devrites 4.6.0 → 5.0.0

package/pack/generated/claude/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -1,8 +1,24 @@
 # Browser proof checklist
 
+Compact sweep only. Numbers and failing cases live in
+[`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md)
+§ Focus & states, § Responsive, and § Browser chrome — do not restate a shorter
+viewport set here.
+
 - Open the real UI (never screenshot-only); check console and network for errors.
-- Interactive slices capture each relevant state (default/hover/focus-visible/active/disabled/loading/empty/error) at 320 + 768 px, +1024/1440 when adaptive; state floor: [`../../../devrites-frontend-craft/reference/quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md). Omission needs a one-line `not-needed` reason; states must exist in source — an unreachable state's capture proves nothing.
-- Review browser-default surfaces once per slice (selection, caret, scrollbars, focus ring); no horizontal overflow at captured widths; 200% zoom spot-check; compare to `design-brief.md` → Visual Verdict.
-- Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record that disposition instead of capturing quietly; UI copy follows `devrites-frontend-craft`, long-form prose follows [`prose-style.md`](prose-style.md).
+- Before reading the builder's verdict, inventory the raw captures against the
+  required routes/states/viewports and candidate identity. Open each capture: a
+  wrong route, blank render, unexpected login wall, inconsistent dimensions, or
+  stale candidate is missing evidence. Recapture; until resolved, record
+  `cannot_verify` and block visual approval. A convincing narrative cannot repair it.
+- Interactive slices capture each relevant canonical state and the canonical
+  viewport set. Omission needs a one-line `not-needed` reason; states must exist
+  in source — an unreachable state's capture proves nothing.
+- Browser-default chrome is judged by § Browser chrome; reflow, zoom and bounded
+  two-dimensional exceptions by § Responsive. Compare to `design-brief.md` → Visual Verdict.
+- Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record
+  that disposition instead of capturing quietly; UI copy follows
+  `devrites-frontend-craft`, long-form prose follows `devrites-prose-craft`
+  ([`prose-style.md`](prose-style.md)).
 
 Detailed skill: `devrites-browser-proof`.

package/pack/generated/claude/skills/devrites-lib/reference/standards/ci-cd.md

@@ -12,7 +12,7 @@ Read this only when creating or changing a build/deploy pipeline. [`hooks.md`](h
 
 Read the specific failure, fix its root cause, verify locally, then push again. Do not blind-rerun a flaky pipeline. Use `devrites-debug-recovery` when a test or build failure needs reproduction.
 
-A designated Build Cop owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
+A designated Build Cop (a human/team role, not a pack agent) owns restoring a broken trunk by fixing or reverting, whichever is faster. Restoring trunk outranks feature work.
 
 ## Deploy versus release
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/code-navigation.md

@@ -0,0 +1,43 @@
+# Code navigation
+
+Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
+this file is the pack-canonical routing table agents cite in Build, Vet, and
+Review.
+
+## Route by question
+
+| Question | First tool | Fallback |
+| --- | --- | --- |
+| Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
+| Callers, callees, data flow across files | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
+| PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
+| Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
+| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
+| Known file, one-line fix | `Read` at offset/limit | — |
+| Literal string / config value | `Grep` | — |
+
+## Before cross-file edits
+
+1. Run **one** primary route from the table (record tool + query in the artifact).
+2. Read symbol bodies you will change (`read_symbol` counts as read).
+3. After edits: LSP diagnostics + project tests.
+
+Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
+`cannot_verify`.
+
+## Index freshness
+
+| Index path | Provider |
+| --- | --- |
+| `.codegraph/` | CodeGraph |
+| `.code-review-graph/` | code-review-graph MCP |
+| `.codebase-memory/` | codebase-memory MCP |
+Run `devrites-engine check indexes` for a quick presence check. Stale or missing index:
+build/refresh per provider docs, or fall back to LSP + grep and note the gap.
+
+## Anti-patterns
+
+- Duplicate graph queries for reassurance.
+- Whole-file reads when `read_symbol` or `module_report` suffices.
+- Grep-only blast-radius claims when an index is present.
+- Editing without reading the enclosing symbol body.

package/pack/generated/claude/skills/devrites-lib/reference/standards/code-review.md

@@ -17,13 +17,19 @@ If it does not, do not merge it.
 
