devrites 6.1.1 → 6.1.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.1.3](https://github.com/ViktorsBaikers/DevRites/compare/v6.1.2...v6.1.3) (2026-10-16)
+
+### Changed
+
+* **devrites:** apply plan bundles in the engine and overlap phase work ([#109](https://github.com/ViktorsBaikers/DevRites/issues/109)) ([4394b0a](https://github.com/ViktorsBaikers/DevRites/commit/4394b0af21677da279be0ca5c359af728e482fd9))
+
+## [6.1.2](https://github.com/ViktorsBaikers/DevRites/compare/v6.1.1...v6.1.2) (2026-10-16)
+
+### Fixed
+
+* **devrites:** close autocomplete dead ends and orphaned writer claims ([#108](https://github.com/ViktorsBaikers/DevRites/issues/108)) ([a680203](https://github.com/ViktorsBaikers/DevRites/commit/a680203d226160f9dae3bf5a386914567bd25da5))
+
 ## [6.1.1](https://github.com/ViktorsBaikers/DevRites/compare/v6.1.0...v6.1.1) (2026-10-16)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.1.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.1.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.1.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.1.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/cli.md

@@ -165,7 +165,10 @@ self-contained updater.
   and exits `3` naming the holder when a live claim by another session covers a
   path; `release --session <id> --id <claim>` frees it; `list [--all]` shows
   live (or all) claims; `check [--session <id>] <path>...` is the read-only
-  preflight. Claims coordinate concurrent same-tree sessions; they never
+  preflight. Each claim records its host and the claiming session's long-lived
+  processes; when all of them have exited on this host, `list` shows the claim
+  `dead` and it no longer conflicts. Other hosts or an unavailable `ps` never
+  prove exit. Claims coordinate concurrent same-tree sessions; they never
   replace the one-writer-per-worktree rule in `standards/agents.md`.
 - `note <add|list|check|rm>` manages `notes.md` anchored notes: `add <slug>
   <subject> <quote> <title> [body]` binds a note to a verbatim quote in one

