devrites 6.1.1 → 6.1.3

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -223,8 +223,9 @@ project/decision docs, and authoritative dependency sources; make and record rev
 implementation/test choices. Ask only about product, scope, acceptance, architecture policy,
 irreversible risk, or human-only access/action.
 
-Objective test/build/tool failure runs bounded `devrites-debug-recovery`; fix it or record a
-technical blocker. Never ask permission for another attempt, test, parser repair, or probe.
+Objective test/build/tool failure runs bounded `devrites-debug-recovery`; fix it, or escalate and
+park it under the [retry contract](#retry-cap-no-progress-loops-and-self-resolve). Never ask
+permission for another attempt, test, parser repair, or probe.
 Close decisions at the earliest informed phase: product in spec, coverage in clarify,
 scope/risk in temper, architecture/dependencies in define, and proof/toolchain in vet. Build
 keeps only unavailable-pre-code or mandatory action-time checkpoints.
@@ -375,6 +376,14 @@ access, safety and irreversible-action boundaries independently stop work.
   closes every deferred row with a labeled verdict; Seal blocks on any without one.
   **Failing case:** round 4 finds three Important items on clauses untouched since
   round 1 and dispatches another repair.
+- **Recovery findings need a discriminator; recovery scope stays frozen.** While a
+  fingerprint is in recovery, a new Important finding keeps it open or opens another
+  only with an executed reproduction or a quoted AC/INV/PROH/accepted-DEC line whose
+  observable outcome fails; root turns it into a control the next wright must pass.
+  A static counterexample against plan-invented hardening goes to the Review trail or
+  `## Deferred findings` (Review gives it a verdict; Seal blocks without one). A
+  Critical with a concrete failure path always opens a fingerprint. A correction adds
+  no proof site or mechanism its fingerprint's closure does not need. No reviewer is skipped.
 - **Separate consumptive authority from recovery.** Spent one-shot authorization
   blocks another execution, not offline recovery. Retained evidence starts caller-owned
   diagnosis/correction immediately; the next consumptive execution needs fresh authority.
@@ -388,13 +397,19 @@ access, safety and irreversible-action boundaries independently stop work.
   the fingerprint's current *strategy*, not the work. Record that strategy and its
   attempts under `## Dead ends`, then the controlling caller escalates inline in the
   same invocation: re-diagnose from the reproduction and dead ends, take the first
-  class below that still has an untried strategy, run `/rite-plan repair` plus
-  narrow Vet for it, and resume with a fresh three-attempt budget. Classes, in order:
-  (1) **shared root cause**: fix the owner every failing path routes through and
-  enforce it across all callers instead of another local guard; (2) **boundary
-  redesign**: acceptance-preserving reslice or redesign of the failing seam;
-  (3) **diagnostic amplification**: add discriminating probes or fixtures, then
-  correct from that evidence. A recorded strategy, or a rewording of one, never
+  class below that still has an untried strategy, and resume with a fresh
+  three-attempt budget. Re-plan only when the strategy must change a planning
+  input (writer allowlist, interface or contract, slice topology, or a
+  `test-plan.md` proof row): run `/rite-plan repair` plus narrow Vet for it. A
+  strategy that fits the vetted plan, with `devrites-engine check readiness <slug>`
+  still passing, goes straight to the wright with the dead ends in its contract;
+  Build's review and proof still gate it. Classes, in order, cheapest evidence
+  before costliest change: (1) **shared root cause**: fix the owner every failing
+  path routes through and enforce it across all callers instead of another local
+  guard; (2) **diagnostic amplification**: add discriminating probes or fixtures,
+  then correct from that evidence (last for a consumptive action, whose attempt
+  needs fresh authorization); (3) **boundary redesign**: acceptance-preserving
+  reslice or redesign of the failing seam, built on that evidence. A recorded strategy, or a rewording of one, never
   repeats. Escalation never weakens tests, validators or acceptance. Each
   fingerprint gets at most three escalations per activation; record each in
   `drift.md` with its class and strategy.

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -62,7 +62,9 @@ a human plus an agent) can share one working tree. Before a same-tree writer
 starts, it records an advisory claim — `devrites-engine claim add --session
 <id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
 with `devrites-engine claim check --session <id> <paths>`; a held claim from a
-live foreign session is a stop-and-report, not a merge-later problem. On every
+live foreign session is never merged later or overridden. Unattended, skip only
+work that needs those paths, run independent work, and re-check `claim list --all`
+before stopping; stop and report the holder only when nothing independent remains. On every
 host-confirmed terminal path after `add` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)) — return,
 rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
@@ -73,7 +75,9 @@ Claims cover product paths only; root-authored `.devrites/**` files use
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose
-session is not proven terminal counts as held (stop and report). **Failing case:**
+session is not proven terminal counts as held (stop and report). `dead` (engine-proven
+exited holder) or `released` is terminal: reconcile per
+[§ Cancellation](../parallel-dispatch.md#cancellation-and-terminal-reconciliation). **Failing case:**
 session B's `claim check` passes at minute 35 over session A's still-running wright.
 
