@zalom/plastic 2.0.0-alpha.19 → 2.0.0-alpha.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "2.0.0-alpha.19",
+  "version": "2.0.0-alpha.20",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/doctor.rb

@@ -29,6 +29,7 @@ require_relative "lib/lock"
 require_relative "lib/savepoint"
 require_relative "lib/node_ledger"
 require_relative "lib/ready_set"
+require_relative "lib/index_projection"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
 require_relative "lib/skill_lint"
@@ -837,6 +838,9 @@ def check_done_signals(scopes: nil)
   unbackfilled = []       # spec/plan/actions gaps on terminal intents (intent 308) - repairable
   excluded_backfill = []  # backfill gaps knowingly exempted via doctor-exclusions (intent 308)
   dead_rows_by_rule = Hash.new { |h, k| h[k] = [] }
+  index_drift = []        # intent 337 (G4): INDEX vs. the intent ledgers, scoped to what
+                           # savepoint_operational does not already report (row 6.7 - a silent or
+                           # absent ledger is already IndexProjection's own exclusion, row 5.13)
 
   done_signal_stores(scopes).each do |store|
     exclusions = DoctorExclusions.load(store[:index])
@@ -845,6 +849,14 @@ def check_done_signals(scopes: nil)
       exclusion_error_paths << exclusions[:path]
     end
 
+    if File.exist?(store[:index])
+      projection = IndexProjection.analyze(store[:store_dir], index_path: store[:index])
+      projection[:drift].each do |row|
+        index_drift << "#{store[:scope]}: #{row[:id]} - INDEX says #{row[:index_status]}, " \
+                        "the ledger's last Done line says #{row[:ledger_status]}"
+      end
+    end
+
     consumed = { "savepoint_operational" => [], "backfilled_complete" => [] }
     # `known_ids` (post-review fix): every intent id with a REAL DIRECTORY in this store, scanned
     # directly from disk - independent of INDEX.md. An id can have a directory on disk without
@@ -1089,6 +1101,30 @@ def check_done_signals(scopes: nil)
     )
   end
 
+  # index_ledger_drift (intent 337, G4): a REAL terminal ledger line (Done
+  # delivered or abandoned) that disagrees with the INDEX section an intent
+  # currently sits in. Never fires for a silent or absent ledger - that gap
+  # is savepoint_operational's own concern, and IndexProjection's own drift
+  # computation already excludes it (row 5.13), so no id is ever double
+  # reported across the two checks (row 6.7). Warn+fixable: `index-projection
+  # <store_root> --write` is the repair, never invented here.
+  if index_drift.empty?
+    checks << check(
+      category: "done_signals", name: "index_ledger_drift", status: "pass",
+      message: "No INDEX section disagrees with an intent's own terminal ledger line"
+    )
+  else
+    checks << check(
+      category: "done_signals", name: "index_ledger_drift", status: "warn",
+      message: "#{index_drift.size} intent#{index_drift.size == 1 ? "" : "s"} whose terminal " \
+               "ledger line disagrees with the INDEX section it currently sits in",
+      details: index_drift, fixable: true,
+      fix_hint: "Reconcile via `index-projection <store_root> --write` (the ledger wins; only the " \
+                "conflicting entries move, every other byte of INDEX.md, including ## Clusters and " \
+                "## Relocated, is left untouched)."
+    )
+  end
+
   checks
 end
 

