devrites 5.4.0 → 5.5.0

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -1,67 +1,87 @@
 # rite-build phase contract
 
-See [`one-slice-cycle.md`](one-slice-cycle.md); candidate lifecycle is
+Apply [`one-slice-cycle.md`](one-slice-cycle.md) and
 [`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
-Opt-in `--parallel N` uses [`parallel-batch.md`](parallel-batch.md) instead of steps 2–8.
-Spec Drift Guard still applies on abort or plan-gap.
+Opt-in `--parallel N` replaces steps 2–8 with [`parallel-batch.md`](parallel-batch.md);
+Spec Drift Guard still applies.
 
-1. **Orient and gate.** Read core, `.devrites/ACTIVE`, `state.md`, and required
-   slice artifacts. Require `Implementation readiness: READY`, its current
-   `Readiness inputs SHA-256`, all applicable exact reviewer accounts,
-   ID-and-meaning traceability, and green proof preflight; run
-   `devrites-engine check readiness <slug>`. Any miss/nonzero stops.
-2. **Select one target.** Restate goal, acceptance criteria, exclusions, and exact
-   source/test paths. Reconcile the spec/plan applicability map and include only the
-   triggered topology/data/integration standards plus their named failure/recovery/proof
-   cases in the writer contract. Before dispatch, validate relevant `assumptions.md` rows
-   against live evidence. If one is disproved and changes acceptance, architecture,
-   scope, or proof, use the Spec Drift Guard/plan recovery; a human-owned unknown
-   stops. Resolve HITL before source work. AFK answers only permitted gates;
-   human-owned or irreversible risk persists a question and stops for `/rite-resolve`.
-   If the target is an exact Vet-ready Workflow Artifact set, apply
-   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md)
-   instead of treating it as a product slice.
-3. **Dispatch or transact.** Product source/tests apply [`wright-dispatch.md`](wright-dispatch.md).
-   Put the smallest exact project-relative source/test path list directly in the task;
-   dispatch the exact `devrites-slice-wright` fresh. Root never writes those product
-   paths, wright never widens, and a missing profile stops.
+1. **Gate.** Read core, `.devrites/ACTIVE`, then `devrites-engine orient <slug>`
+   and the Build read-next in
+   [`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md#read-next-by-phase):
+   the selected slice via `devrites-engine observe slice <slug> <SLICE-ID>`, not whole
+   `tasks.md`; over-budget or `bulk_files` artifacts are read by anchor only. Require
+   `Implementation readiness: READY`, current `Readiness inputs SHA-256`, exact
+   required accounts, ID/meaning traceability and green proof preflight.
+   Run `devrites-engine check readiness <slug>`; any miss/nonzero blocks.
+2. **Select.** Pick the lowest pending slice whose `depends_on` are all built, using
+   `orient` `task_graph.slices` plus the `state.md` built list — never by scanning
+   `tasks.md`; then `observe slice` it. Restate its goal, ACs, exclusions and exact paths. Include
+   applicable topology/data/integration invariants and failure/recovery/proof cases.
+   Verify relevant assumptions live; falsified acceptance/architecture/scope/proof
+   routes through Spec Drift Guard. Resolve human-owned/irreversible gates before
+   source work; AFK follows its ceiling. Vet-ready Workflow Artifacts use
+   [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md).
+3. **Dispatch.** Apply [`wright-dispatch.md`](wright-dispatch.md). Put the smallest
+   exact project-relative source/test path list directly in the task;
+   dispatch the exact `devrites-slice-wright` fresh. Root never writes product
+   paths; wright cannot widen scope; missing profile blocks.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Build gate enters or resumes transaction","action":"invoke canonical operation table; reconcile exact result","return":"same slice/checkpoint cursor or Plan/Vet route"} -->
-4. **Inspect the return.** Wait; compare its file list and `git diff --name-only`
-   with the contract. Reject stale, partial, malformed, or out-of-scope work.
-   Preserve user work; source restoration uses the same bounded wright.
-5. **Challenge stood decisions.** For each stood decision, run exact
-   `devrites-doubt-reviewer` fresh/read-only and record accepted or resolved-rejected
-   in `decisions.md`. A missing verdict, principle breach, scope change, or
-   irreversible risk blocks.
-6. **Prove without guessing.** Against the frozen pre-slice candidate, inspect
-   test hunks for deletion, skipping/focus, tautology, or weaker expectations. Dispatch exact
-   `devrites-test-analyst` on that immutable diff; missing account or adverse criterion
-   verdict is Critical. Run only `test-plan.md` repository/CI commands, capture output,
-   and recheck `git diff --name-only`. Missing, weakened, red, or source-mutating proof
-   is not success.
+4. **Inspect.** Wait; compare returned paths and `git diff --name-only` with the
+   contract. Reject stale/partial/malformed/out-of-scope work; preserve user work.
+   Restoration uses the bounded wright.
+5. **Review.** Apply [Independent Build review](#independent-build-review).
+   Missing verdicts, principle breaches and open Critical/Important block acceptance.
+6. **Prove.** Against the frozen pre-slice candidate inspect
+   test hunks for deletion, skipping/focus, tautology, or weaker expectations.
+   Use step 5's exact test-analyst account; missing/adverse criterion verdict is
+   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
+   Pre-existing/environment-specific claims need a predating same-command,
+   same-environment baseline; otherwise unresolved.
 
