devrites 4.0.12 → 4.1.0

package/pack/generated/codex/skills/rite-ship/reference/rollout.md

@@ -1,43 +1,62 @@
-# Staged rollout & rollback: when the ship includes a live deploy
-
-Opt-in. `$rite-ship`'s job ends at the git ladder (commit → push → tag / PR) and archiving the
-workspace; most projects deploy from CI on merge, and their pipeline owns the rollout. Reach for
-this reference only when the ship *itself* drives a live, staged production rollout the agent is
-responsible for. When it doesn't apply, skip it: the same no-op discipline as the rest of the pack.
-
-The governing idea is the one already in [`git-workflow.md`](../../devrites-lib/reference/standards/git-workflow.md) and
-[`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md): **a launch is only done when it's reversible,
-observable, and incremental.** Write the rollback plan *before* you deploy, not after it breaks.
-
-## The rollback plan is a pre-condition
-Before the first byte ships, the plan exists, with a measured **time-to-rollback** per mechanism:
-feature flag < 1 min, redeploy < 5 min, DB rollback < 15 min. If the fastest reversal is slow, that
-is a launch risk to fix (add a flag) before shipping, not after. A destructive/migration step ships
-only with its rollback proven (expand→contract, [`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md)).
-
-## Advance on evidence: the rollout decision thresholds
-Stage the exposure and, at each stage, read the signals ([`observability.md`](../../devrites-lib/reference/standards/observability.md))
-against a fixed table: advance on green, hold on yellow, roll back on red. Don't eyeball it.
-
-| Signal | Green (advance) | Yellow (hold, investigate) | Red (roll back now) |
-|---|---|---|---|
-| Error rate | within ~10% of baseline | 10-100% over baseline | > 2× baseline |
-| p95 latency | within ~20% of baseline | 20-50% over | > 50% over |
-| Client JS errors | none new | < 0.1% of sessions | > 0.1% of sessions |
-| Business metric on the path | neutral or up | < 5% decline | > 5% decline |
-
-## Stage the exposure, with a monitoring window at each step
-Internal/team → canary ~5% (hold 24-48h) → 25% → 50% → 100%, advancing only when **all** thresholds
-are green and you can still roll back to the previous percentage at any point. Data integrity or a
-security regression is an **immediate** rollback regardless of the table.
-
-## Feature-flag hygiene
-Every flag has an owner and an expiry; test both states in CI; don't nest flags (state explodes);
-remove the flag and its dead branch within ~2 weeks of full rollout: a lingering flag is the
-deprecation debt [`deprecation.md`](../../devrites-lib/reference/standards/deprecation.md) exists to prevent.
-
-## Verify in the first hour (a runbook, not a vibe)
-Health endpoint returns 200 · the error dashboard is flat · latency within budget · one critical
-user flow driven by hand · logs/metrics/traces flowing ([`observability.md`](../../devrites-lib/reference/standards/observability.md)
-"verify the telemetry fires") · a rollback dry-run confirmed reversible. Record the observations in
-`ship.md` / `evidence.md`: an un-watched launch is an unproven one.
+# Staged rollout and recovery: live deploys only
+
+Load this only when `$rite-ship` itself is explicitly authorized to drive a live
+deployment. Git-only Ship stops before rollout; CI-owned deployment follows the pipeline's
+runbook. A Seal GO or AFK setting never authorizes production action.
+
+## Preconditions before exposure
+
+Record one rollout sheet in `ship.md`/`evidence.md`:
+
+| Item | Required decision/evidence |
+| --- | --- |
+| Units and order | Repository/deployable, schema, config, application, worker, contract, and flag order; safe old/new combinations. |
+| Exposure stages | Project-native internal/canary/cohort/percentage/region stages and hold window. |
+| Advance/hold/abort signals | Project baseline or SLO, measurement window, minimum sample, exact threshold, and owner. |
+| Recovery | Fastest safe mechanism, steps, owner, measured/rehearsed time, and data/external-effect reconciliation. |
+| Observability | Watched dashboard/query/alert, failure signal, and executable first action. |
+| Authorization | Exact target/action approved for this attempt; no inferred retry permission. |
+
+Do not import generic percentage, latency, error-rate, or time-to-rollback numbers. Use
+accepted product risk, current baseline/SLO, traffic volume, and platform capability. If the
+project has no defensible threshold or signal, the monitoring gap blocks live exposure.
+
+## Choose the smallest reversible mechanism
+
+- A feature flag is useful only when the off path preserves current behavior, both states
+  are tested, disabling it stops the risky effect, and it has an owner/removal trigger.
