devrites 5.4.0 → 5.6.0

package/pack/generated/codex/skills/rite-status/SKILL.md

@@ -16,7 +16,10 @@ Use the supplied slug or `.devrites/ACTIVE`; require its authoritative
 `state.md` and read the cursor directly. Read question, evidence, and risk
 artifacts only as needed. Never infer lifecycle state from `README.md` or chat.
 
-If no workspace exists, recommend `$rite-spec <feature>` and stop.
+If no workspace exists: when archived workspaces record an unfinished
+[continuation sequence](../rite-plan/reference/slicing.md#continuation-workspaces),
+list each next command (`$rite-spec <parent>-<n> "<objective>"`); otherwise
+recommend `$rite-spec <feature>`. Then stop.
 
 If `state.md` is unreadable/malformed: report a gap with the defect and stop — never infer the phase from other files; `$rite-doctor`/`$rite-upgrade` own repair.
 

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -7,8 +7,7 @@ user-invocable: true
 
 # $rite-temper: review scope and risk before planning
 
-Review a readied spec for outcome ambition, scope, pre-mortem risks, and unnecessary
-solution surface. Fold accepted decisions into the canonical contract before
+Review the readied spec for ambition, scope, pre-mortem risk and unnecessary surface. Fold accepted decisions into the canonical contract before
 `$rite-define`. This step is optional for small work and skips low-stakes specs, but
 `$rite-autocomplete` always invokes it. **Read the active workspace first**; if there
 is no readied `spec.md`, tell the user to run `$rite-spec`. Review depth follows
@@ -58,6 +57,10 @@ the spec applicability map triggers that risk family.
    First, the **one-sentence-intent test**: state the whole change's intent in a single sentence.
    If you can't without an "and" that joins two unrelated outcomes, it is **two features**: the
    scope-creep signal; recommend splitting or narrowing the spec before continuing.
+   Apply the same test to size: a spec whose honest decomposition would exceed the
+   [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+   (roughly ten slices or more than ~20 acceptance criteria) is a feature sequence;
+   recommend the thinnest shippable subset now and name the continuations as Non-goals.
    Then consider the 10-star outcome for the underlying problem and choose **exactly one**
    scope mode (`expand` opt-in · `selective` · `hold-rigor` · `reduce-to-MVP`) with its
    rationale and the condition that would change the choice. `$ARGUMENTS` `--mode` is a
@@ -106,19 +109,19 @@ the spec applicability map triggers that risk family.
    and closed gates. Partial/Missing, an unowned material assumption, or an open
    blocking/escalating question routes `$rite-clarify`/HITL. Only after the
    matrix is re-closed may the phase advance.
-   Update `state.md`: `Phase: temper`,
-   `Next step: $rite-define`; on a blocking pause (expand / irreversible / a dimension still below
-   bar) write the `Awaiting human` block + `Status: awaiting_human` before stopping.
+   Set `Phase: temper`; `Next step: $rite-define` only after verification.
+   Human-owned expansion/unapproved irreversible choices set `Awaiting human` +
+   `Status: awaiting_human`; objective below-bar findings continue correction.
 7. **Adversarial verification loop:** ask the exact
    [`devrites-strategy-reviewer`](.codex/agents/devrites-strategy-reviewer.toml)
    through the native fresh-context contract in
    [`agents.md`](../devrites-lib/reference/standards/agents.md), with **only** the hardened
-   spec + rubric: no authoring reasoning. Resolve
-   actionable findings by editing `spec.md`/`strategy.md`, re-dispatch; **cap ≤3 iterations**. A
-   dimension still below bar after 3 is classified by decision ownership: a product/scope/risk
-   choice becomes a blocking question; an objective spec defect stays blocked with the exact
-   required edit and routes to `$rite-spec`, not `$rite-resolve`. Irreversible-risk findings
-   always pause. If the named agent is unavailable, stop for HITL. After an accepted edit to a
+   spec + rubric, no authoring reasoning. Fold technical findings into one correction;
+   exact strategy reviewer rechecks open findings and affected coverage/regressions under
+   [the canonical retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+   Product/scope choices and unapproved irreversible risk remain human gates;
+   technical exhaustion preserves blocker/reproduction.
+   If the named agent is unavailable, stop for HITL. After an accepted edit to a
    coverage-bound input, repeat step 6's native coverage revalidation before handoff.
 8. **STOP.** Report the mode, the scope deltas, and the floor verdict; recommend `$rite-define`.
 

