devrites 4.0.6 → 4.0.7

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.7](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.6...v4.0.7) (2026-08-08)
+
+### Fixed
+
+* **rite:** resume retained one-shot recovery ([4bd5897](https://github.com/ViktorsBaikers/DevRites/commit/4bd58971f1f3b2f6d8d9bfc7cb22b64066b604be))
+
 ## [4.0.6](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.5...v4.0.6) (2026-08-07)
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -99,7 +99,9 @@ Some work needs a different route:
 - [`/rite-autocomplete`](pack/.claude/skills/rite-autocomplete/SKILL.md) runs
   the reversible lifecycle unattended. With `--ship`, it continues through
   Ship preflight, discloses the exact Git plan, and waits for a fresh literal
-  `GO` plus native approval; without that flag, it stops at Seal GO.
+  `GO` plus native approval; without that flag, it stops at Seal GO. A failed
+  consumptive proof action never retries blindly: retained evidence drives
+  offline repair and re-vetting, and only the next real attempt needs a new GO.
 - [`/rite-upgrade [slug]`](pack/.claude/skills/rite-upgrade/SKILL.md) is a
   compatibility route for an older active workspace that cannot resume. Age or
   cursor form alone never triggers repair; it is not a lifecycle phase.

package/docs/skills.md

@@ -187,7 +187,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | Positive, discriminating tests + build/runtime/browser evidence. Requires the same candidate digest before/after commands and records the exact binding. | All slices built; ready for full verification. |
+| [`rite-prove`](../pack/.claude/skills/rite-prove/SKILL.md) | Positive, discriminating tests + build/runtime/browser evidence. Requires the same candidate digest before/after commands and records the exact binding. Consumptive actions must retain bounded diagnostics through cleanup; a failed action continues offline recovery from that artifact, while any next real execution waits for fresh authorization. | All slices built; ready for full verification. |
 | [`devrites-browser-proof`](../pack/.claude/skills/devrites-browser-proof/SKILL.md) | Browser proof ladder: Playwright MCP → Chrome DevTools MCP → `/run`+`/verify` → project E2E → manual. Auto-emits the structured **Visual Verdict** (per-criterion PASS/FAIL vs `design-brief.md`) for UI slices: consumed by `devrites-frontend-reviewer` and gated at `/rite-seal`. | Scope touches UI. |
 
 ### Polish: normalize, then check the details
@@ -222,7 +222,7 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 
 | Skill | What It Does | Use When |
 |---|---|---|
-| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
+| [`rite-autocomplete`](../pack/.claude/skills/rite-autocomplete/SKILL.md) | Runs the whole lifecycle unattended (spec → clarify → … → seal → ship), choosing the recommended option at each soft gate and recording the rationale in `decisions.md`. A vague prompt triggers one up-front spec/clarify window; after decision coverage is CLEAR it runs without per-phase iteration, pausing only for genuine product/scope/policy decisions, irreversible risk, human-only access/actions, NO-GO, or budget exhaustion. Objective red checks use bounded technical recovery, including cold-resume recovery from retained one-shot evidence; spending an action authorization blocks only another real execution, not offline repair. Default stops at Seal GO; `--ship` (alias `--yolo`) reaches Ship preflight but still requires a fresh literal `GO` and native approval. | "Autocomplete", "do the whole thing", "run the full cycle", "one-shot this feature". |
 | [`rite-zoom-out`](../pack/.claude/skills/rite-zoom-out/SKILL.md) | Map the modules, callers, callees, and decisions in an unfamiliar area using the project's domain glossary. | Explicit-only: `/rite-zoom-out` / `/rite zoom-out`. |
 | [`rite-prototype`](../pack/.claude/skills/rite-prototype/SKILL.md) | Throwaway code answering ONE design question: logic harness OR 2 to 4 UI variations on one route. | Explicit-only: `/rite-prototype` / `/rite prototype`. |
 | [`rite-handoff`](../pack/.claude/skills/rite-handoff/SKILL.md) | Compact chat session → handoff doc. References existing `.devrites/work/<slug>/` artifacts by path. | Explicit-only: `/rite-handoff` / `/rite handoff`. |

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -59,6 +59,10 @@ has no clear next move.
   consumptive action, first re-vet evidence completeness and obtain any required
   fresh authorization; offline fixtures remain mandatory but cannot authorize the
   real attempt.
+- **A spent consumptive authorization is not a spent recovery budget.** When its
+  retained artifact supplies a new Critical/Important fingerprint, continue
+  offline diagnosis, correction, fixtures, and narrow Vet under that fingerprint's
+  no-progress budget. Stop for fresh authorization only before the next real action.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable
@@ -68,7 +72,9 @@ has no clear next move.
   reproduction plus decisive signal rather than hashing symptom text.
   The caller and recovery attempts share one count: read the current context and
   recorded `## Dead ends` / `evidence.md`, then include every no-progress attempt
-  with that fingerprint. Reclassify only on new causal evidence.
+  with that fingerprint. Reclassify only on new causal evidence. On cold resume,
+  a retained fingerprint with fewer than three such attempts remains runnable
+  even if the previous action wrote a terminal cursor.
 - **A maximum of three no-progress attempts per exact causal fingerprint stops the loop.**
   Count an attempt only when its recheck preserves the same decisive failure.
   Record attempt number, exact failure, hypothesis, probe, and failed idea after

