@zalom/plastic 2.0.0-alpha.9 → 2.0.1

package/scripts/lib/data_boundary.rb

@@ -0,0 +1,132 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+require "digest"
+
+# DataBoundary (intent 338, G5, n1): the trust boundary a node input is
+# built over. A data block carries text other agents and the owner wrote,
+# and is opened by `<<<PLASTIC-DATA:<token> label="..." source="...">>>` and
+# closed by `<<<END-PLASTIC-DATA:<token>>>`. The token is content-derived
+# (spec D4), so the same payloads always produce the same token and the
+# node input stays deterministic; the escaping rule (spec D5) runs on every
+# payload independently of the token, so a payload carrying this node input's
+# own closing marker still cannot close its block. Attribute values
+# (`label`, `source`) are sanitized separately, by a whitelist (spec D5a),
+# because they are not payload text and the payload escaping rule does not
+# cover them.
+#
+# Pure and side-effect-free: no I/O, no clock, nothing raised across the
+# boundary. `estimate_tokens` is the one arithmetic every budget in this
+# delivery is spent in (spec D6): bytes over four, rounded.
+module DataBoundary
+  module_function
+
+  MARKER_OPEN = "<<<PLASTIC-DATA:"
+  MARKER_CLOSE = "<<<END-PLASTIC-DATA:"
+  ATTR_MAX = 200
+
+  # The attribute whitelist (spec D5a): anything outside this class becomes
+  # `_`. A quote, an angle bracket, a backslash, a newline and a carriage
+  # return are therefore all impossible in a marker line.
+  ATTR_SAFE_CHARS_RE = %r{[^A-Za-z0-9 _.,:#/@+=-]}.freeze
+
+  OPEN_LINE_RE = /\A#{Regexp.escape(MARKER_OPEN)}([0-9a-f]+) label="([^"]*)" source="([^"]*)">>>\z/.freeze
+  CLOSE_LINE_RE = /\A#{Regexp.escape(MARKER_CLOSE)}([0-9a-f]+)>>>\z/.freeze
+
+  # The first twelve hex characters of the SHA-256 over the payloads joined
+  # by a newline (spec D4): fixed per node input, unguessable from any single
+  # record file, deterministic across two builds of the same payloads.
+  def boundary_token(payloads)
+    Digest::SHA256.hexdigest(Array(payloads).map(&:to_s).join("\n"))[0, 12]
+  end
+
+  # One-way marker escaping (spec D5), plus a UTF-8 scrub (matrix 1.10) so
+  # one invalid byte anywhere in a record never raises the whole node input
+  # build. Runs regardless of what token trails the marker text, because a
+  # payload copied from an earlier node input may carry ANY token, not only this
+  # one (matrix 1.2's concern applied to escaping rather than to the token
+  # itself).
+  def escape(payload)
+    text = payload.to_s.scrub
+    text = text.gsub(MARKER_OPEN) { "<<<\\PLASTIC-DATA:" }
+    text.gsub(MARKER_CLOSE) { "<<<\\END-PLASTIC-DATA:" }
+  end
+
+  # Whitelist-sanitize and truncate a marker attribute value (spec D5a).
+  # Every character outside the whitelist becomes `_`; the result is
+  # truncated to ATTR_MAX characters, so neither a hostile value nor a
+  # multi-kilobyte one can escape or bloat a marker line.
+  def attr_safe(value)
+    value.to_s.scrub.gsub(ATTR_SAFE_CHARS_RE, "_")[0, ATTR_MAX]
+  end
+
+  # One complete, closed data block ending in a newline. The payload is
+  # escaped and scrubbed first; both markers sit alone on their own line
+  # (matrix 1.4), even when the payload is empty (matrix 1.9).
+  def wrap(payload, label:, source:, token:)
+    body = escape(payload)
+    body += "\n" unless body.empty? || body.end_with?("\n")
+    open_line = "#{MARKER_OPEN}#{token} label=\"#{attr_safe(label)}\" source=\"#{attr_safe(source)}\">>>\n"
+    close_line = "#{MARKER_CLOSE}#{token}>>>\n"
+    "#{open_line}#{body}#{close_line}"
+  end
+
+  # [{label:, source:, payload:}], in order. Matches markers case-sensitively
+  # (matrix 1.16: no `/i`, ever) and closes a block only on a close marker
+  # whose token matches the block's own opening token, so a stray marker for
+  # a different token found mid-payload (which the escaping rule already
+  # makes unreachable from real payload text) is never mistaken for this
+  # block's close.
+  def unwrap(text)
+    lines = text.to_s.each_line.to_a
+    blocks = []
+    i = 0
+    while i < lines.length
+      m = lines[i].chomp("\n").match(OPEN_LINE_RE)
+      unless m
+        i += 1
+        next
+      end
+
+      token, label, source = m[1], m[2], m[3]
+      payload_lines = []
+      i += 1
+      while i < lines.length
+        cm = lines[i].chomp("\n").match(CLOSE_LINE_RE)
+        break if cm && cm[1] == token
+
+        payload_lines << lines[i]
+        i += 1
+      end
+      blocks << { label: label, source: source, payload: payload_lines.join }
+      i += 1
+    end
+    blocks
+  end
+
+  # Disarm any line that is, on its own, a complete open or close marker
+  # (intent 338 post-execution review, finding A2). Blocks 1 and 5 are
+  # instruction, raw-interpolated rather than wrapped, on the grounds that
+  # they are orchestrator- and project-record-authored; that trust does not
+  # extend to `release.verify` in project.yml, which the owner and other
+  # agents write. `escape` already disarms every occurrence of the marker
+  # substring wherever it falls, but a marker sitting mid-line (matrix 1.5's
+  # convention of quoting a matrix row verbatim inside a node file) is
+  # already harmless, because `unwrap` only recognizes a marker that is the
+  # WHOLE line. Rewriting a harmless mid-line quote would be needless churn
+  # on instruction text an owner reads, so only a line that fully matches
+  # `OPEN_LINE_RE` or `CLOSE_LINE_RE` gets `escape`'s backslash treatment.
+  def neutralize_marker_lines(text)
+    text.to_s.each_line.map do |line|
+      chomped = line.chomp("\n")
+      chomped.match?(OPEN_LINE_RE) || chomped.match?(CLOSE_LINE_RE) ? escape(line) : line
+    end.join
+  end
+
+  # (bytes / 4.0).round (spec D6): the estimate G10 measures against. Taken
+  # over bytesize, never characters, so multi-byte text is never
+  # under-counted.
+  def estimate_tokens(text)
+    (text.to_s.bytesize / 4.0).round
+  end
+end

