devrites 3.2.22 → 3.2.23

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.23](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.22...v3.2.23) (2026-07-28)
+
+### Fixed
+
+* **devrites:** add retained-window abort recovery ([e47957c](https://github.com/ViktorsBaikers/DevRites/commit/e47957cd759f83e0166985b4b691d84068cc1d93))
+
 ## [3.2.22](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.21...v3.2.22) (2026-07-28)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.22`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.22): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.23`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.23): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/cli.md

@@ -19,7 +19,7 @@ devrites-engine readiness-digest coverage|engineering [slug] # canonical input d
 devrites-engine clarify-return enter|restore [slug] # durable later-phase clarify cursor
 devrites-engine recovery route <class>             # typed owner/action; JSON recovery-route/v1
 devrites-engine recovery check|record|clear ...    # durable three-failure budget; record/clear accept --class
-devrites-engine reconcile snapshot|check|close [slug] # retained writer baseline
+devrites-engine reconcile snapshot|check|restore-check|abort|close [slug] # retained writer baseline and rejected-window recovery
 devrites-engine test-integrity [slug]    # reject weakened tests against that baseline
 devrites-engine evidence-fresh [slug]    # proof freshness gate      (exit 0 fresh · 3 stale)
 devrites-engine check-acceptance <dir>   # acceptance gate           (exit 0 proven · 1 gap)

package/docs/command-map.md

@@ -66,7 +66,7 @@ active workspace with the current semantic planning contract.
 | [`/rite-define`](../pack/.claude/skills/rite-define/SKILL.md) | define → plan | `[slug]` | Authors and approves architecture, plan, vertical `SLICE-###` tasks, and traceability, then leaves the workspace at the `plan` checkpoint for `/rite-vet`. | `spec.md` + `decision-coverage.md` (+ `strategy.md`) + references | `architecture.md`, `plan.md`, `tasks.md`, `traceability.md`, `state.md`, `decisions.md` |
 | [`/rite-vet`](../pack/.claude/skills/rite-vet/SKILL.md) | vet | `[slug] [--cross-model] [--full]` | **Before build: every feature.** Engineering review of the defined plan: scope challenge (reuse / minimum-diff / complexity smell) + architecture / plan code-quality / test-coverage design / performance, confidence-banded with a quote-the-source verification gate; failure-mode + parallelization map. Hardens `plan.md` / `tasks.md` in place; writes the build-readable `test-plan.md` and semantic, input-digest-bound `READY` verdict; acceptance-changing deltas route via the Spec Drift Guard. Runs on every plan: depth scales to stakes (light pass on simple plans, full on big/risky), never skipped; **always in `/rite-autocomplete`**. Reviewer: `devrites-plan-reviewer` (+ optional `--cross-model`). | `plan.md` + `tasks.md` + `spec.md` (+ `strategy.md`) | `eng-review.md`, `test-plan.md`, `plan.md`, `tasks.md`, `decisions.md`, `state.md` |
 | [`/rite-plan`](../pack/.claude/skills/rite-plan/SKILL.md) | repair → plan | `[mode]` | Reslice / repair / re-order / split / unblock an active plan and return to the `plan` checkpoint; `revise` is artifact-only and `/rite-vet` is the normal resume. | spec/plan/tasks/state/drift + diff | `plan.md`, `tasks.md`, `state.md`, `decisions.md` |
-| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | Orchestrate **exactly one** vertical slice through the sole wright. The root writes an exact `.wright-allowlist`, retains the original slice baseline through snapshot → reconcile check → test/package integrity → close, and refreshes only the dispatch boundary on bounded retries. Objective failures stay agent-owned; only product/scope/policy choices, irreversible risk, or human-only access/actions become questions. | workspace + diff + `.devrites/CHECKPOINT` | code + `.wright-allowlist`, `recovery-attempts.jsonl`, `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
+| [`/rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | build | `[slice]` | Orchestrate **exactly one** vertical slice through the sole wright. The root writes an exact `.wright-allowlist`, retains the original slice baseline through snapshot → reconcile check → test/package integrity → close, and aborts rejected windows back to that baseline with a receipt. Objective failures stay agent-owned; only product/scope/policy choices, irreversible risk, or human-only access/actions become questions. | workspace + diff + `.devrites/CHECKPOINT` | code + `.wright-allowlist`, `recovery-attempts.jsonl`, `state.md`, `evidence.md`, `traceability.md`, `touched-files.md` (+ local `WIP(<slug>)` commit in checkpoint mode) |
 | [`/rite-converge`](../pack/.claude/skills/rite-converge/SKILL.md) | converge | `[slug]` | **Recovery.** Compare live code with clarified intent, append each unmet piece as a traceable `SLICE-###`, and invalidate the old vet verdict so changed work returns through `/rite-vet`. `tasks.md` stays byte-identical when already converged. | clarified spec + plan/tasks + principles + live code | `tasks.md` (appended), `traceability.md`, `state.md`, `eng-review.md` (invalidated), `decisions.md` |
 | [`/rite-upgrade`](../pack/.claude/skills/rite-upgrade/SKILL.md) | maintenance | `[slug]` | **Conditional recovery.** Bring an active unfinished workspace onto `devrites.readiness-artifacts.v2`. A fresh read-only planner identifies the smallest change; the rite preserves completed source, slices, decisions, and evidence, removes stale engine-proof recipes and machine-local wrappers from active plans, then reruns current readiness gates. Already-current workspaces that pass readiness, completed workspaces, and archives are no-ops. | active workspace + current readiness contract | active unfinished planning artifacts only |
 | [`/rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | prove | `[scope]` | Tests + build + runtime + browser proof of the completed feature. | `traceability.md` + workspace + diff | `evidence.md`, `browser-evidence.md`, `traceability.md`, `state.md` |

package/docs/orchestration.md

@@ -74,6 +74,16 @@ Each dispatch follows the retained-baseline sequence:
 6. After proof and decision checks pass, `reconcile close` retires the private
    window; only then does the root write canonical records.
 