+  Do not add a flag to a change already reversible by a safe atomic deploy.
+- A flag cannot reverse destructive data/schema effects. Apply
+  [`data-integrity.md`](../../devrites-lib/reference/standards/data-integrity.md) and prove
+  restore or forward recovery separately.
+- External APIs, webhooks, queues, jobs, and caches apply
+  [`integration-reliability.md`](../../devrites-lib/reference/standards/integration-reliability.md):
+  reconcile unknown outcomes, drain/quarantine/replay safely, and protect downstream capacity.
+- Multi-root/service rollout follows
+  [`repository-topology.md`](../../devrites-lib/reference/standards/repository-topology.md);
+  references to another repository never grant write/deploy authority there.
+
+## Stage, observe, decide
+
+At each authorized stage:
+
+1. Verify the intended versions/config/schema and candidate identity on the exact target.
+2. Exercise one critical success path and the declared degradation/recovery signal.
+3. Observe for the recorded window and sample; bind results to the stage and baseline.
+4. **Advance** only when every advance condition holds. **Hold** on ambiguous or
+   insufficient evidence. **Abort/recover** immediately on an abort condition, security or
+   tenant breach, data-integrity violation, unreconciled duplicate/unknown effect, or loss of
+   observability.
+5. Re-verify after recovery; record partial effects and reconciliation. A rollback command
+   exiting zero is not proof the prior state or data was restored.
+
+Never compress stages because an early sample "looks fine," continue through a monitoring
+gap, or retry a failed live action without fresh authorization when the attempt/target changes.
+
+## Completion
+
+Rollout is complete only when full intended exposure meets the recorded window/signals,
+telemetry is still watched, migrations/backfills and queues/reconciliation are settled,
+documentation matches deployed behavior, and temporary flags/compatibility paths have a
+dated removal owner. Otherwise report the exact current stage and remaining risk; do not call
+the launch done.

package/pack/generated/codex/skills/rite-spec/SKILL.md

@@ -19,6 +19,10 @@ declared invariants; an unavoidable principle violation is blocking.
 For behavioral/high-risk acceptance, use `spec-grammar.md` plus workspace schema;
 simple criteria stay flat `AC-###`. Apply
 [`acceptance-criteria.md`](reference/acceptance-criteria.md) so each is binary and observable.
+Use [`edge-case-trace.md`](../devrites-lib/reference/standards/edge-case-trace.md)
+to populate only relevant edge/prohibition rows. The spec's applicability map routes
+topology, data, integration, security, and delivery concerns to their focused standard;
+load a routed standard to discover required behavior, not to prescribe implementation.
 
 ## Operating rules (DevRites core)
 - No silent assumptions or guessing; prefer conventions; ask on scope,
@@ -65,6 +69,8 @@ simple criteria stay flat `AC-###`. Apply
    template's specific justification.
    Identify proof constraints now: human-only credentials, unavailable environments, approval
    windows, or acceptance not observable through existing test/runtime/browser surfaces.
+   An unfamiliar framework/version routes to `devrites-source-driven`; missing or
+   contradictory documentation is evidence to reconcile, never a license to guess.
    Split independent placement, blast-radius, and external-fact questions into at most three
    bounded `devrites-evidence-scout` tasks on one frozen candidate. Wait for and reconcile every
    cited dossier before step 4. The scout supplies facts only; it never asks the human or writes
@@ -102,7 +108,8 @@ simple criteria stay flat `AC-###`. Apply
    unrelated settled content. Write every required artifact and conditional
    annex exactly from [spec-template](reference/spec-template.md), including its
    capability impact, existing-behavior preservation, grammar/delta,
-   coverage-seed, qualified backstops, edge/prohibition, UI, and AI rules. Native
+   stakeholder/constraint/invariant, failure/recovery, applicability, coverage-seed,
+   qualified backstop, edge/prohibition, UI, and AI rules. Native
    hierarchical instructions remain stable; do not rewrite `AGENTS.md` or
    `CLAUDE.md` for the active workspace.
 5a. **Check the spec prose** with [spec-checklists](reference/spec-checklists.md).

package/pack/generated/codex/skills/rite-spec/reference/ai-spec-template.md

@@ -17,17 +17,24 @@ or LLM output.
