devrites 5.3.0 → 5.5.0

package/pack/.claude/skills/devrites-doubt/SKILL.md

@@ -27,7 +27,7 @@ code · claiming "this is safe", "this scales", or "this matches the spec".
   issues but classify **zero** as actionable, the review is too agreeable. Sharpen the
   prompt or use a fresh reviewer. Accept a clean pass only after a genuine attempt to
   disprove the claim.
-- [ ] **5. STOP**: met a stop condition (only trivial findings, no open fingerprint has budget left, the distinct-findings ceiling, or user override). Emit a **binary gate verdict** the orchestrator must clear: **accept** (no valid-&-actionable findings remain) or **reject + the specific required changes**. On reject, the orchestrator loops the wright on those changes before the slice is accepted. Account per finding, not per round: a reject citing a genuinely new defect is progress and the loop continues; a reject re-citing a fingerprint the wright already failed on is no-progress and burns that fingerprint's budget. A finding that only refines a clause a prior cycle already pinned may close as an explicit bounded declared residual. Ceiling: three distinct actionable findings on one decision mean the decision resists repair — classify by decision ownership: human-owned product/risk uncertainty escalates; objective required changes become a technical blocker, never a retry-authorization question.
+- [ ] **5. RETURN**: emit a binary gate verdict: **accept** only when no valid-&-actionable findings remain, otherwise **reject + every supported required change**. The caller folds the complete inventory before one bounded correction and owning-reviewer recheck, including affected dependencies and correction-created regressions. Recovery and stops follow only [the canonical retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve). A distinct evidenced Critical/Important is progress; refining or renaming the same failed mechanism is not. An explicit bounded residual may close a refinement only when the accepted contract permits it and no actionable failure remains; never waive a new failure mode.
 
 ## Deletion-test lens (for "is this abstraction load-bearing?" doubts)
 
@@ -60,22 +60,14 @@ Wait for a second real caller before keeping a pass-through that fails this test
 
 ## AFK exception
 
-When `.devrites/AFK` exists and the user is away, `escalated to user` is unavailable in
-real time. Map the verdict to a `questions.md` entry instead of a synchronous prompt:
-
-- **Findings classified `valid trade-off`, `noise`, or `contract misread`**: append a
-  `questions.md` entry with `gate: advisory`, record the trade-off in `decisions.md`, and
-  proceed with the best inference. The advisory is surfaced by `/rite-status` so the user
-  sees it on return.
-- **Any `valid & actionable` finding, OR the claim touches destructive migration,
-  auth/authz boundaries, public APIs, irreversible data writes**: append a
-  `questions.md` entry with `gate: blocking`, set `state.md` `Status: awaiting_human`,
-  fire the `notify:` hook, and STOP. AFK never silently accepts irreversible risk.
-
-The same bounds apply in AFK. Once no open fingerprint has budget left or the
-distinct-findings ceiling trips, human-owned uncertainty becomes a blocking
-question; an unresolved objective technical finding becomes `Status: blocked` with its exact
-required changes and `/rite-plan unblock`, regardless of AFK config.
+Apply [decision ownership and AFK gates](../devrites-lib/reference/standards/afk-hitl.md#afk-exception-for-discretionary-pauses).
+Accepted in-scope technical findings return to the caller for authorized repair;
+they block acceptance until verified, not continuation by themselves. Record
+trade-offs and rejected findings with reasons in the existing decision record.
+Human-owned uncertainty, missing authority/access, and irreversible-risk choices
+retain their blocking question and pause. Exhausted technical recovery preserves
+the reproduction and blocked cursor prescribed by the canonical retry contract;
+it never becomes a request for permission to retry.
 