package/pack/generated/codex/skills/rite-temper/reference/anti-patterns.md

@@ -1,29 +1,30 @@
 # $rite-temper: anti-patterns
 
-Universal rationalizations + red flags live in
-[`../../devrites-lib/reference/standards/anti-patterns.md`](../../devrites-lib/reference/standards/anti-patterns.md): read it when the
-reluctance is broader than this phase. Below are the temper-specific ones.
+For cross-phase issues, read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patterns.md).
 
 ## Phase rationalizations
 
 | Excuse | Rebuttal |
 |---|---|
-| "I'll write all the findings into `strategy.md` and let the user read it." | The artifact is the *output* of an interactive review, not a substitute for it. A finding's path to "done" goes **through `AskUserQuestion`**, one at a time, with a recommendation + why. Dumping findings into one write and moving on is the exact failure mode this skill exists to prevent. |
+| "I'll write all the findings into `strategy.md` and let the user read it." | Fold and recheck objective corrections preserving scope, behavior, and risk policy. Ask human-owned strategy/acceptance choices with recommendations and await answers. Recording alone resolves nothing; never silently expand or trim the spec. |
 | "Bigger is better: let's add the extra capability while we're thinking big." | Ambition belongs on the **outcome**, not the **solution surface**. A speculative capability/abstraction is gold plating. Expand the problem + acceptance; never the machinery. |
 | "The user obviously wants the ambitious version. I'll add it to the spec." | Expansion is **opt-in**, recorded, and confirmed (HITL) or paused (AFK). Adding acceptance the human didn't approve is silent scope growth: route it through the Spec Drift Guard or don't add it. |
 | "It's over-scoped, I'll just trim those criteria." | Reducing scope is **still a spec change**. Cut acceptance only as a recorded Spec-Drift-Guard decision, and park the rest in Non-goals with a revisit note: never a silent trim. |
-| "This dimension is weak but the others are strong: net it's fine." | The gate is the **floor**, not the average. A spec `broken` on risk does not pass because it's `strong` on clarity. |
-| "I can see it's adequate. I'll note the band, evidence is obvious." | Cite the evidence (the spec line or its absence) **before** the band. Score-first-justify-later is how a reviewer rationalizes a spec it already likes. |
+| "This dimension is weak but the others are strong: net it's fine." | The gate is the **floor**, not the average; strong clarity cannot offset broken risk. |
+| "I can see it's adequate. I'll note the band, evidence is obvious." | Cite spec evidence **before** the band; never score first and rationalize later. |
 | "It's a strategy doc, the implementation concerns don't apply yet." | Cross-cutting concerns (security/data/observability/modifiability) are where strategy breaks down. Address each or mark it explicitly N/A: silent omission is a gap. |
-| "This greenfield design is elegant." | Elegant for a codebase that doesn't exist. Ground ambition in the real seams + blast radius; flag a new dependency / second design system for an explicit decision. |
+| "This greenfield design is elegant." | Ground ambition in live seams/blast radius; a new dependency or second design system needs an explicit decision. |
 
 ## Red flags
-- `strategy.md` written but `spec.md` acceptance/Non-goals **not** updated: the build follows
-  the spec, so the review changed nothing.
-- An `expand` decision auto-applied in AFK (it must pause), or any irreversible-risk touch that
-  didn't pause.
+- An accepted strategy change recorded in `strategy.md` but not reflected in its
+  owning spec acceptance/Non-goals. A clean review does not require gratuitous spec edits.
+- An `expand` decision auto-applied in AFK, an unapproved risk-policy change, or an
+  irreversible operation without its required authorization.
 - A pre-mortem with risks listed but no mitigation + owning slice: a risk without an owner is a
   wish.
-- The reviewer loop running past 3 iterations, or the reviewer being handed the author's
-  reasoning (defeats the fresh-context point).
+- Repeating an exhausted causal failure under the shared no-progress rule in
+  [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), or stopping a
+  distinct cause solely because the total review round exceeds three.
+- The reviewer being handed the author's reasoning as independent evidence
+  (defeats the fresh-context point).
 - The skill writing a `plan.md`, slicing, or touching code. That's `$rite-define` / `$rite-build`.