 - Fallback/degradation: <what users see when AI is unavailable>
 
 ## Domain evals
-| Eval ID | Scenario | Expected signal | Gate |
-| --- | --- | --- | --- |
-| EVAL-001 | <domain-specific case> | <pass condition> | build/seal |
+| Eval ID | Scenario / slice | Dataset provenance | Expected signal + threshold | Gate |
+| --- | --- | --- | --- | --- |
+| EVAL-001 | <representative/adversarial/empty-context case> | <held-out source/version> | <pass condition and baseline delta> | build/seal |
+
+For RAG, cover retrieval relevance/context recall, context precision, answer
+faithfulness, citation support, tenant/ACL isolation, poisoned or conflicting documents,
+and insufficient-context fallback as applicable. A single polished example is not an eval.
 
 ## Guardrails
 - Inputs: <validation, prompt-injection boundaries, tenant/data limits>
-- Outputs: <schema checks, refusals, human review, citations>
+- Retrieval: <source provenance, indexing validation, tenant/ACL filter, freshness/deletion>
+- Outputs: <schema checks, refusals, human review, citations only to supporting retrieved sources>
 - Privacy/security: <data sent to model, retention, secrets policy>
+- Unknown/insufficient context: <abstain, clarify, or bounded fallback; never fabricate>
 
 ## Monitoring
-- Runtime metrics/logs: <latency, cost, quality, refusal/error rates>
+- Runtime metrics/logs: <latency, cost, retrieval/quality, refusal/error/fallback rates>
 - Alerts or manual review: <trigger>
-- Rollback/kill switch: <mechanism>
+- Rollback/kill switch: <prompt/model/index version and reversible mechanism>
+- Drift evaluation: <reference set, schedule/trigger, regression threshold, owner>
 ```

package/pack/generated/codex/skills/rite-spec/reference/spec-checklists.md

@@ -15,8 +15,8 @@ Emit `.devrites/work/<slug>/checklists/<domain>.md` per covered domain; skip
 | `functional.md` | Functional requirements + scenarios: is each capability stated, bounded, testable? |
 | `data-model.md` | Key entities / data model: shapes, fields, lifecycle, relationships (skip if "none"). |
 | `interaction.md` | API / UI impact + UX states: every screen state and contract named (skip if no UI/API). |
-| `non-functional.md` | Constraints, auth / data sensitivity, latency / scale / compatibility budgets, human-only proof prerequisites. |
-| `edge-cases.md` | Empty / boundary / invalid / concurrent / failure paths the requirements imply. |
+| `non-functional.md` | Invariants; security/privacy/accessibility, latency/scale, compatibility, operations, and human-only proof prerequisites. |
+| `edge-cases.md` | Empty/boundary/invalid/concurrent/failure/recovery paths plus the spec's applicability map. |
 
 ## Each item: a question, a verdict, the line it interrogates
 
@@ -46,9 +46,21 @@ Each question checks one requirement-prose failure mode:
   names its empty / error / boundary behaviour.
 - **Clarity:** one entity, one name (no `user`/`customer`/`account` drift); no requirement two
   readers would implement differently; no "should" where "MUST" is meant.
+- **Assumptions:** no material behavior, scope, data, security, or proof fact survives as a
+  hidden assumption; verify it or record an owned/deadlined assumption or blocking question.
 - **Testability:** each acceptance criterion is binary and names (or clearly implies) its evidence.
   A criterion only provable by reading code is a fail.
 - **Consistency:** no requirement contradicts another, the data model, or a non-goal.
+- **Stakeholders:** affected actors/operators are named; conflicting outcomes have an
+  explicit priority or decision owner rather than two simultaneously impossible promises.
+- **Applicability:** topology, data, integration, security, UI/i18n/time zone, and
+  compatibility/delivery rows are `applies` with IDs or specifically justified `not applicable`.
+- **Failure/recovery:** each partial, timeout, invalid, interrupted, or unavailable state
+  implied by an applicable row has a user outcome, system state, and safe retry/recovery rule.
+- **Data:** schema/backfill/concurrency/tenant/retention implications state invariants and
+  prohibited loss/leakage; implementation detail stays for Define.
+- **Integration:** timeout, invalid/partial response, auth/rate-limit/outage, duplicate,
+  ordering, and version-change behavior is specified when the boundary can produce it.
 - **Preservation:** each material brownfield outcome appears in `Existing behavior
   to preserve` with preserving REQ/AC and current evidence. Missing/vague “no
   regressions” or unjustified `none` is CRITICAL.

