devrites 6.9.6 → 7.0.0

package/pack/.claude/skills/devrites-browser-proof/reference/browser-performance.md

@@ -8,7 +8,8 @@ risk is visible. Detect existing tooling; do not install any.
    INP: record `not measured (no interaction)` unless a timespan or trace drives a
    named interaction ([`performance.md`](../../devrites-lib/reference/standards/performance.md)
    § Frontend).
-2. Playwright MCP: read LCP/CLS from the live page, and INP only after a scripted
+2. The driving rung (ego-lite `page.evaluate`, browser-harness JS eval, or Playwright MCP
+   `browser_evaluate`): read LCP/CLS from the live page, and INP only after a scripted
    interaction; label it `Trace (DevTools)`. Pair with Lighthouse when both are available.
 3. CrUX/PageSpeed Insights: only with a user-supplied key; label p75 data `Field
    (CrUX)`.

package/pack/.claude/skills/devrites-debug-recovery/SKILL.md

@@ -4,7 +4,7 @@ description: Fix application test, build, CI, runtime, browser, or 500 failures
 argument-hint: "[<slug>]"
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/workflow-artifacts.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-debug-recovery` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-debug-recovery: fix the root cause, not the symptom

package/pack/.claude/skills/devrites-doubt/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-doubt
 description: Stress-test one consequential decision independently. Use for uncertainty around boundaries, data, auth, APIs, or migrations; not trivial choices.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"security":["devrites-lib/reference/standards/security.md"],"tooling":["devrites-lib/reference/standards/tooling.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/agents.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"security":["devrites-lib/reference/standards/security.md"],"tooling":["devrites-lib/reference/standards/tooling.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md"]},"rootOnly":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/tooling.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-doubt` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-doubt: CLAIM → EXTRACT → DOUBT → RECONCILE → STOP
@@ -42,10 +42,10 @@ complexity reappears across N callers, the abstraction concentrates real complex
 Wait for a second real caller before keeping a pass-through that fails this test.
 
 ## Rules
-- For "where does this claim reach / what would change with it" questions, prefer a
-  code-intelligence index under [`tooling.md`](../devrites-lib/reference/standards/tooling.md): use the primary available index,
-  add at most one cross-check for a named incomplete/stale/conflicting predicate, then fall
-  back to LSP or file search. Do not query several indexes for reassurance.
+- For "where does this claim reach / what would change with it" questions (trigger
+  `tooling`), use codebase-memory `trace_path` (`direction: "inbound"`) per
+  [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md),
+  then fall back to LSP or file search. Do not repeat a query for reassurance.
 - The reviewer prompt must be adversarial: its job is to break the claim, not to agree.
 - Strip your own justification before review; reasoning anchors the reviewer toward
   agreement.

package/pack/.claude/skills/devrites-frontend-craft/reference/reuse-first.md

@@ -9,9 +9,9 @@ This applies to UI **and** non-UI code: utilities, helpers, types, validators, s
 formatters, hooks, query helpers: anything that might already exist.
 
 ## The decision (in order)
-1. **Search first.** Apply `../../devrites-lib/reference/standards/tooling.md`: use the
-   primary available code index to find similar definitions, cross-check only a named
-   unresolved predicate, then fall back to grep/glob over `components/`, design tokens, hooks/,
+1. **Search first.** Apply `../../devrites-lib/reference/standards/code-navigation.md`: find
+   similar definitions with codebase-memory `search_graph` (`semantic_query` plus
+   `name_pattern` variants), then fall back to grep/glob over `components/`, design tokens, hooks/,
    utils/, lib/. Look for things doing the *same job*, not just the same name.
 2. **Exact fit → REUSE.** Compose / import the existing thing. No copy, no fork.
 3. **Close fit → EXTEND.** Add a variant/prop/option that the existing component or util

package/pack/.claude/skills/devrites-interview/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-interview
 description: Interview the user one question at a time to extract intent. Use when the user says "interview me", "I am not sure what I want", or the ask is underspecified. Not for casual clarification.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-spec/reference/interview-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["spec.md","questions.md","decisions.md","assumptions.md","decision-coverage.md","state.md"]} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","rite-spec/reference/interview-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["spec.md","questions.md","decisions.md","assumptions.md","decision-coverage.md","state.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-interview` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-interview: extract intent

package/pack/.claude/skills/devrites-lib/SKILL.md

@@ -45,14 +45,16 @@ lifecycle state from chat or optional `README.md`.
 The engine is limited to:
 
