@zalom/plastic 2.0.0-alpha.23 → 2.0.0-alpha.24

package/scripts/lib/worktree.rb

@@ -108,16 +108,16 @@ module Worktree
 
   # --- provisioning ----------------------------------------------------------
 
-  # Resolve the slug from the bridge's intent.store, create code + store
+  # Resolve the slug from the delivery's intent.store, create code + store
   # worktrees (idempotent: reuse an existing worktree path, do not error), write
-  # the `worktree` block plus `provisioned: true` onto bridge_data, return it.
+  # the `worktree` block plus `provisioned: true` onto delivery, return it.
   #
   # Fails open with a stderr log when the repo is non-git or unresolvable:
   # sets `provisioned: false` and leaves `code: null`. All git ops use
   # `git -C <resolved path>` -- never cwd (decision D6).
-  def provision(bridge_data, home: Dir.home, runner: ShellRunner.new)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    intent = bridge_data["intent"] || {}
+  def provision(delivery, home: Dir.home, runner: ShellRunner.new)
+    return delivery unless delivery.is_a?(Hash)
+    intent = delivery["intent"] || {}
     intent_id = intent["id"].to_s
     store = intent["store"].to_s
     intent_slug = slug_from_dir(intent["dir"]) || slug_from_dir(store)
@@ -173,15 +173,15 @@ module Worktree
     # replaced by the fresh unprovisioned block; the guard must not fail harder
     # than the bug it guards.
     if code_ok
-      bridge_data["worktree"] = block
+      delivery["worktree"] = block
     else
-      existing = bridge_data["worktree"]
+      existing = delivery["worktree"]
       keep = existing.is_a?(Hash) && !blank?(existing["code"]) &&
              Dir.exist?(existing["code"].to_s)
-      bridge_data["worktree"] = block unless keep
+      delivery["worktree"] = block unless keep
     end
 
-    bridge_data
+    delivery
   end
 
   # Remove the worktree (then `git worktree prune`), clear the worktree block.
@@ -189,21 +189,21 @@ module Worktree
   # policy on top via `finish`; this is the plain remove. Pass `remove: false` to
   # clear the block WITHOUT touching git (so `finish` can merge first, then call
   # release to drop the worktree once the code branch is integrated).
-  def release(bridge_data, home: Dir.home, runner: ShellRunner.new, remove: true)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    block = bridge_data["worktree"]
-    return bridge_data unless block.is_a?(Hash)
+  def release(delivery, home: Dir.home, runner: ShellRunner.new, remove: true)
+    return delivery unless delivery.is_a?(Hash)
+    block = delivery["worktree"]
+    return delivery unless block.is_a?(Hash)
 
     if remove
-      slug = slug_for_store(bridge_data.dig("intent", "store").to_s, home: home)
+      slug = slug_for_store(delivery.dig("intent", "store").to_s, home: home)
       repo = repo_for(slug, home: home)
 
       remove_worktree(runner, repo: repo, worktree: block["code"]) if repo && block["code"]
       prune(runner, repo: repo) if repo
     end
 
-    bridge_data.delete("worktree")
-    bridge_data
+    delivery.delete("worktree")
+    delivery
   end
 
   # --- cleanup policy (merge-vs-remove) -------------------------------------
@@ -222,19 +222,19 @@ module Worktree
   # Fail-open and idempotent throughout: a missing block, missing branch, or any
   # git failure never raises and never blocks teardown. All git ops use
   # `git -C <path>`, never cwd (decision D6). No-op when nothing was provisioned.
-  def finish(bridge_data, home: Dir.home, runner: ShellRunner.new, merge: false)
-    return bridge_data unless bridge_data.is_a?(Hash)
-    block = bridge_data["worktree"]
-    return bridge_data unless block.is_a?(Hash)
+  def finish(delivery, home: Dir.home, runner: ShellRunner.new, merge: false)
+    return delivery unless delivery.is_a?(Hash)
+    block = delivery["worktree"]
+    return delivery unless block.is_a?(Hash)
 
     if merge
-      slug = slug_for_store(bridge_data.dig("intent", "store").to_s, home: home)
+      slug = slug_for_store(delivery.dig("intent", "store").to_s, home: home)
       repo = repo_for(slug, home: home)
       branch = block["code_branch"]
       merge_branch(runner, repo: repo, branch: branch) if repo && !blank?(branch)
     end
 
