@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/scripts/lib/harness_adapter.rb

@@ -0,0 +1,184 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# HarnessAdapter (intent 340b, G7c, n1): the one module in Plastic that knows
+# a harness by name. It resolves the current key from config `agent.type`,
+# renders a dispatch plan into that harness's instructions, and answers what
+# the ledger should record. `runner step` calls it; nothing else in the
+# runner does (spec D1).
+#
+# Pure: every input is an argument, nothing here reads ENV or a real
+# config.yml itself - the caller (scripts/runner) owns loading real config,
+# this module only resolves values out of what it is handed, the same
+# discipline RunnerPolicy already holds for model resolution.
+module HarnessAdapter
+  module_function
+
+  # The only two harnesses this module knows (spec D2). An unknown key -
+  # config-authored or from `--harness` - always falls back to this rather
+  # than to no adapter at all (matrix row 1.3): a plan with no rendering
+  # under it is worse than a plan rendered for the wrong harness, because the
+  # first is silent.
+  DEFAULT_KEY = "claude-code"
+  KNOWN_KEYS = %w[claude-code codex].freeze
+
+  # The exact sentence 340a's watch prints to stderr and exits 1 with,
+  # before any write, when `--dispatch` is asked of a harness
+  # #unattended_start? refuses (graph.md D7). Quoted verbatim in
+  # docs/reference/harness-adapters.md (D12); change the wording in one
+  # place only.
+  UNATTENDED_START_SENTENCE =
+    "Unattended start is delivered only where a Ruby loop owns dispatch (Codex, through runner " \
+    "watch --dispatch); on Claude Code the runner is the harness session (327 Q6), so arm /loop " \
+    "over runner watch in a live session instead."
+
+  # unattended_start?(key) -> true only for "codex" (graph.md D7): the one
+  # harness where a Ruby loop (RunnerUntilEmpty, through `runner watch
+  # --dispatch`) owns dispatch end to end with nobody on the other end
+  # making subagent calls. Claude Code IS the harness session (327 Q6), and
+  # an unknown key is never granted unattended start either - this module
+  # stays the only place that names a harness, so RunnerWatch asks this
+  # predicate and never compares a key against "codex" itself.
+  def unattended_start?(key)
+    key.to_s == "codex"
+  end
+
+  # kind -> the Claude Code agent type dispatched for it (spec Approach).
+  # Verify and research carry no `Bash` in their own frontmatter (n2); this
+  # table only names WHICH agent a kind maps to. An unknown kind gets
+  # `work`'s row, the widest of the three, never no agent type at all
+  # (matrix row 1.10), mirroring RunnerPolicy's own kind-table fallback.
+  AGENT_TYPE_BY_KIND = {
+    "work" => "plastic-node-work",
+    "verify" => "plastic-node-verify",
+    "research" => "plastic-node-research",
+  }.freeze
+
+  def agent_type_for_kind(kind)
+    AGENT_TYPE_BY_KIND.fetch(kind.to_s, AGENT_TYPE_BY_KIND["work"])
+  end
+
+  # resolve_key(config:, override:) -> the harness key for one call (matrix
+  # rows 1.1-1.3, 1.18). `override` (the CLI's `--harness KEY`, spec D2) wins
+  # over `config`'s own `agent.type` for that one call; either source is
+  # squashed (whitespace collapsed, matrix row 1.18) before it is even
+  # compared, so a config-authored value carrying a tab or a newline can
+  # never reach `NodeLedger` unsquashed and raise `ArgumentError` mid-dispatch,
+  # after the node input is already built. A value that still is not one of
+  # KNOWN_KEYS after squashing falls back to DEFAULT_KEY with a warning
+  # (never to no adapter), so this method's return is always one of the two
+  # known, clean strings - safe to hand straight to a ledger field.
+  def resolve_key(config: {}, override: nil)
+    raw = blank?(override) ? agent_type_from_config(config) : override.to_s
+    squashed = squash(raw)
+    return squashed if KNOWN_KEYS.include?(squashed)
+
+    warn "harness_adapter: unknown harness #{raw.inspect}, falling back to #{DEFAULT_KEY.inspect}"
+    DEFAULT_KEY
+  end
+
+  def agent_type_from_config(config)
+    return DEFAULT_KEY unless config.is_a?(Hash)
+
+    value = config.dig("agent", "type")
+    value = config.dig(:agent, :type) if blank?(value)
+    blank?(value) ? DEFAULT_KEY : value.to_s
+  end
+  private_class_method :agent_type_from_config
+
+  def squash(text)
+    text.to_s.strip.gsub(/\s+/, " ")