+If the writer result is rejected before a clean check, the root runs the exact
+standalone `reconcile abort` operation. It restores source to the original
+pre-dispatch baseline while preserving pre-snapshot user work and canonical
+`.devrites` evidence, verifies a source-manifest digest, closes the retained
+window, and records a content-addressed `.reconcile-abort-<sha256>.json`
+receipt. The receipt binds the original tree, captured allowlist digest,
+restored path set, and closed-window result. Project-specific frozen hashes are
+verified separately against the restored worktree. `restore-check` remains the
+narrow rollback for source drift introduced after a clean check.
+
 An ordinary `reconcile check` may revalidate an existing retained window
 without a fresh current-turn wright receipt; it does not retire or widen that
 window. `reconcile close` still requires the confirmed, awaited wright result

package/docs/skills.md

@@ -145,7 +145,7 @@ blocks obvious multi-command `Next:` wording.
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | Orchestrates **exactly one** vertical slice through the sole wright. The root writes an exact `.wright-allowlist`, retains the original baseline through snapshot → reconcile check → test/package integrity → close, and refreshes only the dispatch boundary on retries. Objective failures use bounded agent-owned recovery; only genuine product/risk/access decisions become human gates. A `Forge: yes` slice still isolates candidates and lands one judged winner. | A plan exists and fresh digest-bound `CLEAR` and `READY` gates plus `test-plan.md` pass. |
+| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | Orchestrates **exactly one** vertical slice through the sole wright. The root writes an exact `.wright-allowlist`, retains the original baseline through snapshot → reconcile check → test/package integrity → close, and aborts rejected windows back to that baseline with a receipt. Objective failures use bounded agent-owned recovery; only genuine product/risk/access decisions become human gates. A `Forge: yes` slice still isolates candidates and lands one judged winner. | A plan exists and fresh digest-bound `CLEAR` and `READY` gates plus `test-plan.md` pass. |
 | [`devrites-source-driven`](../pack/.claude/skills/devrites-source-driven/SKILL.md) | Consult official docs / source before relying on framework behavior; record the source. | API, config, or framework behavior is assumed rather than known. |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. A fingerprinted ledger preserves the three-failure budget across agents and sessions. | Tests, builds, or runtime checks fail. |

package/engine/hooks_workspace.go

@@ -262,10 +262,11 @@ func hookStatusline(stdin io.Reader, stdout, stderr io.Writer) int {
 // insensitive, and FAIL/PASS scans are line oriented.
 // pack-scan-ignore: these are the hook's own red/green heuristics, not a payload.
 var (
-	redTestCmdRe            = regexp.MustCompile(`(?i)(npm|pnpm|yarn|bun)([[:space:]]+run)?[[:space:]]+(test|build|lint|typecheck|check)|jest|vitest|pytest|go[[:space:]]+test|cargo[[:space:]]+(test|build|clippy)|\bmvn\b|gradle|eslint|ruff|mypy|\btsc\b|\bmake[[:space:]]+(test|build|check)`)
-	redFailRe               = regexp.MustCompile(`(?im)(^|[^A-Za-z])FAIL([^A-Za-z]|$)|[1-9][0-9]*[[:space:]]+(failed|failing|failures?|errors?)|not ok|panic:|error TS[0-9]|Traceback|AssertionError|✗|✘|BUILD FAILED|exit code [1-9]`)
-	redPassRe               = regexp.MustCompile(`(?im)PASS(ED)?|0[[:space:]]+(failed|failing|errors?)|all tests passed|BUILD SUCC(ESS|EEDED)|succeeded|no (errors|problems|issues)|(^|[^a-z])ok([^a-z]|$)|✓`)
-	reconcileRestoreCheckRe = regexp.MustCompile(`^\s*(?:rtk\s+)?(?:[A-Za-z0-9_./-]+/)?devrites-engine\s+reconcile\s+restore-check(?:\s+[A-Za-z0-9._-]+)?\s*$`)
+	redTestCmdRe                   = regexp.MustCompile(`(?i)(npm|pnpm|yarn|bun)([[:space:]]+run)?[[:space:]]+(test|build|lint|typecheck|check)|jest|vitest|pytest|go[[:space:]]+test|cargo[[:space:]]+(test|build|clippy)|\bmvn\b|gradle|eslint|ruff|mypy|\btsc\b|\bmake[[:space:]]+(test|build|check)`)
+	redFailRe                      = regexp.MustCompile(`(?im)(^|[^A-Za-z])FAIL([^A-Za-z]|$)|[1-9][0-9]*[[:space:]]+(failed|failing|failures?|errors?)|not ok|panic:|error TS[0-9]|Traceback|AssertionError|✗|✘|BUILD FAILED|exit code [1-9]`)
+	redPassRe                      = regexp.MustCompile(`(?im)PASS(ED)?|0[[:space:]]+(failed|failing|errors?)|all tests passed|BUILD SUCC(ESS|EEDED)|succeeded|no (errors|problems|issues)|(^|[^a-z])ok([^a-z]|$)|✓`)
+	reconcileRootRecoveryRe        = regexp.MustCompile(`^\s*(?:rtk\s+)?(?:[A-Za-z0-9_./-]+/)?devrites-engine\s+reconcile\s+(?:restore-check|abort)(?:\s+[A-Za-z0-9._-]+)?\s*$`)
+	reconcileRootRecoveryMentionRe = regexp.MustCompile(`\breconcile\s+(?:restore-check|abort)\b`)
 )
 