 ## What to check (tests first)
 1. **Tests:** do they exist and prove the behavior + failure modes (empty, error,
-   boundary, concurrency)? Would they fail if the code were wrong?
+   boundary, concurrency)? Would they fail if the code were wrong? A `skip`/`only`/
+   `TODO` placeholder or assertion-free test is a finding, not coverage.
 2. **Correctness:** logic, edge cases, error paths, race conditions, wrong assumptions. For branching or boundary changes, run the [`edge-case trace`](edge-case-trace.md): relevant probe classes, fixed-set siblings, real wiring, negative intent, and deletion contracts with an evidence disposition.
 3. **Readability:** names, function size, control flow, intent obvious without the author.
 4. **Architecture:** right seam, coupling/cohesion, fits existing patterns, no premature
    abstraction. Check how it fits the larger system as well as its local behavior.
 5. **Security:** trust boundaries, input validation, authz, secrets.
 6. **Risk:** migrations, destructive changes, rollback.
+7. **Read depth matches risk:** the review's `Basis` names **full reads of the largest
+   diff files** (top three by changed lines), and any config/dependency/SQL/auth/migration
+   file is read in full — never skimmed. A review that cannot name what it fully read is
+   unproven. **Failing case:** a 600-line diff gets hunk-by-hunk commentary on the first
+   screen and silence on the migration file at the bottom.
 
 ## Give actionable feedback
 - Read surrounding source before severity: call sites, existing guards, and the nearest consumer decide impact; a diff hunk alone is not enough.
@@ -44,6 +50,10 @@ If it does not, do not merge it.
   never approval or silent demotion.
 - **Skipped checks are recorded.** A check you couldn't run gets a
   `Skipped: <check> — <why>` line.
+- **Unreviewed is not clean.** A report that never names an area does not prove that area
+  was inspected; the consolidated account names what was not covered or marks `gap`.
+  **Failing case:** a findings list silent on, say, migration safety is not a clean
+  migration review — name the inspection or the gap.
 - Let automation (linters, formatters, CI) catch the trivial stuff so review focuses on
   design and correctness.
 
@@ -63,6 +73,15 @@ An author who is factually right wins over a reviewer's taste.
 
 Root re-verifies each claimed consequence at the cited site, keeps the surviving evidence, sets final severity itself (reviewer severity advisory), records what decided ([agents.md § Independence](agents.md#independence)); unresolved conflicts stay open blockers.
 
+## Heuristic checks: FLAG vs NOTE
+
+A heuristic check that gates emits **FLAG** only when it can state the observed
+consequence and where to re-verify it; when context cannot disambiguate, it emits a
+**NOTE** that never gates. A check whose flag rate stays steady while every fix
+reads as progress is checking the wrong layer — retune it or retire it.
+**Failing case:** an ambiguous-identifier rule flags every pass, reviewers learn to
+skim the list, and a real defect hides inside the noise it created.
+
 ## Scope discipline
 Review the change, not the whole project. Out-of-scope problems become follow-ups, not
 drive-by edits that balloon the diff.
@@ -79,7 +98,11 @@ at `/rite-review` / `/rite-seal`:
    human-approved exception** is a **Critical** finding and a **NO-GO** at seal, the same standing
    as an unproven acceptance criterion. Check the diff against each principle's scope; an absent
    or empty file means none are declared (gate passes).
-2. **The anti-slop charter** (`coding-style.md` + `prose-style.md`): the AI-tells do-not list.
+2. **The anti-slop charter** ([`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+   UI + code lists; [`prose-style.md`](prose-style.md) for prose). [`coding-style.md`](coding-style.md)
+   points at the code list — it is not a second catalog. **Failing case:** a backend-only
+   diff is charged UI anti-slop (Inter / lavender / gradient); those fire only when a
+   rendered UI surface is in the diff.
 
 A principle violation is Critical. A charter violation is classified by its real
 impact. Record each finding with `file:line`.

package/pack/generated/claude/skills/devrites-lib/reference/standards/coding-style.md

@@ -18,9 +18,10 @@ existing idiom first; these rules fill the gaps.
 Handle unwanted cases first and return early; keep the success path flat.
 
 ## Comments explain *why*, not *what*
-- Self-explanatory code beats a comment restating it. Rename before you comment.
-- Reserve comments for intent, trade-offs, non-obvious constraints, and "here be
-  dragons" warnings. Delete commented-out code. That's what version control is for.
+- Self-explanatory code beats a comment restating it; delete commented-out code. The
+  full comment do-not list (what-comments, tutorial noise, ownerless TODOs, edit-narration,
+  hedging) is owned by [`anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md)
+  § Code anti-slop — one canonical list, consumed by build, polish, and review.
 
 ## Simplicity
 - Prefer the simplest thing that works. Don't add abstraction before you have two real

package/pack/generated/claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -11,7 +11,15 @@ Long tool histories can displace important facts and retain failed attempts. Act
 to 70% context use, keep one task's working set small, and load only what the current
 step needs. The workspace, not a summary, is the source of truth.
 