package/pack/generated/codex/skills/rite-spec/reference/spec-template.md

@@ -33,10 +33,15 @@ No implementation detail. True greenfield: `none — no existing behavior in the
 | --- | --- | --- |
 | <outcome that must not regress> | REQ-001 / AC-001 | <current evidence> |
 
-## Users / actors
-| Actor | Need |
-| --- | --- |
-| <actor> | <goal> |
+## Stakeholders and priorities
+| Actor/stakeholder | Observable outcome | Conflict / priority rule |
+| --- | --- | --- |
+| <actor or affected owner> | <goal, protection, or operational need> | <none or how competing goals resolve> |
+
+## Constraints and invariants
+- INV-001: <fact that MUST remain true across success, failure, retry, and recovery>.
+- <security/privacy/accessibility/performance/compatibility/data/operational constraint,
+  or `none — <specific reason>` for a materially relevant category>.
 
 ## Requirements
 - REQ-001: The system MUST <observable product behavior>.
@@ -74,6 +79,24 @@ Bespoke only; generic security/privacy stays in standards. Status:
 | --- | --- | --- | --- |
 | PROH-001 | REQ-002 | resolved/test | <test/evidence link> |
 
+## Failure and recovery behavior
+| Trigger / partial state | User-visible outcome | System state | Recovery / retry rule | Requirement/AC |
+| --- | --- | --- | --- | --- |
+| <timeout, invalid input, interruption, dependency loss> | <clear bounded outcome> | <unchanged/pending/reconciling> | <who/what can safely recover> | <REQ/AC> |
+
+## Applicability map
+Use `applies | not applicable`; a non-applicable row needs a specific reason. The
+status routes Define/Vet/Build/Prove to the named standard without copying it here.
+
+| Concern | Status and trigger | Affected REQ/AC/invariant |
+| --- | --- | --- |
+| Repository topology (nested/mono/multi-repo, languages, services, generated/vendor) | <status + reason> | <ids> |
+| Data integrity (writes, schema/migration, concurrency, tenant, retention/privacy) | <status + reason> | <ids> |
+| Integration reliability (API/webhook/queue/job/cache/cross-service) | <status + reason> | <ids> |
+| Security boundary (authn/authz, hostile input/files, secrets, privilege) | <status + reason> | <ids> |
+| UI/accessibility/i18n/time-zone behavior | <status + reason> | <ids> |
+| Compatibility/delivery (old/new versions, config, flag, rollout/rollback) | <status + reason> | <ids> |
+
 ## Edge cases
 - <Boundary note not captured above.>
 
@@ -106,9 +129,15 @@ Bespoke only; generic security/privacy stays in standards. Status:
 
 ## Readiness gate
 - [ ] No blocking clarification; REQ/AC IDs are valid and ACs independently provable.
+- [ ] Stakeholder conflicts/priority rules, constraints, and invariants are explicit;
+      implementation preferences are not disguised as requirements.
 - [ ] Existing affected behavior maps to preserving REQ/AC + current evidence, or uses the exact justified greenfield `none`.
 - [ ] Edge rows target REQ/AC or justify dismissal; every backstop names independent discriminating evidence, else `unresolved`.
 - [ ] Prohibitions resolve/dismiss; `resolved/test` links evidence.
+- [ ] Each material failure/partial state names user outcome, system state, recovery,
+      and REQ/AC; no silent success or blind retry remains.
+- [ ] Every applicability row is `applies` with affected IDs or has a specific
+      evidence-backed `not applicable` reason.
 - [ ] AI has `ai-spec.md` and UI has `design-brief.md`; out-of-scope work states not applicable.
 - [ ] Non-goals/scope are explicit; capability impact is singular/specific and matches ledger deltas.
 - [ ] Architecture/flows/decisions are linked, not duplicated; Coverage seed names Clarify surfaces.

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -20,7 +20,9 @@ Pull on demand: `patterns.md` +
 `coding-style.md` (the over-engineering / YAGNI rubric (reuse the pack's standard, don't
 invent one), `documentation.md` (ADR-style `decisions.md` entries), `afk-hitl.md`
 (irreversible-risk list + gate ceiling), `elicitation.md` (the move-set to deepen a section
-that needs more than the default pre-mortem) selected by the section's risk).
+that needs more than the default pre-mortem) selected by the section's risk). Load
+`repository-topology.md`, `data-integrity.md`, or `integration-reliability.md` only when
+the spec applicability map triggers that risk family.
 
 ## Operating rules
 - **Raise outcome ambition without expanding the solution unnecessarily.** Solve the
@@ -67,6 +69,8 @@ that needs more than the default pre-mortem) selected by the section's risk).