-   A failure is `pre-existing` or environment-specific only with a same-command,
-   same-environment baseline predating the candidate; otherwise it remains unresolved.
+   Technical failure uses `devrites-debug-recovery` and
+   [canonical recovery](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Reapply host admission before correction; affected proof/evidence follows candidate
+   integrity. Human gates remain product/irreversible/access decisions.
+7. **Record green.** Upsert actual scoped `present`/`deleted` rows in `touched-files.md`;
+   update state, evidence and applicable UI/browser proof. Manifest stays mutable
+   until Polish. For a release milestone, after the last slice's rows run
+   `devrites-engine state merge-manifest <slug>` to fold the recorded
+   predecessor chain into the union manifest before Prove. Record stood
+   decisions/dead ends; refresh verified/falsified
+   assumptions. Propose reviewed durable project rules in the nearest guidance.
+8. **Account/reply.** Apply `afk-discipline.md`: charge
+   exactly once after each green built slice; never negative, stop at zero,
+   malformed budget fails closed. Reply names next pending slice or `/rite-prove`
+   only when all built; no decorative renderer/dispatch telemetry.
 
-   Technical failure uses bounded `devrites-debug-recovery`: reapply the host gate
-   before an accepted in-slice correction, keep one exact fingerprint/three
-   no-progress attempts, and never rerun an unchanged check. A closed reproduction
-   is progress; a different Critical/Important invariant gets its own fingerprint.
-   Ask humans only for product decisions,
-   irreversible risk, or genuinely human-only access.
-7. **Record.** After green proof, upsert `touched-files.md`'s authoritative candidate
-   manifest from the actual scoped diff with explicit `present`/`deleted` rows;
-   update `state.md`, `evidence.md`, and applicable UI/browser evidence. The manifest
-   stays mutable until Polish closes it.
-   Record stood decisions/dead ends in `decisions.md`; update checked assumptions'
-   status/evidence, never leaving a disproved row live. If code reveals a durable
-   project rule, propose a reviewed `AGENTS.md`/nearest-doc update, not a scored ledger.
-8. **AFK and reply.** Under `afk-discipline.md`, root charges
-   exactly once after each green built slice, never below zero; stop before another dispatch at zero, and fail closed
-   on malformed budget. Use the reply contract; name the next pending slice or, only
-   when all slices are built, `/rite-prove`. Emit no decorative progress renderer or
-   dispatch telemetry.
+One contract builds one slice: preserve TDD, exact paths and independent judgment.
 
