devrites 6.1.1 → 6.1.3

package/engine/internal/parallel/ops.go

@@ -90,70 +90,182 @@ func createLocked(opts CreateOpts) (*Lease, error) {
 		session = fmt.Sprintf("pid:%d", os.Getpid())
 	}
 
-	createdPaths := make([]string, 0, len(opts.Slices))
-	createdBranches := make([]string, 0, len(opts.Slices))
-	cleanupPartial := func() {
-		for _, p := range createdPaths {
-			if err := removeWorktree(opts.Root, p); err != nil {
-				warnf("worktree cleanup %s: %v", p, err)
+	slices, cleanupPartial, err := createWorktrees(opts.Root, opts.Slug, opts.BatchID, base, opts.Slices)
+	if err != nil {
+		return nil, err
+	}
+
+	lease := &Lease{
+		BatchID:             opts.BatchID,
+		CreatedAt:           NowUTC(),
+		BaseSHA:             base,
+		N:                   len(slices),
+		Status:              StatusRunning,
+		ControlPIDOrSession: session,
+		Slices:              slices,
+	}
+	if err := WriteLease(leasePath, lease); err != nil {
+		cleanupPartial()
+		return nil, err
+	}
+	ensureScratchExcluded(opts.Root)
+	return lease, nil
+}
+
+// createWorktrees makes one pending worker worktree and branch per slice from
+// base, all or nothing: a failure removes what this call already made. The
+// returned rollback undoes a success when the caller's lease write fails.
+func createWorktrees(root, slug, batchID, base string, specs []SlicePaths) ([]LeaseSlice, func(), error) {
+	made := make([]LeaseSlice, 0, len(specs))
+	rollback := func() {
+		// Worktrees first: git refuses to delete a branch still checked out.
+		for _, sl := range made {
+			if err := removeWorktree(root, sl.WorktreePath); err != nil {
+				warnf("worktree cleanup %s: %v", sl.WorktreePath, err)
 			}
 		}
-		for _, b := range createdBranches {
-			if err := deleteBranch(opts.Root, b); err != nil {
-				warnf("branch cleanup %s: %v", b, err)
+		for _, sl := range made {
+			if err := deleteBranch(root, sl.Branch); err != nil {
+				warnf("branch cleanup %s: %v", sl.Branch, err)
 			}
 		}
 	}
-	slices := make([]LeaseSlice, 0, len(opts.Slices))
+	for _, sp := range specs {
+		sl, err := createWorktree(root, slug, batchID, base, sp)
+		if err != nil {
+			rollback()
+			return nil, nil, err
+		}
+		made = append(made, sl)
+	}
+	return made, rollback, nil
+}
+
+func createWorktree(root, slug, batchID, base string, sp SlicePaths) (LeaseSlice, error) {
+	if err := validateSliceID(sp.ID); err != nil {
+		return LeaseSlice{}, err
+	}
+	paths, err := validateSlicePaths(sp.Paths, fmt.Sprintf("slice %q", sp.ID), root)
+	if err != nil {
+		return LeaseSlice{}, err
+	}
+	branch := WorkerBranch(slug, batchID, sp.ID)
+	wt := WorkerWorktreePath(root, batchID, sp.ID)
+	if _, err := os.Stat(wt); err == nil {
+		return LeaseSlice{}, fmt.Errorf("worktree path already exists: %s", wt)
+	}
+	if err := os.MkdirAll(filepath.Dir(wt), 0o755); err != nil {
+		return LeaseSlice{}, err
+	}
+	if err := worktreeAdd(root, wt, branch, base); err != nil {
+		return LeaseSlice{}, fmt.Errorf("worktree add %s: %w", sp.ID, err)
+	}
+	return LeaseSlice{
+		ID:           sp.ID,
+		Paths:        paths,
+		WorktreePath: wt,
+		Branch:       branch,
+		WrightStatus: WrightPending,
+	}, nil
+}
+
+// AddOpts configures refilling a running lease with new slices.
+type AddOpts struct {
+	Root   string
+	Slug   string
+	Slices []SlicePaths
+}
+