package/scripts/lib/day_summary.rb

@@ -8,10 +8,12 @@
 # heartbeat. Never the raw ledger (296 D36). No environment reads; every
 # path is injected.
 
+require_relative "store_layout"
 require "time"
 require_relative "session_ledger"
 require_relative "handoff"
 require_relative "lock"
+require_relative "active_delivery"
 require_relative "report_screen"
 
 module DaySummary
@@ -43,7 +45,7 @@ module DaySummary
       open: open_items(store, day),
       done: last_done(store, day),
       live: live_intents(home, now: now),
-      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl),
+      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl, home: home),
     }
     hidden = Hash.new(0)
     cap!(lists, hidden, :open, OPEN_CAP, keep: :newest)
@@ -81,10 +83,10 @@ module DaySummary
   # The global store plus every projects/<slug>/store, each with its INDEX
   # one level up, the way doctor enumerates them.
   def stores(home)
-    list = [[File.join(home, "INDEX.md"), File.join(home, "store")]]
-    projects_root = File.join(home, "projects")
+    list = [[File.join(Plastic::StoreLayout.global_root(home), "INDEX.md"), Plastic::StoreLayout.global_store(home)]]
+    projects_root = Plastic::StoreLayout.projects_root(home)
     if File.directory?(projects_root)
-      Dir.children(projects_root).sort.each do |slug|
+      Plastic::StoreLayout.project_slugs(home).each do |slug|
         list << [File.join(projects_root, slug, "INDEX.md"), File.join(projects_root, slug, "store")]
       end
     end
@@ -142,7 +144,7 @@ module DaySummary
     "(no savepoint yet)"
   end
 
-  def active_sessions(store, session, now:, ttl:)
+  def active_sessions(store, session, now:, ttl:, home: nil)
     tmp_root = SessionLedger.tmp_root(store)
     return [] unless File.directory?(tmp_root)
 
