devrites 4.0.10 → 4.0.11

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.11](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.10...v4.0.11) (2026-08-08)
+
+### Fixed
+
+* **rite:** recover workflow materializer failures ([4ab042b](https://github.com/ViktorsBaikers/DevRites/commit/4ab042b269c90ce7133bb425d3db15469035255e))
+
 ## [4.0.10](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.9...v4.0.10) (2026-08-08)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.10`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.10): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.11`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.11): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -83,7 +83,7 @@ the same skill.
 | 3 | Temper | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | Challenges scope and failure modes before Define. It is optional for small work and always runs in `/rite-autocomplete`. |
 | 4 | Define | [`/rite-define`](pack/.claude/skills/rite-define/SKILL.md) | Turns the approved spec into architecture, a plan, traceability, and vertical task slices; changed provider/consumer boundaries name one shared contract and consuming tests on both sides. |
 | 5 | Vet | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | Reviews every plan before implementation. The review depth scales with the risk. |
-| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting. |
+| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting; their transaction code is proved in a disposable same-layout fixture before active writes and uses normal bounded recovery rather than a one-shot budget. |
 | 7 | Converge | [`/rite-converge`](pack/.claude/skills/rite-converge/SKILL.md) | Runs only when recovery is needed. It compares the code with the recorded intent, adds missing slices, and sends the changed plan back to Vet. |
 | 8 | Prove | [`/rite-prove`](pack/.claude/skills/rite-prove/SKILL.md) | Runs positive, discriminating tests, build/runtime checks, and UI proof, then binds the evidence to the exact candidate digest. |
 | 9 | Polish | [`/rite-polish`](pack/.claude/skills/rite-polish/SKILL.md) | Cleans up the candidate, normalizes UI when needed, performs durable capability/design/ADR rollups, and refreshes affected proof before closing it. |
@@ -105,7 +105,8 @@ Some work needs a different route:
   boundary-discriminating diagnostic design; only its next real acquisition attempt
   needs a new GO. After an upgrade introduces a supported workflow-artifact writer,
   Autocomplete reopens a stale missing-writer stop once instead of preserving the
-  obsolete recovery count.
+  obsolete recovery count. The first real root-materializer failure then counts as
+  attempt one under normal fingerprint recovery; it is not terminal by itself.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.

package/docs/skills.md

@@ -178,7 +178,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
+| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. The materializer transaction is proved first in a disposable same-layout fixture; its failures use normal three-attempt fingerprint recovery, not consumptive one-shot authority. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
 | [`devrites-source-driven`](../pack/.claude/skills/devrites-source-driven/SKILL.md) | Consult official docs / source before relying on framework behavior; record the source. | API, config, or framework behavior is assumed rather than known. |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. That migration applies once, but the first real materializer failure is only attempt one under normal bounded recovery. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -52,7 +52,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/generated/claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/generated/claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -52,7 +52,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `$rite-plan unblock`, another phase command, a question, or

package/pack/generated/codex/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/generated/codex/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -52,7 +52,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.10",
+  "version": "4.0.11",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",