devrites 4.0.10 → 4.0.12

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.12](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.11...v4.0.12) (2026-08-09)
+
+### Fixed
+
+* **rite:** keep internal replans in autocomplete ([9dbbd30](https://github.com/ViktorsBaikers/DevRites/commit/9dbbd30d6fbb088f2b175b6c4af06a9d7e5e9114))
+
+## [4.0.11](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.10...v4.0.11) (2026-08-08)
+
+### Fixed
+
+* **rite:** recover workflow materializer failures ([4ab042b](https://github.com/ViktorsBaikers/DevRites/commit/4ab042b269c90ce7133bb425d3db15469035255e))
+
 ## [4.0.10](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.9...v4.0.10) (2026-08-08)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.10`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.10): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.12`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.12): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -83,7 +83,7 @@ the same skill.
 | 3 | Temper | [`/rite-temper`](pack/.claude/skills/rite-temper/SKILL.md) | Challenges scope and failure modes before Define. It is optional for small work and always runs in `/rite-autocomplete`. |
 | 4 | Define | [`/rite-define`](pack/.claude/skills/rite-define/SKILL.md) | Turns the approved spec into architecture, a plan, traceability, and vertical task slices; changed provider/consumer boundaries name one shared contract and consuming tests on both sides. |
 | 5 | Vet | [`/rite-vet`](pack/.claude/skills/rite-vet/SKILL.md) | Reviews every plan before implementation. The review depth scales with the risk. |
-| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting. |
+| 6 | Build | [`/rite-build`](pack/.claude/skills/rite-build/SKILL.md) | In HITL, implements and verifies one product slice, then stops. Run it again for each remaining slice. An explicit `.devrites/AFK` sentinel permits bounded low-risk slice chaining under its cap and pause rules. Exact Vet-ready executable workflow artifacts under the active feature workspace are root-materialized and excluded from product slice accounting; their transaction code is proved in a disposable same-layout fixture before active writes and uses normal bounded recovery rather than a one-shot budget. |
 | 7 | Converge | [`/rite-converge`](pack/.claude/skills/rite-converge/SKILL.md) | Runs only when recovery is needed. It compares the code with the recorded intent, adds missing slices, and sends the changed plan back to Vet. |
 | 8 | Prove | [`/rite-prove`](pack/.claude/skills/rite-prove/SKILL.md) | Runs positive, discriminating tests, build/runtime checks, and UI proof, then binds the evidence to the exact candidate digest. |
 | 9 | Polish | [`/rite-polish`](pack/.claude/skills/rite-polish/SKILL.md) | Cleans up the candidate, normalizes UI when needed, performs durable capability/design/ADR rollups, and refreshes affected proof before closing it. |
@@ -105,7 +105,10 @@ Some work needs a different route:
   boundary-discriminating diagnostic design; only its next real acquisition attempt
   needs a new GO. After an upgrade introduces a supported workflow-artifact writer,
   Autocomplete reopens a stale missing-writer stop once instead of preserving the
-  obsolete recovery count.
+  obsolete recovery count. The first real root-materializer failure then counts as
+  attempt one under normal fingerprint recovery; it is not terminal by itself.
+  Likewise, an internal `NEEDS_REPLAN` result stays inside Autocomplete: it runs
+  the next Plan repair and narrow Vet without returning a command to the user.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.

package/docs/skills.md

@@ -178,7 +178,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
+| [`rite-build`](../pack/.claude/skills/rite-build/SKILL.md) | In HITL, orchestrates one vertical product slice through the sole wright; an explicit `.devrites/AFK` sentinel may chain bounded low-risk slices. Exact Vet-ready executable proof artifacts under the active `.devrites/work/<slug>/` are instead materialized atomically by the controlling root and remain outside product candidate/slice accounting. The materializer transaction is proved first in a disposable same-layout fixture; its failures use normal three-attempt fingerprint recovery, not consumptive one-shot authority. | A plan exists, native semantic `CLEAR` and `READY` review passes, `test-plan.md` is complete, and the content-bound engine check passes. |
 | [`devrites-source-driven`](../pack/.claude/skills/devrites-source-driven/SKILL.md) | Consult official docs / source before relying on framework behavior; record the source. | API, config, or framework behavior is assumed rather than known. |
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence and one-time migration of stale missing-writer stops when an upgraded contract supplies the first supported workflow-artifact writer. That migration applies once, but the first real materializer failure is only attempt one under normal bounded recovery. Internal `NEEDS_REPLAN` and newly discovered agent-owned review findings remain caller-owned backward edges rather than user-facing stops. Spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -6,6 +6,12 @@ artifact.
 