 const redReasonFmt = "DevRites: tests/build are RED (%s). Fix to green or record the failure + next step in state.md before stopping: the Stop gate blocks an end-of-turn while .red is set."
@@ -1061,8 +1062,8 @@ func classifyRootBuildWindowOperation(root string, data []byte, in harness.Guard
 	if isOpaqueExecutionTool(in.ToolName) {
 		return true, true, in.ToolName
 	}
-	if isShellTool(in.ToolName) && strings.Contains(in.Command, "reconcile restore-check") {
-		return true, !reconcileRestoreCheckRe.MatchString(in.Command), in.Command
+	if isShellTool(in.ToolName) && reconcileRootRecoveryMentionRe.MatchString(in.Command) {
+		return true, !reconcileRootRecoveryRe.MatchString(in.Command), in.Command
 	}
 
 	projectDir := filepath.Dir(root)

package/engine/internal/lib/reconcile.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -27,8 +28,26 @@ const (
 	defaultWrightAllowlistName  = ".wright-allowlist"
 	wrightAllowlistFileEnv      = "DEVRITES_WRIGHT_ALLOWLIST_FILE"
 	reconcileDevritesPathPrefix = ".devrites/"
+	reconcileAbortSchema        = "devrites.reconcile-abort-receipt.v1"
 )
 
+var (
+	reconcileAbortReceiptName = regexp.MustCompile(`^\.reconcile-abort-([0-9a-f]{64})\.json$`)
+	reconcileObjectID         = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)
+	reconcileSHA256           = regexp.MustCompile(`^[0-9a-f]{64}$`)
+)
+
+type reconcileAbortReceipt struct {
+	SchemaVersion           string   `json:"schemaVersion"`
+	Slug                    string   `json:"slug"`
+	BaselineTree            string   `json:"baselineTree"`
+	SourceManifestSHA256    string   `json:"sourceManifestSHA256"`
+	SourceEntryCount        int      `json:"sourceEntryCount"`
+	CapturedAllowlistSHA256 string   `json:"capturedAllowlistSHA256"`
+	RestoredPaths           []string `json:"restoredPaths"`
+	WindowClosed            bool     `json:"windowClosed"`
+}
+
 // Reconcile enforces the source-write boundary around one dispatched
 // slice-wright. The first `snapshot` captures the dirty worktree, private object
 // database, exact orchestrator-authored allowlist, and .devrites state. A
@@ -39,7 +58,9 @@ const (
 // `check` compares the captured state with the current state and retains the
 // immutable baseline for the later test-integrity gate.
 // `restore-check` rolls back only source drift introduced after the last clean
-// check. `close` revalidates and then removes the private window artifacts.
+// check. `abort` restores the original source baseline, records a
+// content-addressed receipt, and closes a rejected writer window. `close`
+// revalidates and then removes the private window artifacts.
 //
 //	0  clean check, snapshot/close completed, or skipped (not a git repo)
 //	5  VIOLATION: a path changed outside the orchestrator allowlist
@@ -220,6 +241,103 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stdout, "reconcile: snapshot captured for %s.\n", slug)
 		return 0
 
