookend_amnesty.fetch(store[:scope], []).include?(id)
-          unless amnestied
-            gaps << "#{label}: terminal in INDEX but savepoint.md has no " \
-                    "`Done delivered|abandoned` line (audit echo missing)"
-          end
-        end
+      terminal = (in_sections & ["Completed", "Abandoned"]).any?
+      active = in_sections.include?("Active") && !terminal
+      label = "#{store[:scope]} store/#{dirname}"
 
-        # Stalled completion: the End tail never released the delivery lock, so the
-        # post-done window `[INDEX terminal -> Lock.release]` never closed.
-        if File.exist?(Lock.path(dir))
-          note = Lock.fresh?(dir) ? "delivery.lock still present (post-done window not closed)"
-                                  : "delivery.lock is present and STALE"
-          stalled << "#{label}: #{note} — the End tail did not finish"
-        end
-      end
+      findings = done_signal_findings_for_dir(
+        dir, label: label, scope: store[:scope], dirname: dirname, terminal: terminal, active: active
+      )
+      conflicts << findings[:conflict] if findings[:conflict]
+      phantoms << findings[:phantom] if findings[:phantom]
+      gaps.concat(findings[:gap])
+      operational_gaps.concat(findings[:operational_gap])
+      stalled << findings[:stalled] if findings[:stalled]
     end
+  end
 
-    checks = []
+  checks = []
 
-    # signals_agree: only the canonical INDEX-wins conflict is a hard fail, so
-    # `doctor` never goes red on immutable legacy terminal intents.
-    if conflicts.empty?
-      checks << check(
-        category: "done_signals", name: "signals_agree", status: "pass",
-        message: "No done-signal conflicts (no intent has a real outcome.md while still Active)"
-      )
-    else
-      checks << check(
-        category: "done_signals", name: "signals_agree", status: "fail",
-        message: "#{conflicts.size} done-signal conflict#{conflicts.size == 1 ? "" : "s"} " \
-                 "(INDEX ## Completed/## Abandoned is canonical; a real outcome.md must not stay Active)",
-        details: conflicts, fixable: true,
-        fix_hint: "Reconcile to INDEX (canonical): move the intent to its terminal section, or revert " \
-                  "outcome.md to a placeholder. Deliverable-exists but still-Active is the one done-signal " \
-                  "state that must never persist."
-      )
-    end
+  # signals_agree: unchanged.
+  if conflicts.empty?
+    checks << check(
+      category: "done_signals", name: "signals_agree", status: "pass",
+      message: "No done-signal conflicts (no intent has a real outcome.md while still Active)"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "signals_agree", status: "fail",
+      message: "#{conflicts.size} done-signal conflict#{conflicts.size == 1 ? "" : "s"} " \
+               "(INDEX ## Completed/## Abandoned is canonical; a real outcome.md must not stay Active)",
+      details: conflicts, fixable: true,
+      fix_hint: "Reconcile to INDEX (canonical): move the intent to its terminal section, or revert " \
+                "outcome.md to a placeholder. Deliverable-exists but still-Active is the one done-signal " \
+                "state that must never persist."
+    )
+  end
 
-    # signals_complete: terminal completeness gaps are advisory (warn), because
-    # completed intents are immutable and legacy history predates this convention.
-    if gaps.empty?
-      checks << check(
-        category: "done_signals", name: "signals_complete", status: "pass",
-        message: "Every terminal intent carries a real outcome.md and a Done savepoint echo"
-      )
-    else
-      checks << check(
-        category: "done_signals", name: "signals_complete", status: "warn",
-        message: "#{gaps.size} terminal completeness gap#{gaps.size == 1 ? "" : "s"} " \
-                 "(outcome.md or the savepoint Done echo is missing; advisory on immutable history)",
-        details: gaps, fixable: true,
-        fix_hint: "For live terminals, author a real outcome.md with the `disposition:` header via the " \
-                  "completion/abandon path (plastic-auto or plastic-store-curating) and stamp the terminal " \
-                  "savepoint. Legacy terminal intents are immutable, so pre-convention gaps stay advisory."
-      )
-    end
+  # signals_complete (intent 211, 219 D6, repurposed): outcome.md delivery-claim gaps only.
+  # Never fabricated, so there is no legitimate fix to hint at - always status "pass",
+  # informational (matches check_skill_lint's advisory precedent: count + details, no
+  # fix_hint/fixable, never affects doctor's exit code).
+  if gaps.empty?
+    checks << check(
+      category: "done_signals", name: "signals_complete", status: "pass",
+      message: "Every terminal intent carries a real outcome.md"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "signals_complete", status: "pass",
+      message: "#{gaps.size} terminal intent#{gaps.size == 1 ? "" : "s"} missing a real outcome.md " \
+               "(delivery claim - never fabricated; informational only, does not affect doctor's exit code)",
+      details: gaps
+    )
+  end
 
