devrites 5.4.0 → 5.6.0

package/pack/generated/codex/skills/rite-plan/reference/replan-and-repair.md

@@ -31,6 +31,11 @@ A drift event stopped the build. Steps:
 2. If the user answered a drift question, encode that decision in `decisions.md`.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
+   **Write the pointer, not the history.** Name the findings a fold closes by ID, one line
+   of meaning each; never restate prior folds, prior DEC lists, or closed-round narrative in
+   `architecture.md`/`plan.md`/`tasks.md`/`traceability.md`. That text belongs in
+   `decisions.md`, or in `history/` via [Budget relocation](#revise) once closed, so each
+   fold appends a bounded line. A banner that grows with the round count is the defect.
 4. Mark each `drift.md` entry **resolved** with the resolution + date.
 5. **Self-check and self-attack the repaired candidate on the delta before
    handoff** — re-verify every invariant the correction touched (acyclic
@@ -68,6 +73,14 @@ Mid-build user pivot. Apply the marked action, choose rollback or forward-fix, a
 update permitted artifacts atomically (`MVP cut` is the named retreat). Invalidate
 Vet/readiness when contract or topology changes.
 
+**Feature-ceiling cut.** When unbuilt slices exceed the
+[feature ceiling](slicing.md#feature-ceiling-split-an-epic-never-override-the-budget),
+`MVP cut` keeps the built slices plus the thinnest shippable unbuilt subset here; the
+remaining slices, their REQ/AC IDs and proof rows move verbatim into a named
+continuation list (spec `Non-goals` → future `$rite-spec <slug>-2`, `-3`, …) through
+the Spec Drift Guard. IDs never renumber; each ID is owned by exactly one workspace.
+Record the sequence once in `decisions.md`.
+
 ## revise
 
 Artifact-only reconciliation of `spec.md`, `architecture.md`, `plan.md`, `tasks.md`,
@@ -78,6 +91,14 @@ Unchanged acceptance/behavior with non-equivalent `proposed_coverage` is a
 contradictory input: the canonical classifier blocks it — there is no fourth
 route (see `acceptance-preserving-reslice.md`).
 
+**Budget relocation** (admitted by `$rite-upgrade`, or by the phase owner when
+`orient` reports `over: true`): move checkpoint narrative, historical fold text and
+closed-round accounts verbatim from `state.md`/`tasks.md`/`plan.md`/`architecture.md`/
+`eng-review.md` into `history/<file>-<YYYYMMDD>.md`, packets/accounts from the root
+into `packets/`, leaving a one-line pointer. Cursor, live slices, open findings, IDs,
+answers, decisions and bindings stay unchanged; nothing is deleted or reworded.
+Re-emit the readiness binding when a readiness input moved.
+
 ## Always
 
 Update `state.md` (phase, next step) and append a dated line to `decisions.md`

package/pack/generated/codex/skills/rite-plan/reference/slicing.md

@@ -4,9 +4,7 @@ DevRites builds in **thin vertical slices**: each slice cuts through every layer
 needs (data → logic → API → UI) and leaves the system in a working, testable state.
 
