devrites 4.6.0 → 5.0.0

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -19,6 +19,10 @@ Review: Spec/Code; Seal: all applicable roles.
 Also: `devrites-simplifier-reviewer`, `devrites-doubt-reviewer`,
 `devrites-strategy-reviewer`, `devrites-plan-reviewer`, or `devrites-retrospector`.
 
+If the candidate diff has no matching surfaces, record
+`Not-applicable: no relevant paths in diff` for `frontend-reviewer`,
+`security-auditor`, and `performance-reviewer`; do not dispatch them.
+
 ## Dispatch contract
 
 1. Freeze one candidate; give each reviewer the same spec, paths, and diff.
@@ -27,7 +31,13 @@ Also: `devrites-simplifier-reviewer`, `devrites-doubt-reviewer`,
    usually is; pressure requires batches or serial work.
 2. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
-3. Wait for all applicable results before reconciling.
+3. Every dispatch reaches a terminal classification before reconciliation:
+   `Outcome: findings`, `Outcome: no-findings`, `Outcome: gap`, or
+   `unavailable: <reason>` when the step could not run at all. Reconciling over a
+   partial roster is forbidden; an unavailable conditional step is recorded with its
+   marker in `review.md`/`seal.md` — an omitted sub-step reads as a clean run.
+   Findings later withdrawn at reconciliation stay visible: the account records
+   `withdrawn: <n> (<reason>)` rather than silently dropping them.
 4. Apply [`agents.md` § Result admission](standards/agents.md#result-admission)
    and dedupe by evidence/root cause. Account for all seven in
    `review.md`/`seal.md`: `Outcome:` plus admitted account, or
@@ -37,8 +47,28 @@ Also: `devrites-simplifier-reviewer`, `devrites-doubt-reviewer`,
    infer approval or substitute inline review.
 
 On exhaustion/contention: stop spawning; collect running results; batch/serialize.
-Never restart/orphan the cohort or infer approval.
+Never restart/orphan the cohort or infer approval. Reviewers are read-only;
+accounts store evidence, never telemetry. Same-file writers stay serial.
+Capacity rejection is backpressure: retry batches; never shrink a roster.
+
+## Scale limits
+
+Review rosters are bounded by the role table above, not by agent count. Beyond
+roughly four concurrent read-only reviewers (eight only when each owns disjoint
+paths and resources), added reviewers re-read the same material, return
+overlapping findings, and make reconciliation the bottleneck: cost grows linearly,
+discriminable signal does not. DevRites therefore refuses unbounded swarms — more
+agents never substitute for a required role, and a task needing "more reviewers"
+needs a sharper scope or a second bounded pass instead. **Failing case:** an
+eight-agent mesh with no per-agent path ownership returns conflicting edits and
+duplicated findings that no roster can reconcile.
+
+## Children are tools, not peers
 
-Reviewers are read-only; accounts store evidence, never telemetry.
+A dispatched agent is a tool invocation: the parent owns the prompt, the
+expected artifact, and admission. Reviewers do not negotiate with each other
+or with the implementer. A mesh without a parent is not a DevRites profile.
+**Failing case:** two reviewers agree a compromise in a shared channel and the
+parent records that compromise as independent review.
 
-Scale: past 3–4 compatible readers per wave, coordination cost outruns findings — batch serially. Capacity rejection is backpressure, not failure (collect running results; retry batches; never silently shrink a roster). Arbitration/independence → [agents.md § Independence](standards/agents.md#independence); writer batches → [`parallel-batch.md`](../../rite-build/reference/parallel-batch.md).
+Arbitration/independence → [agents.md § Independence](standards/agents.md#independence); writer batches → [`parallel-batch.md`](../../rite-build/reference/parallel-batch.md).

package/pack/.claude/skills/devrites-lib/reference/reply-contract.md

@@ -6,9 +6,9 @@ artifact.
 
 Keep the reply compact and evidence-backed:
 
-When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN`, a
-nested phase `STOP`, and a routine Plan/Vet `Next step` are not eligible completion
-states. Return them to the caller without a user-facing reply. Autocomplete may
+When an active rite is the controlling caller, Intermediate `NEEDS_REPLAN` (the reply
+token for the workspace's `NEEDS REPLAN` readiness value), a nested phase `STOP`, and a
+routine Plan/Vet `Next step` are not eligible completion states. Autocomplete may
 use the shapes below only after its requested rest point or a shared genuine
 human/safety/access/exhausted-recovery stop is reached.
 
