@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/PLASTIC.md

@@ -83,14 +83,15 @@ runs the flow. A roadmap is an ordered, delivery-side collection; `plastic-roadm
   config.yml, projects.yml     # Preferences; slug -> path
   store/ID--slug/              # Strategic intents
   store/.sessions/<YYYYMMDD>/  # Day ledger: <YYYYMMDD>.md, checklist.md, savepoint.md
-  store/.tmp/<session>/        # current (the pointer), heartbeat; git-ignored
+  store/.tmp/<session>/        # heartbeat; git-ignored
 ~/.plastic/projects/{slug}/    # Project store: INDEX.md, AGENTS.md, roadmaps/, store/
 ```
 
-`<session>` is the first eight characters of the session id. The pointer holds a day id (the
-day ledger takes the record) or an intent id (an auto team owns the record); session start
-writes today's day id. The SessionStart hook picks the project store by matching the working
-directory against `projects.yml`; no Plastic files land in project code.
+`<session>` is the first eight characters of the session id. Session start writes the heartbeat
+file, proof only that the session started. The delivery lock (`delivery.lock` in the intent
+directory) names the session delivering an intent, as its owner or a delegate; with no lock a
+session records into its day ledger. SessionStart matches the working directory against
+`projects.yml` to pick the project store.
 
 Naming: intents are `ID--three-to-five-words`, the file matching the directory
 (`1a1--slug/1a1--slug.md`); next id: `ruby ~/.plastic/scripts/folgezettel-id <parent_id>

package/agents/plastic-enforcer.md

@@ -26,9 +26,12 @@ deliberately; the auto pipeline never dispatches them.
    2.0, intent 304): record the rulings, write `spec.md`, then `plan.md`, at least one real
    `actions/ACTION_N.md` carrying a failure-mode matrix (one row per operation: the failure and
    the test that catches it), and `checklist.md`. One consolidated `ACTION_1.md` by default,
-   never an empty `actions/`.
+   never an empty `actions/`. Every name given to a node, file, or field comes from the concept
+   family it lives under, graph engineering, the Plastic concepts coined on top of it, and the
+   software and AI engineering concepts those rest on; a gap is a design finding to raise, not
+   a word to coin.
 3. **Have the plan reviewed before code** - dispatch one adversarial plan reviewer on
-   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; fold every finding into the spec, the
+   `plastic-intent-executing`'s `plan-reviewer-prompt.md`; merge every finding into the spec, the
    matrix, and the tests.
 4. **Dispatch one executor, tests first** - the executor commits the matrix's tests red, then
    builds, then drives the full suite green; you verify tick-versus-diff at the
@@ -50,7 +53,7 @@ dispatch call's model parameter, alongside the spawn-preamble live-state injecti
 
 1. Take the intent; record the rulings in `## Context` + `### Decisions`; write `spec.md`.
 2. Write `plan.md`, the action files with their matrix, and `checklist.md`; dispatch the plan
-   reviewer; fold the review.
+   reviewer; merge the review findings.
 3. Dispatch the executor through `plastic-intent-executing` with the whole consolidated action
    pasted in; require the red commit before the code and a green suite after it. Sequential,
    one team per intent, on one branch when files are shared.

package/agents/plastic-executor.md

@@ -65,3 +65,7 @@ verification, checklist deltas, deviations, blockers, insights) plus the executo
 - Safe-by-default: rename instead of drop, additive migrations, backups before destructive steps
 - One action at a time; do not batch unrelated changes into one step
 - Do not claim done until the full suite is green; show the final summary
+- Every test, file, and symbol you name comes from the same concept family: graph engineering,
+  the Plastic concepts coined on top of it, and the software and AI engineering concepts those
+  rest on; a name from outside that stack is refused, and a gap is a design finding to raise,
+  not a word to coin

package/agents/plastic-node-research.md

@@ -0,0 +1,28 @@
+---
+name: plastic-node-research
+description: |
+  Dispatched for a research node by Plastic's node-graph runner. Given the
+  node input path the dispatch line names, research the question it names by
+  reading the repository, and reply with the YAML return the dispatch line
+  names. Read-only: no Bash, no edit. Never spawned outside a runner
+  dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one node input in, one YAML return out, no diff.