 ## Vertical, not horizontal
-Horizontal ("build all models, then all controllers, then all views") delays working
-software and hides integration risk until the end. Vertical delivers a usable path each
-slice:
+Horizontal layering delays integration feedback. Vertical slicing delivers a usable path:
 ```
 SLICE-001: Create a task   (DB + API + minimal UI)   -> user can create + test passes
 SLICE-002: List tasks      (query + API + UI)         -> user can see them
@@ -17,20 +15,21 @@ SLICE-004: Delete a task   (delete + API + UI + confirm) -> full CRUD
 ## Sizing a slice
 A slice is the right size when it:
 - delivers one observable capability end-to-end;
-- can be built and proven in a single `$rite-build` → `$rite-prove` cycle;
+- can finish its writer, independent review, and slice proof within `$rite-build`;
 - has acceptance criteria you can verify with evidence;
 - can be rolled back on its own;
 - is worth its own review gate: a reviewer could meaningfully reject *this* slice while
   approving its neighbor. If two slices can only pass or fail together, they're one slice.
 
-Too big if: it touches many unrelated files, or you can't name its single observable outcome.
-**The "and" test:** if the slice's *name* needs an "and" ("create **and** list tasks"), it's two
-slices: split on the "and". → reslice.
+Size by independent invariants, failure modes, and proof seams, not file count or
+the word "and". Split independently acceptable/provable responsibilities; several
+files may serve one inseparable capability. Full feature `$rite-prove` follows all
+slices; slice proof never replaces final integration or acceptance proof.
 
-Sizing isn't cosmetic. An agent builds a small or medium slice reliably in one pass but drifts on
-an outsized one, which is why a slice over `Complexity: 3/5` reslices (the `tasks.md` slice format
-in [`rite-define`](../../rite-define/SKILL.md)). Push every slice to the smallest cut that still
-stands alone end-to-end.
+For `Complexity` and irreducible boundaries, use the canonical
+[`tasks.md` slice grammar](../../devrites-lib/reference/workspace-artifact-schema.md#canonical-slice-grammar).
+Keep the smallest cut that stands alone end-to-end; do not add slices or gates for
+fragments that can only pass together. No slice size guarantees first-pass correctness.
 
 ## How many slices?: derive, don't dictate
 The slice **count is an output, not an input.** It falls out of the work: one slice per
@@ -46,10 +45,113 @@ a 12-criterion feature is however many thin end-to-end cuts those 12 need.
 - **Re-size by the rule, not the tally** (`$rite-plan reslice`): split a slice because it
   failed the sizing test, not to hit a count.
 
-Not to be confused with `.devrites/AFK` `max_slices`. That's an AFK *iteration budget*
-capping how many slices the unattended loop builds before it stops, **not** the plan's
-decomposition. The plan always holds exactly the slices the work needs; `max_slices` only
-limits how many run unattended.
+`.devrites/AFK` `max_slices` limits unattended execution, never plan decomposition.
+
+## Feature ceiling: split an epic, never override the budget
+
+The derived count is also a size signal. A decomposition that cannot fit the
+`tasks.md` / `plan.md` / `traceability.md` budgets in
+[`workspace-artifact-schema.md`](../../devrites-lib/reference/workspace-artifact-schema.md)
+(about ten canonical slices) is an epic: every Vet/Doubt/Build review re-reads the
+whole surface, each round finds new material, and the loop never converges.
+`Budget override` never covers slice or acceptance-criteria count.
+
+- Keep the thinnest independently shippable subset here; the rest becomes spec
+  `Non-goals` (via the Spec Drift Guard), each continuation a named future `$rite-spec`
+  workspace. Record the sequence once in `decisions.md`.
+- Acceptance-preserving: every REQ/AC keeps its ID, owned by exactly one workspace.
+- Earliest owner wins: Temper's one-sentence test → Define/Plan decomposition → Vet §0
+  scope finding → `$rite-plan course-correct` (`MVP cut`). Mid-build, unbuilt slices
+  beyond the ceiling move; built slices stay.
+- The ceiling bounds one **workspace**, never the product: the sequence delivers every
+  slice, in order, each with its own Vet/Build/Review loop. A human may still accept a
+  single larger workspace by recording the decision in `decisions.md` and a structural
+  `Budget override:` in the affected artifacts; the extra review rounds on the whole
+  surface are then the accepted, named cost. The deterministic gate
+  (`check readiness`/`check seal`) blocks only a material overshoot without such an
+  override, so the choice stays explicit rather than accidental.
+
+### Continuation workspaces
+
+Granularity is a real cost choice, not a formality: a workspace costs ~8–12 fixed
+dispatches (drafter, plan reviewer, proof runner, spec/code reviewers, seal roster;