+  end
+  private_class_method :squash
+
+  def blank?(value)
+    value.nil? || value.to_s.strip.empty?
+  end
+  private_class_method :blank?
+
+  # render(dispatched, harness:, return_contract:) -> the rendered
+  # instruction block for `harness` (a String), or nil for an empty dispatch
+  # list (matrix row 1.14: a step that dispatched nothing prints no
+  # instruction block for a session to act on). `dispatched` is the runner's
+  # own plan entries (RunnerDispatch's `:dispatched` shape): [{node:, kind:,
+  # role:, model:, worktree:, input:}, ...]. The model and the node input path
+  # ride straight from each entry - never a fresh lookup (matrix row 1.11)
+  # and never a summary (matrix row 1.12) - and `return_contract` (the exact
+  # text RunnerDispatch::RETURN_CONTRACT already carries in the YAML plan)
+  # renders exactly once, above every node, never per node (matrix row 1.13).
+  def render(dispatched, return_contract:, harness: DEFAULT_KEY)
+    entries = Array(dispatched)
+    return nil if entries.empty?
+
+    key = KNOWN_KEYS.include?(harness.to_s) ? harness.to_s : DEFAULT_KEY
+    key == "codex" ? render_codex(entries, return_contract) : render_claude_code(entries, return_contract)
+  end
+
+  # The Claude Code rendering (spec Approach): per dispatched node, the agent
+  # type from the kind, the model the plan already resolved, and the node input
+  # path as the whole prompt.
+  def render_claude_code(entries, return_contract)
+    blocks = entries.map do |d|
+      "Dispatch #{agent_type_for_kind(d[:kind])} for #{d[:node]} (model: #{d[:model]}):\n  prompt: #{d[:input]}"
+    end
+    "#{return_contract.to_s.strip}\n\n#{blocks.join("\n\n")}\n"
+  end
+  private_class_method :render_claude_code
+
+  # The Codex rendering: a Codex node runs end to end through `scripts/
+  # node-run` (n6), which reads the ledger's own `running` line directly and
+  # never through this printed block - so this names, per node, the same
+  # facts the block gives Claude Code (kind, model, node input path) framed as
+  # `node-run` calls, proving the seam renders SOMETHING for the second
+  # harness rather than nothing (matrix row 1.27), without inventing detail
+  # that belongs to n6's own adapter.
+  def render_codex(entries, return_contract)
+    blocks = entries.map do |d|
+      "node-run #{d[:node]} (#{d[:kind]}, model: #{d[:model]}):\n  input: #{d[:input]}"
+    end
+    "#{return_contract.to_s.strip}\n\n#{blocks.join("\n\n")}\n"
+  end
+  private_class_method :render_codex
+
+  # cross_harness_resume(entries) -> [{node:, harnesses: [...], commits: {...}}, ...]
+  # (spec D12, 340b n8). `entries` is a node ledger's own parsed lines (the
+  # shape `NodeLedger.entries`/`entries_from_content` return): every declared
+  # node's own `harness=` values, read across every non-torn line for that
+  # subject in file order, deduplicated by first appearance (matrix row 8.6:
+  # the starting harness is whichever key showed up first). A `reclaimed`
+  # line carries no `harness=` of its own and is never a boundary here (row
+  # 8.7) - it is simply a line with nothing to contribute, scanned like any
+  # other. A node whose lines carry one key, or none at all, reports nothing
+  # (rows 8.2, 8.3): an old ledger with no `harness=` field anywhere must
+  # stay silent rather than raise.
+  #
+  # Every node named by ANY entry is scanned (row 8.8), not only the first;
+  # `RunnerAbsorb` is what put `harness=` on both the running line and the
+  # terminal line, so the commit that lands with the finishing harness's own
+  # terminal line is exactly the evidence a resumed node actually left
+  # behind (row 8.5).
+  def cross_harness_resume(entries)
+    live = Array(entries).reject { |e| e[:torn] }
+    nodes = live.map { |e| e[:subject] }.uniq
+
+    nodes.filter_map do |node|
+      node_lines = live.select { |e| e[:subject] == node }
+      keys = []
+      commits = Hash.new { |h, k| h[k] = [] }
+
+      node_lines.each do |e|
+        fields = e[:fields] || {}
+        key = fields["harness"]
+        next if blank?(key)
+
+        keys << key unless keys.include?(key)
+        commit = fields["commit"]
+        commits[key] << commit unless blank?(commit) || commits[key].include?(commit)
+      end
+
+      next if keys.size < 2
+
+      { node: node, harnesses: keys, commits: keys.to_h { |k| [k, commits[k]] } }
+    end
+  end
+end