 Keep the reply compact and evidence-backed:
 
+When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN`, a
+nested phase `STOP`, and a routine Plan/Vet `Next step` are not eligible completion
+states. Return them to the caller without a user-facing reply. Autocomplete may
+use the shapes below only after its requested rest point or a shared genuine
+human/safety/access/exhausted-recovery stop is reached.
+
 ```text
 Done: <result in one sentence>
 Changed: <artifact or source paths>

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/.claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -54,6 +54,15 @@ Resume next session with: <single command, e.g. /rite-build slice 2>
 This is advice, not a gate. The user can ignore it. It reports a trade-off the model
 cannot inspect directly because no API reports context fullness.
 
+### Autocomplete exception
+
+Do not emit the footer or a resume command for a nested phase controlled by
+Autocomplete. An intermediate `NEEDS_REPLAN`, Plan/Vet checkpoint, or new
+agent-owned fingerprint must continue in the same invocation under the caller
+contract. If the host compacts, persist the current checkpoint and resume from it;
+context pressure is never permission to turn routine backtracking into a user
+handoff.
+
 ## When NOT to recommend `/clear` or `/compact`
 
 - The current phase is read-only and cheap (`/rite-status`, `/rite` menu): no

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -40,7 +40,10 @@ Repository conventions follow [Precedence](#precedence).
 ## Lifecycle rest points
 
 Before advancing a phase, run `devrites-engine check readiness <slug>` for
-structure; exact agents/checklists own semantics. Persist and stop on block.
+structure; exact agents/checklists own semantics. Standalone rites persist and stop
+on block. Under an active controlling caller, an agent-owned technical block is a
+persisted backward edge: return it to that caller instead of producing a
+user-facing stop.
 After native proof/review, `/rite-seal` runs `devrites-engine check seal <slug>`
 for structure/freshness, not prose. HITL/blocked stops follow
 [Persistence before stopping](#persistence-before-stopping-handoff-discipline).

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -36,6 +36,11 @@ the terminal cursor or its recovery count.
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Treat technical readiness as routing, not completion.** `NEEDS_REPLAN` is a backward edge
+  to Plan repair and narrow Vet; `NEEDS_CLARIFICATION` is likewise internal when
+  decision coverage can be resolved from existing authority. Neither state may
+  end Autocomplete unless its underlying fingerprint is actually exhausted or a
+  human/safety/access decision is required.
 - **Do not confuse an action budget with recovery exhaustion.** After a failed
   consumptive action, zero remaining real attempts blocks only another execution.
   New retained Critical/Important evidence starts offline repair and narrow Vet
@@ -73,6 +78,9 @@ the terminal cursor or its recovery count.
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
    a stale pre-ownership workflow-artifact writer stop reopens under
    `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   A `NEEDS_REPLAN` cold resume with a valid technical return cursor immediately
+   invokes Plan repair and Recovery Vet before selecting a forward phase or
+   emitting any reply.
    That materialization runs directly as non-consumptive prerequisite recovery,
    even with no pending product slice or AFK budget; it does not re-ask an answered
    human gate.

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid
@@ -101,6 +104,24 @@ for a human-owned decision or mandatory safety/access action. Exhausted
 agent-owned recovery stops once with its reproduction and dead ends, never with
 another routine Plan/Vet command.
 
+## Continuous caller obligation
+
+No user-facing reply is permitted while the durable state contains an
+agent-owned `NEEDS_REPLAN`, an intermediate Plan/Vet `next_action`, or a distinct
+Critical/Important fingerprint with remaining recovery budget. Invoke the exact
+next Plan repair and Recovery Vet immediately. A narrow reviewer closing its input
+finding and exposing another Critical/Important invariant is progress: close the
+old fingerprint, open the new one, and continue without handing a command to the
+user.
+
+The number of completed repair/Vet cycles is not a stop condition and cannot be
+used as a surrogate recovery budget. Only three no-progress corrections of the
+same exact fingerprint exhaust. Context pressure, compaction, session duration,
+or a nested skill's completion footer also cannot convert an internal checkpoint
+into a stop; persist the checkpoint and resume from it inside the same controlling
+invocation. Autocomplete may emit its final reply only after reaching its requested
+rest point or one of the shared human/safety/access/exhaustion stop conditions.
+
 ## Between phases
 
 - Re-read the active workspace before each phase (don't trust chat memory).

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -29,6 +29,11 @@ on exhaustion, stop as a technical blocker unless human-owned.
 
 ## Not a stop: agent-owned backtracking
 
+`NEEDS_REPLAN` is not a stop condition under an active Autocomplete caller. It
+blocks forward advancement, persists the return cursor, and immediately routes
+Plan repair plus Recovery Vet. The same applies to any intermediate nested
+`STOP`/`Next step` whose underlying decision is agent-owned.
+
 Agent-owned backtracking is not a stop condition while its causal-fingerprint
 budget remains. The active caller invokes the earlier phase inline, follows Vet
 and any bounded remediation, then resumes the originating phase. Persist
@@ -52,7 +57,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -144,8 +144,12 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    After each fold-back rerun step 2a; missing/meaning-changing mappings block.
    Keep `state.md` non-READY for step 6.
 6. **One narrow recheck after edits.** If the candidate changed, dispatch exact
-   `devrites-plan-reviewer` once with accepted findings, changed paths/criteria,
-   and new identity. No full or third loop; if it changes the plan, repeat step 5.
+   `devrites-plan-reviewer` once per correction/fingerprint with accepted findings,
+   changed paths/criteria, and new identity. Within that same correction, no full
+   or third loop; if it changes the plan, repeat step 5. If the recheck closes its
+   input fingerprint but discovers a distinct Critical/Important invariant, return
+   that new fingerprint to the controlling caller as progress. It may start the
+   next bounded Plan/Recovery-Vet cycle; the prior reviewer count is not exhaustion.
    Then close the matrix and rerun step 2a's ID-and-meaning audit.
 
 6a. **Build readback.** From the final owning artifacts, add a cited five-line

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/claude/skills/devrites-lib/reference/reply-contract.md

@@ -6,6 +6,12 @@ artifact.
 
 Keep the reply compact and evidence-backed:
 
+When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN`, a
+nested phase `STOP`, and a routine Plan/Vet `Next step` are not eligible completion
+states. Return them to the caller without a user-facing reply. Autocomplete may
+use the shapes below only after its requested rest point or a shared genuine
+human/safety/access/exhausted-recovery stop is reached.
+
 ```text
 Done: <result in one sentence>
 Changed: <artifact or source paths>