package/pack/.claude/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -15,7 +15,9 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
 Only human credentials/quotas/actions, irreversible work, or fresh authorization
-required by a consumptive action pause; never ask for a blind retry.
+required before the next consumptive execution pause. Fresh authorization never
+pauses offline diagnosis or correction from retained evidence; never ask for a
+blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -59,7 +59,11 @@ Claims such as proved, reviewed, sealed, shipped, or complete must point to real
 output or an artifact. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
-For that terminal case use:
+Use that terminal case only after three recorded no-progress corrections of the
+exact fingerprint, or when required evidence was irretrievably absent. A spent
+consumptive-action authorization plus a retained new fingerprint is not terminal;
+it continues offline recovery and waits for fresh authorization only after repair.
+For a true terminal case use:
 
 ```text
 Stopped: Technical recovery exhausted

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -245,10 +245,20 @@ changes, not a request for permission to retry.
   new Critical or Important finding with a different failed invariant and exact
   evidence gets its own fingerprint and budget; Suggestion, Nit, FYI, or renamed
   evidence cannot open, reset, or extend recovery.
+- **Separate consumptive authority from recovery.** Spending a one-shot action's
+  authorization forbids another real execution but does not consume the offline
+  recovery budget for a newly evidenced fingerprint. The retained artifact starts
+  caller-owned diagnosis and correction immediately; only the next consumptive
+  execution waits for fresh authorization.
 - **Persist accounting in existing records.** Record each fingerprint,
   reproduction, attempted correction, `progress: resolved|no-progress`, and
   decisive result in `drift.md` and `evidence.md`. Cold resume derives the count
   from those records. There is no recovery counter file or command.
+- **Reconcile before honoring a terminal cursor.** A persisted distinct
+  Critical/Important fingerprint with retained evidence and fewer than three
+  recorded no-progress corrections still has recovery budget, even when an older
+  `state.md` says `Next step: none`. Resume it; do not treat session age or the
+  prior action's spent authorization as exhaustion.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -54,6 +54,10 @@ re-reads `state.md`, follows the durable return cursor and intermediate
 `next_action`, and resumes its originating phase while no human-owned, safety,
 access, budget, or exhausted-recovery stop is active.
 
+Derive `exhausted-recovery` from the exact fingerprint's recorded no-progress
+attempts, not from a stale `state.md` label. A consumed authorization for one
+real action does not exhaust offline recovery from its retained new evidence.
+
 An intermediate `Next step` is cold-resume metadata. Do not ask the human to
 copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun
 commands during the active recovery chain. Only the controlling caller emits

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -39,8 +39,28 @@ retention design should have preserved.
 ## Failure handling
 
 After a consumptive action fails, its retained artifact is the reproduction input.
-Do not rerun the action during triage. A new attempt is admissible only after the
-evidence identifies a changed invariant or external condition, the affected plan
-and fixtures are re-vetted, and any required fresh authorization is obtained. If
-the attempt ran without complete retention, stop with the observed technical
-blocker; a blind retry cannot manufacture the destroyed evidence.
+Do not rerun the action during triage.
+
+Keep two budgets separate:
+
+- **Action authorization:** the failed execution consumes only the authorization
+  for that consumptive execution. Zero remaining action attempts prohibits another
+  real execution; it does not exhaust offline diagnosis or correction.
+- **Causal-fingerprint recovery:** when the retained artifact supplies a new
+  Critical/Important failed invariant, the controlling caller immediately runs
+  bounded offline triage, repair, fixtures, and narrow Vet in the same invocation.
+  Count only no-progress corrections of that exact fingerprint under
+  `afk-hitl.md`; do not stop merely because the action authorization was consumed.
+
+Cold resume does not make that fingerprint old or exhausted. Derive its offline
+no-progress count from `drift.md` and `evidence.md`; while the count is below the
+cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`.
+That terminal cursor is valid only for missing retention, a human/safety gate, or
+an actually exhausted fingerprint.
+
+A new real attempt is admissible only after the affected plan and fixtures are
+re-vetted, the failure condition is shown changed, and any required fresh
+authorization is obtained. Stop at that authorization boundary; never infer it
+from successful offline repair. If the attempt ran without complete retention,
+stop with the observed technical blocker because a blind retry cannot manufacture
+the destroyed evidence.

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -15,6 +15,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` and `.claude/skills/devrites-lib/reference/standards/afk-hitl.md` first.
+When the cursor or approved plan contains a consumptive action, also read
+`.claude/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
+stop/continue or execution decision.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -29,6 +32,11 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Do not confuse an action budget with recovery exhaustion.** After a failed
+  consumptive action, zero remaining real attempts blocks only another execution.
+  New retained Critical/Important evidence starts offline repair and narrow Vet
+  inside this Autocomplete invocation. Stop for a fresh GO only after that repair
+  changes the failure condition and Vet is READY.
 - **Budget from the post-vet slice count.** Vet may split/add slices.
   `--max-slices N` may lower the cap for a partial run; otherwise build all.
 - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -55,7 +63,12 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Workflow
 1. **Orient + parse args.** Resolve the explicit or active slug, require its
-   `state.md`, and read the cursor directly.
+   `state.md`, and read the cursor directly. Before honoring `blocked` with a
+   terminal `next_action`, reconcile retained consumptive-action artifacts and
+   per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
+   fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   reconstruct any missing return cursor only from the current phase plus the
+   exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
    for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
    the plan's slice count, i.e. run all planned slices). Parse only the current
@@ -90,7 +103,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
    before any later phase runs; the cursor names the last completed phase and the
    effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
-   on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
+   first route an agent-owned red technical result through the loop's bounded
+   recovery; its `blocked` label alone is not a stop condition. After that, on
+   hard-risk / human-owned blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
    Exhausted agent-owned technical recovery uses the terminal `Next step: none`
    marker and never hands the user `/rite-plan unblock` or another routine
@@ -120,7 +135,9 @@ Do not write a narrative recap.
 ## Clean baseline and checkpoint mode
 - Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
 - Arm `.devrites/CHECKPOINT`; `/rite-ship` collapses its local-only proven-slice checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- Red gates block forward advancement and enter caller-owned bounded recovery.
+  Stop only when the shared stop contract classifies risk/HITL or the exact
+  fingerprint's recovery budget is exhausted.
 - One autocomplete pass spans the lifecycle. Each wright returns after one slice;
   explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
   otherwise HITL stops.

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -57,6 +57,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 When a later phase finds an agent-owned technical gap in an earlier phase, the
 Autocomplete root remains the caller:
 
+On cold resume, reconcile the terminal cursor against durable fingerprint
+accounting first. A retained distinct fingerprint with fewer than three
+no-progress corrections is unfinished recovery, not an unchanged terminal stop.
+Restore `return_phase` from the current phase and `return_next_action` only from
+the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
+to the applicable Vet contract and never licenses execution.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After