-    release(bridge_data, home: home, runner: runner, remove: true)
+    release(delivery, home: home, runner: runner, remove: true)
   end
 
   # Merge `branch` into the repo's default branch from the main checkout. The
@@ -298,8 +298,8 @@ module Worktree
   # --- lock ------------------------------------------------------------------
 
   # True iff ANOTHER session's delivery.lock is FRESH on this intent's dir
-  # (intent 108, D2): the durable lock file decides; /tmp bridges are not
-  # consulted and no pid is probed. current_session being the owner or a
+  # (intent 108, D2): the durable lock file decides alone, and no pid is
+  # probed. current_session being the owner or a
   # delegate does not count as "other". A stale lock does not hold (explicit
   # takeover reclaims it).
   def lock_held_by_other?(intent_id:, store:, current_session:, home: Dir.home,

package/scripts/lib/worktree_sweep.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require_relative "worktree"
-require_relative "bridge"
+require_relative "index_entry"
 
 # WorktreeSweep -- the one-time orphan sweep for store worktrees retired by
 # intent 178 (D2). Pure candidate classification plus a thin apply step, both
@@ -62,7 +62,7 @@ module WorktreeSweep
 
   # The INDEX.md section heading (e.g. "Active", "Completed") that lists this
   # intent dir, or nil if no INDEX.md entry links to it. Reuses
-  # Bridge.index_entry_match so this never drifts from the shared parser.
+  # IndexEntry.match so this never drifts from the shared parser.
   def index_status(intent_dir, name)
     store = File.dirname(intent_dir)
     index = File.join(File.dirname(store), "INDEX.md")
@@ -75,7 +75,7 @@ module WorktreeSweep
         section = stripped.sub(/\A##\s*/, "").strip
         next
       end
-      m = Bridge.index_entry_match(stripped)
+      m = IndexEntry.match(stripped)
       next unless m
       return section if m[3].to_s.include?(name)
     end

package/scripts/{node-packet → node-input}

@@ -2,30 +2,30 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
-require_relative "lib/node_packet"
+require_relative "lib/node_input"
 require_relative "lib/savepoint"
 
-# node-packet - the CLI over NodePacket (intent 338, G5). Builds one node's
-# whole input from disk and writes it to packets/<node>--a<N>.packet (or
+# node-input - the CLI over NodeInput (intent 338, G5). Builds one node's
+# whole input from disk and writes it to attempts/<node>--a<N>.input (or
 # --out), printing a parsable summary and the exact node-transition running
 # command intent 340's runner should record.
 #
 # Usage:
-#   node-packet <intent_dir> --node <id> [--budget N] [--hop-tokens N]
+#   node-input <intent_dir> --node <id> [--budget N] [--hop-tokens N]
 #               [--holder H] [--expires E] [--model M] [--attempt N]
 #               [--out PATH] [--force]
 #
 # Exit codes (spec D17, shared with node-transition's family):
-#   0 - the packet was written (or the identical bytes already existed)
+#   0 - the node input was written (or the identical bytes already existed)
 #   2 - usage: not an intent directory, missing --node, or an unknown node
 #   3 - an unreadable, cyclic or unparsable graph, node file, or record
 #   4 - overflow past the third cut; nothing was written
 #   5 - an existing attempt file whose bytes differ; nothing was written
-module NodePacketCLI
+module NodeInputCLI
   module_function
 
   def usage
-    warn "Usage: node-packet <intent_dir> --node <id> [--budget N] [--hop-tokens N] " \
+    warn "Usage: node-input <intent_dir> --node <id> [--budget N] [--hop-tokens N] " \
          "[--holder H] [--expires E] [--model M] [--attempt N] [--out PATH] [--force]"
   end
 
@@ -42,7 +42,7 @@ module NodePacketCLI
     intent_dir_arg = args.shift
 
     unless intent_directory?(intent_dir_arg && File.expand_path(intent_dir_arg))
-      warn "node-packet: #{intent_dir_arg.inspect} is not an intent directory"
+      warn "node-input: #{intent_dir_arg.inspect} is not an intent directory"
       usage
       exit 2
     end
@@ -50,7 +50,7 @@ module NodePacketCLI
 
     node = opt(args, "--node")
     if node.to_s.strip.empty?
-      warn "node-packet: --node is required"
+      warn "node-input: --node is required"
       usage
       exit 2
     end
@@ -64,11 +64,11 @@ module NodePacketCLI
     model = opt(args, "--model")
     force = args.include?("--force")
 
