devrites 5.13.1 → 5.14.1

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -279,22 +279,15 @@ boundary owns any such request and requires explicit user approval.
 
 ## `state.md` `Awaiting human` block
 
-When a HITL gate fires, `/rite-build` writes:
-
-```markdown
-- Status: awaiting_human
-- Next step: /rite-resolve <qid> "<answer>"
-
-## Awaiting human
-- qid: <q-...>
-- gate: <gate>
-- question: <crisp text>
-- proposed: <agent's tentative answer>
-- raised_at: <iso>
-- blocking_slices: [<slice ids that cannot advance>]
-```
-
-`/rite-resolve` removes the block on success and flips `Status: running`.
+When a HITL gate fires, `/rite-build` sets cursor `status` to `awaiting_human` and
+`next_action` to `/rite-resolve <qid> "<answer>"`, then writes the `Awaiting human` table
+(`question_id`, `gate`, `blocking_slices`) owned by
+[`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
+The question text, `proposed` answer, and `raised_at` live in the `questions.md` entry.
+Legacy `- Status:`/`- Next step:`/`- qid:` bullet keys are engine-accepted aliases, not
+the authoring format.
+
+`/rite-resolve` removes the block on success and sets cursor `status` to `running`.
 
 ## The resume verb: `/rite-resolve`
 

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -67,6 +67,11 @@ terminal path after `add` — success, gap, stop, or launch failure — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
+expected write (engine max 240) and re-add before it lapses; before writing, also
+read `claim list --all` — a foreign `expired` claim on overlapping paths whose
+session is not proven terminal counts as held (stop and report). **Failing case:**
+session B's `claim check` passes at minute 35 over session A's still-running wright.
 
 ## Independence
 
@@ -85,26 +90,53 @@ Each required reviewer/analyst/auditor starts with exactly one:
 
 ```text
 Outcome: <findings | no-findings | gap>
-Finding: <severity> | <file:line or artifact section> | <observed quote/result> | <impact> | <minimum fix>
+Counts: <n per severity or kind used in the rows below>
+Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
   Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
   `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
+  A Critical/Important row carries `conf <n>` in its severity cell and writes impact
+  as `when <input/state/sequence> → <effect>`; missing either, root admits it as
+  `Unverified: <claim> — missing trigger` (stays `gap`).
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
   tool/reviewer failure; or another limit. Required gaps block.
 
 Root treats results as claims; verifies proposed Critical/Important blockers
-against candidate. Missing fields become
+against candidate, first anchoring each row's quote at its cited `file:line` on the
+frozen digest: exact → admit; found at exactly one other location → relocate,
+keeping both locations; not found or found at several → `Unverified: <claim> —
+anchor lost|ambiguous`, a gap that is never a finding or a dismissal. A leaf result
+produced by spawning a nested agent is `gap`, and each hidden child counts toward
+the concurrent pool and `max_agents`. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
 with evidence—never silently dropped/demoted. Null/timeout/failure/malformed
 output is `gap`, never `no-findings`. Conditional `Not-applicable` must name the
 inspected scope and why its trigger did not fire. **Failing case:** parent admits a
 wright "done" with no `git diff --name-only` ⊆ path-contract (allowlist) observation.
 
+### Return budget
+
+Every read-only leaf returns rows, not prose, so the root keeps its context for
+decisions and nothing is lost in a retelling. Exempt: `devrites-plan-drafter` (its
+return is the bundle the root writes) and the wright's change evidence.
+
+- Lead with the result line (`Outcome:` for reviewers, the role's own status line
+  otherwise), then `Counts:` with the number of rows per severity or kind.
+- No restated task, preamble, approach narrative or closing summary. An optional
+  `Notes:` block carries at most five lines that no row can hold.
+- Point, don't paste: cite `file:line` with at most one quoted line (160
+  characters); for a command, give the exact command, its exit code and the one
+  decisive output line. Never paste whole files, diffs, logs or test output.
+- Each row stands alone: a reader of that row alone can re-check it from its pointer.