package/pack/generated/codex/skills/rite-temper/reference/review-dimensions.md

@@ -61,7 +61,6 @@ justifies it. Review a borderline dimension twice if needed and use the **lower*
   irreversibility & #9 convention-fit both touch codebase realism; #1 ambition & #2 scope both
   touch over/under-reach). Don't fail two dimensions for the *same* root cause: cite the
   evidence once and assign one band so one problem does not create two floor failures.
-- Below-bar dimension after the ≤3-iteration reviewer loop → classify by decision ownership:
-  product/scope/risk uncertainty becomes a blocking question; an objective prose/coverage defect
-  routes back to `$rite-spec` without inventing a human decision. Irreversible-risk findings
-  always pause regardless of band.
+- Below-bar blocks readiness; objective fixes return to the caller under
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+  Human-owned scope/risk choices keep their gate; exhaustion blocks technically.

package/pack/generated/codex/skills/rite-upgrade/SKILL.md

@@ -29,7 +29,7 @@ references, and only current phase contracts needed for the observed gap.
   a current rule, exact workspace evidence, affected gate, owning rite, exact paths, and
   the smallest behavior-neutral delta.
 - Existing rites own semantic changes. Upgrade may sequence `$rite-clarify`,
-  `$rite-plan repair`, `$rite-converge`, `$rite-vet`, `$rite-prove`, `$rite-polish`,
+  `$rite-plan repair|revise|course-correct`, `$rite-converge`, `$rite-vet`, `$rite-prove`, `$rite-polish`,
   `$rite-review`, and `$rite-seal`; it never reimplements them or starts Build or Ship.
   `$rite-doctor` owns install/config diagnosis.
 - An admitted candidate route may name only the exact current gate artifacts its owner
@@ -50,7 +50,9 @@ references, and only current phase contracts needed for the observed gap.
    Archive-only is `current`; otherwise require contained regular `state.md` and read its
    cursor. A damaged/mismatched install stops at Doctor; missing live work routes
    `$rite-spec`; `done` is `current`. An unknown cursor is `unsupported`.
-1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields, and
+1. **Freeze preservation evidence.** Record `git status --short`, cursor form/fields,
+   `devrites-engine orient <slug>` (cursor, `task_graph`, `artifact_budgets`,
+   `bulk_files`), and
    hashes of completed-slice fields, candidate gate artifacts, existing answers/decisions,
    and protected history. Inventory every path that could change; absence is evidence,
    never permission to synthesize history. For a post-Build workspace, also retain the
@@ -69,6 +71,13 @@ references, and only current phase contracts needed for the observed gap.
    one at a time:
    - decision coverage or a material assumption → `$rite-clarify`;
    - stale/inconsistent planning or traceability with settled intent → `$rite-plan repair`;
+   - over-budget `state.md` or planning artifacts carrying checkpoint narrative, or
+     packets/traces in the workspace root → `$rite-plan revise` (verbatim relocation to
+     `history/` / `packets/`, current view only; IDs, meaning, answers and decisions
+     unchanged; nothing deleted);
+   - unbuilt slices beyond the [feature ceiling](../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+     → `$rite-plan course-correct` (`MVP cut` plus the named continuation sequence;
+     built slices and their evidence stay);
    - live code and recorded intent disagreement → `$rite-converge`;
    - any changed planning input or readiness defect → `$rite-vet`;
    - a missing/malformed strict manifest, missing/malformed/mismatched evidence binding,

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -7,10 +7,9 @@ user-invocable: true
 
 # $rite-vet: review the plan before build
 
-Vet every plan before code for scope, architecture, quality, proof, performance,
-failure modes, and writer safety. Cite findings; fold accepted technical
-hardening into planning artifacts; design Build tests. Temper owns product
-scope, Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
+Vet every plan's scope, architecture, quality, proof, performance, failures and writer
+safety. Fold cited technical findings; design Build tests. Temper owns product;
+Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
 `reference/depth.md`; profiles never remove the exact plan-reviewer gate
 ([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
 