-    result = NodePacket.build(
+    result = NodeInput.build(
       intent_dir: intent_dir,
       node: node,
-      budget_tokens: budget ? budget.to_i : NodePacket::DEFAULT_BUDGET_TOKENS,
-      hop_tokens: hop_tokens ? hop_tokens.to_i : NodePacket::DEFAULT_HOP_TOKENS,
+      budget_tokens: budget ? budget.to_i : NodeInput::DEFAULT_BUDGET_TOKENS,
+      hop_tokens: hop_tokens ? hop_tokens.to_i : NodeInput::DEFAULT_HOP_TOKENS,
       holder: holder,
       expires: expires,
       model: model,
@@ -78,15 +78,15 @@ module NodePacketCLI
     )
 
     if result[:ok]
-      puts NodePacket.summary_line(result)
+      puts NodeInput.summary_line(result)
       puts result[:running_command]
       exit 0
     end
 
-    Array(result[:errors]).each { |e| warn "node-packet: #{e}" }
+    Array(result[:errors]).each { |e| warn "node-input: #{e}" }
     puts result[:needs_decision_command] if result[:needs_decision_command]
     exit result[:exit_code]
   end
 end
 
-NodePacketCLI.main(ARGV) if $PROGRAM_NAME == __FILE__
+NodeInputCLI.main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/node-run

@@ -8,7 +8,7 @@ require "yaml"
 require "fileutils"
 require_relative "lib/savepoint"
 require_relative "lib/node_ledger"
-require_relative "lib/node_packet"
+require_relative "lib/node_input"
 require_relative "lib/node_worktree"
 require_relative "lib/node_file"
 require_relative "lib/ready_set"
@@ -19,9 +19,9 @@ require_relative "lib/codex_adapter"
 #
 # On Claude Code a subagent dispatch IS the executor; on Codex the executor
 # is a subprocess, so this script owns the timing of a whole node: it reads
-# the node's live `running` line, resolves the packet that line names,
+# the node's live `running` line, resolves the node input that line names,
 # builds the `codex exec` argv for the node's kind (CodexAdapter), runs it
-# in the node's worktree with the packet on stdin, reads the executor's
+# in the node's worktree with the node input on stdin, reads the executor's
 # final message, and writes it to the attempt's own return path.
 #
 # It writes NO ledger transition, on any path - success, refusal or error
@@ -41,8 +41,8 @@ require_relative "lib/codex_adapter"
 #   2 - usage: not an intent directory, or missing --node
 #   3 - the node has no live `running` line
 #   4 - the running line is held by another session
-#   5 - the packet the running line names is missing from disk
-#   6 - the packet on disk does not hash to the running line's packet=
+#   5 - the node input the running line names is missing from disk
+#   6 - the node input on disk does not hash to the running line's input=
 #   7 - no worktree could be resolved to run in
 module NodeRunCLI
   module_function
@@ -60,12 +60,12 @@ module NodeRunCLI
     dir && File.directory?(dir) && File.exist?(Savepoint.intent_file(dir))
   end
 
-  # <intent_dir>/packets/<node>--a<N>.return.yml (spec): beside the packet,
-  # one per attempt, the same treatment packet files already get - never
+  # <intent_dir>/attempts/<node>--a<N>.return.yml (spec): beside the node input,
+  # one per attempt, the same treatment input files already get - never
   # reused across attempts, so a second attempt's return can never be
   # mistaken for the first's.
   def return_path(intent_dir, node, attempt)
-    File.join(intent_dir, "packets", "#{node}--a#{attempt}.return.yml")
+    File.join(intent_dir, "attempts", "#{node}--a#{attempt}.return.yml")
   end
 
   # The node's own declared kind, read straight off its node file - "work"
@@ -167,25 +167,25 @@ module NodeRunCLI
 
     kind = resolve_kind(intent_dir, node)
 
-    # matrix row 6.11: the attempt number comes from NodePacket's own
+    # matrix row 6.11: the attempt number comes from NodeInput's own
     # counter, never a hand count. `lease_flag_given: false` because the
     # running line this attempt is acting on ALREADY exists on disk (it is
     # what we just read above) - counting it a second time would double it
     # (the same count, plus one, that produced it in the first place when
-    # the packet was originally built).
-    attempt = NodePacket.compute_attempt_number(intent_dir: intent_dir, node: node, lease_flag_given: false)
-    packet_path = NodePacket.packet_path(intent_dir: intent_dir, node: node, attempt: attempt)
+    # the node input was originally built).
+    attempt = NodeInput.compute_attempt_number(intent_dir: intent_dir, node: node, lease_flag_given: false)
+    input_path = NodeInput.input_path(intent_dir: intent_dir, node: node, attempt: attempt)
 
