@zalom/plastic 2.0.0-alpha.2 → 2.0.0-alpha.21

package/scripts/lib/hook_replay.rb

@@ -0,0 +1,211 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "timeout"
+
+# HookReplay (intent 331a, T1; promoted to a production lib in 331e) - streams
+# text through a MessageDisplay launcher the way Claude Code streams an
+# assistant reply, chunk by chunk, and returns every chunk's raw stdout.
+#
+# 331a's test/support/hook_replay.rb held this as test-only code; 331e's
+# doctor `display_hook_paints` check (scripts/doctor.rb) needs the exact same
+# mechanics to replay the INSTALLED launcher for real, so the logic lives
+# here and test/support/hook_replay.rb now delegates to it (a require, not a
+# duplicate). Never require this from scripts/lib/doctor_core.rb: that file
+# is the SessionStart boot path (test/doctor_core_split_test.rb T2 pins its
+# exact require set), and the paint check that needs this lib runs only from
+# the full scripts/doctor.rb.
+module HookReplay
+  module_function
+
+  # Streams `text` through `hook_path` in fixed-size chunks. `session_id`/
+  # `message_id` default to fixed values since nothing about a replay depends
+  # on the ambient session at all.
+  #
+  # `env` (intent 331e): extra child-process environment, merged over the
+  # PLASTIC_TMP entry every call already sets (a caller's own key wins). A
+  # `nil` value unsets that variable in the child (Process.spawn's own
+  # convention) is how a caller forces NO_COLOR off regardless of the ambient
+  # environment. Default `{}` keeps every existing caller's behavior
+  # unchanged: this is an extension, not a fork.
+  #
+  # `timeout` (intent 331e): when given, bounds EACH chunk's spawn to that
+  # many seconds. A bare `Timeout.timeout` around `Open3.capture3` does not
+  # reliably bound a genuinely hanging child: capture3's own wait still
+  # blocks on Process.waitpid for the child regardless of the raised
+  # Timeout::Error (the same gotcha scripts/hook-record works around), so a
+  # timeout here spawns directly and kills the child on expiry instead.
+  # Default `nil` keeps every existing caller on the original unbounded
+  # Open3.capture3 path.
+  def replay(hook_path:, tmp_root:, text:, chunk: 40, session_id: "s-replay", message_id: "replay",
+              env: {}, timeout: nil)
+    chunks = text.scan(/.{1,#{chunk}}/m)
+    chunks = [""] if chunks.empty?
+    full_env = { "PLASTIC_TMP" => tmp_root }.merge(env)
+
+    chunks.each_with_index.map do |delta, i|
+      payload = {
+        "session_id" => session_id, "message_id" => message_id, "index" => i,
+        "final" => i == chunks.length - 1, "delta" => delta, "cwd" => tmp_root,
+        "hook_event_name" => "MessageDisplay",
+      }
+      out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, timeout)
+      { index: i, exitstatus: exitstatus, stdout: out, stderr: err, final: payload["final"] }
+    end
+  end
+
+  # replay_concurrent (intent 331a1) - streams `text` through `hook_path` the
+  # way `replay` does, but fires every chunk in its OWN thread, staggered by
+  # `gap_ms` (plus up to half a gap of jitter when `jitter` is true) rather
+  # than run sequentially. This is what reproduces the decision-race defect
+  # 331a1 fixes: Claude Code fires the per-chunk hook processes CONCURRENTLY
+  # in production, and `replay`'s strictly-sequential default never puts two
+  # chunks in flight at once, so it could never have reproduced the race in
+  # the first place.
+  #
+  # `gap_ms: 5` plus jitter is the default on purpose, not "fire everything
+  # at once": firing all 335 chunks of the live session capture with no
+  # stagger at all takes about 8 s of wall clock on this 8-core machine,
+  # because EACH chunk boots its own real Ruby process and the completions
+  # cluster at the tail once every core is saturated - a load real streaming
+  # never produces (a real stream delivers a chunk every few tens of
+  # milliseconds, one at a time). One Ruby process per streamed chunk is the
+  # actual throughput ceiling here, not something this method works around.
