devrites 6.10.0 → 7.0.1

package/engine/internal/parallel/cli.go

@@ -78,6 +78,7 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	jsonPath := "-"
 	capN := 0
 	sawCap := false
+	fromPlan := false
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
 		case "--root", "--slug":
@@ -104,6 +105,8 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 			}
 			capN = n
 			sawCap = true
+		case "--from-plan":
+			fromPlan = true
 		case "-h", "-help", "--help":
 			fmt.Fprintln(stdout, usageSelect)
 			return ExitOK
@@ -119,43 +122,34 @@ func cmdSelect(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stderr, usageSelect)
 		return ExitUsage
 	}
-	data, err := readJSONInput(jsonPath, stdin)
-	if err != nil {
-		fmt.Fprintf(stderr, "parallel select: %v\n", err)
-		return ExitBlocked
-	}
-	slices, err := ParseSlicesJSON(data)
-	if err != nil {
-		fmt.Fprintf(stderr, "parallel select: %v\n", err)
-		return ExitBlocked
-	}
-	var seed []SlicePaths
-	running := -1
-	if slug != "" {
-		lease, err := runningLease(root, slug)
+	var slices []SlicePaths
+	if fromPlan {
+		if slug == "" || jsonPath != "-" {
+			fmt.Fprintln(stderr, "parallel select: --from-plan needs --slug and takes no JSON input")
+			return ExitUsage
+		}
+		if PlanReady == nil {
+			fmt.Fprintln(stderr, "parallel select: --from-plan is unavailable in this build")
+			return ExitBlocked
+		}
+		ready, err := PlanReady(root, slug)
 		if err != nil {
 			fmt.Fprintf(stderr, "parallel select: %v\n", err)
 			return ExitBlocked
 		}
-		if lease != nil {
-			// The lease's active slices keep their slots and paths; nothing it
-			// already names (active or landed) is picked again.
-			seed = activeSlices(lease)
-			running = len(seed)
-			named := make(map[string]bool, len(lease.Slices))
-			for _, sl := range lease.Slices {
-				named[sl.ID] = true
-			}
-			var fresh []SlicePaths
-			for _, s := range slices {
-				if !named[s.ID] {
-					fresh = append(fresh, s)
-				}
-			}
-			slices = fresh
+		slices = ready
+	} else {
+		data, err := readJSONInput(jsonPath, stdin)
+		if err != nil {
+			fmt.Fprintf(stderr, "parallel select: %v\n", err)
+			return ExitBlocked
+		}
+		if slices, err = ParseSlicesJSON(data); err != nil {
+			fmt.Fprintf(stderr, "parallel select: %v\n", err)
+			return ExitBlocked
 		}
 	}
-	selected, err := SelectGreedySeeded(capN, seed, slices, root)
+	_, selected, running, err := SelectForSlug(root, slug, capN, slices)
 	if err != nil {
 		fmt.Fprintf(stderr, "parallel select: %v\n", err)
 		if strings.Contains(err.Error(), "cap must be") {
@@ -237,7 +231,7 @@ const (
 	usageLeaseRead    = "usage: parallel lease-read --root --slug [--field name]"
 	usageLeaseClear   = "usage: parallel lease-clear --root --slug"
 	usagePathDisjoint = "usage: check path-disjoint [--root <dir>] [<json-file>|-]"
-	usageSelect       = "usage: parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [<json-file>|-]"
+	usageSelect       = "usage: parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan | <json-file>|-]"
 )
 
 func parallelUsage() string {
@@ -254,7 +248,7 @@ Subcommands:
   lease-write     --root --slug --json
   lease-read      --root --slug [--field name]
   lease-clear     --root --slug
-  select          --cap <1-10> [--root] [--slug] [<json-file>|-]
+  select          --cap <1-10> [--root] [--slug] [--from-plan | <json-file>|-]
 
 Exit codes: 0 ok, 2 usage, 3 blocked`)
 }

package/engine/internal/parallel/git.go

@@ -201,6 +201,16 @@ func worktreeAdd(repo, path, branch, startPoint string) error {
 	return err
 }
 