-    if stalled.empty?
-      checks << check(
-        category: "done_signals", name: "stalled_completion", status: "pass",
-        message: "No stalled completions (every terminal intent released its delivery lock)"
-      )
-    else
-      checks << check(
-        category: "done_signals", name: "stalled_completion", status: "warn",
-        message: "#{stalled.size} stalled completion#{stalled.size == 1 ? "" : "s"} " \
-                 "(terminal in INDEX but the End tail did not finish)",
-        details: stalled, fixable: true,
-        fix_hint: "Finish the End tail via stale-lock reclaim: run /plastic-doctor reclaim the lock, " \
-                  "then complete the tail (Worktree.release -> Lock.release -> purge -> QMD reindex " \
-                  "last). This FINISHES a completion; it is NOT a reactivation of a done intent."
-      )
-    end
+  # savepoint_operational (intent 211, NEW): missing savepoint.md or missing Done echo -
+  # repairable via maintenance-run --tool rebuild-savepoint, so this stays warn+fixable.
+  if operational_gaps.empty?
+    checks << check(
+      category: "done_signals", name: "savepoint_operational", status: "pass",
+      message: "No terminal intent is missing an operational savepoint.md or its Done echo"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "savepoint_operational", status: "warn",
+      message: "#{operational_gaps.size} terminal intent#{operational_gaps.size == 1 ? "" : "s"} " \
+               "missing an operational savepoint.md or its Done echo (reconstructible)",
+      details: operational_gaps, fixable: true,
+      fix_hint: "Reconstruct the minimal two-line started/Done echo via " \
+                "`maintenance-run --tool rebuild-savepoint --intent <id> --apply` (197-conformant: " \
+                "receipt-before-write via RevisionsWriter, one intent per invocation, owner-approval-gated)."
+    )
+  end
 
-    # savepoint_truthful: advisory only, never fails the run (intent 134). A phantom line on a
-    # live intent auto-rebuilds; on terminal (immutable) history it stays report-only.
-    if phantoms.empty?
-      checks << check(
-        category: "done_signals", name: "savepoint_truthful", status: "pass",
-        message: "No savepoint.md lines are contradicted by disk (phantom-line check clean)"
-      )
-    else
-      checks << check(
-        category: "done_signals", name: "savepoint_truthful", status: "warn",
-        message: "#{phantoms.size} intent#{phantoms.size == 1 ? "" : "s"} carry savepoint.md " \
-                 "line(s) contradicted by disk (advisory; terminal history stays report-only)",
-        details: phantoms, fixable: true,
-        fix_hint: "For a live (Active) intent, run plastic-intent-savepoint to rebuild via " \
-                  "Bridge.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
-                  "a phantom there stays advisory unless an explicit human grant authorizes the " \
-                  "124a manual Done-bookend repair."
-      )
-    end
+  if stalled.empty?
+    checks << check(
+      category: "done_signals", name: "stalled_completion", status: "pass",
+      message: "No stalled completions (every terminal intent released its delivery lock)"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "stalled_completion", status: "warn",
+      message: "#{stalled.size} stalled completion#{stalled.size == 1 ? "" : "s"} " \
+               "(terminal in INDEX but the End tail did not finish)",
+      details: stalled, fixable: true,
+      fix_hint: "Finish the End tail via stale-lock reclaim: run /plastic-doctor reclaim the lock, " \
+                "then complete the tail (Worktree.release -> Lock.release -> purge -> QMD reindex " \
+                "last). This FINISHES a completion; it is NOT a reactivation of a done intent."
+    )
+  end
 
