devrites 5.13.1 → 5.14.1

package/pack/generated/devin/skills/devrites-frontend-craft/reference/quality-standards.md

@@ -19,10 +19,11 @@ these are the floor, not the ceiling.
   visible** with ≥ **3:1** contrast against its background (never remove the outline
   without an equal replacement).
 - **Contrast**: text ≥ **4.5:1** (≥ 3:1 for large text and UI/graphics).
-- **Target size**: ≥ **24×24** CSS px (WCAG 2.2 AA, SC 2.5.8); prefer **44×44** for primary
-  touch targets.
+- **Target size**: ≥ **24×24** CSS px (WCAG 2.2 AA, SC 2.5.8, including its spacing exception) is the conformance floor; **44×44** for primary touch targets is a DS preference, so a spaced 28 px secondary icon button is not an a11y defect.
 - **No drag-only** interactions: provide a single-pointer alternative (SC 2.5.7).
-- Labels/names on all controls; errors announced; respects `prefers-reduced-motion`.
+- Labels/names on all controls; errors identified in text (SC 3.3.1) and status messages announced without moving focus (SC 4.1.3); respects `prefers-reduced-motion` (a platform requirement: SC 2.3.3 is AAA; § Motion below).
+- **Also observe:** a text-spacing override loses no content (SC 1.4.12); hover/focus content is dismissible, hoverable and persistent (SC 1.4.13); a focused element is never fully hidden by sticky or fixed UI (SC 2.4.11).
+- An A11Y finding names the SC, the observed failure and its evidence kind (`static`, `automated`, `manual`, `AT`); without an SC it is a heuristic lead, not a conformance failure. **Failing case:** "improve form accessibility" filed Important with no SC, or a sticky cookie bar hides the focused link and review passes.
 - **Test** with keyboard, a screen reader, and an automated checker (e.g. axe): early.
 
 ## Motion
@@ -57,8 +58,7 @@ website by section 7") is a tell: **one declared color strategy and role budget*
 
 ## Numerical bar (enforceable specifics)
 
-These are the hard numbers that move "good UI" from opinion to checkable.
-Project tokens win when stricter; these are the floor.
+These are the hard numbers that move "good UI" from opinion to checkable. Project tokens win when stricter. Contrast, target size, focus and reflow numbers are A11Y floors; the rest are DS build defaults. A review finding against a DS default needs the mismatch evidence of the [admission rule](../../rite-polish/reference/anti-ai-slop.md).
 
 ### Color
 - **OKLCH-only** for new tokens: perceptually uniform, predictable lightness
@@ -165,15 +165,14 @@ Corollaries (same shape as colour commitment):
 - **Exit at ~75 % of enter.** A 300 ms enter pairs with a 225 ms exit.
 - **Bounce / elastic easing banned** unless the project's design system
   explicitly uses it.
-- Honor `prefers-reduced-motion`: reduce or remove non-essential motion
-  entirely. Reduced means fewer and gentler, never zero feedback.
+- Honor `prefers-reduced-motion`: reduce or remove non-essential motion entirely. Reduced means fewer and gentler, never zero feedback: under emulated `reduce`, content reaches its final visible state and loading, progress and focus stay perceivable. Escalate a missing reduced path to Important only for vestibular-scale motion (parallax, zoom, large translation).
+- **Regardless of preference:** auto-moving or auto-updating content lasting over 5 s can be paused, stopped or hidden (SC 2.2.2); nothing flashes more than 3 times per second (SC 2.3.1); motion never gates input (focus moves and the first key or click lands during an enter animation); re-triggered motion retargets from its current state instead of restarting; zoom is never disabled (`user-scalable=no`, `maximum-scale=1`; SC 1.4.4). **Failing case:** an `opacity: 0` entrance with no reduced branch stays invisible under `reduce`, or a 7 s autoplay banner without pause passes because no preference was set.
 - **Loading feedback appears by ~200 ms**: skeletons/spinners replace stillness
   after that threshold; below it, feedback flicker reads as jank. Hover intents
   may delay 150–300 ms; focus indication never fades in — the ring is instant.
 
 ### Forms
-- Inputs match button height (44 px floor); visual targets under 24 px expand
-  their hit area with a pseudo-element to the 44 px minimum.
+- Inputs match button height (DS: 44 px for primary touch); a visual target under 24×24 CSS px expands its hit area (pseudo-element) to 24 px or meets SC 2.5.8's spacing exception (§ Accessibility).
 - Helper/error text reserves **`min-height: 1lh`** so messages never shift layout.
 - Border width is pinned across states (state changes recolor, never resize).
 - Disabled is visible through **three channels**: muted color, `not-allowed`
@@ -192,25 +191,16 @@ three axes from light:
 If the project has dark tokens already, follow them. If not and dark is in
 scope, propose the compensation rather than ship a flat invert.
 