 ## Independence

package/pack/.claude/skills/devrites-lib/reference/standards/core.md

@@ -163,6 +163,9 @@ A skill that stops without doing this leaves the workspace incomplete.
 
 Long contexts degrade reasoning quality. Act on context at **50-70% used, not 95%**.
 
+Read the engine `context` bundle once per phase instead of re-reading the files it
+contains; after compaction re-read the bundle, not its sources.
+
 Every rite names the single resume command on its action line; a `↻ Hygiene:` footer
 advises `/clear`, `/compact`, or `/rite-handoff` and never a competing command. Full phase-by-phase guidance:
 [`context-hygiene.md`](context-hygiene.md).

package/pack/.claude/skills/devrites-lib/reference/standards/gates.md

@@ -124,6 +124,9 @@ an error because the runner can never execute it.
   (an invariant the output must always satisfy) over example (one concrete
   input/output case). An example-shaped oracle on a property-shaped outcome is
   a weak gate — reviewers flag it even when it passes.
+- One CHECK, one oracle: never chain another artifact's self-test before the
+  AC's oracle with `&&` — give the self-test its own gate, so a red self-test
+  never hides the AC's own result.
 - When an outcome becomes impossible, `gates abandon` it and route the
   handoff — never delete the row to make the ledger pass.
 - The gate set is the coverage denominator: it never shrinks to reach

package/pack/.claude/skills/devrites-lib/reference/standards/testing.md

@@ -250,6 +250,13 @@ Dismiss an irrelevant case with a reason; silently omitting an applicable case i
 - A flaky test is a broken test. Isolate and fix it immediately; don't paper over it with
   retries or `sleep`. **Failing case:** a known-flaky test is left with retries so the
   suite is paper-green at Prove/Seal → NO-GO.
+- **A diagnostic rerun is allowed, never proof.** Rerun a timing-shaped failure on
+  the unchanged candidate to classify it flaky or deterministic before a repair;
+  record it as diagnostic, never as a pass.
+- **Attributable RED.** A negative control or mutant counts RED only on a positive
+  marker from the targeted assertion; a setup, construction, or observation failure
+  is never credited as RED. Prove the classifier with an injected setup failure
+  that must stay uncredited.
 - **A retry-only pass is `flaky`, never green.** A pass earned by rerun on an unchanged
   candidate digest (no admitted correction between attempts), or by a runner retry
   setting, is `flaky`: record every attempt with the first attempt's outcome. It never

package/pack/.claude/skills/devrites-lib/reference/standards/workflow-artifacts.md

@@ -326,12 +326,16 @@ Epoch starts 1. `FAILED` records preimages/cleanup/epoch/fingerprint/reason/
 boundary/route/no-progress count. Resolved fingerprints close; a different
 invariant gets a distinct fingerprint. Handoff death resumes its retry epoch with
 prior rows immutable. `WA-OP-011/012` enforce independent fingerprint/epoch caps
-and terminal source cleanup. Exhaustion records:
+and terminal source cleanup. Exhaustion closes this admission, not the work:
+the controlling caller escalates it under the
+[retry contract](afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
+through `PLAN_VET_REPAIR`, and a re-vetted changed design re-admits under a new
+identity with fresh epochs. A fully escalated fingerprint parks. Exhaustion records:
 
 ```text
-status=blocked
+status=running
 exhaustion_cause=<same-fingerprint-count|total-epoch-limit>
-next_action=none — technical recovery exhausted; requires new evidence or changed failure conditions
+next_action=/rite-plan repair <slug> — escalate exhausted workflow attempt
 ```
 
 The journal, evidence section, and observer retain that cause; epoch exhaustion
@@ -343,7 +347,7 @@ Precedence: busy owner; safety/access/approval gate; completed historical; activ
 journal; `CLEANED`; missing/stale authority; stale writer evidence; current
 admission. `PROVED|CLEANING` resumes cleanup; install-through-`PROVING`, rollback,
 or failure cleanup routes offline; retryable `FAILED` routes correction/retry;
-`EXHAUSTED` blocks; `PREPARING|PREPARED` resumes only with current authority.
+`EXHAUSTED` escalates; `PREPARING|PREPARED` resumes only with current authority.
 There is no actor-history migration or backfill.
 