-    unless File.exist?(packet_path)
-      warn "node-run: #{node}'s packet is missing at #{packet_path}"
+    unless File.exist?(input_path)
+      warn "node-run: #{node}'s node input is missing at #{input_path}"
       exit 5
     end
 
-    packet_bytes = File.binread(packet_path)
-    actual_sha = Digest::SHA256.hexdigest(packet_bytes)[0, 12]
-    expected_sha = fields["packet"]
+    input_bytes = File.binread(input_path)
+    actual_sha = Digest::SHA256.hexdigest(input_bytes)[0, 12]
+    expected_sha = fields["input"]
     unless expected_sha && actual_sha == expected_sha
-      warn "node-run: #{node}'s packet at #{packet_path} does not hash to packet=#{expected_sha.inspect} " \
+      warn "node-run: #{node}'s node input at #{input_path} does not hash to input=#{expected_sha.inspect} " \
            "(computed #{actual_sha})"
       exit 6
     end
@@ -203,7 +203,7 @@ module NodeRunCLI
     timeout_seconds = timeout_flag ? timeout_flag.to_i : CodexAdapter.timeout_seconds(kind)
     codex_argv = CodexAdapter.build_argv(kind: kind, worktree: worktree, output_last_message: message_path)
 
-    result = CodexAdapter.execute(codex_argv, stdin_data: packet_bytes, timeout_seconds: timeout_seconds,
+    result = CodexAdapter.execute(codex_argv, stdin_data: input_bytes, timeout_seconds: timeout_seconds,
                                    output_last_message_path: message_path)
 
     # matrix rows 6.20-6.22: a nonzero exit or a timeout is authoritative -

package/scripts/plastic-lock

@@ -19,12 +19,11 @@
 #                 corrupt lock with the resolving doctor hint
 #   who           compact, read-only durable owner/activity view
 #   status        report the lock file, its freshness, the derived worktree,
-#                 whether this session's pointer names the intent, and any
-#                 live per-artifact claims
+#                 whether this session is the one delivering the intent, and
+#                 any live per-artifact claims
 #   fix           idempotent repair of the lock for the current session; never
 #                 touches a fresh foreign lock
-#   release       owner clears the lock and points the session back at the day
-#                 ledger (End tail / abandoning a boarding)
+#   release       owner clears the lock (End tail / abandoning a boarding)
 #   reclaim       explicit takeover of a stale lock, audited in savepoint.md
 #   delegate      owner registers a subagent session under the lock (D4)
 #   claim         acquire the named --artifact's claim token (intent 111);
@@ -32,18 +31,18 @@
 #                 including this same session; takes over a stale claim
 #   release-claim free the named --artifact's claim token
 #
-# Without --intent-dir the intent is resolved from this session's pointer
-# (~/.plastic/store/.tmp/<session>/current) when it names an intent id, looked
-# up in the working directory's project store and then the global store. The
-# /tmp bridge JSON this CLI used to resolve through was removed in 2.0
-# (intent 307). Exit 0 on success/report; exit 1 when the verb is blocked.
+# Without --intent-dir the intent is resolved from this session's held
+# delivery lock (ActiveDelivery.resolve over the global store and the
+# configured project roots): exactly one fresh lock this session owns or
+# delegates for. Session resolution no longer reads any per-session state
+# file; that path was retired in 2.0 (intent 307) and 344 G11.
+# Exit 0 on success/report; exit 1 when the verb is blocked.
 
 require "json"
 require "yaml"
-require_relative "lib/bridge"
 require_relative "lib/lock"
 require_relative "lib/arm"
-require_relative "lib/session_ledger"
+require_relative "lib/active_delivery"
 
 VERBS = %w[arm status who fix release reclaim delegate claim release-claim].freeze
 
@@ -88,16 +87,7 @@ hint_harness = harness || "claude"
 plastic_home_env = ENV["PLASTIC_HOME"].to_s.strip
 home = plastic_home_env.empty? ? Dir.home : File.dirname(File.expand_path(plastic_home_env))
 