-### Focus & states (8 required, 3 conditional)
-Every interactive element ships **8 visual/interaction states**:
-`default`, `hover`, `active`, `focus-visible`, `disabled`, `loading`,
-`selected`, and an error/invalid surface (required wherever the element can be invalid). Data surfaces add the
-conditional three whenever the data can produce them: **partial** (a missing field
-renders an explicit em-dash/placeholder — never `null` or `0`), **conflict** (a
-concurrent-edit/version-mismatch surface), and **offline/unreachable** (stale-data
-banner with retry, not a silently cached render). **Failing case:** a row with a
-missing value renders `0` or blank and the review reads it as real data.
+### Focus & states (role lattice)
+Every state a role makes applicable is required; applicability comes from the role, not a fixed count.
+- **Control states:** `default`, `active`, `focus-visible`; `hover` for hover-capable pointers; `disabled` where the control can be disabled; `loading` for async actions; `selected` for selectable controls; `invalid` wherever input can be invalid.
+- **Surface states** (a view that loads, lists or edits data): loading (initial vs subsequent), empty (first-run with a next action vs filtered with a way back), error with recovery, **partial** (a missing value renders the project placeholder with an accessible "not available" name, never `null`, `0` or blank), **stale/offline** (banner with retry, not a silently cached render), permission-denied (401 asks to sign in; 403 explains access and never renders as empty), pending/submitting (no double submit), success, and **conflict** (concurrent edit / version mismatch).
+- Mark each state per surface `present`, `partial`, `missing`, `not-needed (<reason>)` or `unknown` (not observed); never a bare count. `not-needed` without a reason is `missing`. **Failing cases:** a row with a missing value renders `0` or blank and the review reads it as real data; a 403 list shows "No invoices yet" and review says states covered; a static nav link is charged a missing `loading` state.
 - `:focus-visible` ring: **2 - 3 px**, **≥ 3:1** contrast against the
   background, **offset 2 px** so the focus is unambiguous on dense layouts.
 
 ### Browser chrome
-User-agent defaults are unfinished craft. Per UI slice, theme or explicitly
-decline (briefed) each of: `::selection` (token colors, not UA blue),
-`caret-color` on editable fields, scrollbar styling or a recorded
-`scrollbar-width` decision, and the project focus-ring token in place of the
-unstyled UA outline. **Failing case:** layout, type, and the 8+3 states pass
-while the UA blue focus ring and default selection remain.
+UA chrome is AES unless the DS defines it. Focus is judged by SC 2.4.7 and 1.4.11 on the actual background and by the DS focus-ring token where one is declared: a UA ring that passes both is not a finding. `::selection`, `caret-color` and scrollbars follow the DS when it defines them; task surfaces get no custom scrollbar the DS lacks. **Failing case:** a settings page with compliant UA focus rings is filed "unstyled UA chrome" Important.
 
 ### Container queries vs viewport queries
 - **Component breakpoints:** use **container queries** (`@container`). The
@@ -254,7 +244,7 @@ rung that carries the structure.
   ([`anti-ai-slop.md`](../../rite-polish/reference/anti-ai-slop.md)).
 
 ### NEVER (UI numerical bar)
-- Never reintroduce anything [`rite-polish` anti-ai-slop](../../rite-polish/reference/anti-ai-slop.md) bans.
+- Never reintroduce anything [`rite-polish` anti-ai-slop](../../rite-polish/reference/anti-ai-slop.md) bans (review findings follow its admission rule).
 - Never hard-code a spacing value the 4 pt scale or project tokens cover.
 - Never animate an exit at 100 % of enter duration (feels uncontrolled).
 - Never use raw `z-index` numbers outside the semantic scale.
@@ -269,25 +259,25 @@ rung that carries the structure.
 - [ ] Renders with **no console errors/warnings**
 - [ ] **Keyboard**: tab through reaches everything; focus visible; Esc/Enter behave
 - [ ] **Screen reader** conveys content + structure
-- [ ] **All states**: the canonical 8 + 3 lattice above (§ Focus & states), not a
-      shorter local list
+- [ ] **All states**: every applicable control and surface state of the role lattice (§ Focus & states) marked, none `missing`, `unknown` recorded `cannot_verify`; not a shorter local list
 - [ ] **Responsive** at the canonical viewport set (§ Responsive); no lost content or
       controls, no page overflow; bounded exceptions tested; zoom-safe
-- [ ] **No accessibility violations** (axe or equivalent)
-- [ ] Meets the **CWV budget** above (measure, don't assume)
+- [ ] **No accessibility violations** (axe or equivalent, WCAG 2.2 tags enabled for a 2.2 AA claim); every `incomplete` result resolved as a manual row, `inapplicable` read as not exercised: zero violations alone never ticks this
+- [ ] Meets the **CWV budget** above (measure, don't assume; lab vs field status per [`performance.md`](../../devrites-lib/reference/standards/performance.md) § Frontend)
 - [ ] Aligned to the **design system** (tokens, components, type, spacing)
-- [ ] **Browser chrome** themed or declined in the brief (§ Browser chrome)
+- [ ] **Focus indicator** passes SC 2.4.7/1.4.11 (DS focus token where declared); no custom scrollbar the DS lacks (§ Browser chrome)
 - [ ] Clickables show `cursor: pointer` + a hover state; icons are SVG from the one set
       (no emoji); nothing trapped under fixed/sticky bars
 - [ ] **Consistency locks hold** (declared color strategy/roles / one radius scale / one theme) and the
-      mechanical pre-flight passes ([`anti-ai-slop.md`](../../rite-polish/reference/anti-ai-slop.md))
+      mechanical pre-flight's ENG/DS rows pass ([`anti-ai-slop.md`](../../rite-polish/reference/anti-ai-slop.md))
 
 ## Craft convergence bar
 
 Craft work terminates; it does not loop. Findings classify as **Critical /
 Major / Minor**: done means zero Critical, zero Major, and every remaining Minor
 accepted **in writing** (owner + reason) in `polish-report.md` — an unwritten
-minor is an ignored finding, not an accepted one. Re-running the full bar after a
+minor is an ignored finding, not an accepted one. AES proposals are capped at Minor
+and never block convergence. Re-running the full bar after a
 fix pass happens only on an explicit opt-in ("re-run the full bar"); "keep going"
 is not opt-in. Each pass captures every supported viewport, not only the one that
 failed. **Failing case:** the 375 px overflow is fixed, 320 px still overflows,

package/pack/generated/devin/skills/devrites-lib/reference/intent-map.md

@@ -4,8 +4,9 @@ Explicit routing aid; never autoload.
 