 |Route|Owner|Exact action|Durable state/status/next action|Cursor/output|
@@ -356,7 +360,7 @@ There is no actor-history migration or backfill.
 | `VERIFY_EXISTING`|controlling root|verify `CLEANED`, targets, proof, and product separation; do not reinstall|restore saved return phase/action|no retry/slice/action budget|
 | `NO_BACKFILL`|controlling root|no action|completed state unchanged|no new output|
 | `WAIT_ACTIVE_OWNER`|non-owner|no write; stop invocation|shared state unchanged|fixed owner-busy diagnostic|
-| `BLOCKED_EXHAUSTED`|controlling root|no attempt 4|blocked with exact exhausted next action|fixed exhausted diagnostic|
+| `BLOCKED_EXHAUSTED`|controlling root|no attempt 4 on this admission; escalate through `PLAN_VET_REPAIR` or park per retry contract|`status=running`, exact exhausted `next_action`; parked keeps the parked-recovery action|fixed exhausted diagnostic; no intermediate reply|
 | `BLOCKED_GATE`|controlling root|follow existing safety/access/approval gate|gate-owned state|gate output; never reinterpret as retry|
 
 |Scenario ID|Trigger|Exact route / action|Durable consequence|Forbidden behavior|
@@ -422,7 +426,7 @@ pairs remain injective for actionable seams.
 | `devrites-debug-recovery/SKILL.md`|durable active failure or ambiguous admitted state|`OFFLINE_RECOVERY`; correct offline, re-preflight, narrow Vet, retry only under cap|saved caller or exact Plan/Vet route|
 | `rite-autocomplete/SKILL.md`|lifecycle cursor encounters admitted set or resumable journal|invoke classifier; execute returned route internally|saved phase/action; zero intermediate reply|
 | `rite-autocomplete/reference/loop.md`|loop tick sees Workflow Artifact trigger/state|invoke classifier once under owner lock; no actor-history migration|same loop cursor; no budget charge for verify/rerun|
-| `rite-autocomplete/reference/stop-conditions.md`|classifier returns owner-busy, exhausted, or existing hard gate|stop on exact `WAIT_ACTIVE_OWNER`, `BLOCKED_EXHAUSTED`, or `BLOCKED_GATE` result|unchanged cursor plus fixed route-owned output|
+| `rite-autocomplete/reference/stop-conditions.md`|classifier returns owner-busy, exhausted, or existing hard gate|escalate `BLOCKED_EXHAUSTED`; on `WAIT_ACTIVE_OWNER` run independent work and recheck; stop on exact `BLOCKED_GATE` result|unchanged cursor plus fixed route-owned output|
 | `rite-build/SKILL.md`|Vet-ready admitted bytes require root authorship outside product wright|`ROOT_TRANSACTION`; root writes only admitted `.devrites/**` targets|saved Build slice cursor; wright product allowlist unchanged|
 | `rite-build/reference/phase-contract.md`|Build gate enters or resumes transaction|invoke canonical operation table; reconcile exact result|same slice/checkpoint cursor or Plan/Vet route|
 | `rite-prove/SKILL.md`|Prove consumes installed Workflow Artifact or `CLEANED` rerun|`VERIFY_EXISTING` or admitted proof path ending `PROVE_AND_RETURN`|saved Prove cursor; stop before real action|

package/pack/.claude/skills/devrites-lib/reference/workspace-artifact-schema.md

@@ -237,7 +237,7 @@ slices; use `none` when they do not apply. Complexity above 3 triggers reslicing
 unless the stated reason makes the boundary irreducible. A Writer allowlist of 12+
 files prints an engine `ADVISORY size:` line (`check task-graph`, `check slice`;
 never blocking): split it acceptance-preserving, or add `Size rationale:` naming
-the inseparable capability.
+the inseparable capability; `ADVISORY hub:` takes a seam slice or `Serial rationale:`.
 
 ## Read next by phase
 

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -106,8 +106,8 @@ executable controller/harness/bundle bytes or a missing writer, read
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
    Build runs the largest eligible path-disjoint batch (cap: this invocation's
-   `--parallel N`, else sentinel `max_parallel`, else 10) and recomputes after
-   every completed round until no pending slice remains; a one-slice round is serial for that round only, then
+   `--parallel N`, else sentinel `max_parallel`, else 10) and refills a slot
+   per landing until no pending slice remains; a one-slice round is serial for that round only, then
    selection runs again (host isolation still forces serial when concurrent writers
    cannot be separated). When `--parallel N`
    is present, pass it into `/rite-build` and do not consult leftover sentinel

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -65,7 +65,7 @@ Workspace files carry state; chat does not. Read and execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; one-slice round when <2 eligible); recompute after each round; charge once per green built slice |
+| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; one-slice round when <2 eligible); refill per landing; charge once per landed slice |
 | 7 | `/rite-prove` | all slices built; approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -36,7 +36,7 @@ Agent-owned backtracking is not a stop condition while the exact causal
 fingerprint has budget. Invoke the earlier phase, affected Vet, remediation, and
 proof; then resume the origin. Three no-progress corrections of that exact
 fingerprint spend only its current strategy: escalate to the next correction
-class inline (shared root cause, boundary redesign, diagnostic amplification)
+class inline (shared root cause, diagnostic amplification, boundary redesign)
 with a fresh budget, never asking permission. After three escalations in this
 activation the fingerprint parks; finish all independent work, then stop once.
 Preserve reproduction, attempts, and dead ends; never offer `/rite-plan unblock`
@@ -56,7 +56,7 @@ amplification Plan repair and narrow Vet inline, then pause for fresh GO before
 one evidence-acquisition attempt. Without a safe seam, escalate to the next
 class or park; only a real human/risk/scope gate stops for a human.
 
