@zalom/plastic 2.0.0-alpha.21 → 2.0.0-alpha.23

package/PLASTIC.md

@@ -3,7 +3,7 @@
 > **This file is maintained by Plastic.** It is overwritten on update; do not edit it. Project
 > rules go in `AGENTS.md`. Deeper doctrine lives in the six `plastic-conventions` chapters
 > (`references/<chapter>.md`: knowledge-graph, lifecycle-and-savepoints, locks-and-worktrees,
-> completion-and-done, maintenance-and-revisions, roadmaps), read on demand.
+> completion-and-done, maintenance-and-revisions, roadmaps).
 
 ## Two Modes, Plus Auto
 
@@ -43,20 +43,20 @@ IDs follow Luhmann's alternating convention (`1`, `1a`, `1a1`, `1a1a`); siblings
 
 ## The Record: Stages as its Shape
 
-| Stage | Section | Deliverable | Skill |
-|---|---|---|---|
-| **What** | `## Intent` | `{ID}--{slug}.md` | `plastic-intent-creating` |
-| **Why** | `## Context` + Decisions | `spec.md` | `plastic-intent-speccing` (thinking mode) |
-| **How** | `checklist.md` + `actions/` | `plan.md` | `plastic-intent-speccing` writes the action files |
-| **Exec** | `## Outcome` | `outcome.md` | `plastic-intent-executing`; `plastic-intent-ending` closes |
+| Stage | Section | Skill |
+|---|---|---|
+| **What** | `## Intent` | `plastic-intent-creating` |
+| **Why** | `## Context` + Decisions | `plastic-intent-speccing` (optional) |
+| **How** | `graph.md` + `nodes/` | `plastic-intent-speccing` |
+| **Exec** | `## Outcome` | `plastic-intent-executing` drives the runner loop; `plastic-intent-ending` closes |
 
-Stages are the shape of the record, not checkpoints: nothing blocks a write. Only "how to
-execute" (a checklist item plus its action) must exist before work; the rest is backfilled at
-intent end from what was recorded while working.
+Stages are the shape of the record, not checkpoints: nothing blocks a write. Work runs on
+`graph.md` and `nodes/`, driven by `runner step` (dispatch), `runner status` (read the
+ledger), and `runner answer` (close a `needs_decision` node). `spec.md` stays optional;
+`plan.md` and `checklist.md` exist only for a legacy intent with no `graph.md`.
 
 Invoke a skill for your harness: Claude Code uses the slash form (`/plastic-intent-creating`);
-Codex CLI uses a dollar prefix instead (`$plastic-intent-creating`), and may also select a skill
-implicitly by matching its description.
+Codex CLI uses a dollar prefix instead (`$plastic-intent-creating`), and may also select a skill implicitly by matching its description.
 
 `## Insights` is the append-only log of durable discoveries from every stage, newest at the
 bottom, never prepended, each entry prefixed `{utc-iso8601} · {stage} · {author}`. Write
@@ -71,8 +71,8 @@ An auto team is `plastic-enforcer` (the lead) plus `plastic-executor`; models li
 Twenty skills, each `plastic-<name>`, listed by your harness. `plastic-doctor` checks
 installation health (core, store, and full scopes). `plastic-feedback` turns a Plastic quirk,
 bug, or feature idea into a redacted local report and a prefilled GitHub issue URL; only the
-user submits it. If the user hits one, offer to invoke the plastic-feedback skill yourself
-instead of waiting to be asked. A release is a collection of intents; `plastic-releasing`
+user submits it. If the user hits one, offer to invoke the plastic-feedback skill yourself.
+A release is a collection of intents; `plastic-releasing`
 runs the flow. A roadmap is an ordered, delivery-side collection; `plastic-roadmap` owns it.
 
