devrites 6.1.0 → 6.1.2

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -223,8 +223,9 @@ project/decision docs, and authoritative dependency sources; make and record rev
 implementation/test choices. Ask only about product, scope, acceptance, architecture policy,
 irreversible risk, or human-only access/action.
 
-Objective test/build/tool failure runs bounded `devrites-debug-recovery`; fix it or record a
-technical blocker. Never ask permission for another attempt, test, parser repair, or probe.
+Objective test/build/tool failure runs bounded `devrites-debug-recovery`; fix it, or escalate and
+park it under the [retry contract](#retry-cap-no-progress-loops-and-self-resolve). Never ask
+permission for another attempt, test, parser repair, or probe.
 Close decisions at the earliest informed phase: product in spec, coverage in clarify,
 scope/risk in temper, architecture/dependencies in define, and proof/toolchain in vet. Build
 keeps only unavailable-pre-code or mandatory action-time checkpoints.
@@ -350,7 +351,7 @@ access, safety and irreversible-action boundaries independently stop work.
   invariant + defect mechanism + minimal reproduction/decisive failure signal.
   DEC/DRIFT IDs, line numbers, wording and splitting one cause create no new budget.
 - **Cap no-progress retries:** three no-progress attempts per exact causal fingerprint
-  across wright/recovery. Only a correction whose narrow recheck leaves that cause
+  and strategy across wright/recovery. Only a correction whose narrow recheck leaves that cause
   open or reproduces its failure consumes an attempt.
   Closing a prior finding with discriminating evidence is progress: resolve it,
   do not charge. A new Critical or Important finding gets its own budget only for
@@ -384,11 +385,30 @@ access, safety and irreversible-action boundaries independently stop work.
 - **Reconcile terminal cursors.** Retained distinct Critical/Important evidence below
   cap resumes despite stale `Next step: none`; age/spent action authority is not exhaustion.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"unattended root reaches current admitted Workflow Artifact work","action":"invoke classifier; execute returned route without wright/slice charge","return":"saved lifecycle phase/action; no intermediate reply"} -->
-- **Classify exhaustion:** human-owned contract/risk/access gaps open their gate.
-  Otherwise preserve reproduction/dead ends, set `Status: blocked` and
-  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`.
-  Emit no phase command, retry-permission question or `/rite-resolve`.
-  Reinvocation with unchanged cause stays blocked; it never resets the cap.
+- **Escalate a spent strategy; never stop on it.** Three no-progress attempts spend
+  the fingerprint's current *strategy*, not the work. Record that strategy and its
+  attempts under `## Dead ends`, then the controlling caller escalates inline in the
+  same invocation: re-diagnose from the reproduction and dead ends, take the first
+  class below that still has an untried strategy, run `/rite-plan repair` plus
+  narrow Vet for it, and resume with a fresh three-attempt budget. Classes, in order:
+  (1) **shared root cause**: fix the owner every failing path routes through and
+  enforce it across all callers instead of another local guard; (2) **boundary
+  redesign**: acceptance-preserving reslice or redesign of the failing seam;
+  (3) **diagnostic amplification**: add discriminating probes or fixtures, then
+  correct from that evidence. A recorded strategy, or a rewording of one, never
+  repeats. Escalation never weakens tests, validators or acceptance. Each
+  fingerprint gets at most three escalations per activation; record each in
+  `drift.md` with its class and strategy.
+- **Park, finish the rest, then stop once.** Human-owned contract/risk/access gaps
+  open their gate. Otherwise, with every escalation spent, mark the fingerprint
+  `parked` in `drift.md`, keep its reproduction and dead ends, and continue every
+  step that does not depend on it. Only when nothing runnable remains, set
+  `Status: blocked` and
+  `Next step: <invoking command> — technical recovery parked; reinvoke to reopen with fresh escalation`.
+  Emit no retry-permission question or `/rite-resolve`. A genuinely new
+  user-issued activation appends `reopened: <date>` to each parked fingerprint and
+  grants it three fresh escalations, counted from that line; wakes, compaction and
+  nested re-entry of the same run never reset counts.
 - **Resolve agent-owned questions first** from code/docs/decisions. Human communication
   is for blocked environment, handover, inaccessible critical information or missing
   credentials/permission—not writing, testing or review. Blocking/escalating/

