devrites 5.2.3 → 5.3.0

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -83,9 +83,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the bounded advisory-only sentinel once; never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte. Touch
-   `.devrites/CHECKPOINT` so proven slices get local crash-survivable WIP
-   checkpoints for Ship to collapse. **Completion:** valid read-only AFK and checkpoint sentinels exist.
+   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
    `/rite-build` × pending slices → `/rite-prove` → `/rite-polish` →

package/pack/.claude/skills/rite-build/SKILL.md

@@ -58,9 +58,13 @@ Wright applies anti-slop; root verifies returns and never patches source.
 ## `--parallel N` (opt-in)
 
 Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
-gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
-vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+All-green serial integrate; a red/gap sibling gets a bounded repair round in
+its own worktree — never rebuilt from scratch while budget remains.
+Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
+plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
+repair blocks and preserves everything; `cleanup --force` (human discard
+path only) salvages slice branches before removing worktrees.
+AFK charges after integrate only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/.claude/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `/rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`/rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`/rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -19,11 +19,13 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
    VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
+            — dispatch the initial read-only reviews of distinct decisions in parallel
+            (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
-            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
 NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```
 

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -12,8 +12,8 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 
 AFK caps `N` by remaining budget. Charge **only after successful integrate**
 (once per integrated green sibling). Abort / integrate-failed → **0**. A
-`running` lease blocks another `/rite-build`. Any present lease blocks
-`parallel create` until cleanup.
+present lease is resumable: `/rite-build` continues it (repair rounds or the
+blocked verdict); `parallel create` refuses until cleanup.
 
 ## Path-disjoint
 
@@ -22,8 +22,9 @@ duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
 
 **SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
 (N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
-overlap → sibling **gap** → abort. **Failing case:** two parallel wrights share a
-path and fan-out proceeds without that check.
+overlap → sibling **gap** (a shared path is a contract defect). **Failing
+case:** two parallel wrights share a path and fan-out proceeds without that
+check.
 
 ## Control vs workers
 
@@ -44,26 +45,80 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
 4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
    even when targeted tests are green.
-5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
-6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
-   path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
-7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
-   per integrated sibling; optional `check candidate`.
-8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
-   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
-   follow [`spec-drift-guard.md`](spec-drift-guard.md) — batch-sweep all
-   siblings' contract assumptions, one folded `/rite-plan repair` + one
-   `/rite-vet` recheck inline, then cleanup and resume Build. Do not emit
-   `Fix: /rite-plan repair`. Product/policy/irreversible-risk still stops.
+5. Non-green siblings → **repair round** (below) in the same worktrees; lease
+   stays `running` — no abort while repair budget remains. A green sibling →
+   `parallel record-green`. No partial integrate. All green → integrate.
+6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
+   staging branch (Ship collapses it). Conflict → reset to `B`,
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+7. Success: FF control to the squash commit — the batch lands as one local
+   commit, never pushed; union `touched-files.md`; update state/evidence;
+   AFK +1 per integrated sibling; optional `check candidate`.
+8. Cleanup runs only after `integrate` marks the lease `complete` — work
+   landed in control, so `parallel cleanup` removes worktrees/branches.
+   Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
+   removed while the batch may resume. `parallel abort` + `cleanup --force`
+   is the explicit human discard path, never orchestrator-emitted; it
+   salvages each sibling first (uncommitted allowlisted changes → slice-branch
+   commit; branches past `B` kept; a failed salvage keeps the worktree) and
+   prints retained refs for the abort record. `abort` marks the lease only —
+   never rewinds control: a moved HEAD is external work, reported not reset.
+   Never integrate a rejected transfer commit.
+
+## Repair rounds
+
+Rejected work is repaired in place — never discarded and rebuilt from scratch
+while budget remains.
+
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: per
+  non-green sibling — status, verbatim findings, transfer_commit or null.
+- Classify first: **implementation defect** (review Critical on the diff, red
+  wright/proof) → repair wright in the same worktree. **Durable-plan defect**
+  (falsified contract assumption, AC unchanged) →
+  [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
+  assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
+  inline, resume repair in the same worktrees under the amended contract;
+  never emit `Fix:`. **Reviewer stall/cancel or missing verdict** →
+  re-dispatch the reviewer, not the wright. **Product/policy/irreversible**
+  → stops for the human.
+- Dispatch a fresh `devrites-slice-wright` (cwd = the sibling's worktree, same
+  allowlist and host rules as step 3 — siblings may repair in parallel) with
+  the original contract + verbatim findings + "preserve what works; fix the
+  named findings; return a new `transfer_commit`". Never reset the worktree
+  to `B` — that destroys the work under repair. The commit must still descend
+  from `B` and diff path-exact vs `B`.
+- Each repair return re-runs the full gate chain: inspect, fresh doubt +
+  test-analysis, approved proof.
+- Budget: the shared causal-fingerprint cap — three total failed attempts per
+  sibling per fingerprint (build + repairs count together); a distinct
+  Critical is a new fingerprint. Exhaustion is not abort: record one
+  technical blocker (`Status: blocked`; `Next step: none — technical recovery
+  exhausted for <fingerprint>; requires new evidence or changed failure
+  conditions`), preserve lease/worktrees/branches, STOP — same fingerprint
+  stays blocked on reinvoke; new evidence resumes repair in place. Human-
+  owned decisions use the drift-guard question and wait.
 