 ## Output
 ```

package/pack/.claude/skills/devrites-lib/reference/candidate-integrity.md

@@ -1,43 +1,42 @@
 # Candidate integrity
 
-This file owns the Build-to-Ship lifecycle for one content-bound candidate. The
-exact `touched-files.md` and binding grammar remain in
-[`workspace-artifact-schema.md`](workspace-artifact-schema.md); phase skills link
-here and state only their phase action.
-
-`devrites-engine check candidate <slug>` is the only candidate hash authority.
-A missing, duplicate, malformed, or mismatched binding stops the lifecycle.
+Manifest and binding grammar remain in
+[`workspace-artifact-schema.md`](workspace-artifact-schema.md).
+`devrites-engine check candidate <slug>` alone hashes candidates.
+Missing/duplicate/malformed/mismatched bindings block.
 
 ## Lifecycle
 
-- **Build maintains** the authoritative manifest from each green slice's actual
-  scoped diff. It may change until Polish closes the candidate.
-- **Prove binds** approved real proof to one digest. Check the candidate before
-  commands and again after them; the digest must be identical and proof must not
-  mutate candidate sources. Record it in evidence and browser evidence when present.
-- **Polish closes** the candidate only after every code/UI correction, capability
-  fold, optional design-memory update, and durable ADR promotion. Update the
-  manifest for every such path; a digest change requires affected real re-proof
-  and refreshed evidence/browser bindings before Review.
-- **Review binds** all immutable reviewers and `review.md` to the same closed
-  digest. A candidate correction updates the manifest and returns through affected
-  Prove, then a fresh Review.
-- **Seal binds** `seal.md` to that reviewed digest, rechecks every binding, then
-  runs `devrites-engine check seal <slug>`. A correction returns through Prove and
-  Review before Seal runs again.
-- **Ship is candidate-read-only.** It may update workspace ship/state/archive
-  bookkeeping, but any project or manifest mutation returns through Prove,
-  Review, and Seal. Git integrity uses the canonical digest; it never implements
-  another candidate hash.
+- Build maintains actual scoped `present`/`deleted` manifest rows.
+- Prove binds approved real proof in evidence/browser artifacts; candidate checks
+  before/after commands match; no source mutation.
+- Polish closes only after code/UI corrections, capability folds, design-memory
+  updates and ADR promotion; update manifest/affected proof for every path.
+- Review binds reconciled coverage to that closed digest; corrections return
+  through affected Prove and fresh affected reviewers.
+- Seal binds the reviewed digest, rechecks bindings, runs `devrites-engine check seal <slug>`.
+- Ship is candidate-read-only; bookkeeping only; source/manifest changes return through Prove,
+  Review, Seal. No alternate hash implementation.
 
-## Existing workspaces
+## Evidence validity
+
+Verify evidence, scope/criterion, source, dependencies, configuration, environment, toolchain, command/cwd,
+prerequisites, and decisive result as applicable. Unknown provenance blocks; source
+hash alone is insufficient. External or time-sensitive observations rerun under
+current authority. Required feature proof cannot substitute slice results.
 
-An older unfinished workspace must refresh the manifest and rerun real proof before
-continuing. Upgrade routes a released-workspace candidate defect to Prove only after its
-read-only assessment cites the current contract and exact defect. Prove may refresh from
-unambiguous legacy scope and currently observed project bytes, then writes fresh bindings.
-Never synthesize a historical pass or infer old bytes. There is no legacy fallback.
+Same-candidate accounts may be cited when permitted. Corrections require
+new candidate checks, affected real proof and fresh affected exact reviewers for
+all open findings and dependency/regression closure, including newly triggered roles.
+Changed contracts or uncertain closure require a full applicable pass.
+Unchanged sub-scope needs explicit unchanged-input/dependency justification and a
+link to original evidence. Never relabel an old candidate-bound account.
+Keep one current aggregate binding; never copy a historical binding line, even quoted. Root reconciles complete coverage and binds
