devrites 3.2.28 → 4.0.0

package/pack/.claude/skills/rite-handoff/SKILL.md

@@ -4,7 +4,6 @@ description: User-invoked handoff writer: sync chat-only context into `.devrites
 user-invocable: true
 disable-model-invocation: true
 argument-hint: "[what the next session will focus on]"
-required-agent-roles: none
 ---
 
 # /rite-handoff: chat-only context, into a fresh-agent doc
@@ -17,7 +16,7 @@ the same user after `/clear`) can pick the work up without re-reading the transc
 Read `.claude/skills/devrites-lib/reference/standards/core.md` first: its "Persistence before stopping" discipline is
 exactly what this skill executes. The other rule files load on demand.
 
-Then run `devrites-engine preamble` for deterministic workspace orientation.
+Then read the explicit or active workspace's `state.md` directly.
 
 ## Where to write
 

package/pack/.claude/skills/rite-handoff/reference/handoff-template.md

@@ -9,7 +9,7 @@ Loaded on demand by `/rite-handoff`. Write the filled-in template to
 ## Resume
 Current objective: <one sentence>
 Last completed slice: <SLICE-### | none>
-Blockers: <none | Q-### / DRIFT-###>
+Blockers: <none | q-YYYY-MM-DD-NNN / released Q-### / DRIFT-###>
 
 ## Read next
 1. `.devrites/work/<slug>/README.md` — workspace map.

package/pack/.claude/skills/rite-learn/SKILL.md

@@ -1,118 +1,58 @@
 ---
 name: rite-learn
-description: User-invoked review of the learning ledger; promotes recurring lessons to project rules or principles.
-argument-hint: "[--mine | \"<lesson to record>\"]"
+description: Review recurring cross-feature evidence and propose durable project guidance.
+argument-hint: "[\"<lesson or rejected direction>\"]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: none
 ---
 
-# /rite-learn: the cross-feature learning loop
+# /rite-learn: review durable lessons
 
-Recurring corrections, dismissed review findings, timeline decisions, and health dips are durable
-signal. **Capture is automatic**: `/rite-seal` appends lessons to `.devrites/learnings.md` on every
-GO (step 9a), while the engine can keep `.devrites/timeline.jsonl`,
-`.devrites/health-history.jsonl`, and per-feature review fingerprints as supporting evidence. The
-review skills load the learning ledger **before** a fan-out, so a dismissed-finding class stops
-being re-flagged without anyone running a command. The system learns as it ships.
-
-`/rite-learn` is the periodic **review + promote** pass on that auto-populated ledger: cluster the
-signal across features and decide which recurring lessons graduate into a project rule. **Propose,
-never impose**: promotion is the human's call, which is why it stays a deliberate command rather
-than firing on its own.
-
-Read-mostly. It reads the auto-populated ledger + the archive; it writes only `.devrites/learnings.md`
-(consolidation, via `devrites-engine learnings`) and drafts proposed rule/ledger edits for the user to confirm:
-it never edits source or rule files on its own.
+Use native session memory and reviewed project Markdown instead of an engine
+miner, score, nudge, or convention registry. This command proposes durable
+guidance; it never turns an inferred pattern into a rule on its own.
 
