@zalom/plastic 2.0.1 → 2.0.2

package/agents/plastic-enforcer.md

@@ -21,7 +21,7 @@ deliberately; the auto pipeline never dispatches them.
 
 ## Your Responsibilities
 
-1. **Take the intent** - `plastic-lock arm` acquires the delivery lock, provisions the code
+1. **Take the intent** - `plastic auto take ID` acquires the delivery lock, provisions the code
    worktree, and points this session at the intent; work only inside that worktree.
 2. **Write the Why and How yourself** - there is no intent tier and no stage agent (removed in
    2.0, intent 304): record the rulings, write `spec.md`, then `plan.md`, at least one real

package/bin/plastic

@@ -1,6 +1,8 @@
 #!/usr/bin/env -S ruby --disable-gems
 # frozen_string_literal: true
 
+ENV["PLASTIC_PACKAGE_ROOT"] = File.expand_path("..", __dir__)
+
 require_relative "../scripts/lib/cli"
 
 exit Plastic::CLI.call(ARGV)

package/docs/help/completion-and-done.md

@@ -22,8 +22,19 @@ savepoint line -> commit -> disarm (Worktree.release -> Lock.release) -> QMD rei
 reindex always LAST. Running the reindex last keeps the index from ever referencing a lock
 that disarm just removed.
 
+`scripts/end-intent` never merges code. Before a delivered close writes anything, it checks
+that the intent's code is already merged into the current branch of the repo checkout. It
+checks the commit the code worktree is on, even when that worktree is on a renamed branch or
+a detached HEAD, and it checks the code branch after the worktree is gone. The repo checkout
+must be on the branch you release from, not detached and not on the code branch. If the code
+isn't merged, or Git can't tell, the close exits 9 and changes nothing: INDEX, the savepoint, the
+lock, and the worktree all stay as they were. `--dry-run` refuses the same way. The refusal
+names the merge to run, for example `git -C <repo> merge plastic/<id>--<slug>`. Run that
+ordinary merge, or release the work through your usual process, and then run the close
+again. An abandoned close and an intent with no code repository skip this check.
+
 `scripts/end-intent` performs this order's disarm step (verify the code worktree is clean,
-then merge/remove worktrees, then clear the lock) as its own step 5, mechanically, since
+then remove the worktree, then clear the lock) as its own step 5, mechanically, since
 intent 188: a session no longer needs a separate one-liner for it, and the script's own
 exit code (0) is the single fact a caller needs that the intent is closed AND its delivery
 lock is gone. A pre-flight lock guard runs before anything is written (refuses a live

package/docs/help/roadmaps.md

@@ -11,8 +11,9 @@ use `plastic roadmap show`, `next`, `log`, and `check` to read, drive, and audit
 
 File location: `roadmaps/{slug}.md`, a sibling of `INDEX.md`, wherever `INDEX.md` lives, never
 inside `store/` (store holds intent directories, not project artifacts). For a project that is its
-root, `~/.plastic/projects/{slug}/roadmaps/`, beside `project.yml`; for the global tier it is
-`~/.plastic/roadmaps/`, beside `~/.plastic/INDEX.md`. `roadmaps/` lists only live (open or
+root, `~/.plastic/stores/{slug}/roadmaps/`, beside `project.yml`; for the global store it is
+`~/.plastic/stores/global/roadmaps/`, beside its `INDEX.md`. Legacy homes keep their
+previous paths until `plastic migrate stores` moves them. `roadmaps/` lists only live (open or
 in-flight) roadmaps: once a roadmap's goal is reached, it moves to `roadmaps/archived/{slug}.md`,
 a sibling subdirectory scaffolded once with a `.gitkeep`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalom/plastic",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Intent-driven idea development system for AI coding agents",
   "type": "module",
   "bin": {