+  #
+  # `replay`'s own signature and sequential default are UNCHANGED by this
+  # method's existence (`scripts/doctor.rb:2571` calls `replay` directly and
+  # must keep working exactly as it does today) - this is a sibling method
+  # in the same module, never a replacement.
+  #
+  # Returns the SAME result shape `replay` returns (one Hash per chunk, keys
+  # index/exitstatus/stdout/stderr/final), ordered by index regardless of
+  # the order the threads actually finish in.
+  def replay_concurrent(hook_path:, tmp_root:, text:, chunk: 40, session_id: "s-replay",
+                         message_id: "replay", env: {}, gap_ms: 5, jitter: true)
+    chunks = text.scan(/.{1,#{chunk}}/m)
+    chunks = [""] if chunks.empty?
+    full_env = { "PLASTIC_TMP" => tmp_root }.merge(env)
+    gap = gap_ms / 1000.0
+
+    results = Array.new(chunks.length)
+    threads = chunks.each_with_index.map do |delta, i|
+      payload = {
+        "session_id" => session_id, "message_id" => message_id, "index" => i,
+        "final" => i == chunks.length - 1, "delta" => delta, "cwd" => tmp_root,
+        "hook_event_name" => "MessageDisplay",
+      }
+      Thread.new do
+        begin
+          delay = i * gap
+          delay += (rand * gap / 2.0) if jitter
+          sleep(delay)
+          out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, nil)
+          results[i] = { index: i, exitstatus: exitstatus, stdout: out, stderr: err, final: payload["final"] }
+        rescue StandardError => e
+          # A raise inside a thread body is invisible until join, and an
+          # unrescued one aborts `threads.each(&:join)` at the first dead
+          # thread: every later thread is then never joined and outlives the
+          # call, racing whatever the caller does next (typically removing
+          # the very tmp root those threads are still writing under). Report
+          # the failure as this chunk's own result instead, so the array is
+          # always complete, every thread is always joined, and a replay
+          # tells its caller what went wrong rather than throwing at it.
+          results[i] = { index: i, exitstatus: nil, stdout: "", stderr: e.message,
+                         final: payload["final"] }
+        end
+      end
+    end
+    threads.each { |thread| thread.join }
+    results
+  end
+
+  # Indices of the chunks that reached the terminal as raw Markdown: a
+  # non-final chunk that emitted nothing at all, after the engaging chunk.
+  # A chunk "passed through" when its stdout is empty; a chunk was
+  # "blanked" (correctly buffered, not shown raw) when its stdout contains
+  # `"displayContent":""`. Only chunks with an index greater than the
+  # engaging chunk's own index count - the engaging chunk is the first one
+  # (at or after `start_index`) whose stdout is non-empty, and chunks
+  # before it already reached the terminal live, verbatim, through the
+  # ordinary passthrough path (they were never candidates for buffering at
+  # all, so an empty stdout from one of them is not this defect).
+  def passthrough_indices(outs, start_index: 0)
+    engaging = outs.find { |o| o[:index] >= start_index && !o[:stdout].to_s.empty? }
+    return [] unless engaging
+
+    outs.select { |o| o[:index] > engaging[:index] && o[:final] != true && o[:stdout].to_s.empty? }
+        .map { |o| o[:index] }
+  end
+
+  def run_one(hook_path, payload, full_env, tmp_root, timeout)
+    return capture(hook_path, payload, full_env) unless timeout
+
+    run_bounded(hook_path, payload, full_env, tmp_root, timeout)
+  end
+
+  def capture(hook_path, payload, full_env)
+    out, err, status = Open3.capture3(full_env, hook_path, stdin_data: JSON.generate(payload))
+    [out, err, status.exitstatus]
+  end
+
+  # Spawn directly (never Open3.capture3) so a timeout can actually kill the
+  # child, with stdin/stdout/stderr routed through scratch files under the
+  # caller's own tmp_root, and never pipes, so a stalled or oversized write can
+  # never deadlock the read side, and never anywhere outside tmp_root, so a
+  # bounded replay carries the same "writes only under the injected tmp
+  # root" guarantee as the unbounded path.