+- The root records admitted rows verbatim, adds its own verification beside them, and
+  never rewrites, merges or summarizes a row; deduplication references rows by
+  position or ID instead of rewording them.
+
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records

package/pack/.claude/skills/devrites-lib/reference/standards/audit-coverage.md

@@ -52,7 +52,11 @@ After each hunting wave, a **coverage critic** — a fresh agent comparing the l
 with targeted source and entry-point evidence — looks for holes: unseeded surfaces,
 boundaries with no check class,
 units stuck `assigned`, `rejected` patterns suggesting a hunter fires blanks.
-Accepted discoveries become `planned` units. Reserve critic and verifier capacity
+Accepted discoveries become `planned` units. Coverage is `complete` only after a
+critic returns no accepted missing or reassigned unit and no unit is `planned`;
+otherwise the run is partial, and a wave or agent cap is never evidence of
+completeness. A reassigned unit gets a fresh owner; the old attempt's evidence stays
+attributed to it and is never merged into the new attempt. Reserve critic and verifier capacity
 **before** spending on hunters; a wave launched with no verification reserve hunts
 for findings nobody may claim.
 

package/pack/.claude/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -13,9 +13,20 @@ viewport set here.
   wrong route, blank render, unexpected login wall, inconsistent dimensions, or
   stale candidate is missing evidence. Recapture; until resolved, record
   `cannot_verify` and block visual approval. A convincing narrative cannot repair it.
-- Interactive slices capture each relevant canonical state and the canonical
-  viewport set. Omission needs a one-line `not-needed` reason; states must exist
-  in source — an unreachable state's capture proves nothing.
+- **Evidence matrix.** Layout-bearing states (default, long content, and every
+  role-applicable surface state from [`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md) § Focus & states) × every
+  canonical viewport; interaction states at ≥1 small and ≥1 large viewport (hover
+  only with a hover-capable pointer); one keyboard traversal; a `reduce` capture when
+  motion changed; every shipped theme. Each cell holds a capture, `cannot_verify`, or
+  `not-needed (<reason>)`; an empty cell is `cannot_verify`. States must exist in source
+  — an unreachable state's capture proves nothing.
+- A capture counts only with fonts loaded, animations settled, the real route (a harness
+  or story capture is labelled and never fills a route cell) and matching candidate
+  identity. Hover, touch, iOS zoom or safe-area behaviour seen only in emulation is
+  `unverified (device)`, never a pass.
+- A finding closes only with a capture of the same route, state and viewport class on the
+  corrected candidate; a failed or incomplete capture run never counts as gone.
+  **Failing case:** a 320 px overflow closed by a clean 1440 px screenshot.
 - Browser-default chrome is judged by § Browser chrome; reflow, zoom and bounded
   two-dimensional exceptions by § Responsive. Compare to `design-brief.md` → Visual Verdict.
 - Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record

package/pack/.claude/skills/devrites-lib/reference/standards/code-navigation.md

@@ -11,7 +11,7 @@ Review.
 | Question | First tool | Fallback |
 | --- | --- | --- |
 | Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
-| Callers, callees, data flow across files | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
+| Callers, callees, call paths across files (value/taint flow: [`tooling.md`](tooling.md) route table) | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
 | PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
 | Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
 | Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
@@ -29,7 +29,13 @@ Review.
 3. After edits: LSP diagnostics + project tests. Compiler errors are the oracle
    for callers the graph listed — fix them in dependency order, direct
    dependents first. Errors absent from the list mean the list was incomplete
-   (see blind spots below); record the gap.
+   (see blind spots below); record the gap. Diagnostics count only when bound to the
+   current bytes: the server received the post-edit sync or save, the project is loaded
+   and ready, and the file is within its size limits. A `0` from a cold, not-ready, or
+   oversized server, a pre-edit result, or a timed-out probe is `stale` (or `unavailable:
+   <reason>` when none ran), never clean; fall back to the project typecheck/compile command. **Failing case:**
+   the language server returns 0 diagnostics before the project finishes compiling and
+   the slice records "diagnostics clean".
 
 Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
 `cannot_verify`.