 ## State System
@@ -108,8 +108,10 @@ the store root, so the id allocator and every 1.x store walker skip them.
 2. Artifacts go in the intent directory, never in `docs/plans/` or `docs/specs/`: code goes in
    the project, everything else in the intent. Capture observations in `## Insights`; at the
    end write `outcome.md` and `## Outcome`, and update INDEX.md.
-3. State is derived from what exists: `outcome.md` present means done, so never write it
-   before the checklist is fully checked. Status lives on checklist items, not intents.
+3. State is derived from what exists: `outcome.md` present means the intent is closed, so
+   never write it before every node in `graph.md` reaches a terminal status (checklist.md
+   fully checked, for a legacy intent). Status lives on graph nodes or checklist items,
+   never on intents.
 4. The global store is never pushed (`~/.plastic/` holds sensitive data); agent-created repos
    are private by default (`gh repo create --private`).
 5. Intents are created only via `plastic-intent-creating`, never hand-authored. It
@@ -137,5 +139,5 @@ treating work as new. Enola, or Serena when Enola is absent: prefer its symbol r
 Locks and worktrees exist only for auto teams. One team develops an intent at a time: a
 session-keyed `delivery.lock` in the intent directory, alive while its mtime lease is fresh.
 Code edits happen in the intent's worktree (`<repo>/.claude/worktrees/{id}--{slug}`, branch
-`plastic/{id}--{slug}`). "Done" is three signals that agree: INDEX `## Completed` or
-`## Abandoned`, `outcome.md`, and the savepoint `Done` line; INDEX wins on conflict.
+`plastic/{id}--{slug}`). A terminal intent is three signals that agree: INDEX
+`## Completed`/`## Abandoned`, `outcome.md`, and the terminal savepoint line; INDEX wins.

package/agents/plastic-enforcer.md

@@ -26,9 +26,12 @@ deliberately; the auto pipeline never dispatches them.
    2.0, intent 304): record the rulings, write `spec.md`, then `plan.md`, at least one real
    `actions/ACTION_N.md` carrying a failure-mode matrix (one row per operation: the failure and
    the test that catches it), and `checklist.md`. One consolidated `ACTION_1.md` by default,
-   never an empty `actions/`.
+   never an empty `actions/`. Every name given to a node, file, or field comes from the concept
+   family it lives under, graph engineering, the Plastic concepts coined on top of it, and the
+   software and AI engineering concepts those rest on; a gap is a design finding to raise, not
+   a word to coin.
 3. **Have the plan reviewed before code** - dispatch one adversarial plan reviewer on
-   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; fold every finding into the spec, the
+   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; merge every finding into the spec, the
    matrix, and the tests.
 4. **Dispatch one executor, tests first** - the executor commits the matrix's tests red, then
    builds, then drives the full suite green; you verify tick-versus-diff at the
@@ -50,7 +53,7 @@ dispatch call's model parameter, alongside the spawn-preamble live-state injecti
 
 1. Take the intent; record the rulings in `## Context` + `### Decisions`; write `spec.md`.
 2. Write `plan.md`, the action files with their matrix, and `checklist.md`; dispatch the plan
-   reviewer; fold the review.
+   reviewer; merge the review findings.
 3. Dispatch the executor through `plastic-intent-executing` with the whole consolidated action
    pasted in; require the red commit before the code and a green suite after it. Sequential,
    one team per intent, on one branch when files are shared.

package/agents/plastic-executor.md

@@ -65,3 +65,7 @@ verification, checklist deltas, deviations, blockers, insights) plus the executo
 - Safe-by-default: rename instead of drop, additive migrations, backups before destructive steps
 - One action at a time; do not batch unrelated changes into one step
 - Do not claim done until the full suite is green; show the final summary
+- Every test, file, and symbol you name comes from the same concept family: graph engineering,
+  the Plastic concepts coined on top of it, and the software and AI engineering concepts those
+  rest on; a name from outside that stack is refused, and a gap is a design finding to raise,
+  not a word to coin

package/agents/plastic-node-research.md

@@ -0,0 +1,28 @@
+---
+name: plastic-node-research
+description: |
+  Dispatched for a research node by Plastic's node-graph runner. Given the
+  packet path the dispatch line names, research the question it names by
+  reading the repository, and reply with the YAML return the dispatch line
+  names. Read-only: no Bash, no edit. Never spawned outside a runner
+  dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one packet in, one YAML return out, no diff.
+
+Read the packet the dispatch line names; it is your whole input. Research the question it names
+by reading the repository, never by running it. This role carries no `Bash`, because Claude
+Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and a shell
+is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every file the
+packet points at.
+
+A research node produces no diff. Put what you found in your return's `findings`, never in a code
+change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-verify.md