 ## Modes
 
-- `/rite-learn` or `/rite-learn --mine`: **mine + propose** (the default).
-- `/rite-learn "<lesson>"`: **record one lesson** directly to the ledger and stop.
-
-## Workflow (mine + propose)
-
-1. **Gather the signal.** Start from the **auto-populated ledger** `.devrites/learnings.md` (seal
-   appends to it on every GO: step 9a), then run `devrites-engine learnings mine` over the archive (it clusters
-   repeated finding / decision / drift phrases across shipped
-   features) to surface cross-feature patterns the per-feature entries don't show on their own:
-   ```bash
-   devrites-engine learnings mine
-   ```
-   Use `.devrites/timeline.jsonl`, `.devrites/health-history.jsonl`, and
-   `.devrites/work/*/review-fingerprints.jsonl` as supporting evidence when they exist; do not
-   promote from those traces without the same repeated-feature threshold.
-2. **Cluster + name.** Group the recurring corrections into candidate lessons. A candidate needs
-   **≥2 occurrences across distinct features**: one-offs are noise, not a pattern. Name the
-   pattern in one specific sentence (the specificity rule from `prose-style.md` applies: a lesson
-   you could swap onto any project says nothing).
-   **Completion:** every candidate cites two distinct features, except a single deliberate
-   rejected direction with its durable reason.
-3. **Classify each candidate** into its durable home:
-   - **project rule:** a craft/standard that belongs in a `.claude/skills/devrites-lib/reference/standards/*` file or `CLAUDE.md`.
-   - **project principle:** a recurring correction that is really a *non-negotiable invariant*
-     (not just an idiom or a craft standard): graduate it to `.devrites/principles.md`
-     ([`principles.md`](../devrites-lib/reference/standards/principles.md)). This is the **trusted, gating** layer (higher
-     stakes than a rule) so `/rite-learn` **drafts** the principle + a dated Governance entry for
-     the human to confirm; it never writes a principle silently.
-   - **conventions-ledger entry:** a proven project idiom for `.devrites/conventions.md`.
-   - **dismissed-finding class:** a pattern reviewers keep flagging that is *intentional here*;
-     recording it stops the recurring false positive (`learnings.md`, loaded pre-fan-out).
-   - **rejected direction:** an approach or product direction weighed and ruled out with a
-     reason that outlives one feature; recording it (tag `rejected-direction`) stops ideation
-     skills (`/rite-pressure-test`, `/rite-pov`) from re-proposing it. Exempt from the
-     ≥2-occurrence rule: one deliberate rejection is the whole pattern.
-   - **drop:** not durable; let it go.
-4. **Propose, don't impose.** Present the candidates with their evidence (which features, how many
-   times, the proposed home) via `AskUserQuestion`: the human picks which to promote. Never
-   promote a lesson to a rule silently; an unproven "lesson" hardened into a rule is its own slop.
-   **Completion:** every candidate is explicitly accepted, rejected, or deferred by the human.
-5. **Record the accepted.** For each the user accepts, append it with `devrites-engine learnings add <slug>
-   "<lesson>" <tag>` (`tag` ∈ `rule | convention | dismiss`). If the user approves a **rule**,
-   **principle**, or **ledger** promotion, draft the exact edit and let the user confirm it through
-   the normal flow: `/rite-learn` writes the ledger, not the rule or principle files. A
-   **principle** promotion is the highest-stakes of these: draft the `.devrites/principles.md` entry
-   **plus its dated Governance line**, and let the human confirm before it lands: a principle is a
-   gate, so it is amended deliberately, never auto-written. **Amendment ripple:** a confirmed