package/scripts/end-intent

@@ -50,6 +50,10 @@
 #      the durable lock file is actually gone afterward, and release it directly
 #      when a foreign-keyed disarm left it.
 #
+# A delivered close never merges code. Its code branch must already be merged
+# into the repo checkout's current branch, or the close refuses before any
+# write (exit 9).
+#
 # Exit codes:
 #   0  ok - the intent is closed and no delivery.lock remains.
 #   1  usage/resolution failure, OR an id that resolves to neither ## Active
@@ -67,13 +71,27 @@
 #   6  retired in 2.0 (intent 308): the structure check reports and proceeds.
 #   7  hollow delivered report refused (317a D7) - intent 308's one deliberate
 #      exception to report-and-proceed; --allow-hollow-report overrides.
+#   8  delivered close of an untouched scaffold refused (acceptance N3):
+#      nothing was worked, so there is nothing to deliver. Close it as
+#      abandoned, or do the work first. Authors nothing.
+#   9  delivered close refused because its code branch is not merged into the
+#      repo checkout's current branch. Refused before any write: nothing is
+#      merged, written, or released. Merge the branch, then run the close again.
+#
+# --dry-run runs the same refusals as the real close (exits 8, 9, 7 and 5 with
+# a "would refuse" line) and writes nothing: the hollow-report gate is judged
+# on a scratch copy that went through the same outcome generation and
+# backfill.
 
 require_relative "lib/store_layout"
 require "fileutils"
 require "date"
 require "open3"
+require "stringio"
+require "tmpdir"
 require "pathname"
 require_relative "lib/arm"
+require_relative "lib/exec_worktree"
 require_relative "lib/index_entry"
 require_relative "lib/savepoint"
 require_relative "lib/lock"
@@ -82,6 +100,8 @@ require_relative "lib/outcome_guard"
 require_relative "lib/report_screen"
 require_relative "lib/backfill_intent"
 require_relative "lib/outcome_report"
+require_relative "lib/untouched_scaffold"
+require_relative "lib/scaffold_intent"
 
 DISPOSITIONS = %w[delivered abandoned].freeze
 
@@ -665,32 +685,10 @@ def run_disarm(intent_dir, id, session, discard_worktree_changes:,
   block = worktree_reader.call(intent_dir)
   worktree_code = block.is_a?(Hash) ? block["code"] : nil
 
-  if worktree_code && Dir.exist?(worktree_code)
-    begin
-      out, err, status = Open3.capture3("git", "-C", worktree_code, "status", "--porcelain")
-    rescue StandardError => e
-      out, err, status = nil, e.message, nil
-    end
-
-    # Fail CLOSED (intent 188, post-review hardening). A failed or impossible
-    # `git status` (corrupt per-worktree index, git missing from PATH, not a
-    # repo) means we cannot PROVE the worktree is clean, and the removal below
-    # force-removes on a plain `git worktree remove` failure, which destroys
-    # uncommitted work. Never force-remove an unproven worktree: the guard
-    # exists to protect uncommitted code, so an inconclusive check must refuse,
-    # not silently proceed as if it were clean.
-    if status.nil? || !status.success?
-      unless discard_worktree_changes
-        warn "end-intent: could not inspect the code worktree at #{worktree_code} " \
-             "(git status failed: #{err.to_s.strip}); refusing to remove it, because " \
-             "removal would force-discard any uncommitted work. Pass " \
-             "--discard-worktree-changes to remove it anyway, or repair the worktree."
-        return :dirty
-      end
-    elsif !out.strip.empty? && !discard_worktree_changes
-      warn "end-intent: code worktree #{worktree_code} has uncommitted changes; refusing " \
-           "to remove it. Pass --discard-worktree-changes to force the close deliberately, " \
-           "or commit/stash the changes and re-run."
+  unless discard_worktree_changes
+    refusal = worktree_refusal(worktree_code)
+    if refusal
+      warn refusal
       return :dirty
     end
   end
@@ -758,6 +756,173 @@ def run_disarm(intent_dir, id, session, discard_worktree_changes:,
   :lock_remains
 end
 