-> **Mid-flight discipline.** One writer contract builds one slice. Do not skip
-> TDD, widen paths, fold in a second slice, or accept the writer's judgment as
-> independent review.
+## Independent Build review
+
+After inspection, freeze full slice scope and cumulative baseline diff. Initial
+inventory: one full-diff `devrites-code-reviewer`, one `devrites-test-analyst`,
+and one exact `devrites-doubt-reviewer` per stood decision that meets
+`devrites-doubt` § When to use (boundary, data model, auth, public API, migration,
+user flow, assumption tests cannot prove); other stood decisions are recorded in
+`decisions.md` without dispatch. Dispatch fresh,
+read-only under [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md).
+Wait for every required account to become terminal; missing/gap needs a valid result.
+Fold supported in-scope Critical/Important findings by cause into one inventory.
+Dispatch one repair-all wright instructed to fix every finding, then attack its own
+correction for fix-introduced defects before returning; durable contract defects use Spec
+Drift Guard.
+Suggestion/Nit/FYI cannot prolong recovery.
+
+Rechecks use Vet's bounded pattern: each exact responsible reviewer checks
+all open findings owned by that role and affected dependency/regression closure
+in one fresh dispatch. Supply new candidate, inventory, correction diff, tests
+and unchanged-coverage evidence under candidate integrity; include newly triggered
+roles. A changed contract or uncertain impact requires the full inventory.
+Collect all required rechecks before another folded correction. Canonical recovery
+owns fingerprints/budget and the
+[late-finding rule](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+a recheck's `Late:` rows on hunks unchanged since that role's previous pass go to
+`touched-files.md` `## Review trail` for `/rite-review`, not into another slice
+repair, unless Critical with a failure path. Evidenced scope coverage never
+guarantees no later defect; the feature-level Review and Seal gates still run.

package/pack/.claude/skills/rite-build/reference/spec-drift-guard.md

@@ -1,8 +1,7 @@
 # Spec Drift Guard (build phase)
 
-Active throughout `/rite-build`. The spec is living, not sacred, but you may not
-silently code against a plan you know is wrong. This is the canonical Spec Drift Guard;
-other phases reference it here.
+Canonical Spec Drift Guard, active in `/rite-build` and referenced by other
+phases. Never silently code against a known-wrong plan.
 