@@ -0,0 +1,27 @@
+---
+name: plastic-node-verify
+description: |
+  Dispatched for a verify node by Plastic's node-graph runner. Given the
+  packet path the dispatch line names, check the work it names by reading
+  the repository, and reply with the YAML return the dispatch line names.
+  Read-only: no Bash, no edit. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: opus
+---
+
+You are one node in Plastic's node-graph runner: one packet in, one YAML return out, no diff.
+
+Read the packet the dispatch line names; it is your whole input. Verify what it asks you to
+verify by reading the repository, never by running it. This role carries no `Bash`, because
+Claude Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and
+a shell is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every
+file the packet points at.
+
+A verify node produces no diff. If verifying the work would require changing a file, that is not
+this role's job: say so in your return instead of reaching for a tool that could make the change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-work.md

@@ -0,0 +1,32 @@
+---
+name: plastic-node-work
+description: |
+  Dispatched for a work node by Plastic's node-graph runner. Given the packet
+  path the dispatch line names, make the node's code changes inside the node
+  worktree, commit them there, and reply with the YAML return the dispatch
+  line names. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Write
+  - Edit
+  - Bash
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one packet in, your files and your commit and
+one YAML return out.
+
+Read the packet the dispatch line names; it is your whole input. Make the changes it asks for,
+inside the worktree it names, and commit them there. Touch no file outside the packet's `files:`
+list, write to no other node's worktree, and write no ledger line yourself: the runner's own
+gates read your commit and your return, never your word.
+
+This `tools:` allowlist is a guardrail on tool names, not a sandbox on what `Bash` can do once
+granted. A shell can read, write, and reach the network the same as any of the other tools here,
+so `ruby -e File.write(...)` or a stray `curl` walks straight through it. The diff-scope check at
+`done` is the real backstop for what your commit is allowed to touch, not this list.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/bin/lib/context_budget.rb

@@ -87,7 +87,7 @@ module ContextBudget
 
   # What the harness loads at boot: every skill's name and description VALUES,
   # YAML-parsed. Not the raw frontmatter (that would count the keys and the
-  # operational fields), and not a line regex (that would truncate a folded
+  # operational fields), and not a line regex (that would truncate a flattened
   # description at its first line).
   def self.skill_catalog_bytes(repo:)
     skill_paths(repo: repo).sum do |path|

package/hooks/hooks.json

@@ -88,6 +88,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook\" stop",
+            "statusMessage": ""
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/statusline

@@ -187,6 +187,7 @@ FIELDS=$(printf '%s' "$INPUT" | awk '
     wanted["context_window.current_usage.cache_read_input_tokens"] = 1
     wanted["cost.total_cost_usd"] = 1
     wanted["rate_limits.five_hour.used_percentage"] = 1
+    wanted["rate_limits.five_hour.resets_at"] = 1
     wanted["rate_limits.seven_day.used_percentage"] = 1
   }
   { buf = buf $0 " " }
@@ -209,6 +210,7 @@ CU_CC=""
 CU_CR=""
 COST_RAW=""
 M5_PCT=""
+M5_RESETS=""
 M7_PCT=""
 
 while IFS=$'\t' read -r k v; do
@@ -224,6 +226,7 @@ while IFS=$'\t' read -r k v; do
     context_window.current_usage.cache_read_input_tokens) CU_CR="$v" ;;
     cost.total_cost_usd) COST_RAW="$v" ;;
     rate_limits.five_hour.used_percentage) M5_PCT="$v" ;;
+    rate_limits.five_hour.resets_at) M5_RESETS="$v" ;;
     rate_limits.seven_day.used_percentage) M7_PCT="$v" ;;
   esac
 done <<FIELDS_EOF
@@ -301,6 +304,31 @@ meter_seg() {   # $1 = label, $2 = raw percentage
 M5=$(meter_seg "5h" "$M5_PCT")
 M7=$(meter_seg "7d" "$M7_PCT")
 