+
+Read the node input the dispatch line names; it is your whole input. Research the question it names
+by reading the repository, never by running it. This role carries no `Bash`, because Claude
+Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and a shell
+is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every file the
+node input points at.
+
+A research node produces no diff. Put what you found in your return's `findings`, never in a code
+change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-verify.md

@@ -0,0 +1,27 @@
+---
+name: plastic-node-verify
+description: |
+  Dispatched for a verify node by Plastic's node-graph runner. Given the
+  node input path the dispatch line names, check the work it names by reading
+  the repository, and reply with the YAML return the dispatch line names.
+  Read-only: no Bash, no edit. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Glob
+  - Grep
+model: opus
+---
+
+You are one node in Plastic's node-graph runner: one node input in, one YAML return out, no diff.
+
+Read the node input the dispatch line names; it is your whole input. Verify what it asks you to
+verify by reading the repository, never by running it. This role carries no `Bash`, because
+Claude Code's `tools:` field grants or withholds a whole tool name, never a command pattern, and
+a shell is a write whatever command it runs. `Read`, `Glob`, and `Grep` are enough to read every
+file the node input points at.
+
+A verify node produces no diff. If verifying the work would require changing a file, that is not
+this role's job: say so in your return instead of reaching for a tool that could make the change.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/agents/plastic-node-work.md

@@ -0,0 +1,32 @@
+---
+name: plastic-node-work
+description: |
+  Dispatched for a work node by Plastic's node-graph runner. Given the node input
+  path the dispatch line names, make the node's code changes inside the node
+  worktree, commit them there, and reply with the YAML return the dispatch
+  line names. Never spawned outside a runner dispatch.
+tools:
+  - Read
+  - Write
+  - Edit
+  - Bash
+  - Glob
+  - Grep
+model: sonnet
+---
+
+You are one node in Plastic's node-graph runner: one node input in, your files and your commit and
+one YAML return out.
+
+Read the node input the dispatch line names; it is your whole input. Make the changes it asks for,
+inside the worktree it names, and commit them there. Touch no file outside the node input's `files:`
+list, write to no other node's worktree, and write no ledger line yourself: the runner's own
+gates read your commit and your return, never your word.
+
+This `tools:` allowlist is a guardrail on tool names, not a sandbox on what `Bash` can do once
+granted. A shell can read, write, and reach the network the same as any of the other tools here,
+so `ruby -e File.write(...)` or a stray `curl` walks straight through it. The diff-scope check at
+`done` is the real backstop for what your commit is allowed to touch, not this list.
+
+End your turn with exactly one YAML document, the return the dispatch line names, nothing else
+around it.

package/bin/lib/context_budget.rb

@@ -87,7 +87,7 @@ module ContextBudget
 
   # What the harness loads at boot: every skill's name and description VALUES,
   # YAML-parsed. Not the raw frontmatter (that would count the keys and the
-  # operational fields), and not a line regex (that would truncate a folded
+  # operational fields), and not a line regex (that would truncate a flattened
   # description at its first line).
   def self.skill_catalog_bytes(repo:)
     skill_paths(repo: repo).sum do |path|

package/hooks/hooks.json

@@ -88,6 +88,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook\" stop",
+            "statusMessage": ""
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/statusline

@@ -187,6 +187,7 @@ FIELDS=$(printf '%s' "$INPUT" | awk '
     wanted["context_window.current_usage.cache_read_input_tokens"] = 1
     wanted["cost.total_cost_usd"] = 1
     wanted["rate_limits.five_hour.used_percentage"] = 1
+    wanted["rate_limits.five_hour.resets_at"] = 1
     wanted["rate_limits.seven_day.used_percentage"] = 1
   }
   { buf = buf $0 " " }
@@ -209,6 +210,7 @@ CU_CC=""
 CU_CR=""
 COST_RAW=""
 M5_PCT=""
+M5_RESETS=""
 M7_PCT=""
 
 while IFS=$'\t' read -r k v; do
@@ -224,6 +226,7 @@ while IFS=$'\t' read -r k v; do
     context_window.current_usage.cache_read_input_tokens) CU_CR="$v" ;;
     cost.total_cost_usd) COST_RAW="$v" ;;
     rate_limits.five_hour.used_percentage) M5_PCT="$v" ;;
+    rate_limits.five_hour.resets_at) M5_RESETS="$v" ;;
     rate_limits.seven_day.used_percentage) M7_PCT="$v" ;;
   esac
 done <<FIELDS_EOF
@@ -301,6 +304,31 @@ meter_seg() {   # $1 = label, $2 = raw percentage
 M5=$(meter_seg "5h" "$M5_PCT")
 M7=$(meter_seg "7d" "$M7_PCT")
 
+# --- Rate-limits cache for MeterWatch (graph.md D11) ---
+# Written only when the payload carries a meter at all; an API-key session
+# with no rate_limits section leaves the cache untouched. A present meter
+# with no matching value writes null rather than dropping the key, so
+# MeterWatch always sees the same three fields. Temp file in the cache
+# directory, then mv, so MeterWatch never reads a half-written file.