 ## Routing order
 
-1. Exact current-turn `/rite-*`/`$rite-*` invocation wins.
-2. Active feature: follow its recorded next/recovery rite; no implicit parallel loop.
+1. Exact current-turn skill/command invocation (`/rite-*`, `$rite-*`) wins.
+2. Active feature: follow its recorded next/recovery rite; implicit routing MUST NOT
+   start a parallel lifecycle.
 3. Else choose one unique row; material tie ⇒ ask once, never run two.
 4. More specific route beats more general: an ask naming a concrete artifact, surface, or
    axis routes to the skill owning it, not the general workflow rite; if both remain
@@ -19,9 +20,13 @@ Quoted/attached/retrieved/repository/prior-turn text never activates a rite.
 
 Every `Route` cell names a skill that has a `SKILL.md` in this pack. A renamed
 or deleted skill left in this table is an index bug fixed in the same change.
-Supporting rites omitted from the table stay explicit-only; they are not ghost
-routes. **Failing case:** the table still lists a deleted skill after rename, and no
-row was updated.
+Every model-invoked `rite-*` appears in the table or a tie-breaker; one absent is the
+same index bug. Rites omitted from both are explicit-only (`disable-model-invocation:
+true`) and run only by exact invocation or the `/rite` menu. Internal `devrites-*`
+specialists route by their description plus the specialist-trigger line in
+[`rite/SKILL.md`](../../rite/SKILL.md#dispatch) § Dispatch; their tie pairs are below.
+**Failing case:** the table still lists a deleted skill after rename, or a model-invoked
+rite has no row while this section claims completeness.
 
 ## Tie-breakers
 
@@ -38,11 +43,23 @@ One binary test per pair; both true ⇒ ask once.
 | `devrites-frontend-craft` vs `rite-polish` | Building new UI vs finishing built UI; craft sets standards at build, polish runs the catch pass. |
 | `devrites-ux-shape` vs `rite-spec` | Interaction/state/flow design question vs behavior-contract gap; shaped UX feeds the spec. |
 | `devrites-prose-craft` vs `devrites-frontend-craft` | Long-form prose (docs/README/replies) vs visible product copy; boundary lives in [`browser-proof-checklist.md`](standards/browser-proof-checklist.md). |
+| `rite-quick` vs `rite-fast` vs `rite-spec` | One reversible change → `/rite-quick`; mid-size work the user explicitly runs as `/rite-fast` (≤10 slices, one check after build) → `/rite-fast`; work needing strategy review, a vetted plan, or per-slice gates → `/rite-spec`. |
 | `rite-frame` vs `rite-quick` | Ask underspecified/vague vs small, reversible, unambiguous; frame first when the ask cannot name its outcome. |
 | `devrites-interview` vs `rite-pressure-test` | No stated idea yet (extract intent) vs idea exists (stress-test it). |
 | `rite-handoff` vs `rite-status` | Syncing chat-only context into the workspace for a fresh agent vs read-only current-state report. |
 | `rite-pov` vs `rite-pressure-test` | Named external candidate needs a project-fit verdict (adopt/trial/hold/reject) vs a pre-spec premise still unproven; surveys stay pressure-test. |
 | `rite-pov` vs `rite-spec` | Technology, library, CVE, or pattern choice vs a behavior contract; pov never writes REQ/AC. |
+| `rite-define` vs `rite-plan` | Does the active feature's `tasks.md` already hold slices? No → `/rite-define`, whatever verb the user used; yes + evidence the plan no longer fits (too-big slice, drift, order, blocker) → `/rite-plan`. |
+| `rite-converge` vs `rite-status` | Drift evidence exists (live code diverges from `tasks.md`/`spec.md`: adopt baseline, unrecorded tree changes per [`context-hygiene.md`](standards/context-hygiene.md#resume-reconciliation) § Resume reconciliation, or an explicit reconcile/append ask) → converge. None → a question such as "what's left?" gets a read-only answer from `state.md`/`tasks.md` plus the `/rite-status` pointer; a question never fires a writer or appends slices. |
+| `devrites-debug-recovery` vs `rite-doctor` | Whose artifact failed? Product test/build/CI/runtime → debug-recovery. DevRites binary/pack/hook/host config or an unparsable workspace schema → `/rite-doctor` (then `/rite-upgrade` for an older workspace). A DevRites gate verdict about the project (diff-scope, gate `FAIL`) is neither: return to the owning phase. |
+| `rite-temper` vs `rite-vet` | Subject is `spec.md` premise/scope/ambition vs a defined `plan.md`/`tasks.md` implementation; no plan yet → never vet. |
+| `rite-review` vs `devrites-audit` | Ask names exactly one axis (security/performance/simplification) and wants findings only → audit; unscoped or multi-axis pass on the polished candidate → review. |
+| `devrites-audit` (simplify) vs `rite-polish` | Does the ask want code changed now? No → audit reports read-only; yes → polish applies feature-scoped edits. |
+| `rite-prove` vs `devrites-browser-proof` | Must the feature's full acceptance set be proven for seal? Yes → prove (it invokes browser-proof for UI ACs); one page/interaction/CWV observation → browser-proof. |
+| `rite-pov` vs `devrites-source-driven` | Outcome is a project-fit verdict on a named candidate vs a verified fact about how an already-used library behaves. |
+| `devrites-interview` vs `rite-spec` | No feature can be named yet (extract intent) vs a named feature to specify; interview output feeds spec. |
+| `devrites-interview` vs `rite-frame` | Open-ended intent with no task vs one imperative task whose outcome or done check is unnamed. |
+| `rite-clarify` vs `devrites-interview` | Does a completed `spec.md` exist? Yes → clarify audits its decision surface (may reuse interview's one-question form); no → interview. |
 
