devrites 5.0.0 → 5.2.0

package/pack/generated/claude/skills/rite-build/reference/parallel-batch.md

@@ -7,12 +7,13 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | Input | Behavior |
 | --- | --- |
 | omitted / `--parallel 1` | Serial one-slice |
-| `--parallel N` (**2≤N≤3**) | Parallel when eligible + host pass |
-| non-integer / `N≤0` / `N>3` | Hard refuse (no silent clamp) |
+| `--parallel N` (**2≤N≤10**) | Parallel when eligible + host pass |
+| non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
 
 AFK caps `N` by remaining budget. Charge **only after successful integrate**
-(once per integrated green sibling). Abort / integrate-failed → **0**. Running
-lease blocks another `/rite-build`.
+(once per integrated green sibling). Abort / integrate-failed → **0**. A
+`running` lease blocks another `/rite-build`. Any present lease blocks
+`parallel create` until cleanup.
 
 ## Path-disjoint
 
@@ -40,14 +41,20 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
-3. Dispatch ≤3 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
-4. Inspect + fail-on-red → `green|red|gap`.
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
+   even when targeted tests are green.
 5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
 6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
    path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
 7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
    per integrated sibling; optional `check candidate`.
-8. Cleanup: success removes worktrees/branches; abort keeps until acknowledged.
+8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
+   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
+   follow [`spec-drift-guard.md`](spec-drift-guard.md) — batch-sweep all
+   siblings' contract assumptions, one folded `/rite-plan repair` + one
+   `/rite-vet` recheck inline, then cleanup and resume Build. Do not emit
+   `Fix: /rite-plan repair`. Product/policy/irreversible-risk still stops.
 
 ## Engine verbs
 

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -3,6 +3,7 @@
 See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
 [`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
 Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
+Spec Drift Guard still applies on abort or plan-gap.
 
 1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
    slice artifacts. Require `Implementation readiness: READY`, its current

package/pack/generated/claude/skills/rite-build/reference/spec-drift-guard.md

@@ -24,13 +24,31 @@ other phases reference it here.
      YES, active-slice technical/tool failure → log it and use Build's bounded debug
        recovery. Do not ask for retry authorization and do not re-plan unless the
        durable remaining-work instructions are wrong.
-     YES, durable plan is wrong → log it, save the caller's return cursor, then
-       invoke `/rite-plan repair` and `/rite-vet` inline without a question and resume.
+     YES, durable plan is wrong → run the batch sweep below, log every
+       violation, save the caller's return cursor, then invoke `/rite-plan repair` and `/rite-vet` inline
+       without a question — ONE folded repair for all open entries, ONE
+       recheck for every open fingerprint — and resume.
      NO, product/policy/irreversible-risk decision → ask the user (format below).
 5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
    may continue only after bounded recovery, returned-diff review, and proof gates pass.
 ```
 
+## Batch sweep (before repair)
+
+A durable-plan drift abort never repairs the first gap alone:
+
+1. Verify every remaining statically-checkable contract assumption against the
+   live repo — named paths, symbols/APIs/signatures, routes, commands, dependency
+   versions, contract artifacts. The wright's return names what it falsified;
+   check the rest yourself — existence checks are deterministic, no dispatch.
+2. Record each violation as its own `drift.md` entry/fingerprint; one folded
+   repair + one batched recheck resolves the set.
+3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
+   internally, never hand an intermediate command to the human.
+4. Nothing skips or defers silently: every entry ends resolved, human-escalated,
+   or fingerprint-exhausted. Execution-only gaps (tests, UX, evidence) get the
+   identical path when they surface.
+
 ## User question format
 ```
 I hit spec drift:
@@ -50,7 +68,8 @@ human permission question. Re-plan only when the durable plan changed.
 
 ## Inline return contract
 
-The phase that detected agent-owned drift owns the whole backtrack. Preserve it
+The phase that detected agent-owned drift owns the whole backtrack, batch sweep
+included. Preserve it
 as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
 boundaries internally; follow any vetted remediation required by the settled
 acceptance; then restore the cursor and resume the failed step. Do not hand an

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -36,7 +36,7 @@ Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
 preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
 Parallel isolated-writer worktrees remain forbidden until this serial pilot measures
 transfer, conflict, proof, and review outcomes on both hosts; opt-in `/rite-build --parallel N`
-(2≤N≤3) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
+(2≤N≤10) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
 worktrees stay forbidden.
 