-# The stores this session's pointer is resolved against: the project store of
-# the working directory (projects.yml, longest path match), then the global one.
-def candidate_stores(home, cwd)
-  plastic_home = File.join(home, ".plastic")
-  stores = []
-  slug = SessionLedger.project_slug(cwd, plastic_home: plastic_home)
-  stores << File.join(plastic_home, "projects", slug, "store") if slug && slug != "global"
-  stores << File.join(plastic_home, "store")
-  stores
-end
+plastic_home = File.join(home, ".plastic")
 
 dir = opts[:dir]
 if dir.nil? || dir.strip.empty?
@@ -105,11 +95,21 @@ if dir.nil? || dir.strip.empty?
     warn "plastic-lock: #{verb} needs --intent-dir <intent dir>"
     exit 1
   end
-  dir = Arm.intent_dir_from_pointer(session, home: home, stores: candidate_stores(home, Dir.pwd))
-end
-if dir.nil?
-  warn "plastic-lock: no intent resolved; pass --intent-dir <intent dir>"
-  exit 1
+  roots = ActiveDelivery.project_roots(plastic_home)
+  global_store = File.join(plastic_home, "store")
+  dir = ActiveDelivery.resolve(global_store: global_store, project_roots: roots, session: session)
+  if dir.nil?
+    candidates = ActiveDelivery.candidate_intent_dirs(global_store: global_store, project_roots: roots).uniq
+    held = candidates.select do |candidate|
+      Lock.fresh?(candidate) && Lock.holds?(candidate, session: session)
+    end
+    if held.size > 1
+      warn "plastic-lock: more than one held delivery lock names this session; pass --intent-dir <intent dir>"
+    else
+      warn "plastic-lock: no intent resolved; pass --intent-dir <intent dir>"
+    end
+    exit 1
+  end
 end
 dir = File.expand_path(dir)
 
@@ -144,7 +144,7 @@ if verb == "who"
   exit 0
 end
 
-intent_id = Bridge.intent_id_from_dir(dir)
+intent_id = Arm.intent_id_for(dir)
 store = File.dirname(dir)
 key = Arm.resolve_session(session, store: store, intent_id: intent_id)
 
@@ -163,7 +163,7 @@ when "arm"
     puts JSON.pretty_generate(
       "intent_dir" => dir, "session" => result[:session], "status" => result[:status].to_s,
       "run_mode" => result[:lock] && result[:lock]["run_mode"],
-      "worktree" => wt, "pointer" => result[:pointer]
+      "worktree" => wt
     )
   when :held
     warn "plastic-lock: delivery lock for intent #{intent_id} is held by session " \
@@ -188,7 +188,10 @@ when "arm"
   end
 when "status"
   lock = Lock.read(dir)
-  pointer = Arm.read_pointer(key, home: home)
+  resolved = ActiveDelivery.resolve(global_store: File.join(plastic_home, "store"),
+                                    project_roots: ActiveDelivery.project_roots(plastic_home),
+                                    session: key)
+  delivering = !resolved.nil? && File.expand_path(resolved) == File.expand_path(dir)
   report = {
     "intent_dir" => dir,
     "session" => key,
@@ -196,8 +199,7 @@ when "status"
     "lock_fresh" => Lock.fresh?(dir),
     "lock_corrupt" => Lock.corrupt?(dir),
     "worktree" => Arm.worktree_block(intent_dir: dir, home: home),
-    "pointer" => pointer,
-    "pointer_names_intent" => pointer == intent_id,
+    "delivering" => delivering,
     "claims" => Claim.claims_status(dir),
   }
   puts JSON.pretty_generate(report)
@@ -217,7 +219,6 @@ when "release"
     warn "plastic-lock: not the owner; run plastic-lock status"
     exit 1
   end
-  Arm.reset_pointer(key, intent_id, home: home)
   puts "released (#{result})"
 when "reclaim"
   status, lock_data = Lock.takeover(dir, session: key, harness: harness,

package/scripts/runner

@@ -412,7 +412,7 @@ module Runner
     exit(exit_code)
   end
 
-  # Row 1.24: lives beside savepoint.md, never inside packets/ (which the
+  # Row 1.24: lives beside savepoint.md, never inside attempts/ (which the
   # reaper treats as attempt evidence). Row 1.32: registers itself in the
   # store's own top-level `.gitignore` (Worktree.ensure_gitignored's own
   # idempotent, non-raising append) the same way `*.lock` already is, so a

package/skills/auto/SKILL.md

@@ -46,10 +46,10 @@ QMD-first (when available): when the user describes the work instead of naming a
 ## Take the intent (do this FIRST)
 