+// Add refills freed slots of a running lease: each new slice gets a worktree
+// from the current control tip, under the same path-disjoint and cap rules as
+// the slices still active. Landed (integrated) slices no longer claim paths.
+func Add(opts AddOpts) (lease *Lease, err error) {
+	err = withLeaseLock(opts.Root, opts.Slug, func() error {
+		lease, err = addLocked(opts)
+		return err
+	})
+	return lease, err
+}
+
+func addLocked(opts AddOpts) (*Lease, error) {
+	if abs, err := filepath.Abs(opts.Root); err == nil {
+		opts.Root = abs
+	}
+	if len(opts.Slices) == 0 {
+		return nil, fmt.Errorf("add requires at least one slice")
+	}
+	leasePath, err := LeasePath(opts.Root, opts.Slug)
+	if err != nil {
+		return nil, err
+	}
+	lease, err := ReadLease(leasePath)
+	if err != nil {
+		return nil, err
+	}
+	if lease.Status != StatusRunning {
+		return nil, fmt.Errorf("add requires status=running (have %s)", lease.Status)
+	}
+	head, err := revParse(opts.Root, expectedControl(lease))
+	if err != nil {
+		return nil, err
+	}
+	if err := ensureControlAtBase(opts.Root, head); err != nil {
+		return nil, err
+	}
+
+	seen := make(map[string]bool, len(lease.Slices)+len(opts.Slices))
+	for _, sl := range lease.Slices {
+		seen[sl.ID] = true
+	}
+	added := make([]SlicePaths, 0, len(opts.Slices))
+	var addedPaths []string
 	for _, sp := range opts.Slices {
 		if err := validateSliceID(sp.ID); err != nil {
-			cleanupPartial()
 			return nil, err
 		}
+		if seen[sp.ID] {
+			return nil, fmt.Errorf("slice id %q already in lease", sp.ID)
+		}
+		seen[sp.ID] = true
 		paths, err := validateSlicePaths(sp.Paths, fmt.Sprintf("slice %q", sp.ID), opts.Root)
 		if err != nil {
-			cleanupPartial()
 			return nil, err
 		}
-		branch := WorkerBranch(opts.Slug, opts.BatchID, sp.ID)
-		wt := WorkerWorktreePath(opts.Root, opts.BatchID, sp.ID)
-		if _, err := os.Stat(wt); err == nil {
-			cleanupPartial()
-			return nil, fmt.Errorf("worktree path already exists: %s", wt)
-		}
-		if err := os.MkdirAll(filepath.Dir(wt), 0o755); err != nil {
-			cleanupPartial()
+		added = append(added, SlicePaths{ID: sp.ID, Paths: paths})
+		addedPaths = append(addedPaths, paths...)
+	}
+	all := append(activeSlices(lease), added...)
+	if len(all) > MaxParallelSlices {
+		return nil, fmt.Errorf("add would make %d slices active; parallel allows at most %d", len(all), MaxParallelSlices)
+	}
+	if len(all) >= 2 {
+		if _, err := CheckPathDisjoint(all, opts.Root); err != nil {
 			return nil, err
 		}
-		if err := worktreeAdd(opts.Root, wt, branch, base); err != nil {
-			cleanupPartial()
-			return nil, fmt.Errorf("worktree add %s: %w", sp.ID, err)
-		}
-		createdPaths = append(createdPaths, wt)
-		createdBranches = append(createdBranches, branch)
-		slices = append(slices, LeaseSlice{
-			ID:           sp.ID,
-			Paths:        paths,
-			WorktreePath: wt,
-			Branch:       branch,
-			WrightStatus: WrightPending,
-		})
+	}
+	// The new worktree starts from control HEAD, so uncommitted user work on
+	// its paths would be neither in the slice nor safe from its landing.
+	dirty, err := porcelainDirtyPaths(opts.Root, addedPaths)
+	if err != nil {
+		return nil, err
+	}
+	if dirty {
+		return nil, fmt.Errorf("control has uncommitted changes on new slice paths; stop for the human to resolve them (never stash or commit them), then rerun add")
 	}
 