@@ -36,8 +35,8 @@ plan declares a root-authored executable workflow file, read
 
 - Review implementation, not ambition. Challenge creep, complexity, proof, and
   risk without changing accepted product scope.
-- Root alone asks, decides, folds, writes, and sets readiness. Reviewers judge;
-  they add no route policy. Cite every finding and confidence; suppress
+- Root owns decisions/writes/readiness; reviewers judge without route policy.
+  Cite findings/confidence; suppress
   unverified or confidence ≤4 findings under `review-axes.md`.
   Lens arrows in `eng-lenses.md` are heuristics; band findings only under the
   four `review-axes.md` names.
@@ -47,8 +46,6 @@ plan declares a root-authored executable workflow file, read
   `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
   human approval before plan slices may edit them. A slice touching a protected path
   without approval → Vet **NEEDS CLARIFICATION**.
-  **Failing case:** plan edits another feature's `state.md` without recorded approval →
-  fail closed.
 - Use the lowest axis band; never average or round thin to ready. Search before
   asking and resolve reversible technical choices. Ask only human-owned choices.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
@@ -91,7 +88,11 @@ plan declares a root-authored executable workflow file, read
    changed clause — enumerate dependents via the dep graph and traceability
    refs, not only patched sites. Otherwise record one no-progress outcome. A
    different Critical/Important invariant needs exact evidence and a new
-   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. A packet
+   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reviewer
+   `Late:` rows on unchanged clauses follow the canonical
+   [late-finding rule](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+   Critical with a failure path → new fingerprint; otherwise `eng-review.md`
+   `## Deferred findings` (mechanism rows become one proof row at step 6). A packet
    marked `convergence_pressure` accepts an explicit, bounded declared
    residual/limitation folded into the contract text as closure for a finding
    marked as a refinement of an already-pinned clause; the recheck may re-raise
@@ -101,7 +102,10 @@ plan declares a root-authored executable workflow file, read
    materialization gate — anchors applied, mirrors consistent, invariants
    pass — without a dispatched reviewer; sub-Important findings already
    cannot keep recovery open. Reconcile
-   shared artifact/readiness gates and return to caller or next repair.
+   shared artifact/readiness gates, then enter step 8 or the next repair.
+   Do not fall through to steps 2–7. Retain evidenced unchanged coverage; changed
+   global contract/uncertain impact requires full applicable review. Reopen historical
+   findings only for affected invariants/dependencies.
 2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
    Harden to the smallest contract-complete plan, using marked topology action.
    Then verify bidirectional ID-and-meaning traceability across spec/plan/
@@ -133,7 +137,11 @@ plan declares a root-authored executable workflow file, read
    Technical gaps are `NEEDS REPLAN` and Plan repair — each finding marks
    itself `new_failure_mode` or names the already-pinned clause/fingerprint
    it refines, making alias-detection and `convergence_pressure` eligibility
-   mechanical. Product/risk gaps are
+   mechanical — and carries `kind: contract | mechanism`
+   (`review-axes.md` § Finding kind). Only `contract` findings open a Plan
+   repair; a `mechanism` finding is closed by one `test-plan.md` proof row
+   at step 6 and leaves readiness intact when nothing else is open.
+   Product/risk gaps are
    `NEEDS CLARIFICATION` and Clarify. Neither becomes a Build qid.
 5. **Review axes.** Apply `review-axes.md` through `eng-lenses.md`. Fold verified
    behavior-preserving technical findings; walk only human-owned decisions.
@@ -155,12 +163,11 @@ plan declares a root-authored executable workflow file, read
    that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
 8. **Build readback and readiness.** Add a cited five-line readback to
    `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/
-   critical flow; slice order/first slice; decisive proof/action-time gates. A
-   fresh implementer must need no product, architecture, or proof invention.
+   critical flow; slice order/first slice; decisive proof/action-time gates. No implementer should need to invent product, architecture, or proof.
    Contradiction, ownerlessness, or material ambiguity blocks via Clarify or Plan.
 
