devrites 6.0.3 → 6.1.0

package/pack/generated/pi/skills/rite/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"intent":["devrites-lib/reference/intent-map.md"],"menu":["rite/reference/menu.md"],"dispatch":["devrites-lib/reference/parallel-dispatch.md"],"reply":["devrites-lib/reference/reply-contract.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite: DevRites menu + router
 
@@ -74,9 +74,10 @@ What each verb does lives once, in the Menu below; this table is the invocation
 Both forms call the same skill. The menu supports discovery; `/rite-<verb>` is the direct form.
 
 `use <slug>` is handled **inline**. There is no `rite-use` skill. Confirm
-`.devrites/work/<slug>/` exists, then re-point `.devrites/ACTIVE` to `<slug>` and report
+`<slug>` is a safe slug and `.devrites/work/<slug>/state.md` is a contained regular file, then re-point `.devrites/ACTIVE` to `<slug>` and report
 the now-active feature. It is cheap context-switching only: no re-spec, no phase run. If
-the workspace is missing, list the slugs under `.devrites/work/` and stop.
+the workspace or its `state.md` is missing, list the slugs under `.devrites/work/` that have
+`state.md` and stop.
 
 `guide` is an inline walkthrough for the first feature. Agree on one **real, small**
 change, then run spec → clarify → temper → define → vet → build → prove → polish → review → seal →

package/pack/generated/pi/skills/rite/reference/menu.md

@@ -32,14 +32,15 @@ Phase-ordered `/rite` reference. Load only for command detail or phase connectio
   `/rite-define` (plan) → `/rite-vet` (engineering review; light or full) →
   `/rite-build` ×N (all slices) → `/rite-prove` (once all built) →
   `/rite-polish` (always: code + UI if UI) → `/rite-review` → `/rite-seal` → `/rite-ship`.
-- **Existing codebase**: `/rite-adopt` → `/rite-clarify` → `/rite-define` → `/rite-vet` → build.
+- **Existing codebase**: `/rite-adopt` → `/rite-spec` → `/rite-clarify` → `/rite-define` → `/rite-vet` → build.
 - **Drift mid-build**: classify → bounded recovery for objective defects, `/rite-plan`
   repair for a wrong durable plan, or one user decision for real product/risk drift.
 - **Older workspace cannot resume**: `/rite-upgrade` audits first → only proven gaps use
-  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. It never
-  migrates cursor format or invents a prior pass.
-- **Resumed / adopted / stalled**: `/rite-converge` (assess live code vs intent → append the
-  remaining slices) → `/rite-vet` → `/rite-build` ×N → continue at `/rite-prove`.
+  Clarify/Plan repair/Converge/Vet or Prove/Polish/Review/Seal → resume. A cursor with
+  no `schema` row needs `devrites-engine migrate <slug>` first; upgrade never migrates
+  cursor format itself or invents a prior pass.
+- **Resumed / stalled, or adopted after Define** (has `plan.md` + `tasks.md`): `/rite-converge`
+  (assess live code vs intent → append the remaining slices) → `/rite-vet` → `/rite-build` ×N → continue at `/rite-prove`.
 
 ## Rules this menu obeys
 

package/pack/generated/pi/skills/rite-adopt/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[path or area to adopt] [+ what you want to build next]"
 user-invocable: true
 ---
 <!-- loads: {"always":["rite-adopt/reference/adoption.md","rite-adopt/reference/anti-patterns.md","rite-polish/reference/ledger.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-adopt` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-adopt` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-adopt: onboard existing code
 
@@ -48,7 +48,8 @@ parallel convention system.
    resistance. Never create convention bands, scores, or a command cache.
 6. A genuine non-negotiable invariant may be proposed for
    `.devrites/principles.md`; the human must ratify it.
-7. Set the next step to `/rite-clarify` and stop. Do not plan or build.
+7. Set the next step to `/rite-spec <slug>` and stop; Spec extends this workspace and owns
+   `brief.md`, `checklists/`, and `spec_gate`. Do not plan or build.
 
 > Refuse the rationalizations in [`anti-patterns`](reference/anti-patterns.md).
 