-    checks
+  # savepoint_truthful: advisory only (intent 134), never fails. No amnesty suppression left.
+  if phantoms.empty?
+    checks << check(
+      category: "done_signals", name: "savepoint_truthful", status: "pass",
+      message: "No savepoint.md lines are contradicted by disk (phantom-line check clean)"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "savepoint_truthful", status: "warn",
+      message: "#{phantoms.size} intent#{phantoms.size == 1 ? "" : "s"} carry savepoint.md " \
+               "line(s) contradicted by disk (advisory; terminal history stays report-only)",
+      details: phantoms, fixable: true,
+      fix_hint: "For a live (Active) intent, run plastic-intent-savepoint to rebuild via " \
+                "Bridge.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
+                "a phantom there stays advisory unless an explicit human grant authorizes the " \
+                "124a manual Done-bookend repair."
+    )
   end
 
-  # Build the cross-store node maps (basename + label per store) + relocation map
-  # from ALL stores, then for every intent compute its canonical `## Links`
-  # projection and flag any whose ACTUAL `## Links` section differs (membership or
-  # ordering drift), or whose projection raises UnresolvedRef. `scopes` (nil = full
-  # run) filters only the REPORTED findings by origin scope.
-  def links_projection_check(scopes: nil)
-    all_dirs = all_intent_dirs
+  checks
+end
 
+  # Build the cross-store node maps (basename + label per store) + relocation map from ALL
+  # stores (intent 222): the one shared build both the store-wide links_projection_check and
+  # the new per-intent intent_links_projection_check_for call, so the two can never disagree
+  # on how a ref resolves.
+  def build_links_projection_context
+    all_dirs = all_intent_dirs
     store_index = seeded_store_index
     node_index = Hash.new { |h, k| h[k] = {} }
     intents = [] # { scope:, id:, sources:, chain:, path: }
@@ -796,6 +876,20 @@ class Doctor
     end
 
     relocation_map = GraphRebuild.build_relocation_map(cross_store_index_texts)
+    { store_index: store_index, node_index: node_index, relocation_map: relocation_map, intents: intents }
+  end
+
+  # Build the cross-store node maps (basename + label per store) + relocation map
+  # from ALL stores, then for every intent compute its canonical `## Links`
+  # projection and flag any whose ACTUAL `## Links` section differs (membership or
+  # ordering drift), or whose projection raises UnresolvedRef. `scopes` (nil = full
+  # run) filters only the REPORTED findings by origin scope.
+  def links_projection_check(scopes: nil)
+    ctx = build_links_projection_context
+    store_index = ctx[:store_index]
+    node_index = ctx[:node_index]
+    relocation_map = ctx[:relocation_map]
+    intents = ctx[:intents]
 
     findings = []
     intents.each do |node|
@@ -849,6 +943,171 @@ class Doctor
     LinksSection.extract_section(IntentValidator.body_of(File.read(path)))
   end
 