 Immediately after selecting the intent, take it for this session. One verb acquires the durable
-`delivery.lock` in the intent directory (stamped `run_mode: auto`), provisions the code worktree
-at `<repo>/.claude/worktrees/{id}--{slug}` on branch `plastic/{id}--{slug}`, and points this
-session at the intent (`~/.plastic/store/.tmp/<session>/current`), so the record hook writes
-savepoint lines and heartbeats for it instead of the day ledger:
+`delivery.lock` in the intent directory (stamped `run_mode: auto`) and provisions the code worktree
+at `<repo>/.claude/worktrees/{id}--{slug}` on branch `plastic/{id}--{slug}`; the delivery lock
+names this session as the one delivering the intent, so the record hook writes savepoint lines
+and heartbeats for it instead of the day ledger:
 
 ```bash
 codex="${CODEX_THREAD_ID:-}"; claude="${CLAUDE_CODE_SESSION_ID:-}"
@@ -78,7 +78,7 @@ for work small enough to skip speccing, delivered inline with no separate plan r
 is no intent tier and no stage agent; depth follows the work.
 
 `runner step` computes readiness and prints a spawn block per dispatched node - agent, model,
-packet path, the test command, the call cap - fenced for a session to paste into the Agent
+node input path, the test command, the call cap - fenced for a session to paste into the Agent
 tool; the runner never spawns (327 D42). `runner status` renders the ledger; `runner answer`
 closes a `needs_decision` node.
 
@@ -259,8 +259,8 @@ Read `../plastic-conventions/references/completion-and-done.md` for what "intent
 4. Review `## Insights` for observations that should become future intents; create them through
    `plastic-intent-creating` and update `chain`.
 5. Close through `plastic-intent-ending`, which runs `scripts/end-intent`: outcome, INDEX,
-   savepoint, the store commit, and the disarm (the worktree released, `delivery.lock` cleared,
-   the session pointer back on the day ledger), then the QMD reindex last and the single owner
+   savepoint, the store commit, and the disarm (the worktree released, `delivery.lock`
+   cleared), then the QMD reindex last and the single owner
    report. Pass `--session` and `--index-note`:
    ```bash
    ruby ~/.plastic/scripts/end-intent --store <store_path> --id <ID> --disposition delivered \

package/skills/auto/references/end-tail.md

@@ -2,8 +2,8 @@
 
 Deep mechanics behind two spots in `SKILL.md`: how `plastic-lock arm` resolves a session id
 when it takes an intent, and why the End-tail steps in Completion (release the worktree, clear
-the lock, reset the pointer, reindex) run in that exact order. The `/tmp` bridge JSON these
-steps once also purged was removed in 2.0 (intent 307); `scripts/lib/arm.rb` is what remains.
+the lock, reindex) run in that exact order. `scripts/lib/arm.rb` carries the arm, disarm, and
+repair operations.
 
 ## Table of Contents
 
@@ -22,18 +22,16 @@ session-less close resolve to the same key.
 Arming acquires the durable `delivery.lock` in the intent dir, keyed by that resolved session
 and stamped with `run_mode`. Ownership is session-keyed, not process-keyed, so the arm command
 exiting is fine by construction: the lock stays yours for every later tool call in this
-session, and the record hook refreshes its lease on every write you make. The same call writes
-the intent id into the session pointer (`~/.plastic/store/.tmp/<session>/current`), which is
+session, and the record hook refreshes its lease on every write you make. Holding that lock is
 why the capture and record hooks stop treating your prompts as day-ledger items for the rest
 of the delivery.
 
 ## Disarm ordering and worktree cleanup rationale
 
 `Arm.disarm` runs the ordered End tail: it releases the worktree first, then clears the
-intent's `delivery.lock` as its recorded owner, and only then resets the session pointer to
-today's day id (when it still names this intent). The worktree goes first so a released lock
-never points at a checkout another session could claim; the pointer goes last so the record
-hook keeps heartbeating the lock until the lock is gone.
+intent's `delivery.lock` as its recorded owner. The worktree goes first so a released lock
+never points at a checkout another session could claim; the lock goes last so the record
+hook keeps heartbeating it until the delivery is actually done.
 
 **Mechanized since intent 188.** `scripts/end-intent` performs this disarm itself, as its own
 step 5, after steps 1-4 (outcome/INDEX/savepoint/commit) commit. A pre-flight lock guard