package/scripts/index-projection

@@ -0,0 +1,74 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# index-projection - the CLI over IndexProjection (intent 337, G4): prints
+# the drift between INDEX.md and the intent ledgers for one store root
+# (INDEX.md plus a store/ directory), exits non-zero when any drift exists.
+# --write renders INDEX.md's four status sections from the projection
+# through AtomicWrite; every other byte, including ## Clusters and
+# ## Relocated, is untouched.
+#
+# Usage:
+#   index-projection <store_root> [--write]
+#
+# Exit codes:
+#   0 - no drift (or, with --write, the write landed cleanly)
+#   1 - drift exists (a real terminal-ledger conflict, an INDEX entry with
+#       no directory, or a directory INDEX does not list)
+#   2 - usage: no argument, or the path is not a store root
+
+require_relative "lib/index_projection"
+
+module IndexProjectionCli
+  module_function
+
+  def usage
+    warn "Usage: index-projection <store_root> [--write]"
+  end
+
+  def main(argv)
+    args = argv.dup
+    write = !!args.delete("--write")
+
+    root = args.shift
+    unless root && Dir.exist?(root)
+      warn "index-projection: #{root.inspect} is not a store root"
+      usage
+      return 2
+    end
+
+    index_path = File.join(root, "INDEX.md")
+    store_dir = File.join(root, "store")
+    unless File.exist?(index_path)
+      warn "index-projection: no INDEX.md at #{index_path}"
+      return 2
+    end
+
+    if write
+      result = IndexProjection.write(store_dir, index_path: index_path)
+      unless result[:ok]
+        warn "index-projection: #{result[:error]}"
+        return 2
+      end
+      puts "index-projection: wrote #{index_path} (#{result[:moved].length} moved)"
+      return 0
+    end
+
+    analysis = IndexProjection.analyze(store_dir, index_path: index_path)
+    print_report(analysis)
+
+    (analysis[:drift].empty? && analysis[:index_only].empty? && analysis[:directory_only].empty?) ? 0 : 1
+  end
+
+  def print_report(analysis)
+    puts "Drift (#{analysis[:drift].length}):"
+    analysis[:drift].each { |r| puts "  #{r[:id]}: INDEX=#{r[:index_status]} ledger=#{r[:ledger_status]}" }
+    puts "INDEX-only (#{analysis[:index_only].length}):"
+    analysis[:index_only].each { |r| puts "  #{r[:id]} (#{r[:index_status]})" }
+    puts "Directory-only (#{analysis[:directory_only].length}):"
+    analysis[:directory_only].each { |r| puts "  #{r[:id]}" }
+  end
+end
+
+exit(IndexProjectionCli.main(ARGV)) if $PROGRAM_NAME == __FILE__

package/scripts/lib/core_integrity.rb

@@ -0,0 +1,71 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+
+# CoreIntegrity (intent 340, G7, n1): re-hashes the files an installed
+# ~/.plastic/manifest.json lists, so the runner's own "am I running trusted
+# code" check has one implementation. scripts/doctor.rb's
+# Doctor#check_install_integrity does this same arithmetic inline today,
+# per-agent (Codex/Hermes/Claude), against each agent's own manifest; this
+# module is not a refactor of that (out of scope for this node), it exists
+# so the runner - and a later node that points doctor at it - never have to
+# reimplement the same hashing loop a third time.
+#
+# Pure and side-effect-free: `check` takes plastic_home: and never raises
+# across its boundary. A missing, unreadable, or non-JSON manifest.json is a
+# named refusal (`reason:`), never an exception. A manifest-listed file that
+# no longer exists is reported under `missing`, distinct from `drifted` (a
+# file that exists but no longer hashes to the manifest's recorded value).
+module CoreIntegrity
+  module_function
+
+  def check(plastic_home:)
+    manifest_path = File.join(plastic_home.to_s, "manifest.json")
+    return refusal("manifest.json not found at #{manifest_path}") unless File.exist?(manifest_path)
+
+    raw = begin
+      File.read(manifest_path)
+    rescue StandardError => e
+      return refusal("manifest.json is unreadable: #{e.message}")
+    end
+
+    data = begin
+      JSON.parse(raw)
+    rescue JSON::ParserError => e
+      return refusal("manifest.json is not valid JSON: #{e.message}")
+    end
+
+    files = data.is_a?(Hash) ? data["files"] : nil
+    return refusal("manifest.json's files: is not a mapping") unless files.is_a?(Hash)
+
+    drifted = []
+    missing = []
+    files.each do |path, expected_hash|
+      unless File.exist?(path)
+        missing << path
+        next
+      end
+
+      # v1 minor 6/row 11.16: a tracked file that exists but cannot be read
+      # (permissions changed under this process) must never raise out of a
+      # module whose whole contract is "never raises across its boundary" -
+      # unreadable is reported the same way a hash mismatch is: this
+      # process cannot confirm the file matches what the manifest expects,
+      # which is exactly what `drifted` already means.
+      actual_hash = begin
+        Digest::SHA256.file(path).hexdigest
+      rescue SystemCallError
+        nil
+      end
+      drifted << path if actual_hash.nil? || actual_hash != expected_hash
+    end
+
+    { ok: drifted.empty? && missing.empty?, drifted: drifted, missing: missing, reason: nil }
+  end
+
+  def refusal(reason)
+    { ok: false, drifted: [], missing: [], reason: reason }
+  end
+end

