devrites 5.2.4 → 5.4.0

package/pack/.claude/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `/rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`/rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`/rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -24,8 +24,8 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
-            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
 NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```
 

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -12,8 +12,8 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 
 AFK caps `N` by remaining budget. Charge **only after successful integrate**
 (once per integrated green sibling). Abort / integrate-failed → **0**. A
-`running` lease blocks another `/rite-build`. Any present lease blocks
-`parallel create` until cleanup.
+present lease is resumable: `/rite-build` continues it (repair rounds or the
+blocked verdict); `parallel create` refuses until cleanup.
 
 ## Path-disjoint
 
@@ -22,8 +22,9 @@ duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
 
 **SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
 (N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
-overlap → sibling **gap** → abort. **Failing case:** two parallel wrights share a
-path and fan-out proceeds without that check.
+overlap → sibling **gap** (a shared path is a contract defect). **Failing
+case:** two parallel wrights share a path and fan-out proceeds without that
+check.
 
 ## Control vs workers
 
@@ -44,26 +45,92 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
 4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
    even when targeted tests are green.
-5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
-6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
-   path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
-7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
-   per integrated sibling; optional `check candidate`.
-8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
-   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
-   follow [`spec-drift-guard.md`](spec-drift-guard.md) — batch-sweep all
-   siblings' contract assumptions, one folded `/rite-plan repair` + one
-   `/rite-vet` recheck inline, then cleanup and resume Build. Do not emit
-   `Fix: /rite-plan repair`. Product/policy/irreversible-risk still stops.
+5. Non-green siblings → **repair round** (below) in the same worktrees; lease
+   stays `running` — no abort while repair budget remains. A green sibling →
+   `parallel record-green`. No partial integrate. All green → integrate.
+6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
+   staging branch (Ship collapses it). Conflict → reset to `B`,
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+7. Success: FF control to the squash commit — the batch lands as one local
+   commit, never pushed; union `touched-files.md`; update state/evidence;
+   AFK +1 per integrated sibling; optional `check candidate`.
+8. Cleanup runs only after `integrate` marks the lease `complete` — work
+   landed in control, so `parallel cleanup` removes worktrees/branches.
+   Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
+   removed while the batch may resume. `parallel abort` + `cleanup --force`
+   abandons the batch — the explicit human discard path; the single
+   orchestrator-emitted use is the automatic re-batch under Repair rounds,
+   where it acts as the salvage step only (uncommitted allowlisted changes →
+   slice-branch commit; branches past `B` kept; a failed salvage keeps the
+   worktree) and prints retained refs for the record. `abort` marks the lease
+   only — never rewinds control: a moved HEAD is external work, reported not
+   reset. Never integrate a rejected transfer commit.
+
+## Repair rounds
+
+Rejected work is repaired in place — never discarded and rebuilt from scratch
+while budget remains.
+
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: per
+  non-green sibling — status, verbatim findings, transfer_commit or null.
+- Classify first: **implementation defect** (review Critical on the diff, red
+  wright/proof) → repair wright in the same worktree. **Durable-plan defect**
+  (falsified contract assumption, AC unchanged) →
+  [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
+  assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
+  inline, resume repair in the same worktrees under the amended contract;
+  never emit `Fix:`. **Frozen-lease scope defect** — the amended contract or
+  a review requirement needs paths outside a slice's allowlist, or re-slices
+  the plan (a lease is immutable once written: its allowlists are the
+  disjointness guarantee) → **automatic re-batch, no human gate**:
+  `parallel cleanup --force` as the salvage step, record the retained refs in
+  the repair-round artifact, `parallel create` a fresh batch from control
+  `HEAD` under the corrected decomposition. Prior attempts stay reachable —
+  hand each new wright the salvaged branch ref
+  (`devrites/parallel/<slug>/<old-batch>/<slice>`) so it builds on what worked
+  instead of starting blind. If no corrected decomposition exists, that is
+  exhaustion → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
+  irreversible** → stops for the human.
+- Dispatch a fresh `devrites-slice-wright` (cwd = the sibling's worktree, same
+  allowlist and host rules as step 3 — siblings may repair in parallel) with
+  the original contract + verbatim findings + "preserve what works; fix the
+  named findings; return a new `transfer_commit`". Never reset the worktree
+  to `B` — that destroys the work under repair. The commit must still descend
+  from `B` and diff path-exact vs `B`.
+- Each repair return re-runs the full gate chain: inspect, fresh doubt +
+  test-analysis, approved proof.
+- Budget: the shared causal-fingerprint cap — three total failed attempts per
+  sibling per fingerprint (build + repairs count together); a distinct
+  Critical is a new fingerprint. Exhaustion is not abort: record one
+  technical blocker (`Status: blocked`; `Next step: none — technical recovery
+  exhausted for <fingerprint>; requires new evidence or changed failure
+  conditions`), preserve lease/worktrees/branches, STOP — same fingerprint
+  stays blocked on reinvoke; new evidence resumes repair in place. Human-
+  owned decisions use the drift-guard question and wait.
 