-	lease := &Lease{
-		BatchID:             opts.BatchID,
-		CreatedAt:           NowUTC(),
-		BaseSHA:             base,
-		N:                   len(slices),
-		Status:              StatusRunning,
-		ControlPIDOrSession: session,
-		Slices:              slices,
+	made, rollback, err := createWorktrees(opts.Root, opts.Slug, lease.BatchID, head, added)
+	if err != nil {
+		return nil, err
+	}
+	for i := range made {
+		made[i].BaseSHA = head
 	}
+	lease.Slices = append(lease.Slices, made...)
+	lease.N = len(lease.Slices)
 	if err := WriteLease(leasePath, lease); err != nil {
-		cleanupPartial()
+		rollback()
 		return nil, err
 	}
-	ensureScratchExcluded(opts.Root)
 	return lease, nil
 }
 
@@ -185,6 +297,10 @@ func recordGreenLocked(repoRoot, slug, sliceID, commit string) (*Lease, error) {
 	found := false
 	for i := range lease.Slices {
 		if lease.Slices[i].ID == sliceID {
+			if lease.Slices[i].WrightStatus == WrightIntegrated {
+				// Re-greening a landed slice would land its work a second time.
+				return nil, fmt.Errorf("slice %s already integrated", sliceID)
+			}
 			lease.Slices[i].WrightStatus = WrightGreen
 			lease.Slices[i].TransferCommit = sha
 			found = true
@@ -222,11 +338,11 @@ func abortLocked(repoRoot, slug string) (*Lease, error) {
 	if lease.Status == StatusComplete {
 		return nil, fmt.Errorf("abort refused: lease already complete — the batch landed in control; nothing to discard")
 	}
-	base, err := revParse(repoRoot, lease.BaseSHA)
+	expected, err := revParse(repoRoot, expectedControl(lease))
 	if err != nil {
 		return nil, err
 	}
-	if err := ensureControlAtBase(repoRoot, base); err != nil {
+	if err := ensureControlAtBase(repoRoot, expected); err != nil {
 		warnf("control not at base: %v", err)
 	}
 	lease.Status = StatusAborted
@@ -252,12 +368,17 @@ func ensureControlAtBase(repoRoot, base string) error {
 
 // IntegrateOpts configures staging integrate.
 type IntegrateOpts struct {
-	Root           string
-	Slug           string
+	Root string
+	Slug string
+	// Slice, when set, lands only that slice (requires ApplyToControl);
+	// otherwise every slice not yet integrated lands together.
+	Slice          string
 	ApplyToControl bool
 }
 
-// Integrate all-or-nothing applies sibling transfer commits onto a staging branch.
+// Integrate all-or-nothing applies transfer commits onto a staging branch
+// cut from the expected control tip — every not-yet-integrated slice, or just
+// opts.Slice — and with ApplyToControl fast-forwards control to it.
 func Integrate(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	err = withLeaseLock(opts.Root, opts.Slug, func() error {
 		tip, lease, err = integrateLocked(opts)
@@ -267,6 +388,9 @@ func Integrate(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 }
 
 func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
+	if opts.Slice != "" && !opts.ApplyToControl {
+		return "", nil, fmt.Errorf("integrate --slice requires --apply-to-control")
+	}
 	leasePath, err := LeasePath(opts.Root, opts.Slug)
 	if err != nil {
 		return "", nil, err
@@ -278,17 +402,36 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	if lease.Status != StatusRunning && lease.Status != StatusIntegrateFailed {
 		return "", nil, fmt.Errorf("integrate requires status=running|integrate-failed (have %s)", lease.Status)
 	}
-	base, err := revParse(opts.Root, lease.BaseSHA)
+	// Control may only have moved by this lease's own landings; anything else
+	// is external work that integrate must neither rewind nor build on.
+	expected, err := revParse(opts.Root, expectedControl(lease))
 	if err != nil {
 		return "", nil, err
 	}
-	if err := ensureControlAtBase(opts.Root, base); err != nil {
+	if err := ensureControlAtBase(opts.Root, expected); err != nil {
 		return "", nil, err
 	}
 
-	union := make([]string, 0, len(lease.Slices))
-	for _, sl := range lease.Slices {
-		union = append(union, sl.Paths...)
+	var targets []int
+	for i, sl := range lease.Slices {
+		switch {
+		case opts.Slice == "" && sl.WrightStatus != WrightIntegrated,
+			opts.Slice != "" && sl.ID == opts.Slice:
+			targets = append(targets, i)
+		}
+	}
+	switch {
+	case opts.Slice != "" && len(targets) == 0:
+		return "", nil, fmt.Errorf("slice not in lease: %s", opts.Slice)
+	case opts.Slice != "" && lease.Slices[targets[0]].WrightStatus == WrightIntegrated:
+		return "", nil, fmt.Errorf("slice %s already integrated", opts.Slice)
+	case len(targets) == 0:
+		return "", nil, fmt.Errorf("no slices left to integrate")
+	}
+
+	union := make([]string, 0, len(targets))
+	for _, i := range targets {
+		union = append(union, lease.Slices[i].Paths...)
 	}
 	if opts.ApplyToControl {
 		// FF into control must not silently absorb or clobber the user's
@@ -303,7 +446,8 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 		}
 	}
 