+# --- Rate-limits cache for MeterWatch (graph.md D11) ---
+# Written only when the payload carries a meter at all; an API-key session
+# with no rate_limits section leaves the cache untouched. A present meter
+# with no matching value writes null rather than dropping the key, so
+# MeterWatch always sees the same three fields. Temp file in the cache
+# directory, then mv, so MeterWatch never reads a half-written file.
+if [ -n "$M5_PCT" ] || [ -n "$M7_PCT" ]; then
+  CACHE_DIR="$HOME/.plastic/.cache"
+  mkdir -p "$CACHE_DIR"
+  CACHE5=$(to_int "$M5_PCT")
+  CACHE7=$(to_int "$M7_PCT")
+  [ -z "$CACHE5" ] && CACHE5=null
+  [ -z "$CACHE7" ] && CACHE7=null
+  if [ -n "$M5_RESETS" ]; then
+    RESETS_JSON="\"$M5_RESETS\""
+  else
+    RESETS_JSON=null
+  fi
+  CACHE_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  CACHE_TMP="$CACHE_DIR/.rate-limits.json.tmp.$$"
+  printf '{"five_hour":%s,"seven_day":%s,"resets_at":%s,"at":"%s"}\n' \
+    "$CACHE5" "$CACHE7" "$RESETS_JSON" "$CACHE_AT" > "$CACHE_TMP"
+  mv "$CACHE_TMP" "$CACHE_DIR/rate-limits.json"
+fi
+
 # --- Session cost (stdin cost.total_cost_usd); hidden when it renders as $0.00 ---
 COST_SEG=""
 if [ -n "$COST_RAW" ]; then

package/hooks/stop

@@ -0,0 +1,5 @@
+#!/bin/bash
+INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+echo "$INPUT" | env -u RUBYOPT ruby "$SCRIPT_DIR/../scripts/hook-stop" "$HOME/.plastic"
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "2.0.0-alpha.21",
+  "version": "2.0.0-alpha.23",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/doctor.rb

@@ -29,6 +29,7 @@ require_relative "lib/lock"
 require_relative "lib/savepoint"
 require_relative "lib/node_ledger"
 require_relative "lib/ready_set"
+require_relative "lib/graph_measure_models"
 require_relative "lib/index_projection"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
@@ -138,7 +139,7 @@ class Doctor
         --intent ID     Per-intent structure gate at intent-end (intent 222): one
                         closing intent only, never a store sweep. Pair with
                         --store <key> to disambiguate an id that collides across
-                        stores, and --disposition delivered|abandoned to fold in
+                        stores, and --disposition delivered|abandoned to include
                         the outcome.md disposition check. 3-state pass/warn/fail.
         -h, --help      Show this help
 
@@ -631,6 +632,20 @@ class Doctor
     # ReadySet's own require chain is 65,648 bytes, far past that budget.
     checks.concat(node_graph_checks(intent_dirs))
 
+    # model_requalification (D42, intent 343 G10 n7): a recorded model= that no
+    # longer matches what RunnerPolicy.model_for resolves for its role today
+    # means every measurement taken under the old model measured a different
+    # system. Lives here for the same reason node_graph_checks does: pins to
+    # test/doctor_core_split_test.rb's exact-set boot-path assertion, never
+    # doctor_core.rb (D11) - GraphMeasureModels' own require chain (NodeLedger,
+    # NodeFile, RunnerPolicy, AgentModels) is far past that file's byte budget.
+    checks.concat(model_requalification_checks(scopes: scopes))
+
+    # unpromoted_rules (intent 341, G8, C37): an Insights entry tagged
+    # `rule:` (via `insight-append --rule`) is a promise the rule will make
+    # it into project doctrine. Advisory only.
+    checks.concat(unpromoted_rules_checks(intent_dirs, home: Dir.home))
+
     # cross_store_resolution — RESOLVES (not just shape-checks) every cross-store
     # `store:id` ref against the FULL store family via the relocation map
     # (relocation consulted first), closing the shape-only gap i1/i3/i4 leave open.
@@ -795,7 +810,11 @@ def done_signal_findings_for_dir(dir, label:, scope:, dirname:, terminal:, activ
     # written from the record by `scaffold-intent backfill`, so this is repairable and
     # reported as a fixable warn (backfilled_complete). Its exclusions go to their OWN
     # bucket so savepoint_operational's consumed/dead-row bookkeeping above never sees them.
-    backfill_gaps = %w[spec.md plan.md].reject { |f| Savepoint.stage_file_present?(File.join(dir, f)) }
+    # A graph intent (real graph.md on disk) never carries spec.md or plan.md by design
+    # (D1, no ceremonies, intent 341): the graph IS the spec and the plan, so a missing one
+    # is never a gap here.
+    is_graph_intent = File.exist?(File.join(dir, "graph.md"))
+    backfill_gaps = is_graph_intent ? [] : %w[spec.md plan.md].reject { |f| Savepoint.stage_file_present?(File.join(dir, f)) }
     # Name whichever directory the intent actually used (post-execution
     # review, non-blocking 8), consistent with Savepoint.missing_for_stage:
     # a nodes/ directory on disk means the intent chose the node-graph
@@ -853,7 +872,7 @@ def check_done_signals(scopes: nil)
       projection = IndexProjection.analyze(store[:store_dir], index_path: store[:index])
       projection[:drift].each do |row|
         index_drift << "#{store[:scope]}: #{row[:id]} - INDEX says #{row[:index_status]}, " \
-                        "the ledger's last Done line says #{row[:ledger_status]}"
+                        "the ledger's last line says #{row[:ledger_status]}"
       end
     end
 