 ## Engine verbs
 
 ```text
-devrites-engine parallel create|record-green|abort|integrate|cleanup|status
-devrites-engine parallel lease-write|lease-read|lease-clear
+devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
+devrites-engine parallel status --root <repo> --slug <slug>
+devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>
+# human discard only, never orchestrator-emitted:
+#   parallel abort --root <repo> --slug <slug>
+#   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-Go is SSOT. Skill calls the engine — never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages the squash commit, leaves the
+lease `running` and control at `B`; cleanup still refuses — the commit cannot
+be lost. `record-green` and `integrate` also accept an `integrate-failed`
+lease, so a failed integrate retries after repair. `--apply-to-control`
+refuses when control moved past `B` or holds uncommitted changes on slice
+paths — commit/stash and retry; the batch is untouched. Go is SSOT; never
+ad-hoc git/bash orchestration.
 
 ## Runtime isolation
 
@@ -78,8 +133,8 @@ assign per-slice env (document in the lease or worktree README):
 | Dev server | one process per worktree; never share a listener |
 
 Reusing the control worktree's running server, DB, or compose stack across
-siblings causes cross-slice pollution and flaky proof. Abort if isolation cannot
-be established.
+siblings causes cross-slice pollution and flaky proof. Force serial if
+isolation cannot be established.
 
 ## Host
 

package/pack/.claude/skills/rite-build/reference/spec-drift-guard.md

@@ -44,7 +44,14 @@ A durable-plan drift abort never repairs the first gap alone:
 2. Record each violation as its own `drift.md` entry/fingerprint; one folded
    repair + one batched recheck resolves the set.
 3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
-   internally, never hand an intermediate command to the human.
+   internally, never hand an intermediate command to the human. When
+   consecutive folded repairs keep landing on the same clause set, the
+   repair packet's `convergence_pressure` marking applies (see `/rite-plan`
+   repair): bounded declared residuals may close refinements of
+   already-pinned clauses; a newly surfaced failure mode is never
+   residual-eligible. A suspect seam's declare-limitation-or-continue choice
+   routes to `/rite-clarify` like any human-owned gate — it is not an
+   intermediate command.
 4. Nothing skips or defers silently: every entry ends resolved, human-escalated,
    or fingerprint-exhausted. Execution-only gaps (tests, UX, evidence) get the
    identical path when they surface.

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -83,7 +83,32 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    touches: which intersected invariants it re-verified, with evidence of no
    correction-created regression. Global re-derivation (ID/edge/HZN counts,
    acyclicity) runs on materialized artifacts at the step-7 gate — the drafter
-   never re-derives them by exhaustive search.
+   never re-derives them by exhaustive search. It also carries a bounded
+   self-attack over the delta (`self_attack_exposures`), catching the shallow
+   next-round findings before Vet's dispatch rather than after a full loop.
+   Root dispositions every exposure — fold as a finding, accept as a declared
+   residual, or reject with reason; none silently drops.
+   Packet mechanics: dedupe at assembly — findings with an identical
+   required-fix and site set merge into one entry that closes all their
+   fingerprints. The packet may carry digest-pinned site excerpts so the
+   drafter spot-verifies anchors instead of re-scanning whole files, and root
+   may partition findings into anchor-disjoint clusters with one drafter per
+   cluster in parallel — findings sharing any anchor or mirrored clause stay
+   in one cluster, and each bundle applies independently. A `partial`-
+   continuation re-dispatch continues the same packet; it does not advance the
+   same-seam counter. Count consecutive repair packets whose findings' cited clause sets overlap
+   the immediately previous packet's — the overlap is the seam. At the third
+   same-seam packet, mark it `convergence_pressure: true` with the seam named.
+   Under pressure the drafter may close a finding marked as a refinement of an
+   already-pinned clause by folding an explicit, bounded declared
+   residual/limitation into the contract text instead of another precision
+   pin — never for a `new_failure_mode` finding. Every finding still gets one
+   disposition; none is skipped. A fourth same-seam packet that still carries