 Wrong-skill fire: stop, admit it, switch rites.
 
@@ -53,8 +70,11 @@ Wrong-skill fire: stop, admit it, switch rites.
 | Derive intent from existing code without an active feature contract | `/rite-adopt` | Establish the brownfield contract. |
 | Reconcile implementation with an active feature contract | `/rite-converge` | Identify gaps and add missing slices. |
 | Older workspace cannot resume | `/rite-upgrade` | Audit cited current-contract defects; age alone is no defect. Route semantic repairs to normal owners; preserve history without synthetic proof. |
+| Turn an approved spec into its first plan | `/rite-define` | No `tasks.md` slices yet; writes architecture, slices, traceability. |
+| Reslice, reorder, or repair an existing plan | `/rite-plan` | Slices exist and evidence invalidates them. |
 | Review plan before code | `/rite-vet` | Every plan; depth scales to risk. |
 | Small safe fix | `/rite-quick` | Escalates auth, migration, public API, destructive, ambiguous, or multi-slice work. |
+| Mid-size work, fast lane (explicit only) | `/rite-fast` | Spec + plan + questions once, ≤10 slices, one completeness check, review, polish, proof; risk deepens questions. |
 | Prove UI/runtime | `/rite-prove` + `devrites-browser-proof` | Capture real evidence. |
 | Stuck/unfamiliar | `/rite-zoom-out` | Map before editing. |
 | Teach me | `/rite-explain` | Human learning loop. |
@@ -62,3 +82,5 @@ Wrong-skill fire: stop, admit it, switch rites.
 | Execute ship after GO | `/rite-ship` | Requires GO/type-GO. |
 | Unattended lifecycle | `/rite-autocomplete` | Clean baseline/checkpoints; hard gates stop. |
 | Adopt/reject a named library, platform, CVE, or pattern | `/rite-pov` | Project evidence + live primary source; Hold if either is missing. |
+| DevRites install, pack, hook, or host config broken | `/rite-doctor` | Read-only diagnostics; never application bugs. |
+| Check one PR's CI/review state | `/rite-watch-pr` | Observe once; never mutates code, Git, threads, or checks. |

package/pack/generated/devin/skills/devrites-lib/reference/orchestration-profiles.md

@@ -39,8 +39,7 @@ evidence binding.
 
 A child result is a claim. Admit it only against observations (`git diff
 --name-only`, recorded commands, artifact existence) — never against the
-child's prose. **Failing case:** a wright reports "done" and the parent
-advances without comparing touched paths to the path contract.
+child's prose ([agents.md § Result admission](standards/agents.md#result-admission)).
 
 The complete 17-role catalog and source-writing boundary live in
 [`standards/agents.md`](standards/agents.md). Review-specific applicability

package/pack/generated/devin/skills/devrites-lib/reference/parallel-dispatch.md

@@ -57,15 +57,21 @@ If the candidate diff has no matching surfaces, record
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
 5. Every dispatch reaches a terminal classification before reconciliation:
-   `Outcome: findings`, `Outcome: no-findings`, `Outcome: gap`, or
-   `unavailable: <reason>` when the step could not run at all. Reconciling over a
-   partial roster is forbidden; an unavailable conditional step is recorded with its
-   marker in `review.md`/`seal.md` — an omitted sub-step reads as a clean run.
+   `Outcome: findings`, `Outcome: no-findings`, `Outcome: gap`, or — for a
+   conditional step that could not run at all — its NOT-RUN marker recorded in
+   `review.md`/`seal.md` per [core.md § Gate contract](standards/core.md#gate-contract);
+   an unavailable required role stops for HITL. Reconciling over a partial roster
+   is forbidden. Admit one account per role label per candidate: only the return
+   bound to the sealed wave's handle counts; a double delivery or a return from an
+   abandoned or re-issued wave is recorded `duplicate`/`stale`, never as a second
+   account or corroboration. **Failing case:** abandoned-wave and re-dispatched
+   code-reviewers both return, and "two reviewers agree" dismisses a spec finding.
    Findings later withdrawn at reconciliation stay visible: the account records
    `withdrawn: <n> (<reason>)` rather than silently dropping them.
 6. Apply [[`agents.md`](standards/agents.md) § Result admission](standards/agents.md#result-admission)
    and dedupe by evidence/root cause. Account for all seven in
-   `review.md`/`seal.md`: `Outcome:` plus admitted account, or
+   `review.md`/`seal.md`, each [engineering lane](#engineering-lanes) separately:
+   `Outcome:` plus admitted account, or
    `Not-applicable: <inspected-scope reason>`. Spec/Code may cite valid unchanged
    `review.md` under [evidence validity](candidate-integrity.md#evidence-validity); persist no dispatch telemetry.
 7. Missing profile, null/failure, or malformed output is a `gap`; never
@@ -76,6 +82,41 @@ Never restart/orphan the cohort or infer approval. Reviewers are read-only;
 accounts store evidence, never telemetry. Same-file writers stay serial.
 Capacity rejection is backpressure: retry batches; never shrink a roster.
 