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -62,7 +62,9 @@ a human plus an agent) can share one working tree. Before a same-tree writer
 starts, it records an advisory claim — `devrites-engine claim add --session
 <id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
 with `devrites-engine claim check --session <id> <paths>`; a held claim from a
-live foreign session is a stop-and-report, not a merge-later problem. On every
+live foreign session is never merged later or overridden. Unattended, skip only
+work that needs those paths, run independent work, and re-check `claim list --all`
+before stopping; stop and report the holder only when nothing independent remains. On every
 host-confirmed terminal path after `add` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)) — return,
 rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
@@ -73,7 +75,9 @@ Claims cover product paths only; root-authored `.devrites/**` files use
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose
-session is not proven terminal counts as held (stop and report). **Failing case:**
+session is not proven terminal counts as held (stop and report). `dead` (engine-proven
+exited holder) or `released` is terminal: reconcile per
+[§ Cancellation](../parallel-dispatch.md#cancellation-and-terminal-reconciliation). **Failing case:**
 session B's `claim check` passes at minute 35 over session A's still-running wright.
 
 ## Independence

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -87,7 +87,7 @@ Verdict discipline — no vacuous verdicts:
 
 ## Caller-owned technical backtracking
 
-When a rite invokes an earlier rite inline to repair an agent-owned technical gap, the original rite stays the controlling caller: a nested `STOP` is a phase boundary, not user-facing. The caller re-reads `state.md`, follows the return cursor/`next_action`, and resumes unless a human-owned, safety, access, budget, or exhausted-recovery stop is active ([Persistence before stopping](#persistence-before-stopping-handoff-discipline)). Derive `exhausted-recovery` from the fingerprint's recorded no-progress attempts, not from a stale `state.md` label; one consumed authorization doesn't exhaust offline recovery from retained new evidence.
+When a rite invokes an earlier rite inline to repair an agent-owned technical gap, the original rite stays the controlling caller: a nested `STOP` is a phase boundary, not user-facing. The caller re-reads `state.md`, follows the return cursor/`next_action`, and resumes unless a human-owned, safety, access, budget, or parked-recovery stop is active ([Persistence before stopping](#persistence-before-stopping-handoff-discipline)). Derive `parked-recovery` from the fingerprint's recorded no-progress attempts and escalations, not from a stale `state.md` label; one consumed authorization doesn't exhaust offline recovery from retained new evidence.
 
 An intermediate `Next step` is cold-resume metadata. Do not ask the human to
 copy routine `/rite-plan repair`, `/rite-vet`, `/rite-build`, or proof-rerun

package/pack/.claude/skills/devrites-lib/reference/standards/one-shot-actions.md

@@ -73,8 +73,9 @@ Keep two budgets separate:
 Cold resume does not make that fingerprint old or exhausted. Derive its offline
 no-progress count from `drift.md` and `evidence.md`; while the count is below the
 cap, resume recovery even if a prior writer stored `blocked` / `Next step: none`.
-That terminal cursor is valid only for a human/safety gate, an actually exhausted
-fingerprint, or a proven absence of any safe retention/amplification design.
+A blocked cursor is valid only for a human/safety gate or a parked fingerprint
+with no independent work left; a missing safe retention/amplification design
+escalates to the next correction class.
 
 A new real attempt is normally admissible only after the affected plan and fixtures
 are re-vetted, the failure condition is shown changed, and any required fresh
@@ -98,7 +99,7 @@ claim the runtime failure condition changed: the independently proven change is
 evidence-acquisition invariant, and the attempt's acceptance signal is the promised
 unique retained boundary (or action success).
 
-Terminal `Next: none` is valid only when no safe in-scope diagnostic-amplification
-seam exists, the required change is human/risk/scope owned, or the exact evidence-gap
-fingerprint exhausts bounded recovery. A missing old artifact alone is not terminal,
-and an amplification attempt never inherits authorization from the failed action.
+When no safe in-scope diagnostic-amplification seam exists, escalate or park per
+[`afk-hitl.md`](afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve); only a
+human/risk/scope-owned change stops for a human. A missing old artifact alone is not
+terminal, and an amplification attempt never inherits authorization from the failed action.

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -326,12 +326,16 @@ Epoch starts 1. `FAILED` records preimages/cleanup/epoch/fingerprint/reason/
 boundary/route/no-progress count. Resolved fingerprints close; a different
 invariant gets a distinct fingerprint. Handoff death resumes its retry epoch with
 prior rows immutable. `WA-OP-011/012` enforce independent fingerprint/epoch caps
-and terminal source cleanup. Exhaustion records:
+and terminal source cleanup. Exhaustion closes this admission, not the work:
+the controlling caller escalates it under the
+[retry contract](afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
+through `PLAN_VET_REPAIR`, and a re-vetted changed design re-admits under a new
+identity with fresh epochs. A fully escalated fingerprint parks. Exhaustion records:
 
 ```text
-status=blocked
+status=running
 exhaustion_cause=<same-fingerprint-count|total-epoch-limit>
-next_action=none — technical recovery exhausted; requires new evidence or changed failure conditions
+next_action=/rite-plan repair <slug> — escalate exhausted workflow attempt
 ```
 