+Temper is skippable when the parent's `strategy.md` already covers the scope) plus
+~3–5 per slice. The split does not remove per-slice cost; it bounds each round's
+context, stops the non-convergent whole-surface loop, isolates a plan defect's blast
+radius to its own workspace, and lets independent continuations run in parallel.
+
+Make each continuation cheap and drift-free:
+
+- `brief.md` names the parent slug and the sequence position; `decisions.md` holds the
+  sequence once (in the parent).
+- The child's `state.md` seeds the durable cursor at creation — `sequence_parent` =
+  parent slug, `sequence_position` = parent position + 1,
+  `sequence_workspaces_remaining` = parent remaining − 1, and `sequence_role:
+  release` only when the recorded entry is the sequence's release milestone.
+  Values derive from the parent's `state.md` and its `decisions.md` record,
+  exactly once; resume re-derives the same values rather than charging again.
+  A workspace that is not a recorded continuation leaves all four rows absent.
+  This is what `state merge-manifest` walks and what the release-union gate reads,
+  so a manually opened continuation needs the same seeding as an armed run.
+- Read the parent's `architecture.md`, `plan.md`, `decisions.md` (or its archived copy)
+  as **design input** — never re-derive settled architecture, dependency choices, or
+  interfaces. Proof is always fresh for the new candidate; parent evidence is cited as
+  input, never as proof for this workspace.
+- Shared interfaces, data shapes, and contracts are pinned **once**, in the workspace
+  that introduces them, and referenced afterwards. A continuation that must change a
+  pinned contract does so through its own `plan.md` shared-contract proof and an ADR
+  that names the superseded owner — never by silently re-deciding it.
+- A request that names a recorded continuation is a new workspace, not
+  `$rite-plan revise` on the parent.
+- Phases chain automatically only **inside** one workspace (`$rite-autocomplete`
+  drives spec → clarify → temper → define → vet → build × slices → prove → polish →
+  review → seal; plain HITL chains plan↔vet inline and stops at each other boundary).
+  Crossing into the next continuation is a new invocation by design, so the human sees
+  each delivered increment before the next one starts.
+
+### Release milestone (full-picture gate)
+
+Milestone gates are feature-scoped: `prove` proves *that* workspace's acceptance,
+`review`/`seal` judge *that* candidate. A product release therefore needs one more
+workspace — the **release milestone** — planned last, whose subject is the assembled
+product:
+
+- Its ACs are product-level: cross-milestone integration, end-to-end journeys,
+  performance/release budgets, docs/rollout. Milestone ACs stay owned by their
+  milestones and are **referenced** here, never re-owned.
+- Its candidate manifest lists the union of shipped surfaces, so one `prove` → `review`
+  → `seal` binds the whole product, and one `ship` commits/pushes/tags the release.
+  Its `state.md` cursor carries `sequence_role: release` (seeded when the recorded
+  continuation is the sequence's release entry); `check candidate`/`check seal`
+  then require the manifest to cover the whole recorded chain. Build that union
+  deterministically: `devrites-engine state merge-manifest <release-slug>` walks
+  the recorded `sequence_parent` chain (live `work/` first, then `archive/`) and
+  folds every predecessor's manifest into the release `## Candidate manifest`;
+  on a path collision the later sequence position's row wins. An explicit
+  ordered `<pred>...` argument exists for chains recorded before the sequence
+  cursor fields.
+- Earlier milestones keep their own slice-level proof and their own prove/review/seal;
+  that is what stops a late defect from invalidating 170 slices of work. Skipping a
+  milestone's proof is allowed only by recording the decision — the release milestone
+  then carries the full acceptance burden, and that cost is the named trade-off.
+- The capability ledger (`.devrites/specs/<capability>/spec.md`) accumulates the
+  product picture across milestones; Polish folds each milestone's deltas.
+- **Deferred-ship sequence** (`.devrites/AFK` `continue_sequence: true`, `max_workspaces: N`):
+  milestones are sealed but not shipped, and the armed run opens the next recorded
+  continuation automatically; per-slice `WIP(<slug>)` checkpoints still land locally,
+  so the tree stays clean. One release ship at the end collapses the sequence's
+  checkpoints into the single release commit, pushes/tags it, and may archive the
+  sealed predecessors. Because no milestone boundary was shipped, later work can touch
+  an earlier milestone's surfaces without an affected-re-proof trigger — so the release
+  milestone re-proves the union acceptance map, and that full re-proof is this mode's