@@ -21,6 +21,10 @@ Next: <one recommended action>
 Record: <primary durable artifact path>
 ```
 
+Pre-send check: delete an opening sentence that only announces ("I'll now…") and a
+closing sentence that only recaps; then apply the two-line test — a reader seeing only
+the first and last lines must know what happened and what to do next.
+
 If a required decision, proof, or invariant is missing, use one of these states
 instead of `Done`:
 
@@ -79,3 +83,6 @@ No runnable recovery command: unchanged reinvocation remains blocked
 Next: none — requires new evidence or changed failure conditions
 Record: <artifact path>
 ```
+
+The terminal cursor marker is `Next: none` exactly as shown; a stored `Next step: none`
+names the same exhausted state.

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -43,11 +43,18 @@ topic's owner.
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
 | `one-shot-actions.md` | A proof/action may be attempted once, needs fresh retry authorization, consumes external state/quota, or can delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
+| `code-navigation.md` | Choosing graph, LSP, grep, or read routes before cross-file edits. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |
 | `review-checklist.md` | A compact review pass/fail sweep is enough. |
 | `test-proof-checklist.md` | Test and evidence quality needs a compact sweep. |
 | `browser-proof-checklist.md` | UI behavior needs browser proof. |
 | `security-checklist.md` | Auth, input, data, or integration work needs a compact security sweep. |
+| `acceptance-preserving-reslice.md` | Classifying or reviewing a Reslice in Plan, Vet, or Autocomplete. |
+| `debug-recovery.md` | Waiting on async readiness (server start, job completion, browser signal) needs a bounded condition-based poll. |
+
+The table is a load trigger, not an exemption. [`core.md` § Rule summary](core.md#rule-summary-load-the-full-file-when-in-scope)
+makes every *applicable* owner mandatory. **Failing case:** a security or data-integrity
+gate is skipped because the standard is "on-demand / modular."
 
 These guide judgment; workflows and engine gates enforce.

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -6,6 +6,23 @@ callers are `/rite-build`, `/rite-status`, `/rite-resolve`, and
 
 The contract uses one sentinel, one queue, and one resume verb.
 
+## Contents
+
+- [Run modes](#run-modes)
+- [The sentinel: `.devrites/AFK`](#the-sentinel-devritesafk)
+- [Unattended resource envelope](#unattended-resource-envelope)
+- [The four gates](#the-four-gates)
+- [Option set: how every gap is presented](#option-set-how-every-gap-is-presented)
+- [Decision ownership: search before asking](#decision-ownership-search-before-asking)
+- [Irreversible-risk list (always pause)](#irreversible-risk-list-always-pause)
+- [`questions.md` schema](#questionsmd-schema)
+- [`state.md` `Awaiting human` block](#statemd-awaiting-human-block)
+- [The resume verb: `/rite-resolve`](#the-resume-verb-riteresolve)
+- [AFK exception for discretionary pauses](#afk-exception-for-discretionary-pauses)
+- [Retry cap, no-progress loops, and self-resolve](#retry-cap-no-progress-loops-and-self-resolve)
+- [What the rule does NOT cover](#what-the-rule-does-not-cover)
+- [Cross-reference](#cross-reference)
+
 ## Run modes
 
