@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/scripts/plastic-lock

@@ -19,12 +19,11 @@
 #                 corrupt lock with the resolving doctor hint
 #   who           compact, read-only durable owner/activity view
 #   status        report the lock file, its freshness, the derived worktree,
-#                 whether this session's pointer names the intent, and any
-#                 live per-artifact claims
+#                 whether this session is the one delivering the intent, and
+#                 any live per-artifact claims
 #   fix           idempotent repair of the lock for the current session; never
 #                 touches a fresh foreign lock
-#   release       owner clears the lock and points the session back at the day
-#                 ledger (End tail / abandoning a boarding)
+#   release       owner clears the lock (End tail / abandoning a boarding)
 #   reclaim       explicit takeover of a stale lock, audited in savepoint.md
 #   delegate      owner registers a subagent session under the lock (D4)
 #   claim         acquire the named --artifact's claim token (intent 111);
@@ -32,18 +31,18 @@
 #                 including this same session; takes over a stale claim
 #   release-claim free the named --artifact's claim token
 #
-# Without --intent-dir the intent is resolved from this session's pointer
-# (~/.plastic/store/.tmp/<session>/current) when it names an intent id, looked
-# up in the working directory's project store and then the global store. The
-# /tmp bridge JSON this CLI used to resolve through was removed in 2.0
-# (intent 307). Exit 0 on success/report; exit 1 when the verb is blocked.
+# Without --intent-dir the intent is resolved from this session's held
+# delivery lock (ActiveDelivery.resolve over the global store and the
+# configured project roots): exactly one fresh lock this session owns or
+# delegates for. Session resolution no longer reads any per-session state
+# file; that path was retired in 2.0 (intent 307) and 344 G11.
+# Exit 0 on success/report; exit 1 when the verb is blocked.
 
 require "json"
 require "yaml"
-require_relative "lib/bridge"
 require_relative "lib/lock"
 require_relative "lib/arm"
-require_relative "lib/session_ledger"
+require_relative "lib/active_delivery"
 
 VERBS = %w[arm status who fix release reclaim delegate claim release-claim].freeze
 
@@ -88,16 +87,7 @@ hint_harness = harness || "claude"
 plastic_home_env = ENV["PLASTIC_HOME"].to_s.strip
 home = plastic_home_env.empty? ? Dir.home : File.dirname(File.expand_path(plastic_home_env))
 
-# The stores this session's pointer is resolved against: the project store of
-# the working directory (projects.yml, longest path match), then the global one.
-def candidate_stores(home, cwd)
-  plastic_home = File.join(home, ".plastic")
-  stores = []
-  slug = SessionLedger.project_slug(cwd, plastic_home: plastic_home)
-  stores << File.join(plastic_home, "projects", slug, "store") if slug && slug != "global"
-  stores << File.join(plastic_home, "store")
-  stores
-end
+plastic_home = File.join(home, ".plastic")
 
 dir = opts[:dir]
 if dir.nil? || dir.strip.empty?
@@ -105,11 +95,21 @@ if dir.nil? || dir.strip.empty?
     warn "plastic-lock: #{verb} needs --intent-dir <intent dir>"
     exit 1
   end
-  dir = Arm.intent_dir_from_pointer(session, home: home, stores: candidate_stores(home, Dir.pwd))
-end
-if dir.nil?
-  warn "plastic-lock: no intent resolved; pass --intent-dir <intent dir>"
-  exit 1
+  roots = ActiveDelivery.project_roots(plastic_home)
+  global_store = File.join(plastic_home, "store")
+  dir = ActiveDelivery.resolve(global_store: global_store, project_roots: roots, session: session)
+  if dir.nil?
+    candidates = ActiveDelivery.candidate_intent_dirs(global_store: global_store, project_roots: roots).uniq
+    held = candidates.select do |candidate|
+      Lock.fresh?(candidate) && Lock.holds?(candidate, session: session)
+    end
+    if held.size > 1
+      warn "plastic-lock: more than one held delivery lock names this session; pass --intent-dir <intent dir>"
+    else
+      warn "plastic-lock: no intent resolved; pass --intent-dir <intent dir>"
+    end
+    exit 1
+  end
 end
 dir = File.expand_path(dir)
 