+# The disarm step's dirty-worktree guard, as a message (nil when the worktree
+# is clean or absent). Shared by run_disarm and --dry-run so the preview
+# refuses exactly what the close refuses.
+#
+# Fail CLOSED (intent 188, post-review hardening). A failed or impossible
+# `git status` (corrupt per-worktree index, git missing from PATH, not a
+# repo) means we cannot PROVE the worktree is clean, and the removal
+# force-removes on a plain `git worktree remove` failure, which destroys
+# uncommitted work. Never force-remove an unproven worktree: the guard
+# exists to protect uncommitted code, so an inconclusive check must refuse,
+# not silently proceed as if it were clean.
+def worktree_refusal(worktree_code)
+  return nil unless worktree_code && Dir.exist?(worktree_code)
+
+  begin
+    out, err, status = Open3.capture3("git", "-C", worktree_code, "status", "--porcelain")
+  rescue StandardError => e
+    out, err, status = nil, e.message, nil
+  end
+
+  if status.nil? || !status.success?
+    "end-intent: could not inspect the code worktree at #{worktree_code} " \
+      "(git status failed: #{err.to_s.strip}); refusing to remove it, because " \
+      "removal would force-discard any uncommitted work. Pass " \
+      "--discard-worktree-changes to remove it anyway, or repair the worktree."
+  elsif !out.strip.empty?
+    "end-intent: code worktree #{worktree_code} has uncommitted changes; refusing " \
+      "to remove it. Pass --discard-worktree-changes to force the close deliberately, " \
+      "or commit/stash the changes and re-run."
+  end
+end
+
+# True when the intent's code worktree carries any work: uncommitted changes
+# or commits past its base branch. Anything that cannot be proven reads as
+# changed, so an unreadable worktree never turns a close into a refusal.
+def worktree_changed?(intent_dir)
+  block = Arm.worktree_block(intent_dir: intent_dir)
+  code = block.is_a?(Hash) ? block["code"] : nil
+  return false unless code && Dir.exist?(code)
+
+  out, status = Open3.capture2e("git", "-C", code, "status", "--porcelain")
+  return true unless status.success? && out.strip.empty?
+
+  base = ScaffoldIntent.detect_base_branch(code)
+  return true if base.nil?
+
+  ahead, status = Open3.capture2e("git", "-C", code, "rev-list", "--count", "#{base}..HEAD")
+  !status.success? || ahead.strip != "0"
+rescue StandardError
+  true
+end
+
+# A delivered close whose code is not on the repo checkout's current branch,
+# as a refusal message (nil when it is, or for a store-only project).
+# end-intent never merges: the owner merges or releases the work, then runs
+# the close again. A real code worktree must prove that its HEAD commit is
+# merged, so a detached or renamed branch is still checked. The code branch
+# must be merged too, even after its worktree is gone. A git failure refuses.
+# A directory that is not a working git worktree, with no code branch, is left
+# to the dirty-worktree guard, which refuses what it cannot inspect.
+def unmerged_refusal(intent_dir, runner: Worktree::ShellRunner.new)
+  paths = Arm.code_paths(intent_dir: intent_dir)
+  code = paths["code"]
+  return nil if code.nil?
+
+  repo = ExecWorktree.repo_from_worktree_code(code)
+  unless runner.run("-C", repo, "rev-parse", "--git-dir").success?
+    # No .git at all is a project without code; a .git that Git cannot read is not.
+    return nil unless File.exist?(File.join(repo, ".git"))
+
+    return "could not inspect the Git repository #{repo}, so the code cannot be shown to be merged. " \
+      "Check the repository, then run the close again"
+  end
+
+  unmerged_worktree_head(runner, code, repo, paths["code_branch"]) ||
+    unmerged_branch(runner, repo, paths["code_branch"])
+end
+
+# True when `code` is the top of its own git work tree, not a plain
