@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.23

package/scripts/lib/harness_adapter.rb

@@ -0,0 +1,184 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# HarnessAdapter (intent 340b, G7c, n1): the one module in Plastic that knows
+# a harness by name. It resolves the current key from config `agent.type`,
+# renders a dispatch plan into that harness's instructions, and answers what
+# the ledger should record. `runner step` calls it; nothing else in the
+# runner does (spec D1).
+#
+# Pure: every input is an argument, nothing here reads ENV or a real
+# config.yml itself - the caller (scripts/runner) owns loading real config,
+# this module only resolves values out of what it is handed, the same
+# discipline RunnerPolicy already holds for model resolution.
+module HarnessAdapter
+  module_function
+
+  # The only two harnesses this module knows (spec D2). An unknown key -
+  # config-authored or from `--harness` - always falls back to this rather
+  # than to no adapter at all (matrix row 1.3): a plan with no rendering
+  # under it is worse than a plan rendered for the wrong harness, because the
+  # first is silent.
+  DEFAULT_KEY = "claude-code"
+  KNOWN_KEYS = %w[claude-code codex].freeze
+
+  # The exact sentence 340a's watch prints to stderr and exits 1 with,
+  # before any write, when `--dispatch` is asked of a harness
+  # #unattended_start? refuses (graph.md D7). Quoted verbatim in
+  # docs/reference/harness-adapters.md (D12); change the wording in one
+  # place only.
+  UNATTENDED_START_SENTENCE =
+    "Unattended start is delivered only where a Ruby loop owns dispatch (Codex, through runner " \
+    "watch --dispatch); on Claude Code the runner is the harness session (327 Q6), so arm /loop " \
+    "over runner watch in a live session instead."
+
+  # unattended_start?(key) -> true only for "codex" (graph.md D7): the one
+  # harness where a Ruby loop (RunnerUntilEmpty, through `runner watch
+  # --dispatch`) owns dispatch end to end with nobody on the other end
+  # making subagent calls. Claude Code IS the harness session (327 Q6), and
+  # an unknown key is never granted unattended start either - this module
+  # stays the only place that names a harness, so RunnerWatch asks this
+  # predicate and never compares a key against "codex" itself.
+  def unattended_start?(key)
+    key.to_s == "codex"
+  end
+
+  # kind -> the Claude Code agent type dispatched for it (spec Approach).
+  # Verify and research carry no `Bash` in their own frontmatter (n2); this
+  # table only names WHICH agent a kind maps to. An unknown kind gets
+  # `work`'s row, the widest of the three, never no agent type at all
+  # (matrix row 1.10), mirroring RunnerPolicy's own kind-table fallback.
+  AGENT_TYPE_BY_KIND = {
+    "work" => "plastic-node-work",
+    "verify" => "plastic-node-verify",
+    "research" => "plastic-node-research",
+  }.freeze
+
+  def agent_type_for_kind(kind)
+    AGENT_TYPE_BY_KIND.fetch(kind.to_s, AGENT_TYPE_BY_KIND["work"])
+  end
+
+  # resolve_key(config:, override:) -> the harness key for one call (matrix
+  # rows 1.1-1.3, 1.18). `override` (the CLI's `--harness KEY`, spec D2) wins
+  # over `config`'s own `agent.type` for that one call; either source is
+  # squashed (whitespace collapsed, matrix row 1.18) before it is even
+  # compared, so a config-authored value carrying a tab or a newline can
+  # never reach `NodeLedger` unsquashed and raise `ArgumentError` mid-dispatch,
+  # after the packet is already built. A value that still is not one of
+  # KNOWN_KEYS after squashing falls back to DEFAULT_KEY with a warning
+  # (never to no adapter), so this method's return is always one of the two
+  # known, clean strings - safe to hand straight to a ledger field.
+  def resolve_key(config: {}, override: nil)
+    raw = blank?(override) ? agent_type_from_config(config) : override.to_s
+    squashed = squash(raw)
+    return squashed if KNOWN_KEYS.include?(squashed)
+
+    warn "harness_adapter: unknown harness #{raw.inspect}, falling back to #{DEFAULT_KEY.inspect}"
+    DEFAULT_KEY
+  end
+
+  def agent_type_from_config(config)
+    return DEFAULT_KEY unless config.is_a?(Hash)
+
+    value = config.dig("agent", "type")
+    value = config.dig(:agent, :type) if blank?(value)
+    blank?(value) ? DEFAULT_KEY : value.to_s
+  end
+  private_class_method :agent_type_from_config
+
+  def squash(text)
+    text.to_s.strip.gsub(/\s+/, " ")