+it anew. Missing coverage blocks; required roles, criteria, proof and authority remain.
+
+## Existing workspaces
 
-Normal Polish rollups and re-proof, Review, and Seal follow when their current gates
-apply. Upgrade re-audits afterward; a failed candidate, seal, or readiness check remains
-a gap. Exact manifest and binding grammar stays in the workspace schema above.
+Upgrade routes a released-workspace candidate defect to Prove with a cited
+current-contract defect and unambiguous legacy scope/bytes: refresh the manifest and rerun real proof.
+Never synthesize a historical pass or bytes; no legacy fallback. Unknown bindings
+require full refresh. Apply Polish/Review/Seal; Upgrade re-audits. Failed gates block.

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -1,6 +1,6 @@
 # Native review dispatch
 
-Host dispatches; DevRites governs.
+Host dispatch; DevRites governs.
 
 ## Roster
 
@@ -29,6 +29,10 @@ If the candidate diff has no matching surfaces, record
    Parallelize only when writes/state/locks/tool sessions/scarce resources
    (ports/processes/quotas/FDs/browsers/MCP) are compatible. Frozen read-only
    usually is; pressure requires batches or serial work.
+   One fresh-context preflight before fan-out checks host configuration/evidence for
+   inherited history/memory/sibling summaries. Use supported clean-context settings;
+   unverified independence is a gap. Do not launch a probe agent per task;
+   still validate each result's context and candidate.
 2. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
 3. Every dispatch reaches a terminal classification before reconciliation:
@@ -41,8 +45,8 @@ If the candidate diff has no matching surfaces, record
 4. Apply [`agents.md` § Result admission](standards/agents.md#result-admission)
    and dedupe by evidence/root cause. Account for all seven in
    `review.md`/`seal.md`: `Outcome:` plus admitted account, or
-   `Not-applicable: <inspected-scope reason>`. Spec/Code may cite unchanged
-   `review.md`; persist no dispatch telemetry.
+   `Not-applicable: <inspected-scope reason>`. Spec/Code may cite valid unchanged
+   `review.md` under [evidence validity](candidate-integrity.md#evidence-validity); persist no dispatch telemetry.
 5. Missing profile, null/failure, or malformed output is a `gap`; never
    infer approval or substitute inline review.
 
@@ -53,15 +57,10 @@ Capacity rejection is backpressure: retry batches; never shrink a roster.
 
 ## Scale limits
 
-Review rosters are bounded by the role table above, not by agent count. Beyond
-roughly four concurrent read-only reviewers (eight only when each owns disjoint
-paths and resources), added reviewers re-read the same material, return
-overlapping findings, and make reconciliation the bottleneck: cost grows linearly,
-discriminable signal does not. DevRites therefore refuses unbounded swarms — more
-agents never substitute for a required role, and a task needing "more reviewers"
-needs a sharper scope or a second bounded pass instead. **Failing case:** an
-eight-agent mesh with no per-agent path ownership returns conflicting edits and
-duplicated findings that no roster can reconcile.
+The role table bounds rosters. Use roughly four concurrent read-only reviewers;
+eight only with disjoint paths/resources. Refuse unbounded swarms and role
+substitution: sharpen scope or use a bounded second pass when coverage is missing.
+Overlapping reviewers increase duplicate findings and reconciliation work.
 
 ## Children are tools, not peers
 

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -59,6 +59,9 @@ expires_at: "<ISO-8601 UTC timestamp>" # absolute unattended-authority expiry
 # max_cost_usd: 10                   # optional stricter host-observed cost cap
 notify: "ntfy.sh/my-topic"           # shell command; examples: rite-build/reference/afk-discipline.md
 allow_gates: [advisory, validating]  # gate severities AFK auto-handles (auto-picks the recommended option)
+continue_sequence: true              # after Seal GO, open the next recorded continuation
+max_workspaces: 5                    # workspaces one armed sequence may open
+max_parallel: 10                     # cap on eligible path-disjoint Build batches (1 = serial)
 ```
 