@@ -155,7 +157,7 @@ module DaySummary
       age = heartbeat_age(dir, now)
       next if age.nil? || age > ttl
 
-      "- #{sid} (#{(age / 60).floor}m ago, on #{pointer_of(dir)})"
+      "- #{sid} (#{(age / 60).floor}m ago, on #{delivering_label(store, home, sid, now)})"
     end
   rescue SystemCallError
     []
@@ -178,14 +180,21 @@ module DaySummary
     nil
   end
 
-  def pointer_of(dir)
-    path = File.join(dir, "current")
-    return "?" unless File.file?(path)
-
-    value = File.read(path).strip
-    value.empty? ? "?" : value[0, 80]
-  rescue SystemCallError
-    "?"
+  # The delivering intent's id, or "day ledger" (344 n2, D4-D7): the
+  # basename before "--" of ActiveDelivery.resolve_by_short_session's
+  # match, else the session records into today's day ledger.
+  def delivering_label(store, home, sid, now)
+    return "day ledger" if home.to_s.empty?
+
+    dir = ActiveDelivery.resolve_by_short_session(
+      global_store: store,
+      project_roots: ActiveDelivery.project_roots(home),
+      short_session: sid,
+      now: now
+    )
+    dir ? File.basename(dir).split("--", 2).first : "day ledger"
+  rescue StandardError
+    "day ledger"
   end
 
   # --- rendering, pure -------------------------------------------------------------

package/scripts/lib/doctor_core.rb

@@ -8,12 +8,13 @@
 # the store, conventions, intent and CLI halves, so Doctor stays one class with
 # one public surface and one definition of which checks are core (intent 36a).
 
+require_relative "store_layout"
 require "json"
 require "yaml"
 require "time"
 require "digest"
-require "rubygems"
 
+require_relative "version_number"
 require_relative "hook_registry"
 require_relative "compact_instructions"
 
@@ -27,10 +28,16 @@ class Doctor
     "hermes" => { name: "Hermes",      dir: File.join(Dir.home, ".hermes") },
   }.freeze
 
-  # The Claude events hooks_registered expects in settings.json: the six-event map of
+  # The Claude events hooks_registered expects in settings.json: the eight-event map of
   # cut-inventory 3b (intent 309 added SessionEnd, registered for close since intent 301;
-  # intent 316a added MessageDisplay, registered for message-display, Claude only).
-  CLAUDE_HOOK_EVENTS = %w[SessionStart PreCompact PostToolUse UserPromptSubmit SessionEnd MessageDisplay].freeze
+  # intent 316a added MessageDisplay, registered for message-display, Claude only; intent
+  # 355 added PreToolUse, registered for call-budget, Claude only; intent 340b added Stop,
+  # registered for stop, Claude only). Stop's registration is static (D5/D7) even though
+  # its runtime arm defaults off (D9, runner.stop_hook), so an install missing it is
+  # exactly as broken as one missing PreCompact, and this list keeps hooks_registered and
+  # hooks_match_registry agreeing on that (row 4.32).
+  CLAUDE_HOOK_EVENTS = %w[SessionStart PreToolUse PreCompact PostToolUse UserPromptSubmit SessionEnd
+                          MessageDisplay Stop].freeze
 
   # Launchers the installer places in the agent's hooks dir that are NOT hooks
   # (intent 204): plastic-statusline is the settings["statusLine"] command, wired
@@ -91,8 +98,19 @@ class Doctor
 
     JSON.parse(File.read(path))
   rescue JSON::ParserError
-    content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
-    JSON.parse(content)
+    # The comment/trailing-comma-stripped retry below can itself raise
+    # JSON::ParserError on genuinely malformed content (a truncated file, or
+    # plain garbage). A nested begin/rescue is required here because a
+    # method-level `rescue` clause never catches an exception raised from
+    # INSIDE a sibling rescue clause's own body (only from the main body).
+    # Without this nesting a malformed settings.json crashes doctor instead
+    # of reporting a clean fail (intent 331e, F5).
+    begin
+      content = File.read(path).gsub(%r{//[^\n]*}, "").gsub(/,(\s*[}\]])/, '\1')
+      JSON.parse(content)
+    rescue
+      nil
+    end
   rescue
     nil
   end
@@ -284,7 +302,7 @@ class Doctor
       return checks
     end
 