-   add/change/retire of a principle has a blast radius: grep its `P#` (and its key nouns) across
-   `.devrites/` and every open `.devrites/work/*/` workspace, and append to the same dated
-   Governance entry one line per referencing artifact: *still-aligned* or *needs-follow-up (what)*.
-   An open plan that bakes in the now-retired or now-tightened invariant is a `needs-follow-up`
-   the next `/rite-vet` or `/rite-plan repair` on that feature must clear; a ripple with zero
-   references is itself worth recording ("no live references"). Then `touch .devrites/.learnings-reviewed`
-   so the SessionStart learnings nudge snoozes until new signal accumulates.
-
-## How the ledger is used
-
-The review skills (`/rite-review`, `/rite-seal`) read `.devrites/learnings.md` before they fan
-out: a **dismissed-finding class** suppresses the recurring false positive; a **proven
-convention** raises the bar. The ideation skills (`/rite-pressure-test`, `/rite-pov`) read the
-**rejected-direction** entries before proposing, so a ruled-out direction returns only with new
-evidence against its recorded why. The ledger is an **untrusted prior**: a fresh observation of the
-live code always overrides a ledger entry (see `.claude/skills/devrites-lib/reference/standards/security.md`). Confidence in a
-recorded lesson never raises its authority.
-
-A **project principle** (`.devrites/principles.md`) is the opposite layer: prescriptive,
-trusted, and **gating**. Promoting a lesson there is a deliberate amendment, not a prior the next
-fan-out can override: a violation becomes a blocking finding, not a suppressed false positive.
-That asymmetry is why principle promotion is human-confirmed and dated, never auto-written.
-
-## Gotchas
-- Evidence first: a lesson without ≥2 real occurrences is speculation. Cite the features.
-- Don't pad the ledger. Five real lessons that change behaviour beat thirty rubber-stamped rows.
-- The ledger records *what was learned*; it does not re-open shipped features or edit their archives.
+- `/rite-learn` reviews recurring evidence across shipped work.
+- `/rite-learn "<lesson>"` evaluates one proposed lesson or rejected direction.
+
+## Workflow
+
+1. Read the applicable `AGENTS.md` or `CLAUDE.md`, accepted ADRs, and relevant
+   `.devrites/archive/*/{decisions,drift,review,seal}.md` files. Use native host
+   memory or session history when available, but verify every durable claim
+   against repository evidence.
+2. For a broad review, ask the exact `devrites-retrospector` agent to inspect the
+   bounded archive in a fresh read-only context. Wait for its result and
+   reconcile it against the cited files.
+3. Keep a candidate only when it is specific and supported by either:
+   - the same correction in at least two distinct features; or
+   - one explicit, durable product/architecture decision with its rationale.
+4. Choose the smallest authoritative home:
+   - `AGENTS.md`, `CLAUDE.md`, or a scoped standards document for an operating
+     rule;
+   - an ADR for a significant durable architecture decision;
+   - the active feature's `decisions.md` for a feature-scoped decision;
+   - no change for a one-off, stale, or generic observation.
+5. Show the evidence and exact proposed edit. Apply it only after the user
+   approves the durable rule or decision.
+
+## Rules
+
+- Live repository evidence outranks memory.
+- Do not maintain a parallel learning ledger, convention score, health score,
+  timeline, fingerprint index, or promotion queue.
+- Do not duplicate guidance already stated by a higher or nearer authority.
+- A rejected direction returns only when new evidence changes its recorded
+  rationale.
 