+# directory inside the repo or a broken checkout.
+def real_worktree?(runner, code)
+  return false unless File.directory?(code)
+
+  top = runner.run("-C", code, "rev-parse", "--show-toplevel")
+  top.success? && File.realpath(top.stdout.strip) == File.realpath(code)
+rescue SystemCallError
+  false
+end
+
+def unmerged_worktree_head(runner, code, repo, branch)
+  return nil unless real_worktree?(runner, code)
+
+  head = runner.run("-C", code, "rev-parse", "--verify", "--quiet", "HEAD^{commit}")
+  unless head.success?
+    return "could not read the HEAD commit of the code worktree #{code}, so its work cannot be " \
+      "shown to be merged. Commit it, merge it into the current branch of #{repo}, then run the close again"
+  end
+  sha = head.stdout.strip
+  on = runner.run("-C", code, "symbolic-ref", "--quiet", "--short", "HEAD")
+  name = on.success? ? on.stdout.strip : nil
+  ref = (name == branch) ? branch : sha[0, 12]
+  where = name ? "on branch #{name}" : "detached"
+  ancestry_refusal(runner, repo, sha, ref, "the code worktree #{code} (#{where} at #{sha[0, 12]})", branch)
+end
+
+def unmerged_branch(runner, repo, branch)
+  found = runner.run("-C", repo, "show-ref", "--verify", "--quiet", "refs/heads/#{branch}")
+  return nil if found.status == 1
+  unless found.success?
+    return "could not look up code branch #{branch} in #{repo}. Check the repository, then run the close again"
+  end
+  ancestry_refusal(runner, repo, branch, branch, "code branch #{branch}", branch)
+end
+
+# nil when `rev` is an ancestor of the branch the repo checkout is on, else a
+# refusal naming `what` and the ordinary merge of `ref` that fixes it.
+def ancestry_refusal(runner, repo, rev, ref, what, branch)
+  target = target_refusal(runner, repo, branch)
+  return target if target
+
+  check = runner.run("-C", repo, "merge-base", "--is-ancestor", rev, "HEAD")
+  return nil if check.success?
+
+  verdict = (check.status == 1) ? "is not merged into" : "could not be checked against"
+  "#{what} #{verdict} the current branch of #{repo}. " \
+    "Merge it there first (git -C #{repo} merge #{ref}), then run the close again"
+end
+
+# Integration means merged into a branch other than the code branch, so a
+# detached checkout, or one on the code branch itself, proves nothing.
+def target_refusal(runner, repo, branch)
+  on = runner.run("-C", repo, "symbolic-ref", "--quiet", "--short", "HEAD")
+  unless on.success?
+    return "the repo checkout #{repo} is not on a branch, so no branch holds the merged code. " \
+      "Check out the branch you release from, merge #{branch} into it, then run the close again"
+  end
+  return nil unless on.stdout.strip == branch
+
+  "the repo checkout #{repo} is on the code branch #{branch} itself, so the code is not merged anywhere. " \
+    "Check out the branch you release from, merge #{branch} into it, then run the close again"
+end
+
+# The hollow-report verdict the real close would reach, judged on a scratch
+# copy of the intent after the same outcome generation and backfill, so the
+# dry run writes nothing.
+def predicted_hollow_reason(intent_dir, store:, id:, disposition:, summary:)
+  return nil unless disposition == "delivered"
+
+  Dir.mktmpdir("end-intent-dry-run") do |scratch|
+    copy = File.join(scratch, File.basename(intent_dir))
+    FileUtils.cp_r(intent_dir, copy)
+    quietly do
+      run_generate_outcome(copy, disposition: disposition)
+      run_backfill(copy, store: store, id: id, disposition: disposition, summary: summary)
+    end
+    hollow_report_reason(copy, disposition)
+  end
+end
+
+def quietly
+  saved = $stderr
+  $stderr = StringIO.new
+  yield
+ensure
+  $stderr = saved
+end
+
 # --- main --------------------------------------------------------------------
 