+## Engineering lanes
+
+Classify each changed path by the runtime it executes in — from entry points, build
+targets, and the import graph, never filename or language: `frontend`
+(client-rendered, browser, or native UI runtime), `backend` (server, worker, CLI, or
+data runtime), `boundary` (a serialized contract between them), or `other` (build
+tooling, libraries, game engines: own profile, no forced split; native app UI is
+`frontend`). Record the lane map
+in `review.md`/`seal.md`.
+
+- **Frontend and backend both changed:** dispatch `devrites-code-reviewer` twice in
+  the same wave (`dispatch open ... --role code-reviewer.frontend --role
+  code-reviewer.backend`; distinct handles — the sealed wave's handles and start
+  stamps are the concurrency receipt). Build each bundle with `devrites-engine
+  context <slug> --phase <p> --role code-reviewer --trigger <set> --out
+  ctx/<p>-code-reviewer.<lane>.bundle.md`; the default name collides. Each packet
+  names its lane, the lane's path set (the whole diff stays readable for context),
+  the triggered profile ([`review/README.md`](standards/review/README.md)), and the
+  contracts crossing the lane. Otherwise one code-reviewer, lane recorded.
+- **Reconcile per contract:** each lane returns `Contract:` rows; root pairs both
+  sides of each contract. A contract assessed from one side only is a `gap`; a
+  missing crossing test is Important.
+- **Accounting:** each lane is its own account; a combined verdict never hides a
+  failed or unassessed lane, and a blocked question on one lane does not stop the
+  other. A mixed file may be reviewed by both lanes; writes stay with one wright.
+  `devrites-frontend-reviewer` (craft/a11y) supplements, never substitutes, the
+  frontend lane.
+- **Capacity:** temporary backpressure keeps the batch rule above. If the host
+  cannot launch concurrent children at all, record `lane-concurrency: unavailable
+  <reason>` and ask the user once before dispatching lanes serially; record the
+  answer in `decisions.md`.
+
+**Failing case:** one code-reviewer covers a full-stack diff from the handler side;
+the client renames a field its mocked test still passes, and the verdict reads clean.
+
 ## Cancellation and terminal reconciliation
 
 Cancellation acknowledgement means the host accepted a request, not that the
@@ -87,11 +128,22 @@ reuse its resources while it may still run. If terminal state cannot be
 established, record a gap and retain ownership. A result classification alone
 does not prove host termination.
 
+On resume (compaction or a new session), run `devrites-engine dispatch <slug>
+status`, `parallel status`, and `claim list --all` before any dispatch. A read-only
+wave whose handles this session cannot query: `abandon` it, record each unreturned
+role `gap`, and re-dispatch fresh on the current digest; its late returns are
+`stale`. A writer keeps its claim and lease — no relaunch on those paths until the
+claim is released or its holder is proven terminal. A wright that never returned an
+admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch
+`git diff --name-only` baseline are never cited as built nor discarded, and are
+named in the re-dispatch contract; changes outside task paths stop for the human
+(Converge side: [`rite-converge`](../../rite-converge/SKILL.md)).
+
 ## Scale limits
 
-The role table bounds rosters. Use roughly four concurrent read-only reviewers;
-eight only with disjoint paths/resources. Refuse unbounded swarms and role
-substitution: sharpen scope or use a bounded second pass when coverage is missing.
+The role table bounds rosters. Use roughly four concurrent read-only reviewers,
+counting children any leaf spawned; eight only with disjoint paths/resources.
+Refuse unbounded swarms and role substitution: sharpen scope or use a bounded second pass when coverage is missing.
 Overlapping reviewers increase duplicate findings and reconciliation work.
 
 ## Children are tools, not peers

package/pack/generated/devin/skills/devrites-lib/reference/reply-contract.md

@@ -38,13 +38,28 @@ Mid-flight replies — the turns between completion states — obey the same eco
   into the one before. A short path finished beats a complete path abandoned.
 - **Name the win before the remainder.** A landed slice, a green gate, a merged
   piece is stated first — visible progress beats an undifferentiated list.
-- **Cap enumerations.** Long lists collapse to a few grouped items with counts;
-  the full enumeration lives in the durable artifact, not the reply.
+- **Cap enumerations.** Long lists collapse to at most 5 items per group plus
+  `k of N; rest: <path>`, where N equals the count in that durable artifact; the full
+  enumeration lives there, not the reply. **Failing case:** the reply says "3 open
+  findings" while `review.md` lists 7 and no path is named.
 - **Errors are matter-of-fact** — cause and fix, never alarm noise.
+- **Paste-safe commands.** A command on a `Next:`/`Resume:`/`Fix:` line has no trailing
+  `#` comment, uses paths that resolve from the user's working directory (project-relative
+  or absolute, never a sandbox/temp path), and chains dependent steps with `&&`.
+  **Failing case:** `Next: devrites-engine handoff billing  # resume` errors on first paste
+  in zsh, which passes the comment as arguments.
 