 The journal, evidence section, and observer retain that cause; epoch exhaustion
@@ -343,7 +347,7 @@ Precedence: busy owner; safety/access/approval gate; completed historical; activ
 journal; `CLEANED`; missing/stale authority; stale writer evidence; current
 admission. `PROVED|CLEANING` resumes cleanup; install-through-`PROVING`, rollback,
 or failure cleanup routes offline; retryable `FAILED` routes correction/retry;
-`EXHAUSTED` blocks; `PREPARING|PREPARED` resumes only with current authority.
+`EXHAUSTED` escalates; `PREPARING|PREPARED` resumes only with current authority.
 There is no actor-history migration or backfill.
 
 |Route|Owner|Exact action|Durable state/status/next action|Cursor/output|
@@ -356,7 +360,7 @@ There is no actor-history migration or backfill.
 | `VERIFY_EXISTING`|controlling root|verify `CLEANED`, targets, proof, and product separation; do not reinstall|restore saved return phase/action|no retry/slice/action budget|
 | `NO_BACKFILL`|controlling root|no action|completed state unchanged|no new output|
 | `WAIT_ACTIVE_OWNER`|non-owner|no write; stop invocation|shared state unchanged|fixed owner-busy diagnostic|
-| `BLOCKED_EXHAUSTED`|controlling root|no attempt 4|blocked with exact exhausted next action|fixed exhausted diagnostic|
+| `BLOCKED_EXHAUSTED`|controlling root|no attempt 4 on this admission; escalate through `PLAN_VET_REPAIR` or park per retry contract|`status=running`, exact exhausted `next_action`; parked keeps the parked-recovery action|fixed exhausted diagnostic; no intermediate reply|
 | `BLOCKED_GATE`|controlling root|follow existing safety/access/approval gate|gate-owned state|gate output; never reinterpret as retry|
 
 |Scenario ID|Trigger|Exact route / action|Durable consequence|Forbidden behavior|
@@ -422,7 +426,7 @@ pairs remain injective for actionable seams.
 | `devrites-debug-recovery/SKILL.md`|durable active failure or ambiguous admitted state|`OFFLINE_RECOVERY`; correct offline, re-preflight, narrow Vet, retry only under cap|saved caller or exact Plan/Vet route|
 | `rite-autocomplete/SKILL.md`|lifecycle cursor encounters admitted set or resumable journal|invoke classifier; execute returned route internally|saved phase/action; zero intermediate reply|
 | `rite-autocomplete/reference/loop.md`|loop tick sees Workflow Artifact trigger/state|invoke classifier once under owner lock; no actor-history migration|same loop cursor; no budget charge for verify/rerun|
-| `rite-autocomplete/reference/stop-conditions.md`|classifier returns owner-busy, exhausted, or existing hard gate|stop on exact `WAIT_ACTIVE_OWNER`, `BLOCKED_EXHAUSTED`, or `BLOCKED_GATE` result|unchanged cursor plus fixed route-owned output|
+| `rite-autocomplete/reference/stop-conditions.md`|classifier returns owner-busy, exhausted, or existing hard gate|escalate `BLOCKED_EXHAUSTED`; on `WAIT_ACTIVE_OWNER` run independent work and recheck; stop on exact `BLOCKED_GATE` result|unchanged cursor plus fixed route-owned output|
 | `rite-build/SKILL.md`|Vet-ready admitted bytes require root authorship outside product wright|`ROOT_TRANSACTION`; root writes only admitted `.devrites/**` targets|saved Build slice cursor; wright product allowlist unchanged|
 | `rite-build/reference/phase-contract.md`|Build gate enters or resumes transaction|invoke canonical operation table; reconcile exact result|same slice/checkpoint cursor or Plan/Vet route|
 | `rite-prove/SKILL.md`|Prove consumes installed Workflow Artifact or `CLEANED` rerun|`VERIFY_EXISTING` or admitted proof path ending `PROVE_AND_RETURN`|saved Prove cursor; stop before real action|

package/pack/.claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -237,7 +237,7 @@ slices; use `none` when they do not apply. Complexity above 3 triggers reslicing
 unless the stated reason makes the boundary irreducible. A Writer allowlist of 12+
 files prints an engine `ADVISORY size:` line (`check task-graph`, `check slice`;
 never blocking): split it acceptance-preserving, or add `Size rationale:` naming
-the inseparable capability.
+the inseparable capability; `ADVISORY hub:` takes a seam slice or `Serial rationale:`.
 