@@ -59,5 +60,5 @@ Done: adopted <scope> into <slug>.
 Changed: <workspace artifacts>; project guidance <proposed | unchanged>
 Evidence: <source/CI paths inspected>
 Open: <questions | none>
-Next: /rite-clarify
+Next: /rite-spec <slug>
 ```

package/pack/generated/pi/skills/rite-autocomplete/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/one-shot-actions.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","rite-autocomplete/reference/decision-policy.md","rite-autocomplete/reference/loop.md","rite-autocomplete/reference/stop-conditions.md"],"triggers":{"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["state.md","spec.md","plan.md","tasks.md","questions.md","decisions.md","drift.md","evidence.md","test-plan.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase autocomplete` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase autocomplete` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-autocomplete: full lifecycle, unattended
@@ -127,11 +127,12 @@ executable controller/harness/bundle bytes or a missing writer, read
    product scope is never auto-resolved by a recommended option; it stops for a human.
    Technical exhaustion records terminal
    `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
-6. **Seal boundary.** Without a ship flag, stop at Seal GO with `/rite-ship` —
-   unless `continue_sequence: false` or sequence budget is spent; otherwise
-   leave the sealed workspace unshipped and open the next recorded continuation
-   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation));
-   report the sequence position on every stop.
+6. **Seal boundary.** Without a ship flag, leave the sealed workspace unshipped and
+   open the next recorded continuation
+   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation))
+   unless `continue_sequence: false`, the sequence budget is spent, or no entry
+   remains; then stop at Seal GO with `/rite-ship`. Report the sequence position on
+   every stop.
    With a ship flag, perform Ship preflight, disclose the exact Git plan, and stop for
    fresh literal `GO` plus native approval. **Completion:** performed no Git action before fresh literal `GO` plus native approval.
 

package/pack/generated/pi/skills/rite-autocomplete/reference/loop.md

@@ -53,7 +53,8 @@ and parallel AFK headroom as stop conditions. Pass this invocation's
 that already name a ranked recommended option (recommended pick via
 `devrites-engine state resolve`) instead of queuing them or handing
 `/rite-resolve` to the user. Escalating, irreversible-risk, access, and
-blocking with no recommended option still pause.
+blocking with no recommended option still pause, as does Seal's judgment-only
+validating question (`slice: seal`).
 
 ## Phase arc
 

package/pack/generated/pi/skills/rite-autocomplete/reference/stop-conditions.md

@@ -66,7 +66,8 @@ exhausted.
   would add acceptance or product scope is never auto-picked, even with a
   recommended option; it stops for a human. Blocking with no
   recommended option still stops. Validating: auto-pick the recommended option,
-  close the question, continue.
+  close the question, continue — except Seal's judgment-only acceptance question
+  (`slice: seal`), which only a human answers; it stops.
 - **Temper:** `expand` and extra acceptance stop: ask through `AskUserQuestion`, hold the
   fold, and continue only after a human resolves the qid (an ADR is not that answer).
   Irreversible-risk still pauses. `hold-rigor`, `reduce-to-MVP`, and a skip do not pause.

package/pack/generated/pi/skills/rite-build/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/agents.md","rite-build/reference/phase-contract.md","rite-build/reference/one-slice-cycle.md","rite-build/reference/wright-dispatch.md","rite-build/reference/checkpoint.md","rite-build/reference/spec-drift-guard.md","rite-build/reference/output.md","rite-build/reference/anti-patterns.md"],"rootOnly":["rite-build/reference/phase-contract.md","rite-build/reference/wright-dispatch.md","rite-build/reference/checkpoint.md","rite-build/reference/output.md","rite-build/reference/afk-discipline.md","rite-build/reference/checkpoint-protocol.md","rite-build/reference/parallel-batch.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/workflow-artifacts.md"],"triggers":{"afk":["rite-build/reference/afk-discipline.md","devrites-lib/reference/standards/afk-hitl.md","rite-build/reference/checkpoint-protocol.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"coding":["devrites-lib/reference/standards/coding-style.md"],"debug-recovery":["devrites-lib/reference/standards/debug-recovery.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"frontend":["rite-build/reference/frontend-trigger.md"],"parallel":["rite-build/reference/parallel-batch.md"],"patterns":["devrites-lib/reference/standards/patterns.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"tdd":["rite-build/reference/tdd.md","devrites-lib/reference/standards/testing.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","strategy.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"slice-wright":["brief.md","spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","assumptions.md","questions.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase build` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase build` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-build: one verified slice
@@ -19,7 +19,7 @@ caps and pause rules. Every wright returns after one slice.
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
 Root owns gates/bookkeeping; fresh
-[`devrites-slice-wright`](.pi/agents/devrites-slice-wright.md) writes source/tests.
+[`devrites-slice-wright`](../../agents/devrites-slice-wright.md) writes source/tests.
 Workflow Artifacts use
 [`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
 (trigger `workflow-artifacts` — only when the plan declares them).

package/pack/generated/pi/skills/rite-build/reference/afk-discipline.md

@@ -9,7 +9,9 @@ contract for the sentinel schema, defaults, gate ceiling, and mutable-counter
 ownership. This file owns only Build's dispatch, charging, and red-path behavior.
 
 Rules: green before `built`; hard `max_slices` cap; gates before the action they
-control; irreversible work (destructive/auth/public API) always pauses.
+control; irreversible work (destructive/auth/public API) always pauses; a tick
+never ends with an open or sealed wave — wait for its returns or
+`dispatch abandon --reason`.
 
 ## Iteration cap
 

package/pack/generated/pi/skills/rite-build/reference/output.md

@@ -9,7 +9,7 @@ Evidence: acceptance met; tests <cmd> → pass; browser <summary|n/a>; drift <no
 Open: <none|blockers|questions>
 Next: /rite-build
 Record: .devrites/work/<slug>/evidence.md
-↻ Hygiene: /clear between slices; /rite-handoff if away > a few hours
+↻ Hygiene: /clear between slices (none in `orient` `inflight_waves`); /rite-handoff if away > a few hours
 ```
 