+  end
+  private_class_method :squash
+
+  def blank?(value)
+    value.nil? || value.to_s.strip.empty?
+  end
+  private_class_method :blank?
+
+  # render(dispatched, harness:, return_contract:) -> the rendered
+  # instruction block for `harness` (a String), or nil for an empty dispatch
+  # list (matrix row 1.14: a step that dispatched nothing prints no
+  # instruction block for a session to act on). `dispatched` is the runner's
+  # own plan entries (RunnerDispatch's `:dispatched` shape): [{node:, kind:,
+  # role:, model:, worktree:, packet:}, ...]. The model and the packet path
+  # ride straight from each entry - never a fresh lookup (matrix row 1.11)
+  # and never a summary (matrix row 1.12) - and `return_contract` (the exact
+  # text RunnerDispatch::RETURN_CONTRACT already carries in the YAML plan)
+  # renders exactly once, above every node, never per node (matrix row 1.13).
+  def render(dispatched, return_contract:, harness: DEFAULT_KEY)
+    entries = Array(dispatched)
+    return nil if entries.empty?
+
+    key = KNOWN_KEYS.include?(harness.to_s) ? harness.to_s : DEFAULT_KEY
+    key == "codex" ? render_codex(entries, return_contract) : render_claude_code(entries, return_contract)
+  end
+
+  # The Claude Code rendering (spec Approach): per dispatched node, the agent
+  # type from the kind, the model the plan already resolved, and the packet
+  # path as the whole prompt.
+  def render_claude_code(entries, return_contract)
+    blocks = entries.map do |d|
+      "Dispatch #{agent_type_for_kind(d[:kind])} for #{d[:node]} (model: #{d[:model]}):\n  prompt: #{d[:packet]}"
+    end
+    "#{return_contract.to_s.strip}\n\n#{blocks.join("\n\n")}\n"
+  end
+  private_class_method :render_claude_code
+
+  # The Codex rendering: a Codex node runs end to end through `scripts/
+  # node-run` (n6), which reads the ledger's own `running` line directly and
+  # never through this printed block - so this names, per node, the same
+  # facts the block gives Claude Code (kind, model, packet path) framed as
+  # `node-run` calls, proving the seam renders SOMETHING for the second
+  # harness rather than nothing (matrix row 1.27), without inventing detail
+  # that belongs to n6's own adapter.
+  def render_codex(entries, return_contract)
+    blocks = entries.map do |d|
+      "node-run #{d[:node]} (#{d[:kind]}, model: #{d[:model]}):\n  packet: #{d[:packet]}"
+    end
+    "#{return_contract.to_s.strip}\n\n#{blocks.join("\n\n")}\n"
+  end
+  private_class_method :render_codex
+
+  # cross_harness_resume(entries) -> [{node:, harnesses: [...], commits: {...}}, ...]
+  # (spec D12, 340b n8). `entries` is a node ledger's own parsed lines (the
+  # shape `NodeLedger.entries`/`entries_from_content` return): every declared
+  # node's own `harness=` values, read across every non-torn line for that
+  # subject in file order, deduplicated by first appearance (matrix row 8.6:
+  # the starting harness is whichever key showed up first). A `reclaimed`
+  # line carries no `harness=` of its own and is never a boundary here (row
+  # 8.7) - it is simply a line with nothing to contribute, scanned like any
+  # other. A node whose lines carry one key, or none at all, reports nothing
+  # (rows 8.2, 8.3): an old ledger with no `harness=` field anywhere must
+  # stay silent rather than raise.
+  #
+  # Every node named by ANY entry is scanned (row 8.8), not only the first;
+  # `RunnerAbsorb` is what put `harness=` on both the running line and the
+  # terminal line, so the commit that lands with the finishing harness's own
+  # terminal line is exactly the evidence a resumed node actually left
+  # behind (row 8.5).
+  def cross_harness_resume(entries)
+    live = Array(entries).reject { |e| e[:torn] }
+    nodes = live.map { |e| e[:subject] }.uniq
+
+    nodes.filter_map do |node|
+      node_lines = live.select { |e| e[:subject] == node }
+      keys = []
+      commits = Hash.new { |h, k| h[k] = [] }
+
+      node_lines.each do |e|
+        fields = e[:fields] || {}
+        key = fields["harness"]
+        next if blank?(key)
+
+        keys << key unless keys.include?(key)
+        commit = fields["commit"]
+        commits[key] << commit unless blank?(commit) || commits[key].include?(commit)
+      end
+
+      next if keys.size < 2
+
+      { node: node, harnesses: keys, commits: keys.to_h { |k| [k, commits[k]] } }
+    end
+  end
+end