-<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"stop on exact WAIT_ACTIVE_OWNER, BLOCKED_EXHAUSTED, or BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"escalate BLOCKED_EXHAUSTED; on WAIT_ACTIVE_OWNER run independent work and recheck; stop on exact BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
 ## Other stop classes
 
 - **Gate severity:** escalating always stops. Blocking with a ranked recommended
@@ -83,6 +83,10 @@ class or park; only a real human/risk/scope gate stops for a human.
   pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
   does not stop. Zero with no pending slices is normal completion.
   Malformed flag stops before any write.
+- **Foreign writer:** a `live`/`expired` claim or `WAIT_ACTIVE_OWNER` held by
+  another session blocks only work on those paths; run independent work, re-check,
+  and stop only when nothing independent remains. `released`/`dead` claims are
+  reconciled per [§ Cancellation](../../devrites-lib/reference/parallel-dispatch.md#cancellation-and-terminal-reconciliation).
 - **Resource envelope:** overlapping run or missing AFK after arm still stops.
   Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
 - **Confidence:** intent still cannot become testable acceptance after interview.

package/pack/.claude/skills/rite-build/SKILL.md

@@ -75,15 +75,15 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 
 Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
 path-disjoint set it can start now (`N_eff`), takes fewer when the cap cannot be
-filled, and recomputes after every completed round (serial slice or parallel
-integrate) until no pending slice remains
+filled, and refills a slot per landing (serial slice or one sibling) until
+no pending slice remains
 ([`parallel-batch.md` § Dynamic selection](reference/parallel-batch.md#dynamic-selection-and-re-batching)).
-Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) repeat batches
-inside the same run; HITL stops after each batch. This invocation's `--parallel N`
+Unattended runs (`/rite-autocomplete`, `.devrites/AFK` `max_parallel`) refill
+inside the same run; HITL stops after each landing. This invocation's `--parallel N`
 is the cap: leftover sentinel `max_parallel` is not consulted. Autocomplete with
 that flag also writes or replaces only `max_parallel: N`. Non-integer/`N≤0`/`N>10` hard refuse.
-All-green (independent review + proof) then integrate as one local `WIP(<slug>):`
-commit per sibling onto the current control branch (never pushed). Do not
+Each sibling lands alone when its review + proof are green (`integrate --slice`):
+one local `WIP(<slug>):` commit onto the control branch (never pushed). Do not
 integrate a sibling because the wright returned. A red/gap sibling gets a bounded repair
 round in its own worktree — never rebuilt from scratch while budget remains.
 Post-writer inventory and affected rechecks follow `phase-contract.md` § Independent
@@ -94,7 +94,7 @@ a human `Fix`. Exhausted repair blocks and preserves everything;
 `cleanup --force` salvages slice branches before removing worktrees —
 human-gated to abandon a batch, orchestrator-emitted only as the salvage
 step of an automatic frozen-lease re-batch.
-AFK charges after integrate only. Running lease blocks another
+AFK charges per landed sibling only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/.claude/skills/rite-build/reference/afk-discipline.md

@@ -44,8 +44,8 @@ The controlling root owns the cap:
    before the next dispatch.
    - **Serial:** charge when fail-on-red is green and the built record is written
      (same rewrite as step 2).
-   - **Parallel `--parallel`:** charge only after **successful serial integrate**
-     — once per integrated green sibling. Abort / integrate-failed → charge **0**.
+   - **Parallel `--parallel`:** charge only after **successful integrate**
+     — once per landed green sibling. Abort / integrate-failed → charge **0**.
      Do not charge on worktree-green before integrate. See
      [`parallel-batch.md`](parallel-batch.md).
 

package/pack/.claude/skills/rite-build/reference/checkpoint.md

@@ -18,7 +18,7 @@ the orchestrator pauses for approval before landing it.
   and fail-on-red proof are green, with no open Critical/Important and no repair
   wright still in flight. Serial: git recipe below (skip empty index) or isolated
   FF of a matching `transfer_commit`. Parallel: `devrites-engine parallel
-  integrate --apply-to-control` (no second control `git commit`).
+  integrate --slice <id> --apply-to-control` (no second control `git commit`).
 - **Do not:** when a wright returns; before review/proof; with red/gap findings;
   fast-forward an isolated transfer onto control before those checks.
 