package/pack/.claude/skills/devrites-lib/reference/standards/code-review.md

@@ -81,10 +81,9 @@ If it does not, do not merge it.
   never approval or silent demotion.
 - **Skipped checks are recorded.** A check you couldn't run gets a
   `Skipped: <check> — <why>` line.
-- **Unreviewed is not clean.** A report that never names an area does not prove that area
-  was inspected; the consolidated account names what was not covered or marks `gap`.
-  **Failing case:** a findings list silent on, say, migration safety is not a clean
-  migration review — name the inspection or the gap.
+- **Unreviewed is not clean** ([core.md § Gate contract](core.md#gate-contract)): an area
+  the report never names counts as uninspected — name the inspection or mark `gap`
+  (silence on migration safety is not a clean migration review).
 - **Separate the verdict from its context.** A verdict flips only on evidence
   scoped to the change under review — its diffs, its acceptance criteria, its
   blast radius. Whole-repo signals gathered along the way (a global health
@@ -124,6 +123,14 @@ grounds, each citing evidence:
    pre-existing code the diff did not touch. Route it as a follow-up, never
    delete the record.
 
+A dispute that turns on runtime, configuration, ordering, or environment (race,
+retry, config default, framework behavior) is decided only by a discriminating
+reproduction naming trigger and result: an approved command, or a wright-authored
+regression test. A green general suite, an assumed framework guarantee, or how many
+reviewers agree never decides it; without the reproduction the conflict stays an
+open blocker. **Failing case:** one reviewer flags a race, another calls it fine,
+and root dismisses it after reading the handler.
+
 "Cannot verify", "suspicious", "would not have raised it", and "inconvenient to
 fix now" are not grounds for removal — the finding stays open.
 

package/pack/.claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -55,7 +55,12 @@ the `gates.md` reduction with unmet/stale ids, `decisions.md` dead ends, and the
 canonical read-next order). Open the artifacts `read_next` names; resume from
 the record, not from transcript memory. Then `devrites-engine check
 regression <slug>`: `BLOCKED` names a durable fact lost since the last
-checkpoint; `unproven` does not block.
+checkpoint; `unproven` does not block. Before any re-dispatch, run
+`devrites-engine dispatch <slug> status`, `devrites-engine parallel status --root <repo>
+--slug <slug>`, and `devrites-engine claim list --all`, and reconcile open waves, leases, and
+claims per [`parallel-dispatch.md`](../parallel-dispatch.md#cancellation-and-terminal-reconciliation) § Cancellation.
+**Failing case:** after compaction the root re-dispatches a review cohort whose original
+children still run, and duplicate accounts arrive.
 
 ## Authority and trust
 
@@ -81,16 +86,22 @@ Apply [`core.md` § Precedence](core.md#precedence); authority and evidence diff
 **Default to `/clear`.** First persist missing decisions, assumptions, or questions
 to their owners (`/rite-handoff`); `/compact` preserves unrecorded continuity.
 
-## The "Session hygiene" footer (every rite-* output)
+## The hygiene footer
 
-Every `rite-*` skill ends its output with a one-line **Session hygiene** advisory, plus
-the **single command** that resumes work next session:
+Every `rite-*` reply names the **single command** that resumes work on its action line
+(`Next:`, or `Resume:`/`Fix:` in a stop shape; [`reply-contract.md`](../reply-contract.md))
+and ends with one advisory line after `Record:`:
 
 ```
-Session hygiene: /clear (recommended)   — <one-line why, anchored to what just got persisted>
-Resume next session with: <single command, e.g. /rite-build slice 2>
+↻ Hygiene: </clear | /compact | /rite-handoff> — <why, anchored to what just got persisted>
 ```
 
+A footer may name two of those moves under stated conditions ("/clear between slices;
+/rite-handoff if away").
+
+Besides `/clear`, `/compact`, or `/rite-handoff`, the footer names no command except the
+action-line command unchanged; a different resume command is a competing next action.
+
 This is advice, not a gate. The user can ignore it. It reports a trade-off the model
 cannot inspect directly because no API reports context fullness.