 ## Read next by phase
 

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -47,14 +47,16 @@ executable controller/harness/bundle bytes or a missing writer, read
   likewise internal when current authority resolves it.
 - Always follow agent-owned backward edges through repair, affected Vet,
   correction, and proof. A nested `STOP`/`Next step` is not a user handoff.
-  Pause only for a shared human/safety/access/exhaustion condition.
+  Pause only for a shared human/safety/access condition.
 - **Do not confuse an action budget with recovery exhaustion.** Spent action
   authority blocks another real execution, not offline correction of retained
   Critical/Important evidence. Stop for fresh GO only after changed conditions
   and READY Vet.
-- Every exact causal fingerprint gets at most three no-progress corrections.
-  Closing one is progress; a distinct Critical/Important invariant has its own
-  budget. Lower severity cannot prolong recovery.
+- Every exact causal fingerprint gets three no-progress corrections per strategy.
+  A spent strategy escalates to a new correction class inline; after three
+  escalations it parks while independent work continues. Never ask permission to
+  retry. Closing one is progress; a distinct Critical/Important invariant has its
+  own budget. Lower severity cannot prolong recovery.
 - Do not stop on `--max-slices`, sentinel `max_slices`, `max_agents`,
   `max_minutes`, or `max_review_queue`. Count failed, malformed, and
   unavailable leaf calls.
@@ -77,7 +79,7 @@ executable controller/harness/bundle bytes or a missing writer, read
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
-   recovery.
+   recovery, and this new invocation reopens each parked fingerprint.
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"lifecycle cursor encounters admitted set or resumable journal","action":"invoke classifier; execute returned route internally","return":"saved phase/action; zero intermediate reply"} -->
    Reconstruct a missing return cursor only from
    the current phase and exact approved action in `test-plan.md`/evidence, never
@@ -104,8 +106,8 @@ executable controller/harness/bundle bytes or a missing writer, read
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
    Build runs the largest eligible path-disjoint batch (cap: this invocation's
-   `--parallel N`, else sentinel `max_parallel`, else 10) and recomputes after
-   every completed round until no pending slice remains; a one-slice round is serial for that round only, then
+   `--parallel N`, else sentinel `max_parallel`, else 10) and refills a slot
+   per landing until no pending slice remains; a one-slice round is serial for that round only, then
    selection runs again (host isolation still forces serial when concurrent writers
    cannot be separated). When `--parallel N`
    is present, pass it into `/rite-build` and do not consult leftover sentinel
@@ -116,15 +118,15 @@ executable controller/harness/bundle bytes or a missing writer, read
    route agent-owned red results through bounded recovery.
    Red gates block forward advancement and enter caller-owned recovery. Stop on
    hard risk, escalating, irreversible-risk, access, blocking with no
-   recommended option, remaining NO-GO, or the exact fingerprint's proven
-   exhaustion. An open blocking question that already names a ranked recommended
+   recommended option, remaining NO-GO, or parked fingerprints with no
+   independent work left. An open blocking question that already names a ranked recommended
    option (`proposed` or option 1 labelled Recommended) auto-resolves through
    `devrites-engine state resolve` and continues (a missing or failing resolver is
    the bounded resolver-failure stop); do not emit `/rite-resolve` as
    a user handoff. Exception: a question whose answer would add acceptance or
    product scope is never auto-resolved by a recommended option; it stops for a human.
-   Technical exhaustion records terminal
-   `Next step: none`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
+   A spent strategy escalates; parked recovery records
+   `Next step: /rite-autocomplete`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
 6. **Seal boundary.** Without a ship flag, leave the sealed workspace unshipped and
    open the next recorded continuation
    ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation))

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -65,7 +65,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; one-slice round when <2 eligible); recompute after each round; charge once per green built slice |
+| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; one-slice round when <2 eligible); refill per landing; charge once per landed slice |
 | 7 | `/rite-prove` | all slices built; approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
@@ -106,7 +106,7 @@ parent's counter (same values, never a second charge); a child with no recorded
 parent/position is not a sequence member and the chain stops.
 
 Stop instead when: no recorded next entry; the cap or review-queue bound is
-reached; a human-owned, safety, access, or exhaustion condition fires; or Seal returns
+reached; a human-owned, safety, access, or parked-recovery stop fires; or Seal returns
 `NO-GO`. On stop, report the sequence position, the sealed-but-unshipped workspaces, and
 the single release command (`/rite-autocomplete <release milestone> --ship`, or
 `/rite-ship` for the current sealed workspace when the sequence is complete).
@@ -138,14 +138,16 @@ agent-owned earlier-phase gap:
 Ask only for a human-owned decision or mandatory safety/access action. An open
 blocking question with `proposed` or option 1 labelled Recommended is not that
 decision: resolve it and continue. Three no-progress corrections of one exact
-fingerprint exhaust; preserve its reproduction and dead ends without another
-Plan/Vet command.
+fingerprint spend only its strategy: escalate inline per the
+[retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+and park it after three escalations while independent work continues.
 