 def main(argv)
@@ -810,7 +975,41 @@ def main(argv)
     exit 4
   end
 
+  # Nothing worked, nothing to deliver (acceptance N3). Before the dry run and
+  # before any write, so the preview and the close refuse together.
+  if disposition == "delivered"
+    untouched = UntouchedScaffold.reason(intent_dir, templates: BackfillIntent.load_templates,
+                                                     worktree_changed: method(:worktree_changed?))
+    if untouched
+      warn "end-intent: refusing to deliver an untouched scaffold: #{untouched}"
+      warn "end-intent: do the work first, or close it with --disposition abandoned"
+      exit 8
+    end
+
+    unmerged = unmerged_refusal(intent_dir)
+    if unmerged
+      warn "end-intent: #{opts[:dry_run] ? "dry run: would refuse" : "refusing"} a delivered close: #{unmerged}"
+      warn "end-intent: nothing was merged, written, or released"
+      exit 9
+    end
+  end
+
   if opts[:dry_run]
+    hollow = predicted_hollow_reason(intent_dir, store: store, id: id, disposition: disposition,
+                                                 summary: opts[:outcome_summary])
+    if hollow && !opts[:allow_hollow_report]
+      warn "end-intent: dry run: would refuse a hollow delivered close: #{hollow}"
+      exit 7
+    end
+    unless blank?(session) || opts[:discard_worktree_changes]
+      block = Arm.worktree_block(intent_dir: intent_dir)
+      refusal = worktree_refusal(block.is_a?(Hash) ? block["code"] : nil)
+      if refusal
+        warn "end-intent: dry run: would refuse at disarm (exit 5), after the store commit: " \
+             "#{refusal.delete_prefix("end-intent: ")}"
+        exit 5
+      end
+    end
     puts "end-intent: dry run for #{File.basename(intent_dir)} (#{disposition})"
     targets = BackfillIntent.targets_for(intent_dir)
     puts "  would backfill: #{targets.empty? ? "(nothing)" : targets.join(", ")}"

package/scripts/lib/arm.rb

@@ -81,12 +81,7 @@ module Arm
   # `{code, code_branch, provisioned}` derived from projects.yml and the
   # intent id: the same path provision creates, `provisioned` iff it exists.
   def worktree_block(intent_dir:, home: Dir.home)
-    dir = File.expand_path(intent_dir)
-    store = store_for(dir)
-    h = home_for(dir, home: home)
-    slug = Worktree.slug_for_store(store, home: h)
-    p = Worktree.paths(slug: slug, intent_id: intent_id_for(dir),
-                       intent_slug: Worktree.slug_from_dir(dir), home: h)
+    p = code_paths(intent_dir: intent_dir, home: home)
     code = p["code"]
     provisioned = !blank?(code) && Dir.exist?(code)
     {
@@ -96,6 +91,16 @@ module Arm
     }
   end
 
+  # The code worktree path and branch this intent would have, whether or not
+  # the worktree exists on disk (blank code for a store-only project).
+  def code_paths(intent_dir:, home: Dir.home)
+    dir = File.expand_path(intent_dir)
+    h = home_for(dir, home: home)
+    slug = Worktree.slug_for_store(store_for(dir), home: h)
+    Worktree.paths(slug: slug, intent_id: intent_id_for(dir),
+                   intent_slug: Worktree.slug_from_dir(dir), home: h)
+  end
+
   # Owner rule 2026-08-31: has this session already started a conversation?
   # A conversation session's tmp directory is made at boot under the global
   # store's `.tmp/`; a dispatched or headless session (a derived key) never
@@ -182,13 +187,19 @@ module Arm
 