+  # --- Check scope 4: per-intent structure gate at intent-end (intent 222) ---
+  #
+  # Doctor's fourth check scope, invoked by `--intent <id>`. Never a store-wide sweep:
+  # resolves exactly one intent directory (mirrors scripts/end-intent's resolve_intent_dir /
+  # scripts/project-links's --intent disambiguation) and returns five checks, four
+  # FAIL-severity, one WARN-severity (intent_savepoint_truthful stays WARN per intent 134's
+  # binding advisory-only ruling; see spec.md D2/D8 - do NOT escalate it to FAIL).
+  def check_intent_end(id, store: nil, disposition: nil)
+    intent_dir, scope = resolve_single_intent_dir(id, store: store)
+    unless intent_dir
+      return [check(
+        category: "intent_end", name: "intent_resolved", status: "fail",
+        message: "no intent directory matches #{id.inspect}" \
+                 "#{store ? " under store #{store.inspect}" : ""}"
+      )]
+    end
+
+    [
+      intent_structure_check(intent_dir),
+      intent_lifecycle_artifacts_check(intent_dir, disposition),
+      intent_checklist_complete_check(intent_dir),
+      intent_links_projection_check_for(id, scope),
+      intent_savepoint_truthful_check(intent_dir),
+    ]
+  end
+
+  # Resolves --intent (+ optional --store) to exactly one (intent_dir, scope) pair, or
+  # [nil, nil] when found nowhere. `store`, when given, must already be a resolved scope key
+  # (e.g. "global" or "project:<slug>", matching all_intent_dirs' own `d[:scope]`); the CLI
+  # boundary (`cli`) is what translates the loosely-typed --store flag value into this shape.
+  # Aborts loud (raises) on cross-store ambiguity when no scope was given, mirroring
+  # scripts/project-links's resolve_target_store.
+  def resolve_single_intent_dir(id, store: nil)
+    candidates = all_intent_dirs.select { |d| d[:name].start_with?("#{id}--") }
+    candidates = candidates.select { |d| d[:scope] == store } if store
+
+    return [nil, nil] if candidates.empty?
+    if candidates.length > 1
+      scopes = candidates.map { |d| d[:scope] }.join(", ")
+      raise "intent #{id.inspect} is ambiguous across stores (#{scopes}); pass --store <key> " \
+            "to disambiguate (e.g. --store #{candidates.first[:scope]})"
+    end
+
+    [candidates.first[:path], candidates.first[:scope]]
+  end
+
+  def intent_structure_check(intent_dir)
+    result = IntentValidator.validate(intent_dir)
+    if result[:ok]
+      check(category: "intent_end", name: "intent_structure", status: "pass",
+            message: "Intent file frontmatter and sections are well-formed")
+    else
+      check(category: "intent_end", name: "intent_structure", status: "fail",
+            message: "Intent file has #{result[:errors].size} structural error(s)",
+            details: result[:errors])
+    end
+  end
+
+  INTENT_END_LIFECYCLE_FILES = %w[spec.md plan.md checklist.md outcome.md].freeze
+
+  def intent_lifecycle_artifacts_check(intent_dir, disposition)
+    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Bridge.stage_file_present?(File.join(intent_dir, f)) }
+    unless Bridge.stage_file_present?(Bridge.intent_file(intent_dir))
+      missing = [File.basename(Bridge.intent_file(intent_dir))] + missing
+    end
+
+    outcome_note = nil
+    if disposition && !missing.include?("outcome.md")
+      outcome_note = OutcomeGuard.reason(intent_dir, disposition)
+    end
+
+    if missing.empty? && outcome_note.nil?
+      check(category: "intent_end", name: "intent_lifecycle_artifacts", status: "pass",
+            message: "Every lifecycle artifact is present and real")
+    else
+      details = missing.map { |f| "#{f} missing or still a placeholder" }
+      details << outcome_note if outcome_note
+      check(category: "intent_end", name: "intent_lifecycle_artifacts", status: "fail",
+            message: "#{details.size} lifecycle-artifact gap(s)", details: details)
+    end
+  end
+
+  def intent_checklist_complete_check(intent_dir)
+    path = File.join(intent_dir, "checklist.md")
+    unless Bridge.stage_file_present?(path)
+      return check(category: "intent_end", name: "intent_checklist_complete", status: "pass",
