@zalom/plastic 2.0.0-alpha.23 → 2.0.0-alpha.24

package/scripts/lib/arm.rb

@@ -10,13 +10,14 @@ require_relative "savepoint"
 
 # Arm - how an auto team takes an intent and gives it back (intent 307).
 #
-# Three durable facts make a delivery: the delivery lock in the intent
-# directory (who owns it), the code worktree under the project repo (where
-# the code lands), and the per-session pointer in the global store's `.tmp/`
-# (which intent this session records into; a day id means the day ledger).
-# Before 2.0 a fourth thing, a `/tmp` bridge JSON, cached all three plus a
-# stage snapshot; ruling 6 of intent 296 retired it, and this module is what
-# replaced the bridge's arm, disarm, and repair methods (removed in 2.0, intent 307).
+# Two durable facts make a delivery: the delivery lock in the intent
+# directory says who delivers, and the code worktree under the project repo
+# says where the code lands. A conversation session's tmp directory under
+# the global store's `.tmp/` says only that a session started; it names no
+# intent. This module carries the
+# arm, disarm, and repair operations (intent 307); the pure INDEX/project-config
+# helpers that once sat alongside them on a shared-helpers module now live on
+# IndexEntry and ProjectConfig (intent 344).
 #
 # Pure and dependency-injected: every path and clock is an argument, every git
 # call goes through an injected runner, and the only environment read is the
@@ -32,7 +33,7 @@ module Arm
   end
 
   # Deterministic, session-less key derived from the store and the intent id,
-  # for headless runs that carry no session id at all (moved from Bridge).
+  # for headless runs that carry no session id at all.
   def derive_key(store, intent_id)
     "auto-" + Digest::SHA256.hexdigest("#{store}/#{intent_id}")[0, 10]
   end
@@ -67,7 +68,7 @@ module Arm
 
   # The minimal hash Worktree.provision, release, and finish consume: the
   # intent block plus, when asked, the derived worktree block.
-  def bridge_hash(intent_dir:, home: Dir.home, with_worktree: true)
+  def delivery(intent_dir:, home: Dir.home, with_worktree: true)
     dir = File.expand_path(intent_dir)
     data = {
       "intent" => { "id" => intent_id_for(dir), "dir" => File.basename(dir), "store" => store_for(dir) },
@@ -94,48 +95,26 @@ module Arm
     }
   end
 
-  # Owner rule 2026-08-31: does this session already have a live top-level
-  # pointer pointing SOMEWHERE ELSE (the day ledger or another intent)? A
-  # pointer already on this intent is the owner re-arming mid-delivery and
-  # stays idempotent. True means a
-  # conversation session. Reads only; rescues to false (fail open).
-  def preexisting_pointer?(session, home:)
-    path = pointer_path(session, home: home)
-    File.exist?(path) && !File.read(path).to_s.strip.empty?
+  # Owner rule 2026-08-31: has this session already started a conversation?
+  # A conversation session's tmp directory is made at boot under the global
+  # store's `.tmp/`; a dispatched or headless session (a derived key) never
+  # gets one. Reads only; rescues to false (fail open: a broken store must
+  # never block a legitimate delivery).
+  def started_session?(session, home:)
+    store = global_store(home)
+    Dir.exist?(SessionLedger.session_tmp_dir(store, SessionLedger.short_session_id(nil, session)))
   rescue StandardError
     false
   end
 
-  # --- the pointer -------------------------------------------------------------
-
-
-  def pointer_path(session, home:)
-    store = global_store(home)
-    SessionLedger.pointer_path(store, SessionLedger.short_session_id(nil, session))
-  end
-
-  def read_pointer(session, home:)
-    path = pointer_path(session, home: home)
-    File.exist?(path) ? File.read(path).strip : nil
-  end
-
-  def write_pointer(session, value, home:)
-    store = global_store(home)
-    SessionLedger.ensure_tmp_root(store)
-    path = pointer_path(session, home: home)
-    FileUtils.mkdir_p(File.dirname(path))
-    File.write(path, "#{value}\n")
-    path
-  end
-
   # --- arm ---------------------------------------------------------------------
 