package/scripts/lib/graph_tree.rb

@@ -0,0 +1,98 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require_relative "graph_edges"
+require_relative "ready_set"
+
+# GraphTree (intent 337, n2, folds 327a): draws any edge map ({id => [needs...]})
+# as an indented tree with box-drawing branches. A node may have any number
+# of children; a node several branches need (fan-out) is drawn once, at the
+# point where those branches join. A node that itself needs several things
+# (fan-in) can only occupy one position in the tree: it hangs under its
+# highest-batch need, ties broken by smallest id, with its other needs shown
+# as converging references at the join (row 2.14, folded at the 2026-09-10
+# plan review). Pure, plain text, no roadmap knowledge, so the same
+# renderer serves the roadmap file, the roadmap screens, and later the node
+# scope. Batch numbers (for placement) and the topological sort come from
+# ReadySet - the ONE sort (327 D1) - never a second local one here.
+module GraphTree
+  module_function
+
+  def render(edges:, labels:, marks:, width:)
+    edges = edges || {}
+    nodes = ReadySet.all_nodes(edges)
+
+    cyc = GraphEdges.cycle(edges)
+    if cyc
+      return { ok: false, text: nil, error: "cyclic graph, cannot render a tree: #{cyc.join(' > ')}", cycle: cyc }
+    end
+
+    if nodes.empty?
+      return { ok: true, text: "(no dependencies)\n", error: nil, cycle: nil }
+    end
+
+    batch_result = ReadySet.batches(edges)
+    batch_of = {}
+    batch_result[:batches].each_with_index { |layer, i| layer.each { |id| batch_of[id] = i + 1 } }
+
+    primary_parent = {}
+    converging = {}
+    nodes.each do |id|
+      needs = (edges[id] || []).uniq
+      next if needs.empty?
+
+      primary = needs.min_by { |n| [-(batch_of[n] || 0), n] }
+      primary_parent[id] = primary
+      others = needs - [primary]
+      converging[id] = others.sort unless others.empty?
+    end
+
+    children_of = Hash.new { |h, k| h[k] = [] }
+    primary_parent.each { |child, parent| children_of[parent] << child }
+    children_of.each_value { |list| list.sort! { |a, b| [batch_of[a] || 0, a] <=> [batch_of[b] || 0, b] } }
+
+    roots = nodes.select { |id| (edges[id] || []).empty? }.sort
+
+    labels ||= {}
+    marks ||= {}
+    critical = (marks[:critical_path] || []).to_a
+    ready = (marks[:ready] || []).to_a
+
+    lines = []
+    roots.each { |id| append_node(id, "", "", lines, children_of, labels, critical, ready, converging, width) }
+
+    { ok: true, text: "#{lines.join("\n")}\n", error: nil, cycle: nil }
+  end
+
+  # `ancestor_prefix` is the continuation string every ancestor above this
+  # node contributes ("│   " when that ancestor still has a later sibling
+  # to draw, "    " when it was the last child); `connector` is this node's
+  # own branch glyph off its parent ("├── " / "└── "), empty for a root.
+  def append_node(id, ancestor_prefix, connector, lines, children_of, labels, critical, ready, converging, width)
+    lines << render_line(ancestor_prefix + connector, id, labels, critical, ready, converging, width)
+
+    continuation = connector == "└── " ? "    " : (connector.empty? ? "" : "│   ")
+    child_ancestor_prefix = ancestor_prefix + continuation
+
+    children = children_of[id] || []
+    children.each_with_index do |child_id, i|
+      last = i == children.length - 1
+      child_connector = last ? "└── " : "├── "
+      append_node(child_id, child_ancestor_prefix, child_connector, lines, children_of, labels, critical, ready, converging, width)
+    end
+  end
+
+  def render_line(connector, id, labels, critical, ready, converging, width)
+    label = labels.fetch(id, id).to_s
+    text = critical.include?(id) ? "* #{label}" : label
+    text += " (also needs #{converging[id].join(', ')})" if converging[id]
+    text += " (ready)" if ready.include?(id)
+
+    available = width - connector.length
+    if available.positive? && text.length > available
+      text = available > 3 ? "#{text[0, available - 3]}..." : text[0, available]
+    end
+
+    "#{connector}#{text}"
+  end
+end