    Write exactly one `Implementation readiness: READY`, `NEEDS CLARIFICATION`,
-   or `NEEDS REPLAN`. Root alone sets READY after every account, checklist,
+   or `NEEDS REPLAN`. Root sets READY after every account, checklist,
    preflight, and sweep is green. Write phase/next step and emit one
    `Readiness inputs SHA-256` with
    `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
@@ -177,7 +184,7 @@ plan declares a root-authored executable workflow file, read
 > Do not replace interactive review with artifacts, change acceptance through
 > hardening, score without source evidence, or ignore unexplained complexity.
 
-## Phase exit (observable)
+## Phase exit
 
 **Complete when:** `eng-review.md` records exactly one readiness verdict, readiness
 binding SHA-256 passes, and every required reviewer account is admitted.

package/pack/generated/codex/skills/rite-vet/reference/anti-patterns.md

@@ -1,8 +1,6 @@
 # $rite-vet: anti-patterns
 
-Universal rationalizations + red flags live in
-[`../../devrites-lib/reference/standards/anti-patterns.md`](../../devrites-lib/reference/standards/anti-patterns.md): read it when the
-reluctance is broader than this phase. Below are the vet-specific ones.
+Read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patterns.md).
 
 Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
@@ -16,15 +14,15 @@ Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preservin
 
 | Excuse | Rebuttal |
 |---|---|
-| "I'll write all the findings into `eng-review.md` and let the user read it." | The artifact is the *output* of an interactive review, not a substitute for it. A material finding's path to "done" goes **through `AskUserQuestion`**, one at a time, with a recommendation + why. Dumping findings into one write and moving on is the exact failure this skill exists to prevent. |
+| "I'll write all the findings into `eng-review.md` and let the user read it." | Fold verified behavior-preserving findings together and recheck affected closure. Ask human-owned choices with recommendations and await answers. Recording alone resolves nothing; never silently change acceptance or mark unresolved choices READY. |
 | "The plan doesn't handle X: flag it." (without checking) | Quote the line first. If you can't quote where the plan handles X, you also can't be sure it doesn't: force confidence ≤4 and suppress. The "field/case doesn't exist" finding is the most common false positive; the verification gate exists to kill it. |
-| "It's an obvious fix. I'll just edit the plan." | Verified plan hardening is Vet's job; topology uses the marked action. |
+| "It's an obvious fix. I'll just edit the plan." | Vet hardens verified plans; topology uses the marked action. |
 | "This dimension is thin but the others are strong: net it's fine." | The gate is the **floor**, not the average. A plan `broken` on test-coverage does not pass because it's `strong` on architecture. |
-| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite the quoted evidence **before** the band. Score-first-justify-later is how a reviewer waves through a plan it already likes. |
-| "8+ files but it all needs to change: proceed." | The complexity smell is a **STOP-and-ask**, not a note. Name the overbuilt part, propose the smaller version that still meets acceptance, and let the human decide before any axis runs. Maybe it's justified (record *why*) but the gate fires first. |
+| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite quoted evidence **before** the band; never score first and rationalize later. |
+| "8+ files but it all needs to change: proceed." | Apply `review-axes.md` §0: justify complexity against the smallest contract-complete alternative; fold technical reductions through the marked action. File count does not justify design or require a pause. Ask only for changed scope, behavior, or risk policy. |
 | "There's no test for this, but the user can add one later." | Coverage is designed **now**, before the code, so the build writes tests alongside it. A deferred test is a test that misses the boundary cases writing-it-now would expose. Regressions are non-negotiable. Critical, no question. |
 | "Performance looks fine." | "Looks fine" is not a measurement. A perf finding is "measure X against budget Y" or it's nothing: don't recommend speculative tuning, and don't wave past an N+1 you can quote. |
-| "Cross-model agrees, so apply it." | Cross-model consensus is a strong *signal*, not an approval. Every cross-model finding is informational until the human approves it (or, in AFK, until the gate ceiling clears a hardening-only change). |
+| "Cross-model agrees, so apply it." | Consensus is a signal, not proof or approval. Verify the finding against source, then use the same technical-hardening or human-owned decision route; model agreement never authorizes a scope, acceptance, or policy change. |
 