@@ -144,7 +144,7 @@ if verb == "who"
   exit 0
 end
 
-intent_id = Bridge.intent_id_from_dir(dir)
+intent_id = Arm.intent_id_for(dir)
 store = File.dirname(dir)
 key = Arm.resolve_session(session, store: store, intent_id: intent_id)
 
@@ -163,7 +163,7 @@ when "arm"
     puts JSON.pretty_generate(
       "intent_dir" => dir, "session" => result[:session], "status" => result[:status].to_s,
       "run_mode" => result[:lock] && result[:lock]["run_mode"],
-      "worktree" => wt, "pointer" => result[:pointer]
+      "worktree" => wt
     )
   when :held
     warn "plastic-lock: delivery lock for intent #{intent_id} is held by session " \
@@ -188,7 +188,10 @@ when "arm"
   end
 when "status"
   lock = Lock.read(dir)
-  pointer = Arm.read_pointer(key, home: home)
+  resolved = ActiveDelivery.resolve(global_store: File.join(plastic_home, "store"),
+                                    project_roots: ActiveDelivery.project_roots(plastic_home),
+                                    session: key)
+  delivering = !resolved.nil? && File.expand_path(resolved) == File.expand_path(dir)
   report = {
     "intent_dir" => dir,
     "session" => key,
@@ -196,8 +199,7 @@ when "status"
     "lock_fresh" => Lock.fresh?(dir),
     "lock_corrupt" => Lock.corrupt?(dir),
     "worktree" => Arm.worktree_block(intent_dir: dir, home: home),
-    "pointer" => pointer,
-    "pointer_names_intent" => pointer == intent_id,
+    "delivering" => delivering,
     "claims" => Claim.claims_status(dir),
   }
   puts JSON.pretty_generate(report)
@@ -217,7 +219,6 @@ when "release"
     warn "plastic-lock: not the owner; run plastic-lock status"
     exit 1
   end
-  Arm.reset_pointer(key, intent_id, home: home)
   puts "released (#{result})"
 when "reclaim"
   status, lock_data = Lock.takeover(dir, session: key, harness: harness,

package/scripts/read-config

@@ -33,6 +33,12 @@ DEFAULTS = {
   },
   "architect" => {
     "style" => nil
+  },
+  # Intent 340b (G7c, n4, D9): the Stop hook's runtime arm. Off until the
+  # owner's C32 ruling; read-config emits it as the string "false", which
+  # StopGate parses as a boolean itself rather than trusting.
+  "runner" => {
+    "stop_hook" => false
   }
 }.freeze
 

package/scripts/runner

@@ -2,24 +2,28 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
+require "yaml"
+require "stringio"
 require_relative "lib/savepoint"
 require_relative "lib/ready_set"
 require_relative "lib/runner_core"
+require_relative "lib/harness_adapter"
 require_relative "lib/runner_proposals"
 
 # runner - the one executable over the graph-ready loop's declared node graph
 # (intent 340, G7, n1). A subcommand table: the public verbs (step, status,
 # answer) are the only ones the skill body ever names; the internal verbs
-# (ready, sweep, rewind) route and work so `step` can compose them and so
-# each can be tested alone, but stay out of the usage text (327 spec).
+# (ready, sweep, rewind, until-empty) route and work so `step` can compose
+# them and so each can be tested alone, but stay out of the usage text (327
+# spec, 340b n7).
 #
-# `step`, `sweep`, `answer` and `rewind` route to modules later nodes
-# deliver (RunnerDispatch and RunnerAbsorb for `step`; RunnerSweep,
-# RunnerAnswer, RunnerRewind for the rest). Each is required LAZILY, inside
-# its own verb branch: a verb whose module has not landed yet reports
-# plainly and exits nonzero, and every other verb - most importantly
-# `status`, which an operator polls constantly across all five of this
-# intent's dispatches - keeps working.
+# `step`, `sweep`, `answer`, `rewind` and `until-empty` route to modules
+# later nodes deliver (RunnerDispatch and RunnerAbsorb for `step`;
+# RunnerSweep, RunnerAnswer, RunnerRewind, RunnerUntilEmpty for the rest).
+# Each is required LAZILY, inside its own verb branch: a verb whose module
+# has not landed yet reports plainly and exits nonzero, and every other verb
+# - most importantly `status`, which an operator polls constantly across all
+# five of this intent's dispatches - keeps working.
 #
 # Usage:
 #   runner <step|status|answer> <intent_dir> [--node ID] [--answer TEXT]
@@ -34,7 +38,7 @@ module Runner
   module_function
 