 **All built:**

package/pack/generated/pi/skills/rite-build/reference/parallel-batch.md

@@ -229,6 +229,6 @@ isolation cannot be established.
 
 ## Host
 
-pi: N concurrent `subagent` wrights (`acceptEdits`, cwd=worktree). Codex: require
+pi: N concurrent `subagent` wrights (cwd=worktree). Codex: require
 host-explicit concurrent worktree writers + native reconcile; else force serial.
 Never two writers in one worktree; never root-emulated concurrency.

package/pack/generated/pi/skills/rite-build/reference/phase-contract.md

@@ -14,6 +14,8 @@ Spec Drift Guard still applies.
    `Implementation readiness: READY`, current `Readiness inputs SHA-256`, exact
    required accounts, ID/meaning traceability and green proof preflight.
    Run `devrites-engine check readiness <slug>`; any miss/nonzero blocks.
+   Non-empty `orient` `inflight_waves` is reconciled first: `dispatch return` each
+   role whose account is in hand, else `dispatch abandon --reason` and re-dispatch.
 2. **Select.** Pick the lowest pending slice whose `depends_on` are all built, using
    `orient` `task_graph.slices` plus the `state.md` built list — never by scanning
    `tasks.md`; then `observe slice` it. Restate its goal, ACs, exclusions and exact paths. Include

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -11,6 +11,15 @@ Claude grants only the exact wright `acceptEdits`; Codex uses its workspace root
 the exact `:workspace` wright, and read-only specialists. Never bypass/substitute
 the wright or recreate an engine bridge.
 
+## Standalone correction
+
+`/rite-quick`, `/rite-dogfood`, and `/rite-pr-feedback` fixes have no `tasks.md`
+slice, so skip Prepare's `check slice`, `context --slice`, and the build `dispatch`
+wave. Give the wright an inline contract: goal, acceptance check, exact
+project-relative paths, and proof command. With an active workspace, `claim add`
+those paths first. On return, compare its file list and `git diff --name-only`
+with the paths; reject any extra path.
+
 ## Isolated writer-worktree pilot
 
 Use native isolation only when the current host exposes an explicit named-writer
@@ -55,7 +64,7 @@ worktrees stay forbidden.
 2. Include goal, verbatim acceptance, exclusions, context,
    `test-plan.md` proof commands, applicable standards, and the exact
    `WIP(<slug>):` subject (no slice id). Build the wright's read-set with
-   `devrites-engine context <slug> --phase build --role slice-wright --slice <SLICE-ID> --trigger <set>`
+   `devrites-engine context --skills-root .pi/skills <slug> --phase build --role slice-wright --slice <SLICE-ID> --trigger <set>`
    and hand it the bundle path (over-budget artifacts arrive as anchor indexes;
    read owning sections live). Evaluate each trigger condition and pass those
    that fire (TDD slice → `tdd`, AFK run → `afk`, UI work → `frontend`, …).
@@ -64,6 +73,8 @@ worktrees stay forbidden.
    topology/data/integration standard, include only the feature-specific owner/invariant,
    failure or partial-state case, recovery rule, and required proof from the vetted plan.
    Do not paste the whole standard or silently omit an applicable risk.
+   Quote every active `decisions.md` carry-forward constraint whose `Files:`
+   overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
 3. Record `git diff --name-only` before dispatch so unrelated work remains
    distinguishable. For an isolated pilot, also record committed base SHA and exact
@@ -141,3 +152,11 @@ TTL is crash recovery, not normal cleanup.
    escalation without the checked-assumption list (verified|falsified) is
    malformed; root sweeps the unchecked remainder per
    [`spec-drift-guard.md`](spec-drift-guard.md) before repair.
+6. **Learning edge.** A correction accepted with a confirmed cause (a review,
+   gate, or proof rejection plus its fix) becomes a carry-forward constraint so
+   later slices start where this one ended: append one line under
+   `decisions.md` `## Carry-forward constraints` —
+   `- <rule> — from <SLICE-ID> (<evidence ref>); Files: <paths>`. Record the
+   derived rule, not the output, at the scope its evidence supports: "this
+   button is blue" never becomes "buttons are blue". Never edit `tasks.md` mid-build (it is a
+   readiness input). **Failing case:** slice 3 repeats a defect slice 2 fixed.