 - Checks: `check candidate` (content-bound identity), `check readiness`
-  (structure; `--emit-binding` emits the Build-input binding), `check seal` (structure
+  (structure; `--emit-binding` emits the Build-input binding), `check
+  preconditions` (Vet preflight rows), `check seal` (structure
   plus exact artifact bindings and evidence freshness), `check slice` (slice
   contract preflight before wright dispatch), `check task-graph`, `check
   diff-scope` (mechanical changed-paths ⊆ allowlist before reviewer dispatch),
   `check path-disjoint`, `check skill-trust`, `check indexes`, `check
   regression` (progress high-water mark), `check drift` (readiness-input
   attribution), `check windows` (deferral-marker waivers), `check dup`
-  (advisory near-duplicates), `detect commands` (repository test/lint wiring).
+  (advisory near-duplicates), `check anchors` (Critical/Important quote
+  anchoring), `check perturb` (safe-perturbation probe), `detect commands` (repository test/lint wiring).
 - Observation: `observe summary` (`orient` alias), `observe slice`, `next`
   (minimal remaining lifecycle path), `handoff` (deterministic resume record).
 - Coordination: `context` emits one deduplicated read-set bundle from each
@@ -71,17 +73,20 @@ The engine is limited to:
   principles presence); confirm them rather than re-deriving conditions. Repeat
   calls with unchanged inputs print `unchanged` and reuse the existing bundle.
   `dispatch` owns the launch-wave barrier — seal needs a distinct handle per
-  role, return needs seal, and start/return auto-record into the `metrics`
-  ledger. `claim` owns the advisory session-scoped `claims.jsonl` ledger;
+  role (the last start seals), return needs seal, open --claim-session/--claim
+  takes the wave's file claim (released by the completing return or abandon
+  --release), and start/return auto-record into the `metrics` ledger;
+  `candidate freeze` and `packet` write a wave's frozen diff and packets. `claim` owns the advisory session-scoped `claims.jsonl` ledger;
   `note` owns anchored `notes.md` entries (`check seal` refuses non-exact
   anchors); `parallel` owns deterministic worktree lease/create/integrate/
   cleanup for parallel slices.
 - `gates` owns the machine-checked acceptance ledger (`gates.md`): `scaffold`,
-  `status`, `run`, `reverify`, `lint`, `attest`, `abandon` — grammar and
+  `status`, `run`, `reverify`, `lint`, `precheck`, `attest`, `abandon` — grammar and
   authoring rules in
   [`reference/standards/gates.md`](reference/standards/gates.md).
 - Atomic state: `state resolve` for answer/drop/batch, `state merge-manifest`
-  for the predecessor-chain union, transactional `state close`, and `migrate`
+  for the predecessor-chain union, `state set`/`state append` for cursor fields and
+  ledger sections, transactional `state close`, and `migrate`
   for fail-closed workspace-schema normalization.
 - `secret-scan`, `open-visual`, and `version` remain read-only helpers.
 - Offline, local `install`, `update`, and `uninstall`; their shell/npm callers

package/pack/.claude/skills/devrites-lib/reference/orchestration-profiles.md

@@ -1,5 +1,7 @@
 # Native execution profiles
 
+> Root-only: not inlined in --role bundles.
+
 Profiles scale **change depth**, not orchestration machinery. The host discovers
 the exact project specialist named by a workflow, dispatches it in fresh context,
 waits for the result, validates the result shape, and reconciles the evidence.

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -1,5 +1,7 @@
 # Native review dispatch
 
+> Root-only: not inlined in --role bundles.
+
 Host dispatch; DevRites governs.
 