package/scripts/lib/hook_registry.rb

@@ -79,6 +79,18 @@ module HookRegistry
           { "name" => "message-display", "status" => "" },
         ] },
       ],
+      # Continuation on Claude Code (intent 340b, G7c, n4, D5/D7): registered
+      # statically here, like every other hook, and decided at runtime by
+      # StopGate, which reads runner.stop_hook itself (default false, D9).
+      # Not one of CODEX_LIVE_STATE_EVENTS, CODEX_POST_HOOKS or
+      # CODEX_SESSION_END_HOOKS, so codex_hooks_json never picks it up and
+      # codex_hook_names stays at its pinned six (test/hook_registry_test.rb,
+      # test/codex_hooks_test.rb).
+      "Stop" => [
+        { "matcher" => "", "hooks" => [
+          { "name" => "stop", "status" => "" },
+        ] },
+      ],
     }
   end
 
@@ -161,7 +173,7 @@ module HookRegistry
   # name here in the SAME change. Skip it and every existing install keeps a dead
   # registration no update will ever clean up.
   #
-  # Never fold these into claude_launcher_names: that method is what doctor's
+  # Never merge these into claude_launcher_names: that method is what doctor's
   # hooks_exist demands be present on disk, so a retired name there makes a correct
   # install report missing launchers.
   RETIRED_HOOK_NAMES = %w[

package/scripts/lib/hook_replay.rb

@@ -83,22 +83,40 @@ module HookReplay
   # index/exitstatus/stdout/stderr/final), ordered by index regardless of
   # the order the threads actually finish in.
   def replay_concurrent(hook_path:, tmp_root:, text:, chunk: 40, session_id: "s-replay",
-                         message_id: "replay", env: {}, gap_ms: 5, jitter: true)
+                         message_id: "replay", env: {}, gap_ms: 5, jitter: true, lead_until_engaged: false)
     chunks = text.scan(/.{1,#{chunk}}/m)
     chunks = [""] if chunks.empty?
     full_env = { "PLASTIC_TMP" => tmp_root }.merge(env)
     gap = gap_ms / 1000.0
 
-    results = Array.new(chunks.length)
-    threads = chunks.each_with_index.map do |delta, i|
-      payload = {
+    payloads = chunks.each_with_index.map do |delta, i|
+      {
         "session_id" => session_id, "message_id" => message_id, "index" => i,
         "final" => i == chunks.length - 1, "delta" => delta, "cwd" => tmp_root,
         "hook_event_name" => "MessageDisplay",
       }
+    end
+    results = Array.new(chunks.length)
+
+    # `lead_until_engaged` runs chunks one at a time until one engages, so
+    # the decision marker is on disk before the rest fire concurrently. A
+    # caller proving "no late passthrough once the decision is in place"
+    # then tests exactly that, instead of whether chunk 0's own process
+    # booted inside a later chunk's poll budget on a loaded machine.
+    lead = 0
+    if lead_until_engaged
+      payloads.each_with_index do |payload, i|
+        out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, nil)
+        results[i] = { index: i, exitstatus: exitstatus, stdout: out, stderr: err, final: payload["final"] }
+        lead = i + 1
+        break unless out.to_s.empty?
+      end
+    end
+
+    threads = payloads.each_with_index.drop(lead).map do |payload, i|
       Thread.new do
         begin
-          delay = i * gap
+          delay = (i - lead) * gap
           delay += (rand * gap / 2.0) if jitter
           sleep(delay)
           out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, nil)