   # Take an intent for `session`: acquire delivery.lock (stamped with the run
-  # mode and the provenance the caller knows), provision the code worktree
-  # (fail-open for a global-only or non-git intent), and point the session at
-  # the intent. Returns `{status:, lock:, worktree:, session:, pointer:}`.
-  # A held, stale, excluded, or corrupt lock returns that status with the
-  # lock data read and touches nothing.
+  # mode and the provenance the caller knows) and provision the code worktree
+  # (fail-open for a global-only or non-git intent). Returns
+  # `{status:, lock:, worktree:, session:}`. A held, stale, excluded, or
+  # corrupt lock returns that status with the lock data read and touches
+  # nothing.
   def arm(intent_dir:, session:, mode: "auto", home: Dir.home, harness: nil,
           agent: nil, model: nil, thread: nil, now: Time.now, runner: Worktree::ShellRunner.new,
           host: Socket.gethostname, allow_inline: false)
@@ -145,52 +124,39 @@ module Arm
     h = home_for(dir, home: home)
 
     # Owner rule 2026-08-31: the main session never delivers an intent inline.
-    # A session that already carries a top-level session pointer is a
-    # conversation session (SessionStart wrote it at boot); arming there is
-    # inline delivery and is refused BEFORE any lock is taken. A dispatched or
-    # headless session has no pre-existing pointer and arms freely.
-    # --allow-inline is the explicit owner override. Fail open on read errors:
-    # a broken pointer file must never block a legitimate delivery.
-    if !allow_inline && preexisting_pointer?(key, home: h) &&
-       read_pointer(key, home: h).to_s.strip != intent_id_for(dir)
-      return { status: :inline_refused, lock: nil, worktree: nil, session: key, pointer: nil }
+    # A conversation session (its tmp directory already exists under the
+    # global store) arming an intent it does not already hold the lock for is
+    # inline delivery and is refused BEFORE any lock is taken. Re-arming the
+    # intent it already holds stays idempotent. A dispatched or headless
+    # session has no tmp directory and arms freely. --allow-inline is the
+    # explicit owner override.
+    if !allow_inline && started_session?(key, home: h) && !Lock.holds?(dir, session: key)
+      return { status: :inline_refused, lock: nil, worktree: nil, session: key }
     end
 
     status, lock = Lock.acquire(dir, session: key, host: host, now: now,
                                 harness: harness, agent: agent, model: model,
                                 thread: thread, run_mode: mode.to_s)
     unless %i[acquired owned].include?(status)
-      return { status: status, lock: lock, worktree: nil, session: key, pointer: nil }
+      return { status: status, lock: lock, worktree: nil, session: key }
     end
 
-    data = bridge_hash(intent_dir: dir, home: h, with_worktree: false)
+    data = delivery(intent_dir: dir, home: h, with_worktree: false)
     begin
       Worktree.provision(data, home: h, runner: runner)
     rescue StandardError => e
       warn "plastic: worktree provision raised, continuing unprovisioned: #{e.message}"
     end
 
-    # The pointer is what the capture and record hooks read; they key on the
-    # harness's real session id, so a derived key gets no pointer (nothing would
-    # ever read it). A pointer failure warns and never undoes an acquired lock.
-    pointer = nil
-    unless key == derive_key(store_for(dir), intent_id_for(dir))
-      begin
-        pointer = write_pointer(key, intent_id_for(dir), home: h)
-      rescue StandardError => e
-        warn "plastic: session pointer not written (#{e.message}); the lock is held regardless"
-      end
-    end
     { status: status, lock: lock, worktree: worktree_block(intent_dir: dir, home: h),
-      session: key, pointer: pointer }
+      session: key }
   end
 