    **Interruption pre-mortem:** audit the spec forecast and assumptions for unresolved behavior,
    proof prerequisites, approvals, access, and irreversible gates. Resolve facts and reversible
    details now; retain only unavailable-pre-code or mandatory action-time checkpoints.
+   Challenge each `not applicable` decision against live evidence and each applicable
+   topology/data/integration row against its worst credible partial-state/recovery case.
    - **Deepen on demand.** When a scope decision, requirement, or risk needs more analysis
      than the default pre-mortem provides, choose 3-5 techniques from
      [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md) whose *when-to-reach-for-it* matches that

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -21,7 +21,8 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
 `coding-style.md`, `testing.md`, `spec-grammar.md`, `performance.md`,
 `error-handling.md`, `development-workflow.md`, `afk-hitl.md`,
 `one-shot-actions.md`, `developer-experience.md`, `elicitation.md`, and
-`definition-of-done.md`.
+`definition-of-done.md`. Load `repository-topology.md`, `data-integrity.md`, and
+`integration-reliability.md` only when the spec applicability map or live plan triggers them.
 
 
 ## Operating rules
@@ -85,14 +86,13 @@ Pull the standard named by the active axis: `principles.md`, `patterns.md`,
    [`reference/review-axes.md`](reference/review-axes.md). Search accepted ADRs and
    relevant workspace `decisions.md` files directly. Harden to the smallest
    behavior-preserving plan; ask only when that changes acceptance or explicit architecture policy.
-2a. **Cross-artifact/project gates.** Apply explicit checklists to spec, tasks,
-   and traceability. Every AC/REQ maps by ID and meaning to a real slice/proof;
-   every slice maps back. Check terminology/conflicts, principles, anti-slop, and
-   conventions. Critical blocks; principle exceptions are human-owned. Recheck
-   after hardening and write `analysis.md`.
+2a. **Cross-artifact/project gates.** Check spec/tasks/traceability: every AC/REQ maps by
+   ID/meaning to slice/proof and back. Check terms, conflicts, principles, anti-slop, conventions;
+   Critical blocks and principle exceptions are human-owned. Recheck, then write `analysis.md`.
 2b. **Build-entry preflight.** Using [`reference/artifacts.md`](reference/artifacts.md), verify
-   every exact proof command/cwd/tool/version/prerequisite; package names against authoritative
-   source and nearest manifest/lockfile; parser-sensitive syntax in an isolated fixture;
+   exact command/cwd/tool/version/prerequisite; output filters must preserve upstream failure or
+   check producer status separately. Verify packages against authoritative source and nearest
+   manifest/lockfile; parser-sensitive syntax in an isolated fixture;
    applicable UI/browser harnesses. Remeasure decision-bearing counts/versions/state
    claims read-only: live facts win; conflicts mark stale artifacts;
    unmeasurable conflict = gap. Record complete SHA-256 provenance inputs. Require

package/pack/generated/codex/skills/rite-vet/reference/artifacts.md

@@ -47,9 +47,9 @@ One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds
 Suppressed (confidence ≤4, unverified): <count — one line each>
 
 ## 4. Failure modes
-| New codepath | Realistic failure | Test? | Handling? | Silent? | Verdict |
-|---|---|---|---|---|---|
-| <path> | timeout / nil / race / stale | y/n | y/n | y/n | ok / **CRITICAL gap** |
+| New codepath/boundary | Realistic failure | Partial/unknown effect | Recovery owner/path | Proof? | Silent? | Verdict |
+|---|---|---|---|---|---|---|
+| <path> | timeout / duplicate / race / stale | <state/effect> | <owner/action> | y/n | y/n | ok / **CRITICAL gap** |
 
 ## 5. Dependency safety
 <declared order is safe | exact dependency/order correction>
@@ -152,6 +152,8 @@ acceptance/behavior changes route through the **Spec Drift Guard**.
 - **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
   - `plan.md` §Scope boundaries ← "NOT in scope" items.
   - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
+  - `plan.md` §Applicability and system ownership ← corrected topology/data/integration
+    routing and each triggered standard's feature-specific output.
   - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
     (e.g. refactor-before-feature split).
   - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.

package/pack/generated/codex/skills/rite-vet/reference/review-axes.md

@@ -1,9 +1,7 @@
 # Vet review: scope, four axes, and outputs
 
-Run §0 first as a blocking gate, then review the four axes in order and produce the
-required outputs. Apply the engineering lenses in [`eng-lenses.md`](eng-lenses.md)
-throughout rather than as a separate checklist. Calibrate every finding through the
-confidence and verification gate before presenting it.