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/generated/claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -54,6 +54,15 @@ Resume next session with: <single command, e.g. /rite-build slice 2>
 This is advice, not a gate. The user can ignore it. It reports a trade-off the model
 cannot inspect directly because no API reports context fullness.
 
+### Autocomplete exception
+
+Do not emit the footer or a resume command for a nested phase controlled by
+Autocomplete. An intermediate `NEEDS_REPLAN`, Plan/Vet checkpoint, or new
+agent-owned fingerprint must continue in the same invocation under the caller
+contract. If the host compacts, persist the current checkpoint and resume from it;
+context pressure is never permission to turn routine backtracking into a user
+handoff.
+
 ## When NOT to recommend `/clear` or `/compact`
 
 - The current phase is read-only and cheap (`/rite-status`, `/rite` menu): no

package/pack/generated/claude/skills/devrites-lib/reference/standards/core.md

@@ -40,7 +40,10 @@ Repository conventions follow [Precedence](#precedence).
 ## Lifecycle rest points
 
 Before advancing a phase, run `devrites-engine check readiness <slug>` for
-structure; exact agents/checklists own semantics. Persist and stop on block.
+structure; exact agents/checklists own semantics. Standalone rites persist and stop
+on block. Under an active controlling caller, an agent-owned technical block is a
+persisted backward edge: return it to that caller instead of producing a
+user-facing stop.
 After native proof/review, `/rite-seal` runs `devrites-engine check seal <slug>`
 for structure/freshness, not prose. HITL/blocked stops follow
 [Persistence before stopping](#persistence-before-stopping-handoff-discipline).