 ## Roster
@@ -27,7 +29,9 @@ If the candidate diff has no matching surfaces, record
 
 ## Dispatch contract
 
-1. Freeze one candidate; give each reviewer the same spec, paths, and diff.
+1. Freeze one candidate with `devrites-engine candidate freeze <slug> --wave <w>
+   (--slice <SLICE-ID> | --paths <path>...) [--base <ref>]` (writes
+   `packets/<w>.diff` and `packets/<w>.sha256`); give each reviewer the same spec, paths, and diff.
    Parallelize only when writes/state/locks/tool sessions/scarce resources
    (ports/processes/quotas/FDs/browsers/MCP) are compatible. Frozen read-only
    usually is; pressure requires batches or serial work.
@@ -37,8 +41,10 @@ If the candidate diff has no matching surfaces, record
    still validate each result's context and candidate.
 2. Build each reviewer's read-set once with
    `devrites-engine context <slug> --phase <p> --role <role> --trigger <set>` and
-   hand the bundle path as the packet's source list instead of a file roster.
-   Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
+   render each reviewer, auditor, and test-analyst packet (other roles, such as
+   `proof-runner`, keep their own) with `devrites-engine packet <slug> --wave <w> --phase <p>
+   --role <role> [--slice <SLICE-ID>] [--focus <file>]`: it names the bundle and frozen
+   diff by reference, copies the digests, and runs the `open` lints. Build roles add `--slice <SLICE-ID>` (slice-scoped, slice-named bundle).
    Evaluate the skill's trigger conditions and pass each that fires — a role's
    Trigger column maps to the phase manifest's names: `security-auditor` →
    `security`; at Review, `frontend-reviewer` → `ui` and `performance-reviewer` →
@@ -48,21 +54,25 @@ If the candidate diff has no matching surfaces, record
    omitted applicable trigger is a gap, not a shortcut.
 3. Enforce the launch barrier through the engine, not prose. Open the wave
    (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`;
-   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, the exact packet
-   those agents receive, and `open` refuses one that seeds a gate result, outcome,
-   count, or "already passed" claim; at Review and Seal it also needs the packet to
-   name the frozen candidate diff and the manifest to cover every checkpointed path), launch every native agent nonblocking through the host's own agent
+   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, any one of the
+   wave's rendered `packets/<w>.<role>.md` (hand each agent its own file unedited), and `open` refuses one that seeds a gate result, outcome,
+   count, or "already passed" claim; a Build reviewer wave adds `--slice <SLICE-ID>`
+   so its findings key on that slice; at Review and Seal it also needs the packet to
+   name the frozen candidate diff and the manifest to cover every checkpointed path;
+   a same-tree writer wave adds `--claim-session <id> --claim <path>...` per
+   [`wright-dispatch.md`](../../rite-build/reference/wright-dispatch.md#run)), launch every native agent nonblocking through the host's own agent
    tool (never a shell-launched host CLI such as `omp -p` or `claude -p`: that is a
    dispatch bridge, its PID handle dies with the session, and its return is a `gap`),
    record each returned host handle
-   (`dispatch ... start --wave <w> --role <r> --handle <id>`), then `seal` —
-   seal fails until every declared role has a distinct handle, which makes a
+   (`dispatch ... start --wave <w> --role <r> --handle <id>`) — the last start
+   seals the wave (an explicit `seal` is a no-op), which makes a
    serial launch-then-wait pattern impossible to record. Record each completion
-   with `dispatch ... return`; `return` refuses before seal. `dispatch status`
+   with `dispatch ... return`; a reviewer adds `--result <file>` holding its return verbatim (the engine stores it as `packets/<wave>-<role>.return.md`, derives the outcome from its head, and records its `Finding:` keys; a file already at that path is kept), or `--outcome <findings|no-findings|gap>` when the host cannot hand the return over as a file; `return` refuses before seal. `dispatch status`
    exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
    auto-record the dispatch/return metrics events — no separate ledger call. If
    an opened wave cannot obtain every handle or reach `seal`, run
-   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` before
+   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` (with
+   `--release` on a host-confirmed stop or refused launch) before
    recording the gap; never leave an open wave to block a retry.
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
@@ -142,13 +152,14 @@ session, the claim proof below settles it. A result classification alone
 does not prove host termination.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
-status`, `parallel status`, and `claim list --all` before any dispatch. A read-only
+status`, `parallel status`, and `claim list` before any dispatch. A read-only
 wave whose handles this session cannot query: `abandon` it, record each unreturned
 role `gap`, and re-dispatch fresh on the current digest; its late returns are
 `stale`. A writer keeps its claim and lease — no relaunch on those paths until the
 claim is released or its holder is proven terminal. For an unqueryable writer,
-`claim list --all` showing its claim `released` or `dead` (the engine proved the
-holding session exited on this host) is that proof: `abandon` the wave, record the
+`claim list` showing its claim `dead` (the engine proved the holding session
+exited on this host), or `claim list --all --session <id>` showing it `released`
+(bare `list` only counts released rows), is that proof: `abandon` the wave, record the
 role `gap`, claim the paths, and re-dispatch without waiting on the launching
 session. `live` or `expired` stays held. A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch

package/pack/.claude/skills/devrites-lib/reference/standards/README.md

@@ -47,7 +47,8 @@ topic's owner.
 | `afk-hitl.md` | A pause, question, resume, or AFK decision is possible. |
 | `one-shot-actions.md` | A failed proof/action would spend paid or rate-limited quota, mutate external state, or delete its own failure evidence. |
 | `tooling.md` | Structural lookup, current external facts, or architecture memory is needed. |
-| `code-navigation.md` | Choosing graph, LSP, grep, or read routes before cross-file edits. |
+| `code-navigation.md` | Editing across files or claiming a blast radius: affected set, enclosing-body reads, fresh diagnostics, static-graph blind spots. |
+| `code-index.md` | Choosing graph, LSP, grep, or read routes: index preflight, route table, coverage, query budget, host access. |
 | `skill-authoring.md` | Creating, editing, routing, evaluating, or pruning a DevRites skill. |
 | `definition-of-done.md` | Prove, Seal, Ship, or Quick must decide whether work is finished. |
 | `review-checklist.md` | A compact review pass/fail sweep is enough. |