+// AddDetachedWorktree checks rev out at path on no branch, for a throwaway
+// copy that must leave no ref behind; RemoveWorktree undoes it.
+func AddDetachedWorktree(repo, path, rev string) error {
+	_, err := git(repo, "worktree", "add", "--detach", path, rev)
+	return err
+}
+
+// RemoveWorktree force-removes a worktree, falling back to delete plus prune.
+func RemoveWorktree(repo, path string) error { return worktreeRemove(repo, path) }
+
 func worktreeRemove(repo, path string) error {
 	_, err := git(repo, "worktree", "remove", "--force", path)
 	if err != nil {

package/engine/internal/parallel/select.go

@@ -74,6 +74,42 @@ func SelectGreedySeeded(cap int, seed, ready []SlicePaths, root string) ([]Slice
 	return selected[len(seed):], nil
 }
 
+// PlanReady returns the plan-order ready set for `select --from-plan` (root is
+// the project root). main sets it: the task-graph reader lives in lib, which
+// imports this package.
+var PlanReady func(root, slug string) ([]SlicePaths, error)
+
+// SelectForSlug is SelectGreedySeeded seeded from slug's running lease: its
+// active slices keep their slots and paths, and nothing it names (active or
+// landed) is picked again. eligible is ready minus those names; running is -1
+// when no lease seeded the selection. An empty slug skips the lease.
+func SelectForSlug(root, slug string, capN int, ready []SlicePaths) (eligible, picks []SlicePaths, running int, err error) {
+	eligible, running = ready, -1
+	var seed []SlicePaths
+	if slug != "" {
+		lease, err := runningLease(root, slug)
+		if err != nil {
+			return nil, nil, -1, err
+		}
+		if lease != nil {
+			seed = activeSlices(lease)
+			running = len(seed)
+			named := make(map[string]bool, len(lease.Slices))
+			for _, sl := range lease.Slices {
+				named[sl.ID] = true
+			}
+			eligible = nil
+			for _, s := range ready {
+				if !named[s.ID] {
+					eligible = append(eligible, s)
+				}
+			}
+		}
+	}
+	picks, err = SelectGreedySeeded(capN, seed, eligible, root)
+	return eligible, picks, running, err
+}
+
 func selectMode(n int) string {
 	switch {
 	case n <= 0:

package/engine/internal/state/budgets.go

@@ -2,6 +2,10 @@ package state
 
 import (
 	"bytes"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
 	"strings"
 
 	"github.com/devrites/devrites/internal/markdowntext"
@@ -14,9 +18,12 @@ const (
 	BudgetBytesPerLine = 400
 	// BudgetBlockFactor is the material-overshoot threshold. At or above this
 	// multiple of a line or byte budget a gate blocks unless the artifact
-	// records a structural `Budget override:` line; smaller overshoots are
-	// reported by `orient` and stay advisory.
+	// records a structural `Budget override: <=N lines; <reason>` line that
+	// covers it; smaller overshoots are reported by `orient` and stay advisory.
 	BudgetBlockFactor = 1.5
+	// BudgetOverrideFactor caps an override's N at this multiple of the line
+	// budget; past it only lossless relocation to history/ or a split is legal.
+	BudgetOverrideFactor = 2
 	// MaxArtifactBytes is the per-artifact read cap. A larger artifact cannot be
 	// observed and blocks as file_too_large, so callers that explain a size
 	// problem quote the same number the observer enforced.
@@ -80,7 +87,7 @@ func ArtifactLineBudget(name string) (int, bool) {
 // line budget: conditional artifacts (`references.md`, `investigation-map.md`,
 // `dogfood.md`, `devex.md`) and engine-owned machine files (the parallel lease,
 // the metrics ledger, the regression baseline, the dispatch ledger, the drift
-// baseline). Anything else in the root is unsanctioned placement — `packets/`
+// baseline, the diff-scope snapshot, the tree baseline). Anything else in the root is unsanctioned placement — `packets/`
 // and `history/` own by-reference packets and relocated narrative
 // (workspace-artifact-schema.md "Required by phase").
 var sanctionedRootFiles = map[string]bool{
@@ -93,6 +100,8 @@ var sanctionedRootFiles = map[string]bool{
 	"regression-baseline.json": true,
 	"dispatch.json":            true,
 	"readiness-inputs.json":    true,
+	"diff-scope-baseline.json": true,
+	"tree-baseline.json":       true,
 }
 
 // SanctionedRootFile reports whether name is a legitimate workspace-root file:
@@ -111,6 +120,19 @@ func ArtifactBudgetGateApplies(name string) bool {
 	return ok && !advisoryOnlyArtifacts[name]
 }
 