 ## Prepare
@@ -83,4 +83,7 @@ Opt-in `/rite-build --parallel N` fans out only under [`parallel-batch.md`](para
    attempts is the limit; persist each and never dispatch a fourth related try.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
-   relevant facts in canonical artifacts, not the wholesale report.
+   relevant facts in canonical artifacts, not the wholesale report. A plan-gap
+   escalation without the checked-assumption list (verified|falsified) is
+   malformed; root sweeps the unchecked remainder per
+   [`spec-drift-guard.md`](spec-drift-guard.md) before repair.

package/pack/generated/claude/skills/rite-plan/SKILL.md

@@ -79,6 +79,9 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
    collision mutant. Past evidence loss is not terminal. The drafter supplies no bodies.
+   A repair candidate carries a delta self-check: touched invariants re-verified
+   (acyclic deps, bidirectional traceability, shared contract proof, sizing), no
+   correction-created regression.
    Bind exact active `.devrites/work/<slug>/` targets and executable contract; after Vet READY, root
    materializes the exact vetted workflow-artifact paths under
    [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
@@ -115,8 +118,9 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    material assumption, or open blocking/escalating question routes `/rite-clarify`/HITL.
    Restore `CLEAR` only from current evidence.
 7. **Done when:** every slice is sized (builds + proves in one cycle; no slice scoring >3
-   left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
-   is marked resolved, revised artifacts agree with each other, no source files changed in
+   left unjustified), the dependency order is acyclic, every open `drift.md` entry
+   was folded in one pass and marked resolved, the delta self-check is recorded,
+   revised artifacts agree with each other, no source files changed in
    `revise` mode, the marked action is complete, and every changed
    plan ends at `/rite-vet` rather than returning directly to build; horizon IDs stay stable,
    reclassifications cite evidence, and no unresolved item vanished. The `Shared contract proof`
@@ -128,5 +132,13 @@ to that caller so it can invoke Vet immediately. The phase boundary is not a
 user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
 condition was recorded.
 
+When invoked directly with no controlling caller and a planning artifact
+changed, become the caller for the mandated next step: record the return
+cursor, invoke `/rite-vet` inline, and consume its results — `NEEDS REPLAN`
+re-enters repair internally under the fingerprint caps; `NEEDS CLARIFICATION`
+and human-owned gates still reach the user. Stop only at Vet's boundary (READY
+readback; next step `/rite-build`). An unchanged plan keeps its recorded next
+step.
+
 > **Mid-flight discipline.** Do not change product behavior without confirmation or
 > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/claude/skills/rite-plan/reference/replan-and-repair.md

@@ -26,12 +26,19 @@ dependency edges.
 
 A drift event stopped the build. Steps:
 
-1. Read the `drift.md` entry and its classification.
+1. Read the `drift.md` entries and their classifications. Fold EVERY open entry
+   and accepted finding for the affected artifacts in ONE pass, never serially.
 2. If the user answered a drift question, encode that decision in `decisions.md`.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
-4. Mark the `drift.md` entry **resolved** with the resolution + date.
-5. Resume at the corrected slice.
+4. Mark each `drift.md` entry **resolved** with the resolution + date.
+5. **Self-check the repaired candidate on the delta before handoff** — re-verify
+   every invariant the correction touched (acyclic dependency graph,
+   bidirectional traceability, Shared contract proof vs boundary set, sizing,
+   no correction-created regression) and record the evidence in the Plan
+   checkpoint; Vet's recheck verifies it rather than rediscovering the defect a
+   loop later.
+6. Resume at the corrected slice.
 Never quietly delete a requirement; use the marked action before contract edits.
 