-	for _, sl := range lease.Slices {
+	for _, i := range targets {
+		sl := lease.Slices[i]
 		if sl.WrightStatus != WrightGreen {
 			return "", nil, fmt.Errorf("slice %s is not green", sl.ID)
 		}
@@ -326,7 +470,7 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 	if err := os.MkdirAll(filepath.Dir(stageWT), 0o755); err != nil {
 		return "", nil, err
 	}
-	if err := worktreeAdd(opts.Root, stageWT, ibranch, base); err != nil {
+	if err := worktreeAdd(opts.Root, stageWT, ibranch, expected); err != nil {
 		return "", nil, fmt.Errorf("staging worktree: %w", err)
 	}
 
@@ -350,13 +494,20 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 					leasePath, StatusRunning, retryErr)
 			}
 		}
-		if err := ensureControlAtBase(opts.Root, base); err != nil {
+		if err := ensureControlAtBase(opts.Root, expected); err != nil {
 			warnf("control diverged from base during integrate: %v", err)
 		}
 		return "", lease, reason
 	}
 
-	for _, sl := range lease.Slices {
+	for _, i := range targets {
+		sl := lease.Slices[i]
+		// Each slice is proven against the commit its worktree was cut from,
+		// which for a refill is a later control tip than the batch base.
+		base, err := revParse(opts.Root, sliceBase(lease, sl))
+		if err != nil {
+			return fail(fmt.Errorf("slice %s base: %w", sl.ID, err))
+		}
 		tc, err := revParse(opts.Root, sl.TransferCommit)
 		if err != nil {
 			return fail(fmt.Errorf("slice %s transfer: %w", sl.ID, err))
@@ -417,11 +568,20 @@ func integrateLocked(opts IntegrateOpts) (tip string, lease *Lease, err error) {
 		if err := mergeFFOnly(opts.Root, tip); err != nil {
 			return fail(fmt.Errorf("control fast-forward to integrate tip failed: %w", err))
 		}
-		lease.Status = StatusComplete
+		for _, i := range targets {
+			lease.Slices[i].WrightStatus = WrightIntegrated
+		}
+		lease.ControlTip = tip
+		// A per-slice landing also clears an earlier integrate-failed: the
+		// lease is healthy again while other slices are still in flight.
+		lease.Status = StatusRunning
+		if len(activeSlices(lease)) == 0 {
+			lease.Status = StatusComplete
+		}
 		if err := WriteLease(leasePath, lease); err != nil {
 			return "", nil, err
 		}
-	} else if err := ensureControlAtBase(opts.Root, base); err != nil {
+	} else if err := ensureControlAtBase(opts.Root, expected); err != nil {
 		return fail(err)
 	}
 	// Without --apply-to-control the lease stays running: the integrate
@@ -529,11 +689,12 @@ func salvageSlice(sl LeaseSlice, batchID string) (string, error) {
 		fmt.Sprintf("devrites: salvage WIP (%s)", batchID), sl.Paths)
 }
 