+  named cost. Trade-off against per-milestone ship: no shared-history rollback point
+  per increment, one Git approval at the end.
+- What is full-surface here is the **review**: reviewers see the whole product diff.
+  Re-proof stays targeted — this milestone's product ACs, everything a later milestone
+  touched, and any uncertain closure. Milestone evidence is cited only under
+  [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+  with explicit unchanged-input/dependency justification and a link to the original
+  account; a blind re-proof of every milestone AC is a recorded decision, not a default.
 
 ## First slice
 Make slice 1 the **thinnest useful end-to-end path**. It flushes out integration and

package/pack/generated/codex/skills/rite-prove/SKILL.md

@@ -7,10 +7,12 @@ user-invocable: true
 
 # $rite-prove: prove the completed feature
 
-Read the active workspace and prove the whole assembled feature once. With no
-active workspace, use `/verify` or `/run` instead; if any task is pending, stop for `$rite-build`.
-Never report an unobserved pass. After Polish/Review code edits, repeat affected
-criteria and bind evidence to the changed candidate digest.
+Prove the assembled feature once. No workspace: use `/verify` or `/run`;
+pending tasks: stop for `$rite-build`.
+Never assert unobserved passes. After Polish/Review edits, repeat affected
+criteria/dependencies and bind under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+Initial full feature proof and required mutable observations still run.
 
 ## Rules
 
@@ -21,21 +23,19 @@ Read the applicable standards: `testing.md`, `test-proof-checklist.md`,
 `workflow-artifacts.md`. Developer surfaces require an observed flow, measured
 TTHW, and exact signal-bearing errors; never assert DX.
 
-- Evidence over confidence. Apply positive, discriminating proof to every
-  behavioral claim; a green command without executing assertion and decisive
-  signal is unproven.
+- Each claim needs an executed positive, discriminating assertion and decisive
+  signal; green commands alone are unproven.
 - Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md). Prove owns proof binding, not candidate
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
-- Root executes vetted gates/browser and records evidence. A read-only proof
-  runner validates immutable evidence. The sole bounded wright fixes product
-  source/tests; root never does.
+- Root runs vetted gates/browser and records immutable evidence; proof runner
+  validates it. Only the bounded wright fixes product source/tests.
 - **Prove remains the controlling caller** during technical backtracking. Save
   its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. Recovery exhausts after
   three no-progress attempts on the exact same fingerprint. Closing one or exposing a distinct
   Critical/Important invariant is progress, not a reason to hand work off.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Prove consumes installed Workflow Artifact or CLEANED rerun","action":"VERIFY_EXISTING or admitted proof path ending PROVE_AND_RETURN","return":"saved Prove cursor; stop before real action"} -->
-## Released-workspace refresh entry
+## Released-workspace refresh
 
 Only an admitted `$rite-upgrade` assessment proving a released-format candidate
 defect enters. Require legacy touched-file scope, live diff, tasks, and traceability agree unambiguously
@@ -85,19 +85,17 @@ test changes.
    [browser proof](reference/browser-proof.md): routes, viewports, opened and
    described screenshots, console/network, interaction, target comparisons, and
    every required state. Material mismatch fails.
-7. **Independent validation.** Dispatch exact fresh read-only
-   `devrites-proof-runner` and `devrites-spec-reviewer` on the same candidate,
-   commands, immutable evidence, and acceptance map. Reject missing/stale,
-   invented-ID, label-only, or self-attested reports; neither executes commands.
-8. **Map proof.** Reconcile both verdicts and
-   [acceptance-proof.md](reference/acceptance-proof.md). Every criterion,
-   scenario, interaction, and planned key link gets positive discriminating
-   evidence or a blocker, including applicable critical-path, observability,
-   developer, and wiring branches.
+7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
+   `devrites-spec-reviewer` judge the same candidate/commands/evidence/acceptance map.
+   Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
+   Every criterion/scenario/interaction/key link needs discriminating evidence or a
+   blocker, including critical-path, observability, developer and wiring branches.
 9. **Recover red.** Use [failure triage](reference/failure-triage.md) and Debug
    Recovery. Reconcile reproduction; send accepted in-scope source/test correction
    to the sole wright; update actual manifest; rerun affected proof, both candidate