+	case "abort":
+		baseTree, env, activeObjects, active, err := loadReconcileBaseline(gitRoot, d)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: invalid snapshot: %v\n", err)
+			return 6
+		}
+		if !active {
+			fmt.Fprintln(stderr, `reconcile: no active snapshot to abort.`)
+			return 6
+		}
+		allowed, err := readWrightAllowlist(gitRoot, capturedAllowlist)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: invalid captured allowlist: %v\n", err)
+			return 6
+		}
+		allowlistBytes := renderWrightAllowlist(allowed)
+		allowlistDigest := sha256.Sum256(allowlistBytes)
+
+		nowTree, err := worktreeTree(gitRoot, activeObjects, root)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot capture worktree for abort: %v\n", err)
+			return 6
+		}
+		changed, err := changedTreePaths(gitRoot, env, baseTree, nowTree)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot compare abort baseline: %v\n", err)
+			return 6
+		}
+		changed = sourceTreePaths(changed)
+		if err := restoreTreePaths(gitRoot, env, baseTree, changed); err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot restore rejected writer source delta: %v\n", err)
+			return 6
+		}
+
+		restoredTree, err := worktreeTree(gitRoot, activeObjects, root)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot verify aborted worktree: %v\n", err)
+			return 6
+		}
+		remaining, err := changedTreePaths(gitRoot, env, baseTree, restoredTree)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot verify abort baseline: %v\n", err)
+			return 6
+		}
+		if remaining = sourceTreePaths(remaining); len(remaining) != 0 {
+			fmt.Fprintln(stderr, "reconcile: rejected writer source delta was not fully restored; retained window left open.")
+			return 6
+		}
+		manifestDigest, entryCount, err := sourceTreeManifest(gitRoot, env, baseTree)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot fingerprint restored source baseline: %v\n", err)
+			return 6
+		}
+		restoredDigest, restoredEntryCount, err := sourceTreeManifest(gitRoot, env, restoredTree)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot fingerprint restored worktree: %v\n", err)
+			return 6
+		}
+		if restoredDigest != manifestDigest || restoredEntryCount != entryCount {
+			fmt.Fprintln(stderr, "reconcile: restored source manifest does not match the original baseline; retained window left open.")
+			return 6
+		}
+		receipt := reconcileAbortReceipt{
+			SchemaVersion:           reconcileAbortSchema,
+			Slug:                    slug,
+			BaselineTree:            baseTree,
+			SourceManifestSHA256:    manifestDigest,
+			SourceEntryCount:        entryCount,
+			CapturedAllowlistSHA256: hex.EncodeToString(allowlistDigest[:]),
+			RestoredPaths:           changed,
+			WindowClosed:            true,
+		}
+		receiptData, receiptName, err := renderReconcileAbortReceipt(receipt)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot render abort receipt: %v\n", err)
+			return 6
+		}
+		receiptPath := filepath.Join(d, receiptName)
+		pendingReceipt, err := stageContentAddressedReceipt(receiptPath, receiptData)
+		if err != nil {
+			fmt.Fprintf(stderr, "reconcile: cannot stage abort receipt: %v\n", err)
+			return 6
+		}
+		if pendingReceipt != "" {
+			defer func() { _ = os.Remove(pendingReceipt) }()
+		}
+		if err := closeWindow(); err != nil {
+			fmt.Fprintf(stderr, "reconcile: source baseline restored, but cannot close rejected slice window: %v\n", err)
+			return 6
+		}
+		if err := commitContentAddressedReceipt(receiptPath, pendingReceipt, receiptData); err != nil {
+			fmt.Fprintf(stderr, "reconcile: source baseline restored and window closed, but cannot persist abort receipt: %v\n", err)
+			return 6
+		}
+		fmt.Fprintf(stdout, "reconcile: aborted rejected slice window for %s; restored %d source path(s); receipt %s.\n", slug, len(changed), receiptName)
+		return 0
+
 	case "restore-check":
 		_, env, activeObjects, active, err := loadReconcileBaseline(gitRoot, d)
 		if err != nil {
@@ -374,7 +492,7 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 		return 0
 
 	default:
-		fmt.Fprintln(stderr, "reconcile: usage: devrites-engine reconcile <snapshot|check|restore-check|close> [slug]")
+		fmt.Fprintln(stderr, "reconcile: usage: devrites-engine reconcile <snapshot|check|restore-check|abort|close> [slug]")
 		return 6
 	}
 }
@@ -654,9 +772,45 @@ func reconcileRootOwnedOperationalFile(filename, rel string, entry os.DirEntry)
 			return false, fmt.Errorf("validate root-owned recovery ledger %s: %w", rel, err)
 		}
 	}
+	if len(parts) == 3 && reconcileAbortReceiptName.MatchString(parts[2]) {
+		data, err := os.ReadFile(filename)
+		if err != nil {
+			return false, fmt.Errorf("read reconcile abort receipt %s: %w", rel, err)
+		}
+		match := reconcileAbortReceiptName.FindStringSubmatch(parts[2])
+		digest := sha256.Sum256(data)
+		if hex.EncodeToString(digest[:]) != match[1] {
+			return false, fmt.Errorf("validate reconcile abort receipt %s: content digest does not match filename", rel)
+		}
+		var receipt reconcileAbortReceipt
+		if err := json.Unmarshal(data, &receipt); err != nil {
+			return false, fmt.Errorf("validate reconcile abort receipt %s: %w", rel, err)
+		}
+		if receipt.SchemaVersion != reconcileAbortSchema || !receipt.WindowClosed ||
+			receipt.Slug != parts[1] || !reconcileObjectID.MatchString(receipt.BaselineTree) ||
+			!reconcileSHA256.MatchString(receipt.SourceManifestSHA256) ||
+			!reconcileSHA256.MatchString(receipt.CapturedAllowlistSHA256) ||
+			receipt.SourceEntryCount < 0 || !validReceiptPaths(receipt.RestoredPaths) {
+			return false, fmt.Errorf("validate reconcile abort receipt %s: invalid receipt fields", rel)
+		}
+	}
 	return true, nil
 }
 
+func validReceiptPaths(paths []string) bool {
+	previous := ""
+	for _, receiptPath := range paths {
+		if receiptPath == "" || receiptPath == "." || receiptPath == ".devrites" ||
+			strings.HasPrefix(receiptPath, reconcileDevritesPathPrefix) ||
+			path.Clean(receiptPath) != receiptPath ||
+			(previous != "" && receiptPath <= previous) {
+			return false
+		}
+		previous = receiptPath
+	}
+	return true
+}
+
 func reconcileRootOwnedOperationalPath(rel string) bool {
 	rel = filepath.ToSlash(filepath.Clean(rel))
 	if rel == "timeline.jsonl" {
@@ -679,7 +833,7 @@ func reconcileRootOwnedOperationalPath(rel string) bool {
 		".wright-scope.log":
 		return true
 	default:
-		return false
+		return reconcileAbortReceiptName.MatchString(parts[2])
 	}
 }
 