-// Cleanup removes worker worktrees and clears the lease. A complete batch
-// deletes the merged slice branches; a forced non-complete cleanup first
-// salvages each sibling — uncommitted allowlisted changes become a commit on
-// the slice branch — and keeps every branch whose tip moved past base as the
-// durable rejected-work ref.
+// Cleanup removes worker worktrees and clears the lease. A complete batch, and
+// any slice already integrated, deletes the merged slice branches; a forced
+// non-complete cleanup first salvages each other sibling — uncommitted
+// allowlisted changes become a commit on the slice branch — and keeps every
+// branch whose tip moved past that slice's base as the durable rejected-work
+// ref.
 func Cleanup(repoRoot, slug string, force bool) (salvaged []Salvage, err error) {
 	err = withLeaseLock(repoRoot, slug, func() error {
 		salvaged, err = cleanupLocked(repoRoot, slug, force)
@@ -558,14 +719,6 @@ func cleanupLocked(repoRoot, slug string, force bool) ([]Salvage, error) {
 		return nil, fmt.Errorf("cleanup refuses status=%s without --force (non-complete cleanup salvages work onto slice branches)", lease.Status)
 	}
 	complete := lease.Status == StatusComplete
-	base := ""
-	if !complete {
-		if b, err := revParse(repoRoot, lease.BaseSHA); err != nil {
-			warnf("base sha %s: %v", lease.BaseSHA, err)
-		} else {
-			base = b
-		}
-	}
 	// Ownership comes from what git registered, read before anything is
 	// removed, never from the lease's own claim.
 	registered, err := registeredWorktrees(repoRoot)
@@ -576,6 +729,9 @@ func cleanupLocked(repoRoot, slug string, force bool) ([]Salvage, error) {
 	var failed, stranded, unconfirmed []string
 	keptWorktrees := map[string]bool{}
 	for _, sl := range lease.Slices {
+		// A slice integrate already landed is done like a complete batch: its
+		// work is on control, so there is nothing to salvage or keep.
+		landed := complete || sl.WrightStatus == WrightIntegrated
 		salvageFailed := false
 		// Only the deterministic scratch layout is ours to touch. A forged or
 		// stale lease worktree_path is never salvaged into (git ops would run
@@ -595,7 +751,7 @@ func cleanupLocked(repoRoot, slug string, force bool) ([]Salvage, error) {
 					sl.ID, sl.WorktreePath, ScratchRoot(repoRoot))
 			}
 		}
-		if !complete && owned {
+		if !landed && owned {
 			if _, err := salvage(sl, lease.BatchID); err != nil {
 				warnf("salvage %s: %v", sl.ID, err)
 				salvageFailed = true
@@ -631,7 +787,13 @@ func cleanupLocked(repoRoot, slug string, force bool) ([]Salvage, error) {
 		if sl.Branch != "" {
 			keep := salvageFailed
 			tip := ""
-			if !complete {
+			if !landed {
+				base := ""
+				if b, err := revParse(repoRoot, sliceBase(lease, sl)); err != nil {
+					warnf("base sha %s: %v", sliceBase(lease, sl), err)
+				} else {
+					base = b
+				}
 				if t, err := revParse(repoRoot, sl.Branch); err != nil {
 					warnf("branch tip %s: %v", sl.Branch, err)
 					keep = true // fail toward preservation
@@ -740,13 +902,20 @@ func StatusReport(repoRoot, slug string) (string, error) {
 	fmt.Fprintf(&b, "lease: %s\n", leasePath)
 	fmt.Fprintf(&b, "status: %s\n", lease.Status)
 	fmt.Fprintf(&b, "base_sha: %s\n", lease.BaseSHA)
+	if lease.ControlTip != "" {
+		fmt.Fprintf(&b, "control_tip: %s\n", lease.ControlTip)
+	}
 	for _, sl := range lease.Slices {
 		tc := sl.TransferCommit
 		if tc == "" {
 			tc = "-"
 		}
-		fmt.Fprintf(&b, "slice %s: wright=%s wt=%s branch=%s transfer=%s\n",
+		fmt.Fprintf(&b, "slice %s: wright=%s wt=%s branch=%s transfer=%s",
 			sl.ID, sl.WrightStatus, sl.WorktreePath, sl.Branch, tc)
+		if sl.BaseSHA != "" {
+			fmt.Fprintf(&b, " base=%s", sl.BaseSHA)
+		}
+		b.WriteString("\n")
 	}
 	if head, err := headSHA(repoRoot); err == nil {
 		fmt.Fprintf(&b, "control_HEAD: %s\n", head)

package/engine/internal/parallel/select.go

@@ -13,6 +13,13 @@ var checkPathDisjoint = CheckPathDisjoint
 // whose size is ≤ cap. ready must already be dependency-satisfied and in plan
 // order. cap is 1–MaxParallelSlices; 1 is a legal one-slice round, not a latch.
 func SelectGreedy(cap int, ready []SlicePaths, root string) ([]SlicePaths, error) {
+	return SelectGreedySeeded(cap, nil, ready, root)
+}
+
+// SelectGreedySeeded is SelectGreedy with seed slices already running: they
+// occupy cap slots and claim their paths, a ready candidate with a seed's id
+// is skipped, and only the new picks are returned.
+func SelectGreedySeeded(cap int, seed, ready []SlicePaths, root string) ([]SlicePaths, error) {
 	if cap < 1 || cap > MaxParallelSlices {
 		return nil, fmt.Errorf("cap must be 1-%d (got %d)", MaxParallelSlices, cap)
 	}
@@ -39,11 +46,18 @@ func SelectGreedy(cap int, ready []SlicePaths, root string) ([]SlicePaths, error
 		normalized = append(normalized, SlicePaths{ID: item.ID, Paths: paths})
 	}
 