package/scripts/lib/index_projection.rb

@@ -0,0 +1,201 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require_relative "doctor_exclusions"
+require_relative "graph_file"
+require_relative "atomic_write"
+
+# IndexProjection (intent 337, n5): computes every intent's status from its
+# own savepoint.md ledger, reads the status INDEX.md currently claims, and
+# reports the drift between them. The ledger wins WHERE THE LEDGER SPEAKS
+# (row 5.1/5.2): a REAL terminal line (Done delivered/abandoned, or a
+# classifiable Done detail) beats a stale INDEX section. An intent whose
+# ledger is silent (no terminal line) or absent (no savepoint.md at all)
+# keeps the status INDEX already carries (row 5.13, folded at the
+# 2026-09-10 plan review): 63 of 451 intents in the plastic store have no
+# savepoint.md and 59 more never reach a Done line, and a literal reading
+# would demote all of them. This module computes and compares only; it
+# writes nothing (row 5.11) and reads no clock or environment variable.
+module IndexProjection
+  module_function
+
+  INDEX_SECTIONS = %w[Active Future Completed Abandoned].freeze
+  TERMINAL_STATUSES = %w[Completed Abandoned].freeze
+  EXCLUSION_RULES = %w[savepoint_operational backfilled_complete].freeze
+
+  # `store_path` holds the intent directories (a project's own `store/`, or
+  # the global `~/.plastic/store`). `index_path` defaults to a sibling
+  # `INDEX.md` inside `store_path` (matching every fixture in this test
+  # file), but the real Plastic layout keeps INDEX.md one level ABOVE
+  # `store/` - callers there (doctor.rb, the CLI) pass it explicitly.
+  def analyze(store_path, index_path: nil)
+    index_path ||= File.join(store_path, "INDEX.md")
+    index_map = read_index(index_path)
+    dir_ids = store_intent_ids(store_path)
+
+    excluded = excluded_ids(index_path)
+
+    drift = index_map.filter_map do |id, index_status|
+      next if index_status == "Future" # 5.5: Future has no ledger counterpart
+      next if excluded.include?(id) # 5.12
+
+      ledger_status = ledger_status_for(store_path, id)
+      next unless TERMINAL_STATUSES.include?(ledger_status) # 5.3/5.13
+      next if ledger_status == index_status
+
+      { id: id, index_status: index_status, ledger_status: ledger_status }
+    end
+
+    index_only = (index_map.keys - dir_ids).reject { |id| excluded.include?(id) }
+                                            .map { |id| { id: id, index_status: index_map[id] } }
+    directory_only = (dir_ids - index_map.keys).reject { |id| excluded.include?(id) }
+                                                .map { |id| { id: id } }
+
+    { ok: true, drift: drift, index_only: index_only, directory_only: directory_only, errors: [] }
+  end
+
+  # Render the four status sections (## Active, ## Future, ## Completed,
+  # ## Abandoned) from the projection and write through AtomicWrite. Only
+  # entries `analyze` actually reported as `drift` ever move - an entry
+  # whose ledger is silent or absent never appears in `drift` (row 5.13),
+  # so --write can never demote it (row 6.14). Every other line, including
+  # ## Clusters and ## Relocated (or any other section), is untouched
+  # (row 6.13): only the four named headings are ever replaced.
+  def write(store_path, index_path:, renamer: File.method(:rename))
+    return { ok: false, written: false, error: "no INDEX.md at #{index_path}" } unless File.exist?(index_path)
+
+    analysis = analyze(store_path, index_path: index_path)
+    text = read_utf8(index_path)
+
+    original_lines = {}
+    INDEX_SECTIONS.each do |heading|
+      section_body(text, heading).each_line do |line|
+        next unless line.strip.start_with?("- [")
+
+        m = line.strip.match(/\A-\s*\[(\S+)\s/)
+        original_lines[m[1]] = line if m
+      end
+    end
+
+    moves = analysis[:drift].each_with_object({}) { |r, h| h[r[:id]] = r[:ledger_status] }
+
+    new_bodies = INDEX_SECTIONS.each_with_object({}) do |heading, h|