+                    message: "n/a: checklist.md absent or placeholder (flagged above if that is a gap)")
+    end
+
+    unchecked = File.read(path).scan(/^- \[ \].*$/)
+    if unchecked.empty?
+      check(category: "intent_end", name: "intent_checklist_complete", status: "pass",
+            message: "checklist.md has zero unchecked items")
+    else
+      check(category: "intent_end", name: "intent_checklist_complete", status: "fail",
+            message: "#{unchecked.size} unchecked checklist item(s) remain", details: unchecked)
+    end
+  end
+
+  def intent_links_projection_check_for(id, scope)
+    ctx = build_links_projection_context
+    node = ctx[:intents].find { |n| n[:id] == id && n[:scope] == scope }
+    unless node
+      return check(category: "intent_end", name: "intent_links_projection", status: "warn",
+                    message: "could not locate #{id.inspect} in the links-projection graph")
+    end
+
+    resolve = ->(ref) do
+      LinksProjection.resolve_ref_projection(
+        ref, referer_store: node[:scope], relocation_map: ctx[:relocation_map],
+             store_index: ctx[:store_index], node_index: ctx[:node_index]
+      )
+    end
+
+    begin
+      expected = LinksProjection.section(sources: node[:sources], chain: node[:chain], resolve: resolve)
+      actual = actual_links_section(node[:path])
+    rescue LinksProjection::UnresolvedRef, LinksSection::AmbiguousLinks => e
+      return check(category: "intent_end", name: "intent_links_projection", status: "fail",
+                    message: "## Links projection failed: #{e.message}")
+    end
+
+    if actual == expected
+      check(category: "intent_end", name: "intent_links_projection", status: "pass",
+            message: "## Links matches its frontmatter projection")
+    else
+      check(category: "intent_end", name: "intent_links_projection", status: "fail",
+            message: "## Links does not match its frontmatter projection (membership/ordering drift)",
+            fixable: true,
+            fix_hint: "Run scripts/project-links --intent #{id} --apply (via maintenance-run)")
+    end
+  end
+
+  # WARN-only, per intent 134 (savepoint truthfulness is advisory, never a hard gate). Do not
+  # change this to FAIL: it would silently contradict a standing, binding ruling.
+  def intent_savepoint_truthful_check(intent_dir)
+    savepoint = File.join(intent_dir, "savepoint.md")
+    unless File.exist?(savepoint)
+      return check(category: "intent_end", name: "intent_savepoint_truthful", status: "warn",
+                    message: "savepoint.md is missing")
+    end
+
+    first_line = File.read(savepoint).each_line.find { |l| !l.strip.empty? }.to_s.strip
+    parts = first_line.split(/\s{2,}/)
+    born_pair = parts.length >= 3 ? [parts[1], parts[2]] : nil
+    expected_pair = Bridge.savepoint_milestone(intent_dir, File.basename(Bridge.intent_file(intent_dir)))
+
+    phantoms = Bridge.savepoint_phantom_lines(intent_dir)
+    problems = []
+    problems << "born line #{born_pair.inspect} does not match the expected #{expected_pair.inspect}" \
+      if born_pair != expected_pair
+    problems << "#{phantoms.size} phantom savepoint line(s): " \
+                "#{phantoms.map { |l, r| "#{l} (#{r})" }.join("; ")}" if phantoms.any?
+
+    if problems.empty?
+      check(category: "intent_end", name: "intent_savepoint_truthful", status: "pass",
+            message: "Savepoint born line and phantom-line state are truthful")
+    else
+      check(category: "intent_end", name: "intent_savepoint_truthful", status: "warn",
+            message: "#{problems.size} savepoint truthfulness issue(s) (advisory, never blocking)",
+            details: problems,
+            fixable: true, fix_hint: "Run plastic-intent-savepoint to rebuild via Bridge.rebuild_savepoint")
+    end
+  end
+
   # Build the relocation map + cross-store store_index from ALL stores, then for
   # every intent's cross-store `sources`/`chain` ref resolve it and flag:
   #   - DEAD: the target resolves nowhere
@@ -1632,7 +1891,7 @@ class Doctor
 