 The file is **read-only config**: never rewritten in place. `max_slices` is the initial
@@ -79,6 +82,49 @@ existing counter may be lowered but never increased or reinitialized. Once prese
 counter is the effective remaining budget even when the read-only sentinel omits
 `max_slices`.
 
+### Sequence continuation (`continue_sequence`, `max_workspaces`)
+
+`continue_sequence: true` lets one armed run open the next **recorded** continuation
+after a `Seal GO` instead of stopping. Absent means `1` — the current workspace only;
+an existing sentinel never receives the default implicitly. `max_workspaces` is the
+sequence budget (nonnegative decimal, fail closed): spend one when a new workspace is
+opened, never when resuming the current one. `max_slices` stays **per workspace** —
+each new workspace's `state.md` seeds its own `afk_slices_remaining`.
+
+The chain lives in root-owned `state.md` cursor fields, not in chat:
+`sequence_parent` (the immediately preceding workspace slug), `sequence_position`
+(1-based ordinal), `sequence_workspaces_remaining` (slots the chain may still
+open after this workspace), and — on the release milestone only —
+`sequence_role: release`. Seeding is exactly-once because the values are
+derived, not remembered: a continuation's fields are computed from its recorded
+parent and the parent's counter at creation, and a resumed run that finds a
+continuation workspace missing the fields re-derives the same values from its
+`brief.md` parent/position plus the parent's counter — never a second charge. A
+workspace without a recorded parent/position is not a sequence member; the
+counter only decreases, malformed values fail closed, and `0` opens nothing.
+`sequence_role: release` makes `check candidate` and `check seal` require the
+candidate manifest to cover the whole recorded chain — run
+`devrites-engine state merge-manifest <slug>` before Prove.
+
+- Only continuations recorded in the parent's `decisions.md` sequence
+  ([slicing.md § Continuation workspaces](../../../rite-plan/reference/slicing.md#continuation-workspaces))
+  qualify; no recorded next entry, or the cap/expiry/review-queue bound reached, stops
+  with the winning reason.
+- Milestones are **not** shipped: they stay sealed and unarchived in `.devrites/work/`
+  with `Next step: /rite-ship` preserved. Per-slice `WIP(<slug>)` checkpoints still
+  land locally ([checkpoint.md](../../../rite-build/reference/checkpoint.md)), so the tree
+  stays clean and crash-safe.
+- Git stays human-gated. The release ship is one disclosed plan, one literal `GO`, and
+  one native approval; it collapses the sequence's `WIP` commits into the single
+  release commit and may archive the sealed predecessors.
+- Every human-owned, safety, access, exhaustion, and `NO-GO` condition still stops the
+  run exactly as without this field.
+
+`max_parallel` caps a Build batch for unattended runs; `1` forces the serial cycle.
+Unattended runs take the largest eligible set ≤ cap and recompute after every integrate
+([parallel-batch.md § Dynamic selection and re-batching](../../../rite-build/reference/parallel-batch.md#dynamic-selection-and-re-batching));
+an explicit `/rite-build --parallel N` cap wins for that invocation.
+
 ## Unattended resource envelope
 
 AFK writer admission needs a bounded input queue, effective slice cap, and valid
@@ -258,65 +304,72 @@ When `/rite-resolve` does resume a stopped session, the skill does **not** auto-
 
 ## AFK exception for discretionary pauses
 
-`devrites-doubt` and similar skills that "ask the user" follow this rule when
-`.devrites/AFK` exists:
+With `.devrites/AFK`, apply decision ownership first. Accepted in-scope technical
+corrections return to the caller for repair/verification; severity blocks acceptance,
+not authorized repair. Never silently accept a defect or broaden existing approval.
 