 ## Reslice classifier rationalizations
 
@@ -36,6 +34,10 @@ Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preservin
 - A finding raised with confidence ≥7 but **no quoted source line**, that defeats the verification gate.
 - Acceptance/product-behavior growth auto-applied in AFK, or an orthogonal human-owned gate that did not pause.
 - A failure-mode table with rows but no verdict column filled: a "no test + no handling + silent" row not marked Critical.
-- The reviewer loop running past 3 iterations, or the reviewer / cross-model being handed the author's reasoning (defeats the fresh-context point).
+- Repeating an exhausted causal failure under the shared no-progress rule in
+  [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), or stopping a
+  distinct cause solely because the total review round exceeds three.
+- The reviewer / cross-model being handed the author's reasoning as independent
+  evidence (defeats the fresh-context point).
 - The skill writing code, implementing a slice, or running the build. That's `$rite-build`. Vet reviews and hardens the plan; it never implements.
 - Re-litigating the **spec's** scope/ambition, that was `$rite-temper`. Vet challenges *implementation* scope only.

package/pack/generated/codex/skills/rite-vet/reference/depth.md

@@ -1,10 +1,8 @@
 # Depth calibration: always vet, scale the rigor (never skip)
 
-`$rite-vet` runs on **every** plan: every feature deserves a correct engineering plan, not
-just the big ones. What changes with stakes is the *depth*, never *whether* it runs: a simple,
-reversible plan gets a fast **light pass**; a big or risky one gets the **full pass**. There is
-no skip. This shared definition is used by both the standalone `$rite-vet` and the always-run
-`$rite-autocomplete` step, so they agree on how deep to go.
+`$rite-vet` runs on **every** plan. Simple reversible work gets a **light pass**;
+big/risky work gets a **full pass**, never a skip. Standalone Vet and Autocomplete
+use these same depth rules.
 
 A four-section deep-dive on a one-file reversible plan is wasteful; rubber-stamping a
 migration-touching plan is dangerous. Match the effort to the stakes, but **always** leave a
@@ -55,6 +53,7 @@ triggers above, **never skipped**. Under the AFK gate ceiling:
   failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order fixes
   (these never grow acceptance). Record the rationale in `decisions.md`.
 - **Topology findings:** marked action; slice count alone never pauses.
-- **Always pause:** irreversible-risk findings, and any axis still below bar after the
-  ≤3-iteration reviewer loop.
+- **Stops:** human-owned irreversible-risk findings pause. Technical recovery follows
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+  with no depth-specific round limit; no-progress exhaustion blocks, never grants readiness.
 - **Cross-model** is off by default; it runs only if `--cross-model` was explicitly armed.

package/pack/generated/codex/skills/rite-vet/reference/review-axes.md

@@ -1,7 +1,7 @@
 # Vet review: scope, four axes, and outputs
 
-Run blocking §0, then the four axes and required outputs. Apply
-[`eng-lenses.md`](eng-lenses.md) throughout; calibrate every finding before presenting it.
+Run blocking §0, four axes, and outputs with [`eng-lenses.md`](eng-lenses.md);
+calibrate findings before presentation.
 
 Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
@@ -15,25 +15,28 @@ Authority: `.agents/skills/devrites-lib/reference/standards/acceptance-preservin
 
 ## §0. Scope challenge (blocking gate)
 
-Before reviewing implementation details, check whether the plan includes more work than
-the settled spec requires.
+Before implementation review, check for work beyond the settled spec.
 