   PUBLIC_VERBS = %w[step status answer].freeze
-  INTERNAL_VERBS = %w[ready sweep rewind].freeze
+  INTERNAL_VERBS = %w[ready sweep rewind until-empty watch].freeze
   VERBS = (PUBLIC_VERBS + INTERNAL_VERBS).freeze
 
   # verb -> [[ModuleName, lib_file], ...], required lazily inside the verb's
@@ -47,6 +51,8 @@ module Runner
     "sweep" => [["RunnerSweep", "runner_sweep"]],
     "answer" => [["RunnerAnswer", "runner_answer"]],
     "rewind" => [["RunnerRewind", "runner_rewind"]],
+    "until-empty" => [["RunnerUntilEmpty", "runner_until_empty"]],
+    "watch" => [["RunnerWatch", "runner_watch"]],
   }.freeze
 
   def usage
@@ -77,11 +83,21 @@ module Runner
   # a mistyped `--session` used to vanish with no effect and the runner
   # simply acted as whichever session `CLAUDE_CODE_SESSION_ID` names.
   KNOWN_FLAGS = {
-    "step" => %w[--return --allow-core-drift],
+    "step" => %w[--return --allow-core-drift --harness],
     "answer" => %w[--node --answer],
     "rewind" => %w[--node --confirm],
+    "until-empty" => %w[--harness],
+    "watch" => %w[--dispatch --harness --install-timer --home],
   }.freeze
 
+  # The explicit YAML document-end marker (intent 340b, G7c, n1, row 1.28)
+  # separating the dispatch plan `step` has always printed from the
+  # harness-rendered block underneath it: stdout has never been one YAML
+  # document (absorb/reclaim/extend/reap lines print before the plan,
+  # decision/park lines after it), so a reader splits on this marker rather
+  # than guessing where the plan ends.
+  DOCUMENT_BOUNDARY = "...".freeze
+
   # unrecognized_flag(verb, args) -> the first token in `args` that looks
   # like a flag (`--...`) and is not in `verb`'s own KNOWN_FLAGS, or nil. A
   # verb absent from KNOWN_FLAGS (status, ready, sweep) accepts none.
@@ -203,6 +219,10 @@ module Runner
       run_answer(intent_dir, args)
     when "rewind"
       run_rewind(intent_dir, args)
+    when "until-empty"
+      run_until_empty(intent_dir, args)
+    when "watch"
+      run_watch(intent_dir, args)
     else
       warn "runner: #{verb}'s module loaded but no dispatcher is wired up yet"
       exit 3
@@ -284,14 +304,156 @@ module Runner
     exit 0
   end
 