+// BudgetGatedArtifacts lists, sorted, every artifact the material-overshoot
+// gate covers, so a gate checks each one present, not only the phase-required.
+func BudgetGatedArtifacts() []ArtifactPath {
+	var names []ArtifactPath
+	for name := range artifactLineBudgets {
+		if ArtifactBudgetGateApplies(name) {
+			names = append(names, ArtifactPath(name))
+		}
+	}
+	sort.Slice(names, func(i, j int) bool { return names[i] < names[j] })
+	return names
+}
+
 // ArtifactBudgetStatus is one canonical artifact measured against its budget.
 type ArtifactBudgetStatus struct {
 	File       string
@@ -120,7 +142,11 @@ type ArtifactBudgetStatus struct {
 	ByteBudget int64
 	Over       bool
 	Material   bool
-	Override   bool
+	// OverrideLines is the N of a well-formed override within the cap, else 0.
+	OverrideLines int
+	// Override is true when that override covers the artifact: at most N lines
+	// and N*BudgetBytesPerLine bytes.
+	Override bool
 }
 
 // ArtifactBudget measures raw against the named artifact's budget. ok is false
@@ -140,7 +166,10 @@ func ArtifactBudget(name string, raw []byte) (ArtifactBudgetStatus, bool) {
 	status.Over = status.Lines > lineBudget || status.Bytes > status.ByteBudget
 	status.Material = float64(status.Lines) >= float64(lineBudget)*BudgetBlockFactor ||
 		float64(status.Bytes) >= float64(status.ByteBudget)*BudgetBlockFactor
-	status.Override = HasBudgetOverride(raw)
+	if n := BudgetOverrideLines(raw); n > 0 && n <= lineBudget*BudgetOverrideFactor {
+		status.OverrideLines = n
+		status.Override = status.Lines <= n && status.Bytes <= int64(n)*BudgetBytesPerLine
+	}
 	return status, true
 }
 
@@ -156,18 +185,36 @@ func CountLines(raw []byte) int {
 	return lines
 }
 
-// HasBudgetOverride reports a structural `Budget override:` line with a reason
-// outside fenced code blocks; a fenced example never counts. Malformed Markdown carries no
-// structural override.
-func HasBudgetOverride(raw []byte) bool {
+// budgetOverrideValue matches the text after `Budget override:`: `<=N` (optionally
+// `lines`), `;`, then a non-empty reason.
+var budgetOverrideValue = regexp.MustCompile(`^\s*<=\s*([0-9]{1,6})(?:\s*lines?)?\s*;\s*\S`)
+
+// BudgetOverrideLines returns N from the first structural
+// `Budget override: <=N lines; <reason>` line outside fenced code blocks, or 0
+// when there is none. A free-text override without N, a fenced example, and
+// malformed Markdown carry no override.
+func BudgetOverrideLines(raw []byte) int {
 	structural, err := markdowntext.Structural(raw)
 	if err != nil {
-		return false
+		return 0
 	}
 	for _, line := range strings.Split(string(structural), "\n") {
-		if reason, ok := strings.CutPrefix(strings.TrimSpace(line), "Budget override:"); ok && strings.TrimSpace(reason) != "" {
-			return true
+		value, ok := strings.CutPrefix(strings.TrimSpace(line), "Budget override:")
+		if !ok {
+			continue
+		}
+		if m := budgetOverrideValue.FindStringSubmatch(value); m != nil {
+			if n, err := strconv.Atoi(m[1]); err == nil && n > 0 {
+				return n
+			}
 		}
 	}
-	return false
+	return 0
+}
+
+// BudgetRemedy names the legal ways out of a material overshoot for a
+// lineBudget-line artifact.
+func BudgetRemedy(lineBudget int) string {
+	return fmt.Sprintf("relocate closed sections losslessly to history/<file>-<YYYYMMDD>.md, split the feature via /rite-plan revise|course-correct, or record a structural `Budget override: <=N lines; <reason>` line with N <= %d (%dx the budget; never for slice or acceptance count)",
+		lineBudget*BudgetOverrideFactor, BudgetOverrideFactor)
 }

package/engine/internal/state/observation.go

@@ -393,7 +393,7 @@ func observationInventory() []ArtifactPath {
 			inventory = append(inventory, artifact)
 		}
 	}
-	for _, artifact := range []ArtifactPath{"strategy.md", "design-brief.md", "ai-spec.md", ".devrites/principles.md"} {
+	for _, artifact := range append(append([]ArtifactPath{"strategy.md", "design-brief.md", "ai-spec.md"}, BudgetGatedArtifacts()...), ".devrites/principles.md") {
 		if !seen[artifact] {
 			seen[artifact] = true
 			inventory = append(inventory, artifact)