   # --- Check category 4: Core files ---
 
-  def check_core_files(agent_key)
+  def check_core_files(agent_key, include_drift: true)
     checks = []
 
     # plastic_md
@@ -1746,7 +2005,7 @@ class Doctor
       end
     end
 
-    checks += check_agent_model_drift(agent_key)
+    checks += check_agent_model_drift(agent_key) if include_drift
 
     checks
   end
@@ -2074,6 +2333,58 @@ class Doctor
     checks
   end
 
+  # --- Check category: registered project paths (core-only, D1) ---
+  #
+  # D1 requires every registered project's store to have its repository path resolve to a
+  # real, existing directory. check_project_store (above) only validates the plastic-home-side
+  # mirror (~/.plastic/projects/<slug>/{store,INDEX.md,project.yml}); this method validates the
+  # registered repo path itself (projects.yml's "path" key), decoupled from 175's deeper
+  # repo-root-versus-registered-path question (219 D9).
+  def check_registered_project_paths
+    checks = []
+
+    projects_yml_path = File.join(plastic_home, "projects.yml")
+    projects_data = load_yaml_safe(projects_yml_path)
+
+    if projects_data.nil?
+      checks << check(
+        category: "project_stores", name: "registered_project_paths", status: "fail",
+        message: "projects.yml not found or invalid at #{tilde(projects_yml_path)}",
+        fixable: true, fix_hint: "Re-run the Plastic installer to restore projects.yml"
+      )
+      return checks
+    end
+
+    projects = projects_data["projects"]
+    unless projects.is_a?(Hash) && !projects.empty?
+      checks << check(
+        category: "project_stores", name: "registered_project_paths", status: "pass",
+        message: "No projects registered"
+      )
+      return checks
+    end
+
+    projects.each do |slug, project_info|
+      path = project_info.is_a?(Hash) ? project_info["path"] : nil
+
+      if path && File.directory?(path)
+        checks << check(
+          category: "project_stores", name: "project_path_resolves", status: "pass",
+          message: "Registered path for '#{slug}' resolves to a real directory"
+        )
+      else
+        checks << check(
+          category: "project_stores", name: "project_path_resolves", status: "fail",
+          message: "Registered path for '#{slug}' does not resolve to a real directory",
+          details: [path ? tilde(path) : "(no path set in projects.yml)"],
+          fixable: false
+        )
+      end
+    end
+
+    checks
+  end
+
   # Per-project validation extracted from check_project_stores so a single
   # project can be checked in isolation (used by `--store <slug>`).
   def check_project_store(slug, project_info)
@@ -2386,7 +2697,7 @@ class Doctor
   # When present, we report whether every Plastic store is registered as a QMD
   # collection. Everything here is read-only; we never invoke a mutating qmd
   # subcommand. detector/runner are injectable so tests stay hermetic.
-  def check_qmd(detector: QmdSync.method(:detect), runner: QmdSync.default_runner)
+  def check_qmd(detector: QmdSync.method(:detect), runner: QmdSync.default_runner, collection: nil)
     return [absent_qmd_check] unless detector.call
 
     checks = [check(
@@ -2395,17 +2706,20 @@ class Doctor
     )]
 
     status = QmdSync.status(plastic_home: plastic_home, runner: runner, detector: detector)
-    missing = status[:missing] || []
+    expected = collection ? [collection] : (status[:expected] || [])
+    missing = collection ? (Array(status[:missing]) & expected) : (status[:missing] || [])
 
-    if status[:all_registered]
+    if missing.empty?
       checks << check(
         category: "qmd", name: "collections", status: "pass",
-        message: "All #{status[:expected].size} Plastic store(s) registered as QMD collections"
+        message: collection ? "Store collection '#{collection}' registered as a QMD collection" \
+                             : "All #{expected.size} Plastic store(s) registered as QMD collections"
       )
     else
       checks << check(
         category: "qmd", name: "collections", status: "warn",
-        message: "#{missing.size} Plastic store(s) not registered as QMD collections",
+        message: collection ? "Store collection '#{collection}' not registered as a QMD collection" \
+                             : "#{missing.size} Plastic store(s) not registered as QMD collections",
         details: missing,
         fixable: true, fix_hint: "Run: qmd-sync register --all"
       )
@@ -2421,6 +2735,47 @@ class Doctor
     )
   end
 
+  # --- Check category: tool readiness (Serena, Enola) ---
+  #
+  # One readiness check per recognized code-navigation power tool (intent 221, D4). Wraps
+  # PowerTools' existing pure, injectable presence detectors (scripts/lib/power_tools.rb).
+  # Absence is a PASS with a note, never a warn, mirroring check_qmd's absent-is-a-silent-pass
+  # shape (108 D8: power tools are recommendations, never a hard gate). No fail path exists for
+  # either check: PowerTools' detectors are pure presence probes (a marker-directory walk or a
+  # PATH scan) with no handshake to test whether a detected tool actually works, so there is
+  # nothing to report beyond present/absent.
+  def check_serena(cwd:, path_probe: PowerTools.method(:which_serena), marker_finder: PowerTools.method(:serena_marker?))
+    present = PowerTools.serena?(cwd: cwd, path_probe: path_probe, marker_finder: marker_finder)
+
+    if present
+      [check(
+        category: "tools", name: "serena_ready", status: "pass",
+        message: "Serena is available for code navigation"
+      )]
+    else
+      [check(
+        category: "tools", name: "serena_ready", status: "pass",
+        message: "Serena not installed (optional code-navigation tool)"
+      )]
+    end
+  end
+
+  def check_enola(cwd:, path_probe: PowerTools.method(:which_enola), marker_finder: PowerTools.method(:enola_marker?))
+    present = PowerTools.enola?(cwd: cwd, path_probe: path_probe, marker_finder: marker_finder)
+
+    if present
+      [check(
+        category: "tools", name: "enola_ready", status: "pass",
+        message: "Enola is available for code navigation"
+      )]
+    else
+      [check(
+        category: "tools", name: "enola_ready", status: "pass",
+        message: "Enola not installed (optional code-navigation tool)"
+      )]
+    end
+  end
+
   # --- Check category: skill-lint (advisory only; intent 85b) ---
   #
   # Reports SkillLint's five structural checks over the skills/ tree as a
@@ -2468,47 +2823,88 @@ class Doctor
   def run_checks(agent_key)
     all_checks = []
     all_checks += check_global_store
-    all_checks += check_conventions
+    all_checks += check_conventions(scopes: ["global"])
     all_checks += check_agent_registration(agent_key)
     all_checks += check_core_files(agent_key)
-    all_checks += check_project_stores
     all_checks += check_deprecations
     all_checks += check_config_asks(agent_key)
     all_checks += check_qmd
-    all_checks += check_done_signals
+    all_checks += check_done_signals(scopes: ["global"])
     all_checks += check_skill_lint
     all_checks += check_install_integrity
 