-**Compaction-preservation directive.** If the harness compacts mid-feature, preserve the `.devrites/ACTIVE` slug, `state.md`'s `Next step`, every open `questions.md` gate, and `decisions.md`'s `Dead ends`. Session hooks normally restore these; this is the fallback when no hook fires.
+- **Count before viewing:** on a search hit list, read match counts first (`grep -c`,
+  match summaries) and open only the files a one-line answer needs; dumping whole
+  files for a one-line question is common waste.
+- **Cut before load, not after.** Drop low-signal files, prior-turn dumps, and
+  duplicate index queries before they enter context. Truncating a bloated window
+  after the fact is not an efficiency strategy — the cost is already paid.
+  **Failing case:** five whole-file reads, then `/compact`, treated as cost control.
+
+**Compaction-preservation directive.** If the harness compacts mid-feature, read `.devrites/ACTIVE`, then reload the `state.md` cursor, open `questions.md` gates, durable `decisions.md`, and `test-plan.md`/`evidence.md` proof pointers. Session hooks normally restore these; this is the fallback when no hook fires.
 
 ## Authority and trust
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/core.md

@@ -9,7 +9,7 @@ Repository conventions follow [Precedence](#precedence).
 1. **Right step, right time:** use the smallest workflow and load only relevant
    files. Batch independent reads and cover the relevant code, not just the first
    match. Prefer an available code index for structure; see
-   [`tooling.md`](tooling.md).
+   [`tooling.md`](tooling.md) and [`code-navigation.md`](code-navigation.md).
 2. **No silent assumptions:** surface material assumptions; ask when the answer
    changes scope, architecture, data model, UX, security, migration risk, or
    acceptance.
@@ -17,7 +17,10 @@ Repository conventions follow [Precedence](#precedence).
    conflict, stop, name the conflict, present options, wait for resolution
    when the answer changes the product.
 4. **Keep the spec current:** change spec / plan only through the Spec Drift Guard;
-   never code against a known-wrong plan.
+   never code against a known-wrong plan. A later phase MUST NOT rewrite a sealed
+   artifact in place so the code "matches." Append a dated delta through the
+   owning rite, or record drift. **Failing case:** Build edits `spec.md`
+   acceptance criteria to fit the implementation.
 5. **One slice at a time:** leave one vertical slice working and proven, then
    stop. HITL never auto-continues; AFK runs to its slice budget
    ([`afk-hitl.md`](afk-hitl.md)).
@@ -43,7 +46,27 @@ Before advancing a phase, run `devrites-engine check readiness <slug>` for struc
 
 ### Gate contract
 
-Each gate is declared as **Name · Precondition · Satisfying observation (exact command/artifact state) · Pass/Fail · What failure blocks**, with one type: `preflight`, `revision`, `escalation` (human-only), `abort`. Engine gates keep exit codes; semantic gates are judged by their owner against this contract. A gate whose failure consequence cannot be named is decoration — sharpen or delete it. A mechanical gate's satisfying observation is a command or artifact state a reviewer can re-run or re-read — narrative-only passes are unproven.
+Each gate is declared as **Name · Precondition · Satisfying observation (exact command/artifact state) · Verdict · What failure blocks**, with one type: `preflight`, `revision`, `escalation` (human-only; distinct from the afk-hitl `escalating` severity), `abort`. Engine gates keep exit codes; semantic gates are judged by their owner against this contract. A gate whose failure consequence cannot be named is decoration — sharpen or delete it. A mechanical gate's satisfying observation is a command or artifact state a reviewer can re-run or re-read — narrative-only passes are unproven.
+
+Verdict discipline — no vacuous verdicts:
+
+- The precondition asserts the artifact **exists and is non-empty**, not merely that its
+  path resolves. **Failing case:** a phase passes its prerequisite gate, then dies
+  mid-analysis reading a missing spec.
+- A verdict is **PASS**, **FAIL**, or **NOT-RUN**. A NOT-RUN carries its named marker
+  (`unavailable: <reason>`, `unproven`, `partial: <what ran>`) in the consuming artifact;
+  it never renders as clean and never goes silent. **Failing case:** a review sub-step
+  that never ran is simply omitted from the summary, which reads as a clean run.
+- A PASS is valid only when the observation states a **positive count of items actually
+  checked**; zero checked items is FAIL. **Failing case:** an unparseable checklist yields
+  an empty result set and a green verdict over zero evidence.
+- Scope-bearing gates name their **baseline** and fail only on issues attributable to the
+  change; "could not run" (timeout, unreachable, parse failure) is never recorded as
+  "failed". **Failing case:** a dependency gate reddens on a pre-existing advisory
+  unrelated to the diff.
+- Failure behavior is **abort** (stop; the blocked step is named) or **record-and-continue**
+  (the FAIL/NOT-RUN is recorded with its marker and the run proceeds). Both are legal;
+  silent is not.
 