-Ceiling comparison order: Suggestion/Nit/FYI < Important < Critical; gates advisory <
-validating < blocking < escalating; a finding is ≤ the ceiling when its severity's gate
-class (Suggestion/Nit/FYI→advisory, Important→validating, Critical→blocking) is at or
-below the slice's gate.
+Discretionary ceilings apply only to
+human-owned trade-off/risk decisions; accepted technical corrections do not enter
+these branches. Compare Suggestion/Nit/FYI→advisory, Important→validating,
+Critical→blocking against advisory < validating < blocking < escalating:
 
-- Finding severity ≤ slice's gate ceiling (slice's `Gate:` plus `.devrites/AFK`
-  `allow_gates`) → log to `questions.md` as `gate: advisory`, record the trade-off in
-  `decisions.md`, proceed.
-- Finding severity > gate ceiling, OR finding touches the irreversible-risk list →
-  log to `questions.md` as `gate: blocking`, set `state.md` `Status: awaiting_human`,
-  fire `notify:`, STOP.
+- Within the slice's `Gate:` and `.devrites/AFK` `allow_gates`: record advisory in
+  `questions.md`, trade-off in `decisions.md`, proceed.
+- Above ceiling, missing authority, or unapproved irreversible risk: record blocking
+  question, `Status: awaiting_human`, fire `notify:`, STOP.
 
-The loop limits of the calling skill still apply. At the limit, classify the unresolved
-finding by the decision-ownership rule above: human-owned uncertainty becomes a blocking
-question; an objective technical finding becomes a recorded blocker with its required
-changes, not a request for permission to retry.
+Recovery uses only the [retry contract](#retry-cap-no-progress-loops-and-self-resolve).
 