 ## Drift has occurred when
 - the spec says X but the code makes X impossible/wrong;
@@ -16,7 +15,7 @@ other phases reference it here.
 ## Workflow
 ```
 1. STOP coding.
-2. Record in drift.md (assumed vs observed, when).
+2. Record drift.md (assumed vs observed, when).
 3. Classify: requirement ambiguity | implementation-plan error | codebase reality
    mismatch | design-system mismatch | test/evidence mismatch | external-doc mismatch
    | user-decision required.
@@ -35,12 +34,14 @@ other phases reference it here.
 
 ## Batch sweep (before repair)
 
-A durable-plan drift abort never repairs the first gap alone:
+Repair durable-plan drift as a folded set:
 
-1. Verify every remaining statically-checkable contract assumption against the
-   live repo — named paths, symbols/APIs/signatures, routes, commands, dependency
-   versions, contract artifacts. The wright's return names what it falsified;
-   check the rest yourself — existence checks are deterministic, no dispatch.
+1. Trace the falsified assumption's full dependency/consumer closure and affected
+   frontier, including dependent future slices. Verify unchecked paths, symbols/APIs/
+   signatures, routes, commands, versions, and artifacts there against live source.
+   Reuse the wright inventory and unchanged evidence; deterministic existence checks
+   need no dispatch. Do not rescan unrelated slices. Broaden unknown closure or shared
+   contract changes until coverage is justified; retain every known gap.
 2. Record each violation as its own `drift.md` entry/fingerprint; one folded
    repair + one batched recheck resolves the set.
 3. A recheck-surfaced gap is a new fingerprint with its own budget — loop
@@ -75,11 +76,9 @@ human permission question. Re-plan only when the durable plan changed.
 
 ## Inline return contract
 
-The phase that detected agent-owned drift owns the whole backtrack, batch sweep
-included. Preserve it
-as `return_phase`/`return_next_action`; consume Plan and Vet's nested `STOP`
-boundaries internally; follow any vetted remediation required by the settled
-acceptance; then restore the cursor and resume the failed step. Do not hand an
-intermediate command to the human. The shared three-attempt causal-fingerprint
+The detecting phase owns backtracking and the batch sweep. Save
+`return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
+vetted acceptance-preserving remediation, then restore the cursor and failed step.
+Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
 cap still applies: exhaustion produces one technical blocker, while a genuinely
 human-owned decision uses the question format below.

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -1,12 +1,12 @@
 # Slice-wright dispatch
 
 `/rite-build` gives one bounded task to exact `devrites-slice-wright`.
-Root owns scope, artifacts, inspection, and routing but never writes source/tests; only
-the wright writes them and invokes no agent.
+Root owns scope/artifacts/inspection; never writes source/tests.
+Wright alone writes; no agents.
 
 ## Host gate
 
-Follow the canonical [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
+Apply [source-writing boundary](../../devrites-lib/reference/standards/agents.md#source-writing-boundary):
 Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root,
 the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
 the wright or recreate an engine bridge.
@@ -47,7 +47,7 @@ worktrees stay forbidden.
    controlling root under
    [`workflow-artifacts.md`](../../devrites-lib/reference/standards/workflow-artifacts.md);
    its rejection here is not a blocker.
-2. Put it in the task with goal, verbatim acceptance, exclusions, context,
+2. Include goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, and applicable standards. For each triggered
    topology/data/integration standard, include only the feature-specific owner/invariant,
    failure or partial-state case, recovery rule, and required proof from the vetted plan.
@@ -77,10 +77,10 @@ Opt-in `/rite-build --parallel N` fans out only under [`parallel-batch.md`](para
    mocks that erase it and one-root proof offered for another root are unproven.
 3. Run only repository proof already approved by `test-plan.md`, then inspect
    `git diff --name-only` again in case a proof tool changed source.
-4. Challenge decisions. Human choices return; native diagnosis routes failures.
-   The root counts the wright plus recovery failures by causal fingerprint from
-   the current context and recorded Dead ends/evidence. Three total failed
-   attempts is the limit; persist each and never dispatch a fourth related try.
+4. Apply [independent Build review](phase-contract.md#independent-build-review) before
+   proof acceptance. Human choices return; technical failures follow
+   [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Derive accounting from recorded reproductions, corrections, and decisive rechecks.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
    relevant facts in canonical artifacts, not the wholesale report. A plan-gap

package/pack/.claude/skills/rite-define/SKILL.md

@@ -33,7 +33,10 @@ Pull these via `Read` when shaping the plan:
 - **Derive the slice count from the work.**
   One per independently-shippable increment, sized by `slicing.md`; map every acceptance
   criterion. User counts are hints: explain honest differences, never pad/compress.
-  `.devrites/AFK` `max_slices` is an iteration budget, not decomposition.
+  `.devrites/AFK` `max_slices` is an iteration budget, not decomposition. A derivation