+Run blocking §0, then the four axes and required outputs. Apply
+[`eng-lenses.md`](eng-lenses.md) throughout; calibrate every finding before presenting it.
 
 ---
 
@@ -12,29 +10,33 @@ confidence and verification gate before presenting it.
 Before reviewing implementation details, check whether the plan includes more work than
 the settled spec requires.
 
-1. **What already exists?** For each sub-problem in the plan, find the existing code/flow that
-   already solves it (use a code-intelligence index if available: see `../../devrites-lib/reference/standards/tooling.md`).
-   Can the plan **capture outputs from an existing
-   flow** instead of building a parallel one? Reuse → extend → build new, in that order
-   (`coding-style.md`). List every reuse opportunity the plan misses.
-2. **Minimum diff.** Find the smallest set of changes that meets the spec's acceptance
-   criteria. Flag work that can be deferred without blocking acceptance. Do not cut an
-   acceptance criterion; that requires the Drift Guard.
-3. **Complexity smell.** If `plan.md` touches **>8 files** or adds **>2 new services / modules /
-   classes**, treat it as a smell. Check the plan's complexity gate justifies it. If it doesn't
-   → harden to the smallest acceptance-preserving plan. Ask only if reduction changes
-   acceptance or explicit architecture policy; never start the axes unresolved.
-4. **Built-in check.** For each new pattern / infra component / concurrency approach the plan
-   introduces, verify a framework/runtime built-in doesn't already do it, and that the choice is
-   current best practice with no known footgun: invoke `devrites-source-driven` to confirm at
-   the source and record the citation. A custom roll where a built-in exists is a scope-reduction
-   finding.
-5. **Completeness check.** Identify shortcuts in edge-case handling, error paths, and
-   test coverage. Prefer the complete option when AI-assisted implementation makes the
-   additional work small. Flag shortcuts that save little time but leave known gaps.
+1. **What exists?** Find existing code/flows for each sub-problem (use the index per
+   [`tooling.md`](../../devrites-lib/reference/standards/tooling.md)). Can the plan capture their outputs instead of building parallel work?
+   Reuse → extend → build new; list missed reuse.
+2. **Minimum diff.** Find the smallest acceptance-complete change. Flag non-blocking work;
+   cutting acceptance requires Drift Guard.
+3. **Complexity smell.** **>8 files** or **>2 new services/modules/classes** needs a justified
+   complexity gate; otherwise harden to the smallest acceptance-preserving plan. Ask only if
+   reduction changes acceptance or architecture policy.
+4. **Built-in check.** For each new pattern/infra/concurrency approach, dispatch
+   `devrites-source-driven` to verify current framework/runtime support and cite it. Custom
+   work where a built-in suffices is a scope-reduction finding.
+5. **Completeness.** Find edge/error/test shortcuts; prefer the complete option when the
+   extra work is small, and flag small savings that leave known gaps.
 6. **Distribution check.** If the plan introduces a new artifact (CLI binary, package, container,
    deployable), does it include how it gets built / published / installed? If distribution is
    deferred, say so explicitly in "NOT in scope": don't let it silently drop.
+7. **Applicability check.** Compare `spec.md`'s topology/data/integration/security/delivery
+   decisions with live seams. A false `not applicable` or an `applies` row without the
+   focused standard's owner, failure/recovery, deployment order, and proof output is `broken`.
+8. **Decision horizons.** Independently apply
+   [`plan-template.md`](../../rite-define/reference/plan-template.md#decision-horizons) to the
+   plan, questions, assumptions, decisions, and checkpoints; no known item may disappear.
+   Reject `local` for blockers or public contracts, security/data invariants, acceptance,
+   migration/rollback, dependencies, or cross-slice interfaces. Local/checkpoint deferral
+   needs bounded owner, evidence trigger, fallback, and resolution proof; a risk spike needs
+   necessary executable evidence, discriminating criteria, and fallback branches. Any defect is
+   `broken`; unresolved human blockers return to Clarify.
 
 > **STOP discipline.** Fold technical reduction into the plan; ask and stop only for a
 > human-owned choice.
@@ -45,46 +47,43 @@ If the smell does not trip, present the §0 findings and proceed to Axis 1.