package/pack/generated/pi/skills/rite-clarify/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/afk-hitl.md","rite-clarify/reference/decision-coverage.md","rite-clarify/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md"],"workspaceByRole":{"evidence-scout":["brief.md","spec.md","state.md","questions.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase clarify` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase clarify` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-clarify: resolve product decisions

package/pack/generated/pi/skills/rite-converge/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/spec-grammar.md","devrites-lib/reference/standards/agents.md","devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/testing.md","rite-converge/reference/convergence-assessment.md","rite-converge/reference/anti-patterns.md","rite-build/reference/spec-drift-guard.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"workflow-artifacts":["devrites-lib/reference/workspace-artifact-schema.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md"],"workspaceByRole":{"evidence-scout":["spec.md","plan.md","tasks.md","state.md","evidence.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase converge` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase converge` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-converge: compare live code with intent
@@ -101,9 +101,10 @@ Pull on demand:
    Produces. A principle violated in the current code is its own top-severity gap.
    Dispatch up to three independent inventory partitions to `devrites-evidence-scout` on the
    same live-code snapshot — build each scout's read-set once with
-   `devrites-engine context <slug> --phase converge --role evidence-scout` and hand it the
-   bundle path; run the wave through
-   `devrites-engine dispatch <slug> open|start|seal|return` (per
+   `devrites-engine context --skills-root .pi/skills <slug> --phase converge --role evidence-scout --out
+   ctx/converge-evidence-scout.p<n>.bundle.md` and hand it the bundle path; run the wave
+   through `devrites-engine dispatch <slug> open|start|seal|return` with one lane label
+   per partition (`--role evidence-scout.p1 --role evidence-scout.p2 ...`, per
    [`parallel-dispatch.md`](../devrites-lib/reference/parallel-dispatch.md)), which
    auto-records dispatch/return metrics. Await their
    dossiers, then reconcile the cited facts in the root

package/pack/generated/pi/skills/rite-customize/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"]},"workspace":[]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-customize` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-customize` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-customize: native project customization
 

package/pack/generated/pi/skills/rite-define/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/spec-grammar.md","rite-define/reference/plan-template.md","rite-define/reference/gates.md","rite-define/reference/anti-patterns.md","rite-plan/reference/slicing.md","rite-plan/reference/task-breakdown.md","rite-spec/reference/acceptance-criteria.md","rite-spec/reference/state-workspace.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"agents":["devrites-lib/reference/standards/agents.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"frontend":["devrites-frontend-craft/reference/fullstack.md"],"principles":["devrites-lib/reference/standards/principles.md"],"visual":["devrites-lib/reference/visual-playbooks/index.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/workspace-artifact-schema.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","strategy.md","design-brief.md","references.md"],"workspaceByRole":{"plan-drafter":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","strategy.md","design-brief.md","references.md","state.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase define` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase define` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-define: plan from the spec
@@ -106,6 +106,8 @@ Pull these via `Read` when shaping the plan:
    capability end to end; first is the thinnest useful path, ordered by dependency then
    risk. Apply the slice-count and broad-refactor rules above plus
    [`slicing.md`](../rite-plan/reference/slicing.md) and [`task-breakdown.md`](../rite-plan/reference/task-breakdown.md).
+   Run `devrites-engine recall --paths <files likely touched>`; fold each relevant prior
+   decision, carry-forward constraint, or finding into that slice's `Prior-slice learnings`.
    Mark per slice: **Frontend craft required**
    and **Browser proof required** (UI), and whether it's **fullstack** (FE+BE → contract
    first, see [`fullstack.md`](../devrites-frontend-craft/reference/fullstack.md)). **For UI slices, name which
@@ -169,8 +171,7 @@ Pull these via `Read` when shaping the plan:
    `Plan sanity` (slice count + riskiest boundary/gate), `Expected build interruptions`
    (`none` or only justified action-time gates), and `Build exactly this?` (yes → approve;
    no → `/rite-plan revise`). When the human confirms the plan, write `Plan approved: <iso>` to
-   `state.md` (see [state-workspace](../rite-spec/reference/state-workspace.md)); `/rite-build`
-   checks this exists before building.
+   `state.md` (see [state-workspace](../rite-spec/reference/state-workspace.md)).
 