 ## Continuous caller obligation
 
 No user-facing reply is permitted while durable state contains agent-owned
 `NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
-Critical/Important fingerprint below its cap, or an open blocking question that
+Critical/Important fingerprint below its cap or with an escalation left, runnable
+work independent of a parked fingerprint, or an open blocking question that
 already names a ranked recommended option. Invoke the next internal repair or
 `devrites-engine state resolve` immediately, unless that writer already hit the
 [resolver-failure stop](stop-conditions.md#other-stop-classes). **Failing case:**
@@ -155,4 +157,4 @@ Critical/Important invariant is progress, not exhaustion.
 The number of completed repair/Vet cycles is not a stop condition. Context
 pressure, compaction, session duration, and nested completion do not convert an
 internal checkpoint into a handoff. Persist it and resume until the requested
-rest point or a shared human/safety/access/exhaustion condition.
+rest point or a shared human/safety/access/parked-recovery condition.

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -1,10 +1,10 @@
 # Stop conditions: when autocomplete pauses
 
 On a real stop, write `state.md` as `awaiting_human` or `blocked`, persist the
-reason, and include one resume command only when an actual human/safety/access
-action can change it. Exhausted agent-owned recovery records terminal
-`Next step: none` and no runnable recovery command. `--ship` never bypasses a
-stop.
+reason, and include one resume command. Agent-owned recovery never ends the run:
+a spent strategy escalates and a fully escalated fingerprint parks while other
+work continues ([retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)).
+`--ship` never bypasses a stop.
 
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
 
@@ -22,8 +22,8 @@ Regardless of flags or AFK ceiling:
 - external-service contract change; or
 - filesystem destruction outside the workspace.
 
-Red proof cannot advance. Run bounded Debug Recovery; stop after proven
-exhaustion unless the remaining owner is human.
+Red proof cannot advance. Run bounded Debug Recovery and escalate spent
+strategies; a fully escalated fingerprint parks unless the remaining owner is human.
 
 ## Not stops: internal technical routing
 
@@ -34,13 +34,16 @@ agent-owned.
 
 Agent-owned backtracking is not a stop condition while the exact causal
 fingerprint has budget. Invoke the earlier phase, affected Vet, remediation, and
-proof; then resume the origin. Stop only after three no-progress corrections of
-that exact fingerprint or a real human/safety/access gate. Preserve reproduction,
-attempts, and dead ends; never offer `/rite-plan unblock` or another routine
-phase command. Reinvocation with unchanged evidence does not reset the cap.
-`unchanged` means the same fingerprint already has three recorded no-progress
-corrections. Closure is progress; a separately evidenced Critical/Important
-invariant starts its own cap and cannot extend the closed one.
+proof; then resume the origin. Three no-progress corrections of that exact
+fingerprint spend only its current strategy: escalate to the next correction
+class inline (shared root cause, boundary redesign, diagnostic amplification)
+with a fresh budget, never asking permission. After three escalations in this
+activation the fingerprint parks; finish all independent work, then stop once.
+Preserve reproduction, attempts, and dead ends; never offer `/rite-plan unblock`
+or another routine phase command. A new user-issued `/rite-autocomplete`
+reopens parked fingerprints with fresh escalation; wakes and compaction do not.
+Closure is progress; a separately evidenced Critical/Important invariant starts
+its own cap and cannot extend the closed one.
 
 Spent consumptive-action authorization is not technical-recovery exhaustion.
 It blocks another execution; retained new Critical/Important evidence still
@@ -50,11 +53,10 @@ authorization and never reuse old GO.
 Past evidence being irretrievable is not by itself terminal. If an in-scope
 trusted seam can uniquely discriminate the next failure, run diagnostic-
 amplification Plan repair and narrow Vet inline, then pause for fresh GO before
-one evidence-acquisition attempt. Use terminal none only when no safe in-scope
-seam exists, a real human/risk/scope gate owns it, or bounded recovery is
-exhausted.
+one evidence-acquisition attempt. Without a safe seam, escalate to the next
+class or park; only a real human/risk/scope gate stops for a human.
 