-   checks, and fresh proof runner. Scope growth blocks.
+   checks, and fresh proof runner. Recheck affected acceptance with the exact spec
+   reviewer; reconcile both validators under evidence validity. Scope growth blocks.
 
    Agent-owned durable-plan errors run Spec Drift Guard, Plan, and Vet inline,
    preserving Prove as origin. Consumptive failures use retained fixtures, repair,
@@ -112,7 +110,7 @@ test changes.
 > Do not claim an unobserved pass, skip browser proof, or proceed with pending
 > slices. Load `reference/anti-patterns.md` when tempted to do so.
 
-## Phase exit (observable)
+## Phase exit
 
 **Complete when:** every criterion in `acceptance-proof.md` has discriminating
 evidence bound to the current candidate digest, both independent validators admit

package/pack/generated/codex/skills/rite-review/SKILL.md

@@ -57,7 +57,7 @@ Pull these via `Read` when the diff demands them:
 
 0. Read `.agents/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
-1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`, `evidence.md`,
+1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
    questions, apply `.agents/skills/devrites-lib/reference/standards/tooling.md`: use
@@ -66,7 +66,14 @@ Pull these via `Read` when the diff demands them:
    current API, context7 if available can confirm the signature. Run
    `devrites-engine check candidate <slug>` and require its digest to match the
    single `evidence.md` binding and the `browser-evidence.md` binding when that
-   file exists. A missing, malformed, or open candidate returns to Polish/Prove.
+   file exists. Read those ledgers via the bounded advisory read
+   (`workspace-artifact-schema.md` § Read next by phase): binding line, `EVID-###`
+   index, then bodies for this candidate's AC/slice IDs only. A missing,
+   malformed, or open candidate returns to Polish/Prove.
+   Read `touched-files.md` `## Review trail` and `eng-review.md` `## Deferred findings`:
+   every deferred row is an input finding for the step-3 cohort (quoted in the owning
+   reviewer's brief without severity) and ends in `review.md` with its own label and
+   action tag — never silently dropped.
 2. **Review tests first:** do they prove the acceptance criteria? Missing,
    weak, or wrong tests are the first findings.
    **Completion:** every acceptance criterion maps to a proven test or a labeled finding.
@@ -74,7 +81,8 @@ Pull these via `Read` when the diff demands them:
    one axis and fail the other: code that follows every project standard but
    implements the wrong thing (Code-review pass, Spec fail), or code that does exactly
    what the spec asked but breaks project conventions (Spec pass, Code-review fail).
-   Separate contexts prevent one axis from masking the other:
+   Separate contexts prevent one axis from masking the other. This is the initial
+   full pass; a correction uses step 7's bounded recheck:
    - Freeze that closed digest and give the same digest to **two** read-only reviewers in
      parallel, each with its own narrow brief and no
      cross-pollination — and evaluate the frontend (step 4), security (step 5),
@@ -88,17 +96,10 @@ Pull these via `Read` when the diff demands them:
        missing spec` and do not infer requirements from the diff."
      - **Code-review axis** → `devrites-code-reviewer`: "Apply your full documented
        discipline (tests-first, correctness, readability, architecture, maintainability,
-       standards) on the active feature workspace + diff. Cite file:line per finding;
-       skip what tooling already enforces. Also flag the AI-codegen smells (silent/empty
-       catch, defensive try-catch bloat + redundant logging, single-use factory / needless
-       indirection, dependency creep where an in-repo option exists, a 100-line function
-       where 20 would do) and the silent-failure bugs (a missing value coerced to 0/''/[],
-       a dropped Result/err return, off-by-one / boundary, logic that contradicts the
-       comment/docstring/name). Per hunk, check whether working code was deleted that the
-       task did not ask to remove. Score the diff against `.devrites/principles.md`: a change
-       that breaks a declared invariant with no recorded, human-approved exception is a Critical.
-       Distinguish hard documented-standard violations from baseline smells; smells are judgment
-       calls unless a DevRites or project standard makes them binding."
+       standards) on the feature workspace + diff. Cite file:line; skip tooling-enforced
+       checks. Apply canonical anti-slop and silent-failure lenses; inspect each hunk
+       for unrequested deletion. Unexcepted `.devrites/principles.md` violations are
+       Critical. Distinguish binding standards from judgment-only baseline smells."
    - **Do NOT merge or re-rank** their findings. Present them under separate
