@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/scripts/lib/intent_validator.rb

@@ -149,7 +149,7 @@ module IntentValidator
 
   # PURE: combine the frontmatter result with section-structure findings for a
   # content STRING. Returns the frontmatter result hash extended with
-  # :section_missing, :section_unknown, and folded section errors; :ok is the AND
+  # :section_missing, :section_unknown, and merged section errors; :ok is the AND
   # of frontmatter and sections. Lets the create gate validate proposed content
   # (no file on disk) with the same definition as the CLI and doctor.
   def validate_content(content, known_stores: nil)
@@ -158,7 +158,7 @@ module IntentValidator
     merge_sections(fm_result, sections)
   end
 
-  # Fold section findings into a frontmatter result hash (shared by validate and
+  # Merge section findings into a frontmatter result hash (shared by validate and
   # validate_content). Does not mutate the input.
   def merge_sections(fm_result, sections)
     errors = fm_result[:errors].dup

package/scripts/lib/lock.rb

@@ -12,8 +12,8 @@ require "time"
 # savepoint.md (git-ignored, transient state). Ownership is session-keyed (D1):
 # the file records the owner session, never a pid. Liveness is a lease: the
 # owner's hooks touch the file mtime on tool calls (heartbeat); the lock is
-# stale only when that heartbeat is older than the TTL. The /tmp bridge is a
-# per-session CACHE of this state; on any disagreement the lock file wins (D2).
+# stale only when that heartbeat is older than the TTL. This lock file is
+# the sole truth of ownership (D2).
 #
 # Mutual-exclusion seam (D3): the schema carries a type ("delivery" now,
 # "maintenance" in a chained intent after 93) and acquire refuses while the
@@ -27,13 +27,12 @@ module Lock
   # Skill-invocation prefix per harness (intent 201, D2/D3). Claude Code invokes a
   # skill with a slash (/plastic-doctor); Codex CLI invokes explicitly with a
   # dollar ($plastic-doctor) and may also select one implicitly by matching the
-  # skill's description. This table is the actual source of truth for
-  # Bridge.skill_ref (bridge.rb requires lock.rb, never the reverse, so the
-  # table lives here rather than pulling Bridge into this dependency-free file
-  # just to render two characters). InstallerCore::DEFAULT_AGENTS carries the
-  # same values per adapter as documented config (see ACTION_2); this constant
-  # is not read from it at runtime, by the same reasoning bridge.rb/hook-*
-  # already stay clear of installer_core.rb (spec Alternatives Considered).
+  # skill's description. This table is the package-wide source of truth for
+  # `Lock.skill_ref`; every caller reaches it directly rather than duplicating
+  # the prefix table. InstallerCore::DEFAULT_AGENTS carries the same values per
+  # adapter as documented config (see ACTION_2); this constant is not read from
+  # it at runtime, by the same reasoning this file and hook-* already stay
+  # clear of installer_core.rb (spec Alternatives Considered).
   SKILL_PREFIXES = { "claude" => "/", "codex" => "$" }.freeze
 
   # Renders a skill reference for the given harness. Unset or unrecognized

package/scripts/lib/meter_watch.rb

@@ -142,30 +142,36 @@ class MeterWatch
     # with launchctl (scripts/meter-watch --install-timer calls this and
     # nothing else). RunAtLoad primes the first tick; StartInterval repeats
     # it every 20 minutes.
-    def install_timer(home:, script_path:, ruby: RbConfig.ruby, interval: TICK_SECONDS)
+    #
+    # `label:` and `arguments:` (intent 340a, G7b, n3, graph.md D9) let the
+    # delivery watch's own `runner watch --install-timer` reuse this one
+    # writer for its `com.plastic.delivery-watch.<id>` job instead of
+    # rendering plist XML a second time; their defaults reproduce today's
+    # meter-watch plist byte for byte (row 3.1).
+    def install_timer(home:, script_path:, ruby: RbConfig.ruby, interval: TICK_SECONDS,
+                       label: "com.plastic.meter-watch", arguments: nil)
       agents_dir = File.join(home, "Library", "LaunchAgents")
       FileUtils.mkdir_p(agents_dir)
-      plist_path = File.join(agents_dir, "com.plastic.meter-watch.plist")
-      File.write(plist_path, plist(script_path, home, ruby, interval))
+      plist_path = File.join(agents_dir, "#{label}.plist")
+      args = arguments || [ruby, script_path, "--home", home]
+      File.write(plist_path, plist(label, args, interval))
       plist_path
     end
 