@@ -973,14 +992,14 @@ def check_done_signals(scopes: nil)
   # rebuild-savepoint for most gaps, or knowingly excluded for the ones 219 D6 forbids ever
   # repairing (no real outcome.md to echo a disposition from). Three branches (spec D4/D5):
   # a malformed exclusion file can never report pass (loud), a clean remaining gap set reports
-  # pass with the exclusion count folded in, and a real remaining gap set stays warn, same as
-  # before intent 274, with the same count folded in when exclusions applied.
+  # pass with the exclusion count included, and a real remaining gap set stays warn, same as
+  # before intent 274, with the same count included when exclusions applied.
   #
-  # `dead_suffix` (intent 280) folds in a second, independent drift notice: exclusion rows that
+  # `dead_suffix` (intent 280) adds a second, independent drift notice: exclusion rows that
   # suppressed nothing this run. It is purely informational, exactly like `exclusion_suffix` - it
   # never changes status on any of the three branches below, because a stale governance-record row
   # is bookkeeping drift, not a store regression (219 D6 is untouched: no disposition is invented).
-  # Per rule (intent 308): savepoint_operational and backfilled_complete each fold in only
+  # Per rule (intent 308): savepoint_operational and backfilled_complete each include only
   # their own exclusions and dead rows, so one check never carries the other's counts.
   suffixes = lambda do |excluded_rows, dead|
     ex = excluded_rows.empty? ? "" : " (#{excluded_rows.size} excluded via #{exclusion_paths.join(", ")})"
@@ -1031,7 +1050,7 @@ def check_done_signals(scopes: nil)
   # backfilled_complete (intent 308): spec.md, plan.md, or a real action file missing on a
   # terminal intent. Same three branches as savepoint_operational: a malformed exclusion
   # file is always loud, a clean set passes with its own exclusion and dead-row counts
-  # folded in, a real gap set warns with the backfill verb as the fix.
+  # included, a real gap set warns with the backfill verb as the fix.
   backfill_hint = "Write the missing documents from the record via " \
                   "`scaffold-intent backfill --store <store> --id <id> --disposition " \
                   "<delivered|abandoned>` (never touches real content, one intent per invocation)."
@@ -1097,7 +1116,7 @@ def check_done_signals(scopes: nil)
       fix_hint: "For a live (Active) intent, rebuild the ledger via " \
                 "Savepoint.rebuild_savepoint. Terminal (Completed/Abandoned) intents are immutable: " \
                 "a phantom there stays advisory unless an explicit human grant authorizes the " \
-                "124a manual Done-bookend repair."
+                "124a manual terminal-bookend repair."
     )
   end
 