   # --- disarm ------------------------------------------------------------------
 
-  # Give the intent back: remove the worktree (when `remove`), release the
-  # lock as its recorded owner (falling back to `session`), and reset the
-  # session pointer to today's day id when it named this intent. Returns
-  # the lock release status (:released, :none, :not_owner, or :raised).
+  # Give the intent back: remove the worktree (when `remove`) and release the
+  # lock as its recorded owner (falling back to `session`). Returns the lock
+  # release status (:released, :none, :not_owner, or :raised).
   def disarm(intent_dir:, session:, home: Dir.home, runner: Worktree::ShellRunner.new,
              remove: true, now: Time.now)
     dir = File.expand_path(intent_dir)
@@ -198,39 +164,24 @@ module Arm
     key = resolve_session(session, store: store_for(dir), intent_id: intent_id_for(dir))
 
     begin
-      Worktree.release(bridge_hash(intent_dir: dir, home: h), home: h, runner: runner, remove: remove)
+      Worktree.release(delivery(intent_dir: dir, home: h), home: h, runner: runner, remove: remove)
     rescue StandardError => e
       warn "plastic: worktree release raised, continuing: #{e.message}"
     end
 
     lock = Lock.read(dir)
     owner = lock && !blank?(lock["owner_session"]) ? lock["owner_session"] : key
-    release_status = begin
+    begin
       Lock.release(dir, session: owner)
     rescue StandardError => e
       warn "plastic: delivery lock release raised for #{dir}, continuing: #{e.message}"
       :raised
     end
-
-    begin
-      reset_pointer(key, intent_id_for(dir), home: h, now: now)
-    rescue StandardError => e
-      warn "plastic: session pointer not reset (#{e.message})"
-    end
-    release_status
-  end
-
-  # Point the session back at the day ledger, but only when it names `intent_id`.
-  def reset_pointer(session, intent_id, home:, now: Time.now)
-    current = read_pointer(session, home: home)
-    return false unless current == intent_id.to_s
-    write_pointer(session, SessionLedger.day_id(now), home: home)
-    true
   end
 
   # --- repair ------------------------------------------------------------------
 
-  # One idempotent repair (the lock half of the bridge's repair, removed in 2.0):
+  # One idempotent repair (the lock half of the repair path):
   # remove a corrupt lock, back off from a fresh foreign lock (`held`), report
   # a stale foreign lock (`stale`) for the explicit reclaim verb, keep and
   # enrich an own lock, heartbeat a delegated one, acquire when none, and
@@ -284,7 +235,7 @@ module Arm
     end
 
     begin
-      Worktree.provision(bridge_hash(intent_dir: dir, home: h, with_worktree: false), home: h, runner: runner)
+      Worktree.provision(delivery(intent_dir: dir, home: h, with_worktree: false), home: h, runner: runner)
     rescue StandardError => e
       warn "plastic: worktree provision raised during repair, continuing unprovisioned: #{e.message}"
     end
@@ -293,16 +244,4 @@ module Arm
 
     { "status" => "repaired", "actions" => actions, "lock" => lock_data, "session" => key }
   end
-
-  # The intent directory this session's pointer names, searched in the given
-  # stores in order; nil when the pointer is absent, empty, or a day id.
-  def intent_dir_from_pointer(session, home:, stores:)
-    current = read_pointer(session, home: home)
-    return nil if blank?(current) || SessionLedger.valid_day_id?(current)
-    stores.each do |store|
-      match = Dir.glob(File.join(store, "#{current}--*")).find { |p| File.directory?(p) }
-      return match if match
-    end
-    nil
-  end
 end

package/scripts/lib/codex_adapter.rb

@@ -8,7 +8,7 @@ require_relative "runner_policy"
 
 # CodexAdapter (intent 340b, G7c, n6): the argv `codex exec` needs for one
 # node's kind, and the mechanics of running it once - a bounded subprocess
-# whose stdin carries the packet, whose stdout and `--output-last-message`
+# whose stdin carries the node input, whose stdout and `--output-last-message`
 # file are the only two places a return can come from, and whose timeout
 # kills the whole process group rather than one pid.
 #
@@ -69,7 +69,7 @@ module CodexAdapter
   # kind's row calls for and nothing else (row 6.7 - never the intent
   # worktree, never `~/.plastic`), `--output-last-message` at the path the
   # caller names, and a bare `-` so the prompt is read from stdin (row 6.9) -
-  # the packet itself never rides in this array.
+  # the node input itself never rides in this array.
   def build_argv(kind:, worktree:, output_last_message:)
     [
       "codex", "exec",

package/scripts/lib/{packet_wrapper.rb → data_boundary.rb}

@@ -3,13 +3,13 @@
 
 require "digest"
 