 ## Engine verbs
 
 ```text
-devrites-engine parallel create|record-green|abort|integrate|cleanup|status
-devrites-engine parallel lease-write|lease-read|lease-clear
+devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
+devrites-engine parallel status --root <repo> --slug <slug>
+devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>
+# abandoning the batch is human discard only; a frozen-lease re-batch may emit
+# cleanup --force as its salvage step (see Repair rounds):
+#   parallel abort --root <repo> --slug <slug>
+#   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-Go is SSOT. Skill calls the engine — never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages the squash commit, leaves the
+lease `running` and control at `B`; cleanup still refuses — the commit cannot
+be lost. `record-green` and `integrate` also accept an `integrate-failed`
+lease, so a failed integrate retries after repair. `--apply-to-control`
+refuses when control moved past `B` or holds uncommitted changes on slice
+paths — commit/stash and retry; the batch is untouched. Go is SSOT; never
+ad-hoc git/bash orchestration.
 
 ## Runtime isolation
 
@@ -78,8 +145,8 @@ assign per-slice env (document in the lease or worktree README):
 | Dev server | one process per worktree; never share a listener |
 
 Reusing the control worktree's running server, DB, or compose stack across
-siblings causes cross-slice pollution and flaky proof. Abort if isolation cannot
-be established.
+siblings causes cross-slice pollution and flaky proof. Force serial if
+isolation cannot be established.
 
 ## Host
 

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -83,9 +83,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the bounded advisory-only sentinel once; never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte. Touch
-   `.devrites/CHECKPOINT` so proven slices get local crash-survivable WIP
-   checkpoints for Ship to collapse. **Completion:** valid read-only AFK and checkpoint sentinels exist.
+   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
    `/rite-build` × pending slices → `/rite-prove` → `/rite-polish` →

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -58,9 +58,15 @@ Wright applies anti-slop; root verifies returns and never patches source.
 ## `--parallel N` (opt-in)
 
 Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
-gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
-vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+All-green serial integrate; a red/gap sibling gets a bounded repair round in
+its own worktree — never rebuilt from scratch while budget remains.
+Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
+plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
+repair blocks and preserves everything; `cleanup --force` salvages slice
+branches before removing worktrees — human-gated to abandon a batch,
+orchestrator-emitted only as the salvage step of an automatic frozen-lease
+re-batch.
+AFK charges after integrate only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/generated/claude/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `/rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`/rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`/rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/generated/claude/skills/rite-build/reference/one-slice-cycle.md

@@ -24,8 +24,8 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
-            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
 NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```
 

package/pack/generated/claude/skills/rite-build/reference/parallel-batch.md

@@ -12,8 +12,8 @@ Opt-in only. Default `/rite-build` stays [`one-slice-cycle.md`](one-slice-cycle.
 
 AFK caps `N` by remaining budget. Charge **only after successful integrate**
 (once per integrated green sibling). Abort / integrate-failed → **0**. A
-`running` lease blocks another `/rite-build`. Any present lease blocks
-`parallel create` until cleanup.
+present lease is resumable: `/rite-build` continues it (repair rounds or the
+blocked verdict); `parallel create` refuses until cleanup.
 
 ## Path-disjoint
 
@@ -22,8 +22,9 @@ duplicates, absolutes, `.devrites/**`. Empty pairwise intersection required.
 
 **SSOT:** `devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]`
 (N≥2 only; pass `--root`). Exit `0` → fan-out; else force serial. Inspect-time
-overlap → sibling **gap** → abort. **Failing case:** two parallel wrights share a
-path and fan-out proceeds without that check.
+overlap → sibling **gap** (a shared path is a contract defect). **Failing
+case:** two parallel wrights share a path and fan-out proceeds without that
+check.
 
 ## Control vs workers
 
@@ -44,26 +45,92 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 3. Dispatch ≤10 wrights in parallel (cwd=worktree; allowlist; prove `HEAD==B`).
 4. Inspect + fail-on-red → `green|red|gap`. Independent-review Critical is `gap`
    even when targeted tests are green.
-5. Any red/gap → **abort** (no partial integrate). All green → serial integrate.