package/pack/generated/claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/generated/claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -36,6 +36,11 @@ the terminal cursor or its recovery count.
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Treat technical readiness as routing, not completion.** `NEEDS_REPLAN` is a backward edge
+  to Plan repair and narrow Vet; `NEEDS_CLARIFICATION` is likewise internal when
+  decision coverage can be resolved from existing authority. Neither state may
+  end Autocomplete unless its underlying fingerprint is actually exhausted or a
+  human/safety/access decision is required.
 - **Do not confuse an action budget with recovery exhaustion.** After a failed
   consumptive action, zero remaining real attempts blocks only another execution.
   New retained Critical/Important evidence starts offline repair and narrow Vet
@@ -73,6 +78,9 @@ the terminal cursor or its recovery count.
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
    a stale pre-ownership workflow-artifact writer stop reopens under
    `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   A `NEEDS_REPLAN` cold resume with a valid technical return cursor immediately
+   invokes Plan repair and Recovery Vet before selecting a forward phase or
+   emitting any reply.
    That materialization runs directly as non-consumptive prerequisite recovery,
    even with no pending product slice or AFK budget; it does not re-ask an answered
    human gate.

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid
@@ -101,6 +104,24 @@ for a human-owned decision or mandatory safety/access action. Exhausted
 agent-owned recovery stops once with its reproduction and dead ends, never with
 another routine Plan/Vet command.
 
+## Continuous caller obligation
+
+No user-facing reply is permitted while the durable state contains an
+agent-owned `NEEDS_REPLAN`, an intermediate Plan/Vet `next_action`, or a distinct
+Critical/Important fingerprint with remaining recovery budget. Invoke the exact
+next Plan repair and Recovery Vet immediately. A narrow reviewer closing its input
+finding and exposing another Critical/Important invariant is progress: close the
+old fingerprint, open the new one, and continue without handing a command to the
+user.
+
+The number of completed repair/Vet cycles is not a stop condition and cannot be
+used as a surrogate recovery budget. Only three no-progress corrections of the
+same exact fingerprint exhaust. Context pressure, compaction, session duration,
+or a nested skill's completion footer also cannot convert an internal checkpoint
+into a stop; persist the checkpoint and resume from it inside the same controlling
+invocation. Autocomplete may emit its final reply only after reaching its requested
+rest point or one of the shared human/safety/access/exhaustion stop conditions.
+
 ## Between phases
 
 - Re-read the active workspace before each phase (don't trust chat memory).

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -29,6 +29,11 @@ on exhaustion, stop as a technical blocker unless human-owned.
 
 ## Not a stop: agent-owned backtracking
 
+`NEEDS_REPLAN` is not a stop condition under an active Autocomplete caller. It
+blocks forward advancement, persists the return cursor, and immediately routes
+Plan repair plus Recovery Vet. The same applies to any intermediate nested
+`STOP`/`Next step` whose underlying decision is agent-owned.
+
 Agent-owned backtracking is not a stop condition while its causal-fingerprint
 budget remains. The active caller invokes the earlier phase inline, follows Vet
 and any bounded remediation, then resumes the originating phase. Persist
@@ -52,7 +57,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -144,8 +144,12 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    After each fold-back rerun step 2a; missing/meaning-changing mappings block.
    Keep `state.md` non-READY for step 6.
 6. **One narrow recheck after edits.** If the candidate changed, dispatch exact
-   `devrites-plan-reviewer` once with accepted findings, changed paths/criteria,
-   and new identity. No full or third loop; if it changes the plan, repeat step 5.
+   `devrites-plan-reviewer` once per correction/fingerprint with accepted findings,
+   changed paths/criteria, and new identity. Within that same correction, no full
+   or third loop; if it changes the plan, repeat step 5. If the recheck closes its
+   input fingerprint but discovers a distinct Critical/Important invariant, return
+   that new fingerprint to the controlling caller as progress. It may start the
+   next bounded Plan/Recovery-Vet cycle; the prior reviewer count is not exhaustion.
    Then close the matrix and rerun step 2a's ID-and-meaning audit.
 