 ## Retry cap, no-progress loops, and self-resolve
 
-- **Fingerprint the failed invariant, not the review round.** An exact causal
-  fingerprint is the owning gate/invariant plus its minimal reproduction and
-  decisive failure signal. A new DEC/DRIFT number, changed line number, reviewer
-  wording, or splitting one finding does not create a new fingerprint.
+Owns all phase recovery, including Doubt/Vet/serial/parallel Build. Resource,
+access, safety and irreversible-action boundaries independently stop work.
+
+- **Fingerprint the failed invariant, not the review round.** Identify owning
+  invariant + defect mechanism + minimal reproduction/decisive failure signal.
+  DEC/DRIFT IDs, line numbers, wording and splitting one cause create no new budget.
 - **Cap no-progress retries:** three no-progress attempts per exact causal fingerprint
-  across wright and recovery is a hard cap. Only a repair whose narrow recheck
-  leaves that fingerprint open or reproduces the same decisive failure consumes
-  an attempt. Closing a prior finding with discriminating evidence is progress:
-  mark that fingerprint resolved and do not charge it as no-progress. A genuinely
-  new Critical or Important finding with a different failed invariant and exact
-  evidence gets its own fingerprint and budget; Suggestion, Nit, FYI, or renamed
-  evidence cannot open, reset, or extend recovery.
-- **Separate consumptive authority from recovery.** Spending a one-shot action's
-  authorization forbids another real execution but does not consume the offline
-  recovery budget for a newly evidenced fingerprint. The retained artifact starts
-  caller-owned diagnosis and correction immediately; only the next consumptive
-  execution waits for fresh authorization.
-- **Persist accounting in existing records.** Record each fingerprint,
-  reproduction, attempted correction, `progress: resolved|no-progress`, and
-  decisive result in `drift.md` and `evidence.md`. Cold resume derives the count
-  from those records. There is no recovery counter file or command.
-- **Reconcile before honoring a terminal cursor.** A persisted distinct
-  Critical/Important fingerprint with retained evidence and fewer than three
-  recorded no-progress corrections still has recovery budget, even when an older
-  `state.md` says `Next step: none`. Resume it; do not treat session age or the
-  prior action's spent authorization as exhaustion.
+  across wright/recovery. Only a correction whose narrow recheck leaves that cause
+  open or reproduces its failure consumes an attempt.
+  Closing a prior finding with discriminating evidence is progress: resolve it,
+  do not charge. A new Critical or Important finding gets its own budget only for
+  a distinct evidenced cause. The same invariant with a different evidenced mechanism qualifies;
+  renaming/splitting an unchanged cause does not. Suggestion/Nit/FYI cannot extend
+  recovery. Initial discovery and expected test-first RED are not corrections;
+  total rounds, re-batches and distinct-finding counts never exhaust recovery.
+- **Rechecks are scoped; late findings never reopen the round.** *Late* applies only
+  from a phase's **second** review pass (Vet 1b, Build's recheck after the first repair,
+  Review step 7); an initial pass has no late findings and every supported finding is
+  folded normally. A recheck packet
+  names the open fingerprints, the correction diff, and the dependents of each
+  changed clause/hunk; the owning reviewer's verdict covers exactly that. A finding
+  on text/code unchanged since that role's previous pass is *late*: Critical with a
+  concrete failure path → new fingerprint under this budget; otherwise recorded
+  (Plan/Vet: `eng-review.md` `## Deferred findings`; Build: `touched-files.md`
+  `## Review trail`) with severity · site · role · kind · round, and consumed by the
+  next full-inventory gate (Vet `mechanism` → one `test-plan.md` proof row; Build →
+  the `/rite-review` roster) — never by another repair round in this phase. Review
+  closes every deferred row with a labeled verdict; Seal blocks on any without one.
+  **Failing case:** round 4 finds three Important items on clauses untouched since
+  round 1 and dispatches another repair.
+- **Separate consumptive authority from recovery.** Spent one-shot authorization
+  blocks another execution, not offline recovery. Retained evidence starts caller-owned
+  diagnosis/correction immediately; the next consumptive execution needs fresh authority.
+- **Persist existing records.** Put fingerprint, reproduction, correction,
+  `progress: resolved|no-progress` and decisive result in `drift.md` and `evidence.md`.
+  Cold resume derives counts there; no new counter file/command.
+- **Reconcile terminal cursors.** Retained distinct Critical/Important evidence below
+  cap resumes despite stale `Next step: none`; age/spent action authority is not exhaustion.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"unattended root reaches current admitted Workflow Artifact work","action":"invoke classifier; execute returned route without wright/slice charge","return":"saved lifecycle phase/action; no intermediate reply"} -->
-- **Classify exhaustion:** human-owned contract/risk/access gaps open their gate. Otherwise
-  preserve reproduction/dead ends, set `Status: blocked` and `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`.
-  Do not emit `/rite-plan unblock`, another phase command, a question, or
-  `/rite-resolve`. Reinvocation with the unchanged fingerprint remains blocked
-  and never resets the retry cap.
-- **Resolve agent-owned questions first.** Before raising a question, try to answer it from the code, the docs,
-  or `decisions.md`. Communicate only for a blocked environment, a deliverable to hand over,
-  critical info you genuinely can't access, or a credential / permission you lack — never for
-  writing code, writing tests, or reviewing; the agent's own work is not a valid human gate.
-  This narrows needless pauses and never weakens the blocking / escalating / irreversible gates.
+- **Classify exhaustion:** human-owned contract/risk/access gaps open their gate.
+  Otherwise preserve reproduction/dead ends, set `Status: blocked` and
+  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`.
+  Emit no phase command, retry-permission question or `/rite-resolve`.
+  Reinvocation with unchanged cause stays blocked; it never resets the cap.
+- **Resolve agent-owned questions first** from code/docs/decisions. Human communication
+  is for blocked environment, handover, inaccessible critical information or missing
+  credentials/permission—not writing, testing or review. Blocking/escalating/
+  irreversible gates remain.
 