-  # run_step (intent 340, G7, n5): one turn of the loop, in the fixed order
-  # 327 D14 and RunnerSweep's own docstring name - abort on a stuck merge,
-  # the delivery-lease heartbeat, absorb every `--return NODE=PATH` this call
-  # carries, THEN reclaim (so a node this very call just absorbed is never
-  # reclaimed out from under its own return, matrix row 2.19/2.20) - and only
-  # then dispatch whatever is left ready. Never spawns an agent (327 D42):
-  # the session makes every subagent call from the plan this prints.
+  # run_until_empty (intent 340b, G7c, n7): the Codex loop. Internal, like
+  # `rewind` (row 7.13) - `RunnerUntilEmpty.run` composes `step` and
+  # `node-run` itself, since Codex has no session on the other end to make
+  # the subagent calls `step` only ever prints a plan for. `--harness`
+  # threads into every turn the loop runs (row 7.5), never re-resolved per
+  # iteration from a literal. The lock check here is the same defence in
+  # depth `run_step_body` carries (B4): `RunnerUntilEmpty.step_once` refuses
+  # `lock_not_held` on its own first call regardless, so this exits before
+  # even constructing the loop's own state.
+  def run_until_empty(intent_dir, args)
+    harness_override = opt(args, "--harness")
+    context = RunnerCore.context(intent_dir: intent_dir, env: ENV["CLAUDE_CODE_SESSION_ID"])
+
+    unless context.session
+      warn "runner: until-empty refused (lock_not_held)"
+      exit 1
+    end
+
+    result = RunnerUntilEmpty.run(context, harness: harness_override)
+
+    case result[:status]
+    when "complete", "stalled", "needs_decision", "iteration_cap"
+      exit 0
+    else
+      exit 1
+    end
+  end
+
+  # run_watch (intent 340a, G7b, n2): one tick over disk truth. Internal,
+  # like until-empty and rewind - the timer that carries it lives outside
+  # this process (a local `/loop` on Claude Code, a launchd job on Codex,
+  # n3/n4). `--dispatch` is unattended start (graph.md D7): refused here,
+  # before RunnerWatch.tick ever takes the tick lock or writes anything,
+  # when the resolved harness's `HarnessAdapter.unattended_start?` is
+  # false, so a refusal never leaves a `watch.record` line behind that
+  # looks like a completed tick.
+  # --install-timer (intent 340a, G7b, n3, graph.md D9): the Codex carrier.
+  # Writes the plist and prints the path plus the `launchctl load` command;
+  # never runs `launchctl` itself, so the owner stays in control of when the
+  # job actually loads. `--home` defaults to the OS home, as
+  # `scripts/meter-watch --install-timer` already does.
+  def run_watch(intent_dir, args)
+    dispatch = args.include?("--dispatch")
+    harness_override = opt(args, "--harness")
+    context = RunnerCore.context(intent_dir: intent_dir, env: ENV["CLAUDE_CODE_SESSION_ID"])
+    agent_config = load_agent_config(context.plastic_home)
+    harness = HarnessAdapter.resolve_key(config: agent_config, override: harness_override)
+
+    if args.include?("--install-timer")
+      home = opt(args, "--home") || Dir.home
+      plist_path = RunnerWatch.install_timer(context, home: home, harness_key: harness)
+      puts "plist: #{plist_path}"
+      puts "launchctl load #{plist_path}"
+      exit 0
+    end
+
+    if dispatch && !HarnessAdapter.unattended_start?(harness)
+      warn HarnessAdapter::UNATTENDED_START_SENTENCE
+      exit 1
+    end
+
+    result = RunnerWatch.tick(context, dispatch: dispatch, harness: harness)
+
+    puts "class: #{result[:class]}"
+    result[:blockers].each { |b| puts "blocked: #{b}" }
+    puts "ready: #{result[:ready].empty? ? '(none)' : result[:ready].join(', ')}"
+    puts "dispatched: #{result[:dispatched].empty? ? '(none)' : result[:dispatched].join(', ')}"
+    exit 0
+  end
+
+  # run_step (intent 340, G7, n5): one turn of the loop. The real work lives