 ## reorder

package/pack/generated/claude/skills/rite-vet/SKILL.md

@@ -52,10 +52,14 @@ plan declares a root-authored executable workflow file, read
 - Use the lowest axis band; never average or round thin to ready. Search before
   asking and resolve reversible technical choices. Ask only human-owned choices.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
-  internally to its caller, not to the human.
-- **Recovery recheck is bounded.** A valid cursor plus open fingerprint enters
-  Recovery recheck; it does not start another Full Vet or repeat unaffected
-  axes/reviewers.
+  internally to its caller, not to the human; on a direct invocation there is
+  no caller, so Vet becomes it — record the cursor and invoke `/rite-plan`
+  repair inline under the same fingerprint caps.
+- **Recovery recheck is bounded and batched.** A valid cursor plus open
+  fingerprints enters Recovery recheck; it does not start another Full Vet or
+  repeat unaffected axes/reviewers. One dispatch covers every open fingerprint
+  of the fold — each checked individually — with a mandatory correction-created
+  regression audit.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"plan declares root-authored executable workflow file","action":"emit exact admission; stale/missing authority uses PLAN_VET_REPAIR","return":"Vet READY cursor or exact technical replan"} -->
 ## Workflow
 
@@ -73,10 +77,13 @@ plan declares a root-authored executable workflow file, read
    required account blocks.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
-   paths/criteria, and affected drift/evidence. Freeze that packet and dispatch
-   each exact owning reviewer once, fresh/read-only, limited to it. Do not rerun
-   broad inventory or unaffected reviewers. Close the prior fingerprint only
-   with discriminating evidence. Otherwise record one no-progress outcome. A
+   paths/criteria, affected drift/evidence, and the recorded delta self-check.
+   Freeze that packet and dispatch each exact owning reviewer once,
+   fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Do not rerun broad inventory or unaffected reviewers. Close the prior
+   fingerprint only with discriminating evidence plus an explicit
+   correction-created regression verdict on the touched invariants (acyclic
+   deps, traceability, contract proof, sizing). Otherwise record one no-progress outcome. A
    different Critical/Important invariant needs exact evidence and a new
    fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reconcile
    shared artifact/readiness gates and return to caller or next repair.
@@ -119,11 +126,13 @@ plan declares a root-authored executable workflow file, read
    criterion needs positive, discriminating proof; every slice must be one-pass
    implementable; developer plans need a predicted scorecard. Durable commands
    are portable repository commands, not host wrappers.
-7. **Narrow recheck after edits.** Dispatch exact plan reviewer once per
-   correction/fingerprint (`per correction/fingerprint`) with accepted findings,
-   changed paths/criteria, and new
-   identity. Within one correction, no broad third loop. If it changes plan,
-   fold again. A closed input plus a distinct Critical/Important invariant returns
+7. **Narrow recheck after edits.** Dispatch the exact plan reviewer once per
+   fold — one dispatch covering every open fingerprint, preserving
+   per correction/fingerprint accounting (each checked individually with its
+   accepted findings, changed paths/criteria, new identity, and recorded delta
+   self-check); it must return an explicit correction-created regression
+   verdict, not only fingerprint closure. Within one correction, no broad
+   third loop. If it changes plan, fold again. A closed input plus a distinct Critical/Important invariant returns
    that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
 8. **Build readback and readiness.** Add a cited five-line readback to
    `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/

package/pack/generated/codex/agents/devrites-slice-wright.toml

@@ -138,6 +138,10 @@ return an `Escalation`** when:
   scoped exception or the approach must change. Report the principle and conflict
   in `Escalation`.
 
+A plan-gap or underspecification escalation populates `assumptions` with every
+contract assumption already checked (verified|falsified); the orchestrator's
+batch sweep covers only the unchecked remainder. Never a bare "plan is wrong".
+
 If an answer would change scope or acceptance, do **not** fold it into the slice.
 Return it in `Escalation` so the orchestrator can route it through the Spec Drift
 Guard (`$rite-plan repair`). Respect any AFK budget in the contract.
@@ -172,7 +176,7 @@ reuse: []
 conventions: []
 principles: []
 sources: []
-assumptions: []
+assumptions: [] # plan-gap escalation: every checked contract assumption, verified|falsified
 decisions_stood: [] # irreversible-risk items go to escalation
 dead_ends: []
 escalation: <none | gate + crisp question + proposed answer>