@@ -1294,9 +1313,13 @@ end
   end
 
   INTENT_END_LIFECYCLE_FILES = %w[spec.md plan.md checklist.md outcome.md].freeze
+  # A graph intent (D1, no ceremonies, intent 341) never carries spec.md, plan.md, or
+  # checklist.md by design; the graph IS the spec and the plan. outcome.md stays mandatory.
+  GRAPH_INTENT_LIFECYCLE_FILES = %w[outcome.md].freeze
 
   def intent_lifecycle_artifacts_check(intent_dir, disposition)
-    missing = INTENT_END_LIFECYCLE_FILES.select { |f| !Savepoint.stage_file_present?(File.join(intent_dir, f)) }
+    files = File.exist?(File.join(intent_dir, "graph.md")) ? GRAPH_INTENT_LIFECYCLE_FILES : INTENT_END_LIFECYCLE_FILES
+    missing = files.select { |f| !Savepoint.stage_file_present?(File.join(intent_dir, f)) }
     unless Savepoint.stage_file_present?(Savepoint.intent_file(intent_dir))
       missing = [File.basename(Savepoint.intent_file(intent_dir))] + missing
     end
@@ -1774,6 +1797,132 @@ end
     end
   end
 
+  # --- Check: re-qualification on model change (D42, intent 343 G10 n7) ---
+  #
+  # When the model behind a role changes, every measurement GraphMeasureModels
+  # took under the old model measured a different system, and the numbers
+  # need re-qualifying before anyone acts on them (D42). This warns, never
+  # fails (D10): a model change is routine, and a red doctor over it would
+  # train people to stop reading the report. The comparison itself is
+  # GraphMeasureModels' own (D16, via RunnerPolicy.model_for) - this method
+  # never re-derives it, it only names the drift rows GraphMeasureModels
+  # already computed.
+  #
+  # Runs once per discovered store (StoreDiscovery, shared with every other
+  # store-scoped check here), never per intent directory: GraphMeasureModels
+  # walks a whole store_dir itself in one pass. A store this process cannot
+  # read - or any other exception the store walk raises - is skipped, never
+  # fatal: one bad store must never take every other doctor check down with
+  # it.
+  #
+  # NEW-4 (v2 review, D22): this rule used to pass `project_config: {}` on
+  # purpose, reasoning there was no live project scope at doctor-run time -
+  # false: each discovered store DOES have a real sibling `config.yml`
+  # (`GraphMeasureModels.project_config_path`), the same file the `cohorts`
+  # verb resolves. Loading it here means the doctor and `cohorts` can never
+  # disagree about the same store's project-scope override again.
+  def model_requalification_checks(scopes: nil)
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml")) || {}
+    findings = []
+
+    store_discovery[:stores].each do |s|
+      next if scopes && !scopes.include?(s[:key])
+
+      project_config = load_yaml_safe(GraphMeasureModels.project_config_path(s[:store])) || {}
+      record = begin
+        GraphMeasureModels.read(s[:store], project_config: project_config, global_config: global_config)
+      rescue StandardError
+        next
+      end
+
+      %i[executor advisor].each do |role|
+        Array(record[:drift][role]).each do |row|
+          findings << "#{s[:key]}/#{row[:intent]}/#{row[:node]} (#{role}): recorded model=#{row[:recorded]}, " \
+                      "current config resolves #{row[:expected]} for kind #{row[:kind]} - re-qualify any " \
+                      "measurement taken while model=#{row[:recorded]} was in effect"
+        end
+      end
+    end
+
+    if findings.empty?
+      [check(
+        category: "conventions", name: "model_requalification", status: "pass",
+        message: "No recorded model= differs from what config resolves today for its role"
+      )]
+    else
+      [check(
+        category: "conventions", name: "model_requalification", status: "warn",
+        message: "#{findings.size} node(s) recorded a model that no longer matches the role's " \
+                 "config-resolved model",
+        details: findings, fixable: false,
+        fix_hint: "The old measurements were taken against a different model; re-qualify them under " \
+                  "the current model before acting on their numbers"
+      )]
+    end
+  end
+
+  # --- Check: unpromoted rule: findings (intent 341, G8, C37) ---------------
+  #
+  # `insight-append --rule` tags an entry "... - rule: <text>". A tag is a
+  # promise the rule will make it into project doctrine; until the exact
+  # rule text shows up in some skills/conventions/references/*.md chapter,
+  # it is only visible to a session that happens to read this one intent
+  # file, and the next session repeats the mistake the rule names. Advisory
+  # only (warn, never fail): a freshly tagged rule is not yet promoted by
+  # design, and nothing here can auto-promote it (that is an editorial call,
+  # not a mechanical one).
+  RULE_ENTRY_RE = /—\s*rule:\s*(.+?)\s*\z/.freeze
+
+  def unpromoted_rules_checks(intent_dirs, package_root: PACKAGE_ROOT, home: nil)
+    # The installed doctor runs from ~/.plastic/scripts, so PACKAGE_ROOT
+    # (~/.plastic) has no skills/ directory: the conventions chapters install
+    # to the agent home layout instead. `home` is caller-injected (never an
+    # ENV read here) so this stays hermetic in tests; the real call site
+    # passes the process's actual home directory.
+    chapter_dirs = []
+    if home
+      chapter_dirs << File.join(home, ".claude", "skills", "plastic-conventions", "references")
+      chapter_dirs << File.join(home, ".agents", "skills", "plastic-conventions", "references")
+    end
+    chapter_dirs << File.join(package_root, "skills", "conventions", "references")
+
+    chapters_text = chapter_dirs.select { |d| Dir.exist?(d) }
+                                .flat_map { |d| Dir.glob(File.join(d, "*.md")) }
+                                .map { |f| File.read(f) }
+                                .join("\n\n")
+
+    unpromoted = []
+    intent_dirs.each do |d|
+      md_path = File.join(d[:path], "#{d[:name]}.md")
+      next unless File.exist?(md_path)
+
+      File.readlines(md_path).each do |line|
+        m = line.chomp.match(RULE_ENTRY_RE)
+        next unless m
+
+        rule_text = m[1].strip
+        next if rule_text.empty?
+
+        unpromoted << "#{tilde(d[:path])}: #{rule_text}" unless chapters_text.include?(rule_text)
+      end
+    end
+
+    if unpromoted.empty?
+      [check(
+        category: "conventions", name: "unpromoted_rules", status: "pass",
+        message: "Every tagged rule: finding is carried by a conventions chapter"
+      )]
+    else
+      [check(
+        category: "conventions", name: "unpromoted_rules", status: "warn",
+        message: "#{unpromoted.size} tagged rule(s) not yet carried by any conventions chapter",
+        details: unpromoted, fixable: false,
+        fix_hint: "Promote the rule into the right skills/conventions/references/*.md chapter, " \
+                  "or drop the tag if the finding does not belong in doctrine"
+      )]
+    end
+  end
+
   # --- Check category 3: Agent registration ---
 