+  # in #run_step_body below; this wrapper (intent 340b, G7c, n1, rows
+  # 1.21-1.25 and 1.29-1.31) exists ONLY to capture every byte `step` prints
+  # - stdout and stderr both, refusals included - and persist it to
+  # `<intent_dir>/runner-step.last` before the process actually exits, so a
+  # PreCompact hand-off (n3) always has something to render, even after one
+  # of the three pre-plan refusals that used to warn to stderr alone.
+  #
+  # `run_step_body` still calls Kernel#exit(N) at every one of its own exit
+  # points, exactly as before this node; wrapping it in a rescue for
+  # SystemExit lets this method capture the intended status, persist the
+  # file, replay the captured output onto the REAL stdout/stderr (so a
+  # subprocess caller like Open3.capture3 sees byte-identical output to
+  # before this node), and only then perform the one real process exit.
   def run_step(intent_dir, args)
+    out_buf = StringIO.new
+    err_buf = StringIO.new
+    real_stdout = $stdout
+    real_stderr = $stderr
+    exit_code = 0
+    begin
+      $stdout = out_buf
+      $stderr = err_buf
+      run_step_body(intent_dir, args)
+    rescue SystemExit => e
+      exit_code = e.status || 1
+    ensure
+      $stdout = real_stdout
+      $stderr = real_stderr
+    end
+
+    real_stdout.print(out_buf.string)
+    real_stderr.print(err_buf.string)
+    persist_runner_step_last(intent_dir, out_buf.string, err_buf.string)
+
+    exit(exit_code)
+  end
+
+  # Row 1.24: lives beside savepoint.md, never inside attempts/ (which the
+  # reaper treats as attempt evidence). Row 1.32: registers itself in the
+  # store's own top-level `.gitignore` (Worktree.ensure_gitignored's own
+  # idempotent, non-raising append) the same way `*.lock` already is, so a
+  # file rewritten on every step never dirties the store tree. Row 1.25:
+  # wrapped in its own rescue - an unwritable intent directory must never
+  # crash a step that has already written its transitions.
+  def persist_runner_step_last(intent_dir, stdout_text, stderr_text)
+    home_root = Arm.home_for(intent_dir)
+    Worktree.ensure_gitignored(File.join(home_root, ".plastic"), "runner-step.last")
+
+    path = File.join(intent_dir, "runner-step.last")
+    File.write(path, "#{stdout_text}#{stderr_text}")
+  rescue StandardError => e
+    warn "runner: could not persist runner-step.last: #{e.message}"
+  end
+
+  # Intent 340b, G7c, n1, row 1.1: the config `HarnessAdapter.resolve_key`
+  # reads `agent.type` from. `context.plastic_home` is derived from the
+  # intent_dir's OWN ancestry (Arm.home_for -> Worktree.home_from_store), so
+  # a sandboxed test fixture never reaches the real ~/.plastic/config.yml
+  # (Arm.home_for's own docstring: "a sandboxed store never resolves to the
+  # real Dir.home") - this stays hermetic for free, the same way every other
+  # `context.plastic_home` read in this file already does. A missing or
+  # unparseable config.yml reads as {}, never raises.
+  def load_agent_config(plastic_home)
+    path = File.join(plastic_home.to_s, "config.yml")
+    return {} unless File.exist?(path)
+
+    YAML.safe_load(File.read(path)) || {}
+  rescue StandardError
+    {}
+  end
+
+  # run_step_body (intent 340, G7, n5): one turn of the loop, in the fixed
+  # order 327 D14 and RunnerSweep's own docstring name - abort on a stuck
+  # merge, the delivery-lease heartbeat, absorb every `--return NODE=PATH`
+  # this call carries, THEN reclaim (so a node this very call just absorbed
+  # is never reclaimed out from under its own return, matrix row 2.19/2.20) -
+  # and only then dispatch whatever is left ready. Never spawns an agent (327
+  # D42): the session makes every subagent call from the plan this prints.
+  def run_step_body(intent_dir, args)
     context = RunnerCore.context(intent_dir: intent_dir, env: ENV["CLAUDE_CODE_SESSION_ID"])
 