     private
 
-    def plist(script_path, home, ruby, interval)
+    def plist(label, arguments, interval)
+      args_xml = arguments.map { |a| "    <string>#{a}</string>" }.join("\n")
       <<~XML
         <?xml version="1.0" encoding="UTF-8"?>
         <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
         <plist version="1.0">
         <dict>
           <key>Label</key>
-          <string>com.plastic.meter-watch</string>
+          <string>#{label}</string>
           <key>ProgramArguments</key>
           <array>
-            <string>#{ruby}</string>
-            <string>#{script_path}</string>
-            <string>--home</string>
-            <string>#{home}</string>
+        #{args_xml}
           </array>
           <key>StartInterval</key>
           <integer>#{interval}</integer>

package/scripts/lib/node_file.rb

@@ -102,14 +102,14 @@ module NodeFile
   # <id>.md or <id>--<slug>.md, exactly - a longer id's file (n11--x.md) must
   # never satisfy a shorter id (n1), so the id is matched as the whole prefix
   # up to end-of-string or the literal "--" separator, never as a substring
-  # (fold A9).
+  # (review A9).
   def filename_matches_id?(basename, id)
     basename.match?(/\A#{Regexp.escape(id)}(--[A-Za-z0-9][A-Za-z0-9-]*)?\z/)
   end
 
   # budget: normalizes to a plain integer token ceiling. A bare integer and
   # {tokens: N} both normalize to N; {turns: N} is the field 327 D47 removed
-  # and is a named error, never silently accepted (fold: report's example).
+  # and is a named error, never silently accepted (from report's example).
   def normalize_budget(raw)
     return [nil, []] if raw.nil?
     return [raw, []] if raw.is_a?(Integer)
@@ -128,7 +128,7 @@ module NodeFile
 
   # Every [heading_line, body] pair in the body text, split on any heading
   # line, fence-aware: a "#" line inside a fenced block never starts a new
-  # section (fold: "a node passes on a section it does not have").
+  # section (see: "a node passes on a section it does not have").
   def split_by_headings(text)
     sections = []
     heading = nil

package/scripts/lib/{node_packet.rb → node_input.rb}

@@ -10,18 +10,18 @@ require_relative "graph_file"
 require_relative "node_ledger"
 require_relative "savepoint"
 require_relative "insights"
-require_relative "packet_wrapper"
+require_relative "data_boundary"
 require_relative "atomic_write"
 require_relative "arm"
 
-# NodePacket (intent 338, G5): builds a node's whole input from disk, the
+# NodeInput (intent 338, G5): builds a node's whole input from disk, the
 # five blocks 327 section 8 fixed - the node, the ledger, the record, the
 # knowledge hop, and where to work. n2 (this half) is the readers: every one
 # of them a keyword seam with a real default, so the suite never shells out
 # to git, never reads the owner's real store, and never sets an environment
-# variable (spec D16). n3 adds assembly, the budget, and the packet's
+# variable (spec D16). n3 adds assembly, the budget, and the node input's
 # identity on top of the same file.
-module NodePacket
+module NodeInput
   module_function
 
   DEFAULT_BUDGET_TOKENS = 8000
@@ -31,11 +31,11 @@ module NodePacket
   INSIGHTS_KEEP = 3
 
   # C7's "the executor stops without it" (spec D9), rendered whenever a
-  # packet carries no lease and whenever the worktree Arm.worktree_block
+  # node input carries no lease and whenever the worktree Arm.worktree_block
   # reports is not provisioned.
   STOP_DIRECTIVE = "STOP: no lease is recorded for this node. Do not edit files or run any command until a runner dispatches this node with a holder, an expiry and a model."
 