 

package/scripts/end-intent

@@ -287,7 +287,7 @@ end
 # Abandoned closes and machine-backfilled outcomes (the backfill marker) are
 # exempt: the reader cannot expect labels the writer never had.
 #
-# Intent 334 (G1, fold A3; post-execution review, blocking 2): the legacy
+# Intent 334 (G1, review A3; post-execution review, blocking 2): the legacy
 # "S3" label grammar applies only to actions/*.md headings, and the node id
 # grammar (kind prefix n/v/d/r plus digits, D1r) applies only to nodes/*.md
 # headings - never both over both directories. This repo's own house words
@@ -310,7 +310,7 @@ end
 # 339 S9 (D18): a node id counts as a label in an actions/*.md heading too,
 # but only when it stands alone as one of the heading's " - "-delimited
 # segments - this repo's own convention, "### S1 - n1 - Title" (this action
-# file's own headings, post-fold) or the bare "### n1 - Title". Never as a
+# file's own headings, post-merge) or the bare "### n1 - Title". Never as a
 # free word inside ordinary prose: the comment above ACTION_ID_LABEL_RE
 # records exactly why intent 334 restricted the node-id grammar to
 # nodes/*.md headings in the first place, and that reasoning does not change
@@ -342,7 +342,7 @@ def hollow_report_reason(intent_dir, disposition)
   # a node id ("n1", "v2", "d3", "r4"). A terse legacy close with no labeled
   # matrix stays report-and-proceed (intent 334, G1, D10r).
   #
-  # Every matching token per heading is kept, not just the first (fold A3):
+  # Every matching token per heading is kept, not just the first (review A3):
   # a legacy actions/ heading can carry BOTH an S-label and prose that reads
   # like a node id ("### The v2 rewrite (S3)"). Restricting the word-scan
   # node-id grammar to nodes/*.md headings (post-execution review, blocking