     # v1 minor 3/row 11.18: RunnerSweep.abort_if_merging already prints the
@@ -322,6 +484,12 @@ module Runner
     # never defaulted true.
     allow_core_drift = args.include?("--allow-core-drift")
 
+    # Intent 340b, G7c, n1, row 1.2/1.4: `--harness KEY` overrides config
+    # `agent.type` for this one call - how one machine drives both adapters
+    # without editing config. `nil` when absent, so HarnessAdapter falls
+    # through to config's own value untouched.
+    harness_override = opt(args, "--harness")
+
     returns = {}
     opt_all(args, "--return").each do |pair|
       node, path = pair.to_s.split("=", 2)
@@ -351,7 +519,8 @@ module Runner
     reaped = NodeWorktree.reap(context)
     reaped[:removed].each { |r| puts "reaped #{r[:node]} worktree" }
 
-    result = RunnerDispatch.dispatch(context)
+    agent_config = load_agent_config(context.plastic_home)
+    result = RunnerDispatch.dispatch(context, config: agent_config, harness: harness_override)
     unless result[:ok]
       warn "runner: step refused (#{result[:reason]}): #{Array(result[:errors]).join('; ')}"
       warn result[:rearm_command] if result[:rearm_command]
@@ -374,6 +543,21 @@ module Runner
       result[:blockers].each { |b| puts "blocked: #{b}" }
     end
 
+    # Intent 340b, G7c, n1, rows 1.6/1.13/1.14/1.27/1.28: the YAML plan keeps
+    # printing exactly as it did before this node (327's contract) - this is
+    # the rendered block UNDERNEATH it, for the harness `result[:harness]`
+    # resolved (config's `agent.type`, or this call's own `--harness`
+    # override), separated by an explicit YAML document-end marker so a
+    # reader splits on that marker rather than a heuristic. `render` returns
+    # nil for an empty dispatch list (row 1.14), so nothing extra ever
+    # prints when this step dispatched nothing.
+    block = HarnessAdapter.render(result[:dispatched], harness: result[:harness],
+                                   return_contract: RunnerDispatch::RETURN_CONTRACT)
+    if block
+      puts DOCUMENT_BOUNDARY
+      puts block
+    end
+
     # M11/row 10.14: a `needs_decision` stop must print even when THIS SAME
     # step also dispatched other nodes ahead of the decision node in ranked
     # order - `result[:status]` reads "dispatched" in that case (dispatched

package/scripts/verify-intent

@@ -11,7 +11,7 @@
 #
 # --base overrides the auto-detected diff base (default: the merge base with the repo's
 # detected default branch) for repos where detection is ambiguous. --suite is an optional
-# caller-supplied command to run (in the repo directory) and fold into the verdict. No
+# caller-supplied command to run (in the repo directory) and merge into the verdict. No
 # other flags exist.
 #
 # Checks, all run every invocation (the fourth only when --suite is given):

package/skills/auto/SKILL.md

@@ -46,10 +46,10 @@ QMD-first (when available): when the user describes the work instead of naming a
 ## Take the intent (do this FIRST)
 