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rite-build
-description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK may chain serially; opt-in `--parallel N` (2≤N≤3) for path-disjoint worktrees.
+description: Build the next approved vertical slice with evidence. HITL one-slice default; AFK may chain serially; opt-in `--parallel N` (2≤N≤10) for path-disjoint worktrees.
 argument-hint: "[--parallel N] [slice number or name]"
 user-invocable: true
 ---
@@ -10,7 +10,7 @@ user-invocable: true
 Build and prove one slice. HITL stops; a later user invocation starts the next.
 Explicit `.devrites/AFK` alone lets the controlling root chain pending slices
 serially under green proof, caps, and pause rules. Every wright returns after one slice.
-**Opt-in:** `$rite-build --parallel N` (2≤N≤3; N=1≡serial) follows
+**Opt-in:** `$rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
@@ -38,8 +38,10 @@ Wright applies anti-slop; root verifies returns and never patches source.
   single-slice isolation when `wright-dispatch.md` preflight + reconcile hold.
 - Exact feature scope only; reject out-of-allowlist diffs; record adjacent issues.
 - Never rerun an unchanged check; re-prove after edits.
-- Unplanned dependency/design-system/gap/repair → Vet/Spec Drift Guard. Ask only
-  for licensing/cost/security/product or explicit architecture-policy decisions.
+- Unplanned dependency/design-system/gap/repair → Vet/Spec Drift Guard batch
+  sweep: every contract-assumption violation recorded before one folded
+  repair+vet. Ask only for licensing/cost/security/product or explicit
+  architecture-policy decisions.
 - Root never edits product source/tests (`.devrites/` + Workflow Artifact only).
   Wright is sole product writer; extras in returned paths/`git diff --name-only` hard-stop.
 - Principles bind; irreversible conflict needs human exception or stop.
@@ -55,9 +57,11 @@ Wright applies anti-slop; root verifies returns and never patches source.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`/`3` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. AFK charges after integrate only.
-Running lease blocks another `$rite-build`. Details: `parallel-batch.md`.
+Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
+All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
+gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
+vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+`$rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply
 

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -3,7 +3,7 @@
 One wright dispatch builds one thin, proven slice. HITL stops; only explicit
 `.devrites/AFK` lets the controlling root chain another pending slice under the
 green-proof, cap, and pause rules. Each wright returns after exactly one slice.
-Opt-in fan-out: [`parallel-batch.md`](parallel-batch.md) (`--parallel N`); this is default.
+This serial cycle is the default `$rite-build`. Opt-in fan-out: [`parallel-batch.md`](parallel-batch.md) (`--parallel N`).
 
 ## The cycle
 
@@ -38,8 +38,11 @@ you check yourself against: anything outside it is scope creep or a drift event.
 
 ## When the slice can't be completed cleanly
 
-- Discovered the plan is wrong → **Spec Drift Guard** (stop, record, classify, maybe
-  ask, `$rite-plan` repair).
-- Slice is bigger than one cycle → stop and `$rite-plan reslice`.
-- Blocked on a failing dependency → record in `state.md`, `$rite-plan unblock`.
+- Discovered the plan is wrong → **Spec Drift Guard** (record, classify;
+  sweep every remaining contract assumption, then one folded repair+vet inline;
+  ask only for product/policy/irreversible-risk).
+- Slice is bigger than one cycle → `$rite-plan reslice` inline when AC is
+  preserved; do not emit a human Fix.
+- Blocked on a failing dependency → record in `state.md`, `$rite-plan unblock`
+  inline when the reroute is technical.
 Never power through by guessing.

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -7,12 +7,13 @@ Opt-in only. Default `$rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 | Input | Behavior |
 | --- | --- |
 | omitted / `--parallel 1` | Serial one-slice |
-| `--parallel N` (**2≤N≤3**) | Parallel when eligible + host pass |
-| non-integer / `N≤0` / `N>3` | Hard refuse (no silent clamp) |
+| `--parallel N` (**2≤N≤10**) | Parallel when eligible + host pass |
+| non-integer / `N≤0` / `N>10` | Hard refuse (no silent clamp) |
 
 AFK caps `N` by remaining budget. Charge **only after successful integrate**
-(once per integrated green sibling). Abort / integrate-failed → **0**. Running
-lease blocks another `$rite-build`.
+(once per integrated green sibling). Abort / integrate-failed → **0**. A
+`running` lease blocks another `$rite-build`. Any present lease blocks
+`parallel create` until cleanup.
 
