plumbbob 0.8.0 → 0.8.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "plumbbob",
   "displayName": "PlumbBob",
-  "version": "0.8.0",
+  "version": "0.8.3",
   "description": "Attention-first build process — driver skills + a CLI that keep you the decider: guidance on the work, a latch on the record.",
   "author": { "name": "Rob McLarty", "email": "hello@robmclarty.com", "url": "https://robmclarty.com" },
   "homepage": "https://github.com/robmclarty/plumbbob#readme",

package/dist/lib/settings.js

@@ -9,9 +9,9 @@
 //
 // Known keys: `check` (string — the heavy gate, tracked in settings.json) and
 // `auto` (boolean — whether the agent approves in the human's place; a personal
-// preference, so it belongs in settings.local.json). `activeBuild` (the
-// per-worktree cursor) also lives in settings.local.json but is resolved by
-// sidecar.ts, not here.
+// preference, so it belongs in settings.local.json). The per-worktree active-build
+// cursor is NOT here — it lives in the STATE file (see sidecar.ts), so this overlay
+// stays purely human-owned and the tool never rewrites it.
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 const DIRNAME = '.plumbbob';
@@ -70,12 +70,6 @@ export function resolveRecord(root, key) {
     const value = resolveSetting(root, key, undefined);
     return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
 }
-// Read one key from the untracked local overlay ONLY — no project or built-in
-// fallback. The `activeBuild` cursor lives here and must never resolve from the
-// tracked settings.json (it is per-worktree state, not a shared default).
-export function localSetting(root, key) {
-    return readSettings(localSettingsPath(root))[key];
-}
 // Merge one key into settings.local.json, preserving the other keys and creating
 // the file when absent. Pretty-printed so the overlay stays hand-editable. A
 // malformed existing file contributes nothing (readSettings yields {}) and is