-    index_path = File.join(plastic_home, "INDEX.md")
+    index_path = File.join(Plastic::StoreLayout.global_root(plastic_home), "INDEX.md")
     if File.exist?(index_path)
       checks << check(
         category: "global_store", name: "global_index_reachable", status: "pass",
@@ -395,7 +413,7 @@ class Doctor
         fix_hint: "Re-run the Plastic installer: npx @zalom/plastic@latest --claude (prunes " \
                   "stale launchers). The plastic- prefix is reserved for Plastic's own hooks: " \
                   "if one of these is yours, rename it (for example to ~/.claude/hooks/" \
-                  "writing-style) and re-register it in settings.json before re-running."
+                  "plain-writing) and re-register it in settings.json before re-running."
       )
     end
 
@@ -500,9 +518,6 @@ class Doctor
       checks << hooks_entries_owned_check(settings)
     end
 
-    # skills_exist — flat, hyphen-namespaced personal skills (plastic-<name>/)
-    checks << flat_skills_check(agent_dir, "--claude")
-
     # stray_skills — installed plastic-* skill dir with no manifest entry (a leftover,
     # e.g. an old-name copy after a rename; intent 158a AC15)
     checks << stray_skills_check(agent_dir, "--claude", File.join(agent_dir, "plastic", "manifest.json"))
@@ -613,24 +628,6 @@ class Doctor
     )
   end
 
-  def flat_skills_check(agent_dir, installer_flag)
-    skills_root = File.join(agent_dir, "skills")
-    found = Dir.glob(File.join(skills_root, "plastic-*", "SKILL.md"))
-
-    if !found.empty?
-      check(
-        category: "agent_registration", name: "skills_exist", status: "pass",
-        message: "#{found.size} plastic-* skill(s) installed in #{tilde(skills_root)}"
-      )
-    else
-      check(
-        category: "agent_registration", name: "skills_exist", status: "fail",
-        message: "No plastic-* skills found in #{tilde(skills_root)}",
-        fixable: true, fix_hint: "Re-run the Plastic installer: npx @zalom/plastic@latest #{installer_flag}"
-      )
-    end
-  end
-
   # Manifest-diff stray-skill check (intent 158a), extended (intent 276) to
   # never vanish on a missing manifest and to name the reserved-prefix rule.
   def stray_skills_check(agent_dir, installer_flag, manifest_path)
@@ -690,9 +687,6 @@ class Doctor
   def check_flat_skills_and_stray(agent_key, agent_dir)
     checks = []
 
-    # For codex/hermes: just check skills exist (no settings.json hooks)
-    checks << flat_skills_check(agent_dir, "--#{agent_key}")
-
     # stray_skills — installed plastic-* skill dir with no manifest entry (a leftover,
     # e.g. an old-name copy after a rename; intent 158a AC15)
     checks << stray_skills_check(agent_dir, "--#{agent_key}", File.join(agent_dir, "plastic", "manifest.json"))
@@ -1044,9 +1038,7 @@ class Doctor
   end
 
   def safe_version(str)
-    Gem::Version.new(str.to_s)
-  rescue ArgumentError
-    nil
+    VersionNumber.parse(str)
   end
 
   def check_core_files(agent_key, include_drift: true)
@@ -1150,7 +1142,7 @@ class Doctor
               "#{tilde(agent_version_path)}: #{agent_version}",
             ],
             fixable: true,
-            fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or plastic-rollback to a prior version"
+            fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or `plastic rollback` to a prior version"
           )
         end
       else
@@ -1158,7 +1150,7 @@ class Doctor
           category: "core_files", name: "version_match", status: "warn",
           message: "Agent-side VERSION file not found at #{tilde(agent_version_path)}",
           fixable: true,
-          fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or plastic-rollback to a prior version"
+          fix_hint: "Re-sync the stale harness: npx @zalom/plastic@latest install --reinstall <flag>, or `plastic rollback` to a prior version"
         )
       end
     end
@@ -1240,15 +1232,99 @@ class Doctor
   # agent_model_drift, no store-content scanning).
   def run_core_checks(agent_key)
     all_checks = []
-    all_checks += check_agent_registration(agent_key)
+    all_checks += check_agent_registration(agent_key).reject { |c| c[:name] == "codex_hooks_trust" }
     all_checks += check_core_files(agent_key, include_drift: false)
     all_checks += check_manifest_sync(agent_key)
     all_checks += check_registered_project_paths
     all_checks += check_global_store_available
+    all_checks += check_display_registration(agent_key)
 