+      kept = section_body(text, heading).each_line.reject do |line|
+        stripped = line.strip
+        next false unless stripped.start_with?("- [")
+
+        m = stripped.match(/\A-\s*\[(\S+)\s/)
+        m && moves.key?(m[1])
+      end
+      arriving = moves.select { |_id, target| target == heading }.keys
+      h[heading] = (kept + arriving.filter_map { |id| original_lines[id] }).join
+    end
+
+    content = text
+    INDEX_SECTIONS.each do |heading|
+      content = GraphFile.replace_or_append_section(content, "## #{heading}", new_bodies[heading].rstrip + "\n")
+    end
+
+    AtomicWrite.write(index_path, content, renamer: renamer)
+    { ok: true, written: true, moved: analysis[:drift], error: nil }
+  end
+
+  # --- INDEX -------------------------------------------------------------------
+
+  def read_index(index_path)
+    map = {}
+    return map unless File.exist?(index_path)
+
+    text = read_utf8(index_path)
+    INDEX_SECTIONS.each do |heading|
+      section_body(text, heading).each_line do |line|
+        stripped = line.strip
+        next unless stripped.start_with?("- [")
+
+        m = stripped.match(/\A-\s*\[(\S+)\s/)
+        map[m[1]] = heading if m
+      end
+    end
+    map
+  end
+
+  def section_body(text, heading)
+    m = text.match(/^##\s+#{Regexp.escape(heading)}\s*$(.*?)(?=^##\s|\z)/m)
+    m ? m[1] : ""
+  end
+
+  # --- store directories ---------------------------------------------------------
+
+  def store_intent_ids(store_path)
+    return [] unless Dir.exist?(store_path)
+
+    Dir.entries(store_path).select { |e| e.include?("--") && File.directory?(File.join(store_path, e)) }
+       .map { |e| e.split("--", 2).first }
+  end
+
+  def intent_dir_for(store_path, id)
+    Dir.glob(File.join(store_path, "#{id}--*")).find { |p| File.directory?(p) }
+  end
+
+  # --- the ledger (savepoint.md) --------------------------------------------------
+
+  # "Completed", "Abandoned", "Active" (no terminal line yet), "unknown" (no
+  # directory or no savepoint.md), or "indeterminate" (a Done line whose
+  # detail is neither delivered/merged nor abandoned, row 5.14).
+  def ledger_status_for(store_path, id)
+    dir = intent_dir_for(store_path, id)
+    return "unknown" unless dir
+
+    sp_path = File.join(dir, "savepoint.md")
+    return "unknown" unless File.exist?(sp_path)
+
+    parsed = complete_lines(read_utf8(sp_path)).filter_map { |l| parse_line(l) }
+    last_done = parsed.reverse.find { |p| p[:kind] == "Done" }
+    return "Active" unless last_done
+
+    classify_done_detail(last_done[:detail]) || "indeterminate"
+  end
+
+  # Drop the trailing torn fragment: a savepoint line that never got its
+  # closing newline because the process died mid-append (row 5.6). Works
+  # whether the file ends in a newline (the dropped element is the empty
+  # string split(-1) always yields after a final "\n") or not (the dropped
+  # element is the torn fragment itself).
+  def complete_lines(content)
+    return [] if content.to_s.empty?
+
+    lines = content.split("\n", -1)
+    lines.pop
+    lines.reject { |l| l.strip.empty? }
+  end
+
+  def parse_line(line)
+    parts = line.strip.split(/\s{2,}/, 3)
+    return nil unless parts.length == 3
+
+    { time: parts[0], kind: parts[1], detail: parts[2] }
+  end
+
+  def classify_done_detail(detail)
+    d = detail.to_s.strip
+    return "Abandoned" if d.start_with?("abandoned")
+    return "Completed" if d.start_with?("delivered") || d.start_with?("merged")
+
+    nil
+  end
+
+  # --- doctor exclusions (row 5.12) -----------------------------------------------
+
+  def excluded_ids(index_path)
+    loaded = DoctorExclusions.load(index_path)
+    EXCLUSION_RULES.flat_map { |rule| loaded[:rules][rule] || [] }.uniq
+  end
+
+  # --- utf-8 -----------------------------------------------------------------------
+
+  def read_utf8(path)
+    text = File.read(path)
+    text.force_encoding(Encoding::UTF_8)
+    text.valid_encoding? ? text : text.scrub("")
+  end
+end