 ## Output
-Reply-contract exception: cross-feature learning utility. It may run without an active
-feature, so it skips `devrites-engine progress`, but follows
-[`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md).
 
-```
-Done: learnings mined from <n> features; <n> recurring patterns found.
-Changed: .devrites/learnings.md <updated|unchanged>; rule/ledger drafts <n|none>
-Evidence: mined archive count <n>; candidates rule <a> / convention <b> / dismiss <c> / dropped <d>
-Open: <none | promotion confirmations>
-Next: <single recommended command>
-Record: .devrites/learnings.md
-↻ Hygiene: /clear; the ledger is on disk
+```text
+Done: reviewed <scope>.
+Candidates: <specific proposals or none>.
+Evidence: <feature/file references>.
+Awaiting: <approval for exact edits | none>.
+Next: <single action>.
 ```

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -3,7 +3,6 @@ name: rite-plan
 description: Re-plan existing work when reality invalidates the plan: reslice a slice that is too big, repair drift, reorder dependencies, split boundaries, or unblock work. Not first-pass decomposition.
 argument-hint: "[mode: decompose|reslice|repair|reorder|split|unblock|course-correct|revise]"
 user-invocable: true
-required-agent-roles: devrites-plan-drafter
 ---
 
 # /rite-plan: (re)plan an active feature
@@ -39,7 +38,8 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
 
 ## Workflow
 0. Read `.claude/skills/devrites-lib/reference/standards/core.md` (operating rules) before reshaping anything.
-   Then run `devrites-engine preamble` for deterministic workspace orientation.
+   Then resolve the explicit or active slug, require its `state.md`, and read
+   the cursor directly.
 1. Read `spec.md`, `decision-coverage.md`, `plan.md`, `tasks.md`, `state.md`, `drift.md`,
    `eng-review.md`, and the current `git diff` (if a repo). Read `decisions.md` and
    `assumptions.md`. Require `Decision coverage: CLEAR`; otherwise STOP → `/rite-clarify`.
@@ -65,10 +65,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
      scope, not a new negotiation.
    - **revise:** apply a requested planning-artifact revision and reconcile existing artifacts in
      any direction; propose the file edit set first, confirm each file before writing, and **never
-     edit source code**. The one confirmation exception is an explicit `/rite-upgrade`: its
-     validated `upgrade-assessment` authorizes one atomic, behavior-neutral normalization of
-     active planning artifacts, provided source, completed slices, answered questions, and
-     historical evidence remain unchanged. **Gate first: revise or new?** Same intent? More than 50% of existing scope
+     edit source code**. The sole confirmation exception is explicit `/rite-upgrade` with an
+     admitted `repairable` assessment naming current rule, evidence, gate, exact paths, and
+     delta; it authorizes only that neutral workspace edit, never source or history.
+     **Gate first: revise or new?** Same intent? More than 50% of existing scope
      survives? original *not* completable without this? Two "no"s → new work: recommend
      sealing/shipping the current workspace (MVP cut if named) then `/rite-spec` for the new
      intent, and stop. Revise preserves context; a new workspace separates the work.
@@ -78,6 +78,10 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    paths, settled contract, and observed failure/drift. Await one atomic `plan-candidate`;
    the drafter writes nothing and returns human-owned choices separately.
 3. Reason about dependencies: [dependency-graph](reference/dependency-graph.md).
+   Reconcile `plan.md`'s canonical `Shared contract proof`: changed provider/consumer
+   boundaries keep one reused contract artifact ahead of both asserting tests, and unaffected
+   plans retain the specific no-impact statement. Missing, one-sided, duplicated-contract, vague, or
+   non-consuming proof routes to `/rite-vet` only after repair.
    **Completion:** the slice graph is cycle-free and every dependency names an existing slice.
 4. Re-slice using vertical-slice rules: [slicing](reference/slicing.md) and
    [task-breakdown](reference/task-breakdown.md). Prefer thin, shippable, verifiable.
@@ -95,33 +99,17 @@ Pull `development-workflow.md` via `Read` when reshaping slice cadence or DoD cr
    `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, including a
    behavior-neutral technical rationale appended to `decisions.md`, re-scan the affected coverage