-  # Pinned so `packet=<sha>` is a function of the repo's history alone
+  # Pinned so `input=<sha>` is a function of the repo's history alone
   # (post-execution review finding B4): unpinned, `git log --stat` varies
   # with the terminal's COLUMNS (abbreviates paths, narrows the graph
   # column), the caller's `color.ui` (ANSI escapes land in the ledger data
@@ -57,7 +57,7 @@ module NodePacket
 
   # `landed commits` is one of the three never-cut blocks (matrix 3.9), so an
   # unbounded `git log --stat` (ten verbose commit messages, say) could route
-  # the whole packet straight to exit 4 with no cut able to help.
+  # the whole node input straight to exit 4 with no cut able to help.
   def truncate_landed_commits(out)
     return out.to_s if out.to_s.bytesize <= LANDED_COMMITS_MAX_BYTES
 
@@ -158,7 +158,7 @@ module NodePacket
   # of the post-execution review): `node-transition` is a concurrent
   # appending writer, so re-reading `savepoint.md` once per predecessor let a
   # line landing mid-build make the Transitions, Lease and attempt number of
-  # one packet disagree with each other. `build` reads once and threads the
+  # one node input disagree with each other. `build` reads once and threads the
   # same entries through every block; a direct caller with no entries to
   # share still gets a real default that reads the file itself.
   def predecessor_block(intent_dir:, node:, graph_reader: GraphFile.method(:parse), entries: nil)
@@ -186,12 +186,12 @@ module NodePacket
   end
   private_class_method :last_running_entry
 
-  # Whether the packet renders no lease at all (matrix 2.11a, post-execution
+  # Whether the node input renders no lease at all (matrix 2.11a, post-execution
   # review finding A1): neither a flag-supplied lease nor a recorded
   # `running` line for this node. `lease_block` itself only ever renders
   # `lease: none` for this case (spec D3: block 2 is retrieved data, and C7's
   # stop directive is instruction, so it can never live inside that data
-  # block, on pain of being self-cancelling under the packet's own trust
+  # block, on pain of being self-cancelling under the node input's own trust
   # rule). `build` uses this to decide whether the stop directive belongs in
   # block 5 instead, deduplicated against the worktree's own copy.
   def lease_missing?(node:, holder:, expires:, model:, entries:)
@@ -304,12 +304,12 @@ module NodePacket
     chunks = Array(sources).map { |src| hop_chunk(store_dir, src) }
     text = chunks.join("\n\n").scrub
     cap = hop_tokens.to_i
-    tokens = PacketWrapper.estimate_tokens(text)
+    tokens = DataBoundary.estimate_tokens(text)
     if tokens > cap
       note = "\n[hop truncated at #{cap} tokens]"
       max_bytes = [(cap * 4) - note.bytesize, 0].max
       text = "#{safe_byteslice(text, max_bytes)}#{note}"
-      tokens = PacketWrapper.estimate_tokens(text)
+      tokens = DataBoundary.estimate_tokens(text)
     end
     { text: text, tokens: tokens }
   end
@@ -401,7 +401,7 @@ module NodePacket
     # `permitted_classes` (post-execution review finding B3): the same bug
     # class `record_sources` already fixed once in 607e31e. Any project.yml
     # that gains a date-typed value (a `created:` field, say) silently
-    # stripped the test command from every packet for that project, since
+    # stripped the test command from every node input for that project, since
     # the rescue swallowed `Psych::DisallowedClass` and returned nil.
     data = begin
       YAML.safe_load(File.read(path), permitted_classes: [Date, Time])
@@ -439,14 +439,14 @@ module NodePacket
   end
 
   # `lease_missing` (post-execution review finding A1) hoists C7's stop
-  # directive here, block 5 (instruction, spec D3), whenever the packet
+  # directive here, block 5 (instruction, spec D3), whenever the node input
   # carries no lease. `worktree_block` already renders its own copy when the
   # worktree is unprovisioned; the two conditions often fire together, so a
   # directive already present is never repeated.
   #
   # `call_cap` (intent 355, n2, D2): one sentence naming this attempt's tool
   # call cap and the return it hits at, so the executor learns the number
-  # from the packet it starts with, never from a denied call mid-edit
+  # from the node input it starts with, never from a denied call mid-edit
   # (matrix 2.4). nil (a caller that names no cap) renders nothing here.
   def where_to_work_block(intent_dir:, worktree_reader: Arm.method(:worktree_block),
                            project_reader: method(:default_project_reader), lease_missing: false, call_cap: nil,
@@ -563,7 +563,7 @@ module NodePacket
   end
 