+if [ -n "$M5_PCT" ] || [ -n "$M7_PCT" ]; then
+  CACHE_DIR="$HOME/.plastic/.cache"
+  mkdir -p "$CACHE_DIR"
+  CACHE5=$(to_int "$M5_PCT")
+  CACHE7=$(to_int "$M7_PCT")
+  [ -z "$CACHE5" ] && CACHE5=null
+  [ -z "$CACHE7" ] && CACHE7=null
+  if [ -n "$M5_RESETS" ]; then
+    RESETS_JSON="\"$M5_RESETS\""
+  else
+    RESETS_JSON=null
+  fi
+  CACHE_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  CACHE_TMP="$CACHE_DIR/.rate-limits.json.tmp.$$"
+  printf '{"five_hour":%s,"seven_day":%s,"resets_at":%s,"at":"%s"}\n' \
+    "$CACHE5" "$CACHE7" "$RESETS_JSON" "$CACHE_AT" > "$CACHE_TMP"
+  mv "$CACHE_TMP" "$CACHE_DIR/rate-limits.json"
+fi
+
 # --- Session cost (stdin cost.total_cost_usd); hidden when it renders as $0.00 ---
 COST_SEG=""
 if [ -n "$COST_RAW" ]; then

package/hooks/stop

@@ -0,0 +1,5 @@
+#!/bin/bash
+INPUT=$(cat)
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+echo "$INPUT" | env -u RUBYOPT ruby "$SCRIPT_DIR/../scripts/hook-stop" "$HOME/.plastic"
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "2.0.0-alpha.22",
+  "version": "2.0.0-alpha.24",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/dashboard.rb

@@ -100,7 +100,7 @@ end
 # instead, with no end-of-line requirement, so trailing note prose is irrelevant. The
 # separator there may be a real em dash (U+2014, INDEX.md's normal on-write convention,
 # built from the codepoint so this source line stays em-dash free) or a plain hyphen
-# (end-intent's own Bridge.index_entry_match accepts either on read). Because regex
+# (end-intent's own IndexEntry.match accepts either on read). Because regex
 # alternation is leftmost-first, this only ever matches the date immediately after the
 # link. It never continues scanning into the note prose, so a second date mentioned
 # later in a note's free text cannot be mistaken for the completion date. The id class

package/scripts/doctor.rb

@@ -29,6 +29,7 @@ require_relative "lib/lock"
 require_relative "lib/savepoint"
 require_relative "lib/node_ledger"
 require_relative "lib/ready_set"
+require_relative "lib/graph_measure_models"
 require_relative "lib/index_projection"
 require_relative "lib/agent_models"
 require_relative "lib/outcome_guard"
@@ -138,7 +139,7 @@ class Doctor
         --intent ID     Per-intent structure gate at intent-end (intent 222): one
                         closing intent only, never a store sweep. Pair with
                         --store <key> to disambiguate an id that collides across
-                        stores, and --disposition delivered|abandoned to fold in
+                        stores, and --disposition delivered|abandoned to include
                         the outcome.md disposition check. 3-state pass/warn/fail.