 6a. **Build readback.** From the final owning artifacts, add a cited five-line

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -73,7 +73,11 @@ has no clear next move.
   workspace follow
   [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
   and are materialized by the controlling root. Never ask a read-only planner or
-  reviewer to return implementation bodies.
+  reviewer to return implementation bodies. Materializer failures are reversible
+  offline recovery, not consumptive one-shot execution: preserve the transaction
+  journal, preimage hashes, and bound temporaries, preflight the corrected
+  transaction in a disposable same-layout fixture, then retry only within the
+  existing materializer fingerprint budget.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable

package/pack/generated/codex/skills/devrites-lib/reference/reply-contract.md

@@ -6,6 +6,12 @@ artifact.
 
 Keep the reply compact and evidence-backed:
 
+When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN`, a
+nested phase `STOP`, and a routine Plan/Vet `Next step` are not eligible completion
+states. Return them to the caller without a user-facing reply. Autocomplete may
+use the shapes below only after its requested rest point or a shared genuine
+human/safety/access/exhausted-recovery stop is reached.
+
 ```text
 Done: <result in one sentence>
 Changed: <artifact or source paths>

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -264,7 +264,9 @@ changes, not a request for permission to retry.
   a read-only role or product wright for implementation and evidence records
   **no controlling-root materialization attempt**. Preserve the old attempts, but
   do not count them against the new root-materialization fingerprint. Record the
-  migration; after a root attempt exists, normal fingerprint accounting applies.
+  migration; after a root attempt exists, normal fingerprint accounting applies:
+  the first root failure is attempt one, not a new one-shot terminal, and the
+  shared cap remains three no-progress corrections.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `$rite-plan unblock`, another phase command, a question, or

package/pack/generated/codex/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -54,6 +54,15 @@ Resume next session with: <single command, e.g. $rite-build slice 2>
 This is advice, not a gate. The user can ignore it. It reports a trade-off the model
 cannot inspect directly because no API reports context fullness.
 
+### Autocomplete exception
+
+Do not emit the footer or a resume command for a nested phase controlled by
+Autocomplete. An intermediate `NEEDS_REPLAN`, Plan/Vet checkpoint, or new
+agent-owned fingerprint must continue in the same invocation under the caller
+contract. If the host compacts, persist the current checkpoint and resume from it;
+context pressure is never permission to turn routine backtracking into a user
+handoff.
+
 ## When NOT to recommend `/clear` or `/compact`
 
 - The current phase is read-only and cheap (`$rite-status`, `$rite` menu): no

package/pack/generated/codex/skills/devrites-lib/reference/standards/core.md

@@ -40,7 +40,10 @@ Repository conventions follow [Precedence](#precedence).
 ## Lifecycle rest points
 
 Before advancing a phase, run `devrites-engine check readiness <slug>` for
-structure; exact agents/checklists own semantics. Persist and stop on block.
+structure; exact agents/checklists own semantics. Standalone rites persist and stop
+on block. Under an active controlling caller, an agent-owned technical block is a
+persisted backward edge: return it to that caller instead of producing a
+user-facing stop.
 After native proof/review, `$rite-seal` runs `devrites-engine check seal <slug>`
 for structure/freshness, not prose. HITL/blocked stops follow
 [Persistence before stopping](#persistence-before-stopping-handoff-discipline).

package/pack/generated/codex/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -7,6 +7,13 @@ privileged/external state so a rerun is not equivalent, and actions whose cleanu
 can destroy the failure state needed for diagnosis. Successful cleanup does not
 make a consumptive action repeatable.
 
+Workflow-artifact materialization is reversible offline work when every admitted
+target has a bound preimage or absence marker, rollback is local to the active
+feature workspace, and no privileged/external real action executes. It is not a
+consumptive action and must not receive a one-shot authorization budget. Failures
+of its materializer, atomic replacement, rollback, or offline proof use the normal
+causal-fingerprint recovery cap in `afk-hitl.md`.
+
 ## Pre-attempt gate
 
 Before Vet can emit READY, and again immediately before Prove executes the action,

package/pack/generated/codex/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -37,7 +37,9 @@ directly even when all product slices are built or the AFK slice budget is zero.
 Do not consume product-slice budget, reopen an answered human gate, or require GO
 for this offline work. After any controlling-root attempt is recorded, this
 migration cannot apply again; route its observed atomic/proof failure under the
-new fingerprint instead.