package/scripts/lib/index_projection.rb

@@ -11,7 +11,7 @@ require_relative "atomic_write"
 # (row 5.1/5.2): a REAL terminal line (Done delivered/abandoned, or a
 # classifiable Done detail) beats a stale INDEX section. An intent whose
 # ledger is silent (no terminal line) or absent (no savepoint.md at all)
-# keeps the status INDEX already carries (row 5.13, folded at the
+# keeps the status INDEX already carries (row 5.13, merged at the
 # 2026-09-10 plan review): 63 of 451 intents in the plastic store have no
 # savepoint.md and 59 more never reach a Done line, and a literal reading
 # would demote all of them. This module computes and compares only; it

package/scripts/lib/installer_core.rb

@@ -10,6 +10,7 @@ require_relative "hook_registry"
 require_relative "agent_models"
 require_relative "harness_text"
 require_relative "compact_instructions"
+require_relative "engine_permissions"
 
 # Shared installer machinery, instantiable with injected package root / store / agent
 # map so the verb scripts (install/update/uninstall/rollback) and their tests can run
@@ -375,6 +376,7 @@ class InstallerCore
       "scripts/lib/savepoint.rb" => "scripts/lib/savepoint.rb",
       "scripts/lib/guarded_append.rb" => "scripts/lib/guarded_append.rb",
       "scripts/lib/node_ledger.rb" => "scripts/lib/node_ledger.rb",
+      "scripts/lib/node_progress.rb" => "scripts/lib/node_progress.rb",
       "scripts/node-transition" => "scripts/node-transition",
       "scripts/lib/arm.rb" => "scripts/lib/arm.rb",
       "scripts/lib/lock.rb" => "scripts/lib/lock.rb",
@@ -545,6 +547,26 @@ class InstallerCore
       # by scripts/runner's `step`.
       "scripts/lib/runner_policy.rb" => "scripts/lib/runner_policy.rb",
       "scripts/lib/runner_dispatch.rb" => "scripts/lib/runner_dispatch.rb",
+      # Intent 340b (G7c, n1): the harness seam - HarnessAdapter, required
+      # by scripts/lib/runner_dispatch.rb and by scripts/runner's `step`
+      # directly.
+      "scripts/lib/harness_adapter.rb" => "scripts/lib/harness_adapter.rb",
+      # Intent 340b (G7c, n6): the Codex leg - CodexAdapter (the `codex exec`
+      # argv, the sandbox per kind, and the bounded subprocess) and
+      # scripts/node-run, the CLI that runs one node's whole attempt over
+      # it and writes only a return file, never a ledger transition.
+      "scripts/lib/codex_adapter.rb" => "scripts/lib/codex_adapter.rb",
+      "scripts/node-run" => "scripts/node-run",
+      # Intent 340b (G7c, n3): the engine deny rule - the frozen permissions.deny
+      # entry list, merged into settings.json at install and removed surgically
+      # at uninstall.
+      "scripts/lib/engine_permissions.rb" => "scripts/lib/engine_permissions.rb",
+      # Intent 340b (G7c, n4): the Stop gate, the shared ActiveDelivery walk
+      # it and the PreCompact hand-off both call, and hook-stop, the Stop