 Pre-send check: delete an opening sentence that only announces ("I'll now…") and a
 closing sentence that only recaps; then apply the two-line test — a reader seeing only
-the first and last lines must know what happened and what to do next.
+the first line (its state token: `Done`, `Awaiting human`, `Stopped`, `NO-GO`, `GO`,
+`Shipped`, or the lead label a utility rite's own output template defines, such as
+`Verdict:` or `Feature:`) and the action line (`Next:`, or `Resume:`/`Fix:` in a stop shape) must know
+what happened and what to do next. Prose before the state token fails the test.
+
+The reply has one next action. A `↻ Hygiene:` footer
+([`context-hygiene.md`](standards/context-hygiene.md#the-hygiene-footer)) names only
+`/clear`, `/compact`, or `/rite-handoff`, plus the action-line command unchanged if it
+repeats one. **Failing case:** `Next: /rite-prove` above a footer resuming with `/rite-review`.
 
 If a required decision, proof, or invariant is missing, use one of these states
 instead of `Done`:
@@ -87,9 +102,9 @@ Record: .devrites/archive/<slug>/ship.md
 ```
 
 Claims such as proved, reviewed, sealed, shipped, or complete must point to real
-output or an artifact. An expected verification that was skipped, unavailable, or
-could not start is named in `Evidence:` or `Open:` — omitting it reads as
-ran-and-green. Use exactly one recommended next action except for
+output or an artifact. A NOT-RUN verification keeps its marker in `Evidence:` or `Open:`
+per [`core.md`](standards/core.md#gate-contract) § Gate contract.
+Use exactly one recommended next action except for
 terminal agent-owned technical exhaustion, which has no runnable action.
 
 Use that terminal case only per [`one-shot-actions.md`](standards/one-shot-actions.md):

package/pack/generated/devin/skills/devrites-lib/reference/standards/README.md

@@ -31,7 +31,6 @@ topic's owner.
 | `observability.md` | A changed runtime path must be diagnosed in production. |
 | `developer-experience.md` | A public API, CLI, SDK, webhook, config, error, or getting-started surface changes. |
 | `patterns.md` | Choosing or simplifying architecture. |
-| `architecture-health.md` | An audit needs a structural read on the whole codebase — coupling/cohesion/cycle score from a dependency index. |
 | `git-workflow.md` | Preparing commits, branches, tags, or changelog entries. |
 | `hooks.md` | Creating or changing repository hooks. |
 | `ci-cd.md` | Creating or changing a build/deploy pipeline. |

package/pack/generated/devin/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -279,22 +279,15 @@ boundary owns any such request and requires explicit user approval.
 
 ## `state.md` `Awaiting human` block
 
-When a HITL gate fires, `/rite-build` writes:
-
-```markdown
-- Status: awaiting_human
-- Next step: /rite-resolve <qid> "<answer>"
-
-## Awaiting human
-- qid: <q-...>
-- gate: <gate>
-- question: <crisp text>
-- proposed: <agent's tentative answer>
-- raised_at: <iso>
-- blocking_slices: [<slice ids that cannot advance>]
-```
-
-`/rite-resolve` removes the block on success and flips `Status: running`.
+When a HITL gate fires, `/rite-build` sets cursor `status` to `awaiting_human` and
+`next_action` to `/rite-resolve <qid> "<answer>"`, then writes the `Awaiting human` table
+(`question_id`, `gate`, `blocking_slices`) owned by
+[`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
+The question text, `proposed` answer, and `raised_at` live in the `questions.md` entry.
+Legacy `- Status:`/`- Next step:`/`- qid:` bullet keys are engine-accepted aliases, not
+the authoring format.
+
+`/rite-resolve` removes the block on success and sets cursor `status` to `running`.
 
 ## The resume verb: `/rite-resolve`
 

package/pack/generated/devin/skills/devrites-lib/reference/standards/agents.md

@@ -67,6 +67,11 @@ terminal path after `add` — success, gap, stop, or launch failure — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
+expected write (engine max 240) and re-add before it lapses; before writing, also
+read `claim list --all` — a foreign `expired` claim on overlapping paths whose
+session is not proven terminal counts as held (stop and report). **Failing case:**
+session B's `claim check` passes at minute 35 over session A's still-running wright.
 
 ## Independence
 
@@ -85,26 +90,53 @@ Each required reviewer/analyst/auditor starts with exactly one:
 
 ```text
 Outcome: <findings | no-findings | gap>
-Finding: <severity> | <file:line or artifact section> | <observed quote/result> | <impact> | <minimum fix>
+Counts: <n per severity or kind used in the rows below>
+Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
   Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
   `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
+  A Critical/Important row carries `conf <n>` in its severity cell and writes impact
+  as `when <input/state/sequence> → <effect>`; missing either, root admits it as
+  `Unverified: <claim> — missing trigger` (stays `gap`).
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.
 - **`gap`:** names missing/unreadable/stale input; skipped/failed required check;
   tool/reviewer failure; or another limit. Required gaps block.
 