@@ -71,6 +78,10 @@ Autocomplete root remains the caller:
    a genuinely new Critical/Important fingerprint. Charge only a no-progress
    outcome against the same fingerprint; lower-severity novelty cannot prolong
    the chain.
+   For a failed consumptive action, its spent authorization blocks only another
+   real execution. A retained artifact that identifies a new fingerprint is the
+   offline reproduction input: diagnose, repair, and narrow-Vet it now, then pause
+   for fresh authorization before any next consumptive execution.
 5. When the prerequisite chain is green, restore and consume the return cursor,
    resume the originating phase, and continue the forward table.
 

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -9,6 +9,12 @@ Closure of a prior fingerprint is progress, not exhaustion. A separately evidenc
 Critical/Important failed invariant starts its own bounded fingerprint; it never
 resets or extends the budget of the one just closed.
 
+An exhausted consumptive-action authorization is not technical-recovery
+exhaustion. It blocks another real action, but retained evidence of a new
+Critical/Important fingerprint must enter offline caller-owned recovery while its
+own no-progress budget remains. After affected Vet is READY, pause for fresh action
+authorization; never execute from the old GO.
+
 ## Always stop (irreversible-risk list: from `afk-hitl.md`)
 
 Regardless of `allow_gates` or `--ship`:
@@ -35,6 +41,10 @@ the remaining choice is a real human/safety/access gate.
 On technical exhaustion, preserve the fingerprint, reproduction, attempts, and
 dead ends, then stop without `/rite-plan unblock` or another phase command.
 Reinvocation with unchanged evidence remains blocked and does not reset the cap.
+Here `unchanged` means the same fingerprint already has three recorded
+no-progress corrections. A retained fingerprint with remaining offline budget is
+not terminal merely because `state.md` was written by the failed action or a prior
+session ended.
 
 ## Stop on gate severity
 

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -86,7 +86,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
 
 ## Workflow
 0. Read core, load relevant rules above, then resolve the active slug,
-   require its `state.md`, and read the cursor directly.
+   require its `state.md`, and read the cursor directly. On a blocked Prove cold
+   resume, reconcile any retained consumptive-action artifact against recorded
+   no-progress corrections before accepting `next_action: none`; a distinct
+   fingerprint below its cap resumes offline triage without another real action.
 1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
    `test-plan.md`, and the full diff.
    A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
@@ -115,7 +118,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    stale, or disposable-only evidence surface returns to Vet inline and consumes
    no attempt. Record the admitted artifact identity before execution. After a
    failed consumptive action, triage from that artifact; never reproduce it by
-   rerunning the action.
+   rerunning the action. Consuming its authorization blocks only another real
+   execution. If the artifact identifies a new Critical/Important fingerprint,
+   continue offline recovery inside this Prove invocation; do not label the new
+   fingerprint exhausted because the action budget is zero.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:
@@ -145,6 +151,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    Vet inside this invocation, and resume the exact failed proof rung. Ask only
    for a human-owned decision; causal-fingerprint exhaustion stops once with a
    technical blocker rather than another phase command.
+   For a consumptive-action failure, use fixtures or another non-consumptive
+   reproduction to fix and re-vet the retained fingerprint. Once the failure
+   condition is demonstrably changed, stop at the fresh-authorization boundary;
+   only a new human GO may admit the next real attempt.
 8. The root updates `evidence.md`, `browser-evidence.md` (when present),
    `traceability.md`, and `state.md`. Record exactly one binding for the observed
    digest in evidence and browser evidence. New proof goes to canonical

package/pack/.claude/skills/rite-prove/reference/failure-triage.md

@@ -11,7 +11,9 @@ loop to `devrites-debug-recovery`.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
-   - environment/setup (missing dep, wrong node/ruby) → fix setup or record blocker.
+   - environment/setup (missing dep, wrong node/ruby) → fix it when agent-owned;
+     record a blocker only for human/access ownership, scope overflow, or exhausted
+     fingerprint recovery.
    - flaky (passes on re-run, timing/order) → note it; don't paper over with retries.
    - external dependency down → record blocker; don't fake the result.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
@@ -19,7 +21,9 @@ loop to `devrites-debug-recovery`.
    scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
 5. **Re-run** the same command when it is repeatable; confirm green and record both
    attempts in `evidence.md`. A consumptive action needs re-vetted evidence
-   completeness and any fresh authorization before a new attempt.
+   completeness and any fresh authorization before a new attempt. Its spent
+   action authorization does not stop offline recovery: a retained new fingerprint
+   enters caller-owned diagnosis, correction, fixtures, and narrow Vet immediately.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/.claude/skills/rite-spec/reference/state-workspace.md

@@ -131,6 +131,13 @@ resume. Never overwrite an existing valid return cursor, and preserve every
 unrelated Markdown byte. `/rite-clarify` applies its stricter native cursor
 protocol below.
 
+On cold resume, a terminal `next_action` is a claim to verify, not a counter.
+Reconcile the exact fingerprint and its attempts in `drift.md` / `evidence.md`.
+If a consumptive action retained a distinct fingerprint below the no-progress
+cap, rewrite the cursor into caller-owned recovery and preserve or reconstruct
+the return rows only from the current phase and approved recorded action. The
+spent action authorization blocks another execution, not that rewrite.
+
 `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
 configuration. Only the controlling root writes it under the shared
 [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#the-sentinel-devritesafk)

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -59,6 +59,10 @@ has no clear next move.
   consumptive action, first re-vet evidence completeness and obtain any required
   fresh authorization; offline fixtures remain mandatory but cannot authorize the
   real attempt.
+- **A spent consumptive authorization is not a spent recovery budget.** When its
+  retained artifact supplies a new Critical/Important fingerprint, continue
+  offline diagnosis, correction, fixtures, and narrow Vet under that fingerprint's
+  no-progress budget. Stop for fresh authorization only before the next real action.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable
@@ -68,7 +72,9 @@ has no clear next move.
   reproduction plus decisive signal rather than hashing symptom text.
   The caller and recovery attempts share one count: read the current context and
   recorded `## Dead ends` / `evidence.md`, then include every no-progress attempt
-  with that fingerprint. Reclassify only on new causal evidence.
+  with that fingerprint. Reclassify only on new causal evidence. On cold resume,
+  a retained fingerprint with fewer than three such attempts remains runnable
+  even if the previous action wrote a terminal cursor.
 - **A maximum of three no-progress attempts per exact causal fingerprint stops the loop.**
   Count an attempt only when its recheck preserves the same decisive failure.
   Record attempt number, exact failure, hypothesis, probe, and failed idea after

package/pack/generated/claude/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -15,7 +15,9 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
 Only human credentials/quotas/actions, irreversible work, or fresh authorization
-required by a consumptive action pause; never ask for a blind retry.
+required before the next consumptive execution pause. Fresh authorization never
+pauses offline diagnosis or correction from retained evidence; never ask for a
+blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected

package/pack/generated/claude/skills/devrites-lib/reference/reply-contract.md

@@ -59,7 +59,11 @@ Claims such as proved, reviewed, sealed, shipped, or complete must point to real
 output or an artifact. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
-For that terminal case use:
+Use that terminal case only after three recorded no-progress corrections of the
+exact fingerprint, or when required evidence was irretrievably absent. A spent
+consumptive-action authorization plus a retained new fingerprint is not terminal;
+it continues offline recovery and waits for fresh authorization only after repair.
+For a true terminal case use:
 