   # ===========================================================================
-  # n3: assembly, the budget, and the packet's identity
+  # n3: assembly, the budget, and the node input's identity
   # ===========================================================================
 
   # Block labels/sources for the wrapped (data) blocks, spec D3.
@@ -610,7 +610,7 @@ module NodePacket
     "#{parts.join("\n")}\n"
   end
 
-  # One packet, node and where-to-work as plain instruction text, ledger,
+  # One node input, node and where-to-work as plain instruction text, ledger,
   # record and (when present) hop wrapped as labeled data sharing ONE
   # boundary token computed over their raw payloads (spec D2-D4, matrix
   # 3.1-3.3).
@@ -618,22 +618,22 @@ module NodePacket
   # Blocks 1 and 5 are raw-interpolated (spec D3: instruction, not data), but
   # that trust does not reach a `release.verify` a project.yml can carry
   # (post-execution review finding A2): a line that is, on its own, a
-  # complete data marker is disarmed by `PacketWrapper.neutralize_marker_lines`
-  # before it ever reaches the packet, so a forged marker cannot open a
+  # complete data marker is disarmed by `DataBoundary.neutralize_marker_lines`
+  # before it ever reaches the node input, so a forged marker cannot open a
   # block outside the wrapper's own boundary. `record_source`/`hop_source`
   # (finding C15) are the record's and the hop sources' real store-relative
   # paths, never the placeholder label "record"/"sources".
-  def render_packet(node_text:, ledger_text:, intent_text:, decisions:, insights:, hop:, where_text:,
+  def render_input(node_text:, ledger_text:, intent_text:, decisions:, insights:, hop:, where_text:,
                      record_source: "record", hop_source: "sources")
     record_text = render_record_text(intent: intent_text, decisions: decisions, insights: insights)
     hop_text = hop && hop[:text]
 
     payloads = [ledger_text, record_text]
     payloads << hop_text if hop_text
-    token = PacketWrapper.boundary_token(payloads)
+    token = DataBoundary.boundary_token(payloads)
 
-    node_text_safe = PacketWrapper.neutralize_marker_lines(node_text.to_s)
-    where_text_safe = PacketWrapper.neutralize_marker_lines(where_text.to_s)
+    node_text_safe = DataBoundary.neutralize_marker_lines(node_text.to_s)
+    where_text_safe = DataBoundary.neutralize_marker_lines(where_text.to_s)
 
     # Normalized through `attr_safe` exactly as `wrap` normalizes the marker
     # attributes it writes (post-execution review finding A2's integrity
@@ -641,43 +641,43 @@ module NodePacket
     # `unwrap` reads back off the rendered marker line raised on every nil
     # source, because `attr_safe(nil)` renders as `""`, not `"nil".to_s`.
     wrapped_specs = [
-      { label: PacketWrapper.attr_safe(LEDGER_LABEL), source: PacketWrapper.attr_safe("savepoint.md") },
-      { label: PacketWrapper.attr_safe(RECORD_LABEL), source: PacketWrapper.attr_safe(record_source) },
+      { label: DataBoundary.attr_safe(LEDGER_LABEL), source: DataBoundary.attr_safe("savepoint.md") },
+      { label: DataBoundary.attr_safe(RECORD_LABEL), source: DataBoundary.attr_safe(record_source) },
     ]
-    wrapped_specs << { label: PacketWrapper.attr_safe(HOP_LABEL), source: PacketWrapper.attr_safe(hop_source) } if hop_text
+    wrapped_specs << { label: DataBoundary.attr_safe(HOP_LABEL), source: DataBoundary.attr_safe(hop_source) } if hop_text
 
     parts = [node_text_safe.rstrip, ""]
-    parts << PacketWrapper.wrap(ledger_text, label: LEDGER_LABEL, source: "savepoint.md", token: token).rstrip
+    parts << DataBoundary.wrap(ledger_text, label: LEDGER_LABEL, source: "savepoint.md", token: token).rstrip
     parts << ""
-    parts << PacketWrapper.wrap(record_text, label: RECORD_LABEL, source: record_source, token: token).rstrip
+    parts << DataBoundary.wrap(record_text, label: RECORD_LABEL, source: record_source, token: token).rstrip
     parts << ""
     if hop_text
-      parts << PacketWrapper.wrap(hop_text, label: HOP_LABEL, source: hop_source, token: token).rstrip
+      parts << DataBoundary.wrap(hop_text, label: HOP_LABEL, source: hop_source, token: token).rstrip
       parts << ""
     end
     parts << where_text_safe.rstrip
     rendered = "#{parts.join("\n")}\n"
 