+  def run_bounded(hook_path, payload, full_env, tmp_root, timeout)
+    token = "#{Process.pid}-#{(Time.now.to_f * 1_000_000).to_i}-#{rand(1_000_000)}"
+    in_path = File.join(tmp_root, ".hook-replay-in-#{token}")
+    out_path = File.join(tmp_root, ".hook-replay-out-#{token}")
+    err_path = File.join(tmp_root, ".hook-replay-err-#{token}")
+    File.write(in_path, JSON.generate(payload))
+
+    pid = Process.spawn(full_env, hook_path, in: in_path, out: out_path, err: err_path)
+    exitstatus =
+      begin
+        Timeout.timeout(timeout) { Process.wait(pid) }
+        $?.exitstatus
+      rescue Timeout::Error
+        kill_and_reap(pid)
+        nil # nil exitstatus is the caller's signal that this chunk timed out
+      end
+
+    out = File.exist?(out_path) ? File.read(out_path) : ""
+    err = File.exist?(err_path) ? File.read(err_path) : ""
+    [out, err, exitstatus]
+  ensure
+    [in_path, out_path, err_path].each { |p| File.delete(p) if p && File.exist?(p) }
+  end
+
+  def kill_and_reap(pid)
+    Process.kill("KILL", pid)
+  rescue StandardError
+    nil
+  ensure
+    begin
+      Process.wait(pid)
+    rescue StandardError
+      nil
+    end
+  end
+
+  # The final chunk's parsed displayContent, or nil when it emitted nothing
+  # (no envelope at all: the message never engaged).
+  def final_display_content(outs)
+    final = outs.last
+    return nil if final[:stdout].to_s.empty?
+
+    JSON.parse(final[:stdout]).dig("hookSpecificOutput", "displayContent")
+  rescue JSON::ParserError
+    nil
+  end
+
+  # True when any chunk's spawn hit its timeout (run_bounded's nil-exitstatus
+  # signal). A replay made with no `timeout:` never reports true.
+  def timed_out?(outs)
+    outs.any? { |o| o[:exitstatus].nil? }
+  end
+end

package/scripts/lib/index_projection.rb

@@ -0,0 +1,201 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require_relative "doctor_exclusions"
+require_relative "graph_file"
+require_relative "atomic_write"
+
+# IndexProjection (intent 337, n5): computes every intent's status from its
+# own savepoint.md ledger, reads the status INDEX.md currently claims, and
+# reports the drift between them. The ledger wins WHERE THE LEDGER SPEAKS
+# (row 5.1/5.2): a REAL terminal line (Done delivered/abandoned, or a
+# classifiable Done detail) beats a stale INDEX section. An intent whose
+# ledger is silent (no terminal line) or absent (no savepoint.md at all)
+# keeps the status INDEX already carries (row 5.13, folded at the
+# 2026-09-10 plan review): 63 of 451 intents in the plastic store have no
+# savepoint.md and 59 more never reach a Done line, and a literal reading
+# would demote all of them. This module computes and compares only; it
+# writes nothing (row 5.11) and reads no clock or environment variable.
+module IndexProjection
+  module_function
+
+  INDEX_SECTIONS = %w[Active Future Completed Abandoned].freeze
+  TERMINAL_STATUSES = %w[Completed Abandoned].freeze
+  EXCLUSION_RULES = %w[savepoint_operational backfilled_complete].freeze
+
+  # `store_path` holds the intent directories (a project's own `store/`, or
+  # the global `~/.plastic/store`). `index_path` defaults to a sibling
+  # `INDEX.md` inside `store_path` (matching every fixture in this test
+  # file), but the real Plastic layout keeps INDEX.md one level ABOVE
+  # `store/` - callers there (doctor.rb, the CLI) pass it explicitly.