 ## Caller-owned technical backtracking
 
@@ -103,12 +126,13 @@ These universal musts link to their full rules; load depth only when needed.
 ## Persistence before stopping (handoff discipline)
 
 Before any `rite-*` skill stops:
+
 - Open question? → `questions.md` (with `status`, `gate`, `slice`, `proposed`,
   `raised_at`). Decision discussed? → `decisions.md`.
 - Assumption made? → `assumptions.md`. Drift raised? → `drift.md`.
 - Approach tried that **failed**? → a `## Dead ends` section in `decisions.md` (what you
-  tried, why it failed, what it rules out). Compaction and the next agent must not repeat a
-  dead end because later work must not repeat an invalidated approach.
+  tried, why it failed, what it rules out). Compaction and the next agent must not repeat an
+  invalidated approach.
 - Next-action ambiguous? → resolve to one command in `state.md`.
 - HITL pause? → write the `Awaiting human` block to `state.md` and set
   `Status: awaiting_human` before stopping; resume via `/rite-resolve <qid> "<answer>"`.
@@ -118,12 +142,12 @@ A skill that stops without doing this leaves the workspace incomplete.
 
 ## Context hygiene (end of every phase)
 
-Long contexts degrade reasoning quality (Liu et al. 2023 "lost in the middle";
-"context rot" on long inputs). Act on context at **50-70% used, not 95%**.
+Long contexts degrade reasoning quality. Act on context at **50-70% used, not 95%**.
 
-Every `rite-*` skill ends with a one-line **Session hygiene** advisory naming
-the right move (`/clear` vs `/compact`) and the single resume command. Full
-phase-by-phase guidance: [`context-hygiene.md`](context-hygiene.md).
+Compact utilities end with a one-line `↻ Hygiene:` advisory naming the right move
+(`/clear` vs `/compact`) and the single resume command; other rites name the single
+resume command in their stop output. Full phase-by-phase guidance:
+[`context-hygiene.md`](context-hygiene.md).
 
 ## Precedence
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/data-integrity.md

@@ -1,7 +1,8 @@
 # Data integrity
 
 Load this when a change writes durable state, changes a schema, migrates or backfills
-records, changes retention, or can expose one tenant's data to another. Data work is
+records, changes retention, can expose one tenant's data to another, or feeds a
+model/feature pipeline (training data, features, labels, embeddings). Data work is
 complete only when normal operation, interruption, retry, and rollback preserve the
 declared invariants.
 
@@ -17,9 +18,29 @@ Name before planning implementation:
   derived stores;
 - old and new readers/writers that coexist during rollout.
 
+Timestamps normalize before they persist: one storage scale (UTC instants), explicit
+conversion only at input/display boundaries; two writers storing different scales for
+the same fact is an invariant violation caught in review. TZ/DST behavioral coverage
+lives in [`testing.md`](testing.md).
+
 An invariant enforced only by prose is not a control. Prefer a database constraint or
 atomic storage primitive, then add behavioral proof at the public surface.
 
+## Model and feature pipelines
+
+Durable-state rules apply to ML-adjacent writes with their own failure modes:
+
+- **Data contract:** producers and consumers bind to a versioned schema plus quality rules
+  owned beside the pipeline. Two stages reading one field under different implicit schemas
+  is an invariant violation caught like any schema drift.
+- **Point-in-time correctness:** a feature may use only data available at prediction time.
+  Label leakage through later-arriving data invalidates the artifact silently. **Failing
+  case:** a feature computed from post-prediction-time data passes review; a backfilled
+  label join reads as valid history.
+- **Training/serving skew:** the same feature computed two ways is a behavioral difference
+  to test, not a deployment note; drift monitoring rides the observability owner
+  ([`observability.md`](observability.md)).
+
 ## Migration and backfill path
 
 Use **expand → migrate → contract** for compatibility across deployment units:
@@ -91,5 +112,7 @@ data scale, before/after counts, rejected rows, invariant results, and observed
   forward-only recovery accepted by the human owner.
 - No migration GO with unknown old readers/writers, unresolved invariant violations,
   unbounded backfill, missing interruption state, or no production-scale risk estimate.
+  **Failing case:** GO with "revert if needed" and no rehearsal command or before/after
+  counts → NO-GO.
 - No data-loss or cross-tenant risk may be dismissed as "pre-existing" without baseline
   evidence from before the candidate.