-    assert_packet_integrity!(rendered, wrapped_specs)
+    assert_input_integrity!(rendered, wrapped_specs)
     rendered
   end
 
   # The trust boundary's own invariant (post-execution review finding A2):
-  # the finished packet must unwrap to exactly the data blocks that were
+  # the finished node input must unwrap to exactly the data blocks that were
   # wrapped, same count, same labels, same sources, in order. This is what
   # the escaping rule and the marker-line neutralization pass are FOR, so the
   # check belongs here, not only in a test that could rot independently of
   # the code it is meant to guard.
-  def assert_packet_integrity!(rendered, wrapped_specs)
-    actual = PacketWrapper.unwrap(rendered).map { |b| { label: b[:label], source: b[:source] } }
+  def assert_input_integrity!(rendered, wrapped_specs)
+    actual = DataBoundary.unwrap(rendered).map { |b| { label: b[:label], source: b[:source] } }
     return if actual == wrapped_specs
 
-    raise "node packet integrity check failed: expected #{wrapped_specs.inspect}, got #{actual.inspect}"
+    raise "node input integrity check failed: expected #{wrapped_specs.inspect}, got #{actual.inspect}"
   end
-  private_class_method :assert_packet_integrity!
+  private_class_method :assert_input_integrity!
 
   def render_from_state(state)
-    render_packet(node_text: state[:node_text], ledger_text: state[:ledger_text], intent_text: state[:intent_text],
+    render_input(node_text: state[:node_text], ledger_text: state[:ledger_text], intent_text: state[:intent_text],
                   decisions: state[:decisions], insights: state[:insights], hop: state[:hop],
                   where_text: state[:where_text], record_source: state[:record_source] || "record",
                   hop_source: state[:hop_source] || "sources")
@@ -685,7 +685,7 @@ module NodePacket
   private_class_method :render_from_state
 
   def estimate_rendered_tokens(rendered)
-    PacketWrapper.estimate_tokens(rendered)
+    DataBoundary.estimate_tokens(rendered)
   end
 
   # The C28 cut ladder: drop the hop whole, then cut Insights to the last
@@ -748,8 +748,8 @@ module NodePacket
       "record" => record_text,
       "where to work" => state[:where_text],
     }
-    name, text = candidates.max_by { |_, t| PacketWrapper.estimate_tokens(t.to_s) }
-    [name, PacketWrapper.estimate_tokens(text.to_s)]
+    name, text = candidates.max_by { |_, t| DataBoundary.estimate_tokens(t.to_s) }
+    [name, DataBoundary.estimate_tokens(text.to_s)]
   end
   private_class_method :name_oversized_block
 
@@ -760,10 +760,10 @@ module NodePacket
 
   # C21: the number of `running` lines already recorded for `node`, plus one
   # when a lease is being supplied by flag (a NEW dispatch), floored at 1.
-  # Minor 5: a torn `running` line (missing holder=/expires=/packet=/model=)
+  # Minor 5: a torn `running` line (missing holder=/expires=/input=/model=)
   # is skipped here exactly as ReadySet.attempts_count already skips it -
   # counting it desynchronizes this attempt number from the extensions file
-  # a live node's own `packets/<node>--a<N>.extensions` names, since that
+  # a live node's own `attempts/<node>--a<N>.extensions` names, since that
   # file is keyed by the attempt sweep computed off the SAME filtered count.
   def compute_attempt_number(intent_dir:, node:, lease_flag_given:, entries: nil)
     entries ||= NodeLedger.entries(savepoint_path(intent_dir))
@@ -771,8 +771,8 @@ module NodePacket
     [count + (lease_flag_given ? 1 : 0), 1].max
   end
 