package/scripts/lib/hook_registry.rb

@@ -79,6 +79,18 @@ module HookRegistry
           { "name" => "message-display", "status" => "" },
         ] },
       ],
+      # Continuation on Claude Code (intent 340b, G7c, n4, D5/D7): registered
+      # statically here, like every other hook, and decided at runtime by
+      # StopGate, which reads runner.stop_hook itself (default false, D9).
+      # Not one of CODEX_LIVE_STATE_EVENTS, CODEX_POST_HOOKS or
+      # CODEX_SESSION_END_HOOKS, so codex_hooks_json never picks it up and
+      # codex_hook_names stays at its pinned six (test/hook_registry_test.rb,
+      # test/codex_hooks_test.rb).
+      "Stop" => [
+        { "matcher" => "", "hooks" => [
+          { "name" => "stop", "status" => "" },
+        ] },
+      ],
     }
   end
 
@@ -161,7 +173,7 @@ module HookRegistry
   # name here in the SAME change. Skip it and every existing install keeps a dead
   # registration no update will ever clean up.
   #
-  # Never fold these into claude_launcher_names: that method is what doctor's
+  # Never merge these into claude_launcher_names: that method is what doctor's
   # hooks_exist demands be present on disk, so a retired name there makes a correct
   # install report missing launchers.
   RETIRED_HOOK_NAMES = %w[

package/scripts/lib/hook_replay.rb

@@ -83,22 +83,40 @@ module HookReplay
   # index/exitstatus/stdout/stderr/final), ordered by index regardless of
   # the order the threads actually finish in.
   def replay_concurrent(hook_path:, tmp_root:, text:, chunk: 40, session_id: "s-replay",
-                         message_id: "replay", env: {}, gap_ms: 5, jitter: true)
+                         message_id: "replay", env: {}, gap_ms: 5, jitter: true, lead_until_engaged: false)
     chunks = text.scan(/.{1,#{chunk}}/m)
     chunks = [""] if chunks.empty?
     full_env = { "PLASTIC_TMP" => tmp_root }.merge(env)
     gap = gap_ms / 1000.0
 
-    results = Array.new(chunks.length)
-    threads = chunks.each_with_index.map do |delta, i|
-      payload = {
+    payloads = chunks.each_with_index.map do |delta, i|
+      {
         "session_id" => session_id, "message_id" => message_id, "index" => i,
         "final" => i == chunks.length - 1, "delta" => delta, "cwd" => tmp_root,
         "hook_event_name" => "MessageDisplay",
       }
+    end
+    results = Array.new(chunks.length)
+
+    # `lead_until_engaged` runs chunks one at a time until one engages, so
+    # the decision marker is on disk before the rest fire concurrently. A
+    # caller proving "no late passthrough once the decision is in place"
+    # then tests exactly that, instead of whether chunk 0's own process
+    # booted inside a later chunk's poll budget on a loaded machine.
+    lead = 0
+    if lead_until_engaged
+      payloads.each_with_index do |payload, i|
+        out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, nil)
+        results[i] = { index: i, exitstatus: exitstatus, stdout: out, stderr: err, final: payload["final"] }
+        lead = i + 1
+        break unless out.to_s.empty?
+      end
+    end
+
+    threads = payloads.each_with_index.drop(lead).map do |payload, i|
       Thread.new do
         begin
-          delay = i * gap
+          delay = (i - lead) * gap
           delay += (rand * gap / 2.0) if jitter
           sleep(delay)
           out, err, exitstatus = run_one(hook_path, payload, full_env, tmp_root, nil)