-# PacketWrapper (intent 338, G5, n1): the trust boundary a node packet is
+# DataBoundary (intent 338, G5, n1): the trust boundary a node input is
 # built over. A data block carries text other agents and the owner wrote,
 # and is opened by `<<<PLASTIC-DATA:<token> label="..." source="...">>>` and
 # closed by `<<<END-PLASTIC-DATA:<token>>>`. The token is content-derived
 # (spec D4), so the same payloads always produce the same token and the
-# packet stays deterministic; the escaping rule (spec D5) runs on every
-# payload independently of the token, so a payload carrying this packet's
+# node input stays deterministic; the escaping rule (spec D5) runs on every
+# payload independently of the token, so a payload carrying this node input's
 # own closing marker still cannot close its block. Attribute values
 # (`label`, `source`) are sanitized separately, by a whitelist (spec D5a),
 # because they are not payload text and the payload escaping rule does not
@@ -18,7 +18,7 @@ require "digest"
 # Pure and side-effect-free: no I/O, no clock, nothing raised across the
 # boundary. `estimate_tokens` is the one arithmetic every budget in this
 # delivery is spent in (spec D6): bytes over four, rounded.
-module PacketWrapper
+module DataBoundary
   module_function
 
   MARKER_OPEN = "<<<PLASTIC-DATA:"
@@ -34,16 +34,16 @@ module PacketWrapper
   CLOSE_LINE_RE = /\A#{Regexp.escape(MARKER_CLOSE)}([0-9a-f]+)>>>\z/.freeze
 
   # The first twelve hex characters of the SHA-256 over the payloads joined
-  # by a newline (spec D4): fixed per packet, unguessable from any single
+  # by a newline (spec D4): fixed per node input, unguessable from any single
   # record file, deterministic across two builds of the same payloads.
   def boundary_token(payloads)
     Digest::SHA256.hexdigest(Array(payloads).map(&:to_s).join("\n"))[0, 12]
   end
 
   # One-way marker escaping (spec D5), plus a UTF-8 scrub (matrix 1.10) so
-  # one invalid byte anywhere in a record never raises the whole packet
+  # one invalid byte anywhere in a record never raises the whole node input
   # build. Runs regardless of what token trails the marker text, because a
-  # payload copied from an earlier packet may carry ANY token, not only this
+  # payload copied from an earlier node input may carry ANY token, not only this
   # one (matrix 1.2's concern applied to escaping rather than to the token
   # itself).
   def escape(payload)

package/scripts/lib/day_summary.rb

@@ -12,6 +12,7 @@ require "time"
 require_relative "session_ledger"
 require_relative "handoff"
 require_relative "lock"
+require_relative "active_delivery"
 require_relative "report_screen"
 
 module DaySummary
@@ -43,7 +44,7 @@ module DaySummary
       open: open_items(store, day),
       done: last_done(store, day),
       live: live_intents(home, now: now),
-      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl),
+      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl, home: home),
     }
     hidden = Hash.new(0)
     cap!(lists, hidden, :open, OPEN_CAP, keep: :newest)
@@ -142,7 +143,7 @@ module DaySummary
     "(no savepoint yet)"
   end
 
-  def active_sessions(store, session, now:, ttl:)
+  def active_sessions(store, session, now:, ttl:, home: nil)
     tmp_root = SessionLedger.tmp_root(store)
     return [] unless File.directory?(tmp_root)
 
@@ -155,7 +156,7 @@ module DaySummary
       age = heartbeat_age(dir, now)
       next if age.nil? || age > ttl
 
-      "- #{sid} (#{(age / 60).floor}m ago, on #{pointer_of(dir)})"
+      "- #{sid} (#{(age / 60).floor}m ago, on #{delivering_label(store, home, sid, now)})"
     end
   rescue SystemCallError
     []
@@ -178,14 +179,21 @@ module DaySummary
     nil
   end
 