     summarize(all_checks, agent_key)
   end
 
-  # Binary core sync check: agent registration + core files + manifest sync,
-  # rolled up with binary: true so ANY warn or fail makes the overall status
-  # "fail" (and "warn" is never emitted). Used by `doctor.rb --core`.
+  # Binary core sync check: agent registration + core files (drift excluded) + manifest
+  # sync + registered project paths + global store availability, rolled up with binary:
+  # true so ANY warn or fail makes the overall status "fail" (and "warn" is never
+  # emitted). Used by `doctor.rb --core` (219 D1/D2: operational readiness only, no
+  # agent_model_drift, no store-content scanning).
   def run_core_checks(agent_key)
     all_checks = []
     all_checks += check_agent_registration(agent_key)
-    all_checks += check_core_files(agent_key)
+    all_checks += check_core_files(agent_key, include_drift: false)
     all_checks += check_manifest_sync(agent_key)
+    all_checks += check_registered_project_paths
+    all_checks += check_global_store_available
 
     summarize(all_checks, agent_key, binary: true)
   end
 
+  # Per-intent structure gate for `doctor.rb --intent <id> [--store <key>] [--disposition ...]`
+  # (intent 222). `store`, here, is already the resolved scope key (see
+  # normalize_intent_store_scope, the CLI-boundary translator that turns the loosely-typed
+  # --store flag value into this shape before calling in).
+  def run_intent_check(id, store: nil, disposition: nil)
+    checks = check_intent_end(id, store: store, disposition: disposition)
+    summarize(checks, "claude", binary: false)
+  end
+
+  # Translate the loosely-typed --store flag value (nil / :all / :global / a bare project
+  # slug String, see parse_args) into the scope-key shape all_intent_dirs' own `d[:scope]`
+  # uses ("global" / "project:<slug>"), for --intent disambiguation only. --store with no
+  # value (:all) means "no disambiguation given" here, distinct from its store-scan meaning.
+  def normalize_intent_store_scope(store)
+    case store
+    when nil, :all then nil
+    when :global then "global"
+    else "project:#{store}"
+    end
+  end
+
   # Store-scoped checks for `doctor.rb --store [global|<slug>]`.
   #   :all     -> global store + all project stores + all conventions
   #   :global  -> global store + conventions scoped to ["global"]
   #   "<slug>" -> that project only + conventions scoped to ["project:<slug>"]
   #               (fail if the slug is not registered in projects.yml)
   # 3-state roll-up (pass/warn/fail), like the full run.
-  def run_store_checks(store)
+  # QMD reachability is now wired into every branch, scoped to that branch's own
+  # collection(s) (D3); Serena/Enola readiness is per-slug only (D4).
+  # Same injection seams as all_checks_for_project_slug (intent 221a), threaded through
+  # so every branch's check_qmd/check_serena/check_enola call can be made hermetic.
+  # Defaults are byte-identical to the real probes; both production callers
+  # (scripts/doctor.rb's CLI entry point and scripts/dashboard.rb) call
+  # run_store_checks(store) with a single positional argument and no kwargs, so
+  # behavior at those call sites is unchanged.
+  def run_store_checks(store, qmd_detector: QmdSync.method(:detect), qmd_runner: QmdSync.default_runner,
+                        serena_path_probe: PowerTools.method(:which_serena),
+                        serena_marker_finder: PowerTools.method(:serena_marker?),
+                        enola_path_probe: PowerTools.method(:which_enola),
+                        enola_marker_finder: PowerTools.method(:enola_marker?))
     all_checks =
       case store
       when :all
-        check_global_store + check_project_stores + check_conventions + check_done_signals
+        check_global_store + check_project_stores + check_conventions + check_done_signals +
+          check_qmd(detector: qmd_detector, runner: qmd_runner)
       when :global
-        check_global_store + check_conventions(scopes: ["global"]) + check_done_signals(scopes: ["global"])
+        check_global_store + check_conventions(scopes: ["global"]) +
+          check_done_signals(scopes: ["global"]) +
+          check_qmd(detector: qmd_detector, runner: qmd_runner, collection: "plastic-global")
       else
-        all_checks_for_project_slug(store)
+        all_checks_for_project_slug(store, qmd_detector: qmd_detector, qmd_runner: qmd_runner,
+                                     serena_path_probe: serena_path_probe, serena_marker_finder: serena_marker_finder,
+                                     enola_path_probe: enola_path_probe, enola_marker_finder: enola_marker_finder)
       end
 