package/scripts/lib/index_entry.rb

@@ -0,0 +1,53 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# IndexEntry - the shared INDEX.md entry matcher and Active check (intent 188,
+# D12/D13; moved off the retired shared-helpers module by intent 344, D2).
+#
+# ONE definition site for the "- [ID <sep> Title](link)" shape both `active?`
+# (below) and `scripts/end-intent`'s own INDEX-move parser depend on, so the
+# two regexes can never drift apart. Accepts a real em dash (U+2014) OR a
+# plain hyphen as the id/title separator on READ; every WRITE still emits the
+# real em dash (D10). The separator is built from the codepoint, not a
+# literal byte, so this file stays em-dash free.
+module IndexEntry
+  module_function
+
+  EM_DASH = "\u2014".freeze
+  ENTRY_RE = /\A- \[(\S+)\s+(?:#{Regexp.escape(EM_DASH)}|-)\s+(.*?)\]\(([^)]+)\)/.freeze
+
+  # Match `line` (already chomped) against the shared INDEX entry shape.
+  # Returns a MatchData (captures: 1 = id, 2 = title, 3 = link) or nil.
+  def match(line)
+    line.to_s.match(ENTRY_RE)
+  end
+
+  # True iff the intent is Active in its store's INDEX.md, which lives at the
+  # PARENT of the store/ dir. Non-raising: any failure (missing or unreadable
+  # INDEX, bad arg) returns false. `index_active_ids` is a pure-data test
+  # seam: when an Array of id strings is supplied, membership is checked
+  # against it directly with no file read.
+  def active?(intent_id, store:, index_active_ids: nil)
+    target = intent_id.to_s
+    return index_active_ids.include?(target) if index_active_ids.is_a?(Array)
+
+    index = File.join(File.dirname(store.to_s), "INDEX.md")
+    return false unless File.exist?(index)
+
+    in_active = false
+    File.foreach(index) do |line|
+      stripped = line.chomp
+      if stripped == "## Active"
+        in_active = true
+        next
+      end
+      next unless in_active
+      break if stripped.start_with?("## ") # next section ends the Active block
+      m = match(stripped)
+      return true if m && m[1] == target
+    end
+    false
+  rescue StandardError
+    false
+  end
+end

package/scripts/lib/index_projection.rb

@@ -11,7 +11,7 @@ require_relative "atomic_write"
 # (row 5.1/5.2): a REAL terminal line (Done delivered/abandoned, or a
 # classifiable Done detail) beats a stale INDEX section. An intent whose
 # ledger is silent (no terminal line) or absent (no savepoint.md at all)
-# keeps the status INDEX already carries (row 5.13, folded at the
+# keeps the status INDEX already carries (row 5.13, merged at the
 # 2026-09-10 plan review): 63 of 451 intents in the plastic store have no
 # savepoint.md and 59 more never reach a Done line, and a literal reading
 # would demote all of them. This module computes and compares only; it

package/scripts/lib/insights.rb

@@ -2,7 +2,7 @@
 # encoding: UTF-8
 
 # insights.rb - the blessed write path for an intent's `## Insights` section
-# (intent 82). A sibling library to bridge.rb so the insight write path stays
+# (intent 82). A standalone library so the insight write path stays
 # independent of the savepoint ledger (the spec forbids touching the ledger).
 #
 # Every entry leads with a fixed, machine-parseable prefix

package/scripts/lib/installer_core.rb

@@ -6,10 +6,12 @@ require "yaml"
 require "fileutils"
 require "digest"
 require "time"
+require "tmpdir"
 require_relative "hook_registry"
 require_relative "agent_models"
 require_relative "harness_text"
 require_relative "compact_instructions"
+require_relative "engine_permissions"
 
 # Shared installer machinery, instantiable with injected package root / store / agent
 # map so the verb scripts (install/update/uninstall/rollback) and their tests can run
@@ -253,7 +255,10 @@ class InstallerCore
 