     summarize(all_checks, agent_key, binary: true)
   end
 
+  # The single `hooks/<name>` launcher basename for the MessageDisplay event,
+  # derived from HookRegistry rather than hand-kept (intent 331e), so a
+  # future rename of the hook stays in one place. Shared by
+  # check_display_registration (below, boot path) and scripts/doctor.rb's
+  # check_display_paints (full run), which resolves the SAME name under the
+  # agent_dir it was given.
+  def display_hook_launcher_name
+    group = HookRegistry.events["MessageDisplay"].first
+    "plastic-#{group['hooks'].first['name']}"
+  end
+
+  DISPLAY_HOOK_FIX_HINT = "Re-run the Plastic installer to repair the hook registration: " \
+                          "npx @zalom/plastic@<channel> install --reinstall --claude " \
+                          "(plastic install --reinstall)".freeze
+
+  # display_hook_registered (intent 331e, D1, category "display"): the Claude
+  # settings carry the plastic-message-display command, on-disk, executable.
+  # Boot-path safe: resolves everything from the injected `agents` hash and
+  # `plastic_home`, never Dir.home or a real ~/.claude (E18). This is the same
+  # discipline check_claude_registration already follows.
+  #
+  # D3: a harness Doctor knows carries no display hook (Codex, Hermes) is a
+  # pass, not a fail, worded "plain by contract" like the paint check's own
+  # skip (scripts/doctor.rb's check_display_paints).
+  def check_display_registration(agent_key)
+    config = agents[agent_key]
+    unless agent_key == "claude"
+      return [check(
+        category: "display", name: "display_hook_registered", status: "pass",
+        message: "#{config[:name]} is plain by contract; no MessageDisplay hook to register"
+      )]
+    end
+
+    agent_dir = config[:dir]
+    settings_path = File.join(agent_dir, "settings.json")
+    settings = read_json_safe(settings_path)
+
+    if settings.nil?
+      return [check(
+        category: "display", name: "display_hook_registered", status: "fail",
+        message: "Cannot read #{tilde(settings_path)}: file missing or invalid",
+        fixable: true, fix_hint: DISPLAY_HOOK_FIX_HINT
+      )]
+    end
+
+    hooks = settings["hooks"].is_a?(Hash) ? settings["hooks"] : {}
+    commands = event_commands(hooks["MessageDisplay"])
+    launcher_name = display_hook_launcher_name
+
+    registered = commands.any? { |cmd| HookRegistry.command_basenames(cmd).include?(launcher_name) }
+
+    unless registered
+      return [check(
+        category: "display", name: "display_hook_registered", status: "fail",
+        message: "No MessageDisplay hook registered in #{tilde(settings_path)}",
+        fixable: true, fix_hint: DISPLAY_HOOK_FIX_HINT
+      )]
+    end
+
+    launcher_path = File.join(agent_dir, "hooks", launcher_name)
+
+    unless File.exist?(launcher_path)
+      return [check(
+        category: "display", name: "display_hook_registered", status: "fail",
+        message: "MessageDisplay is registered but #{tilde(launcher_path)} does not exist",
+        fixable: true, fix_hint: DISPLAY_HOOK_FIX_HINT
+      )]
+    end
+
+    unless File.executable?(launcher_path)
+      return [check(
+        category: "display", name: "display_hook_registered", status: "fail",
+        message: "#{tilde(launcher_path)} exists but is not executable",
+        fixable: true, fix_hint: DISPLAY_HOOK_FIX_HINT
+      )]
+    end
+
+    [check(
+      category: "display", name: "display_hook_registered", status: "pass",
+      message: "MessageDisplay hook registered and #{tilde(launcher_path)} is executable"
+    )]
+  end
+
   def check_registered_project_paths
     checks = []
 

package/scripts/lib/doctor_session_ledger.rb

@@ -1,6 +1,7 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
+require_relative "store_layout"
 require "time"
 require_relative "session_ledger"
 