-<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"stop on exact WAIT_ACTIVE_OWNER, BLOCKED_EXHAUSTED, or BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"escalate BLOCKED_EXHAUSTED; on WAIT_ACTIVE_OWNER run independent work and recheck; stop on exact BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
 ## Other stop classes
 
 - **Gate severity:** escalating always stops. Blocking with a ranked recommended
@@ -81,10 +83,15 @@ exhausted.
   pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
   does not stop. Zero with no pending slices is normal completion.
   Malformed flag stops before any write.
+- **Foreign writer:** a `live`/`expired` claim or `WAIT_ACTIVE_OWNER` held by
+  another session blocks only work on those paths; run independent work, re-check,
+  and stop only when nothing independent remains. `released`/`dead` claims are
+  reconciled per [§ Cancellation](../../devrites-lib/reference/parallel-dispatch.md#cancellation-and-terminal-reconciliation).
 - **Resource envelope:** overlapping run or missing AFK after arm still stops.
   Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
 - **Confidence:** intent still cannot become testable acceptance after interview.
-- **Repeated failure:** the exact fingerprint's bounded recovery is exhausted.
+- **Repeated failure:** not a stop. Escalate; a fully escalated fingerprint parks,
+  and the run stops only once no independent work remains.
 - **Resolver failure:** `devrites-engine state resolve` not found, or nonzero exit.
   Never hand-edit `questions.md`/`state.md` in its place. Not found stops at once;
   nonzero allows one identical re-run (the fingerprint is command + exit code +
@@ -99,7 +106,7 @@ disclose the exact plan, and stop for literal `GO` plus native approval. Without
 one, stop at Seal GO with `/rite-ship`. Seal GO, AFK, prior approval, and flags
 never satisfy Ship approval.
 
-A cold-resumable stop records `state.md` status, exact reason, and either one
-human-owned resume action or `none — technical recovery exhausted`; the owning
-question/drift/seal entry explains it. The user-facing line says what stopped
+A cold-resumable stop records `state.md` status, exact reason, and one resume
+action: the human-owned action, or `/rite-autocomplete` to reopen parked
+fingerprints; the owning question/drift/seal entry explains it. The user-facing line says what stopped
 and, only when applicable, what human action resumes it.

package/pack/.claude/skills/rite-build/SKILL.md

@@ -75,15 +75,15 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 
 Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
 path-disjoint set it can start now (`N_eff`), takes fewer when the cap cannot be
-filled, and recomputes after every completed round (serial slice or parallel
-integrate) until no pending slice remains
+filled, and refills a slot per landing (serial slice or one sibling) until
+no pending slice remains
 ([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
-Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
-inside the same run; HITL stops after each batch. This invocation's `--parallel N`
+Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) refill
+inside the same run; HITL stops after each landing. This invocation's `--parallel N`
 is the cap: leftover sentinel `max_parallel` is not consulted. Autocomplete with
 that flag also writes or replaces only `max_parallel: N`. Non-integer/`N≤0`/`N>10` hard refuse.
-All-green (independent review + proof) then integrate as one local `WIP(<slug>):`
-commit per sibling onto the current control branch (never pushed). Do not
+Each sibling lands alone when its review + proof are green (`integrate --slice`):
+one local `WIP(<slug>):` commit onto the control branch (never pushed). Do not
 integrate a sibling because the wright returned. A red/gap sibling gets a bounded repair
 round in its own worktree — never rebuilt from scratch while budget remains.
 Post-writer inventory and affected rechecks follow `phase-contract.md` § Independent
@@ -94,7 +94,7 @@ a human `Fix`. Exhausted repair blocks and preserves everything;
 `cleanup --force` salvages slice branches before removing worktrees —
 human-gated to abandon a batch, orchestrator-emitted only as the salvage
 step of an automatic frozen-lease re-batch.
-AFK charges after integrate only. Running lease blocks another
+AFK charges per landed sibling only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/.claude/skills/rite-build/reference/afk-discipline.md

@@ -44,8 +44,8 @@ The controlling root owns the cap:
    before the next dispatch.
    - **Serial:** charge when fail-on-red is green and the built record is written
      (same rewrite as step 2).
-   - **Parallel `--parallel`:** charge only after **successful serial integrate**
-     — once per integrated green sibling. Abort / integrate-failed → charge **0**.
+   - **Parallel `--parallel`:** charge only after **successful integrate**
+     — once per landed green sibling. Abort / integrate-failed → charge **0**.
      Do not charge on worktree-green before integrate. See
      [`parallel-batch.md`](parallel-batch.md).
 