package/pack/generated/claude/skills/devrites-lib/reference/standards/debug-recovery.md

@@ -7,7 +7,7 @@ Triggered standard for polling async readiness without blind sleep. Skill owner:
 
 When waiting for async readiness (server start, job completion, browser signal):
 
-1. Set `max_wait_ms` (default 30_000 unless artifact specifies otherwise).
+1. Set `max_wait_ms` (default 30_000 unless the calling task or test-plan artifact specifies otherwise).
 2. Poll with **condition check** — never fixed sleep as the primary strategy.
 3. Capture **last signal** (last log line, HTTP status, DOM state) on timeout.
 4. Record artifact: `{ condition, max_wait_ms, last_signal, outcome }`.
@@ -15,6 +15,13 @@ When waiting for async readiness (server start, job completion, browser signal):
 **Failing case:** `sleep(5)` loop with no captured last signal → recovery incomplete;
 treat as flaky/unproven.
 
+## Diagnosis write freeze
+
+During diagnosis, writable paths are the reproduction harness plus the files
+named by the current ranked hypothesis. Other product paths are frozen until
+the hypothesis is confirmed. **Failing case:** while debugging one test, the
+agent "fixes" lint in an unrelated package.
+
 ## Relationship to debug-recovery skill
 
 The seven-step recovery cycle owns reproduction and fix. This standard owns the

package/pack/generated/claude/skills/devrites-lib/reference/standards/definition-of-done.md

@@ -1,16 +1,19 @@
 # Definition of Done
 
-DevRites acceptance criteria answer "did we build the requested thing?" Definition of Done answers "is the change finished to DevRites quality?"
+Acceptance criteria prove the requested behavior; this bar proves the change is
+shippable. Phase owners keep the checks — this file is the index, not a second list.
 
-A feature is done only when:
+A feature is not done when any required row is missing. Open the owner; do not
+re-judge from this table alone.
 
-1. Acceptance criteria are mapped to evidence.
-2. See-it-fail-first proof exists where behavior changed.
-3. Runtime/build/test/browser evidence is fresh and recorded.
-4. No unscoped edits, drive-by refactors, or hidden second systems remain.
-5. Project standards and declared principles are honored, or an approved exception is recorded.
-6. No hard gates remain open: HITL, AFK, red tests, stale evidence, drift, review blockers, or NO-GO.
-7. Risky work names rollback/recovery.
-8. Public behavior, command surface, docs, or architecture changes update docs/ADR where applicable.
+| Required | Owner | Failing case |
+| --- | --- | --- |
+| Each AC names a stored evidence path (command or artifact) | [`testing.md`](testing.md), `rite-prove` | An AC is checked off with no path in `evidence.md` |
+| Discriminating tests for changed behavior | [`testing.md`](testing.md) | Suite green; revert of the change would still be green |
+| Fresh runtime/build/test/browser records | `rite-prove`, [`browser-proof-checklist.md`](browser-proof-checklist.md) | Proof claimed from stale or unrun commands |
+| Scope-clean diff | [`code-review.md`](code-review.md) | Unscoped edits or a hidden second system remain |
+| Open hard gates closed | [`afk-hitl.md`](afk-hitl.md), `rite-seal` | HITL, red tests, drift, or NO-GO still open |
+| Rollback named for risky work | [`data-integrity.md`](data-integrity.md) | "revert if needed" with no trigger/procedure/proof |
+| Docs/ADR for public behavior | [`documentation.md`](documentation.md) | Command or contract changed; docs did not |
 
-Use this as the standing bar in `rite-vet`, `rite-build`, `rite-prove`, `rite-seal`, and `rite-quick`; phase-specific standards still apply.
+Use from `rite-vet`, `rite-build`, `rite-prove`, `rite-seal`, and `rite-quick`.

package/pack/generated/claude/skills/devrites-lib/reference/standards/documentation.md

@@ -27,7 +27,10 @@ Promotion is maintenance of an existing authority, not a new memory system.
 2. **Ground:** verify each current claim against live authoritative repository sources.
    Report the source and currentness signal. Unverifiable means `unknown`, not false.
 3. **Scope:** state when the guidance applies and does not apply. Reject a candidate whose
-   observable trigger cannot be named.
+   observable trigger cannot be named. If final code/tests/docs already recover the
+   reasoning, reject or consolidate the lesson; promote only the missing durable constraint.
+   **Failing case:** a regression test already explains input rejection, yet a second
+   generic "validate input" rule is added with no lost reasoning identified.
 4. **Own and expose:** choose one existing canonical owner (`AGENTS.md`/`CLAUDE.md`, a scoped
    standard, or an ADR) and name the phases, agents, or contributors that discover it and
    how (direct read, index link, or existing on-demand route).