 Immediately after selecting the intent, take it for this session. One verb acquires the durable
-`delivery.lock` in the intent directory (stamped `run_mode: auto`), provisions the code worktree
-at `<repo>/.claude/worktrees/{id}--{slug}` on branch `plastic/{id}--{slug}`, and points this
-session at the intent (`~/.plastic/store/.tmp/<session>/current`), so the record hook writes
-savepoint lines and heartbeats for it instead of the day ledger:
+`delivery.lock` in the intent directory (stamped `run_mode: auto`) and provisions the code worktree
+at `<repo>/.claude/worktrees/{id}--{slug}` on branch `plastic/{id}--{slug}`; the delivery lock
+names this session as the one delivering the intent, so the record hook writes savepoint lines
+and heartbeats for it instead of the day ledger:
 
 ```bash
 codex="${CODEX_THREAD_ID:-}"; claude="${CLAUDE_CODE_SESSION_ID:-}"
@@ -78,7 +78,7 @@ for work small enough to skip speccing, delivered inline with no separate plan r
 is no intent tier and no stage agent; depth follows the work.
 
 `runner step` computes readiness and prints a spawn block per dispatched node - agent, model,
-packet path, the test command, the call cap - fenced for a session to paste into the Agent
+node input path, the test command, the call cap - fenced for a session to paste into the Agent
 tool; the runner never spawns (327 D42). `runner status` renders the ledger; `runner answer`
 closes a `needs_decision` node.
 
@@ -165,7 +165,7 @@ ledger is missing (then rebuild it with `Savepoint.rebuild_savepoint`).
 | `How  plan.md created` / `How  checklist.md created` / `Exec  started` | Exec (verify plan, matrix, checklist) |
 | `Exec  outcome.md created` | Exec done; complete the intent |
 | A terminal savepoint line (`delivered` or `abandoned`) | Terminal; do not resume |
-| A node or `Intent` transition line (`n1  running ...`, `Intent  needs_decision ...`) | Exec; a graph delivery is in progress - drive it through `scripts/runner`'s three public verbs, `step` (one turn of the dispatch loop), `status` (renders ledger state, safe to poll constantly), and `answer` (closes a `needs_decision` node) - read node status through `NodeLedger.status` before dispatching anything, never re-derive it by eye |
+| A node or `Intent` transition line (`n1  running ...`, `Intent  needs_decision ...`) | Exec; a graph delivery is in progress - drive it through `scripts/runner`'s three public verbs, `step` (one turn of the dispatch loop), `status` (renders ledger state, safe to poll constantly), and `answer` (closes a `needs_decision` node) - read node status through `NodeLedger.status` before dispatching anything, never re-derive it by eye. `scripts/graph-measure` is the read-only sibling over that same ledger, with its own three public verbs `intent`, `budget`, and `cohorts` - it never dispatches and never writes |
 
 Filesystem fallback, in order: `checklist.md` with items checked means resume Exec from the
 first unchecked item; `plan.md` plus `checklist.md` means enter Exec; `spec.md` alone means
@@ -259,8 +259,8 @@ Read `../plastic-conventions/references/completion-and-done.md` for what "intent
 4. Review `## Insights` for observations that should become future intents; create them through
    `plastic-intent-creating` and update `chain`.
 5. Close through `plastic-intent-ending`, which runs `scripts/end-intent`: outcome, INDEX,
-   savepoint, the store commit, and the disarm (the worktree released, `delivery.lock` cleared,
-   the session pointer back on the day ledger), then the QMD reindex last and the single owner
+   savepoint, the store commit, and the disarm (the worktree released, `delivery.lock`
+   cleared), then the QMD reindex last and the single owner
    report. Pass `--session` and `--index-note`:
    ```bash
    ruby ~/.plastic/scripts/end-intent --store <store_path> --id <ID> --disposition delivered \

package/skills/auto/references/end-tail.md

@@ -2,8 +2,8 @@
 
 Deep mechanics behind two spots in `SKILL.md`: how `plastic-lock arm` resolves a session id
 when it takes an intent, and why the End-tail steps in Completion (release the worktree, clear
-the lock, reset the pointer, reindex) run in that exact order. The `/tmp` bridge JSON these
-steps once also purged was removed in 2.0 (intent 307); `scripts/lib/arm.rb` is what remains.
+the lock, reindex) run in that exact order. `scripts/lib/arm.rb` carries the arm, disarm, and
+repair operations.
 
 ## Table of Contents
 
@@ -22,18 +22,16 @@ session-less close resolve to the same key.
 Arming acquires the durable `delivery.lock` in the intent dir, keyed by that resolved session
 and stamped with `run_mode`. Ownership is session-keyed, not process-keyed, so the arm command
 exiting is fine by construction: the lock stays yours for every later tool call in this
-session, and the record hook refreshes its lease on every write you make. The same call writes
-the intent id into the session pointer (`~/.plastic/store/.tmp/<session>/current`), which is
+session, and the record hook refreshes its lease on every write you make. Holding that lock is
 why the capture and record hooks stop treating your prompts as day-ledger items for the rest
 of the delivery.
 
 ## Disarm ordering and worktree cleanup rationale
 
 `Arm.disarm` runs the ordered End tail: it releases the worktree first, then clears the