@@ -69,13 +69,16 @@ wrong contract or proof path — agent-owned recovery; never advance on broken s
 The fail-on-red path:
 
 1. Continue the same wright under `devrites-debug-recovery`, carrying exact output and dead
-   ends; cap writer + recovery at three no-progress attempts per exact causal fingerprint.
+   ends; cap writer + recovery at three no-progress attempts per exact causal fingerprint
+   and strategy.
    A correction that closes the reproduction is progress; a different evidenced
    Critical/Important invariant starts a separate fingerprint.
 2. Green → record the slice. Product-contract/irreversible ambiguity → write the genuine
    human gate. Missing human-only credential/permission → write a human-intervention gate.
-3. Any other exhausted objective failure → set `Status: blocked`, preserve the reproduction,
-   set `Next step: none — technical recovery exhausted for <causal fingerprint>; requires new evidence or changed failure conditions`, and STOP without a qid or runnable phase command. Reinvocation with the unchanged fingerprint remains blocked and does not reset the cap.
+3. Any other spent strategy → escalate inline to the next correction class; after three
+   escalations park the fingerprint and build every slice that does not depend on it,
+   per the [retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve).
+   Never ask a qid or permission to retry; never hand back a routine phase command.
 4. Fire `notify:` only for an actual `awaiting_human` transition.
 
 AFK never starts the next slice while checks are red and never asks the human to approve

package/pack/.claude/skills/rite-build/reference/checkpoint.md

@@ -18,7 +18,7 @@ the orchestrator pauses for approval before landing it.
   and fail-on-red proof are green, with no open Critical/Important and no repair
   wright still in flight. Serial: git recipe below (skip empty index) or isolated
   FF of a matching `transfer_commit`. Parallel: `devrites-engine parallel
-  integrate --apply-to-control` (no second control `git commit`).
+  integrate --slice <id> --apply-to-control` (no second control `git commit`).
 - **Do not:** when a wright returns; before review/proof; with red/gap findings;
   fast-forward an isolated transfer onto control before those checks.
 

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -28,7 +28,7 @@ RECORD    → orchestrator: after green verification, update state.md/evidence.m
             upsert the authoritative candidate manifest from the actual scoped diff
 (CHECKPOINT) → only now, with review+proof green: local WIP(<slug>): <imperative summary>
             on the control branch (no slice id) → checkpoint.md
-NEXT      → HITL root reports and stops. AFK with parallel cap>1: return to parallel-batch selection and run the new N_eff; otherwise repeat under afk-discipline.md
+NEXT      → HITL root reports and stops. AFK with parallel cap>1: return to parallel-batch selection to refill; otherwise repeat under afk-discipline.md
 ```
 
 ## Why the boundary matters

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -36,14 +36,14 @@ Select **greedily in plan order**: pass every currently dependency-ready pending
 `N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
 is normal: take fewer. Serial is this round's size, not the rest of the run.
 
-**Re-batch automatically after every completed round** (parallel integrate+cleanup or
-a serial slice). Re-read `state.md`, pending slices, and the tree, then run
-`parallel select` again: finished work leaves the pending set, and satisfied
-dependencies unlock new slices. Under `.devrites/AFK` and `/rite-autocomplete` the
-repeat is the same run — HITL stops after each batch. `--parallel 5` with one eligible
-slice runs that one; when two to five then become eligible, the next round takes that
-many. **Failing case:** the run stays one-by-one after a serial round even though more
-slices are now eligible under the same cap.
+**Refill per landing; never wait for the batch.** Each sibling lands alone when
+green ([Lifecycle](#lifecycle) step 6). Then re-read `state.md`, pending slices, and
+the tree and run `parallel select --cap N --slug <slug>`: unlanded siblings hold
+their slots and paths, landed ones count as built, and only new picks print;
+`parallel add` starts each from the control tip and its wright dispatches at once.
+No lease → plain `select` + `create`. AFK/autocomplete is one run; HITL stops after
+each landing. **Failing case:** three siblings are green, one is repairing, and no
+new slice starts.
 
 ## Path-disjoint
 
@@ -109,22 +109,27 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    headroom bounds the batch size — one batch never assumes unbounded reviewers.
 5. Non-green siblings → **repair round** (below) in the same worktrees; lease
    stays `running` — no abort while repair budget remains. A green sibling →
-   `parallel record-green`. No partial integrate. All green → integrate.
+   `parallel record-green`, then step 6 for it alone.
    A recoverable RED blocks integration but does not cancel independent safe running siblings.
    Expected test-first RED is not a terminal gate failure. Cancel only for a shared
    invalid foundation, safety/access failure, resource boundary, or explicit stop;
    preserve completed and in-progress recoverable work and classify each result.
-6. `parallel integrate --apply-to-control` **only after steps 4–5 are green**:
-   each `transfer_commit` descends from `B` and diffs path-exact vs
-   `B`; apply each in plan order as its own local `WIP(<slug>):` commit
-   (imperative summary, never a slice id). Staging branch, then FF. Conflict →
-   reset to `B`, `integrate-failed`; classify under repair rounds (siblings stay
-   in place). Never integrate because a wright returned.
-7. Success: FF control (the branch that held `HEAD` when the batch started —
-   often `main`/`master`, otherwise whatever the user was on) to the integrate
-   tip: N local commits, never pushed; union `touched-files.md`; update
-   state/evidence; AFK +1 per integrated sibling; optional `check candidate`.
-8. Cleanup runs only after `integrate` marks the lease `complete` — work
+6. `parallel integrate --slice <id> --apply-to-control` **only after its steps
+   4–5 are green**: `transfer_commit` descends from the sibling's base and diffs
+   path-exact vs it; apply as its own local `WIP(<slug>):` commit
+   (imperative summary, never a slice id). Staging branch, then FF; the engine
+   refuses (never rewinds) if anything but this lease moved control. Conflict →
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+   Never integrate because a wright returned.
+7. Each landing: FF control (the branch that held `HEAD` when the batch started —
+   often `main`/`master`, otherwise whatever the user was on) by one local commit,
+   never pushed; union that sibling's paths into `touched-files.md`; update
+   state/evidence; AFK +1 for that sibling; optional `check candidate`. Then
+   refill ([Dynamic selection](#dynamic-selection-and-re-batching)) and start the
+   feature gates on control
+   ([Proof tiers](phase-contract.md#proof-tiers)); the next landing waits for them
+   to pass, the refilled wrights do not.
+8. Cleanup runs only after the last landing marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
    removed while the batch may resume. `parallel abort` + `cleanup --force`
@@ -182,18 +187,20 @@ Repair rejected work in place; never discard/rebuild while budget remains.
   exhaustion. Use plan path only if inventory proves the approach unsound.
 - Stop under the canonical retry/authority/resource conditions, or when evidence
   proves the approach unsound and no in-scope corrected decomposition exists.
-- Exhaustion is not abort: record one technical blocker (`Status: blocked`;
-  `Next step: none — technical recovery exhausted; requires new evidence or changed failure conditions`), preserve
-  lease/worktrees/branches, STOP — same fingerprint stays blocked on
-  reinvoke; new evidence resumes repair in place. Human-owned decisions use
-  the drift-guard question and wait.
+- A spent strategy is not abort: escalate per the canonical retry contract,
+  preserving lease/worktrees/branches; a fully escalated fingerprint parks and
+  the batch keeps its independent members. Repair resumes in place on
+  escalation or reinvocation. Human-owned decisions use the drift-guard
+  question and wait.
 
 ## Engine verbs
 