package/pack/generated/claude/skills/devrites-lib/reference/standards/edge-case-trace.md

@@ -56,7 +56,9 @@ Every applicable case receives one status:
 
 - `covered`: mapped to a REQ/AC and positive discriminating test or observed runtime proof;
 - `backstop`: an independent held-out, property/metamorphic, or direct behavioral check
-  names the wrong outcome it would detect;
+  names the wrong outcome it would detect — and is **exogenous**: not produced or
+  executed by the same code path it validates (a check the changed code also controls is
+  `covered` evidence, not a backstop);
 - `dismissed`: unreachable or irrelevant with a concrete reason and supporting evidence;
 - `unresolved`: a material case lacks a fact or proof surface and blocks the owning gate.
 
@@ -82,8 +84,8 @@ Spec records relevant cases in **Edge Coverage** and bespoke negative intent in
 reports only reachable gaps:
 
 ```md
-[Important] path:line — <trigger> reaches <unhandled outcome>; consequence:
-<observable harm>. Required correction: <minimal handling>. Missing proof: <test/signal>.
+Finding: <severity> | path:line | <trigger> reaches <unhandled outcome> | <observable harm> |
+<minimal handling>; missing proof: <test/signal>.
 ```
 
 Use the caller's severity scale. Do not create a separate edge score, pad rows with

package/pack/generated/claude/skills/devrites-lib/reference/standards/elicitation.md

@@ -10,6 +10,11 @@ this is the menu you reach into: named reasoning techniques, each with the shape
 2. Read its **risk**, then pull the 3-5 techniques below whose *When to reach for it* matches.
 3. Present them as a short numbered menu; the human picks one (or `skip`).
 4. Run that technique on that section, apply the result, move on.
+5. **No-yield exit:** when the technique surfaces nothing that changes the section — no
+   new requirement, mitigation, estimate change, or blocking question — record
+   `elicitation: <technique> — no yield` in the phase artifact and stop offering menus
+   for that section. **Failing case:** repeated technique menus on a settled section are
+   ceremony, not diligence; a second menu without new section input is a process defect.
 
 Selection is by the section's risk, not taste. Reach for the row that fits:
 
@@ -77,4 +82,4 @@ Run the technique on the **section in front of you**, not the whole document: a
 everything is a move applied to nothing. Record what it changed in the phase artifact (a new
 requirement, a mitigation, a blocking question), not just that you ran it.
 
-A project can append its own house techniques to this file: same three-column shape.
+A project can append its own house techniques to this file: same entry shape — **name (when to reach for it)** → the shape it produces.

package/pack/generated/claude/skills/devrites-lib/reference/standards/error-handling.md

@@ -22,7 +22,7 @@ Never retry blind — match the outcome first:
 
 - **Rejected** (refused: validation/authz/conflict): fix input; unchanged retry fails again.
 - **Unknown** (timed out mid-call): check state at the source before any retry.
-- **Partial** (half-committed): [`data-integrity.md`](data-integrity.md) § partial failure — reconcile or roll back, never resume blind.
+- **Partial** (half-committed): [`data-integrity.md`](data-integrity.md) (see `Writes, retries, and concurrency`) — reconcile or roll back, never resume blind.
 - **Clean failure** (not started / fully rolled back): safe to retry after fixing the cause.
 
 **Failing case:** an **Unknown** outcome retried unchanged double-applies (duplicate charge). Idempotency: [`data-integrity.md`](data-integrity.md); outcome taxonomies: [`integration-reliability.md`](integration-reliability.md). Not provable → `cannot_verify` and stop.
@@ -32,6 +32,9 @@ Never retry blind — match the outcome first:
   and ideally how to recover. Cryptic messages cost hours.
 - Distinguish *expected* failures (validation, not-found) from *unexpected* (bugs);
   handle the first as flow, surface the second.
+- Structured error surfaces carry one consistent envelope — **severity, stable code,
+  human message, fix** — so callers and logs can act programmatically; a bare string that
+  forces callers to parse prose is a contract gap.
 