+  over the [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+  is a split signal, never a `Budget override`: keep the thinnest shippable subset
+  here and route the rest to Non-goals + continuation workspaces via the Drift Guard.
 - **Complexity does not shrink scope.** Split/reorder; never drop/defer approved REQ/AC.
   Reduction needs Drift Guard + human decision; hard/large means decompose.
 - **Wide refactors use expand → migrate → contract.** Add compatibility, migrate green

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -97,7 +97,10 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    in one cluster, and each bundle applies independently. A `partial`-
    continuation re-dispatch continues the same packet; it does not advance the
    same-seam counter. Count consecutive repair packets whose findings' cited clause sets overlap
-   the immediately previous packet's — the overlap is the seam. At the third
+   the immediately previous packet's — the overlap is the seam. Carry it as an explicit
+   integer `same_seam_count` in every packet (previous value + 1 when the seam repeats,
+   else 1) so the threshold is counted rather than judged; a packet that reports the same
+   seam without the counter is malformed. At the third
    same-seam packet, mark it `convergence_pressure: true` with the seam named.
    Under pressure the drafter may close a finding marked as a refinement of an
    already-pinned clause by folding an explicit, bounded declared

package/pack/.claude/skills/rite-plan/reference/replan-and-repair.md

@@ -31,6 +31,11 @@ A drift event stopped the build. Steps:
 2. If the user answered a drift question, encode that decision in `decisions.md`.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
+   **Write the pointer, not the history.** Name the findings a fold closes by ID, one line
+   of meaning each; never restate prior folds, prior DEC lists, or closed-round narrative in
+   `architecture.md`/`plan.md`/`tasks.md`/`traceability.md`. That text belongs in
+   `decisions.md`, or in `history/` via [Budget relocation](#revise) once closed, so each
+   fold appends a bounded line. A banner that grows with the round count is the defect.
 4. Mark each `drift.md` entry **resolved** with the resolution + date.
 5. **Self-check and self-attack the repaired candidate on the delta before
    handoff** — re-verify every invariant the correction touched (acyclic
@@ -68,6 +73,14 @@ Mid-build user pivot. Apply the marked action, choose rollback or forward-fix, a
 update permitted artifacts atomically (`MVP cut` is the named retreat). Invalidate
 Vet/readiness when contract or topology changes.
 
+**Feature-ceiling cut.** When unbuilt slices exceed the
+[feature ceiling](slicing.md#feature-ceiling-split-an-epic-never-override-the-budget),
+`MVP cut` keeps the built slices plus the thinnest shippable unbuilt subset here; the
+remaining slices, their REQ/AC IDs and proof rows move verbatim into a named
+continuation list (spec `Non-goals` → future `/rite-spec <slug>-2`, `-3`, …) through
+the Spec Drift Guard. IDs never renumber; each ID is owned by exactly one workspace.
+Record the sequence once in `decisions.md`.
+
 ## revise
 
 Artifact-only reconciliation of `spec.md`, `architecture.md`, `plan.md`, `tasks.md`,
@@ -78,6 +91,14 @@ Unchanged acceptance/behavior with non-equivalent `proposed_coverage` is a
 contradictory input: the canonical classifier blocks it — there is no fourth
 route (see `acceptance-preserving-reslice.md`).
 
+**Budget relocation** (admitted by `/rite-upgrade`, or by the phase owner when
+`orient` reports `over: true`): move checkpoint narrative, historical fold text and
+closed-round accounts verbatim from `state.md`/`tasks.md`/`plan.md`/`architecture.md`/
+`eng-review.md` into `history/<file>-<YYYYMMDD>.md`, packets/accounts from the root
+into `packets/`, leaving a one-line pointer. Cursor, live slices, open findings, IDs,
+answers, decisions and bindings stay unchanged; nothing is deleted or reworded.
+Re-emit the readiness binding when a readiness input moved.
+
 ## Always
 
 Update `state.md` (phase, next step) and append a dated line to `decisions.md`

package/pack/.claude/skills/rite-plan/reference/slicing.md

@@ -4,9 +4,7 @@ DevRites builds in **thin vertical slices**: each slice cuts through every layer
 needs (data → logic → API → UI) and leaves the system in a working, testable state.
 
 ## Vertical, not horizontal
-Horizontal ("build all models, then all controllers, then all views") delays working
-software and hides integration risk until the end. Vertical delivers a usable path each
-slice:
+Horizontal layering delays integration feedback. Vertical slicing delivers a usable path:
 ```
 SLICE-001: Create a task   (DB + API + minimal UI)   -> user can create + test passes
 SLICE-002: List tasks      (query + API + UI)         -> user can see them
@@ -17,20 +15,21 @@ SLICE-004: Delete a task   (delete + API + UI + confirm) -> full CRUD
 ## Sizing a slice
 A slice is the right size when it:
 - delivers one observable capability end-to-end;
-- can be built and proven in a single `/rite-build` → `/rite-prove` cycle;
+- can finish its writer, independent review, and slice proof within `/rite-build`;
 - has acceptance criteria you can verify with evidence;
 - can be rolled back on its own;
 - is worth its own review gate: a reviewer could meaningfully reject *this* slice while
   approving its neighbor. If two slices can only pass or fail together, they're one slice.
 