+      # hook body scripts/hook-stop's launcher (hooks/stop) relays into.
+      "scripts/lib/stop_gate.rb" => "scripts/lib/stop_gate.rb",
+      "scripts/lib/active_delivery.rb" => "scripts/lib/active_delivery.rb",
+      "scripts/hook-stop" => "scripts/hook-stop",
       # Intent 355 (n2): the call budget PreToolUse hook (RunnerPolicy.call_cap
       # is its cap table, above); its launcher (hooks/call-budget) ships via
       # hook_files' own glob, so only the hook script itself needs an entry.
@@ -559,6 +581,35 @@ class InstallerCore
       "scripts/lib/runner_answer.rb" => "scripts/lib/runner_answer.rb",
       "scripts/lib/runner_proposals.rb" => "scripts/lib/runner_proposals.rb",
       "scripts/lib/runner_rewind.rb" => "scripts/lib/runner_rewind.rb",
+      # Intent 343 (G10, n1): the ledger reader - GraphMeasure.read turns one
+      # intent directory into one frozen measurement record. No CLI yet
+      # (scripts/graph-measure ships at n2); registered here so it is never
+      # a lib that exists on disk but never reaches an install.
+      "scripts/lib/graph_measure.rb" => "scripts/lib/graph_measure.rb",
+      # Intent 343 (G10, n2): the graph-measure command - the subcommand
+      # table over the ledger reader, and the two renderers (text, JSON)
+      # over the one record it returns.
+      "scripts/graph-measure" => "scripts/graph-measure",
+      "scripts/lib/graph_measure_report.rb" => "scripts/lib/graph_measure_report.rb",
+      # Intent 343 (G10, n4): the `budget` verb - whether the `budget:` a
+      # node's envelope declares (327 C19) is a ceiling that ever actually
+      # held, read from the ledger and the real packet files.
+      "scripts/lib/graph_measure_budget.rb" => "scripts/lib/graph_measure_budget.rb",
+      # Intent 343 (G10, n5): the `cohorts` verb's model section - the store
+      # walk and whether a recorded model= still matches what config
+      # resolves today through RunnerPolicy.
+      "scripts/lib/graph_measure_models.rb" => "scripts/lib/graph_measure_models.rb",
+      # Intent 343 (G10, n6): the rest of the `cohorts` verb - approve-then-
+      # fix per verify model, hop on versus off, delivery latency, the
+      # evidence bar, and the two concurrency ceilings.
+      "scripts/lib/graph_measure_cohorts.rb" => "scripts/lib/graph_measure_cohorts.rb",
+      # Intent 340b (G7c, n7): the Codex loop - composes `step` and
+      # `node-run` itself (concurrency two, serial absorb, iteration-capped),
+      # routed from scripts/runner's internal `until-empty` verb.
+      "scripts/lib/runner_until_empty.rb" => "scripts/lib/runner_until_empty.rb",
+      # Intent 340a (G7b, n1): the delivery watch - one tick over disk truth,
+      # stalled and done-unreported classification, no CLI and no dispatch.
+      "scripts/lib/runner_watch.rb" => "scripts/lib/runner_watch.rb",
     }
   end
 