-	selected := make([]SlicePaths, 0, min(cap, len(normalized)))
+	running := make(map[string]bool, len(seed))
+	for _, s := range seed {
+		running[s.ID] = true
+	}
+	selected := append([]SlicePaths{}, seed...)
 	for _, cand := range normalized {
 		if len(selected) >= cap {
 			break
 		}
+		if running[cand.ID] {
+			continue
+		}
 		if len(selected) == 0 {
 			selected = append(selected, cand)
 			continue
@@ -57,7 +71,7 @@ func SelectGreedy(cap int, ready []SlicePaths, root string) ([]SlicePaths, error
 		}
 		selected = trial
 	}
-	return selected, nil
+	return selected[len(seed):], nil
 }
 
 func selectMode(n int) string {
@@ -71,10 +85,21 @@ func selectMode(n int) string {
 	}
 }
 
-func formatSelect(selected []SlicePaths) string {
-	ids := make([]string, len(selected))
-	for i, item := range selected {
+// formatSelect prints the select line. running < 0 means no lease seeded the
+// selection; otherwise new picks join that many running slices, so the mode
+// counts them too and the line reports running=<k>.
+func formatSelect(picks []SlicePaths, running int) string {
+	ids := make([]string, len(picks))
+	for i, item := range picks {
 		ids[i] = item.ID
 	}
-	return fmt.Sprintf("select: n_eff=%d mode=%s slices=%s", len(selected), selectMode(len(selected)), strings.Join(ids, ","))
+	mode := selectMode(len(picks))
+	if running > 0 && len(picks) > 0 {
+		mode = selectMode(len(picks) + running)
+	}
+	line := fmt.Sprintf("select: n_eff=%d mode=%s slices=%s", len(picks), mode, strings.Join(ids, ","))
+	if running >= 0 {
+		line += fmt.Sprintf(" running=%d", running)
+	}
+	return line
 }

package/engine/main.go

@@ -65,6 +65,8 @@ Usage:
   devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/attest/abandon
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
+  devrites-engine state apply-bundle <slug> <bundle.json>... [--dry-run]
+                                         Validate and apply plan-drafter hunk bundles atomically
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
   devrites-engine migrate <slug> [--dry-run] [--answer id=choice]  Normalize an older-schema workspace to the current schema
   devrites-engine secret-scan [--staged] [--stdin] [slug]  Scan exact staged blobs, stdin, or touched files; HIGH blocks
@@ -237,6 +239,8 @@ func cmdState(root string, args []string, stdout, stderr io.Writer) int {
 		return lib.Resolve(root, args[1:], stdout, stderr)
 	case "merge-manifest":
 		return lib.RunMergeManifest(root, args[1:], stdout, stderr)
+	case "apply-bundle":
+		return lib.RunApplyBundle(root, args[1:], stdout, stderr)
 	case "close":
 		return lib.CloseOut(root, args[1:], stdout, stderr)
 	default:

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -21,7 +21,8 @@ seams supplied by the orchestrator.
   planning artifacts while preserving settled intent.
 
 Reuse existing seams and dependencies before proposing new ones. Build vertical
-slices in dependency order. Map every REQ and AC to a slice and executable proof,
+slices in dependency order; put a hub file's shared edit in one seam slice
+([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Durable
 proof commands must be portable repository commands, never host-local wrappers,
 user-specific absolute paths, or temporary proof trees.
@@ -75,10 +76,13 @@ Return this result:
 
 ```yaml
 mode: define | repair
+base_hashes: {}  # <path>: sha256 of the bytes you read, for every replace/patch target
 candidate_files:
   - path: <requested canonical target>
     operation: create | replace | patch
-    content: <complete candidate or exact bounded delta>
+    content: <complete file; create/replace only>
+    hunks: [] # patch only: {id, old_text, new_text}; old_text byte-exact, unique in the pinned file
+retired_ids: [] # tracked IDs (AC/REQ/HZN/SLICE/DEC/...) the delta removes on purpose
 acceptance_map: []
 dependency_order: []
 technical_decisions: []
@@ -88,7 +92,13 @@ applicability_disposition: []
 self_attack_exposures: []
 ```
 