 ```text
 Stopped: Technical recovery exhausted

package/pack/generated/claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -245,10 +245,20 @@ changes, not a request for permission to retry.
   new Critical or Important finding with a different failed invariant and exact
   evidence gets its own fingerprint and budget; Suggestion, Nit, FYI, or renamed
   evidence cannot open, reset, or extend recovery.
+- **Separate consumptive authority from recovery.** Spending a one-shot action's
+  authorization forbids another real execution but does not consume the offline
+  recovery budget for a newly evidenced fingerprint. The retained artifact starts
+  caller-owned diagnosis and correction immediately; only the next consumptive
+  execution waits for fresh authorization.
 - **Persist accounting in existing records.** Record each fingerprint,
   reproduction, attempted correction, `progress: resolved|no-progress`, and
   decisive result in `drift.md` and `evidence.md`. Cold resume derives the count
   from those records. There is no recovery counter file or command.
+- **Reconcile before honoring a terminal cursor.** A persisted distinct
+  Critical/Important fingerprint with retained evidence and fewer than three
+  recorded no-progress corrections still has recovery budget, even when an older
+  `state.md` says `Next step: none`. Resume it; do not treat session age or the
+  prior action's spent authorization as exhaustion.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `/rite-plan unblock`, another phase command, a question, or

package/pack/generated/claude/skills/devrites-lib/reference/standards/core.md

@@ -54,6 +54,10 @@ re-reads `state.md`, follows the durable return cursor and intermediate
 `next_action`, and resumes its originating phase while no human-owned, safety,
 access, budget, or exhausted-recovery stop is active.
 
+Derive `exhausted-recovery` from the exact fingerprint's recorded no-progress
+attempts, not from a stale `state.md` label. A consumed authorization for one
+real action does not exhaust offline recovery from its retained new evidence.
+
 An intermediate `Next step` is cold-resume metadata. Do not ask the human to
 copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun
 commands during the active recovery chain. Only the controlling caller emits

package/pack/generated/claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -39,8 +39,28 @@ retention design should have preserved.
 ## Failure handling
 
 After a consumptive action fails, its retained artifact is the reproduction input.
-Do not rerun the action during triage. A new attempt is admissible only after the
-evidence identifies a changed invariant or external condition, the affected plan
-and fixtures are re-vetted, and any required fresh authorization is obtained. If
-the attempt ran without complete retention, stop with the observed technical
-blocker; a blind retry cannot manufacture the destroyed evidence.
+Do not rerun the action during triage.
+
+Keep two budgets separate:
+
+- **Action authorization:** the failed execution consumes only the authorization
+  for that consumptive execution. Zero remaining action attempts prohibits another
+  real execution; it does not exhaust offline diagnosis or correction.
+- **Causal-fingerprint recovery:** when the retained artifact supplies a new
+  Critical/Important failed invariant, the controlling caller immediately runs
+  bounded offline triage, repair, fixtures, and narrow Vet in the same invocation.
+  Count only no-progress corrections of that exact fingerprint under
+  `afk-hitl.md`; do not stop merely because the action authorization was consumed.
+
+Cold resume does not make that fingerprint old or exhausted. Derive its offline
+no-progress count from `drift.md` and `evidence.md`; while the count is below the
+cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`.
+That terminal cursor is valid only for missing retention, a human/safety gate, or
+an actually exhausted fingerprint.
+
+A new real attempt is admissible only after the affected plan and fixtures are
+re-vetted, the failure condition is shown changed, and any required fresh
+authorization is obtained. Stop at that authorization boundary; never infer it
+from successful offline repair. If the attempt ran without complete retention,
+stop with the observed technical blocker because a blind retry cannot manufacture
+the destroyed evidence.

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -15,6 +15,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Rules consulted (read on demand from `.claude/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.claude/skills/devrites-lib/reference/standards/core.md` and `.claude/skills/devrites-lib/reference/standards/afk-hitl.md` first.
+When the cursor or approved plan contains a consumptive action, also read
+`.claude/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
+stop/continue or execution decision.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -29,6 +32,11 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Do not confuse an action budget with recovery exhaustion.** After a failed
+  consumptive action, zero remaining real attempts blocks only another execution.
+  New retained Critical/Important evidence starts offline repair and narrow Vet
+  inside this Autocomplete invocation. Stop for a fresh GO only after that repair
+  changes the failure condition and Vet is READY.
 - **Budget from the post-vet slice count.** Vet may split/add slices.
   `--max-slices N` may lower the cap for a partial run; otherwise build all.
 - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -55,7 +63,12 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Workflow
 1. **Orient + parse args.** Resolve the explicit or active slug, require its
-   `state.md`, and read the cursor directly.
+   `state.md`, and read the cursor directly. Before honoring `blocked` with a
+   terminal `next_action`, reconcile retained consumptive-action artifacts and
+   per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
+   fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   reconstruct any missing return cursor only from the current phase plus the
+   exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
    for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
    the plan's slice count, i.e. run all planned slices). Parse only the current
@@ -90,7 +103,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
    before any later phase runs; the cursor names the last completed phase and the
    effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
-   on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
+   first route an agent-owned red technical result through the loop's bounded
+   recovery; its `blocked` label alone is not a stop condition. After that, on
+   hard-risk / human-owned blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
    Exhausted agent-owned technical recovery uses the terminal `Next step: none`
    marker and never hands the user `/rite-plan unblock` or another routine
@@ -120,7 +135,9 @@ Do not write a narrative recap.
 ## Clean baseline and checkpoint mode
 - Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
 - Arm `.devrites/CHECKPOINT`; `/rite-ship` collapses its local-only proven-slice checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- Red gates block forward advancement and enter caller-owned bounded recovery.
+  Stop only when the shared stop contract classifies risk/HITL or the exact
+  fingerprint's recovery budget is exhausted.
 - One autocomplete pass spans the lifecycle. Each wright returns after one slice;
   explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
   otherwise HITL stops.