 ## tasks.md slice format
 

package/pack/generated/pi/skills/rite-doctor/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: ""
 user-invocable: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"workspace":["state.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-doctor` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-doctor` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-doctor: DevRites diagnostics
 
@@ -27,12 +27,18 @@ Read-only: never repair files, advance a feature, or diagnose the application.
    For enabled surfaces, require the canonical Claude skills/settings and the
    generated Codex skills, exact agent profiles, config, and AGENTS bridge.
    Cross-check the loaded/effective host configuration when the host exposes it:
-   Claude root plan mode with only `devrites-slice-wright` writable; Codex root
-   `devrites-orchestrator`, wright `:workspace`, all reviewers `:read-only`.
-   Also allowed as writers: `fast-builder` (`acceptEdits` / `:workspace`) and the
-   `overhaul-*` agents (every tool); the other `fast-*` roles are read-only.
+   Claude read-only roles keep a tools allowlist without Edit/Write plus
+   `permissionMode: plan`, which Claude honors only while the parent is not in
+   acceptEdits/auto/bypass — the guarantee is tools + instructions, the mode is
+   best-effort; only `devrites-slice-wright` (`acceptEdits`) writes in the
+   lifecycle. Codex root `devrites-orchestrator`, wright `:workspace`, all
+   reviewers `:read-only`. Also allowed as writers: `fast-builder` (`acceptEdits`
+   / `:workspace`) and the `overhaul-*` agents (every tool; `overhaul-implementer`
+   `acceptEdits`); the other `fast-*` roles are read-only.
    File presence without effective loading is `WARN`; wrong permissions or a
-   missing required profile is `FAIL`.
+   missing required profile is `FAIL`. A project or local Claude
+   `permissions.defaultMode: plan` blocks the root's `.devrites` writes:
+   `FAIL`, remediation: remove it.
 4. **Inspect workspace topology.** Read `.devrites/ACTIVE` if present. An empty
    cursor is `OK` (no active feature). Otherwise require one safe slug, a
    contained regular `.devrites/work/<slug>/state.md`, and no symlink in the

package/pack/generated/pi/skills/rite-dogfood/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-frontend-craft/reference/quality-standards.md","devrites-lib/reference/reply-contract.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"testing":["devrites-lib/reference/standards/testing.md"],"tooling":["devrites-lib/reference/standards/tooling.md"]},"workspace":["state.md","questions.md","dogfood.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-dogfood` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-dogfood` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-dogfood: diff-scoped browser QA
 
@@ -26,7 +26,7 @@ Step 0: Read `.pi/skills/devrites-lib/reference/standards/core.md`, then [`tooli
 2. **Map changed journeys.** Read the diff and relevant routes/components. Write or update `.devrites/work/<slug>/dogfood.md` with Mermaid flowcharts for each touched user journey. Completion: every user-visible changed surface appears in at least one flow or is marked non-browser-testable.
 3. **Build matrix.** Turn flow nodes and branches into scenarios: happy, error, empty, permission, responsive, accessibility basics, and persona paper cuts. Completion: every flow branch has a scenario row.
 4. **Run browser.** Start/reuse the dev server (honor `--port N` when given), visit each route, capture screenshot/console/network notes, and mark each scenario `Pass`, `Fail`, `Fixed`, `Blocked (human verify)`, or `Blocked (human decision)`.
-5. **Safe fix loop.** For `Fail` or sharp paper cut: fix only if obvious and contained; add a regression test or record why a replay/screenshot is the only meaningful check; re-run the scenario. Otherwise record the decision for a human.
+5. **Safe fix loop.** For `Fail` or sharp paper cut: fix only if obvious and contained; add a regression test or record why a replay/screenshot is the only meaningful check; re-run the scenario. Otherwise record the decision for a human. The root never edits source/tests: each fix goes to exact `devrites-slice-wright` with an exact-path contract per [wright-dispatch.md § Standalone correction](../rite-build/reference/wright-dispatch.md#standalone-correction); reject any returned path outside it.
 6. **Finalize.** Run the relevant test command once, update `dogfood.md`, and add follow-ups to `questions.md` only for real human decisions.
 