@@ -796,20 +950,26 @@ func restoreTreeDelta(gitRoot string, env []string, checkedTree, currentTree str
 	if len(changed) == 0 {
 		return nil, nil
 	}
+	if err := restoreTreePaths(gitRoot, env, checkedTree, changed); err != nil {
+		return nil, err
+	}
+	return changed, nil
+}
 
+func restoreTreePaths(gitRoot string, env []string, targetTree string, changed []string) error {
 	materialized, err := os.MkdirTemp("", "devrites-reconcile-restore-*")
 	if err != nil {
-		return nil, fmt.Errorf("create restore directory: %w", err)
+		return fmt.Errorf("create restore directory: %w", err)
 	}
 	defer func() { _ = os.RemoveAll(materialized) }()
 	index := filepath.Join(materialized, "index")
 	restoreEnv := append(append([]string{}, env...), "GIT_INDEX_FILE="+index)
-	if _, err := reconcileGitOutput(gitRoot, restoreEnv, "read-tree", checkedTree); err != nil {
-		return nil, err
+	if _, err := reconcileGitOutput(gitRoot, restoreEnv, "read-tree", targetTree); err != nil {
+		return err
 	}
 	materializedTree := filepath.Join(materialized, "tree")
 	if err := os.MkdirAll(materializedTree, 0o700); err != nil {
-		return nil, fmt.Errorf("create restore tree: %w", err)
+		return fmt.Errorf("create restore tree: %w", err)
 	}
 	gitPrefix := filepath.ToSlash(materializedTree) + "/"
 	if _, err := reconcileGitOutput(
@@ -818,56 +978,159 @@ func restoreTreeDelta(gitRoot string, env []string, checkedTree, currentTree str
 		"-c", "core.autocrlf=false",
 		"checkout-index", "--all", "--force", "--prefix="+gitPrefix,
 	); err != nil {
-		return nil, err
+		return err
 	}
 
 	for _, changedPath := range changed {
 		if changedPath == "." || changedPath == ".devrites" ||
 			strings.HasPrefix(changedPath, reconcileDevritesPathPrefix) ||
 			path.Clean(changedPath) != changedPath {
-			return nil, fmt.Errorf("unsafe restore path %q", changedPath)
+			return fmt.Errorf("unsafe restore path %q", changedPath)
 		}
 		target := filepath.Join(gitRoot, filepath.FromSlash(changedPath))
 		targetParent := filepath.Dir(target)
 		if !safepath.WithinResolved(targetParent, gitRoot) {
-			return nil, fmt.Errorf("restore parent escapes repository through a symlink: %s", changedPath)
+			return fmt.Errorf("restore parent escapes repository through a symlink: %s", changedPath)
 		}
 		source := filepath.Join(materializedTree, filepath.FromSlash(changedPath))
 		sourceInfo, sourceErr := os.Lstat(source)
 		if sourceErr != nil && !os.IsNotExist(sourceErr) {
-			return nil, fmt.Errorf("inspect clean source %s: %w", changedPath, sourceErr)
+			return fmt.Errorf("inspect clean source %s: %w", changedPath, sourceErr)
 		}
 		if err := os.RemoveAll(target); err != nil {
-			return nil, fmt.Errorf("remove post-check path %s: %w", changedPath, err)
+			return fmt.Errorf("remove source path %s: %w", changedPath, err)
 		}
 		if os.IsNotExist(sourceErr) {
 			continue
 		}
 		if err := os.MkdirAll(targetParent, 0o755); err != nil {
-			return nil, fmt.Errorf("create restore parent for %s: %w", changedPath, err)
+			return fmt.Errorf("create restore parent for %s: %w", changedPath, err)
 		}
 		switch {
 		case sourceInfo.Mode()&os.ModeSymlink != 0:
 			link, err := os.Readlink(source)
 			if err != nil {
-				return nil, fmt.Errorf("read clean symlink %s: %w", changedPath, err)
+				return fmt.Errorf("read clean symlink %s: %w", changedPath, err)
 			}
 			if err := os.Symlink(link, target); err != nil {
-				return nil, fmt.Errorf("restore symlink %s: %w", changedPath, err)
+				return fmt.Errorf("restore symlink %s: %w", changedPath, err)