 ## Path-disjoint
 
@@ -40,14 +41,20 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 
 1. Orient/gate; parse N; select ≤N path-disjoint pending slices.
 2. Write lease; freeze `B=HEAD`; `parallel create` worktrees.
-3. Dispatch ≤3 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
-4. Inspect + fail-on-red → `green|red|gap`.
+3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
+4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
+   even when targeted tests are green.
 5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
 6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
    path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
 7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
    per integrated sibling; optional `check candidate`.
-8. Cleanup: success removes worktrees/branches; abort keeps until acknowledged.
+8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
+   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
+   follow [`spec-drift-guard.md`](spec-drift-guard.md) — batch-sweep all
+   siblings' contract assumptions, one folded `$rite-plan repair` + one
+   `$rite-vet` recheck inline, then cleanup and resume Build. Do not emit
+   `Fix: $rite-plan repair`. Product/policy/irreversible-risk still stops.
 
 ## Engine verbs
 

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -3,6 +3,7 @@
 See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
 [`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
 Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
+Spec Drift Guard still applies on abort or plan-gap.
 
 1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
    slice artifacts. Require `Implementation readiness: READY`, its current

package/pack/generated/codex/skills/rite-build/reference/spec-drift-guard.md

@@ -24,13 +24,31 @@ other phases reference it here.
      YES, active-slice technical/tool failure → log it and use Build's bounded debug
        recovery. Do not ask for retry authorization and do not re-plan unless the
        durable remaining-work instructions are wrong.
-     YES, durable plan is wrong → log it, save the caller's return cursor, then
-       invoke `$rite-plan repair` and `$rite-vet` inline without a question and resume.
+     YES, durable plan is wrong → run the batch sweep below, log every
+       violation, save the caller's return cursor, then invoke `$rite-plan repair` and `$rite-vet` inline
+       without a question — ONE folded repair for all open entries, ONE
+       recheck for every open fingerprint — and resume.
      NO, product/policy/irreversible-risk decision → ask the user (format below).
 5. Never continue on a known-wrong durable plan. A repaired active-slice implementation
    may continue only after bounded recovery, returned-diff review, and proof gates pass.
 ```
 
+## Batch sweep (before repair)
+
+A durable-plan drift abort never repairs the first gap alone:
+
+1. Verify every remaining statically-checkable contract assumption against the
+   live repo — named paths, symbols/APIs/signatures, routes, commands, dependency
+   versions, contract artifacts. The wright's return names what it falsified;
+   check the rest yourself — existence checks are deterministic, no dispatch.
+2. Record each violation as its own `drift.md` entry/fingerprint; one folded
+   repair + one batched recheck resolves the set.
+3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
+   internally, never hand an intermediate command to the human.
+4. Nothing skips or defers silently: every entry ends resolved, human-escalated,
+   or fingerprint-exhausted. Execution-only gaps (tests, UX, evidence) get the
+   identical path when they surface.
+
 ## User question format
 ```
 I hit spec drift:
@@ -50,7 +68,8 @@ human permission question. Re-plan only when the durable plan changed.
 
 ## Inline return contract
 
-The phase that detected agent-owned drift owns the whole backtrack. Preserve it
+The phase that detected agent-owned drift owns the whole backtrack, batch sweep
+included. Preserve it
 as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
 boundaries internally; follow any vetted remediation required by the settled
 acceptance; then restore the cursor and resume the failed step. Do not hand an

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -36,7 +36,7 @@ Conflict, extra/missing commit, moved base, or cleanup failure is `gap`/STOP:
 preserve the worktree and commit. Without explicit reconciliation, use same-worktree serial.
 Parallel isolated-writer worktrees remain forbidden until this serial pilot measures
 transfer, conflict, proof, and review outcomes on both hosts; opt-in `$rite-build --parallel N`
-(2≤N≤3) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
+(2≤N≤10) path-disjoint fan-out is the only sanctioned parallel mode. Same-worktree multi-writer / root-emulated
 worktrees stay forbidden.
 