+   `new_failure_mode` findings means the seam is under-specified, not
+   under-repaired: route a declare-limitation-or-continue choice to
+   `/rite-clarify`. AFK records the suspect seam in `state.md` and continues
+   within budgets — a coverage limitation is a product decision and is never
+   auto-declared.
    Bind exact active `.devrites/work/<slug>/` targets and executable contract; after Vet READY, root
    materializes the exact vetted workflow-artifact paths under
    [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)

package/pack/.claude/skills/rite-plan/reference/replan-and-repair.md

@@ -32,10 +32,14 @@ A drift event stopped the build. Steps:
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
 4. Mark each `drift.md` entry **resolved** with the resolution + date.
-5. **Self-check the repaired candidate on the delta before handoff** — re-verify
-   every invariant the correction touched (acyclic dependency graph,
-   bidirectional traceability, Shared contract proof vs boundary set, sizing,
-   no correction-created regression) and record the evidence in the Plan
+5. **Self-check and self-attack the repaired candidate on the delta before
+   handoff** — re-verify every invariant the correction touched (acyclic
+   dependency graph, bidirectional traceability, Shared contract proof vs
+   boundary set, sizing, no correction-created regression), then probe the
+   delta against the reviewers' attack classes (race/observation windows,
+   alias escapes, ordering gaps, capability gaps, unbounded blocking,
+   happy-path-only coverage); fold a fix or a named bounded residual into
+   the same pass. Record both in the Plan
    checkpoint; Vet's recheck verifies it rather than rediscovering the defect a
    loop later.
 6. Resume at the corrected slice.

package/pack/.claude/skills/rite-review/SKILL.md

@@ -77,7 +77,9 @@ Pull these via `Read` when the diff demands them:
    Separate contexts prevent one axis from masking the other:
    - Freeze that closed digest and give the same digest to **two** read-only reviewers in
      parallel, each with its own narrow brief and no
-     cross-pollination:
+     cross-pollination — and evaluate the frontend (step 4), security (step 5),
+     and performance (step 6) dispatch conditions from this same diff now,
+     joining the cohort when applicable rather than dispatching later waves:
      - **Spec axis** → `devrites-spec-reviewer`: "Apply your documented discipline on
        the active feature workspace + diff. Report (a) criteria the spec asked for that
        are missing or partial, (b) behaviour in the diff the spec did not ask for
@@ -112,17 +114,19 @@ Pull these via `Read` when the diff demands them:
    Add only what the dispatched agents could not, then resolve overlaps and
    contradictions before labeling. ([five-axis-review.md](reference/five-axis-review.md)
    documents the axes the code-review agent applies.)
-   - **UI feature?** Dispatch `devrites-frontend-reviewer` and apply the **UX rubric**
+   - **UI feature?** `devrites-frontend-reviewer` joins the step-3 cohort; apply the **UX rubric**
      ([nielsen-heuristics](reference/nielsen-heuristics.md)) and the
      **cognitive-load lens** ([cognitive-load](reference/cognitive-load.md),
      [performance-checklist](reference/performance-checklist.md)). No UI/route/style
      paths: record `Not-applicable: no relevant paths in diff`.
-5. **Security:** dispatch `devrites-security-auditor`
-   ([security-review](reference/security-review.md)) when input, auth, data,
+5. **Security:** `devrites-security-auditor`
+   ([security-review](reference/security-review.md)) joins the step-3 cohort when
+   input, auth, data,
    secrets, or permissions are in the diff; else `Not-applicable: no relevant paths in diff`.
-6. **Performance:** dispatch `devrites-performance-reviewer`
+6. **Performance:** `devrites-performance-reviewer`
    ([performance-review](reference/performance-review.md),
-   [performance-checklist](reference/performance-checklist.md)) only on a budget or
+   [performance-checklist](reference/performance-checklist.md)) joins the step-3 cohort
+   only on a budget or
    hot path; else `Not-applicable: no relevant paths in diff`.
 7. Reconcile and accept only in-scope fixes. Consolidate them into one bounded
    wright correction; never edit source in the reviewing context. Any correction

package/pack/.claude/skills/rite-seal/SKILL.md

@@ -52,7 +52,9 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 
 1. read workspace and final diff;