 

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -2,12 +2,20 @@
 
 > Applies when: always; every workspace rite reads it first.
 
-Each workspace rite reads core first; load phase files from `README.md` on demand.
+Each workspace rite reads core first. Its `loads:` manifest `always` set is its required
+read-set (`devrites-engine context <slug> --skill <name>` where a workspace exists, else
+read the listed files); a trigger's files load when its named condition holds. Load any
+other rule file from `README.md` on demand.
 
 Rules are cited as `core.md #N` (CORE-N). Numbering is stable: text may be
 reworded, an ID never changes meaning. Other files name the ID instead of
 repeating the rule.
 
+Uppercase MUST/MUST NOT/SHOULD/SHOULD NOT/MAY carry RFC 2119 meaning: MUST is a gate;
+a SHOULD deviation records its reason in `decisions.md` (the exception procedure); MAY
+permits. Lowercase "must"/"never" inside a rule, gate, or failing case binds exactly
+as MUST; case never creates a weaker tier. An exception never weakens a core gate.
+
 Repository conventions follow [Precedence](#precedence).
 
 ## Operating rules (every phase)
@@ -143,9 +151,11 @@ Before any `rite-*` skill stops:
   tried, why it failed, what it rules out). Compaction and the next agent must not repeat an
   invalidated approach.
 - Next-action ambiguous? → resolve to one command in `state.md`.
-- HITL pause? → write the `Awaiting human` block to `state.md` and set
-  `Status: awaiting_human` before stopping; resume via `/rite-resolve <qid> "<answer>"`.
-  See [`afk-hitl.md`](afk-hitl.md) for the full AFK / HITL contract.
+- HITL pause? → before stopping, set cursor `status` to `awaiting_human` and write the
+  `Awaiting human` table in `state.md` per its owner,
+  [`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template;
+  resume via `/rite-resolve <qid> "<answer>"`. See [`afk-hitl.md`](afk-hitl.md) for the
+  full AFK / HITL contract.
 
 A skill that stops without doing this leaves the workspace incomplete.
 
@@ -153,9 +163,8 @@ A skill that stops without doing this leaves the workspace incomplete.
 
 Long contexts degrade reasoning quality. Act on context at **50-70% used, not 95%**.
 
-Compact utilities end with a one-line `↻ Hygiene:` advisory naming the right move
-(`/clear` vs `/compact`) and the single resume command; other rites name the single
-resume command in their stop output. Full phase-by-phase guidance:
+Every rite names the single resume command on its action line; a `↻ Hygiene:` footer
+advises `/clear`, `/compact`, or `/rite-handoff` and never a competing command. Full phase-by-phase guidance:
 [`context-hygiene.md`](context-hygiene.md).
 
 ## Precedence

package/pack/.claude/skills/devrites-lib/reference/standards/definition-of-done.md

@@ -11,7 +11,7 @@ re-judge from this table alone.
 | Required | Owner | Failing case |
 | --- | --- | --- |
 | Each AC names a stored evidence path (command or artifact) | [`testing.md`](testing.md), `rite-prove` | An AC is checked off with no path in `evidence.md` |
-| Every explicit request maps to an artifact, test, or observed command | `rite-prove`, `rite-seal` | Numbered asks counted done by proxy — green suite, manifest presence, effort spent — with no per-requirement evidence map |
+| Every explicit request (each `brief.md` `## Asks` row) maps to an artifact, test, or observed command | `rite-prove`, `rite-seal` | Numbered asks counted done by proxy — green suite, manifest presence, effort spent — with no per-requirement evidence map |
 | Runnable required checks ran to a recorded outcome | [`test-proof-checklist.md`](test-proof-checklist.md), [`debug-recovery.md`](debug-recovery.md) | A failed, timed-out, or unstartable check reported as "unrelated"/omitted instead of a named blocker |
 | Discriminating tests for changed behavior | [`testing.md`](testing.md) | Suite green; revert of the change would still be green |
 | Fresh runtime/build/test/browser records | `rite-prove`, [`browser-proof-checklist.md`](browser-proof-checklist.md) | Proof claimed from stale or unrun commands |

package/pack/.claude/skills/devrites-lib/reference/standards/developer-experience.md

@@ -72,7 +72,9 @@ touches:
   silent exit, or "an error occurred" is a defect on a developer-facing path.