package/pack/.claude/skills/rite-build/reference/one-slice-cycle.md

@@ -22,13 +22,14 @@ DISPATCH  → hand the slice contract to devrites-slice-wright (fresh context).
             — dispatch the initial read-only reviews of distinct decisions in parallel
             (independent claims, fresh contexts); wright fixes stay serial — writers share files
 PROVE     → root, concurrent with the reviews on the same frozen candidate:
-            required build/browser/E2E, then returned-diff/path recheck; fail-on-red
+            required build/browser/E2E (narrow self-check/smoke first, full gate only
+            after it is green, long runs in the background), then returned-diff/path recheck; fail-on-red
             (red/gap → repair wright, then re-review and re-prove; do not commit yet)
 RECORD    → orchestrator: after green verification, update state.md/evidence.md and
             upsert the authoritative candidate manifest from the actual scoped diff
 (CHECKPOINT) → only now, with review+proof green: local WIP(<slug>): <imperative summary>
             on the control branch (no slice id) → checkpoint.md
-NEXT      → HITL root reports and stops. AFK with parallel cap>1: return to parallel-batch selection and run the new N_eff; otherwise repeat under afk-discipline.md
+NEXT      → HITL root reports and stops. AFK with parallel cap>1: return to parallel-batch selection to refill; otherwise repeat under afk-discipline.md
 ```
 
 ## Why the boundary matters

package/pack/.claude/skills/rite-build/reference/parallel-batch.md

@@ -36,14 +36,14 @@ Select **greedily in plan order**: pass every currently dependency-ready pending
 `N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
 is normal: take fewer. Serial is this round's size, not the rest of the run.
 
-**Re-batch automatically after every completed round** (parallel integrate+cleanup or
-a serial slice). Re-read `state.md`, pending slices, and the tree, then run
-`parallel select` again: finished work leaves the pending set, and satisfied
-dependencies unlock new slices. Under `.devrites/AFK` and `/rite-autocomplete` the
-repeat is the same run — HITL stops after each batch. `--parallel 5` with one eligible
-slice runs that one; when two to five then become eligible, the next round takes that
-many. **Failing case:** the run stays one-by-one after a serial round even though more
-slices are now eligible under the same cap.
+**Refill per landing; never wait for the batch.** Each sibling lands alone when
+green ([Lifecycle](#lifecycle) step 6). Then re-read `state.md`, pending slices, and
+the tree and run `parallel select --cap N --slug <slug>`: unlanded siblings hold
+their slots and paths, landed ones count as built, and only new picks print;
+`parallel add` starts each from the control tip and its wright dispatches at once.
+No lease → plain `select` + `create`. AFK/autocomplete is one run; HITL stops after
+each landing. **Failing case:** three siblings are green, one is repairing, and no
+new slice starts.
 
 ## Path-disjoint
 
@@ -109,22 +109,27 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    headroom bounds the batch size — one batch never assumes unbounded reviewers.
 5. Non-green siblings → **repair round** (below) in the same worktrees; lease
    stays `running` — no abort while repair budget remains. A green sibling →
-   `parallel record-green`. No partial integrate. All green → integrate.
+   `parallel record-green`, then step 6 for it alone.
    A recoverable RED blocks integration but does not cancel independent safe running siblings.
    Expected test-first RED is not a terminal gate failure. Cancel only for a shared
    invalid foundation, safety/access failure, resource boundary, or explicit stop;
    preserve completed and in-progress recoverable work and classify each result.
-6. `parallel integrate --apply-to-control` **only after steps 4–5 are green**:
-   each `transfer_commit` descends from `B` and diffs path-exact vs
-   `B`; apply each in plan order as its own local `WIP(<slug>):` commit
-   (imperative summary, never a slice id). Staging branch, then FF. Conflict →
-   reset to `B`, `integrate-failed`; classify under repair rounds (siblings stay
-   in place). Never integrate because a wright returned.
-7. Success: FF control (the branch that held `HEAD` when the batch started —
-   often `main`/`master`, otherwise whatever the user was on) to the integrate
-   tip: N local commits, never pushed; union `touched-files.md`; update
-   state/evidence; AFK +1 per integrated sibling; optional `check candidate`.
-8. Cleanup runs only after `integrate` marks the lease `complete` — work
+6. `parallel integrate --slice <id> --apply-to-control` **only after its steps
+   4–5 are green**: `transfer_commit` descends from the sibling's base and diffs
+   path-exact vs it; apply as its own local `WIP(<slug>):` commit
+   (imperative summary, never a slice id). Staging branch, then FF; the engine
+   refuses (never rewinds) if anything but this lease moved control. Conflict →
+   `integrate-failed`; classify under repair rounds (siblings stay in place).
+   Never integrate because a wright returned.
+7. Each landing: FF control (the branch that held `HEAD` when the batch started —
+   often `main`/`master`, otherwise whatever the user was on) by one local commit,
+   never pushed; union that sibling's paths into `touched-files.md`; update
+   state/evidence; AFK +1 for that sibling; optional `check candidate`. Then
+   refill ([Dynamic selection](#dynamic-selection-and-re-batching)) and start the
+   feature gates on control
+   ([Proof tiers](phase-contract.md#proof-tiers)); the next landing waits for them
+   to pass, the refilled wrights do not.
+8. Cleanup runs only after the last landing marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
    removed while the batch may resume. `parallel abort` + `cleanup --force`
@@ -191,9 +196,11 @@ Repair rejected work in place; never discard/rebuild while budget remains.
 ## Engine verbs
 