         -h, --help      Show this help
 
@@ -631,6 +632,15 @@ class Doctor
     # ReadySet's own require chain is 65,648 bytes, far past that budget.
     checks.concat(node_graph_checks(intent_dirs))
 
+    # model_requalification (D42, intent 343 G10 n7): a recorded model= that no
+    # longer matches what RunnerPolicy.model_for resolves for its role today
+    # means every measurement taken under the old model measured a different
+    # system. Lives here for the same reason node_graph_checks does: pins to
+    # test/doctor_core_split_test.rb's exact-set boot-path assertion, never
+    # doctor_core.rb (D11) - GraphMeasureModels' own require chain (NodeLedger,
+    # NodeFile, RunnerPolicy, AgentModels) is far past that file's byte budget.
+    checks.concat(model_requalification_checks(scopes: scopes))
+
     # unpromoted_rules (intent 341, G8, C37): an Insights entry tagged
     # `rule:` (via `insight-append --rule`) is a promise the rule will make
     # it into project doctrine. Advisory only.
@@ -982,14 +992,14 @@ def check_done_signals(scopes: nil)
   # rebuild-savepoint for most gaps, or knowingly excluded for the ones 219 D6 forbids ever
   # repairing (no real outcome.md to echo a disposition from). Three branches (spec D4/D5):
   # a malformed exclusion file can never report pass (loud), a clean remaining gap set reports
-  # pass with the exclusion count folded in, and a real remaining gap set stays warn, same as
-  # before intent 274, with the same count folded in when exclusions applied.
+  # pass with the exclusion count included, and a real remaining gap set stays warn, same as
+  # before intent 274, with the same count included when exclusions applied.
   #
-  # `dead_suffix` (intent 280) folds in a second, independent drift notice: exclusion rows that
+  # `dead_suffix` (intent 280) adds a second, independent drift notice: exclusion rows that
   # suppressed nothing this run. It is purely informational, exactly like `exclusion_suffix` - it
   # never changes status on any of the three branches below, because a stale governance-record row
   # is bookkeeping drift, not a store regression (219 D6 is untouched: no disposition is invented).
-  # Per rule (intent 308): savepoint_operational and backfilled_complete each fold in only
+  # Per rule (intent 308): savepoint_operational and backfilled_complete each include only
   # their own exclusions and dead rows, so one check never carries the other's counts.
   suffixes = lambda do |excluded_rows, dead|
     ex = excluded_rows.empty? ? "" : " (#{excluded_rows.size} excluded via #{exclusion_paths.join(", ")})"
@@ -1040,7 +1050,7 @@ def check_done_signals(scopes: nil)
   # backfilled_complete (intent 308): spec.md, plan.md, or a real action file missing on a
   # terminal intent. Same three branches as savepoint_operational: a malformed exclusion
   # file is always loud, a clean set passes with its own exclusion and dead-row counts
-  # folded in, a real gap set warns with the backfill verb as the fix.
+  # included, a real gap set warns with the backfill verb as the fix.
   backfill_hint = "Write the missing documents from the record via " \
                   "`scaffold-intent backfill --store <store> --id <id> --disposition " \
                   "<delivered|abandoned>` (never touches real content, one intent per invocation)."
@@ -1787,6 +1797,70 @@ end
     end
   end
 
+  # --- Check: re-qualification on model change (D42, intent 343 G10 n7) ---
+  #
+  # When the model behind a role changes, every measurement GraphMeasureModels
+  # took under the old model measured a different system, and the numbers
+  # need re-qualifying before anyone acts on them (D42). This warns, never
+  # fails (D10): a model change is routine, and a red doctor over it would
+  # train people to stop reading the report. The comparison itself is
+  # GraphMeasureModels' own (D16, via RunnerPolicy.model_for) - this method
+  # never re-derives it, it only names the drift rows GraphMeasureModels
+  # already computed.
+  #
+  # Runs once per discovered store (StoreDiscovery, shared with every other
+  # store-scoped check here), never per intent directory: GraphMeasureModels
+  # walks a whole store_dir itself in one pass. A store this process cannot
+  # read - or any other exception the store walk raises - is skipped, never
+  # fatal: one bad store must never take every other doctor check down with
+  # it.