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -57,6 +57,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 When a later phase finds an agent-owned technical gap in an earlier phase, the
 Autocomplete root remains the caller:
 
+On cold resume, reconcile the terminal cursor against durable fingerprint
+accounting first. A retained distinct fingerprint with fewer than three
+no-progress corrections is unfinished recovery, not an unchanged terminal stop.
+Restore `return_phase` from the current phase and `return_next_action` only from
+the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
+to the applicable Vet contract and never licenses execution.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After
@@ -71,6 +78,10 @@ Autocomplete root remains the caller:
    a genuinely new Critical/Important fingerprint. Charge only a no-progress
    outcome against the same fingerprint; lower-severity novelty cannot prolong
    the chain.
+   For a failed consumptive action, its spent authorization blocks only another
+   real execution. A retained artifact that identifies a new fingerprint is the
+   offline reproduction input: diagnose, repair, and narrow-Vet it now, then pause
+   for fresh authorization before any next consumptive execution.
 5. When the prerequisite chain is green, restore and consume the return cursor,
    resume the originating phase, and continue the forward table.
 

package/pack/generated/claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -9,6 +9,12 @@ Closure of a prior fingerprint is progress, not exhaustion. A separately evidenc
 Critical/Important failed invariant starts its own bounded fingerprint; it never
 resets or extends the budget of the one just closed.
 
+An exhausted consumptive-action authorization is not technical-recovery
+exhaustion. It blocks another real action, but retained evidence of a new
+Critical/Important fingerprint must enter offline caller-owned recovery while its
+own no-progress budget remains. After affected Vet is READY, pause for fresh action
+authorization; never execute from the old GO.
+
 ## Always stop (irreversible-risk list: from `afk-hitl.md`)
 
 Regardless of `allow_gates` or `--ship`:
@@ -35,6 +41,10 @@ the remaining choice is a real human/safety/access gate.
 On technical exhaustion, preserve the fingerprint, reproduction, attempts, and
 dead ends, then stop without `/rite-plan unblock` or another phase command.
 Reinvocation with unchanged evidence remains blocked and does not reset the cap.
+Here `unchanged` means the same fingerprint already has three recorded
+no-progress corrections. A retained fingerprint with remaining offline budget is
+not terminal merely because `state.md` was written by the failed action or a prior
+session ended.
 
 ## Stop on gate severity
 

package/pack/generated/claude/skills/rite-prove/SKILL.md

@@ -86,7 +86,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
 
 ## Workflow
 0. Read core, load relevant rules above, then resolve the active slug,
-   require its `state.md`, and read the cursor directly.
+   require its `state.md`, and read the cursor directly. On a blocked Prove cold
+   resume, reconcile any retained consumptive-action artifact against recorded
+   no-progress corrections before accepting `next_action: none`; a distinct
+   fingerprint below its cap resumes offline triage without another real action.
 1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
    `test-plan.md`, and the full diff.
    A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
@@ -115,7 +118,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    stale, or disposable-only evidence surface returns to Vet inline and consumes
    no attempt. Record the admitted artifact identity before execution. After a
    failed consumptive action, triage from that artifact; never reproduce it by
-   rerunning the action.
+   rerunning the action. Consuming its authorization blocks only another real
+   execution. If the artifact identifies a new Critical/Important fingerprint,
+   continue offline recovery inside this Prove invocation; do not label the new
+   fingerprint exhausted because the action budget is zero.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:
@@ -145,6 +151,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    Vet inside this invocation, and resume the exact failed proof rung. Ask only
    for a human-owned decision; causal-fingerprint exhaustion stops once with a
    technical blocker rather than another phase command.
+   For a consumptive-action failure, use fixtures or another non-consumptive
+   reproduction to fix and re-vet the retained fingerprint. Once the failure
+   condition is demonstrably changed, stop at the fresh-authorization boundary;
+   only a new human GO may admit the next real attempt.
 8. The root updates `evidence.md`, `browser-evidence.md` (when present),
    `traceability.md`, and `state.md`. Record exactly one binding for the observed
    digest in evidence and browser evidence. New proof goes to canonical

package/pack/generated/claude/skills/rite-prove/reference/failure-triage.md

@@ -11,7 +11,9 @@ loop to `devrites-debug-recovery`.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
-   - environment/setup (missing dep, wrong node/ruby) → fix setup or record blocker.
+   - environment/setup (missing dep, wrong node/ruby) → fix it when agent-owned;
+     record a blocker only for human/access ownership, scope overflow, or exhausted
+     fingerprint recovery.
    - flaky (passes on re-run, timing/order) → note it; don't paper over with retries.
    - external dependency down → record blocker; don't fake the result.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
@@ -19,7 +21,9 @@ loop to `devrites-debug-recovery`.
    scope, stop and record a blocker in `state.md` (then `/rite-plan unblock`).
 5. **Re-run** the same command when it is repeatable; confirm green and record both
    attempts in `evidence.md`. A consumptive action needs re-vetted evidence
-   completeness and any fresh authorization before a new attempt.
+   completeness and any fresh authorization before a new attempt. Its spent
+   action authorization does not stop offline recovery: a retained new fingerprint
+   enters caller-owned diagnosis, correction, fixtures, and narrow Vet immediately.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/generated/claude/skills/rite-spec/reference/state-workspace.md

@@ -131,6 +131,13 @@ resume. Never overwrite an existing valid return cursor, and preserve every
 unrelated Markdown byte. `/rite-clarify` applies its stricter native cursor
 protocol below.
 