 ## What the rule does NOT cover
 

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -51,6 +51,7 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 ## Independence
 
 - A fresh result sees scope/paths-diff/rubric only — never another result's or the root's conclusions, severities, expected verdicts, or edited context; seeding voids the packet.
+- **Verify the packet is clean before admitting the account.** Confirm the returned packet/trace carries no host-injected context: an automatic memory/summary banner naming an earlier phase verdict (e.g. `past Temper PASS … next is /rite-define`) or harness reminder text seeds the pass and voids it. Cancel that account — never admit it — name the lost coverage, and re-dispatch with the host's context injection disabled for that child. Tool config changes that do not stop native child auto-injection are not a fix; verify on the next spawn instead of assuming.
 - A parent-context pass contributes attributed evidence but is not independent: exclude it from independent accounting and name the lost coverage.
 - Final severity is set at reconciliation after re-verifying the claimed consequence at the cited site (reviewer severity advisory); dismissals record a reason, and true facts about neighboring code route elsewhere instead of being dismissed.
 - Conflicting required results are arbitrated by re-verifying evidence at the site; the deciding evidence is recorded, truly unresolved conflicts stay open blockers. Two results describing the same defect merge only when both defect and fix path match; otherwise the more conservative classification stands, and severity never widens without new site evidence — an overridden or demoted finding stays visible with the reason, never silently merged away.

package/pack/.claude/skills/devrites-lib/reference/standards/context-hygiene.md

@@ -1,25 +1,52 @@
 # Context hygiene
 
-Long conversations degrade an agent's reasoning. End phases cleanly, persist important
-state to disk, and start the next phase in a fresh context.
-
-The feature workspace stores the next session's authority; chat memory does not.
+Persist phase results before starting fresh. The feature workspace, not chat memory,
+stores continuity.
 
 ## Working-set rule
 
-Long tool histories can displace important facts and retain failed attempts. Act at 50%
-to 70% context use, keep one task's working set small, and load only what the current
-step needs. The workspace, not a summary, is the source of truth.
+Act at 50% to 70% context use; load only the current task's working set. The
+workspace, not a summary, is the source of truth.
 
 - **Count before viewing:** on a search hit list, read match counts first (`grep -c`,
-  match summaries) and open only the files a one-line answer needs; dumping whole
-  files for a one-line question is common waste.
+  match summaries), then open relevant files.
 - **Cut before load, not after.** Drop low-signal files, prior-turn dumps, and
-  duplicate index queries before they enter context. Truncating a bloated window
-  after the fact is not an efficiency strategy — the cost is already paid.
+  duplicate index queries before loading; later truncation cannot undo that cost.
   **Failing case:** five whole-file reads, then `/compact`, treated as cost control.
 
-**Compaction-preservation directive.** If the harness compacts mid-feature, read `.devrites/ACTIVE`, then reload the `state.md` cursor, open `questions.md` gates, durable `decisions.md`, and `test-plan.md`/`evidence.md` proof pointers. Session hooks normally restore these; this is the fallback when no hook fires.
+## Dispatch packets
+
+Give each role the exact candidate identity, scope, applicable contract/decision IDs,
+all open findings, relevant tests/evidence, and anchored/hashed read-next paths. Read
+owning text and dependencies: IDs/digests are not semantic evidence. Exclude whole
+histories, duplicates, and raw transcripts from initial packets. Inspect serialized byte size
+and long lines; line counts alone are insufficient. Within the host budget
+and working-set rule, split retrieval rather than truncate active obligations.
+Broaden retrieval when dependency boundaries are unknown.
+
+Packets are **by reference**: project-relative path + SHA-256 + line anchors
+(`path:start-end`) for every input; the reviewer reads the live file. Inline only the
+excerpt a finding or claim needs, ≤ 4 KiB each. Never inline whole workspace artifacts,
+standards/skill files (name the path; the role reads it), foreign documents, prior
+packets, or another role's account. A serialized packet stays ≤ 64 KiB; larger means
+the scope is wrong — split by anchor-disjoint cluster, never truncate. Persist packets
+and admitted accounts under `.devrites/work/<slug>/packets/`; once a round's account
+is recorded in its owning artifact, packets older than the last closed round may be
+deleted. Never persist agent transcripts, traces, or
+`session_init` dumps anywhere in `.devrites/`. Bulk raw proof output stays outside
+`.devrites/work/`; `evidence.md` records the command, decisive lines, and that path.
+**Failing case:** a 4 MiB `vet-review-input.json` embedding `tasks.md`, the spec, six
+standards files, and a 2 MiB source document as `entries`, plus a 10 MiB
+`vet-review-audit.json` of agent traces beside it.
+
+Keep closed findings in immutable history/regressions; recheck those affected by
+changed contracts, implementation, proof, or dependencies, not every prior generation.
+Required review rosters and final proof remain. Preserve protected history unchanged;
+a compact current view references originals without omitting active requirements.
+
+**Compaction fallback:** when hooks do not restore context, read `.devrites/ACTIVE`,
+then the `state.md` cursor, open `questions.md` gates, `decisions.md`, and
+`test-plan.md`/`evidence.md` proof pointers.
 