package/engine/main.go

@@ -28,33 +28,43 @@ Usage:
   devrites-engine check candidate <slug>   Validate and hash the closed project candidate
   devrites-engine check readiness <slug>   Check required files, tasks.md graph, and Build-input binding
   devrites-engine check readiness --emit-binding <slug>  Emit the stable Build-input binding for Vet
+  devrites-engine check preconditions <slug> [--slice SLICE-###] [--timeout N]
+                                         Run test-plan.md preflight rows whose Run at is vet (or pre-dispatch <slice>)
   devrites-engine check seal <slug>        Recheck files, tasks.md graph, Build-input binding, and evidence freshness
   devrites-engine check path-disjoint [--root <dir>] [<json-file>|-]
                                          Verify slice path sets are pairwise disjoint
   devrites-engine check task-graph <slug>  Validate tasks.md slice dependency graph
   devrites-engine check slice <slug> <SLICE-ID>  Pre-dispatch lint of one slice's wright contract
-  devrites-engine check diff-scope <slug> --allow <csv>|--allow-file <path> [--worktree|--staged|--base <ref>]
+  devrites-engine check diff-scope <slug> --allow <csv>|--allow-file <path> [--worktree|--staged|--base <ref>] [--snapshot|--baseline] [--verbose]
                                          Verify the changed-path set stays inside the declared allowlist
   devrites-engine check skill-trust <path> Scan one skill/agent Markdown for trust violations
   devrites-engine check regression <slug> [--update]
                                          Compare workspace progress against the recorded baseline; --update ratchets it
   devrites-engine check drift <slug> [--record]
                                          Attribute readiness-input changes to the exact artifact since the Vet baseline
-  devrites-engine check windows <slug> [--worktree|--staged|--base <ref>]
+  devrites-engine check windows <slug> [--worktree|--staged|--base <ref>|--since-dispatch <wave>]
                                          Fail on deferral markers the change adds without a windows.md waiver
   devrites-engine check dup [slug] [--all|--worktree|--staged|--base <ref>]
                                          Report near-duplicate code clusters that survive renaming (advisory)
+  devrites-engine check anchors <slug> <return-file> [--skills-root <dir>]
+                                         Anchor each Critical/Important row's quotes; Unverified or Deferred rows exit 3
+  devrites-engine check perturb <slug> --patch <file> --expect <test-name> --gate <G-ID> [--timeout N]
+                                         Run one mutant patch against a candidate copy; RED must name --expect
   devrites-engine observe summary <slug>   Emit sanitized JSON workspace summary
   devrites-engine orient <slug>            Alias for observe summary
   devrites-engine next [slug]              Print the minimal remaining lifecycle path with advisory skips
-  devrites-engine handoff [slug]           Emit the deterministic resume record (cursor, blocking gates, ledger, dead ends)
+  devrites-engine handoff [slug] [--resume]  Emit the deterministic resume record (cursor, blocking gates, ledger, dead ends, in-flight waves); --resume records a resume metric
   devrites-engine recall --paths <csv> [--limit n]
                                          Point at archived features that touched these paths: decisions, constraints, findings (read-only)
-  devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--slice <id>] [--trigger a,b]
+  devrites-engine context [slug] (--phase <p> | --skill <name>) [--role <r>] [--slice <id>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]
                                          Emit one deduplicated read-set bundle for a phase, skill, or dispatch role
   devrites-engine metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]
   devrites-engine metrics summary [slug] [--by-slice]  Summarize the metrics ledger, or per-slice rounds and agent-minutes
-  devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon (build wright waves: --slice, round cap)
+  devrites-engine candidate freeze <slug> --wave <w> (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]
+                                         Freeze a review candidate to packets/<w>.diff + packets/<w>.sha256
+  devrites-engine packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]
+                                         Render and lint one role's by-reference dispatch packet
+  devrites-engine dispatch <slug> <sub>    Launch-wave barrier for parallel dispatch: open/start/seal/return/status/abandon/attribute (build wright waves: --slice, round cap)
   devrites-engine claim <add|release|list|check>   Advisory session-scoped file claims for same-tree concurrent sessions (.devrites/claims.jsonl)
   devrites-engine note <subcommand> <slug>         Anchored workspace notes bound to verbatim code quotes; drift regrades them (notes.md)
   devrites-engine observe slice <slug> <SLICE-ID>  Print one SLICE-### section of tasks.md
@@ -62,11 +72,15 @@ Usage:
   devrites-engine detect commands [--root <dir>] [--json]
                                          Resolve test/lint/vet/build commands from the repository's own wiring
   devrites-engine parallel <subcommand>   Deterministic parallel worktree lease/create/integrate/cleanup
-  devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/attest/abandon
+  devrites-engine gates <subcommand> <slug>  Machine-checked gates.md ledger: scaffold/status/run/reverify/lint/precheck/attest/abandon
   devrites-engine state resolve <qid> "<ans>"  Resolve an open question and update state atomically
   devrites-engine state merge-manifest <slug> [pred...]  Fold the recorded predecessor chain's manifests into the release candidate manifest
   devrites-engine state apply-bundle <slug> <bundle.json>... [--dry-run]
                                          Validate and apply plan-drafter hunk bundles atomically
+  devrites-engine state set <slug> <key>=<value>... [--unset <key>]
+                                         Write state.md cursor fields atomically (known phase, no return-cursor overwrite)
+  devrites-engine state append <slug> <ledger.md> --heading "<text>" --body-file <path|->
+                                         Append one ## section to an append-only ledger; refuses a duplicate heading
   devrites-engine state close <slug>       Archive a shipped feature and clear ACTIVE
   devrites-engine migrate <slug> [--dry-run] [--answer id=choice]  Normalize an older-schema workspace to the current schema
   devrites-engine secret-scan [--staged] [--stdin] [slug]  Scan exact staged blobs, stdin, or touched files; HIGH blocks
@@ -106,6 +120,10 @@ func init() {
 		digest, _, err := lib.CandidateIdentity(root, slug)
 		return digest, err
 	}
+	// parallel cannot import lib (lib imports it), so `parallel select --from-plan` gets the plan-derived ready set through this hook.
+	parallel.PlanReady = lib.PlanReady
+	// `gates precheck` runs `check windows` through this hook for the same reason.
+	acceptance.WindowsCheck = lib.RunCheckWindows
 }
 