 - **Ergonomics & consistency:** does the surface match the project's existing conventions
   (naming, argument order, pagination, error shape)? An inconsistent new endpoint taxes everyone
-  who learned the old ones. Sensible defaults; the common case is one call.
+  who learned the old ones. Sensible defaults; the common case is one call. CLI output
+  honours `NO_COLOR` and non-TTY destinations (no ANSI or spinners in a pipe) and never
+  carries meaning by colour alone; a status only colour conveys is a finding.
 - **Docs accuracy:** examples are copy-pasteable and correct, the signature in the docs matches
   the code, and changed behavior updated its docs in the same change ([`documentation.md`](documentation.md)).
 

package/pack/.claude/skills/devrites-lib/reference/standards/duplicate-code.md

@@ -82,6 +82,13 @@ Ranking boosts distant matches across directories or far apart within one file.
 Distance is a triage hint, not proof that two contracts are interchangeable.
 Check whether fixes to one copy should also apply to the other.
 
+A `merge` verdict (cluster or reimplemented-elsewhere twin) states the compared contract
+(inputs, outputs, errors, side effects, ordering), each unit's callers, and the tests
+protecting each copy. Any contract difference is `keep` or `watch`, not merge. When the
+survivor's tests miss the removed copy's callers, the finding adds a characterize-first
+step. A merge without the comparison is admitted only as an FYI lead. **Failing case:** two
+parsers score 0.9; one errors on empty input, the other returns a default; "merge" is wrong.
+
 ## Ignore ledger
 
 `.devrites/dup-ignore` (project-root default; `--ignore-file` overrides) holds
@@ -100,6 +107,10 @@ blind the scan.
 Rules:
 
 - Never add a hash without reading both units — an unread dismissal is a gap.
+- Judge member pairs, not the cluster: a hash is ignored only when every pair is `keep` and
+  one line explains it. A mixed or uncertain cluster gets a finding or `watch`, never an
+  ignore line, whatever the report volume. **Failing case:** A~B is a real copy, B~C is
+  coincidental, and the A~B~C hash lands in the ledger.
 - Write the reason on the same line after `#`; a bare hash is an unexplained
   dismissal and counts as a skipped check.
 - Do not commit-ignore clusters introduced by the *current* diff — a `*` unit

package/pack/.claude/skills/devrites-lib/reference/standards/gates.md

@@ -52,6 +52,14 @@ Execution contract: the command runs through the platform shell in the named
 directory with a bounded timeout; pass requires exit 0 **and** output matching
 EXPECT. Output is captured but never persisted — only its digest.
 
+After Vet READY the runnable set is fixed: converting a runnable gate to manual,
+loosening EXPECT, changing CHECK or CWD, or removing a row is Plan repair plus
+re-Vet, never a Prove or Seal edit. A runnable gate that cannot execute stays unmet
+with `unavailable: <reason>`. Prove attests only gates that were manual at Vet,
+checked by diffing `gates.md` against the Vet record. **Failing case:** AC-003's
+runnable gate fails at Prove, the root deletes CHECK/EXPECT and attests "verified
+manually", and `gates status` reads `all-met`.
+
 ## Evidence binding
 
 A successful run writes `EVIDENCE: automatic-evidence=v1; def=<sha256>; …`
@@ -62,7 +70,14 @@ only automatic evidence bound to the current definition counts.
 
 Manual gates are met when checked with non-empty human evidence (anything
 except `pending`); honesty of that evidence stays with the Prove/Seal
-reviewers.