package/scripts/lib/installer_core.rb

@@ -498,6 +498,17 @@ class InstallerCore
       # test/install_sync_test.rb stays green across every intermediate unit.
       "scripts/lib/ready_set.rb" => "scripts/lib/ready_set.rb",
       "scripts/ready-set" => "scripts/ready-set",
+      # Intent 337 (G4): the roadmap graph model and its tree renderer,
+      # registered as they land (test/installer_core_test.rb requires every
+      # scripts/lib file to be manifest-covered as soon as it exists, not
+      # only once the CLI that ships it arrives at n4).
+      "scripts/lib/roadmap_graph.rb" => "scripts/lib/roadmap_graph.rb",
+      "scripts/lib/graph_tree.rb" => "scripts/lib/graph_tree.rb",
+      "scripts/lib/index_projection.rb" => "scripts/lib/index_projection.rb",
+      "scripts/lib/roadmap_render.rb" => "scripts/lib/roadmap_render.rb",
+      "scripts/lib/roadmap_migration.rb" => "scripts/lib/roadmap_migration.rb",
+      "scripts/roadmap-graph" => "scripts/roadmap-graph",
+      "scripts/index-projection" => "scripts/index-projection",
       # Intent 338 (G5): the node packet command - the trust-boundary wrapper,
       # the five-block gatherer/assembler, and the CLI 340's runner calls.
       "scripts/lib/packet_wrapper.rb" => "scripts/lib/packet_wrapper.rb",
@@ -507,6 +518,39 @@ class InstallerCore
       # node graph for any legacy intent, so WorkGraphValidator can require
       # it without going red on contact with install_sync_test.
       "scripts/lib/action_graph_shim.rb" => "scripts/lib/action_graph_shim.rb",
+      # Intent 340 (G7, n1): the runner command - the subcommand table over
+      # the declared node graph, its shared context (RunnerCore), and the
+      # installed-core integrity check (CoreIntegrity) the runner's trust
+      # boundary and doctor will both call.
+      "scripts/runner" => "scripts/runner",
+      "scripts/lib/runner_core.rb" => "scripts/lib/runner_core.rb",
+      "scripts/lib/core_integrity.rb" => "scripts/lib/core_integrity.rb",
+      # Intent 340 (G7, n2): the merge abort, the reclaim, and the extension -
+      # the first thing every `step` does, routed from scripts/runner's `sweep`
+      # verb.
+      "scripts/lib/runner_sweep.rb" => "scripts/lib/runner_sweep.rb",
+      # Intent 340 (G7, n3): a work node's own git worktree, cut from the
+      # intent branch tip, merged back into the intent branch, and swept once
+      # its node is terminal.
+      "scripts/lib/node_worktree.rb" => "scripts/lib/node_worktree.rb",
+      # Intent 340 (G7, n4): the return schema (NodeReturn) and the six-check
+      # gate (RunnerAbsorb) that turns one executor return into exactly one
+      # node ledger transition, required lazily by scripts/runner's `step`.
+      "scripts/lib/node_return.rb" => "scripts/lib/node_return.rb",
+      "scripts/lib/runner_absorb.rb" => "scripts/lib/runner_absorb.rb",
+      # Intent 340 (G7, n5): validation, policy, leases and the dispatch plan
+      # - RunnerPolicy (the kind table) and RunnerDispatch, required lazily
+      # by scripts/runner's `step`.
+      "scripts/lib/runner_policy.rb" => "scripts/lib/runner_policy.rb",
+      "scripts/lib/runner_dispatch.rb" => "scripts/lib/runner_dispatch.rb",
+      # Intent 340 (G7, n6): answer (closes a decision node or unparks a
+      # work node parked at needs_decision), proposals (mints ids for what
+      # an executor proposed), and rewind (resets the intent branch to a
+      # node's own commit and respins it) - routed from scripts/runner's
+      # `answer` and `rewind` verbs.
+      "scripts/lib/runner_answer.rb" => "scripts/lib/runner_answer.rb",
+      "scripts/lib/runner_proposals.rb" => "scripts/lib/runner_proposals.rb",
+      "scripts/lib/runner_rewind.rb" => "scripts/lib/runner_rewind.rb",
     }
   end
 