    rows, assumption audit, residual uncertainty, and closed gates. Partial/Missing, an unowned
-   material assumption, or an open blocking/escalating question routes `/rite-clarify`/HITL;
-   never refresh past it. Only after the matrix is re-closed, run
-   `devrites-engine readiness-digest coverage <slug>` and replace the complete
-   `Coverage inputs SHA-256` line in `decision-coverage.md`.
+   material assumption, or an open blocking/escalating question routes `/rite-clarify`/HITL.
+   Re-read every affected row and require current evidence before restoring `CLEAR`.
    **Completion:** the change is classified, and every behavior/acceptance change has explicit
    confirmation recorded before the artifacts are updated.
 7. **Done when:** every slice is sized (builds + proves in one cycle; no slice scoring >3
    left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
    is marked resolved, revised artifacts agree with each other, no source files changed in
    `revise` mode, behavior-change-vs-not is confirmed (`no`, or clarified), and every changed
-   plan ends at `/rite-vet` rather than returning directly to build.
+   plan ends at `/rite-vet` rather than returning directly to build. The `Shared contract proof`
+   table or justified no-impact statement must still match the revised boundary set.
    If any check fails, loop back: don't hand off a half-reshaped plan.
 
 > **Mid-flight discipline.** Do not change product behavior without confirmation or
 > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).
-
-## Output
-
-**Progress first**: run `devrites-engine progress`, then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: plan repaired for <slug> in <mode> mode.
-Changed: plan.md, tasks.md, traceability.md, decisions.md, state.md, eng-review.md <invalidated|n/a>
-Evidence: not applicable; slice map now <n> slices and next slice is <name>
-Open: <none | behavior question answered | Alternative: /rite-prove if all built slices need re-verification>
-Next: /rite-vet
-Record: .devrites/work/<slug>/plan.md
-↻ Hygiene: /clear if the repair was large; keep session for small reorder-only repairs
-```

package/pack/.claude/skills/rite-plan/reference/task-breakdown.md

@@ -15,7 +15,10 @@ This reference owns decomposition; the shared schema owns field names and meanin
    cheap to change).
 4. Mark which slices touch UI (→ frontend craft + browser proof), map each to the design
    brief states, and give each a binary visual acceptance target. Mark which slices cross
-   a module/service boundary (→ `devrites-api-interface`, `devrites-doubt`).
+   a module/service boundary (→ `devrites-api-interface`, `devrites-doubt`). For a changed
+   provider/consumer boundary, map the plan's `Shared contract proof` artifact before its
+   provider- and consumer-side asserting tests; both tests consume that same artifact and
+   their slice dependencies preserve the order. Do not duplicate the contract in each slice.
 5. Write or update `traceability.md` so every `AC-###` maps to ≥1 `SLICE-###`, a
    planned proof, evidence status, and likely touched files.
 6. Sanity check: every acceptance criterion in `spec.md` maps to ≥1 slice; no slice has

package/pack/.claude/skills/rite-polish/SKILL.md

@@ -1,9 +1,8 @@
 ---
 name: rite-polish
-description: Polish the active feature before review: code always, UI when touched. Use when the user says "polish this", "finish before review", "normalize the UI", or "make it bolder/quieter". Not for repo-wide refactors.
+description: Polish the active feature's code and any touched UI before review. Use for finish or normalization requests; not for repository-wide refactors.
 argument-hint: "[target | bolder | quieter | distill | harden | normalize-only]"
 user-invocable: true
-required-agent-roles: none
 ---
 
 # /rite-polish: finish before review
@@ -16,6 +15,9 @@ live in `reference/code.md` and `reference/ui.md`; read only the phase in scope.
 
 - **Functionality complete first.** Polish runs after `/rite-prove` (full
   feature proven).
+- Follow the shared
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Polish owns every candidate-affecting correction and durable rollup before Review.
 - Feature scope only.
 - For UI, **normalize before polishing**. Do not add decoration on top of drift.
 - **Root selects; wright edits.** The controlling chat assesses and reconciles, but every