package/docs/command-map.md

@@ -44,7 +44,7 @@ The Go surface is intentionally closed and deterministic:
 | Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal`, `check slice <slug> <SLICE-ID>`, `check task-graph`, `check regression <slug> [--update]`, `check drift <slug> [--record]`, `check windows <slug>`, `check dup`, `check path-disjoint`, `parallel select`, `check skill-trust`, `check indexes`, `detect commands [--root <dir>] [--json]` | Candidate validates/hashes the strict project manifest; readiness checks phase files, the required `tasks.md` slice graph, or emits the vetted Build-input binding; seal checks final files/open gates, that graph and binding, then exact candidate bindings. `check slice` preflights one slice before wright dispatch — contract present, exact Writer allowlist paths, `Satisfies` AC ids resolvable, bounded scope — so a malformed slice fails before a writer context is spent. `check indexes` reports install manifest and optional code-index directory presence as JSON. `parallel select` returns the greedy path-disjoint subset ≤ cap from the supplied ready slices. `check regression` compares current workspace progress against the durable `regression-baseline.json` high-water mark and `--update` ratchets it at a checkpoint, so a lost slice, unchecked criterion, or reopened question fails closed instead of passing silently. `check windows` scans the feature diff for newly introduced deferral markers (TODO/FIXME/skipped test/stub idioms) and fails when any lacks a `windows.md` waiver row — silent deferrals block the seal. `check dup` reports advisory near-duplicate clusters that survive renaming (normalized token shingles, transitive clusters, distance-boosted rank, `*`-marked diff overlap, stable content hashes, `.devrites/dup-ignore` dismissal ledger) — leads for reviewer triage, never a gate. `check drift` attributes readiness-input drift to the exact artifact: `--record` snapshots per-input SHA-256 digests into `readiness-inputs.json` under the feature lock, and a later compare names each `changed`/`missing`/`added` input (falling back to the aggregate `eng-review.md` binding plus mtime candidates when no baseline exists) so a stale-binding repair starts at the right file — advisory, never a gate. `detect commands` resolves the repository's own test/lint/vet/build commands (Makefile targets, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager) so `gates.md` `CHECK` lines and proof steps cite real wiring instead of invented commands — read-only, no installs, no execution. |
 | Workspace observation | `observe summary`, `orient`, `observe slice <slug> <SLICE-ID>`, `next`, `handoff` | JSON workspace snapshot for agents (cursor, task graph, `artifact_budgets`, `bulk_files`); `orient` is an alias for `observe summary`. `observe slice` prints one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. `next` prints the minimal remaining lifecycle path plus advisory skips (e.g. clarify at zero open questions). `handoff` emits the deterministic resume record (cursor, `awaiting_human`, blocking question gates, ledger reduction with unmet/stale ids, dead ends, read-next order) — the `/rite-handoff` spine and compaction-fallback entry. |
 | Context packets, dispatch waves, metrics, claims, notes | `context [slug] (--phase <p> \| --skill <name>) [--role <r>] [--trigger a,b]`, `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>`, `metrics record`, `metrics summary`, `claim <add\|release\|list\|check>`, `note <add\|list\|check\|rm>` | `context` emits one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest — a dispatch target reads it instead of selecting files; `--skill` works without a workspace when `--out` is given. `dispatch` owns the launch-wave barrier (seal needs a handle per role; return needs seal) and auto-records dispatch/return metrics. `metrics` owns the append-only `metrics.jsonl` ledger. `claim` owns the append-only `.devrites/claims.jsonl` ledger — advisory, session-scoped file claims with TTL so concurrent same-tree sessions see each other's write intent before edits collide (conflict exits 3; never a substitute for one-writer-per-worktree). `note` owns the anchored `notes.md` ledger — notes bound to verbatim code quotes, regraded `exact`/`moved`/`stale`/`ambiguous`/`lost` as the code drifts; `check seal` refuses non-`exact` anchors. `check diff-scope` is the mechanical changed-paths ⊆ allowlist gate run before reviewer dispatch. |
-| Atomic workspace state | `state resolve`, `state merge-manifest`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, transactional close, and fail-closed v5 schema normalization. |
+| Atomic workspace state | `state resolve`, `state merge-manifest`, `state apply-bundle <slug> <bundle.json>... [--dry-run]`, `state close`, `migrate [--dry-run] [--answer id=choice]` | Go owns answer/drop/batch resolution, the recorded predecessor-chain manifest union for a release milestone, the all-or-nothing apply of plan-drafter hunk bundles (base-hash pins, unique non-overlapping anchors, no lost IDs, no new task-graph or budget defect, no appended dated delta section), transactional close, and fail-closed v5 schema normalization. |
 | Acceptance ledger | `gates scaffold`, `gates status`, `gates run [--timeout N]`, `gates reverify [--timeout N]`, `gates lint [--strict]`, `gates attest <id> <note>`, `gates abandon <id> <why>` | Go owns the `gates.md` ledger: per-outcome gates whose runnable `CHECK`/`CWD` must exactly match a `test-plan.md` Build-entry preflight row, evidence bound to the gate definition digest (stale = unmet), `ABANDON:` handoffs, and oracle lint. Readiness/seal require a parse-clean, all-met ledger whenever `gates.md` is a required artifact. |
 | Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |

package/docs/engine/commands.md

@@ -16,9 +16,9 @@ workflow strategy.
 | `check readiness --emit-binding <slug>` | Render the exact stable Build-input binding for Vet to record after review. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [<json-file> | -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices. |
-| `parallel <create\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. |
-| `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Advisories print only when the graph is valid. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [<json-file> | -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices. With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, and only new picks print. |
+| `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
+| `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
 | `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). |
 | `check windows <slug> [--worktree\|--staged\|--base <ref>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. |
@@ -37,7 +37,7 @@ workflow strategy.
 | `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; start/return auto-record metrics. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). |
-| `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows live claims (`--all` includes expired/released). `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
+| `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows live claims (`--all` includes expired/released); a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
 | `gates <scaffold\|status\|run\|reverify\|lint\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |

package/docs/orchestration.md

@@ -138,9 +138,10 @@ and a control `parallel-lease.md` apply. `--parallel N` on `/rite-autocomplete`
 or `/rite-build` is the batch cap for that run and wins over leftover sentinel
 `max_parallel`; `/rite-autocomplete --parallel N` also writes or replaces only
 that field. Absent the flag, the sentinel (default cap 10 under
-`/rite-autocomplete`) is a **cap**: each round runs
-the largest eligible set, recomputes after every completed round, and repeats until no
-pending slice remains; a one-slice round is serial for that round only (see
+`/rite-autocomplete`) is a **cap**: the run fills it
+with the largest eligible set, lands each sibling as soon as its review and proof are
+green, refills the freed slot (`parallel add`), and repeats until no pending slice
+remains; a one-slice round is serial for that round only (see
 [`parallel-batch.md`](../pack/.claude/skills/rite-build/reference/parallel-batch.md)).
 Same-worktree multi-writer and root-emulated worktrees remain forbidden; default
 `/rite-build` stays one writer across linked worktrees.