-The root validates the cross-file bundle and persists accepted content.
+The root saves the bundle as JSON and applies it with `devrites-engine state
+apply-bundle <slug> <bundle.json>`, which refuses a stale pin, a missing,
+duplicate, or overlapping `old_text`, an unlisted vanished ID, a new task-graph
+problem, new budget overshoot, or a new dated delta section, and writes nothing on refusal. Pin each
+`base_hashes` entry with `shasum -a 256` (or `sha256sum`) on the exact file you
+read, and prefer short anchored hunks to whole-file `replace`. Patch the owning
+clause in place; never add a dated delta section beside superseded text.
 
 ## Tools / read-write mode
 

package/pack/.claude/agents/devrites-slice-wright.md

@@ -103,7 +103,11 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
      that source in the result. Never invent an API.
    - **No process residue.** Do not put `SLICE-###`, slice numbers, or "this slice"
      in product source, tests, comments, or filenames.
-4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint. Report required
+4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
+   tests of changed code; `## Feature gates` rows are root-owned. Writer-safe means
+   local and non-consumptive — syntax/type/lint, unit and self-check suites, and a
+   narrow smoke of the changed path — never only a syntax check; contract text
+   cannot strip it. Report required
    build/browser/E2E as `not-run` (root-owned, artifact-producing gates), and only
    when the exact command, cwd, and prerequisites already appear in the unchanged
    vetted `test-plan.md`; never synthesize or rewrite a root command. Root runs

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -4,7 +4,9 @@ Host dispatch; DevRites governs.
 
 ## Roster
 
-Review: Spec/Code plus triggered frontend/security/performance; Seal: all applicable roles.
+Review: Spec/Code, triggered frontend/security/performance, and the seal roles that can
+judge the frozen digest (test-analyst, doubt, devex); Seal: all applicable roles, citing
+same-candidate Review accounts.
 
 | Reviewer | Fires | Trigger |
 |---|---|---|
@@ -74,8 +76,10 @@ If the candidate diff has no matching surfaces, record
    and dedupe by evidence/root cause. Account for all seven (and, in `seal.md`, `devrites-proof-runner` and `devrites-doubt-reviewer`) in
    `review.md`/`seal.md`, each [engineering lane](#engineering-lanes) separately:
    `Outcome:` plus admitted account, or
-   `Not-applicable: <inspected-scope reason>`. Spec/Code may cite valid unchanged
-   `review.md` under [evidence validity](candidate-integrity.md#evidence-validity); persist no dispatch telemetry.
+   `Not-applicable: <inspected-scope reason>`. Seal cites, rather than re-dispatches, any
+   role `review.md` admitted on the identical candidate under
+   [evidence validity](candidate-integrity.md#evidence-validity); a changed digest or newly
+   triggered surface needs a fresh account. Persist no dispatch telemetry.
 7. Missing profile, null/failure, or malformed output is a `gap`; never
    infer approval or substitute inline review.
 
@@ -127,7 +131,8 @@ child's handle, path/resource ownership and capacity reservation until the
 native host confirms a terminal state and returned work has been reconciled.
 Query or wait on that handle; do not replace the child, release its slot, or
 reuse its resources while it may still run. If terminal state cannot be
-established, record a gap and retain ownership. A result classification alone
+established, record a gap and retain ownership; for a child launched by an earlier
+session, the claim proof below settles it. A result classification alone
 does not prove host termination.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
@@ -135,7 +140,11 @@ status`, `parallel status`, and `claim list --all` before any dispatch. A read-o
 wave whose handles this session cannot query: `abandon` it, record each unreturned
 role `gap`, and re-dispatch fresh on the current digest; its late returns are
 `stale`. A writer keeps its claim and lease — no relaunch on those paths until the
-claim is released or its holder is proven terminal. A wright that never returned an
+claim is released or its holder is proven terminal. For an unqueryable writer,
+`claim list --all` showing its claim `released` or `dead` (the engine proved the
+holding session exited on this host) is that proof: `abandon` the wave, record the
+role `gap`, claim the paths, and re-dispatch without waiting on the launching
+session. `live` or `expired` stays held. A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch
 `git diff --name-only` baseline are never cited as built nor discarded, and are
 named in the re-dispatch contract; changes outside task paths stop for the human