+  def analyze(store_path, index_path: nil)
+    index_path ||= File.join(store_path, "INDEX.md")
+    index_map = read_index(index_path)
+    dir_ids = store_intent_ids(store_path)
+
+    excluded = excluded_ids(index_path)
+
+    drift = index_map.filter_map do |id, index_status|
+      next if index_status == "Future" # 5.5: Future has no ledger counterpart
+      next if excluded.include?(id) # 5.12
+
+      ledger_status = ledger_status_for(store_path, id)
+      next unless TERMINAL_STATUSES.include?(ledger_status) # 5.3/5.13
+      next if ledger_status == index_status
+
+      { id: id, index_status: index_status, ledger_status: ledger_status }
+    end
+
+    index_only = (index_map.keys - dir_ids).reject { |id| excluded.include?(id) }
+                                            .map { |id| { id: id, index_status: index_map[id] } }
+    directory_only = (dir_ids - index_map.keys).reject { |id| excluded.include?(id) }
+                                                .map { |id| { id: id } }
+
+    { ok: true, drift: drift, index_only: index_only, directory_only: directory_only, errors: [] }
+  end
+
+  # Render the four status sections (## Active, ## Future, ## Completed,
+  # ## Abandoned) from the projection and write through AtomicWrite. Only
+  # entries `analyze` actually reported as `drift` ever move - an entry
+  # whose ledger is silent or absent never appears in `drift` (row 5.13),
+  # so --write can never demote it (row 6.14). Every other line, including
+  # ## Clusters and ## Relocated (or any other section), is untouched
+  # (row 6.13): only the four named headings are ever replaced.
+  def write(store_path, index_path:, renamer: File.method(:rename))
+    return { ok: false, written: false, error: "no INDEX.md at #{index_path}" } unless File.exist?(index_path)
+
+    analysis = analyze(store_path, index_path: index_path)
+    text = read_utf8(index_path)
+
+    original_lines = {}
+    INDEX_SECTIONS.each do |heading|
+      section_body(text, heading).each_line do |line|
+        next unless line.strip.start_with?("- [")
+
+        m = line.strip.match(/\A-\s*\[(\S+)\s/)
+        original_lines[m[1]] = line if m
+      end
+    end
+
+    moves = analysis[:drift].each_with_object({}) { |r, h| h[r[:id]] = r[:ledger_status] }
+
+    new_bodies = INDEX_SECTIONS.each_with_object({}) do |heading, h|
+      kept = section_body(text, heading).each_line.reject do |line|
+        stripped = line.strip
+        next false unless stripped.start_with?("- [")
+
+        m = stripped.match(/\A-\s*\[(\S+)\s/)
+        m && moves.key?(m[1])
+      end
+      arriving = moves.select { |_id, target| target == heading }.keys
+      h[heading] = (kept + arriving.filter_map { |id| original_lines[id] }).join
+    end
+
+    content = text
+    INDEX_SECTIONS.each do |heading|
+      content = GraphFile.replace_or_append_section(content, "## #{heading}", new_bodies[heading].rstrip + "\n")
+    end
+
+    AtomicWrite.write(index_path, content, renamer: renamer)
+    { ok: true, written: true, moved: analysis[:drift], error: nil }
+  end
+
+  # --- INDEX -------------------------------------------------------------------
+
+  def read_index(index_path)
+    map = {}
+    return map unless File.exist?(index_path)
+
+    text = read_utf8(index_path)
+    INDEX_SECTIONS.each do |heading|
+      section_body(text, heading).each_line do |line|
+        stripped = line.strip
+        next unless stripped.start_with?("- [")
+
+        m = stripped.match(/\A-\s*\[(\S+)\s/)
+        map[m[1]] = heading if m
+      end
+    end
+    map
+  end
+
+  def section_body(text, heading)
+    m = text.match(/^##\s+#{Regexp.escape(heading)}\s*$(.*?)(?=^##\s|\z)/m)
+    m ? m[1] : ""
+  end
+
+  # --- store directories ---------------------------------------------------------
+
+  def store_intent_ids(store_path)
+    return [] unless Dir.exist?(store_path)
+
+    Dir.entries(store_path).select { |e| e.include?("--") && File.directory?(File.join(store_path, e)) }
+       .map { |e| e.split("--", 2).first }
+  end
+
+  def intent_dir_for(store_path, id)
+    Dir.glob(File.join(store_path, "#{id}--*")).find { |p| File.directory?(p) }
+  end
+
+  # --- the ledger (savepoint.md) --------------------------------------------------
+
+  # "Completed", "Abandoned", "Active" (no terminal line yet), "unknown" (no
+  # directory or no savepoint.md), or "indeterminate" (a Done line whose
+  # detail is neither delivered/merged nor abandoned, row 5.14).