 ## Output

package/pack/generated/pi/skills/rite-explain/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["rite-explain/reference/intake.md"],"triggers":{"repo":["devrites-lib/reference/standards/tooling.md"],"style":["devrites-lib/reference/standards/prose-style.md"],"principles":["devrites-lib/reference/standards/principles.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-explain` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-explain` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-explain: the human half of the learning loop
 

package/pack/generated/pi/skills/rite-fast/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/standards/elicitation.md","devrites-lib/reference/standards/spec-grammar.md","rite-fast/reference/artifacts.md","rite-fast/reference/check-and-triage.md"],"triggers":{"risk":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["spec.md","plan.md","evidence.md"]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase fast` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase fast` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-fast: shortened lane for mid-size work
 
@@ -49,10 +49,10 @@ proof) and drops the per-slice ceremony. It stands outside the engine lifecycle:
 
 | Role | Agent | Mode |
 | --- | --- | --- |
-| Planner: repo facts, draft spec and plan, ranked questions | [`fast-planner`](.pi/agents/fast-planner.md) | read-only |
-| Builder: slices and accepted fixes | [`fast-builder`](.pi/agents/fast-builder.md) | write-capable, exact paths |
-| Completeness checker | [`fast-checker`](.pi/agents/fast-checker.md) | read-only |
-| Critic: review and polish in one pass | [`fast-critic`](.pi/agents/fast-critic.md) | read-only |
+| Planner: repo facts, draft spec and plan, ranked questions | [`fast-planner`](../../agents/fast-planner.md) | read-only |
+| Builder: slices and accepted fixes | [`fast-builder`](../../agents/fast-builder.md) | write-capable, exact paths |
+| Completeness checker | [`fast-checker`](../../agents/fast-checker.md) | read-only |
+| Critic: review and polish in one pass | [`fast-critic`](../../agents/fast-critic.md) | read-only |
 
 Dispatch each role as its named agent in a fresh context with a packet that names
 the slug, the workspace paths, and the exact task. If the host cannot dispatch named
@@ -69,7 +69,9 @@ installed and no fresh context is available, stop with `Stopped: fast-* agents m
    record `unproven: no commands` and continue. PROVE will report it.
 3. Pick a short kebab-case slug from the task. If the argument names an existing
    `.devrites/work/<slug>/plan.md` with `Lane: fast`, **resume**: read the ledger and
-   continue at the first phase or slice that is not complete.
+   continue at the first phase or slice that is not complete. If `.devrites/work/<slug>/`
+   exists without `Lane: fast`, or `.devrites/archive/<slug>/` exists, pick a new slug;
+   if the user named that slug, stop instead — never overwrite another workspace.
 
 ## 1. Shape: spec, plan, questions
 

package/pack/generated/pi/skills/rite-frame/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-frame/reference/failure-modes.md"],"triggers":{"principles":["devrites-lib/reference/standards/principles.md"],"simplify":["devrites-lib/reference/standards/coding-style.md","devrites-lib/reference/standards/patterns.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":[]} -->
-> Read-set manifest: `devrites-engine context <slug> --phase frame` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase frame` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-frame: frame the goal, audit the diff

package/pack/generated/pi/skills/rite-handoff/SKILL.md

@@ -6,7 +6,7 @@ disable-model-invocation: true
 argument-hint: "[what the next session will focus on]"
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-handoff/reference/handoff-template.md","devrites-lib/reference/reply-contract.md"],"triggers":{"hygiene":["devrites-lib/reference/standards/context-hygiene.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-handoff` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-handoff` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # /rite-handoff: chat-only context, into a fresh-agent doc
 
@@ -48,8 +48,9 @@ For each of these, write the content into its **canonical home** first, then mer
 - **Assumption** about behaviour / API / user intent → append to `assumptions.md`.
 - **Drift event raised but not fully resolved** → update `drift.md` with the current
   resolution status (open / asked-user / repaired).
-- **Files modified in chat not yet in `touched-files.md`** → append to
-  `touched-files.md`.
+- **Files modified in chat not yet in `touched-files.md`** → no recorded provenance, so
+  record them as drift in `drift.md` (or a `questions.md` entry); never append them to
+  `touched-files.md`, the candidate manifest Ship stages.
 