 // run is the testable entry point. It returns the process exit code.
@@ -151,6 +169,14 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return lib.RunRecall(root, args[1:], stdout, stderr)
 	case "context":
 		return lib.RunContext(root, args[1:], stdout, stderr)
+	case "candidate":
+		if len(args) > 1 && args[1] == "freeze" {
+			return lib.RunCandidateFreeze(root, args[2:], stdout, stderr)
+		}
+		fmt.Fprint(stderr, lib.CandidateFreezeUsage)
+		return exitUsage
+	case "packet":
+		return lib.RunPacket(root, args[1:], stdout, stderr)
 	case "metrics":
 		return lib.RunMetrics(root, args[1:], stdout, stderr)
 	case "dispatch":
@@ -162,7 +188,7 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	case "overhaul":
 		return overhaul.Run(args[1:], stdout, stderr)
 	case "state":
-		return cmdState(root, args[1:], stdout, stderr)
+		return cmdState(root, args[1:], stdin, stdout, stderr)
 	case "migrate":
 		return lib.Migrate(root, args[1:], stdout, stderr)
 	case "secret-scan":
@@ -194,6 +220,8 @@ func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Wri
 		return cmdCandidate(root, rest, stdout, stderr)
 	case "readiness", "seal":
 		return cmdGate(root, gate.Kind(sub), rest, stdout, stderr)
+	case "preconditions":
+		return acceptance.RunPreconditions(root, rest, stdout, stderr)
 	case "path-disjoint":
 		return parallel.Run("path-disjoint", rest, stdin, stdout, stderr)
 	case "task-graph":
@@ -214,6 +242,10 @@ func cmdCheck(root string, args []string, stdin io.Reader, stdout, stderr io.Wri
 		return lib.RunCheckDup(root, rest, stdout, stderr)
 	case "drift":
 		return lib.RunCheckDrift(root, rest, stdout, stderr)
+	case "anchors":
+		return lib.RunCheckAnchors(root, rest, stdout, stderr)
+	case "perturb":
+		return lib.RunCheckPerturb(root, rest, stdout, stderr)
 	default:
 		fmt.Fprintf(stderr, "devrites: unknown check %q\n", sub)
 		return exitUsage
@@ -238,11 +270,15 @@ func cmdCandidate(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "candidate: BLOCKED: %v\n", err)
 		return exitBlocked
 	}
+	if err := lib.CheckTreeBaseline(root, args[0]); err != nil {
+		fmt.Fprintf(stderr, "candidate: BLOCKED: %v\n", err)
+		return exitBlocked
+	}
 	fmt.Fprintf(stdout, "candidate-sha256: %s\ncandidate-files: %d\n", digest, files)
 	return exitOK
 }
 