+  def ledger_status_for(store_path, id)
+    dir = intent_dir_for(store_path, id)
+    return "unknown" unless dir
+
+    sp_path = File.join(dir, "savepoint.md")
+    return "unknown" unless File.exist?(sp_path)
+
+    parsed = complete_lines(read_utf8(sp_path)).filter_map { |l| parse_line(l) }
+    last_done = parsed.reverse.find { |p| p[:kind] == "Done" }
+    return "Active" unless last_done
+
+    classify_done_detail(last_done[:detail]) || "indeterminate"
+  end
+
+  # Drop the trailing torn fragment: a savepoint line that never got its
+  # closing newline because the process died mid-append (row 5.6). Works
+  # whether the file ends in a newline (the dropped element is the empty
+  # string split(-1) always yields after a final "\n") or not (the dropped
+  # element is the torn fragment itself).
+  def complete_lines(content)
+    return [] if content.to_s.empty?
+
+    lines = content.split("\n", -1)
+    lines.pop
+    lines.reject { |l| l.strip.empty? }
+  end
+
+  def parse_line(line)
+    parts = line.strip.split(/\s{2,}/, 3)
+    return nil unless parts.length == 3
+
+    { time: parts[0], kind: parts[1], detail: parts[2] }
+  end
+
+  def classify_done_detail(detail)
+    d = detail.to_s.strip
+    return "Abandoned" if d.start_with?("abandoned")
+    return "Completed" if d.start_with?("delivered") || d.start_with?("merged")
+
+    nil
+  end
+
+  # --- doctor exclusions (row 5.12) -----------------------------------------------
+
+  def excluded_ids(index_path)
+    loaded = DoctorExclusions.load(index_path)
+    EXCLUSION_RULES.flat_map { |rule| loaded[:rules][rule] || [] }.uniq
+  end
+
+  # --- utf-8 -----------------------------------------------------------------------
+
+  def read_utf8(path)
+    text = File.read(path)
+    text.force_encoding(Encoding::UTF_8)
+    text.valid_encoding? ? text : text.scrub("")
+  end
+end

package/scripts/lib/installer_core.rb

@@ -76,8 +76,25 @@ class InstallerCore
     @agents = agents
   end
 
+  # Reads the package version from `package.json` when present (the source
+  # tree, and any dev checkout), falling back to the bare `VERSION` file the
+  # installer copies to `~/.plastic` (row B, spec 315b): an installed system
+  # carries VERSION but never package.json, so `rollback.rb` and `update.rb`
+  # constructing an InstallerCore with `package_root: ~/.plastic` crashed with
+  # a raw Errno::ENOENT before this fallback existed. Raises a named error,
+  # not a bare ENOENT, when neither file exists, so the caller is not
+  # misdirected toward the wrong missing file.
   def read_package_version(root)
-    File.read(File.join(root, "package.json")).then { |s| JSON.parse(s)["version"] }
+    package_json = File.join(root, "package.json")
+    version_file = File.join(root, "VERSION")
+
+    if File.exist?(package_json)
+      JSON.parse(File.read(package_json))["version"]
+    elsif File.exist?(version_file)
+      File.read(version_file).strip
+    else
+      raise "cannot determine the package version: neither #{package_json} nor #{version_file} exists"
+    end
   end
 
   # --- Channel derivation (the channel is encoded in the version string) ---
@@ -314,12 +331,26 @@ class InstallerCore
     end
   end
 
+  # Intent 331a (D6/R7): a screen kind file (scripts/lib/screens/<kind>.rb)
+  # must reach an installed ~/.plastic the same way a new template or hook
+  # does - glob-derived, so "add a file, not a diff" is actually true for an
+  # installed Plastic, not just an in-repo one. This repo ships none yet;
+  # the glob answers {} until one exists.