 
 ## Four axes (one at a time, at most 8 findings each)
 
-For each axis, fold verified technical findings into the plan, then walk each human-owned
-decision via one coherent `AskUserQuestion` packet. Supporting findings may combine only
-with one owner/trade-off. HITL pauses there; AFK follows `depth.md`. Never invent findings.
+Fold verified technical findings into the plan; present each human-owned decision in one
+`AskUserQuestion` packet. Combine support only for one owner/trade-off. HITL pauses; AFK
+uses `depth.md`. Never invent findings.
 
 ### 1. Architecture
-- Component boundaries, coupling, data-flow patterns, single points of failure. Architecture records invariants, not scaffolding: each medium+ decision should state `Binds:` and `Prevents:` so the builder knows what divergence it prevents.
-- Scaling characteristics; where the plan's approach breaks under real load.
+- Boundaries, coupling, data flow, single points of failure. Record invariants, not
+  scaffolding; medium+ decisions state `Binds:`/`Prevents:`.
+- Repository/deployable roots, canonical contract and mutable-state ownership, shared
+  resources, dependency cycles, and old/new deployment combinations when applicable.
+- Scaling ceiling under real load.
 - Security architecture at the seams (auth, data access, API boundaries): does the plan name
   the trust boundary for each untrusted input?
-- For each new codepath / integration point: **one realistic production failure scenario** and
-  whether the plan accounts for it (feeds the failure-mode table).
+- One realistic production failure per new codepath/integration (feeds failure-mode table).
 - Does any key flow deserve an ASCII diagram in the plan or an inline comment in the code the
   build will write? Name the files that should carry one.
 
 ### 2. Plan code-quality
-- Module structure the plan implies; DRY across the slices (flag planned repetition aggressively).
+- Implied modules and planned cross-slice repetition.
 - Error-handling + edge cases the plan names, and the ones it doesn't (call those out explicitly).
 - Over-engineering (premature abstraction, an extension point with no second caller) vs
   under-engineering (fragile / hacky) relative to `patterns.md` + `coding-style.md`.
-- Tech-debt hotspots the plan walks into; existing inline diagrams in touched files that the
-  change will make stale.
+- Tech-debt hotspots and diagrams the change makes stale.
 
 ### 3. Test-coverage design
-Design tests before code so the build writes them alongside the implementation.
-- **Framework detection:** find the project's existing test runner + conventions; match them
-  (never introduce a new runner to prove one change: `testing.md`).
-- **Map acceptance → tests.** Every spec acceptance criterion must map to ≥1 planned, surface-anchored test (the API response/UI state/CLI output the criterion names, not an internal proxy).
-- **Tool per path:** unit (pure logic, single function, edge cases), integration/E2E (a user
-  flow spanning 3+ components, an auth/payment/data-loss path, a mock-hides-failure boundary),
-  eval (an LLM/prompt change that needs a quality bar).
-- **Interaction inventory (UI slices): enumerate every interactive element + flow.** List each
-  input field, checkbox, radio, select, toggle, button, and actionable link, plus each user
-  flow; assign each ≥1 asserting test **at the right level**: elements/fields → unit/component,
-  critical journeys → one E2E (never one-per-field). Every element/flow with no asserting test
-  is a GAP; no element ships unverified. Write the inventory to `test-plan.md` (table in
-  `artifacts.md`). This is `testing.md` "Completeness" made concrete for the plan.
-- **Regression rule (mandatory, no question):** when the plan modifies existing behavior and the
-  current suite doesn't cover the changed path, a regression test is added to the plan as a
-  **Critical** requirement: no `AskUserQuestion`, no skipping. Regressions are the highest-priority
-  test because they prove something broke. When unsure whether a change is a regression, write the test.
+Design tests before code.
+- **Framework:** match the existing runner/conventions; never add a runner for one change.
+- **Acceptance → tests.** Every AC maps to a planned surface assertion, not an internal proxy.
+- **Map applicable risk → tests.** Data and integration rows cover their relevant
+  duplicate/retry/concurrency/interruption/tenant/timeout/partial/outage/order/rollback cases,
+  or record an evidence-backed dismissal. A mock that cannot exhibit the named risk is a GAP.
+- **Tool per path:** unit for pure logic; integration/E2E for 3+ components,
+  auth/payment/data-loss, or mock-hidden failure; eval for LLM/prompt quality.
+- **UI inventory:** list every interactive element/flow in `test-plan.md`; assign
+  elements/fields a unit/component assertion and critical journeys an E2E. Untested = GAP;
+  no one-E2E-per-field (`artifacts.md`).