     summarize(all_checks, "claude", binary: false)
@@ -2516,7 +2912,16 @@ class Doctor
 
   # Build the checks for a single project slug, or a lone fail check when the
   # slug is unknown.
-  def all_checks_for_project_slug(slug)
+  # qmd_detector/qmd_runner and the serena_/enola_ path_probe/marker_finder kwargs are
+  # injection seams (intent 221a) mirroring check_qmd/check_serena/check_enola's own
+  # kwargs, defaulted to the same real probes those methods already default to. No
+  # caller passes these; they exist so tests can make host state (QMD/Serena/Enola
+  # presence) irrelevant.
+  def all_checks_for_project_slug(slug, qmd_detector: QmdSync.method(:detect), qmd_runner: QmdSync.default_runner,
+                                   serena_path_probe: PowerTools.method(:which_serena),
+                                   serena_marker_finder: PowerTools.method(:serena_marker?),
+                                   enola_path_probe: PowerTools.method(:which_enola),
+                                   enola_marker_finder: PowerTools.method(:enola_marker?))
     projects_data = load_yaml_safe(File.join(plastic_home, "projects.yml"))
     projects = projects_data.is_a?(Hash) ? projects_data["projects"] : nil
 
@@ -2528,9 +2933,16 @@ class Doctor
       )]
     end
 
-    check_project_store(slug, projects[slug]) +
+    project_info = projects[slug]
+    project_path = project_info.is_a?(Hash) ? project_info["path"] : nil
+    probe_cwd = project_path || Dir.pwd
+
+    check_project_store(slug, project_info) +
       check_conventions(scopes: ["project:#{slug}"]) +
-      check_done_signals(scopes: ["project:#{slug}"])
+      check_done_signals(scopes: ["project:#{slug}"]) +
+      check_qmd(detector: qmd_detector, runner: qmd_runner, collection: "plastic-#{slug}") +
+      check_serena(cwd: probe_cwd, path_probe: serena_path_probe, marker_finder: serena_marker_finder) +
+      check_enola(cwd: probe_cwd, path_probe: enola_path_probe, marker_finder: enola_marker_finder)
   end
 
   # Roll a list of checks up into the standard result envelope.
@@ -2572,7 +2984,15 @@ class Doctor
     end
 
     result =
-      if !flags[:store].nil?
+      if flags[:intent]
+        begin
+          run_intent_check(flags[:intent], store: normalize_intent_store_scope(flags[:store]),
+                                            disposition: flags[:disposition])
+        rescue StandardError => e
+          $stderr.puts "doctor: #{e.message}"
+          exit 2
+        end
+      elsif !flags[:store].nil?
         run_store_checks(flags[:store])
       elsif flags[:core]
         run_core_checks(flags[:agent])