 ```text
-devrites-engine parallel select --cap <1-10> [--root <dir>] [<json-file>|-]
+devrites-engine parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [<json-file>|-]
 devrites-engine parallel create --root <repo> --slug <slug> --batch <id> --base <B> --json <file>|-
+devrites-engine parallel add --root <repo> --slug <slug> --json <file>|-
 devrites-engine parallel record-green --root <repo> --slug <slug> --slice <id> --commit <sha>
+devrites-engine parallel integrate --root <repo> --slug <slug> --slice <id> --apply-to-control
 devrites-engine parallel integrate --root <repo> --slug <slug> --apply-to-control
 devrites-engine parallel status --root <repo> --slug <slug>
 devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug <slug>

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -42,7 +42,8 @@ Spec Drift Guard still applies.
 6. **Prove.** Against the frozen pre-slice candidate inspect
    test hunks for deletion, skipping/focus, tautology, or weaker expectations.
    Wait for step 5's exact test-analyst account; missing/adverse criterion verdict is
-   Critical. Run only `test-plan.md` repository/CI commands, record output, recheck
+   Critical. Run only `test-plan.md` repository/CI commands ([tier](#proof-tiers)),
+   record output, recheck
    `git diff --name-only`. Missing/weakened/red/source-mutating proof cannot pass.
    Pre-existing/environment-specific claims need a predating same-command,
    same-environment baseline; otherwise unresolved.
@@ -67,6 +68,14 @@ Spec Drift Guard still applies.
 
 One contract builds one slice: preserve TDD, exact paths and independent judgment.
 
+## Proof tiers
+
+With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and every
+other row; feature gates run once per parallel landing, on control, while worktree
+wrights continue. The next landing and Prove wait for them; red is a fingerprint
+against slices landed since the last green run. Serial same-worktree mode, and plans
+without the section, run every row each round.
+
 ## Independent Build review
 
 After inspection, freeze full slice scope and cumulative baseline diff. Initial

package/pack/.claude/skills/rite-build/reference/spec-drift-guard.md

@@ -82,5 +82,6 @@ The detecting phase owns backtracking and the batch sweep. Save
 `return_phase`/`return_next_action`; consume nested Plan/Vet `STOP` internally, complete
 vetted acceptance-preserving remediation, then restore the cursor and failed step.
 Never hand the human an intermediate command. The shared three-attempt causal-fingerprint
-cap still applies: exhaustion produces one technical blocker, while a genuinely
-human-owned decision uses the question format below.
+cap still applies: a spent strategy escalates and a fully escalated fingerprint parks
+under the [retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+while a genuinely human-owned decision uses the question format below.

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -76,6 +76,11 @@ worktrees stay forbidden.
    Quote every active `decisions.md` carry-forward constraint whose `Files:`
    overlap the task paths (or that names no files).
    A new path requires a new bounded contract; the wright cannot widen the task.
+   Name the writer-safe commands the wright must run (syntax/type/lint, unit and
+   self-check suites, a narrow local smoke of the changed path) and never forbid
+   them: a wright that cannot execute writes blind and its failures surface a
+   whole review round later. Only artifact-producing, consumptive, or full
+   canonical feature gates stay root-owned.
 3. Record `git diff --name-only` before dispatch so unrelated work remains
    distinguishable. For an isolated pilot, also record committed base SHA and exact
    baseline status before asking the host for isolation. **Failing case:** paths that
@@ -99,6 +104,8 @@ acceptance-preserving split (`root_no_change_analysis` → `FOLD` per
 [acceptance-preserving-reslice](../../devrites-lib/reference/standards/acceptance-preserving-reslice.md);
 open findings move to the new slice owning their paths), or record
 `## <DRIFT-ID> — <SLICE-ID> reslice review` with why no smaller split exists and
+a spec trace of the slice's obligations (hardening no AC/INV/PROH requires moves to
+a sibling slice dependents do not need, still gated before Seal), and
 reopen with `--reslice-review <DRIFT-ID>`. Use
 at most one writer across all linked worktrees for this workspace. Never run two
 writers in one worktree, run isolated and same-worktree writers concurrently, or
@@ -144,8 +151,8 @@ TTL is crash recovery, not normal cleanup.
    **Do not land on control until review and proof are both green.** Isolated
    `transfer_commit` stays on the worker branch; same-worktree diffs stay
    uncommitted. Serial: [`checkpoint.md`](checkpoint.md), then host may remove the
-   worktree. Parallel: `record-green` only; land with `parallel integrate
-   --apply-to-control` after the batch; `parallel cleanup` removes worktrees.
+   worktree. Parallel: `record-green`, then `parallel integrate
+   --slice <id> --apply-to-control`; `parallel cleanup` removes worktrees.
 5. Reconcile returned reuse, conventions, principles, sources, assumptions,
    decisions, dead ends, follow-ups, gates, and touched files. Persist the
    relevant facts in canonical artifacts, not the wholesale report. A plan-gap