-1. **What exists?** Find existing code/flows for each sub-problem (use the index per
-   [`tooling.md`](../../devrites-lib/reference/standards/tooling.md)). Can the plan capture their outputs instead of building parallel work?
-   Reuse → extend → build new; list missed reuse.
+1. **What exists?** Find reusable code/flows via
+   [`tooling.md`](../../devrites-lib/reference/standards/tooling.md). Reuse → extend →
+   build new; list missed reuse instead of planning parallel work.
 2. **Minimum diff.** Find the smallest contract-complete change. Flag non-blocking work;
    use the marked action for topology cuts.
 3. **Complexity smell.** **>8 files** or **>2 new services/modules/classes** needs a justified
    complexity gate; otherwise harden to the smallest contract-complete plan. Use the
    marked action for topology reduction.
-4. **Built-in check.** For each new pattern/infra/concurrency approach, dispatch
-   `devrites-source-driven` to verify current framework/runtime support and cite it. Custom
+   **Feature ceiling.** A plan over the
+   [feature ceiling](../../rite-plan/reference/slicing.md#feature-ceiling-split-an-epic-never-override-the-budget)
+   (over-budget `tasks.md`/`plan.md` from slice or AC count) is a scope finding, not a
+   `Budget override`: route to `$rite-plan course-correct` (`MVP cut`) with the
+   continuation sequence named; do not vet the whole epic.
+4. **Built-in check.** For each new pattern/infra/concurrency approach, invoke
+   `devrites-source-driven` inline to verify current framework/runtime support and cite it. Custom
    work where a built-in suffices is a scope-reduction finding.
 5. **Completeness.** Find edge/error/test shortcuts; prefer the complete option when the
    extra work is small, and flag small savings that leave known gaps.
-6. **Distribution check.** If the plan introduces a new artifact (CLI binary, package, container,
-   deployable), does it include how it gets built / published / installed? If distribution is
-   deferred, say so explicitly in "NOT in scope": don't let it silently drop.
+6. **Distribution check.** New artifacts (binary/package/container/deployable) need
+   build/publish/install plans or explicit deferral in "NOT in scope".
 7. **Applicability check.** Compare `spec.md`'s topology/data/integration/security/delivery
    decisions with live seams. A false `not applicable` or an `applies` row without the
    focused standard's owner, failure/recovery, deployment order, and proof output is `broken`.
@@ -49,15 +52,18 @@ the settled spec requires.
 > **STOP discipline.** Fold technical reduction into the plan; ask and stop only for a
 > human-owned choice.
 
-If the smell does not trip, present the §0 findings and proceed to Axis 1.
+After justifying complexity or folding the contract-preserving reduction, present
+the §0 findings and proceed to Axis 1. A human-owned unresolved choice still pauses.
 
 ---
 
-## Four axes (one at a time, at most 8 findings each)
+## Four axes (complete inventory, bounded presentation)
 
 Fold verified technical findings into the plan; present each human-owned decision in one
 `AskUserQuestion` packet. Combine support only for one owner/trade-off. HITL pauses; AFK
 uses `depth.md`. Never invent findings.
+Report every supported Critical/Important before repair. Group duplicates; compact
+presentation never caps the inventory or hides the ninth substantive defect.
 
 ### 1. Architecture
 
@@ -138,6 +144,25 @@ Tag each finding `[severity] (confidence: N/10) <plan/task/spec ref> — finding
 Quote supporting lines. Without them confidence is ≤4 and suppressed; never inflate it.
 `devrites-plan-reviewer` follows this rule.
 
+## Finding kind: contract or mechanism
+
+Tag every Critical/Important `kind: contract` or `kind: mechanism`; root confirms the tag
+at reconciliation.
+
+- **contract** — a *guarantee* (acceptance, interface, boundary, ownership, data shape,
+  ordering/durability, failure outcome, dependency choice) an implementer could build
+  differently and still pass the planned tests → plan text → `NEEDS REPLAN` + Plan repair.
+- **mechanism** — *how* a pinned clause is achieved (syscall order, fsync/rename shape,
+  lock scope, retry shape, parser detail): a test discriminates the wrong implementation
+  → root adds one named case row to `test-plan.md` (input → observable outcome + the
+  mutant that must fail) plus its `traceability.md` ref, re-emits the readiness binding,
+  rechecks mechanically (anchor, ID parity). No Plan repair, no reviewer redispatch;
+  Build's RED test proves it. Prove in code, not in prose.
+
+Mechanism becomes `contract` only when the plan asserts the opposite mechanism or the
+clause is a public/shared seam. **Failing case:** round after round of prose pins on
+already-pinned clauses.
+
 ---
 
 ## Present human-owned decisions

package/pack/generated/omp/agents/devrites-code-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: devrites-code-reviewer
-description: "Reviews one DevRites feature diff for /rite-review and /rite-seal with fresh context. Checks tests first, then correctness, readability, architecture, maintainability, and standards. Finds defects instead of rubber-stamping the change."
+description: "Reviews a full DevRites feature diff once for /rite-review and /rite-seal. Checks tests, correctness, readability, architecture, maintainability, and standards; returns every supported finding."
 tools: read, grep, glob, bash
 ---
 