   # --- Distribution phase ---
 
-  def distribute(mode)
+  # `tmp_dirs:` defaults to the real system tmp directory plus `/tmp` (where a
+  # retired session-state leftover would sit); a test overrides it (often to
+  # `[]`) so the removal never scans the real filesystem's tmp directories.
+  def distribute(mode, tmp_dirs: [Dir.tmpdir, "/tmp"].uniq)
     puts "  \u{1f4e6} #{mode == :update ? "Updating" : "Installing"} core files to #{plastic_home}"
 
     manifest_path = File.join(plastic_home, "manifest.json")
@@ -295,6 +300,8 @@ class InstallerCore
     write_manifest(global_files, manifest_path)
 
     pruned = prune_removed_files(old_files - global_files, root: plastic_home)
+    removed = remove_retired_session_state(plastic_home: plastic_home, tmp_dirs: tmp_dirs)
+    puts "  \u{1f9f9} #{removed} retired session state file(s) removed" if removed.positive?
 
     puts "  \u{2705} Core files synced (v#{version})#{pruned.positive? ? ", #{pruned} stale file(s) pruned" : ""}"
   end
@@ -371,10 +378,13 @@ class InstallerCore
       "scripts/lib/agent_models.rb" => "scripts/lib/agent_models.rb",
       "scripts/lib/config_asks.rb" => "scripts/lib/config_asks.rb",
       "scripts/lib/release_guard.rb" => "scripts/lib/release_guard.rb",
-      "scripts/lib/bridge.rb" => "scripts/lib/bridge.rb",
+      "scripts/lib/index_entry.rb" => "scripts/lib/index_entry.rb",
+      "scripts/lib/project_config.rb" => "scripts/lib/project_config.rb",
       "scripts/lib/savepoint.rb" => "scripts/lib/savepoint.rb",
       "scripts/lib/guarded_append.rb" => "scripts/lib/guarded_append.rb",
       "scripts/lib/node_ledger.rb" => "scripts/lib/node_ledger.rb",
+      "scripts/lib/node_input_compatibility.rb" => "scripts/lib/node_input_compatibility.rb",
+      "scripts/lib/node_progress.rb" => "scripts/lib/node_progress.rb",
       "scripts/node-transition" => "scripts/node-transition",
       "scripts/lib/arm.rb" => "scripts/lib/arm.rb",
       "scripts/lib/lock.rb" => "scripts/lib/lock.rb",
@@ -511,11 +521,11 @@ class InstallerCore
       "scripts/lib/roadmap_migration.rb" => "scripts/lib/roadmap_migration.rb",
       "scripts/roadmap-graph" => "scripts/roadmap-graph",
       "scripts/index-projection" => "scripts/index-projection",
-      # Intent 338 (G5): the node packet command - the trust-boundary wrapper,
+      # Intent 338 (G5): the node input command - the trust-boundary wrapper,
       # the five-block gatherer/assembler, and the CLI 340's runner calls.
-      "scripts/lib/packet_wrapper.rb" => "scripts/lib/packet_wrapper.rb",
-      "scripts/lib/node_packet.rb" => "scripts/lib/node_packet.rb",
-      "scripts/node-packet" => "scripts/node-packet",
+      "scripts/lib/data_boundary.rb" => "scripts/lib/data_boundary.rb",
+      "scripts/lib/node_input.rb" => "scripts/lib/node_input.rb",
+      "scripts/node-input" => "scripts/node-input",
       # Intent 342 (G9): the backward shim that presents actions/*.md as a
       # node graph for any legacy intent, so WorkGraphValidator can require
       # it without going red on contact with install_sync_test.
@@ -545,6 +555,26 @@ class InstallerCore
       # by scripts/runner's `step`.
       "scripts/lib/runner_policy.rb" => "scripts/lib/runner_policy.rb",
       "scripts/lib/runner_dispatch.rb" => "scripts/lib/runner_dispatch.rb",
+      # Intent 340b (G7c, n1): the harness seam - HarnessAdapter, required
+      # by scripts/lib/runner_dispatch.rb and by scripts/runner's `step`
+      # directly.
+      "scripts/lib/harness_adapter.rb" => "scripts/lib/harness_adapter.rb",
+      # Intent 340b (G7c, n6): the Codex leg - CodexAdapter (the `codex exec`