package/pack/.claude/skills/rite-define/SKILL.md

@@ -77,6 +77,13 @@ Pull these via `Read` when shaping the plan:
    `devrites-plan-drafter` in `define` mode for one atomic candidate bundle:
    `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` with proof mapping.
    Validate its bounded result; it does not write/ask, and returns human choices to root.
+   In the same parallel wave, dispatch one `devrites-evidence-scout` per external
+   capability the plan will rest on — OS/SDK/native API, permission or sandbox,
+   file format, toolchain, or third-party behavior — that neither live code nor a
+   cited dossier already proves (at most three, as in Spec). Fold each dossier
+   before step 2a: cite a proven capability in `architecture.md`; an unproven or
+   contradicted one becomes a risk spike ordered before its dependent slices,
+   never an assumption the build discovers.
 2. **Reconcile architecture + approach** against live seams; root writes at step 6.
    `architecture.md` owns layers/boundaries/integrations/data/dependencies/risks/impact;
    `plan.md` owns build strategy. Use the code index for structure/impact
@@ -148,7 +155,9 @@ Pull these via `Read` when shaping the plan:
    intended, route it through the Spec Drift Guard plus a recorded decision and a scoped principle
    exception a human approves. Never ready a plan that silently violates an invariant. (Re-scored
    as a blocking gate at `/rite-vet`; no file → none declared → nothing to check.)
-6. **Write** `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md`; update
+6. **Write** `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` — save the
+   accepted bundle under `packets/` and apply it with `devrites-engine state
+   apply-bundle <slug> <bundle.json>` before root reconciliation edits; update
    `state.md` (phase: plan → next `/rite-vet`). When diagrams clarify, also write optional
    `flows.md` (**Mermaid-first**). If a richer reviewable visual earns it, emit
    `visual/<flow>.html` + `visual/<flow>.outline.md` after loading matching playbooks from
@@ -161,7 +170,7 @@ Pull these via `Read` when shaping the plan:
    meaning-changing mappings block. Then run
    `devrites-engine check task-graph <slug>`; a malformed dependency graph blocks
    before Vet rather than spending a reviewer context on invalid tasks. Resolve each
-   `ADVISORY size:` line now (split, or `Size rationale:`); it never blocks.
+   `ADVISORY size:`/`hub:` line now (split or seam slice, or a rationale); never blocking.
 7. **Readiness gate** (`plan-template.md`): require CLEAR coverage; complete acceptance,
    wiring, shared-contract proof, applicable outputs, and rollback; risk-first acyclic order;
    justified deviations; and every horizon item present, with blockers resolved, planning

package/pack/.claude/skills/rite-handoff/SKILL.md

@@ -74,7 +74,7 @@ themselves. The workspace is the canonical store; the handoff is the chat-only d
 6. **In-flight work.** Every dispatch wave opened or sealed without a return (`devrites-engine
    dispatch <slug> status`), running writer handle, held claim id plus paths (`devrites-engine
    claim list --all`), and consumptive action started, each `terminal: yes|unknown` (`yes` only with
-   an admitted return, release, or proof of stop). The live handle exists only in chat. Any
+   an admitted return, release, `dead` claim, or proof of stop). The live handle exists only in chat. Any
    `unknown` row makes item 1 a reconcile step (`dispatch <slug> status`, `parallel status`,
    `claim list --all`), never a writer command: otherwise the next session dispatches a second writer.
 7. **How to resume:** fixed boilerplate (see template below).

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -5,7 +5,7 @@ argument-hint: "[mode: decompose|reslice|repair|reorder|split|unblock|course-cor
 user-invocable: true
 ---
 