-Too big if: it touches many unrelated files, or you can't name its single observable outcome.
-**The "and" test:** if the slice's *name* needs an "and" ("create **and** list tasks"), it's two
-slices: split on the "and". → reslice.
+Size by independent invariants, failure modes, and proof seams, not file count or
+the word "and". Split independently acceptable/provable responsibilities; several
+files may serve one inseparable capability. Full feature `/rite-prove` follows all
+slices; slice proof never replaces final integration or acceptance proof.
 
-Sizing isn't cosmetic. An agent builds a small or medium slice reliably in one pass but drifts on
-an outsized one, which is why a slice over `Complexity: 3/5` reslices (the `tasks.md` slice format
-in [`rite-define`](../../rite-define/SKILL.md)). Push every slice to the smallest cut that still
-stands alone end-to-end.
+For `Complexity` and irreducible boundaries, use the canonical
+[`tasks.md` slice grammar](../../devrites-lib/reference/workspace-artifact-schema.md#canonical-slice-grammar).
+Keep the smallest cut that stands alone end-to-end; do not add slices or gates for
+fragments that can only pass together. No slice size guarantees first-pass correctness.
 
 ## How many slices?: derive, don't dictate
 The slice **count is an output, not an input.** It falls out of the work: one slice per
@@ -46,10 +45,113 @@ a 12-criterion feature is however many thin end-to-end cuts those 12 need.
 - **Re-size by the rule, not the tally** (`/rite-plan reslice`): split a slice because it
   failed the sizing test, not to hit a count.
 