   # --- repair ------------------------------------------------------------------
 
+  # A stale foreign lock is reclaimed only by an audited owner step, never by
+  # the session that found it.
+  def stale_hint(intent_id)
+    "reclaiming a stale lock is the owner's audited step; plastic auto lock status #{intent_id} shows it"
+  end
+
   # One idempotent repair (the lock half of the repair path):
   # remove a corrupt lock, back off from a fresh foreign lock (`held`), report
   # a stale foreign lock (`stale`) for the explicit reclaim verb, keep and
   # enrich an own lock, heartbeat a delegated one, acquire when none, and
   # provision the worktree so the repaired intent has its checkout.
   def repair(intent_dir:, session:, home: Dir.home, now: Time.now, harness: nil,
-             agent: nil, model: nil, thread: nil, run_mode: nil, hint_harness: nil,
+             agent: nil, model: nil, thread: nil, run_mode: nil,
              runner: Worktree::ShellRunner.new)
     dir = File.expand_path(intent_dir)
     h = home_for(dir, home: home)
@@ -208,11 +219,18 @@ module Arm
       end
       return { "status" => "stale", "owner" => lock["owner_session"],
                "actions" => actions, "session" => key,
-               "hint" => "run #{Lock.skill_ref('plastic-doctor', harness: hint_harness || harness)} " \
-                         "reclaim the lock to take over with an audit" }
+               "hint" => stale_hint(intent_id_for(dir)) }
     end
 
-    mode = blank?(run_mode) ? (lock && lock["run_mode"]) : run_mode.to_s
+    # A lock rebuilt from nothing (none, or a corrupt one removed) is an auto
+    # delivery's lock again; a kept lock keeps whatever mode it had.
+    mode = if !blank?(run_mode)
+      run_mode.to_s
+    elsif lock
+      lock["run_mode"]
+    else
+      "auto"
+    end
     if lock
       if lock["owner_session"].to_s == key.to_s
         lock_data = lock.dup

package/scripts/lib/cli/commands/auto_lock.rb

@@ -9,8 +9,9 @@ require_relative "../legacy"
 # Legacy). The verb comes first, then the id, since the verb is what the
 # table's two-token match consumes as part of the command name.
 #
-# `status` speaks JSON, so this command renders it as a screen and leaves the
-# document to `--json`. `fix` and `release` already report in prose.
+# `status` and `fix` speak JSON, so this command renders them as a screen and
+# leaves the document to `--json`. `release` already reports in prose. A lock
+# another session owns exits 3, which travels as a refusal.
 module Plastic
   class CLI
     module Commands
@@ -32,7 +33,11 @@ module Plastic
         def call
           raise Usage, "VERB must be one of #{VERBS.join(", ")}" unless VERBS.include?(verb)
 
-          (verb == "status") ? screen(report) : run_verb
+          case verb
+          when "status" then screen(report("status"))
+          when "fix" then options[:json] ? run_verb : fix_screen(report("fix"))
+          else run_verb
+          end
           @output.next_step(AFTER.fetch(verb).sub("ID", id.to_s), because: BECAUSE.fetch(verb))
         end
 
@@ -43,8 +48,8 @@ module Plastic
           raise Failure, "plastic-lock exited #{status}" unless status.zero?
         end
 
-        def report
-          text, status = legacy.capture("plastic-lock", "status", "--intent-dir", intent_dir)
+        def report(name)
+          text, status = legacy.capture("plastic-lock", name, "--intent-dir", intent_dir)
           raise Failure, "plastic-lock exited #{status}" unless status.zero?
 