package/scripts/lib/node_packet.rb

@@ -740,9 +740,14 @@ module NodePacket
 
   # C21: the number of `running` lines already recorded for `node`, plus one
   # when a lease is being supplied by flag (a NEW dispatch), floored at 1.
+  # Minor 5: a torn `running` line (missing holder=/expires=/packet=/model=)
+  # is skipped here exactly as ReadySet.attempts_count already skips it -
+  # counting it desynchronizes this attempt number from the extensions file
+  # a live node's own `packets/<node>--a<N>.extensions` names, since that
+  # file is keyed by the attempt sweep computed off the SAME filtered count.
   def compute_attempt_number(intent_dir:, node:, lease_flag_given:, entries: nil)
     entries ||= NodeLedger.entries(savepoint_path(intent_dir))
-    count = entries.count { |e| e[:subject] == node.to_s && e[:state] == "running" }
+    count = entries.count { |e| !e[:torn] && e[:subject] == node.to_s && e[:state] == "running" }
     [count + (lease_flag_given ? 1 : 0), 1].max
   end
 
@@ -772,7 +777,13 @@ module NodePacket
   # usage (unknown node), 3 unreadable/unparsable graph, node file or
   # record, 4 overflow past the third cut, 5 an existing attempt whose bytes
   # differ.
-  def build(intent_dir:, node:, budget_tokens: DEFAULT_BUDGET_TOKENS, hop_tokens: DEFAULT_HOP_TOKENS,
+  # M7/row 10.9: `budget_tokens: nil` (rather than DEFAULT_BUDGET_TOKENS)
+  # is how a caller says "no override" - the fallback below then reaches for
+  # the node block's OWN declared `budget:` before ever touching the
+  # shipped default, so a caller that never learned about a node's budget
+  # (the CLI, another future caller) still gets it, not just the one path
+  # RunnerDispatch explicitly threads it through (row 10.8).
+  def build(intent_dir:, node:, budget_tokens: nil, hop_tokens: DEFAULT_HOP_TOKENS,
             holder: nil, expires: nil, model: nil, attempt: nil, out: nil, force: false,
             renamer: File.method(:rename), git_runner: DEFAULT_GIT_RUNNER,
             worktree_reader: Arm.method(:worktree_block), project_reader: method(:default_project_reader))
@@ -783,6 +794,8 @@ module NodePacket
       return { ok: false, exit_code: nb[:error_kind] == :unknown_node ? 2 : 3, errors: nb[:errors] }
     end
 
+    budget_tokens = (budget_tokens || nb[:budget] || DEFAULT_BUDGET_TOKENS).to_i
+
     record = record_block(intent_dir: intent_dir, kind: nb[:kind])
     return { ok: false, exit_code: 3, errors: record[:errors] } unless record[:ok]