package/dist/lib/sidecar.js

@@ -2,14 +2,18 @@
 // read it with a grep and no markdown parsing (D7). Functional/procedural,
 // node builtins only (C1/C2).
 //
-// STATE is a pure session sentinel: its EXISTENCE means "a session is active",
-// and nothing reads its content. The phase the dashboard shows (DESIGN/BUILD/
-// SPIKE) is derived, not stored — BUILD ⇔ a STEP is in flight, SPIKE ⇔ the SPIKE
-// marker is present, otherwise DESIGN.
+// STATE is the session sentinel AND the active-build cursor (D28): its EXISTENCE
+// means "a session is active", and its CONTENT names the build that session is on —
+// the two reinforce each other (a session is always on some build; the cursor is
+// meaningless without a session). Content is empty under --local / no build.
+// hasSession stays existence-only; activeBuild reads the content. Homing the cursor
+// here — not in settings.local.json — keeps that overlay purely human-owned
+// (check/auto): the tool only ever reads it, never rewrites it. The phase the
+// dashboard shows (DESIGN/BUILD/SPIKE) is derived, not stored — BUILD ⇔ a STEP is
+// in flight, SPIKE ⇔ the SPIKE marker is present, otherwise DESIGN.
 import { existsSync, readdirSync, readFileSync, writeFileSync, appendFileSync, rmSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { gitPath } from "./git.js";
-import { localSetting } from "./settings.js";
 const DIRNAME = '.plumbbob';
 export function sidecarDir(root) {
     return join(root, DIRNAME);
@@ -50,19 +54,35 @@ export function listBuilds(root) {
     }
 }
 // Resolve which build a verb acts on (D28): an explicit `--build <slug>` flag →
-// the `activeBuild` cursor in settings.local.json → the sole build in `builds/`
-// → null (the caller then refuses with a hint). One-active-per-worktree holds by
-// construction: the cursor is a single scalar key in an untracked file, so it can
-// never point at two builds (D28).
+// the cursor in STATE → the sole build in `builds/` → null (the caller then refuses
+// with a hint). One-active-per-worktree holds by construction: the cursor is STATE's
+// single-line content, so it can never point at two builds (D28).
 export function activeBuild(root, flag) {
     if (flag !== undefined && flag.length > 0)
         return flag;
-    const cursor = localSetting(root, 'activeBuild');
-    if (typeof cursor === 'string' && cursor.length > 0)
+    const cursor = readCursor(root);
+    if (cursor !== null)
         return cursor;
     const builds = listBuilds(root);
     return builds.length === 1 ? (builds[0] ?? null) : null;
 }
+// STATE's content is the active-build cursor. Empty means "no build" (--local, or a
+// session whose cursor is unset) → null, so activeBuild falls through to the
+// sole-build rule. A pre-STATE-cursor session wrote the literal `active` sentinel
+// here (the cursor lived in settings.local.json then); treat that legacy value as
+// unset so an in-flight upgrade degrades gracefully instead of chasing a build named
+// "active". `active` is thus reserved and never a valid cursor — no derived slug
+// collides (they carry a YYYY-MM-DD- prefix).
+function readCursor(root) {
+    let content;
+    try {
+        content = readFileSync(statePath(root), 'utf8').trim();
+    }
+    catch {
+        return null;
+    }
+    return content.length > 0 && content !== 'active' ? content : null;
+}
 // The build a verb should act on, plus its argv with the `--build <slug>` pair
 // stripped (D28). Every verb resolves through this: an explicit `--build <slug>`
 // wins, else the cursor / sole-build fallback of `activeBuild`. `rest` matters
@@ -197,12 +217,26 @@ function patchStepStat(root, slug, step, patch) {
 }
 // A session exists iff STATE exists. Deleting STATE (at finish) is what flips the
 // repo back to "no session" — so it is the single source of truth for "is there
-// a session". `start` calls beginSession; `finish` removes the file.
+// a session". `start` calls beginSession; `finish` removes the file. Existence is
+// the whole session signal; STATE's content is a separate axis (the cursor).
 export function hasSession(root) {
     return existsSync(statePath(root));
 }
-export function beginSession(root) {
-    writeFileSync(statePath(root), 'active\n');
+// Open the session and point its cursor at `slug` — null under --local / no build,
+// which leaves STATE present but empty so activeBuild falls through to the sole-build
+// rule. `finish` removes the file, closing the session and clearing the cursor in
+// one delete.
+export function beginSession(root, slug = null) {
+    writeCursor(root, slug);
+}
+// Re-point the cursor at an existing build (`use`) — a plain content rewrite that
+// leaves the session sentinel (STATE's existence) intact. Callers guard hasSession
+// first, so this never resurrects a finished session.
+export function setActiveBuild(root, slug) {
+    writeCursor(root, slug);
+}
+function writeCursor(root, slug) {
+    writeFileSync(statePath(root), slug === null ? '' : `${slug}\n`);
 }
 // SPIKE marker helpers — existence is the whole signal (content is irrelevant).
 export function inSpike(root, slug) {
@@ -309,10 +343,11 @@ function addExcludes(root, patterns) {
     appendFileSync(exclude, `${prefix}${missing.join('\n')}\n`);
 }
 // The narrowed control plane (D17): with `builds/<slug>/` now tracked, only the
-// per-worktree control files stay git-excluded — the local settings overlay (its
-// `activeBuild` cursor), the session sentinel, and the in-flight step markers
-// inside every build. Everything else under `.plumbbob/` (settings.json, and each
-// build's intent/build-log/checkpoints/report) rides the branch into the PR.
+// per-worktree control files stay git-excluded — the session sentinel STATE (whose
+// content is the active-build cursor, D28), the personal settings overlay, and the
+// in-flight step markers inside every build. Everything else under `.plumbbob/`
+// (settings.json, and each build's intent/build-log/checkpoints/report) rides the
+// branch into the PR.
 export function excludeControl(root) {
     addExcludes(root, [
         `${DIRNAME}/STATE`,