+reviewers. The engine cannot see who attests, so the note must cite the human's
+own words or source (a `q-…` id the human resolved, or their message in this
+session) and name what was observed and where. An agent's own inspection, or a
+question resolved by AFK or autocomplete auto-pick, is not human evidence: an AFK
+run leaves the gate unmet behind an open `gate: validating` question and never
+self-attests. Placeholder or tautological notes (`n/a`, `tbd`, `-`, `ok`, `done`,
+`yes`, the restated gate title) are unmet at Prove and Seal. **Failing case:**
+`gates attest <slug> AC-004 "done"` passes the engine and Seal reaches GO.
 
 ## Commands
 

package/pack/.claude/skills/devrites-lib/reference/standards/performance.md

@@ -29,6 +29,17 @@ by source (`Field (CrUX)`, `Lab (Lighthouse)`, `Trace (DevTools)`): field and la
 interchangeable, and static source cannot measure a CWV. The reviewer captures these via the
 browser-proof ladder when a budget exists, then judges them in Measured mode (a
 source-labeled scorecard); with no artifact it runs in Source mode and names the command.
+
+- **Field status is never a pre-release pass.** Missing field data is `unavailable`;
+  origin-level data is not proof for a route; the field window lags a new deploy. The
+  pre-release gate is a lab/trace budget under stated conditions, and the field row
+  reads `pending (field)` until route-level data covers the release. **Failing case:**
+  seal cites origin "good" field data for a route shipped yesterday, or a localhost
+  audit records "field: pass".
+- **INP needs an interaction:** a named scripted interaction (timespan or trace) or
+  field data. A navigation-only lab run records INP `not measured (no interaction)`;
+  TBT may appear only as a labeled proxy.
+
 Baseline checks + measurement commands:
 [`rite-review/reference/performance-checklist.md`](../../../rite-review/reference/performance-checklist.md).
 

package/pack/.claude/skills/devrites-lib/reference/standards/prose-style.md

@@ -31,7 +31,8 @@ A rewrite succeeds only when the source still supports every sentence and the re
 the same decisions from it.
 
 - Preserve every fact, constraint, uncertainty, identifier, count, criterion, evidence link,
-  decision, and voice-bearing detail. Restructure freely; keep the information.
+  decision, ranking, order or causality claim, and voice-bearing detail. Restructure freely;
+  keep the information.
 - Keep quotations, titles, proper names, code spans/fences, CLI output, error strings, and text
   discussed as an example exact unless the user asks to edit that material.
 - Keep YAML frontmatter, markdown tables, URLs, and file paths exact unless the user asked to
@@ -65,8 +66,8 @@ the same decisions from it.
 - **Be specific.** Replace "every / always / never / a lot" with the actual number, file, or
   case when you know it.
 - **Vary rhythm.** Don't stack three staccato fragments or three same-length sentences in a row.
-- **Skip em and en dashes** — a repeated AI tell (matches
-  [`rite-polish/reference/anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md));
+- **Skip em and en dashes** — a repeated AI tell in DevRites prose (product UI copy is
+  only a lead, per [`rite-polish/reference/anti-ai-slop.md`](../../../rite-polish/reference/anti-ai-slop.md));
   use a comma, period, colon, or parentheses instead.
 - **Trust the reader.** Skip the softening preamble and the recap of what you just said.
 

package/pack/.claude/skills/devrites-lib/reference/standards/review/README.md

@@ -5,7 +5,9 @@
 > second severity scale.
 
 Load `default.md` for every reviewed file, plus the file matching the file's
-language. A file with no listed language gets `default.md` only.
+language. A file with no listed language gets `default.md` plus a card from
+[`stack-profile.md`](stack-profile.md); `default.md` alone is a disclosed
+`default-only: <reason>` gap, never silent coverage.