-  def pointer_of(dir)
-    path = File.join(dir, "current")
-    return "?" unless File.file?(path)
-
-    value = File.read(path).strip
-    value.empty? ? "?" : value[0, 80]
-  rescue SystemCallError
-    "?"
+  # The delivering intent's id, or "day ledger" (344 n2, D4-D7): the
+  # basename before "--" of ActiveDelivery.resolve_by_short_session's
+  # match, else the session records into today's day ledger.
+  def delivering_label(store, home, sid, now)
+    return "day ledger" if home.to_s.empty?
+
+    dir = ActiveDelivery.resolve_by_short_session(
+      global_store: store,
+      project_roots: ActiveDelivery.project_roots(home),
+      short_session: sid,
+      now: now
+    )
+    dir ? File.basename(dir).split("--", 2).first : "day ledger"
+  rescue StandardError
+    "day ledger"
   end
 
   # --- rendering, pure -------------------------------------------------------------

package/scripts/lib/doctor_session_ledger.rb

@@ -15,21 +15,12 @@ require_relative "session_ledger"
 # heartbeat is only refreshed on prompts and edits, so an old heartbeat is evidence, not
 # proof, that the session is gone. Fail-open: an unreadable directory is skipped, never
 # raised. Depends on the including class for `plastic_home` and `check`.
+#
+# Intent 344 (G11, D10): the third check this category used to carry,
+# `no_pointer_session_tmp`, is retired along with the per-session state it read.
 module DoctorSessionLedger
   ORPHAN_TTL_SECONDS = 24 * 60 * 60
 
-  # Row H (spec D9): a `.tmp/<sid>/` directory with no `current` pointer is a
-  # DIFFERENT orphan class than ORPHAN_TTL_SECONDS's -- a session where
-  # session start never ran at all (a `-p` print session, a resumed
-  # background job, an unregistered SessionStart hook), not a session that
-  # ran and then never closed. No choice of session id ever creates a
-  # pointer for that class, so it would otherwise stay invisible for the
-  # full 24 hours (or forever, once hook-capture/hook-record stop creating
-  # it at all). Short relative to ORPHAN_TTL_SECONDS on purpose: a session
-  # between its own start and its first pointer write is normal and must not
-  # be flagged, but that window is seconds, not hours.
-  NO_POINTER_TTL_SECONDS = 5 * 60
-
   # Seconds since the session's last heartbeat: the ISO-8601 content of `heartbeat`,
   # else that file's mtime, else the directory's mtime.
   def heartbeat_age(dir, now)
@@ -49,7 +40,6 @@ module DoctorSessionLedger
 
     store_dir = File.join(plastic_home, "store")
     orphans = orphaned_session_dirs(store_dir, now)
-    no_pointer = no_pointer_session_dirs(store_dir, now)
     shape = day_ledger_shape_problems(store_dir)
 
     checks = []
@@ -67,20 +57,6 @@ module DoctorSessionLedger
                                 "session is gone: a live session rewrites its heartbeat on every " \
                                 "prompt and edit, so only a listed directory may be removed, by hand.")
               end
-    checks << if no_pointer.empty?
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "pass",
-                      message: "No .tmp/<session>/ directory has gone without a `current` pointer for " \
-                               "longer than #{NO_POINTER_TTL_SECONDS} seconds")
-              else
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "warn",
-                      message: "#{no_pointer.size} .tmp/<session>/ director#{no_pointer.size == 1 ? "y" : "ies"} " \
-                               "with no `current` pointer for longer than #{NO_POINTER_TTL_SECONDS} seconds " \
-                               "(session start never ran for this session)",
-                      details: no_pointer, fixable: true,
-                      fix_hint: "Remove each listed .tmp/<session>/ directory after confirming that " \
-                                "session never started: no `current` pointer means session start never " \
-                                "ran for it, so this is not a live session missing a checklist entry.")
-              end
     checks << if shape.empty?
                 check(category: "session_ledger", name: "day_ledger_shape", status: "pass",
                       message: "Every .sessions/ entry is a YYYYMMDD day directory with its <day>.md file")
@@ -113,31 +89,6 @@ module DoctorSessionLedger
     [] # unreadable .tmp/: nothing to report, never a crash
   end
 