+  #
+  # NEW-4 (v2 review, D22): this rule used to pass `project_config: {}` on
+  # purpose, reasoning there was no live project scope at doctor-run time -
+  # false: each discovered store DOES have a real sibling `config.yml`
+  # (`GraphMeasureModels.project_config_path`), the same file the `cohorts`
+  # verb resolves. Loading it here means the doctor and `cohorts` can never
+  # disagree about the same store's project-scope override again.
+  def model_requalification_checks(scopes: nil)
+    global_config = load_yaml_safe(File.join(plastic_home, "config.yml")) || {}
+    findings = []
+
+    store_discovery[:stores].each do |s|
+      next if scopes && !scopes.include?(s[:key])
+
+      project_config = load_yaml_safe(GraphMeasureModels.project_config_path(s[:store])) || {}
+      record = begin
+        GraphMeasureModels.read(s[:store], project_config: project_config, global_config: global_config)
+      rescue StandardError
+        next
+      end
+
+      %i[executor advisor].each do |role|
+        Array(record[:drift][role]).each do |row|
+          findings << "#{s[:key]}/#{row[:intent]}/#{row[:node]} (#{role}): recorded model=#{row[:recorded]}, " \
+                      "current config resolves #{row[:expected]} for kind #{row[:kind]} - re-qualify any " \
+                      "measurement taken while model=#{row[:recorded]} was in effect"
+        end
+      end
+    end
+
+    if findings.empty?
+      [check(
+        category: "conventions", name: "model_requalification", status: "pass",
+        message: "No recorded model= differs from what config resolves today for its role"
+      )]
+    else
+      [check(
+        category: "conventions", name: "model_requalification", status: "warn",
+        message: "#{findings.size} node(s) recorded a model that no longer matches the role's " \
+                 "config-resolved model",
+        details: findings, fixable: false,
+        fix_hint: "The old measurements were taken against a different model; re-qualify them under " \
+                  "the current model before acting on their numbers"
+      )]
+    end
+  end
+
   # --- Check: unpromoted rule: findings (intent 341, G8, C37) ---------------
   #
   # `insight-append --rule` tags an entry "... - rule: <text>". A tag is a

package/scripts/end-intent

@@ -37,7 +37,7 @@
 #   2. Move the intent's INDEX.md line from `## Active` into `## Completed`
 #      (delivered) or `## Abandoned` (abandoned), dated today, appending
 #      --index-note (if given). Accepts a real em dash OR a plain hyphen as
-#      the id/title separator on READ (shared matcher, Bridge.index_entry_match);
+#      the id/title separator on READ (shared matcher, IndexEntry.match);
 #      always EMITS the real em dash on write. An id that resolves to neither
 #      `## Active` nor the terminal section is a loud failure (exit 1); an id
 #      already correctly in the terminal section is a quiet, idempotent success.
@@ -46,10 +46,9 @@
 #   5. Disarm (intent 188, D2/D16; intent 307): check the code worktree (derived
 #      from projects.yml and the intent id, Arm.worktree_block) for uncommitted
 #      changes first (exit 5 if dirty, unless --discard-worktree-changes); call the
-#      disarm seam (default Arm.disarm: worktree released, lock cleared, the session
-#      pointer back on the day ledger); verify the durable lock file is actually gone
-#      afterward, and release it directly when a foreign-keyed disarm left it (the
-#      /tmp bridge this step once read was removed in 2.0, intent 307).
+#      disarm seam (default Arm.disarm: worktree released, lock cleared); verify
+#      the durable lock file is actually gone afterward, and release it directly
+#      when a foreign-keyed disarm left it.
 #
 # Exit codes:
 #   0  ok - the intent is closed and no delivery.lock remains.
@@ -57,7 +56,7 @@
 #      nor the terminal section (D11). Deliberately double duty; see plan.md.
 #   2  retired in 2.0 (intent 308): the outcome.md guard reports and proceeds.
 #   3  steps 1-4 already committed, but the delivery lock genuinely could not
-#      be cleared (not a bridge cache miss; see step 5 above).
+#      be cleared (see step 5 above).