 
 | File pattern | Checklist |
 |---|---|
@@ -13,8 +15,11 @@ language. A file with no listed language gets `default.md` only.
 | `*.go` | [`go.md`](go.md) |
 | `*.py` | [`python.md`](python.md) |
 | `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.mjs`, `*.cjs` | [`ts-js.md`](ts-js.md) |
+| `*.vue`, `*.svelte`, `*.astro` (script blocks) | [`ts-js.md`](ts-js.md) |
+| resolved manifest declares `react` (not the file extension) | [`react.md`](react.md) |
 | `*.sh`, `*.bash`, `*.zsh`, PKGBUILD, Dockerfile RUN blocks | [`shell.md`](shell.md) |
 | `.github/workflows/*.yml`, `.github/workflows/*.yaml`, `*.gitlab-ci.yml` | [`ci-workflows.md`](ci-workflows.md) |
+| a trigger in `stack-profile.md` fires: multi-runtime language, unlisted language, embedded region, two framework majors, cross-stack serialized boundary | [`stack-profile.md`](stack-profile.md) |
 
 Each checklist lists investigation probes, not automatic findings. Establish the
 applicable contract, reachable path, and concrete effect before reporting a defect.

package/pack/.claude/skills/devrites-lib/reference/standards/review/react.md

@@ -0,0 +1,55 @@
+# Review: React / Next.js
+
+> Applies when: the resolved manifest of the reviewed package declares `react`.
+> Load with [`default.md`](default.md) and [`ts-js.md`](ts-js.md). Vue, Svelte,
+> Angular, and vanilla code never load this file.
+
+Resolve each tag yourself from the package's resolved lockfile entry or installed
+package (a leaf never spawns `devrites-source-driven`; an open version question returns
+to the root as a gap). An unresolved predicate means the
+probe is skipped and listed in `Basis` as `predicate unresolved: <tag>`, never applied
+on a guess. Each probe is a lead: establish the contract, reachable path, and effect
+before reporting; a finding names its tag and how the version was resolved.
+
+Tags: `[any]` · `[react≥19]` · `[compiler on]` (optimizing compiler enabled in build
+config) · `[next app-router]` · `[next≥15.x]` (minor stated per probe; verify
+installed version). `(perf)` marks probes the performance reviewer also applies.
+
+## Defect probes
+
+- `[any]` **Derived state through an effect.** Props or state copied into state by
+  an effect render one frame stale and can desync. Proof: change the source; the
+  derived value is correct in the same render.
+- `[any]` **Action modelled as state + effect.** A submit or click stored as a flag
+  and executed by an effect repeats on remount or dependency change. Proof: remount
+  under strict mode; the side effect runs once.
+- `[any]` **Component type defined in render.** A component declared in another's
+  body remounts each render, dropping focus and state. Proof: type into a nested
+  input across a parent re-render; focus and value survive.
+- `[react≥19]` **setState after `await` in an async transition** with no sequence
+  guard: an earlier transition resolving late overwrites a newer one. Proof: the
+  deferred-promise ordering test of the stale-response probe in `ts-js.md`.
+- `[compiler on]` (perf) **Memo added or removed** without evidence: an addition
+  needs profiler evidence; a removal needs a test that effect run counts stay unchanged.
+- `[next app-router]` **`'use server'` exports are public entry points.** Each
+  authenticates, authorizes, and validates inside the action — judge under
+  [`security.md`](../security.md). Proof: call it with no session and as another user.
+- `[next app-router]` (perf) **Server→client props** carry unused or sensitive fields
+  into the serialized page payload.
+- `[next app-router]` **`ssr: false` inside a Server Component** fails the build
+  (verify installed version).
+- `[any]` **Mutable module-level request or user data** in a long-lived SSR process.
+  Proof: two overlapping requests as different users show no cross-contamination.
+- `[next≥15.1]` **`after()` used for invalidation or a must-not-lose write**: it runs
+  after the response is sent and may run for failed responses (verify installed version).
+- `[any]` **`suppressHydrationWarning` on a non-leaf node** hides real mismatches; a
+  pre-hydration inline script without the page's CSP nonce.
+- `[any]` (perf) **Barrel imports** only when the bundler does not optimize them and a
+  bundle measurement shows the cost.
+
+## Do not flag
+
+- Missing `memo`/`useMemo`/`useCallback` without profiler evidence.
+- `useContext` where `use()` exists; `forwardRef` on React 18 (still required there).
+- Migration to a newer API with no behavior change.
+- A probe whose predicate is unresolved: list it in `Basis`, do not report it.