+On cold resume, a terminal `next_action` is a claim to verify, not a counter.
+Reconcile the exact fingerprint and its attempts in `drift.md` / `evidence.md`.
+If a consumptive action retained a distinct fingerprint below the no-progress
+cap, rewrite the cursor into caller-owned recovery and preserve or reconstruct
+the return rows only from the current phase and approved recorded action. The
+spent action authorization blocks another execution, not that rewrite.
+
 `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
 configuration. Only the controlling root writes it under the shared
 [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#the-sentinel-devritesafk)

package/pack/generated/codex/skills/devrites-debug-recovery/SKILL.md

@@ -59,6 +59,10 @@ has no clear next move.
   consumptive action, first re-vet evidence completeness and obtain any required
   fresh authorization; offline fixtures remain mandatory but cannot authorize the
   real attempt.
+- **A spent consumptive authorization is not a spent recovery budget.** When its
+  retained artifact supplies a new Critical/Important fingerprint, continue
+  offline diagnosis, correction, fixtures, and narrow Vet under that fingerprint's
+  no-progress budget. Stop for fresh authorization only before the next real action.
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 - **Durably record class and rationale** in `decisions.md` and the applicable
@@ -68,7 +72,9 @@ has no clear next move.
   reproduction plus decisive signal rather than hashing symptom text.
   The caller and recovery attempts share one count: read the current context and
   recorded `## Dead ends` / `evidence.md`, then include every no-progress attempt
-  with that fingerprint. Reclassify only on new causal evidence.
+  with that fingerprint. Reclassify only on new causal evidence. On cold resume,
+  a retained fingerprint with fewer than three such attempts remains runnable
+  even if the previous action wrote a terminal cursor.
 - **A maximum of three no-progress attempts per exact causal fingerprint stops the loop.**
   Count an attempt only when its recheck preserves the same decisive failure.
   Record attempt number, exact failure, hypothesis, probe, and failed idea after

package/pack/generated/codex/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -15,7 +15,9 @@ record the dead end and classify anew. Failure alone never resets the budget.
 - `not_a_defect`: the observation matches current accepted authority. Record that authority and continue.
 
 Only human credentials/quotas/actions, irreversible work, or fresh authorization
-required by a consumptive action pause; never ask for a blind retry.
+required before the next consumptive execution pause. Fresh authorization never
+pauses offline diagnosis or correction from retained evidence; never ask for a
+blind retry.
 
 Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
 or `## Dead ends`. Use one stable causal fingerprint shaped as `<affected