+      # argv, the sandbox per kind, and the bounded subprocess) and
+      # scripts/node-run, the CLI that runs one node's whole attempt over
+      # it and writes only a return file, never a ledger transition.
+      "scripts/lib/codex_adapter.rb" => "scripts/lib/codex_adapter.rb",
+      "scripts/node-run" => "scripts/node-run",
+      # Intent 340b (G7c, n3): the engine deny rule - the frozen permissions.deny
+      # entry list, merged into settings.json at install and removed surgically
+      # at uninstall.
+      "scripts/lib/engine_permissions.rb" => "scripts/lib/engine_permissions.rb",
+      # Intent 340b (G7c, n4): the Stop gate, the shared ActiveDelivery walk
+      # it and the PreCompact hand-off both call, and hook-stop, the Stop
+      # hook body scripts/hook-stop's launcher (hooks/stop) relays into.
+      "scripts/lib/stop_gate.rb" => "scripts/lib/stop_gate.rb",
+      "scripts/lib/active_delivery.rb" => "scripts/lib/active_delivery.rb",
+      "scripts/hook-stop" => "scripts/hook-stop",
       # Intent 355 (n2): the call budget PreToolUse hook (RunnerPolicy.call_cap
       # is its cap table, above); its launcher (hooks/call-budget) ships via
       # hook_files' own glob, so only the hook script itself needs an entry.
@@ -559,6 +589,35 @@ class InstallerCore
       "scripts/lib/runner_answer.rb" => "scripts/lib/runner_answer.rb",
       "scripts/lib/runner_proposals.rb" => "scripts/lib/runner_proposals.rb",
       "scripts/lib/runner_rewind.rb" => "scripts/lib/runner_rewind.rb",
+      # Intent 343 (G10, n1): the ledger reader - GraphMeasure.read turns one
+      # intent directory into one frozen measurement record. No CLI yet
+      # (scripts/graph-measure ships at n2); registered here so it is never
+      # a lib that exists on disk but never reaches an install.
+      "scripts/lib/graph_measure.rb" => "scripts/lib/graph_measure.rb",
+      # Intent 343 (G10, n2): the graph-measure command - the subcommand
+      # table over the ledger reader, and the two renderers (text, JSON)
+      # over the one record it returns.
+      "scripts/graph-measure" => "scripts/graph-measure",
+      "scripts/lib/graph_measure_report.rb" => "scripts/lib/graph_measure_report.rb",
+      # Intent 343 (G10, n4): the `budget` verb - whether the `budget:` a
+      # node's envelope declares (327 C19) is a ceiling that ever actually
+      # held, read from the ledger and the real input files.
+      "scripts/lib/graph_measure_budget.rb" => "scripts/lib/graph_measure_budget.rb",
+      # Intent 343 (G10, n5): the `cohorts` verb's model section - the store
+      # walk and whether a recorded model= still matches what config
+      # resolves today through RunnerPolicy.
+      "scripts/lib/graph_measure_models.rb" => "scripts/lib/graph_measure_models.rb",
+      # Intent 343 (G10, n6): the rest of the `cohorts` verb - approve-then-
+      # fix per verify model, hop on versus off, delivery latency, the
+      # evidence bar, and the two concurrency ceilings.
+      "scripts/lib/graph_measure_cohorts.rb" => "scripts/lib/graph_measure_cohorts.rb",
+      # Intent 340b (G7c, n7): the Codex loop - composes `step` and
+      # `node-run` itself (concurrency two, serial absorb, iteration-capped),
+      # routed from scripts/runner's internal `until-empty` verb.
+      "scripts/lib/runner_until_empty.rb" => "scripts/lib/runner_until_empty.rb",
+      # Intent 340a (G7b, n1): the delivery watch - one tick over disk truth,
+      # stalled and done-unreported classification, no CLI and no dispatch.
+      "scripts/lib/runner_watch.rb" => "scripts/lib/runner_watch.rb",
     }
   end
 