package/dist/verbs/doctor.js

@@ -31,8 +31,8 @@ import { listAgents } from "../lib/agents.js";
 import { gateDetectsTools } from "../lib/check.js";
 import { marketplacePlumbbob } from "../lib/plugins.js";
 import { findRepoRoot, gitPath, stagePath } from "../lib/git.js";
-import { buildDir, excludeControl, listBuilds, readTurn, sidecarDir, slugify } from "../lib/sidecar.js";
-import { resolveString, settingsPath, setLocalSetting } from "../lib/settings.js";
+import { buildDir, excludeControl, listBuilds, readTurn, setActiveBuild, sidecarDir, slugify } from "../lib/sidecar.js";
+import { resolveString, settingsPath } from "../lib/settings.js";
 // The plumbbob package's own skills/ dir (the canonical set), off this module's
 // URL so it resolves the same from src/ (dev) and dist/ (published).
 function packageDir(name) {
@@ -206,8 +206,12 @@ export function migrateSidecar(root) {
     const configPath = join(dir, 'config');
     if (existsSync(configPath)) {
         if (!existsSync(settingsPath(root))) {
+            // Carry forward ONLY what the legacy config actually held — a `check` line,
+            // nothing else. No invented `auto` (the config never had one, it defaults to
+            // false, and it belongs in settings.local.json): migration yields exactly what
+            // a fresh `start` would, plus the check. An empty config → an empty `{}`.
             const check = configCheck(configPath);
-            const settings = check === null ? { auto: false } : { check, auto: false };
+            const settings = check === null ? {} : { check };
             writeFileSync(settingsPath(root), `${JSON.stringify(settings, null, 2)}\n`);
             actions.push(check === null ? 'config → settings.json' : `config → settings.json (check: ${check})`);
         }
@@ -220,7 +224,7 @@ export function migrateSidecar(root) {
         const slug = uniqueSlug(slugify(titleFromIntent(flatIntent)), taken);
         taken.add(slug);
         moveInto(dir, buildDir(root, slug), ['intent.md', 'build-log.md', 'checkpoints', 'STEP', 'SEAM', 'SPIKE']);
-        setLocalSetting(root, 'activeBuild', slug);
+        setActiveBuild(root, slug);
         actions.push(`active session → builds/${slug} (the cursor)`);
     }
     // archive/<slug> → builds/<slug>. These are "done" by simply not being the cursor.

package/dist/verbs/finish.js

@@ -9,7 +9,6 @@ import { appendFileSync, existsSync, readFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { commit, findRepoRoot, isDirty, stageAll } from "../lib/git.js";
 import { checkpointsPath, clearTick, hasSession, intentPath, readStats, reportPath, resolveBuild, seamPath, setGrant, sidecarDir, spikePath, stepPath, } from "../lib/sidecar.js";
-import { setLocalSetting } from "../lib/settings.js";
 import { parseTitle } from "../lib/orient.js";
 export function finish(cwd, args = []) {
     const root = findRepoRoot(cwd);
@@ -35,9 +34,10 @@ export function finish(cwd, args = []) {
         stageAll(root);
     }
     const sha = commit(root, subject(root, slug), bodyArg(args) ?? undefined);
-    // Clear the control state: the in-flight markers, the per-worktree cursor (D28),
-    // and the session sentinel (STATE last, so "no session" flips exactly at the end).
-    // The tracked artifacts stay in place — only the ephemera go.
+    // Clear the control state: the in-flight markers first, then the session sentinel
+    // last (so "no session" flips exactly at the end). Deleting STATE also drops the
+    // cursor (D28) — cursor and session share the one file now, so a single delete does
+    // both. The tracked artifacts stay in place — only the ephemera go.
     rmSync(seamPath(root, slug), { force: true });
     rmSync(stepPath(root, slug), { force: true });
     rmSync(spikePath(root, slug), { force: true });
@@ -47,12 +47,6 @@ export function finish(cwd, args = []) {
     // the next session's first landing.
     clearTick(root, slug);
     setGrant(root, null);
-    if (slug !== null) {
-        // Drop the activeBuild key — JSON.stringify omits an `undefined` value, so the
-        // cursor is removed while the other local settings (auto, …) survive. Skipped
-        // under `--local`, where there is no cursor to clear.
-        setLocalSetting(root, 'activeBuild', undefined);
-    }
     rmSync(join(sidecarDir(root), 'STATE'), { force: true });
     const where = slug === null ? '.plumbbob/' : `.plumbbob/builds/${slug}/`;
     process.stdout.write(`plumbbob: finished — ${sha.slice(0, 9)}. ${where} rides your branch into the PR. ` +