+  def screen_files
+    Dir.glob(File.join(package_root, "scripts", "lib", "screens", "*.rb")).each_with_object({}) do |path, acc|
+      next unless File.file?(path)
+
+      rel = File.join("scripts", "lib", "screens", File.basename(path))
+      acc[rel] = rel
+    end
+  end
+
   # Files copied into ~/.plastic on install/update. Every verb script + the shared lib
   # must be here so the installed ~/.plastic/scripts copy is self-complete (sync-guarded
-  # by install_sync_test). The templates half is glob-derived (template_files above); the
-  # rest stays a hand-written literal.
+  # by install_sync_test). The templates and screen-kind halves are glob-derived
+  # (template_files, screen_files above); the rest stays a hand-written literal.
   def core_files
-    hand_registered_files.merge(template_files).merge(hook_files)
+    hand_registered_files.merge(template_files).merge(hook_files).merge(screen_files)
   end
 
   def hand_registered_files
@@ -342,6 +373,9 @@ class InstallerCore
       "scripts/lib/release_guard.rb" => "scripts/lib/release_guard.rb",
       "scripts/lib/bridge.rb" => "scripts/lib/bridge.rb",
       "scripts/lib/savepoint.rb" => "scripts/lib/savepoint.rb",
+      "scripts/lib/guarded_append.rb" => "scripts/lib/guarded_append.rb",
+      "scripts/lib/node_ledger.rb" => "scripts/lib/node_ledger.rb",
+      "scripts/node-transition" => "scripts/node-transition",
       "scripts/lib/arm.rb" => "scripts/lib/arm.rb",
       "scripts/lib/lock.rb" => "scripts/lib/lock.rb",
       "scripts/plastic-lock" => "scripts/plastic-lock",
@@ -383,6 +417,9 @@ class InstallerCore
       "scripts/lib/harness_text.rb" => "scripts/lib/harness_text.rb",
       "scripts/codex-hook" => "scripts/codex-hook",
       "scripts/spawn-preamble" => "scripts/spawn-preamble",
+      "scripts/lib/report_screen.rb" => "scripts/lib/report_screen.rb",
+      "scripts/report-screen" => "scripts/report-screen",
+      "scripts/savepoint-note" => "scripts/savepoint-note",
       "scripts/lib/store_provisioning.rb" => "scripts/lib/store_provisioning.rb",
       "scripts/provision-project-store" => "scripts/provision-project-store",
       "scripts/lib/project_validator.rb" => "scripts/lib/project_validator.rb",
@@ -401,8 +438,11 @@ class InstallerCore
       "scripts/verify-intent" => "scripts/verify-intent",
       "scripts/lib/exec_worktree.rb" => "scripts/lib/exec_worktree.rb",
       "scripts/exec-worktree" => "scripts/exec-worktree",
+      "scripts/lib/session_usage.rb" => "scripts/lib/session_usage.rb",
+      "scripts/session-usage" => "scripts/session-usage",
       "scripts/doctor.rb" => "scripts/doctor.rb",
       "scripts/lib/doctor_core.rb" => "scripts/lib/doctor_core.rb",
+      "scripts/lib/hook_replay.rb" => "scripts/lib/hook_replay.rb",
       "scripts/lib/rule_catalog.rb" => "scripts/lib/rule_catalog.rb",
       "scripts/lib/doctor_exclusions.rb" => "scripts/lib/doctor_exclusions.rb",
       "scripts/lib/doctor_session_ledger.rb" => "scripts/lib/doctor_session_ledger.rb",
@@ -423,7 +463,102 @@ class InstallerCore
       "scripts/lib/day_summary.rb" => "scripts/lib/day_summary.rb",
       "scripts/write-handoff" => "scripts/write-handoff",
       "scripts/day-summary" => "scripts/day-summary",
+      "scripts/lib/intent_screen.rb" => "scripts/lib/intent_screen.rb",
+      "scripts/intent-screen" => "scripts/intent-screen",
       "scripts/hook-savepoint" => "scripts/hook-savepoint",
+      # Intent 316a: hooks/* only glob-copies scripts/*, never scripts/lib/*
+      # (see hook_files above), so the two lib files a require_relative
+      # between themselves are unguarded there — these three literal
+      # entries are their only protection (test/install_sync_test.rb:23-29
+      # greps installer_core.rb's own source text for "scripts/<name>").