@@ -834,6 +893,111 @@ class InstallerCore
     removed
   end
 
+  # Intent 344 (G11, D10): leftovers from the retired per-session day pointer
+  # and the retired inter-hook coordination key. A `current` candidate is
+  # real only when reached with no symlink between plastic_home and the
+  # session directory: a store root's own real path must equal the plain
+  # join of plastic_home's real path with the store's lexical relative path
+  # (a symlinked store, or a symlinked projects/<slug> above it, breaks
+  # that equality), and neither the store's `.tmp` directory nor the
+  # session directory beneath it may itself be a symlink. A tmp-file
+  # candidate is judged by its containing directory's real path instead,
+  # so a symlinked tmp root such as macOS's real /tmp still works; its
+  # name is matched on raw bytes so an undecodable name never raises.
+  # Never opens or parses a candidate: a torn or malformed leftover is
+  # deleted by name alone, exactly like a well-formed one. Only a regular
+  # file that is not a symlink is ever a candidate for deletion. Returns
+  # the count removed; a delete failure warns once per path and the sync
+  # continues, since a stuck leftover must never fail an install.
+  def remove_retired_session_state(plastic_home:, tmp_dirs:)
+    candidates = []
+
+    real_store_roots(plastic_home).each do |store_root|
+      candidates.concat(current_candidates(store_root))
+    end
+
+    Array(tmp_dirs).compact.each do |dir|
+      candidates.concat(tmp_json_candidates(dir))
+    end
+
+    removed = 0
+    candidates.uniq.each do |candidate|
+      begin
+        next unless File.lstat(candidate).file?
+      rescue SystemCallError
+        next
+      end
+
+      begin
+        File.delete(candidate)
+        removed += 1
+      rescue SystemCallError => e
+        warn "  \u{26a0}\u{fe0f}  Could not remove retired session state #{candidate}: #{e.message}"
+      end
+    end
+    removed
+  rescue StandardError
+    removed || 0
+  end
+
+  # Every store root (the global store, plus each project store) whose real
+  # path is reached with no symlink between it and plastic_home.
+  def real_store_roots(plastic_home)
+    roots = [File.join(plastic_home, "store")] +
+            Dir.glob(File.join(plastic_home, "projects", "*", "store"))
+    roots.select { |root| real_store_root?(plastic_home, root) }
+  end
+
+  def real_store_root?(plastic_home, store_root)
+    return false unless File.directory?(store_root)
+
+    real_home = File.realpath(plastic_home)
+    relative = store_root.sub(/\A#{Regexp.escape(plastic_home)}\/?/, "")
+    File.realpath(store_root) == File.join(real_home, relative)
+  rescue SystemCallError
+    false
+  end
+
+  # `current` candidates under one validated store root: `.tmp` and every
+  # session directory beneath it must be real directories, never symlinks.
+  def current_candidates(store_root)
+    tmp_root = File.join(store_root, ".tmp")
+    return [] unless File.lstat(tmp_root).directory?
+
+    Dir.children(tmp_root).filter_map do |child|
+      begin
+        session_dir = File.join(tmp_root, child)
+        next unless File.lstat(session_dir).directory?
+
+        File.join(session_dir, "current")
+      rescue SystemCallError
+        nil
+      end
+    end
+  rescue SystemCallError
+    []
+  end
+
+  # Retired session-state leftover files sitting directly in `dir`, resolved through
+  # `dir`'s own real path so a symlinked tmp root (macOS's real /tmp) still
+  # works; the name match runs on raw bytes so an undecodable name is
+  # simply not a match, never a raised error.
+  def tmp_json_candidates(dir)
+    real = File.realpath(dir)
+    Dir.children(real).select { |name| retired_tmp_name?(name) }.map { |name| File.join(real, name) }
+  rescue SystemCallError
+    []
+  end
+
+  # True when `name`'s raw bytes match the retired session-state leftover shape
+  # (`plastic-<session>--<id>.json`). Runs on `name.b` so a name that is
+  # not valid UTF-8 is judged on bytes instead of raising.
+  def retired_tmp_name?(name)
+    name.b.match?(/\Aplastic-[^\/]+--[^\/]+\.json\z/n)
+  rescue StandardError
+    false
+  end
+
   # True when `path`, once expanded, is one of `roots` itself or lives underneath
   # one of them. String-prefix containment guarded by a trailing separator so a
   # sibling directory that merely shares a prefix (`/home/x-evil` vs root `/home/x`)
@@ -932,6 +1096,11 @@ class InstallerCore
     choice = statusline_choice(settings_path, argv: argv, input: input, reinstall: reinstall)
     merge_claude_hooks(settings_path, choice: choice)
 