 Root treats results as claims; verifies proposed Critical/Important blockers
-against candidate. Missing fields become
+against candidate, first anchoring each row's quote at its cited `file:line` on the
+frozen digest: exact → admit; found at exactly one other location → relocate,
+keeping both locations; not found or found at several → `Unverified: <claim> —
+anchor lost|ambiguous`, a gap that is never a finding or a dismissal. A leaf result
+produced by spawning a nested agent is `gap`, and each hidden child counts toward
+the concurrent pool and `max_agents`. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
 with evidence—never silently dropped/demoted. Null/timeout/failure/malformed
 output is `gap`, never `no-findings`. Conditional `Not-applicable` must name the
 inspected scope and why its trigger did not fire. **Failing case:** parent admits a
 wright "done" with no `git diff --name-only` ⊆ path-contract (allowlist) observation.
 
+### Return budget
+
+Every read-only leaf returns rows, not prose, so the root keeps its context for
+decisions and nothing is lost in a retelling. Exempt: `devrites-plan-drafter` (its
+return is the bundle the root writes) and the wright's change evidence.
+
+- Lead with the result line (`Outcome:` for reviewers, the role's own status line
+  otherwise), then `Counts:` with the number of rows per severity or kind.
+- No restated task, preamble, approach narrative or closing summary. An optional
+  `Notes:` block carries at most five lines that no row can hold.
+- Point, don't paste: cite `file:line` with at most one quoted line (160
+  characters); for a command, give the exact command, its exit code and the one
+  decisive output line. Never paste whole files, diffs, logs or test output.
+- Each row stands alone: a reader of that row alone can re-check it from its pointer.
+- The root records admitted rows verbatim, adds its own verification beside them, and
+  never rewrites, merges or summarizes a row; deduplication references rows by
+  position or ID instead of rewording them.
+
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records

package/pack/generated/devin/skills/devrites-lib/reference/standards/audit-coverage.md

@@ -52,7 +52,11 @@ After each hunting wave, a **coverage critic** — a fresh agent comparing the l
 with targeted source and entry-point evidence — looks for holes: unseeded surfaces,
 boundaries with no check class,
 units stuck `assigned`, `rejected` patterns suggesting a hunter fires blanks.
-Accepted discoveries become `planned` units. Reserve critic and verifier capacity
+Accepted discoveries become `planned` units. Coverage is `complete` only after a
+critic returns no accepted missing or reassigned unit and no unit is `planned`;
+otherwise the run is partial, and a wave or agent cap is never evidence of
+completeness. A reassigned unit gets a fresh owner; the old attempt's evidence stays
+attributed to it and is never merged into the new attempt. Reserve critic and verifier capacity
 **before** spending on hunters; a wave launched with no verification reserve hunts
 for findings nobody may claim.
 

package/pack/generated/devin/skills/devrites-lib/reference/standards/browser-proof-checklist.md

@@ -13,9 +13,20 @@ viewport set here.
   wrong route, blank render, unexpected login wall, inconsistent dimensions, or
   stale candidate is missing evidence. Recapture; until resolved, record
   `cannot_verify` and block visual approval. A convincing narrative cannot repair it.
-- Interactive slices capture each relevant canonical state and the canonical
-  viewport set. Omission needs a one-line `not-needed` reason; states must exist
-  in source — an unreachable state's capture proves nothing.
+- **Evidence matrix.** Layout-bearing states (default, long content, and every
+  role-applicable surface state from [`quality-standards.md`](../../../devrites-frontend-craft/reference/quality-standards.md) § Focus & states) × every
+  canonical viewport; interaction states at ≥1 small and ≥1 large viewport (hover
+  only with a hover-capable pointer); one keyboard traversal; a `reduce` capture when
+  motion changed; every shipped theme. Each cell holds a capture, `cannot_verify`, or
+  `not-needed (<reason>)`; an empty cell is `cannot_verify`. States must exist in source
+  — an unreachable state's capture proves nothing.
+- A capture counts only with fonts loaded, animations settled, the real route (a harness
+  or story capture is labelled and never fills a route cell) and matching candidate
+  identity. Hover, touch, iOS zoom or safe-area behaviour seen only in emulation is
+  `unverified (device)`, never a pass.
+- A finding closes only with a capture of the same route, state and viewport class on the
+  corrected candidate; a failed or incomplete capture run never counts as gone.
+  **Failing case:** a 320 px overflow closed by a clean 1440 px screenshot.
 - Browser-default chrome is judged by § Browser chrome; reflow, zoom and bounded
   two-dimensional exceptions by § Responsive. Compare to `design-brief.md` → Visual Verdict.
 - Tooling unavailable ⇒ record fallback + limitation. Backend-only changes record

package/pack/generated/devin/skills/devrites-lib/reference/standards/code-navigation.md