package/docs/usage.md

@@ -71,7 +71,7 @@ Project-root sentinel (outside the workspace):
 | `.devrites/AFK` | you (presence = AFK mode active) | optional YAML: `max_slices`, `notify`, `allow_gates`. Empty file = AFK with defaults. See [`pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md`](../pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md). |
 | `.devrites/CHECKPOINT` | unused as a gate | reserved path (not a candidate). After Independent Build review and fail-on-red proof are green (not when a wright returns), `/rite-build` / `/rite-prove` / `/rite-polish` / `/rite-review` land a local `WIP(<slug>): <imperative summary>` commit (serial: checkpoint git recipe or no-op if nothing staged; parallel: `devrites-engine parallel integrate`); `/rite-ship` later collapses an eligible WIP run. See [`pack/.claude/skills/rite-build/reference/checkpoint.md`](../pack/.claude/skills/rite-build/reference/checkpoint.md). |
 | `.devrites/dup-ignore` | you (optional) | One `check dup` cluster hash per line with a `#` reason — the dismissal ledger. Content-derived hashes survive line moves but resurface on structural edits. See [`pack/.claude/skills/devrites-lib/reference/standards/duplicate-code.md`](../pack/.claude/skills/devrites-lib/reference/standards/duplicate-code.md). |
-| `.devrites/claims.jsonl` | `devrites-engine claim add` | Append-only advisory file claims: `{id, session, paths, reason, claimed_at, expires_at}` plus release events. Session-scoped and TTL-bounded — per-checkout state, so gitignore it (a committed ledger exports stale claims to every clone). See [`standards/agents.md`](../pack/.claude/skills/devrites-lib/reference/standards/agents.md). |
+| `.devrites/claims.jsonl` | `devrites-engine claim add` | Append-only advisory file claims: `{id, session, paths, reason, claimed_at, expires_at, host, anchors}` plus release events. Session-scoped and TTL-bounded — per-checkout state, so gitignore it (a committed ledger exports stale claims to every clone). See [`standards/agents.md`](../pack/.claude/skills/devrites-lib/reference/standards/agents.md). |
 
 The shape of this directory is also documented in
 [`flow.md` § Workspace state model](flow.md#7-workspace-state-model).

package/engine/commands.go

@@ -34,7 +34,7 @@ func rootModeFor(command string, args []string) rootMode {
 		return rootLenient
 	case "state":
 		switch subcommand {
-		case "resolve", "merge-manifest", "close":
+		case "resolve", "merge-manifest", "apply-bundle", "close":
 			return rootStrict
 		}
 		return rootUnused

package/engine/help.go

@@ -30,7 +30,7 @@ const (
   check dup [slug] [--all|--worktree|--staged|--base <ref>]
 `
 
-	stateUsage = `usage: devrites-engine state <resolve|merge-manifest|close> ...
+	stateUsage = `usage: devrites-engine state <resolve|merge-manifest|apply-bundle|close> ...
 
   state resolve <qid> "<answer>"
   state resolve --drop <qid> ["<reason>"]
@@ -39,6 +39,7 @@ const (
   state resolve --human --drop <qid> ["<reason>"]
   state resolve --human --batch <file>
   state merge-manifest <slug> [<predecessor>...]
+  state apply-bundle <slug> <bundle.json>... [--dry-run]
   state close <slug>
 `
 