 ```text
-devrites-engine parallel select --cap <1-10> [--root <dir>] [<json-file>|-]
+devrites-engine parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [<json-file>|-]
 devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel add --root <repo> --slug <slug> --json <file>|-
 devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --slice <id> --apply-to-control
 devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
 devrites-engine parallel status --root <repo> --slug <slug>
 devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -42,7 +42,8 @@ Spec Drift Guard still applies.
 6. **Prove.** Against the frozen pre-slice candidate inspect
    test hunks for deletion, skipping/focus, tautology, or weaker expectations.
    Wait for step 5's exact test-analyst account; missing/adverse criterion verdict is
-   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   Critical. Run only `test-plan.md` repository/CI commands ([tier](#proof-tiers)),
+   record output, recheck
    `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
    Pre-existing/environment-specific claims need a predating same-command,
    same-environment baseline; otherwise unresolved.
@@ -67,6 +68,14 @@ Spec Drift Guard still applies.
 
 One contract builds one slice: preserve TDD, exact paths and independent judgment.
 
+## Proof tiers
+
+With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and every
+other row; feature gates run once per parallel landing, on control, while worktree
+wrights continue. The next landing and Prove wait for them; red is a fingerprint
+against slices landed since the last green run. Serial same-worktree mode, and plans
+without the section, run every row each round.
+
 ## Independent Build review
 
 After inspection, freeze full slice scope and cumulative baseline diff. Initial

package/pack/.claude/skills/rite-build/reference/spec-drift-guard.md

@@ -82,5 +82,6 @@ The detecting phase owns backtracking and the batch sweep. Save
 `return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
 vetted acceptance-preserving remediation, then restore the cursor and failed step.
 Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
-cap still applies: exhaustion produces one technical blocker, while a genuinely
-human-owned decision uses the question format below.
+cap still applies: a spent strategy escalates and a fully escalated fingerprint parks
+under the [retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+while a genuinely human-owned decision uses the question format below.