-  # Row H (spec D9): `.tmp/<sid>/` directories with no `current` pointer, past
-  # NO_POINTER_TTL_SECONDS. A different signal than #orphaned_session_dirs:
-  # that one is age-only and blind to whether a pointer exists at all, so a
-  # young no-pointer dir (a session between its start and its first pointer
-  # write) must not appear here even though it may well appear there once it
-  # ages past ORPHAN_TTL_SECONDS -- the two checks answer different questions
-  # and a dir can legitimately show up in neither, either, or both.
-  def no_pointer_session_dirs(store_dir, now)
-    tmp_root = SessionLedger.tmp_root(store_dir)
-    return [] unless File.directory?(tmp_root)
-
-    Dir.children(tmp_root).sort.filter_map do |name|
-      dir = File.join(tmp_root, name)
-      next unless File.directory?(dir)
-      next if File.exist?(File.join(dir, "current"))
-
-      age = heartbeat_age(dir, now)
-      next if age <= NO_POINTER_TTL_SECONDS
-
-      "global: #{dir} (session #{name}, no `current` pointer, last heartbeat #{age.round}s ago)"
-    end
-  rescue SystemCallError
-    [] # unreadable .tmp/: nothing to report, never a crash
-  end
-
   def day_ledger_shape_problems(store_dir)
     root = SessionLedger.sessions_root(store_dir)
     return [] unless File.directory?(root)

package/scripts/lib/exec_worktree.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require "open3"
-require_relative "bridge"
 require_relative "arm"
 require_relative "lock"
 require_relative "worktree"
@@ -29,8 +28,8 @@ require_relative "scaffold_intent"
 # fail-open, see the merge-verification note below), `finisher:` (defaults to
 # `Worktree.method(:finish)`), `status_checker:` (defaults to a `git status --porcelain`
 # lambda). Every seam exists so
-# tests run with no real git, no real worktree removal, and no real bridge file outside a
-# tmpdir.
+# tests run with no real git, no real worktree removal, and no real delivery-lock file
+# outside a tmpdir.
 #
 # MERGE VERIFICATION (delivered disposition only). `Worktree.merge_branch` is deliberately
 # fail-open: on a conflict it runs `git merge --abort`, warns, and returns false, and
@@ -39,7 +38,7 @@ require_relative "scaffold_intent"
 # module never trusts the discarded return value; it asks git directly, AFTER finish, whether
 # the intent's code branch is now an ancestor of the repo's current HEAD
 # (`merged_into_current_branch?` below). `repo` and `branch` are captured BEFORE the finisher
-# runs, because finish deletes the bridge's `worktree` block.
+# runs, because finish deletes the delivery's `worktree` block.
 #
 # DOES NOT RUN A TEST SUITE, in any form. `verify-intent` owns test execution; one concern
 # per script (spec D8).
@@ -60,6 +59,10 @@ module ExecWorktree
   # [stdout, stderr, status] triple Open3.capture3 returns (status responds to
   # success?). A raised error (git missing, corrupt repo) is caught and reported as a
   # nil status, so the caller can fail closed the same way a failed exit status would.
+  def blank?(value)
+    value.nil? || value.to_s.strip.empty?
+  end
+
   def default_status_checker
     lambda do |worktree_code|
       Open3.capture3("git", "-C", worktree_code, "status", "--porcelain")
@@ -85,7 +88,7 @@ module ExecWorktree
   # `<repo>/.claude/worktrees/<name>` (scripts/lib/worktree.rb:75), so walking up three
   # directories recovers `<repo>` deterministically, with no I/O and no git.
   def repo_from_worktree_code(worktree_code)
-    return nil if Bridge.blank?(worktree_code)
+    return nil if blank?(worktree_code)
     File.dirname(File.dirname(File.dirname(worktree_code.to_s)))
   end
 