@@ -30,9 +32,9 @@ live in `reference/code.md` and `reference/ui.md`; read only the phase in scope.
    per-phase rule files (`coding-style.md`, `error-handling.md`, …) load on demand
    from `reference/code.md` / `reference/ui.md` when their phase runs; for UI scope also read
    `.claude/skills/devrites-lib/reference/standards/browser-proof-checklist.md`.
-   Then run `devrites-engine preamble` for deterministic workspace orientation.
-1. **Read** `state.md`, `touched-files.md`, and the `git diff` for the active
-   workspace (or `$ARGUMENTS` if a target was given).
+   Then read the explicit or active workspace's `state.md` directly.
+1. **Read** `state.md`, `touched-files.md`, the current candidate digest, and the
+   `git diff` for the active workspace (or `$ARGUMENTS` if a target was given).
 2. **Detect UI scope:** UI is touched if the diff or `touched-files.md`
    contains any of: `.tsx`, `.jsx`, `.vue`, `.svelte`, `.html`, `.css`,
    `.scss`, `.sass`, `.less`, `.styl`, component dirs (`components/`,
@@ -55,13 +57,18 @@ live in `reference/code.md` and `reference/ui.md`; read only the phase in scope.
    - `bolder | quieter | distill | harden`: passed to Phase 4 as the
      emphasis dial.
    - `normalize-only`: assess Phase 3 and stop (no Phase 4).
-5. **Re-verify after any code edit:** a wright correction invalidates prior proof, so
-   `/rite-prove` no longer post-dates it. Dispatch `devrites-proof-runner` for the affected
-   fast checks (the
-   targeted tests for the touched files + typecheck/lint; browser re-check if UI
-   changed) and record a **`Re-verification:`** line in `polish-report.md`. A
-   polish that changed code without a green re-verification isn't finished.
-6. **Aggregate output:** both phases append to the single `polish-report.md`.
+5. **Finish durable rollups before Review.** Apply the capability
+   [`ledger`](reference/ledger.md) when requirements changed, the optional UI
+   [`design memory`](reference/design-memory.md), and durable
+   [`ADR promotion`](reference/adr-promotion.md). Add every changed project path
+   to the candidate manifest; none of these writes waits for Ship.
+6. **Re-prove and close.** After all accepted code/UI corrections and rollups,
+   run `devrites-engine check candidate <slug>`. Any digest change requires
+   affected real re-proof using the approved commands, fresh proof-runner
+   validation, refreshed evidence/browser bindings, and an updated candidate
+   manifest. Record a **`Re-verification:`** line in `polish-report.md`. Close
+   the candidate for Review only after these checks are green.
+7. **Aggregate output:** both phases append to the single `polish-report.md`.
 
 ## Refinement modes
 
@@ -74,19 +81,4 @@ quality bar; they apply after the system is aligned. See `reference/ui.md`.
 
 ## Output → `polish-report.md`
 
-Write the detailed report to `polish-report.md`. In chat, run `devrites-engine progress` first,
-then use the shared completion reply contract
-([`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md)).
-Default success shape:
-```
-Done: polished <slug | target>; code/backend/UI phases <ran|n/a>.
-Changed: polish-report.md, <files touched | workspace only>, browser-evidence.md <updated|n/a>
-Evidence: re-verification <cmd -> pass | n/a>; browser <summary | n/a>
-Open: <none | non-blocking design follow-ups>
-Next: /rite-review
-Record: .devrites/work/<slug>/polish-report.md
-↻ Hygiene: /clear before /rite-review
-```
-If a design decision remains unresolved or polish invalidated proof, use `Awaiting human`
-or `Stopped / blocked` and route to the decision or `/rite-prove`; do not recommend
-`/rite-review`.
+Write the detailed report to `polish-report.md`.

package/pack/.claude/skills/rite-polish/reference/adr-promotion.md

@@ -0,0 +1,11 @@
+# ADR promotion
+
+Promote only durable architecture or interface decisions from `decisions.md`; slice-local
+calls remain in the archived workspace. Do this during Polish before Review. If the
+project has no `docs/adr/`, ask before creating that convention.
+
+Write the next append-only `docs/adr/ADR-NNN.md` with Context, Decision, Status
+`accepted`, and Consequences. Never rewrite an accepted ADR; supersede it with a new ADR
+that links the old one. Add every promoted ADR to the authoritative candidate
+manifest, run affected real re-proof, and refresh evidence/browser bindings before
+Review. Ship performs no ADR promotion.

package/pack/{generated/claude/skills/rite-ship → .claude/skills/rite-polish}/reference/design-memory.md