-func cmdState(root string, args []string, stdout, stderr io.Writer) int {
+func cmdState(root string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
 		fmt.Fprint(stderr, stateUsage)
 		return exitUsage
@@ -254,6 +290,10 @@ func cmdState(root string, args []string, stdout, stderr io.Writer) int {
 		return lib.RunMergeManifest(root, args[1:], stdout, stderr)
 	case "apply-bundle":
 		return lib.RunApplyBundle(root, args[1:], stdout, stderr)
+	case "set":
+		return lib.RunStateSet(root, args[1:], stdout, stderr)
+	case "append":
+		return lib.RunStateAppend(root, args[1:], stdin, stdout, stderr)
 	case "close":
 		return lib.CloseOut(root, args[1:], stdout, stderr)
 	default:
@@ -294,21 +334,28 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		return exitBlocked
 	}
 	if kind == gate.Seal {
-		if err := lib.VerifyReleaseUnion(root, args[0]); err != nil {
-			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\nreason: %s\n", err, gate.ResultReasonID(kind, true))
+		// A later seal check can block after the gate passed; keep its notes
+		// (waived test drivers) visible on that NO-GO too.
+		sealBlocked := func() int {
+			for _, note := range result.Notes {
+				fmt.Fprintf(stdout, "note: %s\n", note)
+			}
+			fmt.Fprintf(stdout, "reason: %s\n", gate.ResultReasonID(kind, true))
 			return exitBlocked
 		}
+		if err := lib.VerifyReleaseUnion(root, args[0]); err != nil {
+			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\n", err)
+			return sealBlocked()
+		}
 		code := lib.EvidenceFresh(root, []string{args[0]}, stdout, stderr)
 		if code == exitUsage {
 			return exitUsage
 		}
 		if code != exitOK {
-			fmt.Fprintf(stdout, "reason: %s\n", gate.ResultReasonID(kind, true))
-			return exitBlocked
+			return sealBlocked()
 		}
 		if !notes.SealCheck(root, args[0], stdout) {
-			fmt.Fprintf(stdout, "reason: %s\n", gate.ResultReasonID(kind, true))
-			return exitBlocked
+			return sealBlocked()
 		}
 	}
 	fmt.Fprint(stdout, result.Render())

package/pack/.claude/agents/devrites-code-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-code-reviewer
 description: Reviews a full DevRites feature diff once for /rite-review and /rite-seal. Checks tests, correctness, readability, architecture, maintainability, and standards; returns every supported finding.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -48,7 +48,11 @@ diff scope. Read `spec.md` for the objective and acceptance criteria, then
 reports one over budget, index it (`grep -n`) and load only entries naming this
 candidate's AC/slice IDs. The principles are binding project invariants. Run `git diff`
 for the feature scope and read the touched files. No diff or an empty candidate →
-`Outcome: gap` naming it.
+`Outcome: gap` naming it. For blast radius, run `detect_changes` (explicit
+`base_branch` = feature base, `scope: "impact"`) and `trace_path` (`direction:
+"inbound"`) on impacted symbols that carry a finding, per
+`.claude/skills/devrites-lib/reference/standards/code-navigation.md`; check
+cited paths with `check_index_coverage`.
 