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/agents.md","rite-plan/reference/slicing.md","rite-plan/reference/replan-and-repair.md","rite-plan/reference/dependency-graph.md","rite-plan/reference/task-breakdown.md","rite-plan/reference/anti-patterns.md","rite-define/reference/plan-template.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","drift.md"],"workspaceByRole":{"plan-drafter":["brief.md","spec.md","plan.md","tasks.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","state.md","drift.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/agents.md","rite-plan/reference/slicing.md","rite-plan/reference/replan-and-repair.md","rite-plan/reference/dependency-graph.md","rite-plan/reference/task-breakdown.md","rite-plan/reference/anti-patterns.md","rite-define/reference/plan-template.md"],"triggers":{"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","drift.md"],"workspaceByRole":{"evidence-scout":["spec.md","architecture.md","decisions.md","state.md"],"plan-drafter":["brief.md","spec.md","plan.md","tasks.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","architecture.md","state.md","drift.md"]}} -->
 > Read-set manifest: `devrites-engine context <slug> --phase plan` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 
@@ -93,15 +93,21 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    never re-derives them by exhaustive search. It also carries a bounded
    self-attack over the delta (`self_attack_exposures`), catching the shallow
    next-round findings before Vet's dispatch rather than after a full loop.
-   Root dispositions every exposure — fold as a finding, accept as a declared
+   During recovery, a non-Critical exposure off the failing fingerprint's causal
+   path goes to `eng-review.md` `## Deferred findings` (Review gives it a verdict;
+   Seal blocks without one), so a repair never widens past its fingerprint.
+   Root dispositions every other exposure — fold as a finding, accept as a declared
    residual, or reject with reason; none silently drops.
    Packet mechanics: dedupe at assembly — findings with an identical
    required-fix and site set merge into one entry that closes all their
    fingerprints. The packet may carry digest-pinned site excerpts so the
-   drafter spot-verifies anchors instead of re-scanning whole files, and root
-   may partition findings into anchor-disjoint clusters with one drafter per
-   cluster in parallel — findings sharing any anchor or mirrored clause stay
-   in one cluster, and each bundle applies independently. A `partial`-
+   drafter spot-verifies anchors instead of re-scanning whole files. Root
+   partitions findings into anchor-disjoint clusters — findings sharing any
+   anchor or mirrored clause stay in one cluster — and, with two or more,
+   dispatches one drafter per cluster in one parallel wave within the scale
+   limits. Every cluster pins the same base; their bundles apply together in
+   one `state apply-bundle` call, and an overlap refusal merges those clusters
+   for the re-dispatch. A `partial`-
    continuation re-dispatch continues the same packet; it does not advance the
    same-seam counter. Count consecutive repair packets whose findings' cited clause sets overlap
    the immediately previous packet's — the overlap is the seam. Carry it as an explicit
@@ -140,9 +146,14 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
 4. Re-slice using vertical-slice rules: [slicing](reference/slicing.md) and
    [task-breakdown](reference/task-breakdown.md). Prefer thin, shippable, verifiable.
    **Completion:** every slice is independently shippable/provable or carries an irreducibility reason.
-5. Reconcile the candidate against steps 3 and 4, then the root updates `plan.md`, `tasks.md`,
-   `state.md`, and appends rationale to `decisions.md`. A rejected candidate
-   (malformed bundle, stale or non-unique anchor) or a drafter `Outcome: gap`
+5. Reconcile the candidate's meaning against steps 3 and 4, save each bundle
+   under `packets/`, and apply its hunks with `devrites-engine state apply-bundle
+   <slug> <bundle.json>...` (all-or-nothing; `--dry-run` previews); never
+   hand-copy hunks or stage file copies. Rewrite each owning clause in place; never
+   append a dated delta or fold section beside the clause it supersedes (apply-bundle
+   refuses one). Then update `state.md` and append
+   rationale to `decisions.md`. A rejected candidate
+   (malformed bundle, stale or non-unique anchor, any apply-bundle refusal) or a drafter `Outcome: gap`
    is one no-progress outcome on every open fingerprint in the fold; the
    re-dispatch packet must name the rejection so the same hunks don't recur.
    A gap naming genuinely human-owned information routes to `/rite-clarify`.

package/pack/.claude/skills/rite-plan/reference/slicing.md

@@ -168,3 +168,8 @@ Order by dependency, but minimize coupling. A slice that needs three other slice
 is a smell: look for a thinner cut that stands alone. An edge exists only when this slice
 reads something the other produces: write it as `SLICE-001 (via <interface>)`. If you
 cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.
+
+Slices sharing a file never build side by side: put a hub file's shared edit
+(registry, command table, test harness) in one seam slice the others depend on.
+`check task-graph` prints the `schedule:` and `ADVISORY hub:` lines; inseparable
+writes get `Serial rationale: <why>`. Never merge slices or drop acceptance to widen it.

package/pack/.claude/skills/rite-polish/SKILL.md

@@ -77,8 +77,10 @@ Incomplete comparison is **not** agreement. Record axis deltas in `polish-report
    captures.
 3. **Always** read [`reference/code.md`](reference/code.md) and assess **Phase 1
    (code polish)**; if backend was touched, assess **Phase 2 (backend polish)** from
-   the same file. Reconcile the findings, then send accepted corrections as one bounded
-   wright contract: build its read-set with
+   the same file. Assess step 4's UI phases on the same frozen digest while the
+   code assessment runs, reconcile both, then send every accepted code and UI
+   correction as one bounded wright contract (normalize corrections before polish
+   ones): build its read-set with
    `devrites-engine context <slug> --phase polish --role slice-wright`, run the
    single-agent wave through `devrites-engine dispatch <slug> open|start|seal|return`
    (auto-records dispatch/return metrics), and gate returned paths
@@ -91,8 +93,8 @@ Incomplete comparison is **not** agreement. Record axis deltas in `polish-report
    its `FAIL` and `PARTIAL` rows are the normalize/quality-bar worklist**: identify the root
    cause of each (a missing state, an off-token CTA, or an anti-slop hit) rather than
    hiding it with decoration. Assess **Phase 3 (normalize)** → **Phase 4 (UI polish)**,
-   then send accepted UI
-   corrections to the wright (which invokes the relevant craft skill). Honor argument modes:
+   and fold accepted UI
+   corrections into step 3's single wright contract (the wright invokes the relevant craft skill). Honor argument modes:
    - `bolder | quieter | distill | harden`: passed to Phase 4 as the
      emphasis dial.
    - `normalize-only`: assess Phase 3 and stop (no Phase 4).