 ## Fail closed (security-relevant paths)
 - On error in an auth/permission/transaction path, **deny and roll back**: never
@@ -39,6 +42,6 @@ Never retry blind — match the outcome first:
 
 ## Logging
 - Log key events (failures, access violations, validation errors) with enough context to
-  debug. Prefer structured logs (key/value or JSON) over string soup.
+  debug. Prefer structured logs (key/value or JSON).
 - **Never log secrets, credentials, tokens, or personal data.** Show users a clear,
   non-revealing message; keep the detail in the logs for the team.

package/pack/generated/claude/skills/devrites-lib/reference/standards/integration-reliability.md

@@ -11,6 +11,15 @@ schema, optional and unknown fields, ordering guarantee, rate limit, timeout bud
 retry responsibility, idempotency key, and user-visible degradation. Validate an
 external response as hostile input before trusted code consumes it.
 
+**Uploads and paginated collections are boundary contracts, not transport details.** An
+upload names body and expanded-size caps, chunk/resume behavior, partial-upload
+reconciliation, and the rejection path for oversized or malformed payloads. A paginated
+collection names cursor/offset semantics, page-size cap, the terminal “no more pages”
+signal, and how rows written during paging surface — skipped or duplicated rows are
+contract data, not surprises. **Failing case:** a client pages by offset while rows
+insert ahead of it and silently misses records; a boundary contract that cannot name
+this behavior fails Vet.
+
 For every call or delivery, classify the observed outcome:
 
 | Outcome | Required behavior |
@@ -27,17 +36,30 @@ For every call or delivery, classify the observed outcome:
 - Retry only a named transient failure and only when the operation is idempotent or has
   a durable deduplication key. Bound attempts, elapsed time, and exponential backoff;
   add jitter when many workers could synchronize.
+- Assign one retry owner across SDK, worker and queue, or explicitly share one
+  end-to-end attempt/deadline budget that redelivery cannot reset. Prove exhaustion
+  by counting physical downstream calls, including inner retries, and advancing a
+  controlled/injected clock to the deadline. Assert exhaustion, not wall-clock
+  duration ([testing.md](testing.md#determinism-no-flaky-tests)); elapsed-time logs
+  are observations, never timing assertions in tests.
+  **Failing case:** each of three layers permits four attempts, producing 64 calls;
+  three passing local retry tests do not prove the operation's budget. Budget
+  overrun blocks proof and Seal until retry ownership or shared accounting is fixed.
 - A timeout is not proof the provider did nothing. Query by idempotency key/status or
   reconcile before creating a second effect.
 - Webhook/queue consumers acknowledge only after durable success or durable handoff.
   Duplicate delivery, duplicate jobs, and out-of-order delivery are normal inputs:
   deduplicate durably and reject, buffer, or reconcile stale sequence/version values by contract.
+  **Failing case:** the handler acks before the durable write; a duplicate delivery
+  creates a second effect.
 - A poison message must not block the partition forever. Bound redelivery, retain the
   failure reason without secrets, move to the project's quarantine/dead-letter path,
   and define replay after correction.
-- A queue needs backlog age/depth, processing/failure rate, saturation, and ownership
-  signals. A queue backlog needs an accepted capacity/drain/recovery action; auto-scaling
-  without downstream capacity protection only moves the outage.
+- A queue emits observability signals — backlog depth, poison/quarantine count,
+  reconciliation lag, saturation, ownership — with [`observability.md`](observability.md)
+  as the signal-taxonomy owner. A queue backlog still needs an accepted
+  capacity/drain/recovery action; auto-scaling without downstream capacity protection
+  only moves the outage.
 
 ## Partial failure and recovery
 
@@ -45,9 +67,9 @@ Map each multi-step effect as `not started | committed | unknown | compensating
 reconciled`. If one system commits and another fails, name the durable record that
 drives retry or compensation. Do not catch/log/continue into a false success.
 
-For synchronous versus asynchronous design, decide from the user-visible consistency
-need, latency budget, failure coupling, and recovery model. Async processing changes the
-contract to accepted/pending/failed/retryable; it does not make the failure disappear.
+For synchronous versus asynchronous design, apply [`patterns.md`](patterns.md); async
+processing changes the contract to accepted/pending/failed/retryable; it does not make the
+failure disappear.
 
 ## Cache and partition behavior
 
@@ -67,9 +89,10 @@ For each boundary, `plan.md` records:
 | `<provider → consumer>` | `<budgets/key>` | `<rules>` | `<user/system path>` | `<signals/owner>` | `<test/rehearsal>` |
 
 Proof drives success, invalid shape, partial response, auth failure, rate limit, timeout,
-duplicate, out-of-order delivery, and outage when relevant. Use a contract-capable fake
-or sandbox for deterministic cases and at least one real boundary check when authorized
-and safe. A mock that simply returns the expected payload does not prove the risk.
+duplicate, out-of-order delivery, and outage when relevant. Deterministic cases use a
+contract-capable fake or sandbox per [`testing.md`](testing.md) — never a mock that
+simply returns the expected payload (that tests the stub, not the boundary) — plus at
+least one real boundary check when authorized and safe.
 