package/dist/verbs/start.js

@@ -1,12 +1,12 @@
 // `plumbbob start "<title>"` — scaffold the sidecar, record the baseline, open
 // the session. Refuses on a dirty tree (D22), an existing session, or a non-git dir.
 import { fileURLToPath } from 'node:url';
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { detectGate } from "../lib/check.js";
 import { findRepoRoot, hasCommit, headSha, isDirty } from "../lib/git.js";
 import { sidecarDir, buildDir, listBuilds, slugify, checkpointsPath, intentPath, buildLogPath, beginSession, hasSession, excludeControl, excludeSidecar, setGrant, stampTick, } from "../lib/sidecar.js";
-import { settingsPath, setLocalSetting } from "../lib/settings.js";
+import { settingsPath } from "../lib/settings.js";
 // D24/D32: the gate is checkride unless a `check` setting overrides it, so
 // settings.json seeds with no `check` key at all — absence IS the default. The
 // templates' {{CHECK}} line is a human-readable echo of that.
@@ -51,8 +51,20 @@ export async function start(cwd, args) {
     }
     const sha = headSha(root);
     mkdirSync(sidecarDir(root), { recursive: true });
-    beginSession(root);
-    writeFileSync(settingsPath(root), `${JSON.stringify({ auto: false }, null, 2)}\n`);
+    // beginSession writes STATE — the session sentinel and, in its content, the cursor
+    // (D28). Point it at this build (null under --local, which has no cursor). The
+    // cursor lives in STATE, not settings.local.json, so that overlay stays human-owned.
+    beginSession(root, local ? null : slug);
+    // Scaffold the tracked settings.json ONLY when absent, and seed it EMPTY — the
+    // human owns this file once it exists (their `check` gate lives here), so a
+    // re-start must never touch it. We inject no opinions even on first create:
+    // absence of `check` already means checkride and absence of `auto` already means
+    // false (see settings.ts), so `{}` is exactly "all defaults". `auto` in
+    // particular is a personal preference that belongs in settings.local.json, not
+    // this tracked file — seeding it here was the bug that clobbered custom checks.
+    if (!existsSync(settingsPath(root))) {
+        writeFileSync(settingsPath(root), `${JSON.stringify({}, null, 2)}\n`);
+    }
     // D26: `--local` keeps today's fully-untracked flat layout (whole `.plumbbob/`
     // excluded); the default plants a tracked, PR-riding `builds/<slug>/` folder
     // (D26) and points the per-worktree cursor at it (D28), excluding only control
@@ -72,7 +84,6 @@ export async function start(cwd, args) {
         writeFileSync(join(dir, 'checkpoints'), `baseline ${sha}\n`);
         writeFileSync(join(dir, 'intent.md'), stamp(readTemplate('intent.md'), title, CHECK_ECHO));
         writeFileSync(join(dir, 'build-log.md'), stamp(readTemplate('build-log.md'), title, CHECK_ECHO));
-        setLocalSetting(root, 'activeBuild', slug);
         excludeControl(root);
         intentLocation = `.plumbbob/builds/${slug}/intent.md`;
     }