package/pack/generated/codex/skills/devrites-lib/reference/reply-contract.md

@@ -59,7 +59,11 @@ Claims such as proved, reviewed, sealed, shipped, or complete must point to real
 output or an artifact. Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
-For that terminal case use:
+Use that terminal case only after three recorded no-progress corrections of the
+exact fingerprint, or when required evidence was irretrievably absent. A spent
+consumptive-action authorization plus a retained new fingerprint is not terminal;
+it continues offline recovery and waits for fresh authorization only after repair.
+For a true terminal case use:
 
 ```text
 Stopped: Technical recovery exhausted

package/pack/generated/codex/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -245,10 +245,20 @@ changes, not a request for permission to retry.
   new Critical or Important finding with a different failed invariant and exact
   evidence gets its own fingerprint and budget; Suggestion, Nit, FYI, or renamed
   evidence cannot open, reset, or extend recovery.
+- **Separate consumptive authority from recovery.** Spending a one-shot action's
+  authorization forbids another real execution but does not consume the offline
+  recovery budget for a newly evidenced fingerprint. The retained artifact starts
+  caller-owned diagnosis and correction immediately; only the next consumptive
+  execution waits for fresh authorization.
 - **Persist accounting in existing records.** Record each fingerprint,
   reproduction, attempted correction, `progress: resolved|no-progress`, and
   decisive result in `drift.md` and `evidence.md`. Cold resume derives the count
   from those records. There is no recovery counter file or command.
+- **Reconcile before honoring a terminal cursor.** A persisted distinct
+  Critical/Important fingerprint with retained evidence and fewer than three
+  recorded no-progress corrections still has recovery budget, even when an older
+  `state.md` says `Next step: none`. Resume it; do not treat session age or the
+  prior action's spent authorization as exhaustion.
 - **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
   preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`.
   Do not emit `$rite-plan unblock`, another phase command, a question, or

package/pack/generated/codex/skills/devrites-lib/reference/standards/core.md

@@ -54,6 +54,10 @@ re-reads `state.md`, follows the durable return cursor and intermediate
 `next_action`, and resumes its originating phase while no human-owned, safety,
 access, budget, or exhausted-recovery stop is active.
 
+Derive `exhausted-recovery` from the exact fingerprint's recorded no-progress
+attempts, not from a stale `state.md` label. A consumed authorization for one
+real action does not exhaust offline recovery from its retained new evidence.
+
 An intermediate `Next step` is cold-resume metadata. Do not ask the human to
 copy routine `$rite-plan repair`, `$rite-vet`, `$rite-build`, or proof-rerun
 commands during the active recovery chain. Only the controlling caller emits

package/pack/generated/codex/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -39,8 +39,28 @@ retention design should have preserved.
 ## Failure handling
 
 After a consumptive action fails, its retained artifact is the reproduction input.
-Do not rerun the action during triage. A new attempt is admissible only after the
-evidence identifies a changed invariant or external condition, the affected plan
-and fixtures are re-vetted, and any required fresh authorization is obtained. If
-the attempt ran without complete retention, stop with the observed technical
-blocker; a blind retry cannot manufacture the destroyed evidence.
+Do not rerun the action during triage.
+
+Keep two budgets separate:
+
+- **Action authorization:** the failed execution consumes only the authorization
+  for that consumptive execution. Zero remaining action attempts prohibits another
+  real execution; it does not exhaust offline diagnosis or correction.
+- **Causal-fingerprint recovery:** when the retained artifact supplies a new
+  Critical/Important failed invariant, the controlling caller immediately runs
+  bounded offline triage, repair, fixtures, and narrow Vet in the same invocation.
+  Count only no-progress corrections of that exact fingerprint under
+  `afk-hitl.md`; do not stop merely because the action authorization was consumed.
+
+Cold resume does not make that fingerprint old or exhausted. Derive its offline
+no-progress count from `drift.md` and `evidence.md`; while the count is below the
+cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`.
+That terminal cursor is valid only for missing retention, a human/safety gate, or
+an actually exhausted fingerprint.
+
+A new real attempt is admissible only after the affected plan and fixtures are
+re-vetted, the failure condition is shown changed, and any required fresh
+authorization is obtained. Stop at that authorization boundary; never infer it
+from successful offline repair. If the attempt ran without complete retention,
+stop with the observed technical blocker because a blind retry cannot manufacture
+the destroyed evidence.

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -15,6 +15,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Rules consulted (read on demand from `.agents/skills/devrites-lib/reference/standards/`)
 **Step 0:** Read `.agents/skills/devrites-lib/reference/standards/core.md` and `.agents/skills/devrites-lib/reference/standards/afk-hitl.md` first.
+When the cursor or approved plan contains a consumptive action, also read
+`.agents/skills/devrites-lib/reference/standards/one-shot-actions.md` before any
+stop/continue or execution decision.
 
 ## Operating rules
 - **Use one initial human window.** Run spec and topology-first clarify; arm AFK
@@ -29,6 +32,11 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
   through repair, Vet, bounded implementation correction, and re-proof inside
   the active run. A nested phase `STOP` or intermediate `Next step` is not a
   user handoff; pause only on the shared real stop conditions.
+- **Do not confuse an action budget with recovery exhaustion.** After a failed
+  consumptive action, zero remaining real attempts blocks only another execution.
+  New retained Critical/Important evidence starts offline repair and narrow Vet
+  inside this Autocomplete invocation. Stop for a fresh GO only after that repair
+  changes the failure condition and Vet is READY.
 - **Budget from the post-vet slice count.** Vet may split/add slices.
   `--max-slices N` may lower the cap for a partial run; otherwise build all.
 - **Parse flags only from this invocation.** `--ship`, `--yolo`, `--max-slices`,
@@ -55,7 +63,12 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
 
 ## Workflow
 1. **Orient + parse args.** Resolve the explicit or active slug, require its
-   `state.md`, and read the cursor directly.
+   `state.md`, and read the cursor directly. Before honoring `blocked` with a
+   terminal `next_action`, reconcile retained consumptive-action artifacts and
+   per-fingerprint attempts from `drift.md` / `evidence.md`. A distinct retained
+   fingerprint below its no-progress cap reopens caller-owned offline recovery;
+   reconstruct any missing return cursor only from the current phase plus the
+   exact approved action in `test-plan.md` / evidence, never from chat or guesswork.
    The idea + flags: `--ship` / `--yolo` (continue through ship preflight, then stop
    for literal-GO and native approval), `--max-slices N` (optional lower safety cap for a partial run; default =
    the plan's slice count, i.e. run all planned slices). Parse only the current
@@ -90,7 +103,9 @@ default and **Full** for high-risk scope or explicit `--full`; profiles are defi
    before any later phase runs; the cursor names the last completed phase and the
    effective remaining budget.
 5. **Apply stop conditions at every gate** ([reference/stop-conditions.md](reference/stop-conditions.md)):
-   on hard-risk / blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
+   first route an agent-owned red technical result through the loop's bounded
+   recovery; its `blocked` label alone is not a stop condition. After that, on
+   hard-risk / human-owned blocking / escalating / NO-GO / budget-exhausted / still-low-confidence
    → write `state.md` (`Status`, `Next step`), surface *why*, and **STOP**.
    Exhausted agent-owned technical recovery uses the terminal `Next step: none`
    marker and never hands the user `$rite-plan unblock` or another routine
@@ -120,7 +135,9 @@ Do not write a narrative recap.