 ## Prepare
@@ -83,4 +83,7 @@ Opt-in `$rite-build --parallel N` fans out only under [`parallel-batch.md`](para
    attempts is the limit; persist each and never dispatch a fourth related try.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
-   relevant facts in canonical artifacts, not the wholesale report.
+   relevant facts in canonical artifacts, not the wholesale report. A plan-gap
+   escalation without the checked-assumption list (verified|falsified) is
+   malformed; root sweeps the unchecked remainder per
+   [`spec-drift-guard.md`](spec-drift-guard.md) before repair.

package/pack/generated/codex/skills/rite-plan/SKILL.md

@@ -79,6 +79,9 @@ Before classifying any Reslice, read `.agents/skills/devrites-lib/reference/stan
    require the drafter to apply `one-shot-actions.md` and return the bounded
    diagnostic-amplification design, injective boundary map, per-seam fixtures, and
    collision mutant. Past evidence loss is not terminal. The drafter supplies no bodies.
+   A repair candidate carries a delta self-check: touched invariants re-verified
+   (acyclic deps, bidirectional traceability, shared contract proof, sizing), no
+   correction-created regression.
    Bind exact active `.devrites/work/<slug>/` targets and executable contract; after Vet READY, root
    materializes the exact vetted workflow-artifact paths under
    [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
@@ -115,8 +118,9 @@ Before classifying any Reslice, read `.agents/skills/devrites-lib/reference/stan
    material assumption, or open blocking/escalating question routes `$rite-clarify`/HITL.
    Restore `CLEAR` only from current evidence.
 7. **Done when:** every slice is sized (builds + proves in one cycle; no slice scoring >3
-   left unjustified), the dependency order is acyclic, every `drift.md` entry you stopped for
-   is marked resolved, revised artifacts agree with each other, no source files changed in
+   left unjustified), the dependency order is acyclic, every open `drift.md` entry
+   was folded in one pass and marked resolved, the delta self-check is recorded,
+   revised artifacts agree with each other, no source files changed in
    `revise` mode, the marked action is complete, and every changed
    plan ends at `$rite-vet` rather than returning directly to build; horizon IDs stay stable,
    reclassifications cite evidence, and no unresolved item vanished. The `Shared contract proof`
@@ -128,5 +132,13 @@ to that caller so it can invoke Vet immediately. The phase boundary is not a
 user-facing stop unless a genuine HITL, safety/access, or exhausted-recovery
 condition was recorded.
 
+When invoked directly with no controlling caller and a planning artifact
+changed, become the caller for the mandated next step: record the return
+cursor, invoke `$rite-vet` inline, and consume its results — `NEEDS REPLAN`
+re-enters repair internally under the fingerprint caps; `NEEDS CLARIFICATION`
+and human-owned gates still reach the user. Stop only at Vet's boundary (READY
+readback; next step `$rite-build`). An unchanged plan keeps its recorded next
+step.
+
 > **Mid-flight discipline.** Do not change product behavior without confirmation or
 > absorb drift silently. See [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/codex/skills/rite-plan/reference/replan-and-repair.md

@@ -26,12 +26,19 @@ dependency edges.
 
 A drift event stopped the build. Steps:
 
-1. Read the `drift.md` entry and its classification.
+1. Read the `drift.md` entries and their classifications. Fold EVERY open entry
+   and accepted finding for the affected artifacts in ONE pass, never serially.
 2. If the user answered a drift question, encode that decision in `decisions.md`.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
-4. Mark the `drift.md` entry **resolved** with the resolution + date.
-5. Resume at the corrected slice.
+4. Mark each `drift.md` entry **resolved** with the resolution + date.
+5. **Self-check the repaired candidate on the delta before handoff** — re-verify
+   every invariant the correction touched (acyclic dependency graph,
+   bidirectional traceability, Shared contract proof vs boundary set, sizing,
+   no correction-created regression) and record the evidence in the Plan
+   checkpoint; Vet's recheck verifies it rather than rediscovering the defect a
+   loop later.
+6. Resume at the corrected slice.
 Never quietly delete a requirement; use the marked action before contract edits.
 