 2. recheck the canonical candidate/bindings and approved repository/CI proof;
-3. dispatch exact proof, spec, test, doubt, and applicable review agents;
+3. dispatch exact proof, spec, test, doubt, and applicable review agents in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md` — independent
+   read-only verdicts on one frozen candidate;
 4. reconcile their read-only verdicts against source and immutable evidence;
 5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
 6. write exactly one candidate binding, then run

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -73,9 +73,11 @@ plan declares a root-authored executable workflow file, read
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Every initial
    pass records an engineering verdict and test-plan coverage. A valid Recovery
    recheck retains prior depth and enters 1b.
-1a. **Independent initial pass.** Freeze candidate and dispatch exact fresh
-   read-only plan reviewer. Add developer-experience reviewer for developer
-   surfaces and current strategy reviewer after significant Temper. Missing
+1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
+   read-only plan reviewer — plus developer-experience reviewer for developer
+   surfaces and the current strategy reviewer after significant Temper — in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
+   independent read-only passes on one frozen candidate. Missing
    required account blocks.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
@@ -89,7 +91,16 @@ plan declares a root-authored executable workflow file, read
    changed clause — enumerate dependents via the dep graph and traceability
    refs, not only patched sites. Otherwise record one no-progress outcome. A
    different Critical/Important invariant needs exact evidence and a new
-   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reconcile
+   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. A packet
+   marked `convergence_pressure` accepts an explicit, bounded declared
+   residual/limitation folded into the contract text as closure for a finding
+   marked as a refinement of an already-pinned clause; the recheck may re-raise
+   it only by naming a concrete failure path the declaration omits. A
+   `new_failure_mode` finding is never residual-eligible. A fold whose
+   findings are all Suggestion-or-lower rechecks mechanically at the
+   materialization gate — anchors applied, mirrors consistent, invariants
+   pass — without a dispatched reviewer; sub-Important findings already
+   cannot keep recovery open. Reconcile
    shared artifact/readiness gates and return to caller or next repair.
 2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
    Harden to the smallest contract-complete plan, using marked topology action.
@@ -119,7 +130,10 @@ plan declares a root-authored executable workflow file, read
    consumer seam, or an explicit no-impact statement. Missing, one-sided,
    duplicated-contract, vague, or non-consuming proof fails closed.
 
-   Technical gaps are `NEEDS REPLAN` and Plan repair. Product/risk gaps are
+   Technical gaps are `NEEDS REPLAN` and Plan repair — each finding marks
+   itself `new_failure_mode` or names the already-pinned clause/fingerprint
+   it refines, making alias-detection and `convergence_pressure` eligibility
+   mechanical. Product/risk gaps are
    `NEEDS CLARIFICATION` and Clarify. Neither becomes a Build qid.
 5. **Review axes.** Apply `review-axes.md` through `eng-lenses.md`. Fold verified
    behavior-preserving technical findings; walk only human-owned decisions.

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -60,6 +60,14 @@ principle-exception questions. List them for the root.
   re-dispatches the rest. A finding blocked on human-owned information goes in
   `blocked_findings` with the needed input named — never `remaining_findings`,
   which is reserved for what another dispatch can complete.
+- In `repair`, before returning, self-attack the delta: probe every clause the
+  hunks touch for the attack classes Vet's reviewers hunt — race/observation
+  windows, identity/alias escapes, durability/ordering gaps,
+  platform-capability gaps, unbounded blocking, happy-path-only coverage.
+  Close each real exposure inside the same delta or return it in
+  `self_attack_exposures` with its bound; never silently drop one. This
+  narrows the next Vet round; it never replaces independent review and never
+  self-approves the repair.
 
 ## Output format
 
@@ -77,6 +85,7 @@ technical_decisions: []
 human_owned_choices: []
 validation_commands: []
 applicability_disposition: []
+self_attack_exposures: []
 ```
 