@@ -94,7 +97,7 @@ module ExecWorktree
   # i.e. the merge actually landed. Fails CLOSED (not merged) on a blank repo/branch or a
   # raising runner, so an inconclusive check is never reported as a success.
   def merged_into_current_branch?(runner, repo:, branch:)
-    return false if Bridge.blank?(repo) || Bridge.blank?(branch)
+    return false if blank?(repo) || blank?(branch)
     runner.run("-C", repo, "merge-base", "--is-ancestor", branch, "HEAD").success?
   rescue StandardError
     false
@@ -106,12 +109,12 @@ module ExecWorktree
   # The lock-owner fallback is correct here: this is a teardown step on an intent this
   # session has been delivering.
   def resolve_session(explicit, env_session, intent_dir)
-    return explicit.to_s.strip unless Bridge.blank?(explicit)
-    return env_session.to_s.strip unless Bridge.blank?(env_session)
+    return explicit.to_s.strip unless blank?(explicit)
+    return env_session.to_s.strip unless blank?(env_session)
     lock = Lock.read(intent_dir)
     return nil unless lock
     owner = lock["owner_session"].to_s
-    Bridge.blank?(owner) ? nil : owner
+    blank?(owner) ? nil : owner
   end
 
   # --- result builders (the exit_code/stdout/stderr shape the thin CLIs share) --------
@@ -181,7 +184,7 @@ module ExecWorktree
     merge_line =
       if disposition != "delivered"
         "not attempted (abandoned)"
-      elsif Bridge.blank?(target_branch)
+      elsif blank?(target_branch)
         "merged (integration target branch could not be resolved)"
       else
         "merged into #{target_branch}"
@@ -202,10 +205,10 @@ module ExecWorktree
           runner: Worktree::ShellRunner.new,
           finisher: Worktree.method(:finish),
           status_checker: default_status_checker)
-    return usage_result("--store is required") if Bridge.blank?(store)
-    return usage_result("--id is required") if Bridge.blank?(id)
-    return usage_result("--home is required") if Bridge.blank?(home)
-    return usage_result("--disposition is required") if Bridge.blank?(disposition)
+    return usage_result("--store is required") if blank?(store)
+    return usage_result("--id is required") if blank?(id)
+    return usage_result("--home is required") if blank?(home)
+    return usage_result("--disposition is required") if blank?(disposition)
     unless DISPOSITIONS.include?(disposition)
       return usage_result("--disposition must be one of #{DISPOSITIONS.join('|')} (got #{disposition.inspect})")
     end
@@ -220,16 +223,16 @@ module ExecWorktree
 
     # Step 0: session resolution + pre-flight refusal (D3-mirroring; see resolve_session).
     key_session = resolve_session(session, env_session, intent_dir)
-    if Bridge.blank?(key_session) && File.exist?(Lock.path(intent_dir))
+    if blank?(key_session) && File.exist?(Lock.path(intent_dir))
       return deny_result(EXIT_UNRESOLVED, no_session_message(intent_dir))
     end
 
-    bridge_data = Arm.bridge_hash(intent_dir: intent_dir, home: normalized_home)
-    worktree_code = bridge_data.dig("worktree", "code")
-    return ok_result(nothing_provisioned_message(intent_dir)) if Bridge.blank?(worktree_code)
+    delivery = Arm.delivery(intent_dir: intent_dir, home: normalized_home)
+    worktree_code = delivery.dig("worktree", "code")
+    return ok_result(nothing_provisioned_message(intent_dir)) if blank?(worktree_code)
 
-    branch = bridge_data.dig("worktree", "code_branch")
-    # Captured now, before `finisher.call` below (Worktree.finish) deletes the bridge's
+    branch = delivery.dig("worktree", "code_branch")
+    # Captured now, before `finisher.call` below (Worktree.finish) deletes the delivery's
     # `worktree` block, so the post-finish merge verification (BLOCKING 1/2) still has
     # both `repo` and `branch` to work with.
     repo = repo_from_worktree_code(worktree_code)
@@ -254,7 +257,7 @@ module ExecWorktree
     # disposition only, whether the worktree directory still exists on disk (teardown
     # incomplete); second, for a delivered disposition only, whether the branch actually
     # merged (BLOCKING 1/2, see merged_into_current_branch? above).
-    finisher.call(bridge_data, home: normalized_home, runner: runner,
+    finisher.call(delivery, home: normalized_home, runner: runner,
                   merge: disposition == "delivered")
 
     removed = !Dir.exist?(worktree_code)