 - **HITL (default):** human is present. At a gap/checkpoint the skill **asks inline** via
@@ -40,7 +57,7 @@ max_review_queue: 8                  # unresolved review/gate items admitted bef
 expires_at: "<ISO-8601 UTC timestamp>" # absolute unattended-authority expiry
 # max_tokens: 200000                 # optional stricter host-observed token cap
 # max_cost_usd: 10                   # optional stricter host-observed cost cap
-notify: "ntfy.sh/my-topic"           # shell command run on awaiting_human transition
+notify: "ntfy.sh/my-topic"           # shell command; examples: rite-build/reference/afk-discipline.md
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
 ```
 
@@ -66,7 +83,8 @@ counter is the effective remaining budget even when the read-only sentinel omits
 
 AFK writer admission needs a bounded input queue, effective slice cap, and valid
 `max_agents`, `max_minutes`, `max_review_queue`, and `expires_at`. Existing sentinels
-missing/malforming these fail closed; cold resume keeps the state-owned slice counter.
+that declare writer admission but miss/malform these fail closed; cold resume keeps the
+state-owned slice counter.
 Read-only watchers use equivalent native caps from [`loop-operations.md`](loop-operations.md).
 
 `max_agents` counts every leaf in the native activation, including failures and
@@ -84,9 +102,8 @@ for a genuinely new activation. Slices, recovery attempts, absolute expiry, and
 review queue remain durable/recomputed across wakes. Persist each activation stop and
 checkpoint before notification.
 
-New sentinels use: `max_slices: 10`, `max_agents: 32`, `max_minutes: 120`,
-`max_review_queue: 8`, `expires_at: <arming + 4h>`, `allow_gates: [advisory]`, and no
-notification/token/cost cap. Post-Vet pending count may lower slices. Existing files
+New sentinels default `expires_at` to arming + 4h with no notification/token/cost cap.
+Post-Vet pending count may lower slices. Existing files
 never receive missing defaults implicitly.
 
 To leave AFK, delete the file. The next skill invocation reverts to HITL.
@@ -120,7 +137,7 @@ Wherever a gap, checkpoint, or non-trivial decision surfaces (`/rite-spec`, `/ri
 - **2-4 concrete options**, the **recommended one first**, labelled `(Recommended)`.
 - Each option has a **one-line, dimension-tagged rationale**: `logic · infra · business ·
   architecture` (add `security` / `UX` / `risk` in scope) and trade-off.
-- Always include an escape hatch (`Something else — I'll describe it`).
+- Always include an escape hatch (`Something else — describe it`).
 - With more than four materially distinct choices, first ask a discriminating question or use
   sequential packets, then obtain final confirmation. Materially distinct options MUST NOT
   be silently dropped, merged, or preselected to fit the UI.
@@ -244,6 +261,11 @@ When `/rite-resolve` does resume a stopped session, the skill does **not** auto-
 `devrites-doubt` and similar skills that "ask the user" follow this rule when
 `.devrites/AFK` exists:
 
+Ceiling comparison order: Suggestion/Nit/FYI < Important < Critical; gates advisory <
+validating < blocking < escalating; a finding is ≤ the ceiling when its severity's gate
+class (Suggestion/Nit/FYI→advisory, Important→validating, Critical→blocking) is at or
+below the slice's gate.
+
 - Finding severity ≤ slice's gate ceiling (slice's `Gate:` plus `.devrites/AFK`
   `allow_gates`) → log to `questions.md` as `gate: advisory`, record the trade-off in
   `decisions.md`, proceed.
@@ -290,15 +312,11 @@ changes, not a request for permission to retry.
   Do not emit `/rite-plan unblock`, another phase command, a question, or
   `/rite-resolve`. Reinvocation with the unchanged fingerprint remains blocked
   and never resets the retry cap.
-- **Reassess no-progress loops:** After repeated attempts without progress, stop and
-  reassess the failure and approach rather than continuing blindly.
 - **Resolve agent-owned questions first.** Before raising a question, try to answer it from the code, the docs,
   or `decisions.md`. Communicate only for a blocked environment, a deliverable to hand over,
-  critical info you genuinely can't access, or a credential / permission you lack. This narrows
-  needless pauses and never weakens the blocking / escalating / irreversible gates.
-- **Use human intervention only for human-owned work.** A `human_intervention` pause is for what the agent
-  literally cannot do (create a cloud account, click a console button): never for writing code,
-  writing tests, or reviewing. The agent's own work is not a valid human gate.
+  critical info you genuinely can't access, or a credential / permission you lack — never for
+  writing code, writing tests, or reviewing; the agent's own work is not a valid human gate.
+  This narrows needless pauses and never weakens the blocking / escalating / irreversible gates.
 
 ## What the rule does NOT cover
 
@@ -317,8 +335,9 @@ AFK changes which decisions are automatic. It changes nothing else.
 
 - Skill: `/rite-resolve` (`.claude/skills/rite-resolve/SKILL.md`).
 - Workflow integration: `/rite-build` (`.claude/skills/rite-build/SKILL.md`),
-  workflow steps 0 + 2a (readiness / HITL pre-flight) and steps 4-6 (doubt / fail-on-red /
-  record) on the wright's return.
+  the readiness / HITL pre-flight stages before dispatch, and the DOUBT → PROVE
+  (fail-on-red) → RECORD stages on the wright's return
+  (`reference/one-slice-cycle.md`).
 - Render contract: `.claude/skills/rite-build/reference/checkpoint-protocol.md`.
 - Loop discipline: `.claude/skills/rite-build/reference/afk-discipline.md`.
 - Gate taxonomy: `.claude/skills/rite-define/reference/gates.md`.

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -38,6 +38,7 @@ Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters
 Skills name exact fresh roles, omit native fields;
 hosts spawn/wait/deliver. Root MUST NOT advance/claim completion before admitting required results;
 running/orphaned/unavailable = `gap` — no root/generic substitute.
+Workflow-named skills (e.g. devrites-source-driven) are invoked inline in the root context, never dispatched as agents.
 
 ## Source-writing boundary
 
@@ -52,7 +53,7 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 - A fresh result sees scope/paths-diff/rubric only — never another result's or the root's conclusions, severities, expected verdicts, or edited context; seeding voids the packet.
 - A parent-context pass contributes attributed evidence but is not independent: exclude it from independent accounting and name the lost coverage.
 - Final severity is set at reconciliation after re-verifying the claimed consequence at the cited site (reviewer severity advisory); dismissals record a reason, and true facts about neighboring code route elsewhere instead of being dismissed.
-- Conflicting required results are arbitrated by re-verifying evidence at the site; the deciding evidence is recorded, truly unresolved conflicts stay open blockers.
+- Conflicting required results are arbitrated by re-verifying evidence at the site; the deciding evidence is recorded, truly unresolved conflicts stay open blockers. Two results describing the same defect merge only when both defect and fix path match; otherwise the more conservative classification stands, and severity never widens without new site evidence — an overridden or demoted finding stays visible with the reason, never silently merged away.
 
 ## Result admission
 
@@ -64,10 +65,12 @@ Each required reviewer/analyst/auditor starts with exactly one:
 ```text
 Outcome: <findings | no-findings | gap>
 Finding: <severity> | <file:line or artifact section> | <observed quote/result> | <impact> | <minimum fix>
+Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
-  Critical/Important requires 7+, exact evidence, and concrete impact.
+  Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
+  `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
@@ -78,13 +81,18 @@ against candidate. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
 with evidence—never silently dropped/demoted. Null/timeout/failure/malformed
 output is `gap`, never `no-findings`. Conditional `Not-applicable` must name the
-inspected scope and why its trigger did not fire.
+inspected scope and why its trigger did not fire. **Failing case:** parent admits a
+wright "done" with no `git diff --name-only` ⊆ path-contract (allowlist) observation.
 