+new fingerprint instead. Applying the migration once does not make the first root
+attempt terminal: normal fingerprint accounting starts with that attempt and
+allows up to three no-progress corrections under `afk-hitl.md`.
 
 ## Admission
 
@@ -52,15 +54,39 @@ Before writing:
    or a request that a drafter supply code is a Plan gap, not implementation input.
 3. Record preimages or absence for every target plus protected product manifests
    and the current candidate digest. Resolve every parent no-follow before mutation.
+4. Before creating an active transaction, **preflight the materializer itself**.
+   Do this before any journal or admitted-target mutation. Compile/static-check
+   it, then run its
+   complete transaction machinery in a disposable same-layout fixture. Cover an
+   existing target, an absent target, full success, injected replacement failure,
+   rollback cleanup, retained-temporary cleanup, and idempotent rerun. Require the
+   fixture to prove that failures leave every simulated target at its bound
+   preimage and that no same-parent temporary escapes its admitted directory. Run
+   with the working directory outside the admitted parent, and execute negative
+   mutants where relative replacement omits either directory handle; both mutants
+   must fail before the active transaction is eligible.
 
 ## Materialize
 
 The root authors the smallest complete bytes for all admitted targets. Write each
 through a same-parent private temporary file, set the planned mode, flush it, and
 atomically replace the target; settle the whole set or roll back partial output.
+Anchor every relative rename/replace operand to its source and destination directory handles.
+For Python `os.replace`, pass both `src_dir_fd`
+and `dst_dir_fd`; a basename plus only the destination handle is not admitted.
 Do not install dependencies, touch Git, use the network, mutate product paths, or
 execute the consumptive action.
 
+Workflow-artifact materialization is not a consumptive action. Its active
+transaction may begin only after the disposable preflight is green. If an active
+attempt fails, preserve its journal, exact hashes, and decisive boundary before
+cleanup. When all targets remain at their recorded preimages and only bound
+same-parent temporaries remain, perform exact fail-closed cleanup, repair and
+preflight the materializer offline, then retry under the same causal fingerprint.
+The first controlling-root failure is attempt one of the shared cap, not terminal
+exhaustion; stop only after three no-progress corrections or a genuine
+human/safety/access gate.
+
 ## Verify and return
 
 Read back the exact path set, modes, and SHA-256 identities. Run only the vetted

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -36,6 +36,11 @@ the terminal cursor or its recovery count.
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Treat technical readiness as routing, not completion.** `NEEDS_REPLAN` is a backward edge
+  to Plan repair and narrow Vet; `NEEDS_CLARIFICATION` is likewise internal when
+  decision coverage can be resolved from existing authority. Neither state may
+  end Autocomplete unless its underlying fingerprint is actually exhausted or a
+  human/safety/access decision is required.
 - **Do not confuse an action budget with recovery exhaustion.** After a failed
   consumptive action, zero remaining real attempts blocks only another execution.
   New retained Critical/Important evidence starts offline repair and narrow Vet
@@ -73,6 +78,9 @@ the terminal cursor or its recovery count.
    fingerprint below its no-progress cap reopens caller-owned offline recovery;
    a stale pre-ownership workflow-artifact writer stop reopens under
    `workflow-artifacts.md` when no controlling-root materialization attempt exists.
+   A `NEEDS_REPLAN` cold resume with a valid technical return cursor immediately
+   invokes Plan repair and Recovery Vet before selecting a forward phase or
+   emitting any reply.
    That materialization runs directly as non-consumptive prerequisite recovery,
    even with no pending product slice or AFK budget; it does not re-ask an answered
    human gate.

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -72,7 +72,10 @@ root ownership is a changed routing condition. Preserve the old fingerprint,
 record the new materialization fingerprint, and run that offline branch directly;
 do not charge or require product-slice/AFK budget, re-ask a resolved question, or
 request GO. Once a root materialization attempt exists, never apply this migration
-again—route its observed failure normally. This reconciliation runs even when all
+again—route its observed failure normally. That one-time migration
+does not make the first root attempt terminal: record it as attempt one under the new
+materializer fingerprint and continue bounded offline correction while fewer than
+three no-progress corrections exist. This reconciliation runs even when all
 product slices are already built, before selecting the next forward phase.
 
 1. Save the originating phase/action in the native return cursor unless a valid
@@ -101,6 +104,24 @@ for a human-owned decision or mandatory safety/access action. Exhausted