-  def packet_path(intent_dir:, node:, attempt:)
-    File.join(intent_dir, "packets", "#{node}--a#{attempt}.packet")
+  def input_path(intent_dir:, node:, attempt:)
+    File.join(intent_dir, "attempts", "#{node}--a#{attempt}.input")
   end
 
   def summary_line(result)
@@ -781,7 +781,7 @@ module NodePacket
   end
 
   def running_command(intent_dir:, node:, sha:, hop_tokens:)
-    "node-transition #{intent_dir} --node #{node} --state running --field packet=#{sha} --field hop=#{hop_tokens}"
+    "node-transition #{intent_dir} --node #{node} --state running --field input=#{sha} --field hop=#{hop_tokens}"
   end
 
   def needs_decision_command(intent_dir:, node:, question:)
@@ -789,7 +789,7 @@ module NodePacket
     "node-transition #{intent_dir} --node #{node} --state needs_decision --field question=\"#{escaped}\""
   end
 
-  # Build one node's whole packet from disk (spec D1). Returns
+  # Build one node's whole input from disk (spec D1). Returns
   # {ok:, exit_code:, path:, sha:, tokens:, hop_tokens:, attempt:,
   # cuts_applied:, running_command:, errors:} on success, or
   # {ok: false, exit_code:, errors:, needs_decision_command: (on overflow)}
@@ -831,7 +831,7 @@ module NodePacket
     # it (post-execution review finding B12): `node-transition` is a
     # concurrent appending writer, so re-reading `savepoint.md` once per
     # block risked a line landing mid-build and making the Transitions,
-    # Lease and attempt number of one packet disagree with each other.
+    # Lease and attempt number of one node input disagree with each other.
     entries = NodeLedger.entries(savepoint_path(intent_dir))
 
     ledger_text = full_ledger_text(intent_dir: intent_dir, node: node, files: nb[:files], holder: holder,
@@ -843,7 +843,7 @@ module NodePacket
     hop_full = hop_block(store_dir: store_dir, sources: sources, hop_tokens: hop_tokens)
 
     # Finding A1: the stop directive belongs in block 5 (instruction)
-    # whenever the packet carries no lease at all, never inside block 2's
+    # whenever the node input carries no lease at all, never inside block 2's
     # ledger data (spec D3's self-cancellation risk).
     missing_lease = lease_missing?(node: node, holder: holder, expires: expires, model: model, entries: entries)
     where_text = where_to_work_block(intent_dir: intent_dir, worktree_reader: worktree_reader,
@@ -867,7 +867,7 @@ module NodePacket
         decisions: cuts_applied.include?(:decisions) ? state[:decisions].last(DECISIONS_KEEP) : state[:decisions],
       )
       oversized_name, oversized_tokens = name_oversized_block(final_state)
-      question = "packet for #{node} is #{tokens} tokens after every cut, over the #{budget_tokens}-token " \
+      question = "node input for #{node} is #{tokens} tokens after every cut, over the #{budget_tokens}-token " \
                  "budget; #{oversized_name} alone is #{oversized_tokens} tokens, shorten it"
       return {
         ok: false, exit_code: 4, tokens: tokens,
@@ -878,7 +878,7 @@ module NodePacket
 
     attempt_n = attempt || compute_attempt_number(intent_dir: intent_dir, node: node,
                                                    lease_flag_given: lease_flag_given?(holder), entries: entries)
-    path = out ? File.expand_path(out) : packet_path(intent_dir: intent_dir, node: node, attempt: attempt_n)
+    path = out ? File.expand_path(out) : input_path(intent_dir: intent_dir, node: node, attempt: attempt_n)
     FileUtils.mkdir_p(File.dirname(path))
 
     if File.exist?(path)