+- **Regression (mandatory):** changed behavior without path coverage adds a **Critical**
+  regression test—no question or skip. If uncertain, write it.
 - Produce the **coverage diagram** (shape below) and add a specific test requirement per GAP.
 
 #### Coverage diagram (write to `test-plan.md`)
@@ -119,45 +118,36 @@ Tag each finding `[severity] (confidence: N/10) <plan/task/spec ref> — finding
 - **5-6** moderate → report with "verify this is real".
 - **≤4** speculative → **suppress from the walk-through**, appendix only.
 
-Before raising a finding, quote the lines that support it. If no line supports it, set
-confidence to 4 or lower and suppress it. Do not inflate confidence to avoid suppression.
-`devrites-plan-reviewer` follows the same rule.
+Quote supporting lines. Without them confidence is ≤4 and suppressed; never inflate it.
+`devrites-plan-reviewer` follows this rule.
 
 ---
 
 ## Present human-owned decisions
-Use `AskUserQuestion` per the pack's standard. Plan-review specifics:
+Use standard `AskUserQuestion`:
 - **One decision = one call.** Never ask about agent work or batch unrelated choices.
 - Concrete: name the plan/task section + the quoted line.
 - 2-3 options, including "do nothing / proceed as-is" where reasonable.
-- Per option, one line: **effort** (human ~X / with the build agent ~Y), **risk**, **maintenance**.
-  If the complete option is only marginally more effort than the shortcut (AI makes it cheap),
-  recommend complete.
+- Per option: **effort** (human/build agent), **risk**, **maintenance**; recommend complete
+  when marginally costlier than a shortcut.
 - **Map to a rule.** One sentence tying the recommendation to a DevRites rule (reuse-first,
   fail-fast, test-behavior, measure-first, minimum diff).
-- **Coverage vs kind:** if the options differ in *coverage* (more tests vs fewer, complete vs
-  happy-path), add `Completeness: N/10` per option. If they differ in *kind* (two different
-  architectures), skip the score and note "options differ in kind, not coverage". Never fabricate
-  a score on a kind question.
-- Every material call ends as a **recorded decision**: behavior-preserving technical hardening
-  goes to `decisions.md`; a human-owned HITL choice gets a resolved `questions.md` qid; AFK
-  records the allowed recommendation in `decisions.md`. The review must leave an auditable
-  trail without turning agent work into questions.
+- **Coverage vs kind:** coverage options get `Completeness: N/10`; architecture/kind options
+  state “differ in kind” and get no fabricated score.
+- Record every material call: technical hardening/AFK in `decisions.md`; HITL in a resolved
+  `questions.md` qid. Do not turn agent work into questions.
 
 ---
 
 ## Required outputs (after the axes)
-1. **"NOT in scope":** work considered and explicitly deferred, one-line rationale each. Folds
-   into `plan.md` §Scope boundaries + `spec.md` Non-goals (via the Guard) so it can't silently re-enter.
-2. **"What already exists":** existing code/flows that solve sub-problems, and whether the plan
-   reuses or rebuilds them. Every missed reuse becomes a §0 finding.
-3. **Failure-mode table:** for each new codepath: a realistic failure, and whether (a) a test
-   covers it, (b) error handling exists, (c) the user sees a clear error or a silent failure. A
-   failure with **no test AND no handling AND silent** is a **Critical gap**. (Shape in
-   [`artifacts.md`](artifacts.md).)
-4. **Dependency safety:** verify the declared dependency graph, required execution order,
-   and conflicts where slices touch the same module. Correct unsafe or missing ordering in the
-   plan; do not create a lane/scheduler artifact—the native host schedules eligible work.
+1. **"NOT in scope":** considered/deferred work + rationale, folded into plan boundaries and
+   spec Non-goals via the Guard.
+2. **"What exists":** solving code/flows and reuse/rebuild disposition; missed reuse is §0.
+3. **Failure-mode table:** per new codepath: realistic failure, partial/unknown effect,
+   recovery owner, test, handling, and user-visible/silent result. No test + no handling +
+   silent = **Critical** (`artifacts.md`).
+4. **Dependency safety:** verify graph/order and shared file/state/contract/lock/port/queue/env
+   conflicts. Correct the plan; native host scheduling needs no lane artifact.
 5. **Build-entry preflight:** commands/cwds, tools, package state, parser/browser smoke,
    prerequisites, and provenance ([`artifacts.md`](artifacts.md)).
 6. **Implementation readiness:** goal-backward coverage, wiring, dependency simulation,