@@ -52,10 +50,10 @@ survives and can be reclaimed).
 When the work is being shipped through a release, do NOT rely on this plain remove.
 `skills/releasing/SKILL.md` runs its worktree-merge step BEFORE its `end-intent` call, merging
 the intent's code branch (`plastic/{id}--{slug}`) back to the repo's default branch BEFORE
-the worktree is removed, via `Worktree.finish(Arm.bridge_hash(intent_dir: ...), merge: true)`
+the worktree is removed, via `Worktree.finish(Arm.delivery(intent_dir: ...), merge: true)`
 (merge-then-remove), so the integrated work is not lost. By the time `end-intent`'s own step 5
-runs afterward, the worktree is already gone (a harmless no-op) and only the delivery lock and
-the pointer are left to clear. Never leave an orphaned worktree, and run `git worktree prune`
+runs afterward, the worktree is already gone (a harmless no-op) and only the delivery lock is
+left to clear. Never leave an orphaned worktree, and run `git worktree prune`
 if you hit a stale reference.
 
 ## QMD reindex ordering rationale

package/skills/conventions/references/completion-and-done.md

@@ -17,10 +17,10 @@ self-declares its disposition through a `disposition: delivered|abandoned` front
 header. The delivered path authors it with the result; the abandoned path authors it with
 the abandonment reason and no longer leaves the scaffolded placeholder sentinel in place.
 
-The canonical End tail runs in this order, and the QMD reindex is always LAST, after the
-purge: `outcome.md -> INDEX terminal -> the terminal savepoint line -> commit -> disarm
-(Worktree.release -> Lock.release -> purge) -> QMD reindex`. Running the reindex last keeps the index from
-ever referencing a bridge or lock that disarm is about to remove.
+The canonical End tail runs in this order: `outcome.md -> INDEX terminal -> the terminal
+savepoint line -> commit -> disarm (Worktree.release -> Lock.release) -> QMD reindex`, the
+reindex always LAST. Running the reindex last keeps the index from ever referencing a lock
+that disarm just removed.
 
 `scripts/end-intent` performs this order's disarm step (verify the code worktree is clean,
 then merge/remove worktrees, then clear the lock) as its own step 5, mechanically, since
@@ -31,12 +31,11 @@ foreign session, reclaims a stale one with an audit line), and a dirty code work
 refuses before removal rather than force-discarding uncommitted changes.
 
 The post-done access window is lock-bounded: `[INDEX terminal -> Lock.release]`. Through it
-the completing session keeps full read and write access to the terminal directory and no
-purge can fire (108's lock-held keep-guard keeps the bridge while `delivery.lock` exists).
-Once the lock is released the window closes: the bridge becomes purge-eligible and the
-directory is frozen. A crash mid-tail is recovered by stale-lock reclaim plus finishing the
-tail; `doctor` surfaces this as a "stalled completion" (terminal in INDEX but the lock is
-still present or stale). Finishing the tail is FINISHING a completion, never a reactivation:
+the completing session keeps full read and write access to the terminal directory (108's
+lock-held keep-guard holds it open while `delivery.lock` exists). Once the lock is released
+the window closes and the directory is frozen. A crash mid-tail is recovered by stale-lock
+reclaim plus finishing the tail; `doctor` surfaces this as a "stalled completion" (terminal in
+INDEX but the lock is still present or stale). Finishing the tail is FINISHING a completion, never a reactivation:
 a done intent is never moved back to `## Active`.
 
 One report per audience: a delivery produces `outcome.md` plus one EM-to-CTO owner report, and

package/skills/conventions/references/knowledge-graph.md

@@ -50,7 +50,7 @@ This chapter holds the linking doctrine from Frontmatter and the branch-vs-root
 
 A thing is named after the concept family it lives under. A node is a graph-engineering
 concept, so its name comes from graph engineering (node, edge, ready set, critical path),
-from the Plastic concepts coined on top of it (intent, ledger, packet, lease, gate, runner),
+from the Plastic concepts coined on top of it (intent, ledger, node input, lease, gate, runner),
 and from the software and AI engineering concepts those rest on (review, fix, test, verify,
 dispatch, executor, reviewer). A name from outside that stack is refused. Where no existing
 concept fits, that is a design finding to raise, not a word to coin.