package/dist/verbs/use.js

@@ -1,14 +1,13 @@
 // `plumbbob use <slug>` (D30) — re-point the per-worktree cursor at an existing
 // build and resume it. Both switching and resuming are the same one word (Q10,
-// `nvm use`-shaped): the cursor is a single scalar key in settings.local.json, so
-// pointing it elsewhere IS the switch and one-active-per-worktree holds by
+// `nvm use`-shaped): the cursor is STATE's single-line content, so pointing it
+// elsewhere IS the switch and one-active-per-worktree holds by
 // construction (D28). It validates the target folder exists, and warns — but
 // allows — leaving a build with a step in flight: that surviving in-flight state
 // is D26's whole payoff, resumed the next time you `use` that build.
 import { existsSync } from 'node:fs';
 import { findRepoRoot } from "../lib/git.js";
-import { activeBuild, hasSession, intentPath, listBuilds, stepPath } from "../lib/sidecar.js";
-import { setLocalSetting } from "../lib/settings.js";
+import { activeBuild, hasSession, intentPath, listBuilds, setActiveBuild, stepPath } from "../lib/sidecar.js";
 export function use(cwd, args) {
     const root = findRepoRoot(cwd);
     if (root === null || !hasSession(root)) {
@@ -32,7 +31,7 @@ export function use(cwd, args) {
         process.stderr.write(`plumbbob: note — build "${leaving}" has a step in flight; its in-flight state is preserved ` +
             `and resumes when you \`use ${leaving}\` again.\n`);
     }
-    setLocalSetting(root, 'activeBuild', target);
+    setActiveBuild(root, target);
     const resuming = existsSync(stepPath(root, target)) ? ' (a step is in flight — `status` shows where)' : '';
     process.stdout.write(`plumbbob: now on build "${target}"${resuming}. \`status\` to orient.\n`);
     return 0;

package/hooks/post-edit.sh

@@ -5,16 +5,16 @@
 # the tools are absent or there is no session. tsc is deferred to the heavy tier
 # (D25): it has no true single-file mode and would tax every keystroke.
 
-# The repo root is the nearest ancestor whose .plumbbob/settings.local.json carries
-# an `activeBuild` cursor — the per-worktree signal that a tracked build is live
-# here (D28). Grep the same way the file_path read below does: a plain pattern
-# match, no JSON parse. The cursor replaces the old .plumbbob/STATE probe as the
-# "a build is active here" root marker.
+# The repo root is the nearest ancestor whose .plumbbob/STATE is NON-EMPTY — the
+# per-worktree signal that a tracked build is live here (D28). STATE's existence
+# means "a session is active"; its content is the active-build cursor, so a non-empty
+# STATE is exactly "a tracked build is live" (the `--local` layout leaves STATE empty,
+# and this file-scoped check is a tracked-build affordance). `-s` tests both existence
+# and non-emptiness — no JSON parse, no cursor file to read.
 find_root() {
   d=$(pwd -P)
   while [ -n "$d" ]; do
-    if [ -f "$d/.plumbbob/settings.local.json" ] &&
-      grep -q '"activeBuild"' "$d/.plumbbob/settings.local.json" 2>/dev/null; then
+    if [ -s "$d/.plumbbob/STATE" ]; then
       printf '%s' "$d"
       return 0
     fi

package/hooks/pre-bash-commit.sh

@@ -8,8 +8,8 @@
 
 # The repo root is the nearest ancestor with an active session — `.plumbbob/STATE`,
 # the sentinel `start` writes and `finish` removes. Present in both the tracked and
-# the `--local` layout (the activeBuild cursor post-edit.sh probes exists only in
-# the tracked one, and this hook must guard `--local` steps too).
+# the `--local` layout (post-edit.sh only fires when STATE is non-empty, i.e. a
+# tracked build; this hook must guard `--local` steps too, so it probes existence).
 find_root() {
   d=$(pwd -P)
   while [ -n "$d" ]; do
@@ -26,12 +26,11 @@ find_root() {
 root=$(find_root) || exit 0 # no active session here: nothing to guard
 
 # The in-flight signal is STEP (cleared when the step checkpoints): inside the
-# active build's folder when the cursor names one, else the flat sidecar STEP of
-# the `--local` layout. jq if present, else the same sed fallback post-edit.sh
-# uses for its field read.
-settings="$root/.plumbbob/settings.local.json"
-slug=$(jq -r '.activeBuild // empty' "$settings" 2>/dev/null)
-[ -z "$slug" ] && slug=$(sed -n 's/.*"activeBuild"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$settings" 2>/dev/null | head -n1)
+# active build's folder when STATE names one, else the flat sidecar STEP of the
+# `--local` layout. STATE's content IS the cursor (D28) — read the first line, trim
+# whitespace, and treat the legacy `active` sentinel (pre-STATE-cursor) as no cursor.
+slug=$(head -n1 "$root/.plumbbob/STATE" 2>/dev/null | tr -d '[:space:]')
+[ "$slug" = "active" ] && slug=""
 if [ -n "$slug" ]; then
   step_file="$root/.plumbbob/builds/$slug/STEP"
 else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plumbbob",
-  "version": "0.8.0",
+  "version": "0.8.3",
   "description": "Attention-first build process: 12 skills + a CLI that keep you the decider — guidance on the work, a latch on the record.",
   "keywords": [
     "claude-code",