@@ -15,21 +16,12 @@ require_relative "session_ledger"
 # heartbeat is only refreshed on prompts and edits, so an old heartbeat is evidence, not
 # proof, that the session is gone. Fail-open: an unreadable directory is skipped, never
 # raised. Depends on the including class for `plastic_home` and `check`.
+#
+# Intent 344 (G11, D10): the third check this category used to carry,
+# `no_pointer_session_tmp`, is retired along with the per-session state it read.
 module DoctorSessionLedger
   ORPHAN_TTL_SECONDS = 24 * 60 * 60
 
-  # Row H (spec D9): a `.tmp/<sid>/` directory with no `current` pointer is a
-  # DIFFERENT orphan class than ORPHAN_TTL_SECONDS's -- a session where
-  # session start never ran at all (a `-p` print session, a resumed
-  # background job, an unregistered SessionStart hook), not a session that
-  # ran and then never closed. No choice of session id ever creates a
-  # pointer for that class, so it would otherwise stay invisible for the
-  # full 24 hours (or forever, once hook-capture/hook-record stop creating
-  # it at all). Short relative to ORPHAN_TTL_SECONDS on purpose: a session
-  # between its own start and its first pointer write is normal and must not
-  # be flagged, but that window is seconds, not hours.
-  NO_POINTER_TTL_SECONDS = 5 * 60
-
   # Seconds since the session's last heartbeat: the ISO-8601 content of `heartbeat`,
   # else that file's mtime, else the directory's mtime.
   def heartbeat_age(dir, now)
@@ -47,9 +39,8 @@ module DoctorSessionLedger
   def check_session_ledger(scopes: nil, now: Time.now)
     return [] unless scopes.nil? || scopes.include?("global")
 
-    store_dir = File.join(plastic_home, "store")
+    store_dir = Plastic::StoreLayout.global_store(plastic_home)
     orphans = orphaned_session_dirs(store_dir, now)
-    no_pointer = no_pointer_session_dirs(store_dir, now)
     shape = day_ledger_shape_problems(store_dir)
 
     checks = []
@@ -67,20 +58,6 @@ module DoctorSessionLedger
                                 "session is gone: a live session rewrites its heartbeat on every " \
                                 "prompt and edit, so only a listed directory may be removed, by hand.")
               end
-    checks << if no_pointer.empty?
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "pass",
-                      message: "No .tmp/<session>/ directory has gone without a `current` pointer for " \
-                               "longer than #{NO_POINTER_TTL_SECONDS} seconds")
-              else
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "warn",
-                      message: "#{no_pointer.size} .tmp/<session>/ director#{no_pointer.size == 1 ? "y" : "ies"} " \
-                               "with no `current` pointer for longer than #{NO_POINTER_TTL_SECONDS} seconds " \
-                               "(session start never ran for this session)",
-                      details: no_pointer, fixable: true,
-                      fix_hint: "Remove each listed .tmp/<session>/ directory after confirming that " \
-                                "session never started: no `current` pointer means session start never " \
-                                "ran for it, so this is not a live session missing a checklist entry.")
-              end
     checks << if shape.empty?
                 check(category: "session_ledger", name: "day_ledger_shape", status: "pass",
                       message: "Every .sessions/ entry is a YYYYMMDD day directory with its <day>.md file")
@@ -113,31 +90,6 @@ module DoctorSessionLedger
     [] # unreadable .tmp/: nothing to report, never a crash
   end
 
-  # Row H (spec D9): `.tmp/<sid>/` directories with no `current` pointer, past
-  # NO_POINTER_TTL_SECONDS. A different signal than #orphaned_session_dirs:
-  # that one is age-only and blind to whether a pointer exists at all, so a
-  # young no-pointer dir (a session between its start and its first pointer
-  # write) must not appear here even though it may well appear there once it
-  # ages past ORPHAN_TTL_SECONDS -- the two checks answer different questions
-  # and a dir can legitimately show up in neither, either, or both.
-  def no_pointer_session_dirs(store_dir, now)
-    tmp_root = SessionLedger.tmp_root(store_dir)
-    return [] unless File.directory?(tmp_root)
-
-    Dir.children(tmp_root).sort.filter_map do |name|
-      dir = File.join(tmp_root, name)
-      next unless File.directory?(dir)
-      next if File.exist?(File.join(dir, "current"))
-
-      age = heartbeat_age(dir, now)
-      next if age <= NO_POINTER_TTL_SECONDS
-
-      "global: #{dir} (session #{name}, no `current` pointer, last heartbeat #{age.round}s ago)"
-    end
-  rescue SystemCallError
-    [] # unreadable .tmp/: nothing to report, never a crash
-  end
-
   def day_ledger_shape_problems(store_dir)
     root = SessionLedger.sessions_root(store_dir)
     return [] unless File.directory?(root)