 The handoff doc itself then says "synced N entries into decisions.md", not the entries
 themselves. The workspace is the canonical store; the handoff is the chat-only delta.

package/pack/generated/pi/skills/rite-learn/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/documentation.md","devrites-lib/reference/standards/tooling.md"],"workspace":["state.md","decisions.md","drift.md","evidence.md","review.md","seal.md","questions.md"],"workspaceByRole":{"retrospector":["state.md","decisions.md","drift.md","evidence.md","review.md","seal.md","questions.md"]},"triggers":{"agents":["devrites-lib/reference/standards/agents.md"]}} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-learn` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-learn` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-learn: review durable lessons
 
@@ -29,7 +29,7 @@ of one authority; it cannot promote a rule alone.
    A missing, failed, timed-out, or malformed result reports `Candidate: NOT-RUN
    (unavailable: <reason>)` as a gap, never `Candidate: none`; an unavailable role stops
    for HITL per [`agents.md`](../devrites-lib/reference/standards/agents.md) (trigger `agents`).
-3. Keep corrections repeated in two features, a judgement call made twice, or a defect class seen twice; drop one-off preferences, task-specific detail, generic advice.
+3. Keep corrections repeated in two features (a `## Carry-forward constraints` rule recurring in two archived `decisions.md` qualifies), a judgement call made twice, or a defect class seen twice; drop one-off preferences, task-specific detail, generic advice.
    Broad mode also proposes **retirements**: a rule found via a `rite-learn: accepted`
    marker whose cited failing case or owner no longer exists in live source, whose
    review-by date passed unverified, or that is a model-default no-op. Zero is valid but

package/pack/generated/pi/skills/rite-plan/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/agents.md","rite-plan/reference/slicing.md","rite-plan/reference/replan-and-repair.md","rite-plan/reference/dependency-graph.md","rite-plan/reference/task-breakdown.md","rite-plan/reference/anti-patterns.md","rite-define/reference/plan-template.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","drift.md"],"workspaceByRole":{"plan-drafter":["brief.md","spec.md","plan.md","tasks.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","state.md","drift.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase plan` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase plan` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-plan: (re)plan an active feature

package/pack/generated/pi/skills/rite-plan/reference/replan-and-repair.md

@@ -29,6 +29,8 @@ A drift event stopped the build. Steps:
 1. Read the `drift.md` entries and their classifications. Fold EVERY open entry
    and accepted finding for the affected artifacts in ONE pass, never serially.
 2. If the user answered a drift question, encode that decision in `decisions.md`.
+   Fold each `decisions.md` carry-forward constraint into `Prior-slice learnings`
+   of the remaining slices it affects.
 3. Update `spec.md` (only the affected sections) and `plan.md`/`tasks.md` to match
    reality. Adjust acceptance criteria if they were wrong.
    **Write the pointer, not the history.** Name the findings a fold closes by ID, one line

package/pack/generated/pi/skills/rite-plan/reference/slicing.md

@@ -165,4 +165,6 @@ while pivoting is still cheap.
 
 ## Slice independence
 Order by dependency, but minimize coupling. A slice that needs three other slices first
-is a smell: look for a thinner cut that stands alone.
+is a smell: look for a thinner cut that stands alone. An edge exists only when this slice
+reads something the other produces: write it as `SLICE-001 (via <interface>)`. If you
+cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.

package/pack/generated/pi/skills/rite-polish/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 ---
 
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","rite-polish/reference/code.md","rite-polish/reference/anti-patterns.md","rite-polish/reference/anti-ai-slop.md","rite-polish/reference/harden-checklist.md","rite-polish/reference/ledger.md","rite-build/reference/checkpoint.md"],"triggers":{"adr":["rite-polish/reference/adr-promotion.md"],"agents":["devrites-lib/reference/standards/agents.md"],"backend":["rite-polish/reference/backend-polish.md"],"coding":["devrites-lib/reference/standards/coding-style.md","devrites-lib/reference/standards/duplicate-code.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"ui":["rite-polish/reference/ui.md","rite-polish/reference/design-memory.md","rite-polish/reference/design-system-discovery.md","rite-polish/reference/browser-polish-evidence.md","devrites-lib/reference/standards/browser-proof-checklist.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","design-brief.md","browser-evidence.md","polish-report.md"],"workspaceByRole":{"slice-wright":["spec.md","architecture.md","plan.md","tasks.md","test-plan.md","state.md","decisions.md","design-brief.md"]}} -->
-> Read-set manifest: `devrites-engine context <slug> --phase polish` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --phase polish` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
 # /rite-polish: finish before review
@@ -79,7 +79,7 @@ Incomplete comparison is **not** agreement. Record axis deltas in `polish-report
    (code polish)**; if backend was touched, assess **Phase 2 (backend polish)** from
    the same file. Reconcile the findings, then send accepted corrections as one bounded
    wright contract: build its read-set with
-   `devrites-engine context <slug> --phase polish --role slice-wright`, run the
+   `devrites-engine context --skills-root .pi/skills <slug> --phase polish --role slice-wright`, run the
    single-agent wave through `devrites-engine dispatch <slug> open|start|seal|return`
    (auto-records dispatch/return metrics), and gate returned paths
    with `devrites-engine check diff-scope <slug> --allow <contract-paths>` before