-6. Integrate: `transfer_commit` descends from `B`; `` `<base>..<transfer>` ``
-   path-exact; apply in plan order. Conflict → reset to `B`, `integrate-failed`.
-7. Success: FF control; union `touched-files.md`; update state/evidence; AFK +1
-   per integrated sibling; optional `check candidate`.
-8. Cleanup: success removes worktrees/branches. Abort keeps them as repair
-   inputs until the root consumes them: agent-owned plan gaps (AC unchanged)
-   follow [`spec-drift-guard.md`](spec-drift-guard.md) — batch-sweep all
-   siblings' contract assumptions, one folded `/rite-plan repair` + one
-   `/rite-vet` recheck inline, then cleanup and resume Build. Do not emit
-   `Fix: /rite-plan repair`. Product/policy/irreversible-risk still stops.
+5. Non-green siblings → **repair round** (below) in the same worktrees; lease
+   stays `running` — no abort while repair budget remains. A green sibling →
+   `parallel record-green`. No partial integrate. All green → integrate.
+6. Integrate: each `transfer_commit` descends from `B` and diffs path-exact vs
+   `B`; squash-apply all in plan order into one `WIP(<slug>):` commit on the
+   staging branch (Ship collapses it). Conflict → reset to `B`,
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+7. Success: FF control to the squash commit — the batch lands as one local
+   commit, never pushed; union `touched-files.md`; update state/evidence;
+   AFK +1 per integrated sibling; optional `check candidate`.
+8. Cleanup runs only after `integrate` marks the lease `complete` — work
+   landed in control, so `parallel cleanup` removes worktrees/branches.
+   Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
+   removed while the batch may resume. `parallel abort` + `cleanup --force`
+   abandons the batch — the explicit human discard path; the single
+   orchestrator-emitted use is the automatic re-batch under Repair rounds,
+   where it acts as the salvage step only (uncommitted allowlisted changes →
+   slice-branch commit; branches past `B` kept; a failed salvage keeps the
+   worktree) and prints retained refs for the record. `abort` marks the lease
+   only — never rewinds control: a moved HEAD is external work, reported not
+   reset. Never integrate a rejected transfer commit.
+
+## Repair rounds
+
+Rejected work is repaired in place — never discarded and rebuilt from scratch
+while budget remains.
+
+- Record each round as `build-parallel-<batch>-repair-<round>.json`: per
+  non-green sibling — status, verbatim findings, transfer_commit or null.
+- Classify first: **implementation defect** (review Critical on the diff, red
+  wright/proof) → repair wright in the same worktree. **Durable-plan defect**
+  (falsified contract assumption, AC unchanged) →
+  [`spec-drift-guard.md`](spec-drift-guard.md): batch-sweep contract
+  assumptions, one folded `/rite-plan repair` + one `/rite-vet` recheck
+  inline, resume repair in the same worktrees under the amended contract;
+  never emit `Fix:`. **Frozen-lease scope defect** — the amended contract or
+  a review requirement needs paths outside a slice's allowlist, or re-slices
+  the plan (a lease is immutable once written: its allowlists are the
+  disjointness guarantee) → **automatic re-batch, no human gate**:
+  `parallel cleanup --force` as the salvage step, record the retained refs in
+  the repair-round artifact, `parallel create` a fresh batch from control
+  `HEAD` under the corrected decomposition. Prior attempts stay reachable —
+  hand each new wright the salvaged branch ref
+  (`devrites/parallel/<slug>/<old-batch>/<slice>`) so it builds on what worked
+  instead of starting blind. If no corrected decomposition exists, that is
+  exhaustion → blocked, preserve, STOP. **Reviewer stall/cancel or missing
+  verdict** → re-dispatch the reviewer, not the wright. **Product/policy/
+  irreversible** → stops for the human.
+- Dispatch a fresh `devrites-slice-wright` (cwd = the sibling's worktree, same
+  allowlist and host rules as step 3 — siblings may repair in parallel) with
+  the original contract + verbatim findings + "preserve what works; fix the
+  named findings; return a new `transfer_commit`". Never reset the worktree
+  to `B` — that destroys the work under repair. The commit must still descend
+  from `B` and diff path-exact vs `B`.
+- Each repair return re-runs the full gate chain: inspect, fresh doubt +
+  test-analysis, approved proof.
+- Budget: the shared causal-fingerprint cap — three total failed attempts per
+  sibling per fingerprint (build + repairs count together); a distinct
+  Critical is a new fingerprint. Exhaustion is not abort: record one
+  technical blocker (`Status: blocked`; `Next step: none — technical recovery
+  exhausted for <fingerprint>; requires new evidence or changed failure
+  conditions`), preserve lease/worktrees/branches, STOP — same fingerprint
+  stays blocked on reinvoke; new evidence resumes repair in place. Human-
+  owned decisions use the drift-guard question and wait.
 
 ## Engine verbs
 