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records
-accepted conclusions, and reruns only affected proof/review. Route defects before
-correction: product/acceptance → Spec Drift Guard/Clarify;
+accepted conclusions, and reruns only affected proof/review. Reconciliation runs
+only after every dispatch reaches a terminal classification
+([parallel-dispatch.md](../parallel-dispatch.md)); findings that do not survive stay
+visible as `withdrawn: <n> (<reason>)` in the account rather than being silently
+dropped, so a later reader can audit what was discarded and why.
+Route defects before correction: product/acceptance → Spec Drift Guard/Clarify;
 architecture/slicing/proof → Plan/Vet; source/test → wright;
 external/pre-existing → blocker/defer. Never patch downstream to hide an upstream
 defect.

package/pack/.claude/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -1,8 +1,24 @@
 # Browser proof checklist
 
+Compact sweep only. Numbers and failing cases live in
+[`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md)
+§ Focus & states, § Responsive, and § Browser chrome — do not restate a shorter
+viewport set here.
+
 - Open the real UI (never screenshot-only); check console and network for errors.
-- Interactive slices capture each relevant state (default/hover/focus-visible/active/disabled/loading/empty/error) at 320 + 768 px, +1024/1440 when adaptive; state floor: [`../../../devrites-frontend-craft/reference/quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md). Omission needs a one-line `not-needed` reason; states must exist in source — an unreachable state's capture proves nothing.
-- Review browser-default surfaces once per slice (selection, caret, scrollbars, focus ring); no horizontal overflow at captured widths; 200% zoom spot-check; compare to `design-brief.md` → Visual Verdict.
-- Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record that disposition instead of capturing quietly; UI copy follows `devrites-frontend-craft`, long-form prose follows [`prose-style.md`](prose-style.md).
+- Before reading the builder's verdict, inventory the raw captures against the
+  required routes/states/viewports and candidate identity. Open each capture: a
+  wrong route, blank render, unexpected login wall, inconsistent dimensions, or
+  stale candidate is missing evidence. Recapture; until resolved, record
+  `cannot_verify` and block visual approval. A convincing narrative cannot repair it.
+- Interactive slices capture each relevant canonical state and the canonical
+  viewport set. Omission needs a one-line `not-needed` reason; states must exist
+  in source — an unreachable state's capture proves nothing.
+- Browser-default chrome is judged by § Browser chrome; reflow, zoom and bounded
+  two-dimensional exceptions by § Responsive. Compare to `design-brief.md` → Visual Verdict.
+- Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record
+  that disposition instead of capturing quietly; UI copy follows
+  `devrites-frontend-craft`, long-form prose follows `devrites-prose-craft`
+  ([`prose-style.md`](prose-style.md)).
 