package/skills/pb-build/SKILL.md

@@ -83,15 +83,24 @@ differs from the model you're running as, say so before implementing — the hum
    `--body` for the deterministic done-when + seam + diffstat fallback). Do **not** bump
    the version or changelog — that is the human's `/version` call.
 
-   **The latch makes this pause real (D64).** On the default (non-`--auto`) path you
+   **The latch makes this pause real.** On the default (non-`--auto`) path you
    build the step and reach the pause *in one turn* — so under plumbbob's turn hook the
    checkpoint at the end of that turn is **refused** ("no human turn since this step
    began"), and that refusal **is** the pause working as designed. Do exactly what the
    pause already asks: present the diff and the self-review, **end the turn**, and the
    human's next message is the tick that lands the checkpoint when you re-fire. **Never
-   route around a refusal with a raw `git commit`** — the work plane stays free (D10/D13),
+   route around a refusal with a raw `git commit`** — the work plane stays free,
    but the *record* is latched on purpose.
 
+   **Then hand off with the next model.** Once the checkpoint lands on re-fire, close the
+   turn by citing where the loop now stands: the step you just completed and the next
+   undone step. If that next step carries a `- model:` recommendation (the plan's
+   smallest-model-that-fits call, echoed on `plumbbob status`'s `▸ next` line), **name
+   it** so the human knows which `/model` to select before firing `/pb-build` again — it
+   is what carries the plan's suggestion across a fresh context window, which inherits the
+   session model, not the plan's. No `- model:` line means any model will do. Guidance,
+   never a gate.
+
 ## `--auto` — let the agent be the clock (opt-in)
 
 `/pb-build --auto` is the explicit escape hatch when the human wants unattended
@@ -108,7 +117,10 @@ and approves in the human's place**, and it **chains**:
   the self-review finds a mismatch (surface exactly what, and do not checkpoint it), a
   bound agent returns `blocked` or `drift` (unblock-and-re-run, or `/pb-refine` — an
   agent cannot advance the loop), a new decision is needed, no planned steps
-  remain, or the top of a requested range is reached.
+  remain, or the top of a requested range is reached. **When `--auto` halts back to the
+  human, give the same hand-off the default pause does** — the step just completed, the
+  next undone step, and that next step's `- model:` recommendation if it has one, so a
+  fresh context window knows which `/model` to select.
 
 `--auto` and a step range are the only paths that checkpoint without a human pause, and
 only because the human asked for it by name; a range re-imposes the pause at its top.
@@ -150,8 +162,12 @@ just the one more entry already in the halt list above.
   `build` writes the diff, `after` is advisory — none can checkpoint, flip a step, or
   chain. `blocked` → unblock and re-run; `drift` → `/pb-refine`. You are still the one
   who verifies and (bar `--auto`) the human is still the clock.
-- **A refused checkpoint is the pause, not an error (D64).** Under plumbbob's turn
+- **A refused checkpoint is the pause, not an error.** Under plumbbob's turn
   hook a same-turn `checkpoint` is refused by design — present the diff, **end the
   turn**, and the human's next message is the tick that lands it on re-fire. Never route
   around it with a raw `git commit`; `--auto`, a typed range, or `auto: true` are the
   only self-approvals.
+- **Close with the next model.** When a step lands, cite the completed step and the next
+  undone step, and name that next step's `- model:` recommendation if it has one — it's
+  what a fresh context window needs to pick the right `/model` before re-firing.
+  Guidance, never a gate.