 ## reorder

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -52,10 +52,14 @@ plan declares a root-authored executable workflow file, read
 - Use the lowest axis band; never average or round thin to ready. Search before
   asking and resolve reversible technical choices. Ask only human-owned choices.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
-  internally to its caller, not to the human.
-- **Recovery recheck is bounded.** A valid cursor plus open fingerprint enters
-  Recovery recheck; it does not start another Full Vet or repeat unaffected
-  axes/reviewers.
+  internally to its caller, not to the human; on a direct invocation there is
+  no caller, so Vet becomes it — record the cursor and invoke `$rite-plan`
+  repair inline under the same fingerprint caps.
+- **Recovery recheck is bounded and batched.** A valid cursor plus open
+  fingerprints enters Recovery recheck; it does not start another Full Vet or
+  repeat unaffected axes/reviewers. One dispatch covers every open fingerprint
+  of the fold — each checked individually — with a mandatory correction-created
+  regression audit.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"plan declares root-authored executable workflow file","action":"emit exact admission; stale/missing authority uses PLAN_VET_REPAIR","return":"Vet READY cursor or exact technical replan"} -->
 ## Workflow
 
@@ -73,10 +77,13 @@ plan declares a root-authored executable workflow file, read
    required account blocks.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
-   paths/criteria, and affected drift/evidence. Freeze that packet and dispatch
-   each exact owning reviewer once, fresh/read-only, limited to it. Do not rerun
-   broad inventory or unaffected reviewers. Close the prior fingerprint only
-   with discriminating evidence. Otherwise record one no-progress outcome. A
+   paths/criteria, affected drift/evidence, and the recorded delta self-check.
+   Freeze that packet and dispatch each exact owning reviewer once,
+   fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Do not rerun broad inventory or unaffected reviewers. Close the prior
+   fingerprint only with discriminating evidence plus an explicit
+   correction-created regression verdict on the touched invariants (acyclic
+   deps, traceability, contract proof, sizing). Otherwise record one no-progress outcome. A
    different Critical/Important invariant needs exact evidence and a new
    fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reconcile
    shared artifact/readiness gates and return to caller or next repair.
@@ -119,11 +126,13 @@ plan declares a root-authored executable workflow file, read
    criterion needs positive, discriminating proof; every slice must be one-pass
    implementable; developer plans need a predicted scorecard. Durable commands
    are portable repository commands, not host wrappers.
-7. **Narrow recheck after edits.** Dispatch exact plan reviewer once per
-   correction/fingerprint (`per correction/fingerprint`) with accepted findings,
-   changed paths/criteria, and new
-   identity. Within one correction, no broad third loop. If it changes plan,
-   fold again. A closed input plus a distinct Critical/Important invariant returns
+7. **Narrow recheck after edits.** Dispatch the exact plan reviewer once per
+   fold — one dispatch covering every open fingerprint, preserving
+   per correction/fingerprint accounting (each checked individually with its
+   accepted findings, changed paths/criteria, new identity, and recorded delta
+   self-check); it must return an explicit correction-created regression
+   verdict, not only fingerprint closure. Within one correction, no broad
+   third loop. If it changes plan, fold again. A closed input plus a distinct Critical/Important invariant returns
    that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
 8. **Build readback and readiness.** Add a cited five-line readback to
    `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/

package/pack/generated/omp/agents/devrites-slice-wright.md

@@ -138,6 +138,10 @@ return an `Escalation`** when:
   scoped exception or the approach must change. Report the principle and conflict
   in `Escalation`.
 
+A plan-gap or underspecification escalation populates `assumptions` with every
+contract assumption already checked (verified|falsified); the orchestrator's
+batch sweep covers only the unchecked remainder. Never a bare "plan is wrong".
+
 If an answer would change scope or acceptance, do **not** fold it into the slice.
 Return it in `Escalation` so the orchestrator can route it through the Spec Drift
 Guard (`/rite-plan repair`). Respect any AFK budget in the contract.
@@ -172,7 +176,7 @@ reuse: []
 conventions: []
 principles: []
 sources: []
-assumptions: []
+assumptions: [] # plan-gap escalation: every checked contract assumption, verified|falsified
 decisions_stood: [] # irreversible-risk items go to escalation
 dead_ends: []
 escalation: <none | gate + crisp question + proposed answer>