 			}
 		case sourceInfo.Mode().IsRegular():
 			data, err := os.ReadFile(source)
 			if err != nil {
-				return nil, fmt.Errorf("read clean file %s: %w", changedPath, err)
+				return fmt.Errorf("read clean file %s: %w", changedPath, err)
 			}
 			if err := os.WriteFile(target, data, sourceInfo.Mode().Perm()); err != nil {
-				return nil, fmt.Errorf("restore file %s: %w", changedPath, err)
+				return fmt.Errorf("restore file %s: %w", changedPath, err)
 			}
 		default:
-			return nil, fmt.Errorf("unsupported clean tree entry for %s: %s", changedPath, sourceInfo.Mode())
+			return fmt.Errorf("unsupported clean tree entry for %s: %s", changedPath, sourceInfo.Mode())
 		}
 	}
-	return changed, nil
+	return nil
+}
+
+func sourceTreePaths(paths []string) []string {
+	source := make([]string, 0, len(paths))
+	for _, changedPath := range paths {
+		if changedPath == ".devrites" || strings.HasPrefix(changedPath, reconcileDevritesPathPrefix) {
+			continue
+		}
+		source = append(source, changedPath)
+	}
+	sort.Strings(source)
+	return source
+}
+
+func sourceTreeManifest(gitRoot string, env []string, tree string) (string, int, error) {
+	out, err := reconcileGitOutput(gitRoot, env, "ls-tree", "-r", "-z", "--full-tree", tree)
+	if err != nil {
+		return "", 0, err
+	}
+	hash := sha256.New()
+	count := 0
+	for _, entry := range strings.Split(string(out), "\x00") {
+		if entry == "" {
+			continue
+		}
+		tab := strings.IndexByte(entry, '\t')
+		if tab < 0 {
+			return "", 0, fmt.Errorf("invalid ls-tree entry")
+		}
+		entryPath := entry[tab+1:]
+		if entryPath == ".devrites" || strings.HasPrefix(entryPath, reconcileDevritesPathPrefix) {
+			continue
+		}
+		_, _ = hash.Write([]byte(entry))
+		_, _ = hash.Write([]byte{0})
+		count++
+	}
+	return hex.EncodeToString(hash.Sum(nil)), count, nil
+}
+
+func renderReconcileAbortReceipt(receipt reconcileAbortReceipt) ([]byte, string, error) {
+	data, err := json.MarshalIndent(receipt, "", "  ")
+	if err != nil {
+		return nil, "", err
+	}
+	data = append(data, '\n')
+	digest := sha256.Sum256(data)
+	name := fmt.Sprintf(".reconcile-abort-%x.json", digest)
+	return data, name, nil
+}
+
+func stageContentAddressedReceipt(filename string, data []byte) (string, error) {
+	existing, readErr := os.ReadFile(filename)
+	if readErr == nil {
+		if string(existing) != string(data) {
+			return "", fmt.Errorf("existing content-addressed receipt does not match %s", filepath.Base(filename))
+		}
+		return "", nil
+	}
+	if !os.IsNotExist(readErr) {
+		return "", readErr
+	}
+	pending := strings.TrimSuffix(filename, ".json") + ".pending"
+	file, err := os.OpenFile(pending, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return "", err
+	}
+	if _, err := file.Write(data); err != nil {
+		_ = file.Close()
+		_ = os.Remove(pending)
+		return "", err
+	}
+	if err := file.Sync(); err != nil {
+		_ = file.Close()
+		_ = os.Remove(pending)
+		return "", err
+	}
+	if err := file.Close(); err != nil {
+		_ = os.Remove(pending)
+		return "", err
+	}
+	if err := os.Chmod(pending, 0o444); err != nil {
+		_ = os.Remove(pending)
+		return "", err
+	}
+	return pending, nil
+}
+
+func commitContentAddressedReceipt(filename, pending string, data []byte) error {
+	if pending == "" {
+		return nil
+	}
+	if err := os.Rename(pending, filename); err != nil {
+		return err
+	}
+	persisted, err := os.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+	if string(persisted) != string(data) {
+		return fmt.Errorf("persisted abort receipt does not match staged content")
+	}
+	return nil
 }
 