package/skills/pb-finish/SKILL.md

@@ -31,7 +31,8 @@ record.
 2. **Finish.** Run `plumbbob finish`, which appends the checkpoint SHAs to the
    report and makes the final commit — subject `plumbbob: finish — <title>`,
    with an optional proportional body via `--body` (the stdin heredoc) — then
-   clears the control state (markers, the `activeBuild` cursor, STATE last). The
+   clears the control state (the in-flight markers, then `STATE` last — one delete
+   drops both the session sentinel and the active-build cursor it carries). The
    build folder stays in place, committed, and rides the branch into the PR.
 3. **Point at the next goal** — `/pb-plan` to frame the next one.
 

package/skills/pb-plan/SKILL.md

@@ -107,7 +107,7 @@ an agent can follow with `/pb-build`. The argument only seeds how you get there.
    baseline → plan → steps. Pass a proportional `--body` (the single-quoted stdin
    heredoc) when the rationale is worth carrying; skip it for a small plan. Do this
    only on the human's approval — the plan is their convergence.
-   - **The plan commit is latched too (D64).** Once the turn ledger exists, `checkpoint
+   - **The plan commit is latched too.** Once the turn ledger exists, `checkpoint
      --plan` refuses to land in the same turn `start` stamped it: present the plan,
      **end the turn**, and the human's approving message is the tick that lets it
      commit on re-fire — the refusal *is* the plan pause. Never route around it with a

package/skills/pb-verify/SKILL.md

@@ -62,8 +62,18 @@ this skill verifies it the same way: **it reads the diff, not the author**.
    write in one breath. Omit `--body` entirely and the CLI writes a deterministic body
    (done-when + seam + diffstat) on its own. Either way, do **not** bump the version or
    touch the changelog — that is the human's `/version` call.
+7. **Hand off with the next model** *(once the checkpoint lands)*. `plumbbob checkpoint`
+   prints `step N checkpointed … Back at the boundary` and returns to DESIGN. Close the
+   turn by citing where the loop now stands: the step you just completed and the **next
+   undone step** — its title and done-when. If that next step carries a `- model:`
+   recommendation (the plan's smallest-model-that-fits call, which `plumbbob status`
+   echoes on the `▸ next` line), **name it in the hand-off** so the human knows which
+   `/model` to select before firing `/pb-build` again. This matters most across a context
+   boundary: a fresh window inherits the *session's* model, not the plan's suggestion, so
+   this line is what carries the recommendation over. No `- model:` line means any model
+   will do — say nothing about it. Guidance, never a gate.
 
-## The latch makes the pause real (D64)
+## The latch makes the pause real
 
 When this session runs under plumbbob's turn hook, `plumbbob checkpoint` **refuses to
 land a step in the same turn it was entered** — and that refusal **is** this pause, not
@@ -73,7 +83,7 @@ the self-review, **end the turn**, and the human's next message is the tick that
 the checkpoint land when you re-fire. **Never reach for a raw `git commit` to force the
 land** — that forges the very record the latch exists to keep honest, and the
 commit-ask hook asks the human about it anyway. The refusal is a healthy latch doing its
-job on the *record* while the *work* plane stays free (D10/D13); a `/pb-build --auto` or
+job on the *record* while the *work* plane stays free; a `/pb-build --auto` or
 a typed step range in the human's own prompt is the only self-approval, and `auto: true`
 in settings is the standing one.
 
@@ -90,7 +100,11 @@ in settings is the standing one.
 - **`after`-agents advise; they never gate**. Their output feeds the
   self-review — checkride gates, the human approves. `blocked` → unblock and re-run;
   `drift` → `/pb-refine` before checkpointing. No code path makes them blocking.
-- **A refused checkpoint is the pause, never a workaround (D64).** Under the turn
+- **A refused checkpoint is the pause, never a workaround.** Under the turn
   hook a same-turn checkpoint is refused *by design* — present the diff, **end the
   turn**, and let the human's next message re-tick it. Never route around it with a raw
   `git commit`; the latch guards the record, not the work.
+- **Close with the next model.** After the checkpoint lands, cite the completed step
+  and the next undone step, and surface that next step's `- model:` recommendation when
+  it has one — it is the plan's smallest-model-that-fits call, and it's what a fresh
+  context window needs to pick the right `/model`. Guidance, never a gate.