 The root validates the cross-file bundle and persists accepted content.

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -104,7 +104,10 @@ criterion, slice, or proof.
 - `/rite-vet` may request one initial pass and one narrow recheck per correction/fingerprint.
 - Label each finding **Critical / Important / Suggestion / Nit / FYI** and include
   the relevant plan or task section, confidence score, and a concrete fix. Do not
-  pad the report with praise.
+  pad the report with praise. In a recheck, also mark each finding
+  `new_failure_mode` or name the already-pinned clause/fingerprint it refines —
+  the packet lists prior repairs; the mark makes alias-detection and
+  `convergence_pressure` eligibility mechanical.
 - When a dimension has no issue, say "strong: <why>" instead of inventing a
   finding.
 - If a claim cannot be verified, such as blast radius without an index, say so and

package/pack/generated/claude/skills/devrites-api-interface/SKILL.md

@@ -51,7 +51,9 @@ Before standing the interface, run `devrites-doubt`.
 ## Done when
 The contract is complete only when **every** field carries a type + optionality + unit,
 **every** success and error status code is enumerated with its error-body shape, the
-`devrites-doubt` verdict is accept (on reject: revise the contract and re-doubt), and the
+`devrites-doubt` verdict is accept (on reject: revise the contract and re-doubt under
+`devrites-doubt`'s per-fingerprint bounds and distinct-findings ceiling — a contract
+that resists repair becomes a blocker or human gate, not an endless revise loop), and the
 contract + rationale are recorded in `decisions.md`. A contract that pins only the
 happy-path shape is not done.
 

package/pack/generated/claude/skills/devrites-doubt/SKILL.md

@@ -27,7 +27,7 @@ code · claiming "this is safe", "this scales", or "this matches the spec".
   issues but classify **zero** as actionable, the review is too agreeable. Sharpen the
   prompt or use a fresh reviewer. Accept a clean pass only after a genuine attempt to
   disprove the claim.
-- [ ] **5. STOP**: met a stop condition (only trivial findings, 3 cycles done, or user override). Emit a **binary gate verdict** the orchestrator must clear: **accept** (no valid-&-actionable findings remain) or **reject + the specific required changes**. On reject, the orchestrator loops the wright on those changes before the slice is accepted. Still reject after the 3-cycle cap → classify by decision ownership: human-owned product/risk uncertainty escalates; objective required changes become a technical blocker, never a retry-authorization question.
+- [ ] **5. STOP**: met a stop condition (only trivial findings, no open fingerprint has budget left, the distinct-findings ceiling, or user override). Emit a **binary gate verdict** the orchestrator must clear: **accept** (no valid-&-actionable findings remain) or **reject + the specific required changes**. On reject, the orchestrator loops the wright on those changes before the slice is accepted. Account per finding, not per round: a reject citing a genuinely new defect is progress and the loop continues; a reject re-citing a fingerprint the wright already failed on is no-progress and burns that fingerprint's budget. A finding that only refines a clause a prior cycle already pinned may close as an explicit bounded declared residual. Ceiling: three distinct actionable findings on one decision mean the decision resists repair — classify by decision ownership: human-owned product/risk uncertainty escalates; objective required changes become a technical blocker, never a retry-authorization question.
 
 ## Deletion-test lens (for "is this abstraction load-bearing?" doubts)
 
@@ -72,7 +72,8 @@ real time. Map the verdict to a `questions.md` entry instead of a synchronous pr
   `questions.md` entry with `gate: blocking`, set `state.md` `Status: awaiting_human`,
   fire the `notify:` hook, and STOP. AFK never silently accepts irreversible risk.
 
-The 3-loop limit still applies. After 3 cycles, human-owned uncertainty becomes a blocking
+The same bounds apply in AFK. Once no open fingerprint has budget left or the
+distinct-findings ceiling trips, human-owned uncertainty becomes a blocking
 question; an unresolved objective technical finding becomes `Status: blocked` with its exact
 required changes and `/rite-plan unblock`, regardless of AFK config.
 

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -83,9 +83,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the bounded advisory-only sentinel once; never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte. Touch
-   `.devrites/CHECKPOINT` so proven slices get local crash-survivable WIP
-   checkpoints for Ship to collapse. **Completion:** valid read-only AFK and checkpoint sentinels exist.
+   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
    `/rite-build` × pending slices → `/rite-prove` → `/rite-polish` →

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -58,9 +58,13 @@ Wright applies anti-slop; root verifies returns and never patches source.
 ## `--parallel N` (opt-in)
 
 Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
-gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
-vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+All-green serial integrate; a red/gap sibling gets a bounded repair round in
+its own worktree — never rebuilt from scratch while budget remains.
+Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
+plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
+repair blocks and preserves everything; `cleanup --force` (human discard
+path only) salvages slice branches before removing worktrees.
+AFK charges after integrate only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/generated/claude/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `/rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`/rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`/rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/generated/claude/skills/rite-build/reference/one-slice-cycle.md

@@ -19,11 +19,13 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
    IMPLEMENT → smallest complete version; match conventions; devrites-frontend-craft for UI
    VERIFY    → writer-safe tests/types/lint; return code + tests
 (DOUBT)   → orchestrator, on return: devrites-doubt each non-trivial decision the wright stood up
+            — dispatch the initial read-only reviews of distinct decisions in parallel
+            (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
-            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
 NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```