 #   4  pre-flight refusal: a FRESH foreign lock is held by a live,
 #      non-delegate session; a FRESH lock that will not parse (corrupt); or a
 #      lock file with no resolvable session identity at all. Authors nothing.
@@ -73,8 +72,8 @@ require "fileutils"
 require "date"
 require "open3"
 require "pathname"
-require_relative "lib/bridge"
 require_relative "lib/arm"
+require_relative "lib/index_entry"
 require_relative "lib/savepoint"
 require_relative "lib/lock"
 require_relative "lib/intent_validator"
@@ -89,7 +88,7 @@ DISPOSITIONS = %w[delivered abandoned].freeze
 # dash (U+2014), the existing INDEX.md convention (store files are exempt from
 # the no-em-dash shipped-file rule). Built from the codepoint, not a literal
 # byte in this source file, so the script's own source stays em-dash free.
-# READING accepts a plain hyphen too, via the shared Bridge.index_entry_match
+# READING accepts a plain hyphen too, via the shared IndexEntry.match
 # (intent 188, D9/D12): see move_index_to_terminal below.
 EM_DASH = "\u2014"
 
@@ -99,6 +98,10 @@ class UnresolvedIndexEntry < StandardError; end
 
 # --- Explicit flag parsing (no eval, no global injection) -------------------
 
+def blank?(value)
+  value.nil? || value.to_s.strip.empty?
+end
+
 def parse_args(argv)
   opts = {
     store: nil, id: nil, disposition: nil, index: nil,
@@ -287,7 +290,7 @@ end
 # Abandoned closes and machine-backfilled outcomes (the backfill marker) are
 # exempt: the reader cannot expect labels the writer never had.
 #
-# Intent 334 (G1, fold A3; post-execution review, blocking 2): the legacy
+# Intent 334 (G1, review A3; post-execution review, blocking 2): the legacy
 # "S3" label grammar applies only to actions/*.md headings, and the node id
 # grammar (kind prefix n/v/d/r plus digits, D1r) applies only to nodes/*.md
 # headings - never both over both directories. This repo's own house words
@@ -310,7 +313,7 @@ end
 # 339 S9 (D18): a node id counts as a label in an actions/*.md heading too,
 # but only when it stands alone as one of the heading's " - "-delimited
 # segments - this repo's own convention, "### S1 - n1 - Title" (this action
-# file's own headings, post-fold) or the bare "### n1 - Title". Never as a
+# file's own headings, post-merge) or the bare "### n1 - Title". Never as a
 # free word inside ordinary prose: the comment above ACTION_ID_LABEL_RE
 # records exactly why intent 334 restricted the node-id grammar to
 # nodes/*.md headings in the first place, and that reasoning does not change
@@ -342,7 +345,7 @@ def hollow_report_reason(intent_dir, disposition)
   # a node id ("n1", "v2", "d3", "r4"). A terse legacy close with no labeled
   # matrix stays report-and-proceed (intent 334, G1, D10r).
   #
-  # Every matching token per heading is kept, not just the first (fold A3):
+  # Every matching token per heading is kept, not just the first (review A3):
   # a legacy actions/ heading can carry BOTH an S-label and prose that reads
   # like a node id ("### The v2 rewrite (S3)"). Restricting the word-scan
   # node-id grammar to nodes/*.md headings (post-execution review, blocking
@@ -438,10 +441,10 @@ def section_stop(lines, heading_idx)
   stop
 end
 
-# Shared matcher (Bridge.index_entry_match, intent 188 D12): accepts a real em
+# Shared matcher (IndexEntry.match, intent 188 D12): accepts a real em
 # dash OR a plain hyphen as the id/title separator on READ.
 def active_line_id(line)
-  m = Bridge.index_entry_match(line)
+  m = IndexEntry.match(line)
   m && m[1]
 end
 
@@ -520,7 +523,7 @@ def move_index_to_terminal(content, id, disposition, today:, index_note: nil)
     raise UnresolvedIndexEntry, "INDEX.md has no #{target_heading} heading; cannot complete the move"
   end
 
-  m = Bridge.index_entry_match(lines[entry_idx])
+  m = IndexEntry.match(lines[entry_idx])
   title, link = m[2], m[3]
   note_suffix = (index_note && !index_note.to_s.strip.empty?) ? " #{index_note.to_s.strip}" : ""
   new_entry = "- [#{id} #{EM_DASH} #{title}](#{link}) #{EM_DASH} #{today}#{note_suffix}\n"