@@ -1,18 +1,18 @@
 # Design memory: record proven design rules in `DESIGN.md`
 
-This optional `/rite-ship` step applies only to UI features. Feature design decisions
+This optional `/rite-polish` step applies only to UI features. Feature design decisions
 live in `design-brief.md` and archive with the workspace. With the user's approval,
 copy proven, reusable design rules into the project-level `DESIGN.md` for later
 features.
 
 `devrites-ux-shape` §1 and
 `devrites-frontend-craft/reference/design-references.md` read `DESIGN.md` when present.
-This step writes that file from sealed feature evidence.
+This step writes that file from real feature evidence before Review.
 
 ## When it runs
 - **UI features only.** No UI in the diff → skip silently.
-- **At ship, GO sealed, after the git plan, before type-GO** (step 2a), so the user sees
-  the full staged change set (code + `DESIGN.md`) under the single type-GO that ships it.
+- **During Polish, after initial proof and before candidate closure.** Any update
+  enters the candidate manifest and is proved and reviewed with the feature.
 - **Opt in and confirm.** A project-wide artifact is outside feature scope
   (`standards/core.md` rule 7), so never write it silently. Present a ranked option set
   (see [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), "Option set");
@@ -23,25 +23,28 @@ This step writes that file from sealed feature evidence.
   it only adds evidence-proven entries.
 
 ## Inputs (proven only)
+
+Entries are **proven, not aspirational**.
 - `design-brief.md`: direction, color strategy, **calibration** (density / motion), key
   states, named anchors, and the per-slice **Build-time refinements**.
-- The **final diff** and `touched-files.md`: the tokens, components, and states that
-  shipped. Record only what the diff proves, not everything the brief intended.
+- The **closed candidate diff** and `touched-files.md`: the tokens, components,
+  and states the candidate proves. Record only what the diff proves, not
+  everything the brief intended.
 - Existing `DESIGN.md` if present: the merge target.
 
 ## What to record
-Record only reusable rules established by the shipped, proven feature. Exclude choices
+Record only reusable rules established by the proved candidate. Exclude choices
 that apply only to this feature.
 - **Tokens introduced + used:** new color roles / spacing steps / type steps / elevation
-  / radius that shipped and are reusable. Names and values, mirrored from the code.
+  / radius proved in the candidate and reusable. Names and values, mirrored from the code.
 - **Color strategy and calibration baseline:** the strategy (Restrained / Committed / …) and
   established density / motion; record a deviation as a deviation, not a new
   default.
 - **Type & spacing scales** in actual use; **motion** classes + easing; **materiality**
   (elevation set, hairline usage, glass / texture policy).
 - **Component behaviors:** for each shared component established or extended by the
-  feature, record its shipped states and interaction model.
-- **Named-anchor lineage:** the anchors used by shipped features.
+  feature, record its proved states and interaction model.
+- **Named-anchor lineage:** the anchors used by proved features.
 - **Anti-slop exceptions:** any banned default the project *intentionally* uses (with the
   why), so build / polish don't "correct" a deliberate choice.
 
@@ -54,20 +57,20 @@ that apply only to this feature.
 - **Attribute and keep it short.** Tag each new entry with the feature slug. Future
   specs read this file, so use concise entries.
 
-## How it commits
-`DESIGN.md` is a tracked project artifact and ships **in the feature commit**:
+## How it enters the candidate
+`DESIGN.md` is a tracked project artifact:
 1. Write / update `<project-root>/DESIGN.md` from the template below.
-2. **Append `DESIGN.md` to `touched-files.md`** so the existing commit scope (SKILL
-   steps 2 and 4) stages it under the same type-GO. Do not create a second commit.
-3. Note the rollup in `ship.md` (what was added, or "design-memory: skipped by user").
+2. Add `DESIGN.md` to the authoritative candidate manifest.
+3. Run affected real re-proof, refresh evidence/browser digest bindings, and
+   include the result in Review. Ship performs no design-memory write.
 
 ## `DESIGN.md` template (project-level, stack-agnostic)
 ```markdown
 # DESIGN.md — <project> design memory
 