 // worktreeTree captures the working tree (tracked + untracked, .gitignore

package/engine/internal/lib/reconcile_test.go

@@ -2,6 +2,7 @@ package lib
 
 import (
 	"bytes"
+	"encoding/json"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -293,6 +294,132 @@ func TestReconcileRestoreCheckRollsBackOnlyPostCheckDelta(t *testing.T) {
 	}
 }
 
+func TestReconcileAbortRestoresOriginalSourceAndClosesWindow(t *testing.T) {
+	gitRoot := newGitRepo(t)
+	root := filepath.Join(gitRoot, ".devrites")
+	if err := os.MkdirAll(filepath.Join(root, "work", "feat"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeWrightAllowlist(t, root, "feat", "seed.go", "user-dirty.go")
+	userDirty := "package main\n\nfunc userWorkBeforeDispatch() {}\n"
+	writeFile(t, filepath.Join(gitRoot, "user-dirty.go"), userDirty)
+
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+	writeFile(t, filepath.Join(gitRoot, "seed.go"), "package main\n\nfunc rejectedWriterChange() {}\n")
+	if err := os.Remove(filepath.Join(gitRoot, "user-dirty.go")); err != nil {
+		t.Fatal(err)
+	}
+	writeFile(t, filepath.Join(gitRoot, "writer-added.go"), "package main\n")
+	evidence := filepath.Join(featureDir(root, "feat"), "evidence.md")
+	writeFile(t, evidence, "rejection evidence stays\n")
+
+	code, out := runReconcile(t, root, "abort", "feat")
+	if code != 0 {
+		t.Fatalf("abort = %d, want 0\n%s", code, out)
+	}
+	if !strings.Contains(out, "restored 3 source path(s)") {
+		t.Errorf("abort output omitted restored scope:\n%s", out)
+	}
+	if data, err := os.ReadFile(filepath.Join(gitRoot, "seed.go")); err != nil {
+		t.Fatal(err)
+	} else if string(data) != "package main\n" {
+		t.Fatalf("seed.go = %q, want original source", data)
+	}
+	if data, err := os.ReadFile(filepath.Join(gitRoot, "user-dirty.go")); err != nil {
+		t.Fatal(err)
+	} else if string(data) != userDirty {
+		t.Fatalf("pre-snapshot user work = %q, want %q", data, userDirty)
+	}
+	if _, err := os.Stat(filepath.Join(gitRoot, "writer-added.go")); !os.IsNotExist(err) {
+		t.Fatalf("writer-added source remains after abort: %v", err)
+	}
+	if data, err := os.ReadFile(evidence); err != nil {
+		t.Fatal(err)
+	} else if string(data) != "rejection evidence stays\n" {
+		t.Fatalf("abort changed canonical evidence: %q", data)
+	}
+	feature := featureDir(root, "feat")
+	if isFile(filepath.Join(feature, reconcileBaseName)) || isDir(filepath.Join(feature, reconcileObjectsName)) {
+		t.Fatal("abort retained the private reconciliation window")
+	}
+	receipts, err := filepath.Glob(filepath.Join(feature, ".reconcile-abort-*.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(receipts) != 1 {
+		t.Fatalf("abort receipts = %v, want exactly one", receipts)
+	}
+	data, err := os.ReadFile(receipts[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	var receipt reconcileAbortReceipt
+	if err := json.Unmarshal(data, &receipt); err != nil {
+		t.Fatal(err)
+	}
+	if receipt.SchemaVersion != reconcileAbortSchema || receipt.Slug != "feat" ||
+		!receipt.WindowClosed || receipt.SourceEntryCount != 2 ||
+		len(receipt.RestoredPaths) != 3 {
+		t.Fatalf("unexpected abort receipt: %+v", receipt)
+	}
+	entries, err := os.ReadDir(feature)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var receiptEntry os.DirEntry
+	for _, entry := range entries {
+		if entry.Name() == filepath.Base(receipts[0]) {
+			receiptEntry = entry
+			break
+		}
+	}
+	if receiptEntry == nil {
+		t.Fatal("abort receipt directory entry not found")
+	}
+	if ok, err := reconcileRootOwnedOperationalFile(receipts[0], "work/feat/"+filepath.Base(receipts[0]), receiptEntry); err != nil || !ok {
+		t.Fatalf("valid abort receipt operational=%v err=%v", ok, err)
+	}
+	if err := os.Chmod(receipts[0], 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(receipts[0], append(data, 'x'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := reconcileRootOwnedOperationalFile(receipts[0], "work/feat/"+filepath.Base(receipts[0]), receiptEntry); err == nil {
+		t.Fatal("tampered content-addressed abort receipt was accepted")
+	}
+}
+
+func TestReconcileAbortFailsClosedWhenObjectDatabaseIsMissing(t *testing.T) {
+	gitRoot := newGitRepo(t)
+	root := workspace(t, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+	rejected := "package main\n\nfunc rejectedWriterChange() {}\n"
+	writeFile(t, filepath.Join(gitRoot, "seed.go"), rejected)
+	feature := featureDir(root, "feat")
+	if err := os.RemoveAll(filepath.Join(feature, reconcileObjectsName)); err != nil {
+		t.Fatal(err)
+	}
+
+	code, out := runReconcile(t, root, "abort", "feat")
+	if code != 6 {
+		t.Fatalf("abort = %d, want 6\n%s", code, out)
+	}
+	if data, err := os.ReadFile(filepath.Join(gitRoot, "seed.go")); err != nil {
+		t.Fatal(err)
+	} else if string(data) != rejected {
+		t.Fatalf("failed abort mutated source: %q", data)
+	}
+	if !isFile(filepath.Join(feature, reconcileBaseName)) {
+		t.Fatal("failed abort removed its retained baseline marker")
+	}
+}
+
 func TestReconcileCheckFlagsUnauthorizedChange(t *testing.T) {
 	gitRoot := newGitRepo(t)
 	root := workspace(t, "feat")
@@ -633,6 +760,7 @@ func TestReconcileRootOwnedOperationalPathsAreExact(t *testing.T) {
 		"timeline.jsonl",
 		"work/feat/.red",
 		"features/feat/events.jsonl",
+		"work/feat/.reconcile-abort-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef.json",
 	} {
 		if !reconcileRootOwnedOperationalPath(path) {
 			t.Errorf("%q should be root-owned operational state", path)

package/engine/main.go

@@ -57,7 +57,7 @@ Usage:
   devrites-engine test-integrity [slug]    Gate: no test deleted, skipped, or de-asserted
   devrites-engine review-integrity [slug]  Gate: no adversarial review axis is silent (zero findings, no justification)
   devrites-engine dispatch-waive <reason>  Record a deterministic pre-dispatch STOP reason
-  devrites-engine reconcile <sub> [slug]   A1 gate: snapshot|check|restore-check|close the wright's source writes
+  devrites-engine reconcile <sub> [slug]   A1 gate: snapshot|check|restore-check|abort|close the wright's source writes
   devrites-engine resolve <qid> "<ans>"    Resolve an open question; keep state.md consistent
   devrites-engine close-out <slug>         Archive a shipped feature and clear ACTIVE
   devrites-engine archive-search "<nouns>" Find prior shipped specs that overlap the query

package/engine/tests/hook_test.go

@@ -804,6 +804,9 @@ func TestHookWrightScopeRequiresSpawnedCodexWorkerForSourceWrites(t *testing.T)
 	runGuard(`{"tool_name":"js","tool_input":{"code":"writeFile()"}}`, true)
 	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile restore-check auth-tokens"}}`, false)
 	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile restore-check auth-tokens && printf x > src/app.go"}}`, true)
+	runGuard(`{"tool_name":"Bash","tool_input":{"command":"rtk devrites-engine reconcile abort auth-tokens"}}`, false)
+	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile   abort auth-tokens"}}`, false)
+	runGuard(`{"tool_name":"Bash","tool_input":{"command":"devrites-engine reconcile abort auth-tokens && printf x > src/app.go"}}`, true)
 	out, errOut, code := runDevritesIO(t, root,
 		`{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`,
 		nil, "hook", "wright-scope", "--harness=claude")