+      "scripts/lib/intent_screen_ansi.rb" => "scripts/lib/intent_screen_ansi.rb",
+      "scripts/lib/screen_paint.rb" => "scripts/lib/screen_paint.rb",
+      "scripts/lib/message_display.rb" => "scripts/lib/message_display.rb",
+      # Intent 331d (A1): scripts/dashboard.rb require_relatives this lib
+      # directly; templates/dashboard-screen.md and scripts/lib/screens/
+      # dashboard.rb are glob-derived (template_files, screen_files above)
+      # and need no entry here.
+      "scripts/lib/dashboard_screen.rb" => "scripts/lib/dashboard_screen.rb",
+      "scripts/hook-message-display" => "scripts/hook-message-display",
+      # Intent 334 (G1): the node file and graph.md library, plus its
+      # validator and CLI (327 D40/D41).
+      "scripts/lib/graph_edges.rb" => "scripts/lib/graph_edges.rb",
+      "scripts/lib/node_file.rb" => "scripts/lib/node_file.rb",
+      "scripts/lib/atomic_write.rb" => "scripts/lib/atomic_write.rb",
+      "scripts/lib/graph_file.rb" => "scripts/lib/graph_file.rb",
+      "scripts/lib/work_graph_validator.rb" => "scripts/lib/work_graph_validator.rb",
+      "scripts/validate-work-graph" => "scripts/validate-work-graph",
+      # Intent 335a: every id an intent has ever seen, so a deleted node's id
+      # is never reissued to a new node with the dead one's ledger history.
+      "scripts/lib/node_ids.rb" => "scripts/lib/node_ids.rb",
+      # Intent 339 (G6): the generated outcome.md library and its CLI.
+      "scripts/lib/outcome_report.rb" => "scripts/lib/outcome_report.rb",
+      "scripts/outcome-report" => "scripts/outcome-report",
+      # Intent 336 (G3): ReadySet, the one function that says what may run
+      # next, and its CLI. node-transition requires the lib as of n5;
+      # registered here (rather than waiting for n8's own CLI/doc unit) so
+      # test/install_sync_test.rb stays green across every intermediate unit.
+      "scripts/lib/ready_set.rb" => "scripts/lib/ready_set.rb",
+      "scripts/ready-set" => "scripts/ready-set",
+      # Intent 337 (G4): the roadmap graph model and its tree renderer,
+      # registered as they land (test/installer_core_test.rb requires every
+      # scripts/lib file to be manifest-covered as soon as it exists, not
+      # only once the CLI that ships it arrives at n4).
+      "scripts/lib/roadmap_graph.rb" => "scripts/lib/roadmap_graph.rb",
+      "scripts/lib/graph_tree.rb" => "scripts/lib/graph_tree.rb",
+      "scripts/lib/index_projection.rb" => "scripts/lib/index_projection.rb",
+      "scripts/lib/roadmap_render.rb" => "scripts/lib/roadmap_render.rb",
+      "scripts/lib/roadmap_migration.rb" => "scripts/lib/roadmap_migration.rb",
+      "scripts/roadmap-graph" => "scripts/roadmap-graph",
+      "scripts/index-projection" => "scripts/index-projection",
+      # Intent 338 (G5): the node packet command - the trust-boundary wrapper,
+      # the five-block gatherer/assembler, and the CLI 340's runner calls.