 Detailed skill: `devrites-browser-proof`.

package/pack/.claude/skills/devrites-lib/reference/standards/ci-cd.md

@@ -12,7 +12,7 @@ Read this only when creating or changing a build/deploy pipeline. [`hooks.md`](h
 
 Read the specific failure, fix its root cause, verify locally, then push again. Do not blind-rerun a flaky pipeline. Use `devrites-debug-recovery` when a test or build failure needs reproduction.
 
-A designated Build Cop owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
+A designated Build Cop (a human/team role, not a pack agent) owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
 
 ## Deploy versus release
 

package/pack/.claude/skills/devrites-lib/reference/standards/code-navigation.md

@@ -0,0 +1,43 @@
+# Code navigation
+
+Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
+this file is the pack-canonical routing table agents cite in Build, Vet, and
+Review.
+
+## Route by question
+
+| Question | First tool | Fallback |
+| --- | --- | --- |
+| Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
+| Callers, callees, data flow across files | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
+| PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
+| Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
+| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
+| Known file, one-line fix | `Read` at offset/limit | — |
+| Literal string / config value | `Grep` | — |
+
+## Before cross-file edits
+
+1. Run **one** primary route from the table (record tool + query in the artifact).
+2. Read symbol bodies you will change (`read_symbol` counts as read).
+3. After edits: LSP diagnostics + project tests.
+
+Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
+`cannot_verify`.
+
+## Index freshness
+
+| Index path | Provider |
+| --- | --- |
+| `.codegraph/` | CodeGraph |
+| `.code-review-graph/` | code-review-graph MCP |
+| `.codebase-memory/` | codebase-memory MCP |
+Run `devrites-engine check indexes` for a quick presence check. Stale or missing index:
+build/refresh per provider docs, or fall back to LSP + grep and note the gap.
+
+## Anti-patterns
+
+- Duplicate graph queries for reassurance.
+- Whole-file reads when `read_symbol` or `module_report` suffices.
+- Grep-only blast-radius claims when an index is present.
+- Editing without reading the enclosing symbol body.

package/pack/.claude/skills/devrites-lib/reference/standards/code-review.md

@@ -17,13 +17,19 @@ If it does not, do not merge it.
 
 ## What to check (tests first)
 1. **Tests:** do they exist and prove the behavior + failure modes (empty, error,
-   boundary, concurrency)? Would they fail if the code were wrong?
+   boundary, concurrency)? Would they fail if the code were wrong? A `skip`/`only`/
+   `TODO` placeholder or assertion-free test is a finding, not coverage.
 2. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
 3. **Readability:** names, function size, control flow, intent obvious without the author.
 4. **Architecture:** right seam, coupling/cohesion, fits existing patterns, no premature
    abstraction. Check how it fits the larger system as well as its local behavior.
 5. **Security:** trust boundaries, input validation, authz, secrets.
 6. **Risk:** migrations, destructive changes, rollback.
+7. **Read depth matches risk:** the review's `Basis` names **full reads of the largest
+   diff files** (top three by changed lines), and any config/dependency/SQL/auth/migration
+   file is read in full — never skimmed. A review that cannot name what it fully read is
+   unproven. **Failing case:** a 600-line diff gets hunk-by-hunk commentary on the first
+   screen and silence on the migration file at the bottom.
 
 ## Give actionable feedback
 - Read surrounding source before severity: call sites, existing guards, and the nearest consumer decide impact; a diff hunk alone is not enough.
@@ -44,6 +50,10 @@ If it does not, do not merge it.
   never approval or silent demotion.
 - **Skipped checks are recorded.** A check you couldn't run gets a
   `Skipped: <check> — <why>` line.
+- **Unreviewed is not clean.** A report that never names an area does not prove that area
+  was inspected; the consolidated account names what was not covered or marks `gap`.
+  **Failing case:** a findings list silent on, say, migration safety is not a clean
+  migration review — name the inspection or the gap.
 - Let automation (linters, formatters, CI) catch the trivial stuff so review focuses on
   design and correctness.
 
@@ -63,6 +73,15 @@ An author who is factually right wins over a reviewer's taste.
 