@@ -86,6 +87,7 @@ const (
 	dupUsageLine        = "usage: devrites-engine check dup [slug] [--all|--worktree|--staged|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>] [--phase p] [--cwd <dir>]"
 	resolveUsage        = `usage: devrites-engine state resolve <qid> "<answer>"  |  state resolve --drop <qid> ["<reason>"]  |  state resolve --batch <file>  |  state resolve --human <qid> "<answer>"  |  state resolve --human --drop <qid> ["<reason>"]  |  state resolve --human --batch <file>`
 	mergeManifestUsage  = "usage: devrites-engine state merge-manifest <slug> [<predecessor>...]"
+	applyBundleUsage    = "usage: devrites-engine state apply-bundle <slug> <bundle.json>... [--dry-run]"
 	closeUsage          = "usage: devrites-engine state close <slug>"
 	observeSliceUsage   = "usage: devrites-engine observe slice <slug> <SLICE-ID>"
 	observeSummaryUsage = "usage: devrites-engine observe summary [slug]"
@@ -286,6 +288,8 @@ func helpState(rest []string) string {
 		return resolveUsage
 	case "merge-manifest":
 		return mergeManifestUsage
+	case "apply-bundle":
+		return applyBundleUsage
 	case "close":
 		return closeUsage
 	default:

package/engine/internal/acceptance/cli.go

@@ -248,9 +248,19 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		return ExitBlocked
 	}
 
-	lockErr := state.WithFeatureLock(root, slug, func() error {
-		text, err := ReadLedgerFile(ledgerPath)
-		if err != nil {
+	// The gates lock serializes check execution; the feature lock is held only
+	// to read inputs and per writeback, so dispatch and other workspace writers
+	// are not blocked for the whole (often minutes-long) run.
+	featureLock := func(fn func() error) error { return state.WithFeatureLock(root, slug, fn) }
+	lockErr := state.WithLock(ledgerPath+".lock", func() error {
+		var text string
+		var approved []ApprovedCommand
+		if err := featureLock(func() error {
+			var err error
+			text, err = ReadLedgerFile(ledgerPath)
+			approved = loadTestPlan(testPlanPath)
+			return err
+		}); err != nil {
 			return err
 		}
 		doc := ParseLedger(text)
@@ -260,8 +270,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 			}
 			return nil
 		}
-		approved := loadTestPlan(testPlanPath)
-		for _, result := range RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout) {
+		for _, result := range RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock) {
 			switch {
 			case !result.Ran:
 				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)

package/engine/internal/acceptance/run.go

@@ -65,9 +65,19 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 // Each pass writes definition-bound evidence; each failure clears the box and
 // restores EVIDENCE: pending.
 //
-// The caller holds the feature lock across this call.
-func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration) []GateResult {
+// Gates sharing one CHECK and CWD execute once per call; each matches its own
+// EXPECT against that shared output. writeLock, when non-nil, wraps every
+// ledger writeback so the caller need not hold the feature lock while checks
+// execute; writeResult re-verifies the gate's oracle before it writes.
+func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
 	var results []GateResult
+	outcomes := map[string]RunOutcome{}
+	write := func(gate *Gate, evidence string, checked bool) error {
+		if writeLock == nil {
+			return writeResult(ledgerPath, gate, evidence, checked)
+		}
+		return writeLock(func() error { return writeResult(ledgerPath, gate, evidence, checked) })
+	}
 	for _, gate := range doc.Gates {
 		if _, abandoned := doc.Abandoned[gate.ID]; abandoned {
 			results = append(results, GateResult{ID: gate.ID, Detail: "abandoned; handoff required"})
@@ -94,17 +104,22 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 		if gate.Cwd != "" {
 			cwd = filepath.Join(root, filepath.FromSlash(gate.Cwd))
 		}
-		outcome := Execute(ctx, gate.Check, cwd, timeout)
+		key := gate.Check + "\x00" + cwd
+		outcome, ran := outcomes[key]
+		if !ran {
+			outcome = Execute(ctx, gate.Check, cwd, timeout)
+			outcomes[key] = outcome
+		}
 		if outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output) {
 			evidence := FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339))
-			writeErr := writeResult(ledgerPath, gate, evidence, true)
+			writeErr := write(gate, evidence, true)
 			results = append(results, GateResult{
 				ID: gate.ID, Ran: true, Passed: true,
 				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
 				Detail: resultDetail(writeErr, "pass"),
 			})
 		} else {
-			writeErr := writeResult(ledgerPath, gate, "pending", false)
+			writeErr := write(gate, "pending", false)
 			results = append(results, GateResult{
 				ID: gate.ID, Ran: true,
 				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,