 agent-owned recovery stops once with its reproduction and dead ends, never with
 another routine Plan/Vet command.
 
+## Continuous caller obligation
+
+No user-facing reply is permitted while the durable state contains an
+agent-owned `NEEDS_REPLAN`, an intermediate Plan/Vet `next_action`, or a distinct
+Critical/Important fingerprint with remaining recovery budget. Invoke the exact
+next Plan repair and Recovery Vet immediately. A narrow reviewer closing its input
+finding and exposing another Critical/Important invariant is progress: close the
+old fingerprint, open the new one, and continue without handing a command to the
+user.
+
+The number of completed repair/Vet cycles is not a stop condition and cannot be
+used as a surrogate recovery budget. Only three no-progress corrections of the
+same exact fingerprint exhaust. Context pressure, compaction, session duration,
+or a nested skill's completion footer also cannot convert an internal checkpoint
+into a stop; persist the checkpoint and resume from it inside the same controlling
+invocation. Autocomplete may emit its final reply only after reaching its requested
+rest point or one of the shared human/safety/access/exhaustion stop conditions.
+
 ## Between phases
 
 - Re-read the active workspace before each phase (don't trust chat memory).

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -29,6 +29,11 @@ on exhaustion, stop as a technical blocker unless human-owned.
 
 ## Not a stop: agent-owned backtracking
 
+`NEEDS_REPLAN` is not a stop condition under an active Autocomplete caller. It
+blocks forward advancement, persists the return cursor, and immediately routes
+Plan repair plus Recovery Vet. The same applies to any intermediate nested
+`STOP`/`Next step` whose underlying decision is agent-owned.
+
 Agent-owned backtracking is not a stop condition while its causal-fingerprint
 budget remains. The active caller invokes the earlier phase inline, follows Vet
 and any bounded remediation, then resumes the originating phase. Persist
@@ -52,7 +57,12 @@ as root materialization attempts. Reopen only when exact paths and executable
 behavior passed Vet and there is **no controlling-root materialization attempt**;
 record the routing migration so it cannot reset again. Missing product slices,
 unresolved protocol choices, or a recorded root attempt remain under their normal
-gate/fingerprint rules.
+gate/fingerprint rules. The first controlling-root failure is not exhaustion: it
+is the first no-progress result for the materializer fingerprint. If all targets
+still equal their recorded preimages, no real action ran, and only admitted bound
+temporaries remain, reopen an incorrectly persisted one-shot `1/1` terminal,
+preserve its evidence as attempt one, clean/repair/preflight offline, and continue
+within the shared three-attempt cap.
 
 Past evidence being irretrievable is not by itself terminal. When an in-scope
 trusted diagnostic seam can make the next retained fingerprint uniquely

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -23,7 +23,11 @@ See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
    dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
    paths, wright never widens, and a missing profile stops.
    For the workflow-artifact branch, the controlling root writes only the admitted
-   `.devrites/work/<slug>/` paths, proves the complete atomic set, rechecks an
+   `.devrites/work/<slug>/` paths. Before an active journal or target write, it
+   compiles the materializer and runs the exact transaction implementation in a
+   disposable same-layout fixture covering success, replacement failure, rollback,
+   retained-temporary cleanup, and rerun. It then proves the complete atomic set,
+   rechecks an
    identical product candidate, records hashes/evidence, and runs narrow Vet. Do not
    dispatch any agent as a substitute writer and do not charge a product slice.
 

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -144,8 +144,12 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    After each fold-back rerun step 2a; missing/meaning-changing mappings block.
    Keep `state.md` non-READY for step 6.
 6. **One narrow recheck after edits.** If the candidate changed, dispatch exact
-   `devrites-plan-reviewer` once with accepted findings, changed paths/criteria,
-   and new identity. No full or third loop; if it changes the plan, repeat step 5.
+   `devrites-plan-reviewer` once per correction/fingerprint with accepted findings,
+   changed paths/criteria, and new identity. Within that same correction, no full
+   or third loop; if it changes the plan, repeat step 5. If the recheck closes its
+   input fingerprint but discovers a distinct Critical/Important invariant, return
+   that new fingerprint to the controlling caller as progress. It may start the
+   next bounded Plan/Recovery-Vet cycle; the prior reviewer count is not exhaustion.
    Then close the matrix and rerun step 2a's ID-and-meaning audit.
 
 6a. **Build readback.** From the final owning artifacts, add a cited five-line

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.10",
+  "version": "4.0.12",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",