 Root re-verifies each claimed consequence at the cited site, keeps the surviving evidence, sets final severity itself (reviewer severity advisory), records what decided ([agents.md § Independence](agents.md#independence)); unresolved conflicts stay open blockers.
 
+## Heuristic checks: FLAG vs NOTE
+
+A heuristic check that gates emits **FLAG** only when it can state the observed
+consequence and where to re-verify it; when context cannot disambiguate, it emits a
+**NOTE** that never gates. A check whose flag rate stays steady while every fix
+reads as progress is checking the wrong layer — retune it or retire it.
+**Failing case:** an ambiguous-identifier rule flags every pass, reviewers learn to
+skim the list, and a real defect hides inside the noise it created.
+
 ## Scope discipline
 Review the change, not the whole project. Out-of-scope problems become follow-ups, not
 drive-by edits that balloon the diff.
@@ -79,7 +98,11 @@ at `/rite-review` / `/rite-seal`:
    human-approved exception** is a **Critical** finding and a **NO-GO** at seal, the same standing
    as an unproven acceptance criterion. Check the diff against each principle's scope; an absent
    or empty file means none are declared (gate passes).
-2. **The anti-slop charter** (`coding-style.md` + `prose-style.md`): the AI-tells do-not list.
+2. **The anti-slop charter** ([`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+   UI + code lists; [`prose-style.md`](prose-style.md) for prose). [`coding-style.md`](coding-style.md)
+   points at the code list — it is not a second catalog. **Failing case:** a backend-only
+   diff is charged UI anti-slop (Inter / lavender / gradient); those fire only when a
+   rendered UI surface is in the diff.
 
 A principle violation is Critical. A charter violation is classified by its real
 impact. Record each finding with `file:line`.

package/pack/.claude/skills/devrites-lib/reference/standards/coding-style.md

@@ -18,9 +18,10 @@ existing idiom first; these rules fill the gaps.
 Handle unwanted cases first and return early; keep the success path flat.
 
 ## Comments explain *why*, not *what*
-- Self-explanatory code beats a comment restating it. Rename before you comment.
-- Reserve comments for intent, trade-offs, non-obvious constraints, and "here be
-  dragons" warnings. Delete commented-out code. That's what version control is for.
+- Self-explanatory code beats a comment restating it; delete commented-out code. The
+  full comment do-not list (what-comments, tutorial noise, ownerless TODOs, edit-narration,
+  hedging) is owned by [`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+  § Code anti-slop — one canonical list, consumed by build, polish, and review.
 
 ## Simplicity
 - Prefer the simplest thing that works. Don't add abstraction before you have two real

package/pack/.claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -11,7 +11,15 @@ Long tool histories can displace important facts and retain failed attempts. Act
 to 70% context use, keep one task's working set small, and load only what the current
 step needs. The workspace, not a summary, is the source of truth.
 
-**Compaction-preservation directive.** If the harness compacts mid-feature, preserve the `.devrites/ACTIVE` slug, `state.md`'s `Next step`, every open `questions.md` gate, and `decisions.md`'s `Dead ends`. Session hooks normally restore these; this is the fallback when no hook fires.
+- **Count before viewing:** on a search hit list, read match counts first (`grep -c`,
+  match summaries) and open only the files a one-line answer needs; dumping whole
+  files for a one-line question is common waste.
+- **Cut before load, not after.** Drop low-signal files, prior-turn dumps, and
+  duplicate index queries before they enter context. Truncating a bloated window
+  after the fact is not an efficiency strategy — the cost is already paid.
+  **Failing case:** five whole-file reads, then `/compact`, treated as cost control.
+
+**Compaction-preservation directive.** If the harness compacts mid-feature, read `.devrites/ACTIVE`, then reload the `state.md` cursor, open `questions.md` gates, durable `decisions.md`, and `test-plan.md`/`evidence.md` proof pointers. Session hooks normally restore these; this is the fallback when no hook fires.
 