      `## Spec` and `## Code review` sub-sections in `review.md`. Surface contradictions
      between the axes explicitly (e.g. "Spec axis says complete, Code-review axis says
@@ -131,9 +132,15 @@ Pull these via `Read` when the diff demands them:
 7. Reconcile and accept only in-scope fixes. Consolidate them into one bounded
    wright correction; never edit source in the reviewing context. Any correction
    updates the candidate manifest, returns through affected Prove, and then starts
-   a fresh Review on the new digest. Do not carry a prior reviewer account across it.
+   a fresh Review binding on the new digest. Dispatch affected exact reviewers on
+   all their open findings and the dependency/regression closure under
+   [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Cite unchanged sub-scope coverage only with its original identity and explicit
+   justification; never relabel old accounts. Changed contracts or uncertain impact
+   require the full applicable pass.
 8. The root updates `review.md` and `state.md`, writing exactly one candidate
-   binding in `review.md` for the digest given to every reviewer.
+   binding in `review.md` for the current digest, distinguishing fresh accounts from
+   cited unchanged sub-scope evidence and reconciling complete coverage.
    **Completion:** the records name the reviewed candidate identity and every accepted
    correction has affected proof plus a fresh Review.
 

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -7,8 +7,8 @@ user-invocable: true
 
 # $rite-seal: GO / NO-GO
 
-Verify the final candidate and write `seal.md`; `$rite-ship` alone performs
-authorized irreversible actions and close-out.
+Verify final candidate in `seal.md`; `$rite-ship` owns authorized irreversible
+actions and close-out.
 
 ## Authority
 
@@ -36,6 +36,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
 | Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
 | Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any deferred finding (`touched-files.md` `## Review trail`, `eng-review.md` `## Deferred findings`) lacks a `review.md` verdict | **NO-GO** |
 | Any `gate: validating` question remains open | **NO-GO** |
 | Material UI acceptance lacks or fails required browser proof | **NO-GO** |
 | Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
@@ -52,18 +53,17 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 
 1. read workspace and final diff;
 2. recheck the canonical candidate/bindings and approved repository/CI proof;
-3. dispatch exact proof, spec, test, doubt, and applicable review agents in
-   parallel under `../devrites-lib/reference/parallel-dispatch.md` — independent
-   read-only verdicts on one frozen candidate;
+3. admit valid Spec/Code accounts; dispatch remaining required exact roles under
+   `../devrites-lib/reference/parallel-dispatch.md` on the same frozen candidate;
 4. reconcile their read-only verdicts against source and immutable evidence;
 5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven accounts;
 6. write exactly one candidate binding, then run
    `devrites-engine check seal <slug>` for structure and identity, never semantics.
 
-Any candidate correction returns through affected Prove and a fresh Review before
-Seal starts again.
+Corrections return through affected Prove/Review before restarting Seal under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 
-Only repository scripts/CI authorize commands; never guess them.
+Only repository scripts/CI authorize commands; never guess.
 
 ## On GO
 

package/pack/generated/codex/skills/rite-seal/reference/final-evidence.md

@@ -1,6 +1,6 @@
 # Final evidence check
 
-Map every `spec.md` promise to fresh observed proof.
+Map spec promises to valid observed proof.
 
 ## Acceptance
 
@@ -11,7 +11,7 @@ inspection alone, and generic "tests pass" do not count.
 
 Apply [`testing.md`'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
 including invalid-result exclusions and static/textual criterion boundaries.
-Unsupported behavioral claims remain unproven: NO-GO.
+Unproven behavior: NO-GO.
 
 ## Cross-check
 
@@ -25,11 +25,12 @@ recovery evidence or an evidence-backed dismissal; a generic green suite cannot
 
 Run `devrites-engine check candidate <slug>` and require its digest to match the
 single evidence/review bindings and browser binding when present. Diff tests,
-dispatch exact `devrites-test-analyst`, run approved repository commands, then
-require the same candidate digest and no source mutation. Deleted/skipped/focused/
+dispatch exact `devrites-test-analyst`; apply
+[evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+to approved proof, then require unchanged digest/sources. Deleted/skipped/focused/
 weakened/tautological tests are Critical.
 
-After the native semantic verdicts are recorded in `seal.md`, run:
+After recording verdicts in `seal.md`, run:
 