package/scripts/lib/engine_permissions.rb

@@ -0,0 +1,88 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# EnginePermissions: the engine deny rule (intent 340b, G7c, n3). A permissions.deny
+# block merged into settings.json at install so the engine directories are not
+# editable by a dispatched agent (C25's self-preservation half).
+#
+# Claude Code accepts a Write(...) path rule and never consults it: Edit(...) is the
+# rule that covers Write, MultiEdit and NotebookEdit. Every entry below names Edit,
+# never Write, and every entry ends in /** because a bare directory path matches the
+# directory itself, not the files under it.
+#
+# This is a second ownership mechanism, deliberately not a reuse of HookRegistry's
+# merge, which knows its own entries by a plastic- launcher basename inside a command
+# string. A deny entry is a bare string with no marker in it, so ownership here is
+# exact-string membership in ENTRIES. The consequence is deliberate: an entry the
+# owner has edited no longer matches the frozen string, so it is the owner's from
+# that point on - the merge appends Plastic's own alongside it, and removal leaves
+# the edited one in place untouched.
+#
+# Pure functions only: no file I/O here. InstallerCore#merge_engine_permissions and
+# #remove_engine_permissions own the read-modify-write against settings.json,
+# mirroring the split HookRegistry keeps from merge_claude_hooks.
+module EnginePermissions
+  module_function
+
+  ENTRIES = [
+    "Edit(~/.plastic/scripts/**)",
+    "Edit(~/.plastic/skills/**)",
+    "Edit(~/.plastic/hooks/**)",
+    "Edit(~/.plastic/templates/**)",
+  ].freeze
+
+  # Returns a new settings hash with ENTRIES merged into permissions.deny, appended
+  # (never duplicated) alongside whatever is already there. Survives a permissions
+  # or deny value that is not the shape expected (row 3.12): a non-Hash permissions
+  # value or a non-Array deny value is replaced rather than raised on. Never
+  # mutates the argument.
+  def merge_into(settings)
+    settings = settings.is_a?(Hash) ? settings.dup : {}
+
+    permissions = settings["permissions"]
+    permissions = permissions.is_a?(Hash) ? permissions.dup : {}
+
+    deny = permissions["deny"]
+    deny = deny.is_a?(Array) ? deny.dup : []
+
+    ENTRIES.each { |entry| deny << entry unless deny.include?(entry) }
+
+    permissions["deny"] = deny
+    settings["permissions"] = permissions
+    settings
+  end
+
+  # Returns a new settings hash with exactly the ENTRIES strings removed from
+  # permissions.deny, leaving every other entry (the owner's own deny rules, and
+  # any Plastic entry the owner has since edited) untouched. Prunes the deny array
+  # once it is empty, and the whole permissions block once nothing else remains
+  # under it (row 3.10). A settings/permissions/deny shape that is not what is
+  # expected is left alone rather than raised on (row 3.12's uninstall side).
+  def remove_from(settings)
+    return settings unless settings.is_a?(Hash)
+
+    permissions = settings["permissions"]
+    return settings unless permissions.is_a?(Hash)
+
+    deny = permissions["deny"]
+    return settings unless deny.is_a?(Array)
+
+    settings = settings.dup
+    permissions = permissions.dup
+    deny = deny.reject { |entry| ENTRIES.include?(entry) }
+
+    if deny.empty?
+      permissions.delete("deny")
+    else
+      permissions["deny"] = deny
+    end
+
+    if permissions.empty?
+      settings.delete("permissions")
+    else
+      settings["permissions"] = permissions
+    end
+
+    settings
+  end
+end