 ## Authority and trust
 

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -9,7 +9,7 @@ Repository conventions follow [Precedence](#precedence).
 1. **Right step, right time:** use the smallest workflow and load only relevant
    files. Batch independent reads and cover the relevant code, not just the first
    match. Prefer an available code index for structure; see
-   [`tooling.md`](tooling.md).
+   [`tooling.md`](tooling.md) and [`code-navigation.md`](code-navigation.md).
 2. **No silent assumptions:** surface material assumptions; ask when the answer
    changes scope, architecture, data model, UX, security, migration risk, or
    acceptance.
@@ -17,7 +17,10 @@ Repository conventions follow [Precedence](#precedence).
    conflict, stop, name the conflict, present options, wait for resolution
    when the answer changes the product.
 4. **Keep the spec current:** change spec / plan only through the Spec Drift Guard;
-   never code against a known-wrong plan.
+   never code against a known-wrong plan. A later phase MUST NOT rewrite a sealed
+   artifact in place so the code "matches." Append a dated delta through the
+   owning rite, or record drift. **Failing case:** Build edits `spec.md`
+   acceptance criteria to fit the implementation.
 5. **One slice at a time:** leave one vertical slice working and proven, then
    stop. HITL never auto-continues; AFK runs to its slice budget
    ([`afk-hitl.md`](afk-hitl.md)).
@@ -43,7 +46,27 @@ Before advancing a phase, run `devrites-engine check readiness <slug>` for struc
 
 ### Gate contract
 
-Each gate is declared as **Name · Precondition · Satisfying observation (exact command/artifact state) · Pass/Fail · What failure blocks**, with one type: `preflight`, `revision`, `escalation` (human-only), `abort`. Engine gates keep exit codes; semantic gates are judged by their owner against this contract. A gate whose failure consequence cannot be named is decoration — sharpen or delete it. A mechanical gate's satisfying observation is a command or artifact state a reviewer can re-run or re-read — narrative-only passes are unproven.
+Each gate is declared as **Name · Precondition · Satisfying observation (exact command/artifact state) · Verdict · What failure blocks**, with one type: `preflight`, `revision`, `escalation` (human-only; distinct from the afk-hitl `escalating` severity), `abort`. Engine gates keep exit codes; semantic gates are judged by their owner against this contract. A gate whose failure consequence cannot be named is decoration — sharpen or delete it. A mechanical gate's satisfying observation is a command or artifact state a reviewer can re-run or re-read — narrative-only passes are unproven.
+
+Verdict discipline — no vacuous verdicts:
+
+- The precondition asserts the artifact **exists and is non-empty**, not merely that its
+  path resolves. **Failing case:** a phase passes its prerequisite gate, then dies
+  mid-analysis reading a missing spec.
+- A verdict is **PASS**, **FAIL**, or **NOT-RUN**. A NOT-RUN carries its named marker
+  (`unavailable: <reason>`, `unproven`, `partial: <what ran>`) in the consuming artifact;
+  it never renders as clean and never goes silent. **Failing case:** a review sub-step
+  that never ran is simply omitted from the summary, which reads as a clean run.
+- A PASS is valid only when the observation states a **positive count of items actually
+  checked**; zero checked items is FAIL. **Failing case:** an unparseable checklist yields
+  an empty result set and a green verdict over zero evidence.
+- Scope-bearing gates name their **baseline** and fail only on issues attributable to the
+  change; "could not run" (timeout, unreachable, parse failure) is never recorded as
+  "failed". **Failing case:** a dependency gate reddens on a pre-existing advisory
+  unrelated to the diff.
+- Failure behavior is **abort** (stop; the blocked step is named) or **record-and-continue**
+  (the FAIL/NOT-RUN is recorded with its marker and the run proceeds). Both are legal;
+  silent is not.
 
 ## Caller-owned technical backtracking
 
@@ -103,12 +126,13 @@ These universal musts link to their full rules; load depth only when needed.
 ## Persistence before stopping (handoff discipline)
 
 Before any `rite-*` skill stops:
+
 - Open question? → `questions.md` (with `status`, `gate`, `slice`, `proposed`,
   `raised_at`). Decision discussed? → `decisions.md`.
 - Assumption made? → `assumptions.md`. Drift raised? → `drift.md`.
 - Approach tried that **failed**? → a `## Dead ends` section in `decisions.md` (what you
-  tried, why it failed, what it rules out). Compaction and the next agent must not repeat a
-  dead end because later work must not repeat an invalidated approach.
+  tried, why it failed, what it rules out). Compaction and the next agent must not repeat an
+  invalidated approach.
 - Next-action ambiguous? → resolve to one command in `state.md`.
 - HITL pause? → write the `Awaiting human` block to `state.md` and set
   `Status: awaiting_human` before stopping; resume via `/rite-resolve <qid> "<answer>"`.
@@ -118,12 +142,12 @@ A skill that stops without doing this leaves the workspace incomplete.
 