@@ -932,6 +983,11 @@ class InstallerCore
     choice = statusline_choice(settings_path, argv: argv, input: input, reinstall: reinstall)
     merge_claude_hooks(settings_path, choice: choice)
 
+    # The engine deny rule (intent 340b, G7c, n3, D4): a second ownership
+    # mechanism from the hook merge above, so it is its own call rather than a
+    # branch inside merge_claude_hooks.
+    merge_engine_permissions(settings_path)
+
     # Instruction injection (intent 312): the compact-instructions block into
     # ~/.claude/CLAUDE.md. A partial-ownership user file, so it is NOT manifest-tracked
     # (stripped surgically on uninstall), the same treatment ~/.codex/AGENTS.md gets.
@@ -1485,6 +1541,44 @@ class InstallerCore
     removed
   end
 
+  # --- The engine deny rule (intent 340b, G7c, n3) ---
+  #
+  # A second ownership mechanism from merge_claude_hooks above (D4, node n3): a
+  # permissions.deny entry is a bare string with no marker in it, so EnginePermissions
+  # owns its four entries by exact-string membership, not by a plastic- launcher
+  # basename. This pair only does the read-modify-write; EnginePermissions.merge_into
+  # and .remove_from are the pure transforms.
+
+  # Merges EnginePermissions::ENTRIES into settings.json. Unlike merge_claude_hooks,
+  # this refuses rather than starting from {} when the existing file cannot be
+  # parsed (row 3.11): a hand-edited settings file is never silently replaced.
+  # Returns true when it wrote, false when it refused.
+  def merge_engine_permissions(settings_path)
+    if File.exist?(settings_path)
+      settings = read_json_safe(settings_path)
+      return false if settings.nil?
+    else
+      settings = {}
+    end
+
+    write_json_atomic(settings_path, EnginePermissions.merge_into(settings))
+    true
+  end
+
+  # Removes exactly EnginePermissions::ENTRIES from settings.json, leaving every
+  # other deny entry (the owner's own, and any Plastic entry the owner has since
+  # edited) in place. Returns true when it wrote, false on a missing or
+  # unparseable file, or a permissions/deny shape it does not recognize.
+  def remove_engine_permissions(settings_path)
+    return false unless File.exist?(settings_path)
+
+    settings = read_json_safe(settings_path)
+    return false unless settings.is_a?(Hash)
+
+    write_json_atomic(settings_path, EnginePermissions.remove_from(settings))
+    true
+  end
+
   # --- Codex AGENTS.md marked-section injection (22a/Beads pattern) ---
   # New primitive: markdown marked-section merge, the analog of merge_claude_hooks'
   # JSON read-modify-write for a partial-ownership text file. Three states
@@ -1674,6 +1768,7 @@ class InstallerCore
     if key == "claude"
       settings_path = File.join(config[:dir], "settings.json")
       remove_claude_hooks(settings_path) if File.exist?(settings_path)
+      remove_engine_permissions(settings_path) if File.exist?(settings_path)
       removed.concat(migrate_legacy_plugin(config[:dir]))
 
       # The compact-instructions block in the user-owned CLAUDE.md (intent 312): a
@@ -1822,11 +1917,22 @@ class InstallerCore
 
   def read_json_safe(path)
     return nil unless File.exist?(path)
+
     JSON.parse(File.read(path))
   rescue JSON::ParserError
-    # Try JSONC stripping (remove // comments and trailing commas)
-    content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
-    JSON.parse(content)
+    # The comment/trailing-comma-stripped retry below can itself raise
+    # JSON::ParserError on genuinely malformed content (a truncated file, or
+    # plain garbage). A nested begin/rescue is required here because a
+    # method-level `rescue` clause never catches an exception raised from
+    # INSIDE a sibling rescue clause's own body (only from the main body);
+    # doctor_core.rb#read_json_safe carries the same fix for the same reason
+    # (intent 331e, F5).
+    begin
+      content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
+      JSON.parse(content)
+    rescue
+      nil
+    end
   rescue
     nil
   end

package/scripts/lib/intent_screen.rb

@@ -287,7 +287,7 @@ module IntentScreen
   # Returns [clause_without_terminal_punctuation, remainder_or_nil]. `nil` for
   # the remainder means either no boundary exists at all, or the boundary
   # sits at the absolute end of `text` (a single trailing clause with nothing
-  # after it) — both cases where there is no SECOND clause to fold in.
+  # after it) — both cases where there is no SECOND clause to merge in.
   def self.clause_and_rest(text)
     m = text.match(/\A(.+?)[.;](\s+(.*)|\z)/m)
     return [text, nil] unless m

package/scripts/lib/intent_validator.rb

@@ -149,7 +149,7 @@ module IntentValidator
 
   # PURE: combine the frontmatter result with section-structure findings for a
   # content STRING. Returns the frontmatter result hash extended with
-  # :section_missing, :section_unknown, and folded section errors; :ok is the AND
+  # :section_missing, :section_unknown, and merged section errors; :ok is the AND
   # of frontmatter and sections. Lets the create gate validate proposed content
   # (no file on disk) with the same definition as the CLI and doctor.
   def validate_content(content, known_stores: nil)
@@ -158,7 +158,7 @@ module IntentValidator
     merge_sections(fm_result, sections)
   end
 