           JSON.parse(text)
@@ -60,6 +65,13 @@ module Plastic
           @output.row("claims", Array(report["claims"]).map(&:to_s))
         end
 
+        def fix_screen(report)
+          lock = report["lock"] || {}
+          @output.row("lock", "#{report["status"]} by #{lock["owner_session"] || report["session"]}, " \
+                              "#{lock["run_mode"]} mode")
+          @output.row("actions", Array(report["actions"]).map(&:to_s))
+        end
+
         def lock_line(report)
           lock = report["lock"]
           return "corrupt, plastic auto lock fix #{id} rewrites it" if report["lock_corrupt"]

package/scripts/lib/cli/commands/auto_take.rb

@@ -1,30 +1,67 @@
 # frozen_string_literal: true
 
+require "json"
 require_relative "intent_command"
 
 # `plastic auto take` - arms the intent's delivery lock for this session
 # (`plastic-lock arm --intent-dir DIR --mode auto`, run through Legacy).
+# The lock records who took it: --harness, --agent, --model and --thread pass
+# through, and a Claude Code session names its harness when none is given.
+# plastic-lock answers in JSON, so this command renders it as a screen and
+# leaves the document to `--json`. A lock another session owns exits 3.
 module Plastic
   class CLI
     module Commands
       class AutoTake < IntentCommand
-        USAGE_LINE = "plastic auto take ID [--allow-inline] [--json]"
+        USAGE_LINE = "plastic auto take ID [--allow-inline] [--harness NAME] [--agent NAME] " \
+                     "[--model MODEL] [--thread ID] [--json]"
 
         SCRIPT = "plastic-lock"
         AFTER = "plastic auto brief ID"
         BECAUSE = "the preamble is the live state a taken intent is read from next"
+        PROVENANCE = %i[harness agent model thread].freeze
+
+        def call
+          return super if options[:json]
+
+          text, status = legacy.capture(SCRIPT, *script_arguments)
+          raise Failure, "#{SCRIPT} exited #{status}" unless status.zero?
+
+          screen(JSON.parse(text))
+          command, reason = after_run
+          @output.next_step(command, because: reason)
+        rescue JSON::ParserError
+          raise Failure, "#{SCRIPT} did not print a report"
+        end
 
         private
 
         def switches(parser)
           parser.on("--allow-inline") { @options[:allow_inline] = true }
+          PROVENANCE.each do |name|
+            parser.on("--#{name} VALUE") { |value| @options[name] = value }
+          end
         end
 
         def script_arguments
           args = ["arm", "--intent-dir", intent_dir, "--mode", "auto"]
+          provenance.each { |name, value| args.push("--#{name}", value) }
           args << "--allow-inline" if options[:allow_inline]
           args
         end
+
+        def provenance
+          given = PROVENANCE.to_h { |name| [name, options[name]] }
+          given[:harness] ||= "claude" if @env["CLAUDE_CODE_SESSION_ID"].to_s.strip != ""
+          given.compact
+        end
+
+        def screen(report)
+          worktree = report["worktree"] || {}
+          @output.row("intent", File.basename(report["intent_dir"].to_s))
+          @output.row("lock", "#{report["status"]} by #{report["session"]}, #{report["run_mode"]} mode")
+          @output.row("worktree", worktree["provisioned"] ? worktree["code"].to_s : "none")
+        end
       end
     end
   end

package/scripts/lib/cli/commands/doctor.rb

@@ -15,8 +15,8 @@ module Plastic
   class CLI
     module Commands
       class Doctor < InstallerVerb
-        USAGE_LINE = "plastic doctor [--core] [--store WHICH] [--json]"
-        FLAGS = %w[--core --store].freeze
+        USAGE_LINE = "plastic doctor [--core] [--agent claude|codex|hermes] [--store WHICH] [--json]"
+        FLAGS = %w[--core --agent --store].freeze
 
         SCRIPT = "doctor.rb"
         AFTER = "none"

package/scripts/lib/cli/commands/intent_command.rb

@@ -22,11 +22,16 @@ module Plastic
           status = legacy.run(self.class::SCRIPT, *script_arguments)
           raise Failure, "#{self.class::SCRIPT} exited #{status}" unless status.zero?
 