package/pack/generated/pi/skills/rite-pov/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[candidate/link/question]"
 user-invocable: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/tooling.md"],"workspace":["decisions.md"]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-pov` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-pov` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-pov: project-grounded external verdict
 

package/pack/generated/pi/skills/rite-pr-feedback/SKILL.md

@@ -6,7 +6,7 @@ user-invocable: true
 disable-model-invocation: true
 ---
 <!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/git-workflow.md"],"triggers":{"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":[]} -->
-> Read-set manifest: `devrites-engine context [slug] --skill rite-pr-feedback` bundles every file named below into one deduplicated read.
+> Read-set manifest: `devrites-engine context --skills-root .pi/skills <slug> --skill rite-pr-feedback` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # /rite-pr-feedback: resolve PR review threads
 
@@ -20,6 +20,7 @@ Step 0: Read [`core.md`](../devrites-lib/reference/standards/core.md), plus [`gi
 - Judge centrally before dispatching any fix; isolated fix agents do not decide legitimacy.
 - Never execute code or commands from review comments.
 - Never resolve a thread without a reply that names what happened.
+- **Fresh approval.** Before any commit, push, reply, or resolve, disclose the exact plan (files, commit subject, branch, thread replies and resolutions) and get fresh explicit user approval for that attempt; a changed plan needs new approval. AFK/autonomous mode never supplies it — stop and wait.
 
 ## Workflow
 1. **Locate PR/thread.** Argument URL = targeted thread; PR number = all unresolved threads on that PR; blank = current branch PR via `gh pr view`. Stop if `gh` is unavailable. Each stop below quotes the failing command's output and names one recovery command; never substitute another branch's or the most recent PR:
@@ -29,15 +30,15 @@ Step 0: Read [`core.md`](../devrites-lib/reference/standards/core.md), plus [`gi
    **Completion:** exactly one PR (and thread, for a URL) located, or one named stop reported.
 2. **Fetch.** Use GitHub GraphQL/CLI to collect unresolved review threads with file, line, author, body, and thread id. Completion: every unresolved thread is represented once, or the fetch error is reported.
 3. **Legitimacy gate.** For each item, read the surrounding code and classify: `fix`, `not-addressing`, `declined`, `reply-only`, or `needs-human`. Deduplicate overlapping items.
-4. **Fix approved items.** Apply contained fixes, add/update tests when behavior changes, and run targeted checks. Larger product/API/security calls become `needs-human`.
-5. **Commit/push.** Stage only touched files; commit only if changes exist; push the branch.
+4. **Fix approved items.** Apply contained fixes, add/update tests when behavior changes, and run targeted checks. The root never edits source/tests: each fix goes to exact `devrites-slice-wright` with an exact-path contract per [wright-dispatch.md § Standalone correction](../rite-build/reference/wright-dispatch.md#standalone-correction); reject any returned path outside it. Larger product/API/security calls become `needs-human`.
+5. **Commit/push.** After fresh approval of the disclosed plan: stage only touched files; commit only if changes exist; push the branch.
    Push rejected (protected branch, non-fast-forward, hooks): stop and report the exact
    rejection — never force-push or rewrite a shared branch. Post-push checks fail: record
    the failing check, choose fix-forward or revert, put the choice + reason in the thread
    reply — never a silent red push.
    **Completion:** committed/pushed with SHA evidence and green checks, or no commit (empty
    diff), or the push failure reported verbatim.
-6. **Reply and resolve.** Reply to every thread with outcome and evidence. Resolve only `fix`, `not-addressing`, `declined`, and `reply-only`; leave `needs-human` open.
+6. **Reply and resolve.** Under the approved plan, reply to every thread with outcome and evidence. Resolve only `fix`, `not-addressing`, `declined`, and `reply-only`; leave `needs-human` open.
    **Completion:** every thread has one recorded outcome and only permitted terminal outcomes are resolved.
 7. **Verify.** Fetch unresolved threads again and report remaining intentional opens.