 A lane assignment (`code-reviewer.frontend` or `code-reviewer.backend`) names your
 lane, its path set, its profile, and the contracts crossing it: verdicts cover your
@@ -150,12 +154,12 @@ not as a blocker on this diff.
 Return the report in this shape:
 
 ```
-Code review (<slug>) — independent · lane: <frontend | backend | single: <domain>>
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
+Lane: <frontend | backend | single: <domain>>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Coverage: <files read fully | hunk-level | skipped: name — reason>
-Finding: <severity> conf <n> | <file:line> | <observed> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
+Finding: <severity> conf <n> | <file:line> | `<quoted cited line>` <observed result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 Contract: <applicable | not-applicable> — <basis: both sides read · crossing test>
 Tests: <adequate? gaps>

package/pack/.claude/agents/devrites-devex-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-devex-reviewer
 description: Reviews developer experience for one DevRites feature in fresh context. Predicts at /rite-vet and measures at /rite-seal for public APIs, CLIs, SDKs, libraries, webhooks, configuration, errors, and onboarding; reports where the next developer gets stuck.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -47,7 +47,8 @@ The available artifacts select one of two modes:
 You receive a feature slug or workspace path (`.devrites/work/<slug>/`) and the
 diff scope. Read `spec.md`, `plan.md`, `decisions.md`, `touched-files.md`, and
 `.devrites/principles.md` if present. Public API invariants in the principles file
-are binding. Read `devex.md` if present for predicted or measured scores, plus
+are binding. Find consumers of a changed public symbol with `trace_path`
+(`direction: "inbound"`) per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`. Read `devex.md` if present for predicted or measured scores, plus
 `evidence.md`, `browser-evidence.md`, and the root-supplied immutable diff for the
 measured run. Inspect the developer-facing files it
 touches, including route handlers, CLI entry points, exported signatures, README
@@ -105,9 +106,9 @@ consistently:
 Return the report in this shape:
 
 ```
-DevEx review (<slug>) — independent · mode: predict | measure
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
+Mode: <predict | measure>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Scorecard:
   discoverability   <band/score + one-line basis>

package/pack/.claude/agents/devrites-doubt-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-doubt-reviewer
 description: Stress-tests one claim or decision for the devrites-doubt loop from a fresh context. Tries to break the claim rather than validate it.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -30,7 +30,8 @@ attack, not support.
 A **claim** of one to three sentences and an **artifact + contract**, such as a
 function, decision, diff hunk, or interface. You may also receive a workspace path
 for `spec.md`, `decisions.md`, and the relevant `git diff`. Read only what you need
-to test the claim.
+to test the claim. Where a claim reaches: `trace_path` (`direction: "inbound"`) on its
+symbols, per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 When the claim concerns branching, boundary handling, or deletion, read
 `.claude/skills/devrites-lib/reference/standards/edge-case-trace.md` or its Codex
@@ -71,9 +72,8 @@ mirror.
 Return the report in this shape:
 
 ```
-Doubt review
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Claim: <restated>
 Attempts to break it: <what you tried>

package/pack/.claude/agents/devrites-evidence-scout.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-evidence-scout
 description: Answers one bounded evidence question for spec, clarify, converge, or external-fact work from a fresh, read-only context. Returns a cited dossier from live code, project records, installed source, or authoritative versioned documentation. Never asks the user, chooses scope, edits artifacts, or advances a phase.
-tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -27,7 +27,8 @@ Read only the paths and bounded question supplied by the orchestrator.
   versioned docs/standards. Cite URL or `path:line`, version, and for external sources
   the retrieval date (ISO).
 
-For structural questions, use the repository's code-intelligence index. Use exact
+For structural questions, use codebase-memory-mcp per the route table and coverage
+rule in `.claude/skills/devrites-lib/reference/standards/code-index.md`. Use exact
 sources, not recollection, and do not broaden the question.
 
 Report how things are today, not how the intended change should go. When the brief

package/pack/.claude/agents/devrites-frontend-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-frontend-reviewer
 description: Reviews one DevRites UI feature for /rite-seal from a fresh context. Checks UX flow, accessibility, responsive behavior, design-system alignment, and AI slop independently and adversarially.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 skills:
   - devrites-frontend-craft
 permissionMode: plan
@@ -36,7 +36,9 @@ catalog.
 In workspace `.devrites/work/<slug>/`, read `design-brief.md`,
 `polish-report.md`. Run `git diff` limited to `touched-files.md` paths, inspect the
 touched UI files, and check the
-project's tokens, shared components, and neighboring screens.
+project's tokens, shared components, and neighboring screens. Find consumers of a
+changed shared component with `trace_path` (`direction: "inbound"`) per
+`.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 ## Review
 Before the gate sweep, stamp a **pre-emit critique** over six axes — philosophy
@@ -107,9 +109,8 @@ draws a revision finding for variety 2.
 
 Return the report in this shape:
 ```
-Frontend review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Critique: <philosophy n · hierarchy n · execution n · specificity n · restraint n · variety n | n/a>
 System alignment: <drift by root cause>