package/scripts/lib/node_input_compatibility.rb

@@ -0,0 +1,62 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# NodeInputCompatibility (intent 338a, G6, n1, D10/D11): the one seam that
+# lets a `running` line written before the node-input rename keep reading
+# correctly. It is the ONLY shipped file allowed to name the retired field,
+# and it names it exactly once, as LEGACY_FIELD below.
+#
+# It maps, never rewrites: the raw ledger line on disk is never touched.
+# `NodeLedger.parse_transition_line` calls #fields on every parsed field hash
+# before returning it, so torn detection, attempt counting, node-run,
+# graph-measure and outcome-report all see `input` whether the line was
+# written by an old dispatch or a new one.
+#
+# No project requires (spec D10): a plain module over a plain hash, so
+# `node_ledger.rb` never gains a require cycle through this file.
+module NodeInputCompatibility
+  module_function
+
+  # The retired field name, named once. No other shipped file names it.
+  LEGACY_FIELD = "packet"
+
+  # The retired directory and suffix (338a n3, D8), named once beside
+  # LEGACY_FIELD. No other shipped file spells either literal; a caller
+  # that needs the legacy input location builds it from these constants.
+  LEGACY_DIRECTORY = "packets"
+  LEGACY_SUFFIX = ".packet"
+
+  # A copy of `fields` where LEGACY_FIELD maps to "input" when "input" is
+  # absent or blank. "input" wins when both are present (D11): the newer,
+  # authoritative name is never overwritten by the retired one. LEGACY_FIELD
+  # itself is dropped from the copy either way, so a caller that renders
+  # every field it does not recognize (outcome-report's evidence line) never
+  # sees the retired key leak through as a second, unrecognized field.
+  def fields(fields)
+    source = fields || {}
+    return source.dup unless source.key?(LEGACY_FIELD)
+
+    mapped = source.dup
+    unless present?(mapped["input"])
+      mapped["input"] = mapped[LEGACY_FIELD]
+    end
+    mapped.delete(LEGACY_FIELD)
+    mapped
+  end
+
+  # 338a n3 (D8): the new path when it exists, the legacy directory and
+  # suffix when only that file exists, and the new path when neither does
+  # (a fresh attempt names its own soon-to-be-written destination).
+  def input_path(intent_dir:, node:, attempt:)
+    new_path = File.join(intent_dir, "attempts", "#{node}--a#{attempt}.input")
+    return new_path if File.exist?(new_path)
+
+    legacy_path = File.join(intent_dir, LEGACY_DIRECTORY, "#{node}--a#{attempt}#{LEGACY_SUFFIX}")
+    File.exist?(legacy_path) ? legacy_path : new_path
+  end
+
+  def present?(value)
+    !(value.nil? || value.to_s.strip.empty?)
+  end
+  private_class_method :present?
+end

package/scripts/lib/node_ledger.rb

@@ -4,6 +4,7 @@
 require "strscan"
 require_relative "savepoint"
 require_relative "guarded_append"
+require_relative "node_input_compatibility"
 
 # NodeLedger - the node and intent transition line (intent 335, G2). Owns the
 # line's byte-exact format, the closed state vocabulary, the required fields per
@@ -40,7 +41,7 @@ module NodeLedger
   # a flat list; DONE_EVIDENCE_FIELDS below carries the "at least one of" half.
   REQUIRED_FIELDS = {
     "planned" => [],
-    "running" => %w[holder expires packet model],
+    "running" => %w[holder expires input model],
     "done" => %w[gates],
     "failed_verification" => %w[gates reason],
     "needs_decision" => %w[question],
@@ -61,7 +62,14 @@ module NodeLedger
   # 2.6): every key named in REQUIRED_FIELDS or DONE_EVIDENCE_FIELDS, plus
   # `model` (accepted on any state). A field outside this list still renders,
   # sorted after these, so an unrecognized key is never silently dropped.
-  FIELD_ORDER = %w[holder expires packet model gates commit verdict reason question by expired].freeze
+  #
+  # `harness` (intent 340b, G7c, n1, D21) sits right after `model`: both are
+  # dispatch-time metadata `running` writes and every terminal transition
+  # carries forward, accepted on every state and required by none - the same
+  # treatment `suite=`, `hop=` and `core_drift=` already get as extras, given
+  # a stable declared position instead of falling to the alphabetical extras
+  # tail (matrix row 1.17).
+  FIELD_ORDER = %w[holder expires input model harness gates commit verdict reason question by expired].freeze
 
   SEPARATOR = "  "
 
@@ -187,6 +195,7 @@ module NodeLedger
     timestamp, subject, rest = m.captures
     state, remainder = rest.split(/\s+/, 2)
     fields, comment = scan_fields(remainder.to_s)
+    fields = NodeInputCompatibility.fields(fields)
     { timestamp: timestamp, subject: subject, state: state, fields: fields, comment: comment, raw: raw }
   end