-> Rolled up from shipped features by `/rite-ship` (design memory). Read by
+> Rolled up from proven features by `/rite-polish` (design memory). Read by
 > `devrites-ux-shape` and `devrites-frontend-craft` as the inherited system. Evidence-only:
-> every entry shipped and was proven. Edit through a feature's ship, not by hand.
+> every entry was proven. Edit through a feature's polish, not by hand.
 
 ## Register & direction
 Default register per surface (brand / product) and the scene-derived direction the product
@@ -94,7 +97,7 @@ Classes in use, easing, `prefers-reduced-motion` handling.
 Elevation token set, hairline usage, glass policy, texture / asset approach.
 
 ## Components (proven behaviors)
-| Component | States shipped | Interaction model | First proven by |
+| Component | States proven | Interaction model | First proven by |
 |---|---|---|---|
 | <name> | default/hover/focus/loading/empty/error/… | inline / navigated / modal · feedback | <slug> |
 
@@ -108,8 +111,7 @@ Banned defaults this project *intentionally* uses, with the why (so build/polish
 ## NEVER (design memory)
 - Never roll up unattended on first creation: a new persistent project artifact is a
   confirmed step, never an AFK silent write.
-- Never write an entry the feature didn't *prove* shipped: no aspirational tokens.
+- Never write an entry the feature did not prove: no aspirational tokens.
 - Never overwrite or silently reconcile a conflicting existing entry: surface it.
 - Never persist a feature-only one-off as if it were the project default.
-- Never add `DESIGN.md` to the commit without appending it to `touched-files.md` first
-  (it would fall outside the ship's commit scope).
+- Never leave `DESIGN.md` outside the candidate manifest or defer it until Ship.

package/pack/.claude/skills/rite-polish/reference/ledger.md

@@ -0,0 +1,62 @@
+# Capability ledger
+
+`.devrites/specs/<capability>/spec.md` is the canonical ledger of proven capability
+`### Requirement:` blocks across feature archival.
+Host filesystem I/O; no engine command.
+
+## Fold semantics
+
+A feature spec may group deltas under capability-tagged H2s (`## ADDED
+Requirements — capability: <c>`, `MODIFIED`, or `REMOVED`); see
+[`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md).
+
+| Delta | Rule |
+|---|---|
+| ADDED | Append an absent block. Identical existing content is a no-op; the same header with different content conflicts. |
+| MODIFIED | Replace the named block in full. Equal content is a no-op; an absent target conflicts. |
+| REMOVED | Delete the named block. An absent target is a no-op; preview deletion if the capability becomes empty. |
+
+Match exact `### Requirement:` headers. Rename = REMOVED + ADDED. Flat specs
+seed the slug capability as all-ADDED.
+
+For MODIFIED, compare the complete current requirement block to its full replacement.
+It MUST preserve
+every existing scenario and normative or source-grounded claim unless an exact accepted `DEC-###`
+explicitly names its replacement or removal and rationale. For MODIFIED or REMOVED,
+reconciliation MUST account for load-bearing adjacent notes,
+examples, and comments whose meaning depends on changed text. Ambiguous ownership blocks
+reconciliation: preserve and show the content for an explicit decision; MUST NOT silently
+relocate or drop it. An unexplained omission is a blocking conflict,
+not cleanup or simplification.
+
+## Native preview/write workflow
+
+Run during Polish before Review so ledger edits enter the proved candidate.
+
+1. **Read.** Read the feature spec and only affected ledger specs. Reject a
+   capability escaping `.devrites/specs`, symlink/special file, duplicate header,
+   or malformed delta.
+2. **Preview, do not write.** Show exact target paths; every delta with before/after
+   header; full requirement order; and changed files. Apply the table to current
+   bytes and the preservation rule to MODIFIED and REMOVED. Conflicts stop.
+3. **Check feature grammar.** Apply `spec-grammar.md`'s Native grammar re-read
+   checklist to the saved feature spec. Any miss stops. Step 2's native comparison owns delta reconciliation; an
+   already-applied empty preview remains a no-op.
+4. **Confirm.** Name exact paths and deltas. A later Seal or Ship approval does
+   not confirm this write. Skip only when no capability contract exists.
+5. **Write safely.** Use `git check-ignore` and `git status` to prove targets will
+   be tracked; surface a needed ignore carve-out. Immediately re-read and refuse
+   bytes changed since preview. Touch only `.devrites/specs/`, preserve unrelated
+   bytes/order, and apply only previewed replacements or empty-file deletion.
+6. **Verify.** Re-read targets; require unrelated blocks byte-identical and the
+   same preview empty. Apply the same Native grammar re-read checklist to each
+   resulting capability spec.
+   Add changed paths to the authoritative candidate manifest, run affected real
+   re-proof, and refresh evidence/browser digest bindings before Review.
+
+Skip all six steps for a refactor/chore with no requirements.
+
+## Reading in Spec and Adopt
+
+List ledger specs with the host filesystem and read only touched capabilities.
+Classify against current file content, never memory.