 ```text
-devrites-engine parallel create|record-green|abort|integrate|cleanup|status
-devrites-engine parallel lease-write|lease-read|lease-clear
+devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
+devrites-engine parallel status --root <repo> --slug <slug>
+devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>
+# abandoning the batch is human discard only; a frozen-lease re-batch may emit
+# cleanup --force as its salvage step (see Repair rounds):
+#   parallel abort --root <repo> --slug <slug>
+#   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-Go is SSOT. Skill calls the engine — never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages the squash commit, leaves the
+lease `running` and control at `B`; cleanup still refuses — the commit cannot
+be lost. `record-green` and `integrate` also accept an `integrate-failed`
+lease, so a failed integrate retries after repair. `--apply-to-control`
+refuses when control moved past `B` or holds uncommitted changes on slice
+paths — commit/stash and retry; the batch is untouched. Go is SSOT; never
+ad-hoc git/bash orchestration.
 
 ## Runtime isolation
 
@@ -78,8 +145,8 @@ assign per-slice env (document in the lease or worktree README):
 | Dev server | one process per worktree; never share a listener |
 
 Reusing the control worktree's running server, DB, or compose stack across
-siblings causes cross-slice pollution and flaky proof. Abort if isolation cannot
-be established.
+siblings causes cross-slice pollution and flaky proof. Force serial if
+isolation cannot be established.
 
 ## Host
 

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -83,9 +83,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the bounded advisory-only sentinel once; never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte. Touch
-   `.devrites/CHECKPOINT` so proven slices get local crash-survivable WIP
-   checkpoints for Ship to collapse. **Completion:** valid read-only AFK and checkpoint sentinels exist.
+   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `$rite-spec` →
    `$rite-clarify` → `$rite-temper` → `$rite-define` → `$rite-vet` →
    `$rite-build` × pending slices → `$rite-prove` → `$rite-polish` →

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -58,9 +58,15 @@ Wright applies anti-slop; root verifies returns and never patches source.
 ## `--parallel N` (opt-in)
 
 Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
-gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
-vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+All-green serial integrate; a red/gap sibling gets a bounded repair round in
+its own worktree — never rebuilt from scratch while budget remains.
+Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
+plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
+repair blocks and preserves everything; `cleanup --force` salvages slice
+branches before removing worktrees — human-gated to abandon a batch,
+orchestrator-emitted only as the salvage step of an automatic frozen-lease
+re-batch.
+AFK charges after integrate only. Running lease blocks another
 `$rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/generated/codex/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `$rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`$rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`$rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `$rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.

package/pack/generated/codex/skills/rite-build/reference/one-slice-cycle.md

@@ -24,8 +24,8 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
 PROVE     → root: required build/browser/E2E, then returned-diff/path review; fail-on-red
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
-(CHECKPOINT) → orchestrator: if .devrites/CHECKPOINT is set, commit the proven slice
-            local-only as WIP(<slug>) with a [devrites-context] body → survives a crash (checkpoint.md)
+(CHECKPOINT) → orchestrator: commit the proven slice local-only as WIP(<slug>)
+            with a [devrites-context] body → clean tree, survives a crash (checkpoint.md)
 NEXT      → HITL root reports and stops; AFK root may repeat only under afk-discipline.md
 ```