@@ -11,7 +11,7 @@ Review.
 | Question | First tool | Fallback |
 | --- | --- | --- |
 | Explore unfamiliar area, architecture, blast radius | `codegraph_explore` or codebase-memory `search_graph` / `get_architecture` | code-review-graph `detect_changes_tool` / `get_impact_radius_tool` |
-| Callers, callees, data flow across files | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
+| Callers, callees, call paths across files (value/taint flow: [`tooling.md`](tooling.md) route table) | codebase-memory `trace_path` | code-review-graph `query_graph_tool` |
 | PR/review context for a diff | code-review-graph `get_review_context_tool` | `detect_changes_tool` |
 | Exact symbol body before edit | `read_symbol` / `module_report` (pi-lens) | `get_code_snippet` then targeted `Read` |
 | Rename, references, diagnostics | LSP (`lsp` rename/references) when available | graph trace + grep |
@@ -29,7 +29,13 @@ Review.
 3. After edits: LSP diagnostics + project tests. Compiler errors are the oracle
    for callers the graph listed — fix them in dependency order, direct
    dependents first. Errors absent from the list mean the list was incomplete
-   (see blind spots below); record the gap.
+   (see blind spots below); record the gap. Diagnostics count only when bound to the
+   current bytes: the server received the post-edit sync or save, the project is loaded
+   and ready, and the file is within its size limits. A `0` from a cold, not-ready, or
+   oversized server, a pre-edit result, or a timed-out probe is `stale` (or `unavailable:
+   <reason>` when none ran), never clean; fall back to the project typecheck/compile command. **Failing case:**
+   the language server returns 0 diagnostics before the project finishes compiling and
+   the slice records "diagnostics clean".
 
 Skipping step 1 on a multi-file slice is a Build orient gap unless recorded
 `cannot_verify`.

package/pack/generated/devin/skills/devrites-lib/reference/standards/code-review.md

@@ -81,10 +81,9 @@ If it does not, do not merge it.
   never approval or silent demotion.
 - **Skipped checks are recorded.** A check you couldn't run gets a
   `Skipped: <check> — <why>` line.
-- **Unreviewed is not clean.** A report that never names an area does not prove that area
-  was inspected; the consolidated account names what was not covered or marks `gap`.
-  **Failing case:** a findings list silent on, say, migration safety is not a clean
-  migration review — name the inspection or the gap.
+- **Unreviewed is not clean** ([core.md § Gate contract](core.md#gate-contract)): an area
+  the report never names counts as uninspected — name the inspection or mark `gap`
+  (silence on migration safety is not a clean migration review).
 - **Separate the verdict from its context.** A verdict flips only on evidence
   scoped to the change under review — its diffs, its acceptance criteria, its
   blast radius. Whole-repo signals gathered along the way (a global health
@@ -124,6 +123,14 @@ grounds, each citing evidence:
    pre-existing code the diff did not touch. Route it as a follow-up, never
    delete the record.
 
+A dispute that turns on runtime, configuration, ordering, or environment (race,
+retry, config default, framework behavior) is decided only by a discriminating
+reproduction naming trigger and result: an approved command, or a wright-authored
+regression test. A green general suite, an assumed framework guarantee, or how many
+reviewers agree never decides it; without the reproduction the conflict stays an
+open blocker. **Failing case:** one reviewer flags a race, another calls it fine,
+and root dismisses it after reading the handler.
+
 "Cannot verify", "suspicious", "would not have raised it", and "inconvenient to
 fix now" are not grounds for removal — the finding stays open.
 

package/pack/generated/devin/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -55,7 +55,12 @@ the `gates.md` reduction with unmet/stale ids, `decisions.md` dead ends, and the
 canonical read-next order). Open the artifacts `read_next` names; resume from
 the record, not from transcript memory. Then `devrites-engine check
 regression <slug>`: `BLOCKED` names a durable fact lost since the last
-checkpoint; `unproven` does not block.
+checkpoint; `unproven` does not block. Before any re-dispatch, run
+`devrites-engine dispatch <slug> status`, `devrites-engine parallel status --root <repo>
+--slug <slug>`, and `devrites-engine claim list --all`, and reconcile open waves, leases, and
+claims per [`parallel-dispatch.md`](../parallel-dispatch.md#cancellation-and-terminal-reconciliation) § Cancellation.
+**Failing case:** after compaction the root re-dispatches a review cohort whose original
+children still run, and duplicate accounts arrive.
 
 ## Authority and trust
 
@@ -81,16 +86,22 @@ Apply [`core.md` § Precedence](core.md#precedence); authority and evidence diff
 **Default to `/clear`.** First persist missing decisions, assumptions, or questions
 to their owners (`/rite-handoff`); `/compact` preserves unrecorded continuity.
 
-## The "Session hygiene" footer (every rite-* output)
+## The hygiene footer
 
-Every `rite-*` skill ends its output with a one-line **Session hygiene** advisory, plus
-the **single command** that resumes work next session:
+Every `rite-*` reply names the **single command** that resumes work on its action line
+(`Next:`, or `Resume:`/`Fix:` in a stop shape; [`reply-contract.md`](../reply-contract.md))
+and ends with one advisory line after `Record:`:
 
 ```
-Session hygiene: /clear (recommended)   — <one-line why, anchored to what just got persisted>
-Resume next session with: <single command, e.g. /rite-build slice 2>
+↻ Hygiene: </clear | /compact | /rite-handoff> — <why, anchored to what just got persisted>
 ```
 
+A footer may name two of those moves under stated conditions ("/clear between slices;
+/rite-handoff if away").
+
+Besides `/clear`, `/compact`, or `/rite-handoff`, the footer names no command except the
+action-line command unchanged; a different resume command is a competing next action.
+
 This is advice, not a gate. The user can ignore it. It reports a trade-off the model
 cannot inspect directly because no API reports context fullness.