 ## Context hygiene (end of every phase)
 
-Long contexts degrade reasoning quality (Liu et al. 2023 "lost in the middle";
-"context rot" on long inputs). Act on context at **50-70% used, not 95%**.
+Long contexts degrade reasoning quality. Act on context at **50-70% used, not 95%**.
 
-Every `rite-*` skill ends with a one-line **Session hygiene** advisory naming
-the right move (`/clear` vs `/compact`) and the single resume command. Full
-phase-by-phase guidance: [`context-hygiene.md`](context-hygiene.md).
+Compact utilities end with a one-line `↻ Hygiene:` advisory naming the right move
+(`/clear` vs `/compact`) and the single resume command; other rites name the single
+resume command in their stop output. Full phase-by-phase guidance:
+[`context-hygiene.md`](context-hygiene.md).
 
 ## Precedence
 

package/pack/.claude/skills/devrites-lib/reference/standards/data-integrity.md

@@ -1,7 +1,8 @@
 # Data integrity
 
 Load this when a change writes durable state, changes a schema, migrates or backfills
-records, changes retention, or can expose one tenant's data to another. Data work is
+records, changes retention, can expose one tenant's data to another, or feeds a
+model/feature pipeline (training data, features, labels, embeddings). Data work is
 complete only when normal operation, interruption, retry, and rollback preserve the
 declared invariants.
 
@@ -17,9 +18,29 @@ Name before planning implementation:
   derived stores;
 - old and new readers/writers that coexist during rollout.
 
+Timestamps normalize before they persist: one storage scale (UTC instants), explicit
+conversion only at input/display boundaries; two writers storing different scales for
+the same fact is an invariant violation caught in review. TZ/DST behavioral coverage
+lives in [`testing.md`](testing.md).
+
 An invariant enforced only by prose is not a control. Prefer a database constraint or
 atomic storage primitive, then add behavioral proof at the public surface.
 
+## Model and feature pipelines
+
+Durable-state rules apply to ML-adjacent writes with their own failure modes:
+
+- **Data contract:** producers and consumers bind to a versioned schema plus quality rules
+  owned beside the pipeline. Two stages reading one field under different implicit schemas
+  is an invariant violation caught like any schema drift.
+- **Point-in-time correctness:** a feature may use only data available at prediction time.
+  Label leakage through later-arriving data invalidates the artifact silently. **Failing
+  case:** a feature computed from post-prediction-time data passes review; a backfilled
+  label join reads as valid history.
+- **Training/serving skew:** the same feature computed two ways is a behavioral difference
+  to test, not a deployment note; drift monitoring rides the observability owner
+  ([`observability.md`](observability.md)).
+
 ## Migration and backfill path
 
 Use **expand → migrate → contract** for compatibility across deployment units:
@@ -91,5 +112,7 @@ data scale, before/after counts, rejected rows, invariant results, and observed
   forward-only recovery accepted by the human owner.
 - No migration GO with unknown old readers/writers, unresolved invariant violations,
   unbounded backfill, missing interruption state, or no production-scale risk estimate.
+  **Failing case:** GO with "revert if needed" and no rehearsal command or before/after
+  counts → NO-GO.
 - No data-loss or cross-tenant risk may be dismissed as "pre-existing" without baseline
   evidence from before the candidate.

package/pack/.claude/skills/devrites-lib/reference/standards/debug-recovery.md

@@ -7,7 +7,7 @@ Triggered standard for polling async readiness without blind sleep. Skill owner:
 
 When waiting for async readiness (server start, job completion, browser signal):
 
-1. Set `max_wait_ms` (default 30_000 unless artifact specifies otherwise).
+1. Set `max_wait_ms` (default 30_000 unless the calling task or test-plan artifact specifies otherwise).
 2. Poll with **condition check** — never fixed sleep as the primary strategy.
 3. Capture **last signal** (last log line, HTTP status, DOM state) on timeout.
 4. Record artifact: `{ condition, max_wait_ms, last_signal, outcome }`.
@@ -15,6 +15,13 @@ When waiting for async readiness (server start, job completion, browser signal):
 **Failing case:** `sleep(5)` loop with no captured last signal → recovery incomplete;
 treat as flaky/unproven.
 
+## Diagnosis write freeze
+
+During diagnosis, writable paths are the reproduction harness plus the files
+named by the current ranked hypothesis. Other product paths are frozen until
+the hypothesis is confirmed. **Failing case:** while debugging one test, the
+agent "fixes" lint in an unrelated package.
+
 ## Relationship to debug-recovery skill
 
 The seven-step recovery cycle owns reproduction and fix. This standard owns the