+    # The engine deny rule (intent 340b, G7c, n3, D4): a second ownership
+    # mechanism from the hook merge above, so it is its own call rather than a
+    # branch inside merge_claude_hooks.
+    merge_engine_permissions(settings_path)
+
     # Instruction injection (intent 312): the compact-instructions block into
     # ~/.claude/CLAUDE.md. A partial-ownership user file, so it is NOT manifest-tracked
     # (stripped surgically on uninstall), the same treatment ~/.codex/AGENTS.md gets.
@@ -1485,6 +1654,44 @@ class InstallerCore
     removed
   end
 
+  # --- The engine deny rule (intent 340b, G7c, n3) ---
+  #
+  # A second ownership mechanism from merge_claude_hooks above (D4, node n3): a
+  # permissions.deny entry is a bare string with no marker in it, so EnginePermissions
+  # owns its four entries by exact-string membership, not by a plastic- launcher
+  # basename. This pair only does the read-modify-write; EnginePermissions.merge_into
+  # and .remove_from are the pure transforms.
+
+  # Merges EnginePermissions::ENTRIES into settings.json. Unlike merge_claude_hooks,
+  # this refuses rather than starting from {} when the existing file cannot be
+  # parsed (row 3.11): a hand-edited settings file is never silently replaced.
+  # Returns true when it wrote, false when it refused.
+  def merge_engine_permissions(settings_path)
+    if File.exist?(settings_path)
+      settings = read_json_safe(settings_path)
+      return false if settings.nil?
+    else
+      settings = {}
+    end
+
+    write_json_atomic(settings_path, EnginePermissions.merge_into(settings))
+    true
+  end
+
+  # Removes exactly EnginePermissions::ENTRIES from settings.json, leaving every
+  # other deny entry (the owner's own, and any Plastic entry the owner has since
+  # edited) in place. Returns true when it wrote, false on a missing or
+  # unparseable file, or a permissions/deny shape it does not recognize.
+  def remove_engine_permissions(settings_path)
+    return false unless File.exist?(settings_path)
+
+    settings = read_json_safe(settings_path)
+    return false unless settings.is_a?(Hash)
+
+    write_json_atomic(settings_path, EnginePermissions.remove_from(settings))
+    true
+  end
+
   # --- Codex AGENTS.md marked-section injection (22a/Beads pattern) ---
   # New primitive: markdown marked-section merge, the analog of merge_claude_hooks'
   # JSON read-modify-write for a partial-ownership text file. Three states
@@ -1674,6 +1881,7 @@ class InstallerCore
     if key == "claude"
       settings_path = File.join(config[:dir], "settings.json")
       remove_claude_hooks(settings_path) if File.exist?(settings_path)
+      remove_engine_permissions(settings_path) if File.exist?(settings_path)
       removed.concat(migrate_legacy_plugin(config[:dir]))
 
       # The compact-instructions block in the user-owned CLAUDE.md (intent 312): a
@@ -1822,11 +2030,22 @@ class InstallerCore
 
   def read_json_safe(path)
     return nil unless File.exist?(path)
+
     JSON.parse(File.read(path))
   rescue JSON::ParserError
-    # Try JSONC stripping (remove // comments and trailing commas)
-    content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
-    JSON.parse(content)
+    # The comment/trailing-comma-stripped retry below can itself raise
+    # JSON::ParserError on genuinely malformed content (a truncated file, or
+    # plain garbage). A nested begin/rescue is required here because a
+    # method-level `rescue` clause never catches an exception raised from
+    # INSIDE a sibling rescue clause's own body (only from the main body);
+    # doctor_core.rb#read_json_safe carries the same fix for the same reason
+    # (intent 331e, F5).
+    begin
+      content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
+      JSON.parse(content)
+    rescue
+      nil
+    end
   rescue
     nil
   end

package/scripts/lib/intent_screen.rb

@@ -287,7 +287,7 @@ module IntentScreen
   # Returns [clause_without_terminal_punctuation, remainder_or_nil]. `nil` for
   # the remainder means either no boundary exists at all, or the boundary
   # sits at the absolute end of `text` (a single trailing clause with nothing
-  # after it) — both cases where there is no SECOND clause to fold in.
+  # after it) — both cases where there is no SECOND clause to merge in.
   def self.clause_and_rest(text)
     m = text.match(/\A(.+?)[.;](\s+(.*)|\z)/m)
     return [text, nil] unless m