-intent's `delivery.lock` as its recorded owner, and only then resets the session pointer to
-today's day id (when it still names this intent). The worktree goes first so a released lock
-never points at a checkout another session could claim; the pointer goes last so the record
-hook keeps heartbeating the lock until the lock is gone.
+intent's `delivery.lock` as its recorded owner. The worktree goes first so a released lock
+never points at a checkout another session could claim; the lock goes last so the record
+hook keeps heartbeating it until the delivery is actually done.
 
 **Mechanized since intent 188.** `scripts/end-intent` performs this disarm itself, as its own
 step 5, after steps 1-4 (outcome/INDEX/savepoint/commit) commit. A pre-flight lock guard
@@ -52,10 +50,10 @@ survives and can be reclaimed).
 When the work is being shipped through a release, do NOT rely on this plain remove.
 `skills/releasing/SKILL.md` runs its worktree-merge step BEFORE its `end-intent` call, merging
 the intent's code branch (`plastic/{id}--{slug}`) back to the repo's default branch BEFORE
-the worktree is removed, via `Worktree.finish(Arm.bridge_hash(intent_dir: ...), merge: true)`
+the worktree is removed, via `Worktree.finish(Arm.delivery(intent_dir: ...), merge: true)`
 (merge-then-remove), so the integrated work is not lost. By the time `end-intent`'s own step 5
-runs afterward, the worktree is already gone (a harmless no-op) and only the delivery lock and
-the pointer are left to clear. Never leave an orphaned worktree, and run `git worktree prune`
+runs afterward, the worktree is already gone (a harmless no-op) and only the delivery lock is
+left to clear. Never leave an orphaned worktree, and run `git worktree prune`
 if you hit a stale reference.
 
 ## QMD reindex ordering rationale

package/skills/conventions/references/completion-and-done.md

@@ -17,10 +17,10 @@ self-declares its disposition through a `disposition: delivered|abandoned` front
 header. The delivered path authors it with the result; the abandoned path authors it with
 the abandonment reason and no longer leaves the scaffolded placeholder sentinel in place.
 
-The canonical End tail runs in this order, and the QMD reindex is always LAST, after the
-purge: `outcome.md -> INDEX terminal -> the terminal savepoint line -> commit -> disarm
-(Worktree.release -> Lock.release -> purge) -> QMD reindex`. Running the reindex last keeps the index from
-ever referencing a bridge or lock that disarm is about to remove.
+The canonical End tail runs in this order: `outcome.md -> INDEX terminal -> the terminal
+savepoint line -> commit -> disarm (Worktree.release -> Lock.release) -> QMD reindex`, the
+reindex always LAST. Running the reindex last keeps the index from ever referencing a lock
+that disarm just removed.
 
 `scripts/end-intent` performs this order's disarm step (verify the code worktree is clean,
 then merge/remove worktrees, then clear the lock) as its own step 5, mechanically, since
@@ -31,12 +31,11 @@ foreign session, reclaims a stale one with an audit line), and a dirty code work
 refuses before removal rather than force-discarding uncommitted changes.
 
 The post-done access window is lock-bounded: `[INDEX terminal -> Lock.release]`. Through it
-the completing session keeps full read and write access to the terminal directory and no
-purge can fire (108's lock-held keep-guard keeps the bridge while `delivery.lock` exists).
-Once the lock is released the window closes: the bridge becomes purge-eligible and the
-directory is frozen. A crash mid-tail is recovered by stale-lock reclaim plus finishing the
-tail; `doctor` surfaces this as a "stalled completion" (terminal in INDEX but the lock is
-still present or stale). Finishing the tail is FINISHING a completion, never a reactivation:
+the completing session keeps full read and write access to the terminal directory (108's
+lock-held keep-guard holds it open while `delivery.lock` exists). Once the lock is released
+the window closes and the directory is frozen. A crash mid-tail is recovered by stale-lock
+reclaim plus finishing the tail; `doctor` surfaces this as a "stalled completion" (terminal in
+INDEX but the lock is still present or stale). Finishing the tail is FINISHING a completion, never a reactivation:
 a done intent is never moved back to `## Active`.
 
 One report per audience: a delivery produces `outcome.md` plus one EM-to-CTO owner report, and

package/skills/conventions/references/knowledge-graph.md

@@ -45,3 +45,12 @@ This chapter holds the linking doctrine from Frontmatter and the branch-vs-root
   the relation on the PREDECESSOR's `chain` (and mirror it as a
   `[[id--slug|<target's full intent: text>]]` wikilink in `## Links`).
 - **Rule of thumb:** if the intent could exist without its parent, it's a root.
+
+## Naming
+
+A thing is named after the concept family it lives under. A node is a graph-engineering
+concept, so its name comes from graph engineering (node, edge, ready set, critical path),
+from the Plastic concepts coined on top of it (intent, ledger, node input, lease, gate, runner),
+and from the software and AI engineering concepts those rest on (review, fix, test, verify,
+dispatch, executor, reviewer). A name from outside that stack is refused. Where no existing
+concept fits, that is a design finding to raise, not a word to coin.