-Not to be confused with `.devrites/AFK` `max_slices`. That's an AFK *iteration budget*
-capping how many slices the unattended loop builds before it stops, **not** the plan's
-decomposition. The plan always holds exactly the slices the work needs; `max_slices` only
-limits how many run unattended.
+`.devrites/AFK` `max_slices` limits unattended execution, never plan decomposition.
+
+## Feature ceiling: split an epic, never override the budget
+
+The derived count is also a size signal. A decomposition that cannot fit the
+`tasks.md` / `plan.md` / `traceability.md` budgets in
+[`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md)
+(about ten canonical slices) is an epic: every Vet/Doubt/Build review re-reads the
+whole surface, each round finds new material, and the loop never converges.
+`Budget override` never covers slice or acceptance-criteria count.
+
+- Keep the thinnest independently shippable subset here; the rest becomes spec
+  `Non-goals` (via the Spec Drift Guard), each continuation a named future `/rite-spec`
+  workspace. Record the sequence once in `decisions.md`.
+- Acceptance-preserving: every REQ/AC keeps its ID, owned by exactly one workspace.
+- Earliest owner wins: Temper's one-sentence test → Define/Plan decomposition → Vet §0
+  scope finding → `/rite-plan course-correct` (`MVP cut`). Mid-build, unbuilt slices
+  beyond the ceiling move; built slices stay.
+- The ceiling bounds one **workspace**, never the product: the sequence delivers every
+  slice, in order, each with its own Vet/Build/Review loop. A human may still accept a
+  single larger workspace by recording the decision in `decisions.md` and a structural
+  `Budget override:` in the affected artifacts; the extra review rounds on the whole
+  surface are then the accepted, named cost. The deterministic gate
+  (`check readiness`/`check seal`) blocks only a material overshoot without such an
+  override, so the choice stays explicit rather than accidental.
+
+### Continuation workspaces
+
+Granularity is a real cost choice, not a formality: a workspace costs ~8–12 fixed
+dispatches (drafter, plan reviewer, proof runner, spec/code reviewers, seal roster;
+Temper is skippable when the parent's `strategy.md` already covers the scope) plus
+~3–5 per slice. The split does not remove per-slice cost; it bounds each round's
+context, stops the non-convergent whole-surface loop, isolates a plan defect's blast
+radius to its own workspace, and lets independent continuations run in parallel.
+
+Make each continuation cheap and drift-free:
+
+- `brief.md` names the parent slug and the sequence position; `decisions.md` holds the
+  sequence once (in the parent).
+- The child's `state.md` seeds the durable cursor at creation — `sequence_parent` =
+  parent slug, `sequence_position` = parent position + 1,
+  `sequence_workspaces_remaining` = parent remaining − 1, and `sequence_role:
+  release` only when the recorded entry is the sequence's release milestone.
+  Values derive from the parent's `state.md` and its `decisions.md` record,
+  exactly once; resume re-derives the same values rather than charging again.
+  A workspace that is not a recorded continuation leaves all four rows absent.
+  This is what `state merge-manifest` walks and what the release-union gate reads,
+  so a manually opened continuation needs the same seeding as an armed run.
+- Read the parent's `architecture.md`, `plan.md`, `decisions.md` (or its archived copy)
+  as **design input** — never re-derive settled architecture, dependency choices, or
+  interfaces. Proof is always fresh for the new candidate; parent evidence is cited as
+  input, never as proof for this workspace.
+- Shared interfaces, data shapes, and contracts are pinned **once**, in the workspace
+  that introduces them, and referenced afterwards. A continuation that must change a
+  pinned contract does so through its own `plan.md` shared-contract proof and an ADR
+  that names the superseded owner — never by silently re-deciding it.
+- A request that names a recorded continuation is a new workspace, not
+  `/rite-plan revise` on the parent.
+- Phases chain automatically only **inside** one workspace (`/rite-autocomplete`
+  drives spec → clarify → temper → define → vet → build × slices → prove → polish →
+  review → seal; plain HITL chains plan↔vet inline and stops at each other boundary).
+  Crossing into the next continuation is a new invocation by design, so the human sees
+  each delivered increment before the next one starts.
+
+### Release milestone (full-picture gate)
+
+Milestone gates are feature-scoped: `prove` proves *that* workspace's acceptance,
+`review`/`seal` judge *that* candidate. A product release therefore needs one more
+workspace — the **release milestone** — planned last, whose subject is the assembled
+product:
+
+- Its ACs are product-level: cross-milestone integration, end-to-end journeys,
+  performance/release budgets, docs/rollout. Milestone ACs stay owned by their
+  milestones and are **referenced** here, never re-owned.
+- Its candidate manifest lists the union of shipped surfaces, so one `prove` → `review`
+  → `seal` binds the whole product, and one `ship` commits/pushes/tags the release.
+  Its `state.md` cursor carries `sequence_role: release` (seeded when the recorded
+  continuation is the sequence's release entry); `check candidate`/`check seal`
+  then require the manifest to cover the whole recorded chain. Build that union
+  deterministically: `devrites-engine state merge-manifest <release-slug>` walks
+  the recorded `sequence_parent` chain (live `work/` first, then `archive/`) and
+  folds every predecessor's manifest into the release `## Candidate manifest`;
+  on a path collision the later sequence position's row wins. An explicit
+  ordered `<pred>...` argument exists for chains recorded before the sequence
+  cursor fields.
+- Earlier milestones keep their own slice-level proof and their own prove/review/seal;
+  that is what stops a late defect from invalidating 170 slices of work. Skipping a
+  milestone's proof is allowed only by recording the decision — the release milestone
+  then carries the full acceptance burden, and that cost is the named trade-off.
+- The capability ledger (`.devrites/specs/<capability>/spec.md`) accumulates the
+  product picture across milestones; Polish folds each milestone's deltas.
+- **Deferred-ship sequence** (`.devrites/AFK` `continue_sequence: true`, `max_workspaces: N`):
+  milestones are sealed but not shipped, and the armed run opens the next recorded
+  continuation automatically; per-slice `WIP(<slug>)` checkpoints still land locally,
+  so the tree stays clean. One release ship at the end collapses the sequence's
+  checkpoints into the single release commit, pushes/tags it, and may archive the
+  sealed predecessors. Because no milestone boundary was shipped, later work can touch
+  an earlier milestone's surfaces without an affected-re-proof trigger — so the release
+  milestone re-proves the union acceptance map, and that full re-proof is this mode's
+  named cost. Trade-off against per-milestone ship: no shared-history rollback point
+  per increment, one Git approval at the end.
+- What is full-surface here is the **review**: reviewers see the whole product diff.
+  Re-proof stays targeted — this milestone's product ACs, everything a later milestone
+  touched, and any uncertain closure. Milestone evidence is cited only under
+  [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+  with explicit unchanged-input/dependency justification and a link to the original
+  account; a blind re-proof of every milestone AC is a recorded decision, not a default.
 