 ```bash
 devrites-engine check seal "<slug>"

package/pack/generated/codex/skills/rite-seal/reference/phase-contract.md

@@ -1,27 +1,29 @@
 # rite-seal phase contract
 
-Seal's candidate action follows
-[`candidate-integrity.md`](../../devrites-lib/reference/candidate-integrity.md).
-
 1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
    `state.md`, then read required workspace artifacts, conditional
    browser/design/devex evidence, and final diff.
 2. **Recheck identity and real proof.** Run
    `devrites-engine check candidate <slug>` and require its exact digest to match
    the single evidence/review bindings and the browser binding when present.
-   Apply `spec-grammar.md`'s Native grammar re-read checklist, then run only
-   `test-plan.md`'s repository/CI commands against that frozen digest. Rerun the
+   Apply `spec-grammar.md`'s Native grammar re-read checklist and
+   [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Run required `test-plan.md` commands unless valid observed proof already satisfies
+   them under that contract. Rerun the
    candidate check afterward and require the identical digest and no source
    mutation. Capture command, cwd, exit, decisive output, and identity.
    Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
 3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
-   proof and exact `devrites-spec-reviewer` on the same candidate. Reconcile every
+   proof; admit valid same-candidate `devrites-spec-reviewer` evidence from Review
+   or dispatch that exact reviewer. Reconcile every
    AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
 4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
    tautology, or weakening; dispatch exact `devrites-test-analyst`. Missing or
    adverse account, or green tests not asserting mapped behavior, is Critical.
 5. **Resolve gates.** Open blocking/escalating/validating questions and drift
    block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+   Every deferred finding (`touched-files.md` `## Review trail`, `eng-review.md`
+   `## Deferred findings`) needs its `review.md` verdict; a row without one blocks.
 6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
    and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
    the candidate. Admit each result through
@@ -31,17 +33,15 @@ Seal's candidate action follows
 7. **Route corrections.** Reconcile cited findings/disagreements, but do not
    edit the candidate or manifest in Seal. Route an accepted correction through
    one bounded wright, update the manifest, run affected Prove, complete a fresh
-   Review, then restart Seal on the new digest.
-8. **Draft, then check deterministic invariants.** Write `seal.md` from
+   Review under evidence validity, then restart Seal on the new digest.
+8. **Draft/check.** Write `seal.md` from
    [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
    test-analysis account, stood-decision verdicts, all seven reviewer accounts,
    and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
    ```bash
    devrites-engine check seal "<slug>"
    ```
-   This checks structure and exact candidate bindings, not prose or semantics. Blocks exit `3`;
-   invalid state exits `2`. GO sets `Next step: $rite-ship`; NO-GO names the
-   smallest fix. Never commit, push, tag, publish, deploy, or close here.
+   Structure/bindings only: blocks exit `3`, invalid state `2`. GO sets
+   `Next step: $rite-ship`; NO-GO names the fix. No commit/push/tag/publish/deploy/close.
 
-> When tempted to round NO-GO up to GO or average away reviewer disagreement,
-> load [`anti-patterns.md`](anti-patterns.md).
+Apply [`anti-patterns.md`](anti-patterns.md); never average away disagreement.

package/pack/generated/codex/skills/rite-ship/SKILL.md

@@ -80,6 +80,9 @@ if absent, route to `$rite-spec <feature>`. Ship only with current **GO** in `se
    to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
    only if it names this slug; preserve another active feature's cursor.
    Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
+   Report the recorded `Next step` verbatim — the exact `$rite-spec <parent>-<n> "<objective>"`
+   when a continuation sequence remains — so the next increment starts from one line,
+   never from chat memory.
 
 > **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
 > deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/codex/skills/rite-ship/reference/close-out.md

@@ -5,8 +5,13 @@ deleted. DevRites keeps the audit trail; it just moves out of the live path.
 
 ## What close-out does
 
-1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`
-   of `$rite-spec <next feature>`.
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`.
+   When this workspace's `decisions.md` records an unfinished
+   [continuation sequence](../../rite-plan/reference/slicing.md#continuation-workspaces),
+   that step is the **exact** next command — `$rite-spec <parent>-<n> "<objective>"` —
+   and the ship reply prints the same line. Otherwise it stays
+   `$rite-spec <next feature>`. Nothing spawns the continuation automatically:
+   the recorded command is the handoff, so the human starts each increment knowingly.
 2. **Archive.** Run the deterministic script:
    ```bash
    devrites-engine state close <slug>
@@ -25,6 +30,15 @@ can also fail. Inspect the actual live path, archive and cursor before reporting
 retrying. Record the command/error and observed locations; never claim restored state
 from an attempted rollback or repeat a move against an unverified destination.
 
+## Sequence predecessors
+
+A deferred-ship sequence leaves earlier milestones sealed and unarchived in
+`.devrites/work/`. The release ship's disclosed plan may close them
+(`devrites-engine state close '<slug>'` per predecessor) after the release commit
+lands; each close is safe because `ACTIVE` names the release workspace. Closing is
+bookkeeping only: the release commit already carries their bytes, and their audit
+records move intact.
+
 ## Why archive, not delete
 
 - The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)

package/pack/generated/codex/skills/rite-ship/reference/git-ship.md

@@ -12,11 +12,13 @@ Acceptance criteria proven: <n / total>
 Branch:   <target branch>
 Candidate paths: <exact project-relative paths>
 Checkpoint collapse: <exact `git reset --soft '<merge-base>'` command | skip>
+Collapse slugs: <active slug plus every recorded sequence slug in the range | n/a>
 Stage plan: <exact argv-safe `git add -- '<path>'` command for every manifest row>
 Commit:   <exact git commit command>
 Push:     <exact git push command | skip>
 Tag:      <exact git tag command | skip>
 PR:       <exact PR command, target, title, and body source | skip>
+Close:    <exact `devrites-engine state close '<slug>'` for each sealed sequence predecessor | skip>
 