@@ -37,9 +37,11 @@ From `spec.md`'s applicability map, load only triggered `repository-topology.md`
 
 You receive a feature slug or workspace path (`.devrites/work/<slug>/`) and the
 diff scope. Read `spec.md` for the objective and acceptance criteria, then
-`tasks.md`, `decisions.md`, `touched-files.md`, and `.devrites/principles.md` if
-present. The principles are binding project invariants. Run `git diff` for the
-feature scope and read the touched files.
+`decisions.md` and `.devrites/principles.md` if present. Read `tasks.md` and
+`touched-files.md` by the schema's bounded rule: when `devrites-engine orient <slug>`
+reports one over budget, index it (`grep -n`) and load only entries naming this
+candidate's AC/slice IDs. The principles are binding project invariants. Run `git diff`
+for the feature scope and read the touched files.
 
 ## Review (feature scope only)
 
@@ -105,12 +107,13 @@ not as a blocker on this diff.
 
 ## Rules
 
-- Stay in feature scope (touched files + diff). Out-of-scope problems → FYI follow-ups.
+- Out-of-scope problems → FYI.
 - Do **not** edit code. Return findings only.
 - Read surrounding source (call sites, existing guards, nearest consumer) before assigning severity; don't rate impact from the diff hunk alone.
 - Label each finding **Critical / Important / Suggestion / Nit / FYI** with `file:line`
   and a concrete fix. No praise padding.
-- If you can't verify something, say so explicitly rather than assuming it's fine.
+- Return every supported in-scope finding from the full inspected diff in this one pass, not only the first. Repeat canonical `Finding:`/`Basis:` rows; unverified → gap. Complete means evidenced coverage, not guaranteed defect-free.
+- In a recheck (the packet names open findings and a correction diff), your verdict covers those findings, the changed hunks, and their dependents. Anything else on hunks unchanged since your previous pass goes under `Late:` with severity and `file:line`; it is recorded for `/rite-review`, not verdict-bearing.
 - **Non-trigger (UI anti-slop):** if the diff touches no rendered UI surface, do not
   fire UI anti-slop (Inter, lavender, gradient, emoji headers). Code anti-slop still
   applies. The UI catalog is `devrites-frontend-reviewer`.

package/pack/generated/omp/agents/devrites-doubt-reviewer.md

@@ -57,6 +57,12 @@ mirror.
 
 - Don't edit anything. Return findings only.
 - Be concrete: the exact scenario that breaks it, with `file:line` where relevant.
+- Tag every `valid & actionable` finding `kind: contract` (the claim's guarantee is
+  wrong or unpinned) or `kind: mechanism` (the guarantee stands; a named test would
+  catch the wrong implementation — propose that case).
+- When the packet names prior fingerprints and a correction diff, your verdict covers
+  those and the dependents of each changed clause. Other observations on unchanged
+  text go under `Late:` with severity and site; they are recorded, not verdict-bearing.
 
 ## Output
 

package/pack/generated/omp/agents/devrites-plan-reviewer.md

@@ -105,7 +105,13 @@ criterion, slice, or proof.
   pad the report with praise. In a recheck, also mark each finding
   `new_failure_mode` or name the already-pinned clause/fingerprint it refines —
   the packet lists prior repairs; the mark makes alias-detection and
-  `convergence_pressure` eligibility mechanical.
+  `convergence_pressure` eligibility mechanical. Tag every Critical/Important
+  `kind: contract` (an implementer could build it differently and still pass the
+  planned tests) or `kind: mechanism` (a named test can discriminate the wrong
+  implementation; propose that case as the fix, not new plan prose).
+- In a recheck, your verdict covers the listed fingerprints, the correction diff, and
+  the dependents of each changed clause. Anything else you notice on unchanged text
+  goes under `Late:` with severity and site; it is recorded, not verdict-bearing.
 - When a dimension has no issue, say "strong: <why>" instead of inventing a
   finding.
 - If a claim cannot be verified, such as blast radius without an index, say so and