-  # Fold section findings into a frontmatter result hash (shared by validate and
+  # Merge section findings into a frontmatter result hash (shared by validate and
   # validate_content). Does not mutate the input.
   def merge_sections(fm_result, sections)
     errors = fm_result[:errors].dup

package/scripts/lib/meter_watch.rb

@@ -142,30 +142,36 @@ class MeterWatch
     # with launchctl (scripts/meter-watch --install-timer calls this and
     # nothing else). RunAtLoad primes the first tick; StartInterval repeats
     # it every 20 minutes.
-    def install_timer(home:, script_path:, ruby: RbConfig.ruby, interval: TICK_SECONDS)
+    #
+    # `label:` and `arguments:` (intent 340a, G7b, n3, graph.md D9) let the
+    # delivery watch's own `runner watch --install-timer` reuse this one
+    # writer for its `com.plastic.delivery-watch.<id>` job instead of
+    # rendering plist XML a second time; their defaults reproduce today's
+    # meter-watch plist byte for byte (row 3.1).
+    def install_timer(home:, script_path:, ruby: RbConfig.ruby, interval: TICK_SECONDS,
+                       label: "com.plastic.meter-watch", arguments: nil)
       agents_dir = File.join(home, "Library", "LaunchAgents")
       FileUtils.mkdir_p(agents_dir)
-      plist_path = File.join(agents_dir, "com.plastic.meter-watch.plist")
-      File.write(plist_path, plist(script_path, home, ruby, interval))
+      plist_path = File.join(agents_dir, "#{label}.plist")
+      args = arguments || [ruby, script_path, "--home", home]
+      File.write(plist_path, plist(label, args, interval))
       plist_path
     end
 
     private
 
-    def plist(script_path, home, ruby, interval)
+    def plist(label, arguments, interval)
+      args_xml = arguments.map { |a| "    <string>#{a}</string>" }.join("\n")
       <<~XML
         <?xml version="1.0" encoding="UTF-8"?>
         <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
         <plist version="1.0">
         <dict>
           <key>Label</key>
-          <string>com.plastic.meter-watch</string>
+          <string>#{label}</string>
           <key>ProgramArguments</key>
           <array>
-            <string>#{ruby}</string>
-            <string>#{script_path}</string>
-            <string>--home</string>
-            <string>#{home}</string>
+        #{args_xml}
           </array>
           <key>StartInterval</key>
           <integer>#{interval}</integer>

package/scripts/lib/node_file.rb

@@ -102,14 +102,14 @@ module NodeFile
   # <id>.md or <id>--<slug>.md, exactly - a longer id's file (n11--x.md) must
   # never satisfy a shorter id (n1), so the id is matched as the whole prefix
   # up to end-of-string or the literal "--" separator, never as a substring
-  # (fold A9).
+  # (review A9).
   def filename_matches_id?(basename, id)
     basename.match?(/\A#{Regexp.escape(id)}(--[A-Za-z0-9][A-Za-z0-9-]*)?\z/)
   end
 
   # budget: normalizes to a plain integer token ceiling. A bare integer and
   # {tokens: N} both normalize to N; {turns: N} is the field 327 D47 removed
-  # and is a named error, never silently accepted (fold: report's example).
+  # and is a named error, never silently accepted (from report's example).
   def normalize_budget(raw)
     return [nil, []] if raw.nil?
     return [raw, []] if raw.is_a?(Integer)
@@ -128,7 +128,7 @@ module NodeFile
 
   # Every [heading_line, body] pair in the body text, split on any heading
   # line, fence-aware: a "#" line inside a fenced block never starts a new
-  # section (fold: "a node passes on a section it does not have").
+  # section (see: "a node passes on a section it does not have").
   def split_by_headings(text)
     sections = []
     heading = nil

package/scripts/lib/node_ledger.rb

@@ -61,7 +61,14 @@ module NodeLedger
   # 2.6): every key named in REQUIRED_FIELDS or DONE_EVIDENCE_FIELDS, plus
   # `model` (accepted on any state). A field outside this list still renders,
   # sorted after these, so an unrecognized key is never silently dropped.
-  FIELD_ORDER = %w[holder expires packet model gates commit verdict reason question by expired].freeze
+  #
+  # `harness` (intent 340b, G7c, n1, D21) sits right after `model`: both are
+  # dispatch-time metadata `running` writes and every terminal transition
+  # carries forward, accepted on every state and required by none - the same
+  # treatment `suite=`, `hop=` and `core_drift=` already get as extras, given
+  # a stable declared position instead of falling to the alphabetical extras
+  # tail (matrix row 1.17).
+  FIELD_ORDER = %w[holder expires packet model harness gates commit verdict reason question by expired].freeze
 
   SEPARATOR = "  "