 Type "GO" exactly to approve this attempt once. Anything else cancels.
 ```
@@ -45,9 +47,12 @@ Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
 1. **Analyze checkpoint history without mutating it.** Read the upstream, merge
    base, commit OIDs, and full subjects. If no checkpoint commit exists, disclose
    `skip`. A collapse is eligible only when every commit in its range has the exact
-   `WIP(<active-slug>):` prefix for the validated active slug. A different slug,
-   missing colon, broad `WIP(` match, ordinary commit, or mixed history blocks;
-   never reinterpret the range.
+   `WIP(<slug>):` prefix for the validated active slug — or, for a release ship of a
+   deferred-ship sequence, for a slug recorded in the parent's `decisions.md`
+   sequence whose workspace is sealed in this run
+   ([afk-hitl.md § Sequence continuation](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces));
+   disclose the exact slug set. A different slug, missing colon, broad `WIP(` match,
+   ordinary commit, or mixed history blocks; never reinterpret the range.
 2. **Verify the candidate.** Rerun `devrites-engine check candidate <slug>` and
    `devrites-engine check seal <slug>`, compare every binding, require the
    candidate worktree paths to be unchanged, and inspect the existing staged
@@ -62,8 +67,8 @@ Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
 
 1. **Optional checkpoint collapse.** If and only if the prompt disclosed it,
    recheck that `HEAD`, merge base, and every subject are unchanged and that each
-   subject starts exactly `WIP(<slug>):` for the active slug, then run the exact
-   disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
+   subject starts exactly `WIP(<slug>):` for the disclosed slug set, then run the
+   exact disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
    subject blocks without mutation.
 2. **Exact staging.** Run `git add -- "$path"` once for each disclosed manifest
    row, passing each validated project-relative path as its own quoted argv
@@ -95,6 +100,10 @@ Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
    Any mismatch stops; do not reinterpret it.
 8. **Push** to the project-conventional target branch.
 9. **Tag / PR** only when project convention requires it; otherwise skip.
+10. **Close sealed predecessors** only when the prompt disclosed them: run the
+    exact `devrites-engine state close '<slug>'` once per predecessor. Each is safe
+    because `ACTIVE` names the release workspace; a nonzero exit stops the rest and
+    is reported, never retried against an unverified destination.
 
 Record SHA(s), branch, and tag/PR URL in `ship.md`.
 

package/pack/generated/codex/skills/rite-spec/SKILL.md

@@ -50,6 +50,12 @@ load a routed standard to discover required behavior, not to prescribe implement
    problem in one sentence. **Completion:** it includes both.
 1a. **Dedupe.** Search local issues/PRDs, work, and archive. On a close match ask
    extend/adopt/new, then record the choice; otherwise continue silently.
+   A recorded [feature-sequence continuation](../rite-plan/reference/slicing.md#continuation-workspaces)
+   is a **new** workspace (`<parent>-2`): carry the parent slug and position into
+   `brief.md`, read the parent artifacts as design input, and do not route to
+   `$rite-plan revise` on the parent. When the ask is open and archived work records
+   an unfinished sequence, propose that next continuation (slug + objective) as the
+   recommended option instead of a fresh slug.
 2. **Investigate:** follow [investigation](reference/investigation.md) through its
    complete findings and done-when gate. Discover the project's **test /
    build/typecheck/lint** commands, frontend/backend systems, and declared project guidance

package/pack/generated/codex/skills/rite-spec/reference/state-workspace.md

@@ -172,6 +172,12 @@ Ordinary workspace creation preserves the field without initializing,
 increasing, renaming, or deleting it. Released bullet workspaces spell it `AFK
 slices remaining`; preserve that presentation rather than migrating it.
 
+When the brief records a [sequence continuation](../../rite-plan/reference/slicing.md#continuation-workspaces),
+seed the `sequence_parent`, `sequence_position`, `sequence_workspaces_remaining`,
+and — for the release entry — `sequence_role` rows at creation per that contract.
+Without them `state merge-manifest` cannot walk the chain and the release-union
+gate never engages.
+
 ## questions.md entry format
 
 ```markdown