 ## First slice
 Make slice 1 the **thinnest useful end-to-end path**. It flushes out integration and

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -7,10 +7,12 @@ user-invocable: true
 
 # /rite-prove: prove the completed feature
 
-Read the active workspace and prove the whole assembled feature once. With no
-active workspace, use `/verify` or `/run` instead; if any task is pending, stop for `/rite-build`.
-Never report an unobserved pass. After Polish/Review code edits, repeat affected
-criteria and bind evidence to the changed candidate digest.
+Prove the assembled feature once. No workspace: use `/verify` or `/run`;
+pending tasks: stop for `/rite-build`.
+Never assert unobserved passes. After Polish/Review edits, repeat affected
+criteria/dependencies and bind under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+Initial full feature proof and required mutable observations still run.
 
 ## Rules
 
@@ -21,21 +23,19 @@ Read the applicable standards: `testing.md`, `test-proof-checklist.md`,
 `workflow-artifacts.md`. Developer surfaces require an observed flow, measured
 TTHW, and exact signal-bearing errors; never assert DX.
 
-- Evidence over confidence. Apply positive, discriminating proof to every
-  behavioral claim; a green command without executing assertion and decisive
-  signal is unproven.
+- Each claim needs an executed positive, discriminating assertion and decisive
+  signal; green commands alone are unproven.
 - Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md). Prove owns proof binding, not candidate
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
-- Root executes vetted gates/browser and records evidence. A read-only proof
-  runner validates immutable evidence. The sole bounded wright fixes product
-  source/tests; root never does.
+- Root runs vetted gates/browser and records immutable evidence; proof runner
+  validates it. Only the bounded wright fixes product source/tests.
 - **Prove remains the controlling caller** during technical backtracking. Save
   its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. Recovery exhausts after
   three no-progress attempts on the exact same fingerprint. Closing one or exposing a distinct
   Critical/Important invariant is progress, not a reason to hand work off.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Prove consumes installed Workflow Artifact or CLEANED rerun","action":"VERIFY_EXISTING or admitted proof path ending PROVE_AND_RETURN","return":"saved Prove cursor; stop before real action"} -->
-## Released-workspace refresh entry
+## Released-workspace refresh
 
 Only an admitted `/rite-upgrade` assessment proving a released-format candidate
 defect enters. Require legacy touched-file scope, live diff, tasks, and traceability agree unambiguously
@@ -85,19 +85,17 @@ test changes.
    [browser proof](reference/browser-proof.md): routes, viewports, opened and
    described screenshots, console/network, interaction, target comparisons, and
    every required state. Material mismatch fails.
-7. **Independent validation.** Dispatch exact fresh read-only
-   `devrites-proof-runner` and `devrites-spec-reviewer` on the same candidate,
-   commands, immutable evidence, and acceptance map. Reject missing/stale,
-   invented-ID, label-only, or self-attested reports; neither executes commands.
-8. **Map proof.** Reconcile both verdicts and
-   [acceptance-proof.md](reference/acceptance-proof.md). Every criterion,
-   scenario, interaction, and planned key link gets positive discriminating
-   evidence or a blocker, including applicable critical-path, observability,
-   developer, and wiring branches.
+7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
+   `devrites-spec-reviewer` judge the same candidate/commands/evidence/acceptance map.
+   Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
+   Every criterion/scenario/interaction/key link needs discriminating evidence or a
+   blocker, including critical-path, observability, developer and wiring branches.
 9. **Recover red.** Use [failure triage](reference/failure-triage.md) and Debug
    Recovery. Reconcile reproduction; send accepted in-scope source/test correction
    to the sole wright; update actual manifest; rerun affected proof, both candidate
-   checks, and fresh proof runner. Scope growth blocks.
+   checks, and fresh proof runner. Recheck affected acceptance with the exact spec
+   reviewer; reconcile both validators under evidence validity. Scope growth blocks.
 
    Agent-owned durable-plan errors run Spec Drift Guard, Plan, and Vet inline,
    preserving Prove as origin. Consumptive failures use retained fixtures, repair,
@@ -112,7 +110,7 @@ test changes.
 > Do not claim an unobserved pass, skip browser proof, or proceed with pending
 > slices. Load `reference/anti-patterns.md` when tempted to do so.
 
-## Phase exit (observable)
+## Phase exit
 
 **Complete when:** every criterion in `acceptance-proof.md` has discriminating
 evidence bound to the current candidate digest, both independent validators admit