-          @output.next_step(self.class::AFTER.sub("ID", id.to_s), because: self.class::BECAUSE)
+          command, reason = after_run
+          @output.next_step(command, because: reason)
         end
 
         private
 
+        def after_run
+          [self.class::AFTER.sub("ID", id.to_s), self.class::BECAUSE]
+        end
+
         def id
           arguments.first
         end

package/scripts/lib/cli/commands/intent_end.rb

@@ -15,6 +15,15 @@ module Plastic
 
         REFUSAL_STATUS = 4
 
+        # end-intent's own refusals the agent can act on: the reason is theirs to
+        # fix, so they stay failures (exit 1), but each is named rather than
+        # surfaced as a bare exit code.
+        REFUSED = {
+          7 => "end-intent refused a hollow delivered close: write outcome.md's ## Delivered rows to match the action headings",
+          8 => "end-intent refused to deliver an untouched scaffold: do the work first, or close it with --abandoned",
+          9 => "end-intent refused a delivered close whose code is not merged: run the git merge it names in the repo, then run the close again"
+        }.freeze
+
         SUMMARY_GUIDANCE = [
           "a good summary is written for the reader deciding whether to merge, release, or accept",
           "delivered: what shipped, impact and risk first, in plain language, never the checklist",
@@ -28,9 +37,13 @@ module Plastic
 
           status = legacy.run("end-intent", *end_intent_arguments)
           raise Refusal, "end-intent needs the owner: the delivery lock is held" if status == REFUSAL_STATUS
-          raise Failure, "end-intent exited #{status}" unless status.zero?
+          raise Failure, REFUSED.fetch(status) { "end-intent exited #{status}" } unless status.zero?
 
-          @output.next_step("plastic status", because: "the intent moved out of Active")
+          if options[:dry_run]
+            @output.next_step("none", because: "the dry run wrote nothing and found nothing that would refuse the close")
+          else
+            @output.next_step("plastic status", because: "the intent moved out of Active")
+          end
         end
 
         private

package/scripts/lib/cli/commands/intent_step.rb

@@ -16,6 +16,7 @@ module Plastic
         SCRIPT = "runner"
         AFTER = "plastic intent step ID"
         BECAUSE = "call step again after each dispatched node returns"
+        COMPLETE = "every node in the graph has finished"
 
         def call
           intent_dir
@@ -49,11 +50,18 @@ module Plastic
             env_session: @env["CLAUDE_CODE_SESSION_ID"], store: scope.store, intent_id: id)
           return true if session
           raise Refusal, "intent #{id} is held by another session; inspect with plastic auto lock status #{id} --project #{scope.slug}" if Lock.read(intent_dir)
+          raise Refusal, "return not accepted: take intent #{id} with plastic auto take #{id} --project #{scope.slug} before submitting it" unless Array(options[:returns]).empty?
 
           @output.next_step("plastic auto take #{id}", because: "graph execution requires this session to take the delivery lock")
           false
         end
 
+        def after_run
+          return super unless RunnerCore.complete?(RunnerCore.context(intent_dir: intent_dir, home: File.dirname(scope.plastic_home)))
+
+          ["plastic intent verify #{id}", COMPLETE]
+        end
+
         def graph?
           File.exist?(File.join(intent_dir, "graph.md"))
         end

package/scripts/lib/cli/commands/project_links.rb

@@ -20,7 +20,11 @@ module Plastic
           status = legacy.run("project-links", "--plastic-home", scope.plastic_home, *dry_run_flag)
           raise Failure, "project-links exited #{status}" unless status.zero?
 
-          @output.next_step("plastic status", because: "the Links sections just rebuilt across every store")
+          if options[:dry_run]
+            @output.next_step("none", because: "the preview wrote no files")
+          else
+            @output.next_step("plastic status", because: "the Links sections just rebuilt across every store")
+          end
         end
 
         private