 ## Clean baseline and checkpoint mode
 - Before autonomy, require a clean or accepted baseline; refuse unrelated dirty work and record plan artifacts.
 - Arm `.devrites/CHECKPOINT`; `$rite-ship` collapses its local-only proven-slice checkpoints.
-- Stop on risky steps, red gates, NO-GO, stale evidence, or exhausted budget.
+- Red gates block forward advancement and enter caller-owned bounded recovery.
+  Stop only when the shared stop contract classifies risk/HITL or the exact
+  fingerprint's recovery budget is exhausted.
 - One autocomplete pass spans the lifecycle. Each wright returns after one slice;
   explicit `.devrites/AFK` lets the Build root chain green slices under cap/pause rules;
   otherwise HITL stops.

package/pack/generated/codex/skills/rite-autocomplete/reference/loop.md

@@ -57,6 +57,13 @@ Read each phase's `SKILL.md` and execute that workflow. Workspace files such as
 When a later phase finds an agent-owned technical gap in an earlier phase, the
 Autocomplete root remains the caller:
 
+On cold resume, reconcile the terminal cursor against durable fingerprint
+accounting first. A retained distinct fingerprint with fewer than three
+no-progress corrections is unfinished recovery, not an unchanged terminal stop.
+Restore `return_phase` from the current phase and `return_next_action` only from
+the exact approved action recorded in `test-plan.md` / evidence; ambiguity returns
+to the applicable Vet contract and never licenses execution.
+
 1. Save the originating phase/action in the native return cursor unless a valid
    one already exists.
 2. Invoke the required repair, Vet, remediation, and proof skills inline. After
@@ -71,6 +78,10 @@ Autocomplete root remains the caller:
    a genuinely new Critical/Important fingerprint. Charge only a no-progress
    outcome against the same fingerprint; lower-severity novelty cannot prolong
    the chain.
+   For a failed consumptive action, its spent authorization blocks only another
+   real execution. A retained artifact that identifies a new fingerprint is the
+   offline reproduction input: diagnose, repair, and narrow-Vet it now, then pause
+   for fresh authorization before any next consumptive execution.
 5. When the prerequisite chain is green, restore and consume the return cursor,
    resume the originating phase, and continue the forward table.
 

package/pack/generated/codex/skills/rite-autocomplete/reference/stop-conditions.md

@@ -9,6 +9,12 @@ Closure of a prior fingerprint is progress, not exhaustion. A separately evidenc
 Critical/Important failed invariant starts its own bounded fingerprint; it never
 resets or extends the budget of the one just closed.
 
+An exhausted consumptive-action authorization is not technical-recovery
+exhaustion. It blocks another real action, but retained evidence of a new
+Critical/Important fingerprint must enter offline caller-owned recovery while its
+own no-progress budget remains. After affected Vet is READY, pause for fresh action
+authorization; never execute from the old GO.
+
 ## Always stop (irreversible-risk list: from `afk-hitl.md`)
 
 Regardless of `allow_gates` or `--ship`:
@@ -35,6 +41,10 @@ the remaining choice is a real human/safety/access gate.
 On technical exhaustion, preserve the fingerprint, reproduction, attempts, and
 dead ends, then stop without `$rite-plan unblock` or another phase command.
 Reinvocation with unchanged evidence remains blocked and does not reset the cap.
+Here `unchanged` means the same fingerprint already has three recorded
+no-progress corrections. A retained fingerprint with remaining offline budget is
+not terminal merely because `state.md` was written by the failed action or a prior
+session ended.
 
 ## Stop on gate severity
 

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -86,7 +86,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
 
 ## Workflow
 0. Read core, load relevant rules above, then resolve the active slug,
-   require its `state.md`, and read the cursor directly.
+   require its `state.md`, and read the cursor directly. On a blocked Prove cold
+   resume, reconcile any retained consumptive-action artifact against recorded
+   no-progress corrections before accepting `next_action: none`; a distinct
+   fingerprint below its cap resumes offline triage without another real action.
 1. **Confirm all slices built.** Read `spec.md`, `tasks.md`, `state.md`,
    `test-plan.md`, and the full diff.
    A missing `test-plan.md` enters caller-owned Vet backtracking; invoke Vet
@@ -115,7 +118,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    stale, or disposable-only evidence surface returns to Vet inline and consumes
    no attempt. Record the admitted artifact identity before execution. After a
    failed consumptive action, triage from that artifact; never reproduce it by
-   rerunning the action.
+   rerunning the action. Consuming its authorization blocks only another real
+   execution. If the artifact identifies a new Critical/Important fingerprint,
+   continue offline recovery inside this Prove invocation; do not label the new
+   fingerprint exhausted because the action budget is zero.
 4. **UI feature?** The root applies the browser proof ladder with
    `design-brief.md`, `references.md`, the requested routes, browser harness, and
    allowed scratch path:
@@ -145,6 +151,10 @@ failure is a blocker; this Upgrade admission never authorizes source or test cha
    Vet inside this invocation, and resume the exact failed proof rung. Ask only
    for a human-owned decision; causal-fingerprint exhaustion stops once with a
    technical blocker rather than another phase command.
+   For a consumptive-action failure, use fixtures or another non-consumptive
+   reproduction to fix and re-vet the retained fingerprint. Once the failure
+   condition is demonstrably changed, stop at the fresh-authorization boundary;
+   only a new human GO may admit the next real attempt.
 8. The root updates `evidence.md`, `browser-evidence.md` (when present),
    `traceability.md`, and `state.md`. Record exactly one binding for the observed
    digest in evidence and browser evidence. New proof goes to canonical

package/pack/generated/codex/skills/rite-prove/reference/failure-triage.md

@@ -11,7 +11,9 @@ loop to `devrites-debug-recovery`.
 2. **Classify** the failure:
    - test is right, code is wrong → fix the code (in scope).
    - test is wrong/outdated → that may be **spec drift** (acceptance criteria wrong).
-   - environment/setup (missing dep, wrong node/ruby) → fix setup or record blocker.
+   - environment/setup (missing dep, wrong node/ruby) → fix it when agent-owned;
+     record a blocker only for human/access ownership, scope overflow, or exhausted
+     fingerprint recovery.
    - flaky (passes on re-run, timing/order) → note it; don't paper over with retries.
    - external dependency down → record blocker; don't fake the result.
 3. **Isolate:** minimize to the smallest failing case; bisect the diff if needed.
@@ -19,7 +21,9 @@ loop to `devrites-debug-recovery`.
    scope, stop and record a blocker in `state.md` (then `$rite-plan unblock`).
 5. **Re-run** the same command when it is repeatable; confirm green and record both
    attempts in `evidence.md`. A consumptive action needs re-vetted evidence
-   completeness and any fresh authorization before a new attempt.
+   completeness and any fresh authorization before a new attempt. Its spent
+   action authorization does not stop offline recovery: a retained new fingerprint
+   enters caller-owned diagnosis, correction, fixtures, and narrow Vet immediately.
 
 ## Rules
 - Quote the real error text; don't paraphrase it away.

package/pack/generated/codex/skills/rite-spec/reference/state-workspace.md

@@ -131,6 +131,13 @@ resume. Never overwrite an existing valid return cursor, and preserve every
 unrelated Markdown byte. `$rite-clarify` applies its stricter native cursor
 protocol below.
 
+On cold resume, a terminal `next_action` is a claim to verify, not a counter.
+Reconcile the exact fingerprint and its attempts in `drift.md` / `evidence.md`.
+If a consumptive action retained a distinct fingerprint below the no-progress
+cap, rewrite the cursor into caller-owned recovery and preserve or reconstruct
+the return rows only from the current phase and approved recorded action. The
+spent action authorization blocks another execution, not that rewrite.
+
 `afk_slices_remaining` is mutable runtime state, not `.devrites/AFK`
 configuration. Only the controlling root writes it under the shared
 [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md#the-sentinel-devritesafk)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "4.0.6",
+  "version": "4.0.7",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",