@@ -609,13 +612,13 @@ end
 # exclusion with a raw backtrace. nil is the only safe "could not resolve"
 # signal; main refuses explicitly on it rather than ever reaching takeover.
 def resolve_end_session(explicit, intent_dir)
-  return explicit.to_s.strip unless Bridge.blank?(explicit)
+  return explicit.to_s.strip unless blank?(explicit)
   env = ENV["CLAUDE_CODE_SESSION_ID"]
-  return env.to_s.strip unless Bridge.blank?(env)
+  return env.to_s.strip unless blank?(env)
   lock = Lock.read(intent_dir)
   return nil unless lock
   owner = lock["owner_session"].to_s
-  Bridge.blank?(owner) ? nil : owner
+  blank?(owner) ? nil : owner
 end
 
 # Read-only pre-flight verdict (D4). Returns [:proceed, lock_or_nil],
@@ -663,7 +666,7 @@ end
 def run_disarm(intent_dir, id, session, discard_worktree_changes:,
                worktree_reader: ->(dir) { Arm.worktree_block(intent_dir: dir) },
                disarm: ->(sess, dir) { Arm.disarm(intent_dir: dir, session: sess) })
-  return :ok if Bridge.blank?(session)
+  return :ok if blank?(session)
 
   block = worktree_reader.call(intent_dir)
   worktree_code = block.is_a?(Hash) ? block["code"] : nil
@@ -788,7 +791,7 @@ def main(argv)
   # Lock.takeover (blank session reaches Lock.acquire's blank? guard AFTER the
   # existing lock file was already deleted) or silently mis-arbitrate. Refuse
   # rather than guess; nothing has been written yet.
-  if Bridge.blank?(session) && File.exist?(Lock.path(intent_dir))
+  if blank?(session) && File.exist?(Lock.path(intent_dir))
     warn "end-intent: a delivery lock exists at #{Lock.path(intent_dir)} but no session " \
          "identity could be resolved (--session, CLAUDE_CODE_SESSION_ID, and the lock's " \
          "own recorded owner are all blank); refusing rather than guessing. Pass " \

package/scripts/exec-worktree

@@ -21,15 +21,15 @@
 #      (--session, else CLAUDE_CODE_SESSION_ID, else the existing delivery.lock's own
 #      recorded owner_session when non-blank, else nil; the lock-owner fallback IS
 #      used here, matching end-intent's teardown resolution order).
-#      Derive the worktree block from projects.yml and the intent id (Arm.worktree_block;
-#      the /tmp bridge this once read was removed in 2.0, intent 307). No code worktree on
+#      Derive the worktree block from projects.yml and the intent id (Arm.worktree_block).
+#      No code worktree on
 #      disk means nothing was provisioned (exit 0).
 #   1. The dirty-worktree guard (delivered only): git status --porcelain on the code
 #      worktree. Not clean, or the check itself fails, fails CLOSED (exit 3), mirroring
 #      end-intent's dirty-worktree handling. abandoned skips this guard entirely: the
 #      branch survives and can be reclaimed, so a dirty worktree is not a reason to
 #      refuse.
-#   2. Finish: Worktree.finish(bridge_data, home:, runner:, merge: disposition ==
+#   2. Finish: Worktree.finish(delivery, home:, runner:, merge: disposition ==
 #      "delivered"). Worktree.finish is fail-open and never raises, so failure is
 #      detected by checking, for a delivered disposition only, whether the worktree
 #      directory still exists on disk afterward (release removes it on success).
@@ -38,8 +38,8 @@
 # one concern per script (spec D8).
 #
 # Exit codes:
-#   0  finished (merged or removed per disposition), or nothing to finish (no bridge
-#      resolved, or no code worktree recorded on the bridge)
+#   0  finished (merged or removed per disposition), or nothing to finish (no delivery
+#      resolved, or no code worktree recorded on it)
 #   1  usage or path-resolution failure
 #   2  retired in 2.0 (intent 302): was the order precondition; never emitted, never reused
 #   3  the worktree is not clean, or the merge/removal did not complete (delivered only)