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -56,9 +56,9 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    [`wright-dispatch.md`](wright-dispatch.md) end to end; it owns snapshot timing, stuck
    logging, the exact packet, conditional skill loading, and return checks. Dispatch through
    named wright → safely enforced generic fresh worker. If neither is available, stop for
-   HITL; the root never performs wright work. Before any canonical
-   `.devrites/` mutation, validate the typed result and require a clean immediate
-   `devrites-engine reconcile check`; exit `5` rejects the writer result.
+   HITL; root never writes source. Validate the result before `.devrites`
+   writes; run `reconcile check`. Exit `5` rejects: run standalone
+   `devrites-engine reconcile abort`, then verify its receipt and frozen hashes.
 4. **Doubt every stood decision before accepting the slice.** The writer never grades its
    own decisions: invoke `devrites-doubt` and its fresh reviewer for each entry. Do not enter
    step 5 until every entry has a recorded `accept` or resolved `reject` verdict. Log each dispatch:

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -70,8 +70,8 @@ devrites-engine reconcile check; echo "reconcile rc=$?"
 devrites-engine test-integrity; echo "test-integrity rc=$?"
 ```
 
-- Reconcile `5`: reject the result. Preserve pre-snapshot user work; restore only the
-  unauthorized slice delta; never widen scope from the writer's self-report.
+- Reconcile `5`: reject; run standalone `devrites-engine reconcile abort` to restore
+  pre-snapshot source/user work and close with a receipt. Never widen scope.
 - Test integrity `3`: a test was deleted, muted, focused, or de-asserted. Treat it as a
   Critical protocol failure and correct it through the wright.
 - A setup/corrupt-baseline error blocks acceptance; never fall back silently to `HEAD`.

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -56,9 +56,9 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    [`wright-dispatch.md`](wright-dispatch.md) end to end; it owns snapshot timing, stuck
    logging, the exact packet, conditional skill loading, and return checks. Dispatch through
    named wright → safely enforced generic fresh worker. If neither is available, stop for
-   HITL; the root never performs wright work. Before any canonical
-   `.devrites/` mutation, validate the typed result and require a clean immediate
-   `devrites-engine reconcile check`; exit `5` rejects the writer result.
+   HITL; root never writes source. Validate the result before `.devrites`
+   writes; run `reconcile check`. Exit `5` rejects: run standalone
+   `devrites-engine reconcile abort`, then verify its receipt and frozen hashes.
 4. **Doubt every stood decision before accepting the slice.** The writer never grades its
    own decisions: invoke `devrites-doubt` and its fresh reviewer for each entry. Do not enter
    step 5 until every entry has a recorded `accept` or resolved `reject` verdict. Log each dispatch:

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -70,8 +70,8 @@ devrites-engine reconcile check; echo "reconcile rc=$?"
 devrites-engine test-integrity; echo "test-integrity rc=$?"
 ```
 
-- Reconcile `5`: reject the result. Preserve pre-snapshot user work; restore only the
-  unauthorized slice delta; never widen scope from the writer's self-report.
+- Reconcile `5`: reject; run standalone `devrites-engine reconcile abort` to restore
+  pre-snapshot source/user work and close with a receipt. Never widen scope.
 - Test integrity `3`: a test was deleted, muted, focused, or de-asserted. Treat it as a
   Critical protocol failure and correct it through the wright.
 - A setup/corrupt-baseline error blocks acceptance; never fall back silently to `HEAD`.

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -56,9 +56,9 @@ See also [`one-slice-cycle.md`](one-slice-cycle.md).
    [`wright-dispatch.md`](wright-dispatch.md) end to end; it owns snapshot timing, stuck
    logging, the exact packet, conditional skill loading, and return checks. Dispatch through
    named wright → safely enforced generic fresh worker. If neither is available, stop for
-   HITL; the root never performs wright work. Before any canonical
-   `.devrites/` mutation, validate the typed result and require a clean immediate
-   `devrites-engine reconcile check`; exit `5` rejects the writer result.
+   HITL; root never writes source. Validate the result before `.devrites`
+   writes; run `reconcile check`. Exit `5` rejects: run standalone
+   `devrites-engine reconcile abort`, then verify its receipt and frozen hashes.
 4. **Doubt every stood decision before accepting the slice.** The writer never grades its
    own decisions: invoke `devrites-doubt` and its fresh reviewer for each entry. Do not enter
    step 5 until every entry has a recorded `accept` or resolved `reject` verdict. Log each dispatch:

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -70,8 +70,8 @@ devrites-engine reconcile check; echo "reconcile rc=$?"
 devrites-engine test-integrity; echo "test-integrity rc=$?"
 ```
 
-- Reconcile `5`: reject the result. Preserve pre-snapshot user work; restore only the
-  unauthorized slice delta; never widen scope from the writer's self-report.
+- Reconcile `5`: reject; run standalone `devrites-engine reconcile abort` to restore
+  pre-snapshot source/user work and close with a receipt. Never widen scope.
 - Test integrity `3`: a test was deleted, muted, focused, or de-asserted. Treat it as a
   Critical protocol failure and correct it through the wright.
 - A setup/corrupt-baseline error blocks acceptance; never fall back silently to `HEAD`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.22",
+  "version": "3.2.23",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",