 ## Stop conditions
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/loop-operations.md

@@ -74,8 +74,8 @@ armed AFK workspace whose exact scope, gates, and budgets permit it.
   narration are not.
 - Host timeout, unavailable agent, malformed result, missed event, or stale snapshot
   is `gap`/`cannot_verify`, never success.
-- Do not retry unchanged work merely because a timer fired. Apply the existing exact
-  causal-fingerprint recovery cap.
+- Do not retry unchanged work merely because a timer fired. Apply the exact
+  causal-fingerprint recovery cap ([`afk-hitl.md`](afk-hitl.md)).
 - A cold resume continues durable slice/recovery state and absolute expiry. Fresh
   native activation counters follow `afk-hitl.md`; no durable bound is reinitialized.
 - Native notifications fire only after evidence and stop state are written.

package/pack/generated/claude/skills/devrites-lib/reference/standards/observability.md

@@ -26,6 +26,11 @@ answers one of them. A signal that maps to no question is noise you pay to store
   external-call outcomes, validation rejections, and authz denials.
 - Structured (key/value or JSON), not string soup: a log you can't query is a log you won't
   read. Carry a correlation id (request / trace / job id) so one incident's lines join up.
+- When several entry points share a path, carry a bounded **origin** (scheduler,
+  CLI, replay, request) set at entry and propagated across async boundaries.
+  Correlation joins one execution; origin identifies what started it. Trigger failures
+  through two distinct entries and prove each is attributed correctly. **Failing case:**
+  a CLI replay has a trace ID but is reported as a scheduled run.
 - **Never log secrets, tokens, or PII** ([`security.md`](security.md),
   [`error-handling.md`](error-handling.md)). Levels mean something: `error` is a page-worthy
   claim, not routine flow.
@@ -64,7 +69,7 @@ hours). A third tier is the noise everyone learns to mute: collapse it into one
 
 ## Verify the telemetry fires (evidence, not assumption)
 Instrumentation you added but never watched emit is unproven: the same standing as a test you
-never saw fail ([`testing.md`](testing.md) "See it fail first"). Trigger the path, confirm the
+never saw fail ([`testing.md`](testing.md) "Prove it can fail"). Trigger the path, confirm the
 log line / metric / span appears, and record the observation in `evidence.md`. "I
 added logging" with no observed emission is not done.
 

package/pack/generated/claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -66,8 +66,8 @@ Keep two budgets separate:
 Cold resume does not make that fingerprint old or exhausted. Derive its offline
 no-progress count from `drift.md` and `evidence.md`; while the count is below the
 cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`.
-That terminal cursor is valid only for missing retention, a human/safety gate, or
-an actually exhausted fingerprint.
+That terminal cursor is valid only for a human/safety gate, an actually exhausted
+fingerprint, or a proven absence of any safe retention/amplification design.
 
 A new real attempt is normally admissible only after the affected plan and fixtures
 are re-vetted, the failure condition is shown changed, and any required fresh

package/pack/generated/claude/skills/devrites-lib/reference/standards/patterns.md

@@ -46,6 +46,22 @@ Use a pattern only when it makes the design easier to understand and reduces cou
   abstraction over two things that aren't really the same).
 - Speculative generality: config, hooks, and extension points with no current user.
 
+## Symptom → suspect pattern
+
+Route an observed code symptom to the review it should trigger; the symptom is the
+evidence, not the diagnosis:
+
+| Observable symptom | Suspect | First check |
+| --- | --- | --- |
+| Every change funnels through one file/module | God object / missing seam | ownership map (§ Boundaries and state ownership) |
+| Tests stub half the module to exercise one function | I/O and logic entangled | separate I/O, domain logic, presentation |
+| Adding one field requires editing many unrelated files | Shotgun coupling | coupling direction; [`repository-topology.md`](repository-topology.md) |
+| Two components write the same mutable state | Authority conflict | one authoritative owner per fact |
+| Config/flag exists with no current consumer | Speculative generality | delete or name the current user (anti-patterns above) |
+
+**Failing case:** a review that names a pattern without pointing at the observed symptom
+that motivated it is architecture preference, not finding.
+
 ## In a codebase
 Match the patterns the project already uses before introducing a new one. A consistent
 "good enough" pattern beats a locally-superior but foreign one. Document the *why* of any