 ## Authority and trust
 
@@ -39,15 +66,11 @@ Apply [`core.md` § Precedence](core.md#precedence); authority and evidence diff
 
 | Use `/clear` (default) when | Use `/compact` when |
 |---|---|
-| The current phase is done and its outputs are on disk (the common DevRites case). | You need to keep mid-flight reasoning that hasn't yet been written to the workspace. |
-| Next phase reads workspace files anyway (every `rite-*` does). | The remaining work is small and continuation beats restart. |
-| The chat is dominated by tool outputs (file reads, diffs, test logs, browser snapshots). | A drift or doubt loop is mid-flight and the trade-off discussion isn't yet recorded. |
-| You hit a wrong path that needs unwinding: fresh start beats arguing with stale context. | A user clarification just landed that materially changes the next phase. |
+| Phase results are persisted; the next phase reads them. | Important mid-flight reasoning is not yet persisted. |
+| Tool output or a wrong path dominates context. | Small remaining work, unrecorded drift/doubt discussion, or fresh clarification favors continuity. |
 
-**Default to `/clear`.** Use `/compact` only when the workspace does not capture
-important continuity. When in doubt, write the missing decision /
-assumption / question to the canonical file (`/rite-handoff` does this in one step),
-then `/clear`.
+**Default to `/clear`.** First persist missing decisions, assumptions, or questions
+to their owners (`/rite-handoff`); `/compact` preserves unrecorded continuity.
 
 ## The "Session hygiene" footer (every rite-* output)
 
@@ -82,8 +105,5 @@ handoff.
 
 ## The handoff bridge
 
-When the user is leaving for a long break rather than moving directly between phases, `/rite-handoff`
-is safer than `/clear` alone because it syncs chat-only context into the canonical
-workspace files **before** the reset, then the user can `/clear` (or even close the
-session) without losing anything. The session-hygiene footer points at `/rite-handoff`
-when the gap to the next session is likely > a few hours.
+For a break longer than a few hours, point the footer at `/rite-handoff`: persist
+chat-only context to canonical files before clearing or closing the session.

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -42,7 +42,7 @@ Repository conventions follow [Precedence](#precedence).
 
 ## Lifecycle rest points
 
-Before advancing a phase, run `devrites-engine check readiness <slug>` for structure (semantics belong to exact agents/checklists). Standalone rites persist and stop on block; under a controlling caller, agent-owned technical blocks return backward as a nested phase boundary, not a user-facing handoff. `/rite-seal` runs `devrites-engine check seal <slug>` for structure/freshness, not prose. HITL/blocked stops follow [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
+Before advancing a phase, run `devrites-engine check readiness <slug>` for structure, including artifact budgets (semantics belong to exact agents/checklists). Standalone rites persist and stop on block; under a controlling caller, agent-owned technical blocks return backward as a nested phase boundary, not a user-facing handoff. `/rite-seal` runs `devrites-engine check seal <slug>` for structure/freshness, not prose. HITL/blocked stops follow [Persistence before stopping](#persistence-before-stopping-handoff-discipline).
 
 ### Gate contract