+      "scripts/lib/packet_wrapper.rb" => "scripts/lib/packet_wrapper.rb",
+      "scripts/lib/node_packet.rb" => "scripts/lib/node_packet.rb",
+      "scripts/node-packet" => "scripts/node-packet",
+      # Intent 342 (G9): the backward shim that presents actions/*.md as a
+      # node graph for any legacy intent, so WorkGraphValidator can require
+      # it without going red on contact with install_sync_test.
+      "scripts/lib/action_graph_shim.rb" => "scripts/lib/action_graph_shim.rb",
+      # Intent 340 (G7, n1): the runner command - the subcommand table over
+      # the declared node graph, its shared context (RunnerCore), and the
+      # installed-core integrity check (CoreIntegrity) the runner's trust
+      # boundary and doctor will both call.
+      "scripts/runner" => "scripts/runner",
+      "scripts/lib/runner_core.rb" => "scripts/lib/runner_core.rb",
+      "scripts/lib/core_integrity.rb" => "scripts/lib/core_integrity.rb",
+      # Intent 340 (G7, n2): the merge abort, the reclaim, and the extension -
+      # the first thing every `step` does, routed from scripts/runner's `sweep`
+      # verb.
+      "scripts/lib/runner_sweep.rb" => "scripts/lib/runner_sweep.rb",
+      # Intent 340 (G7, n3): a work node's own git worktree, cut from the
+      # intent branch tip, merged back into the intent branch, and swept once
+      # its node is terminal.
+      "scripts/lib/node_worktree.rb" => "scripts/lib/node_worktree.rb",
+      # Intent 340 (G7, n4): the return schema (NodeReturn) and the six-check
+      # gate (RunnerAbsorb) that turns one executor return into exactly one
+      # node ledger transition, required lazily by scripts/runner's `step`.
+      "scripts/lib/node_return.rb" => "scripts/lib/node_return.rb",
+      "scripts/lib/runner_absorb.rb" => "scripts/lib/runner_absorb.rb",
+      # Intent 340 (G7, n5): validation, policy, leases and the dispatch plan
+      # - RunnerPolicy (the kind table) and RunnerDispatch, required lazily
+      # by scripts/runner's `step`.
+      "scripts/lib/runner_policy.rb" => "scripts/lib/runner_policy.rb",
+      "scripts/lib/runner_dispatch.rb" => "scripts/lib/runner_dispatch.rb",
+      # Intent 355 (n2): the call budget PreToolUse hook (RunnerPolicy.call_cap
+      # is its cap table, above); its launcher (hooks/call-budget) ships via
+      # hook_files' own glob, so only the hook script itself needs an entry.
+      "scripts/hook-call-budget" => "scripts/hook-call-budget",
+      "scripts/meter-watch" => "scripts/meter-watch",
+      "scripts/lib/meter_watch.rb" => "scripts/lib/meter_watch.rb",
+      # Intent 340 (G7, n6): answer (closes a decision node or unparks a
+      # work node parked at needs_decision), proposals (mints ids for what
+      # an executor proposed), and rewind (resets the intent branch to a
+      # node's own commit and respins it) - routed from scripts/runner's
+      # `answer` and `rewind` verbs.
+      "scripts/lib/runner_answer.rb" => "scripts/lib/runner_answer.rb",
+      "scripts/lib/runner_proposals.rb" => "scripts/lib/runner_proposals.rb",
+      "scripts/lib/runner_rewind.rb" => "scripts/lib/runner_rewind.rb",
     }
   end
 
@@ -437,8 +572,8 @@ class InstallerCore
       version: 3
       execution_mode: subagent-driven
       stale_threshold_days: 3
-      context_offer_tokens: 350000
-      context_insist_tokens: 500000
+      context_offer_tokens: 150000
+      context_insist_tokens: 250000
       hash_length: 6
       hash_algorithm: sha256-base36
       max_slug_words: 5