package/pack/.claude/skills/devrites-lib/reference/standards/afk-hitl.md

@@ -1,5 +1,7 @@
 # AFK & HITL: the pause/resume contract
 
+> Root-only: not inlined in --role bundles.
+
 > Applies when: any rite/devrites skill that can pause for a human or run unattended; irreversible-risk list, budgets, recovery accounting.
 
 Defines two modes for `rite-*`/`devrites-*` skills that may pause; main
@@ -211,6 +213,9 @@ Wherever a gap, checkpoint, or non-trivial decision surfaces (`/rite-spec`, `/ri
   sequential packets, then obtain final confirmation. Materially distinct options MUST NOT
   be silently dropped, merged, or preselected to fit the UI.
 - Recommend for project conventions, stack, scale, and domain, not a generic default.
+- **One visit per decision chain.** Ask the follow-ups an answer predictably triggers (a
+  dependency's lock lines, a rerun after a failed measurement) in the same entry or one
+  `--batch`; each link asked alone costs one human wait.
 
 **HITL** renders the set via `AskUserQuestion`; the human's pick resolves the gate **in place**.
 **AFK** auto-picks option 1 for gates it may auto-handle. Record the chosen option verbatim and
@@ -271,8 +276,8 @@ options: |                                    # ranked option set; recommended F
   1. <recommended> (Recommended) — logic: … · infra: … · business: … · architecture: …
   2. <alternative> — <dimension-tagged rationale + trade-off>
   3. Something else — describe it
-proposed: <the recommended option restated — the HITL default + the AFK auto-pick>
-raised_at: <iso>
+proposed: <the recommended option restated — the HITL default + the AFK auto-pick; omit with no (Recommended)>
+raised_at: <full RFC 3339 timestamp, e.g. 2026-10-19T08:17:08Z>
 answered_at: <iso, when status flips off "open">
 answer: <chosen option (or human's verbatim reply / drop reason)>
 answered_by: human                            # only when a human resolved it (`state resolve --human`)
@@ -280,6 +285,8 @@ answered_by: human                            # only when a human resolved it (`
 
 Rules:
 - `NNN` is sequential per date: the next-available 3-digit integer.
+- `state append` refuses a new open entry that breaks this schema (2-4 options plus the escape
+  hatch, `(Recommended)` only on option 1); length is advisory.
 - `status: open` is the only state `/rite-resolve` can mutate; `answered` and `dropped`
   are terminal.
 - `answered_by: human` is written only by `state resolve --human`. HITL live picks and `/rite-resolve`
@@ -295,7 +302,8 @@ boundary owns any such request and requires explicit user approval.
 ## `state.md` `Awaiting human` block
 
 When a HITL gate fires, `/rite-build` sets cursor `status` to `awaiting_human` and
-`next_action` to `/rite-resolve <qid> "<answer>"`, then writes the `Awaiting human` table
+`next_action` to `/rite-resolve <qid> "<answer>"` via `devrites-engine state set` (under AFK
+it names questions the sentinel auto-picks: resolve those unless irreversible-risk), then writes the `Awaiting human` table
 (`question_id`, `gate`, `blocking_slices`) owned by
 [`state-workspace.md`](../../../rite-spec/reference/state-workspace.md#statemd-template) § state.md template.
 The question text, `proposed` answer, and `raised_at` live in the `questions.md` entry.

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -6,11 +6,14 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 
 ## Authority
 
+<!-- root-only -->
 - Root owns scope, questions/decisions/results, `.devrites/**`, phase transitions — not product source/tests; vetted executable workflow artifacts follow [`workflow-artifacts.md`](workflow-artifacts.md).
-- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Every named role runs; unavailable → HITL, never skip/substitute.
+<!-- /root-only -->
+- Only bounded wright writes product source/tests; others inspect an immutable candidate.
 - Leaves never invoke agents, ask humans, change phase, push, install/deploy, migrate live data, or act irreversibly; they return evidence/proposals for root acceptance. Sole exception: one local unpushed transfer commit by an eligible native-worktree `devrites-slice-wright` — transport, not shipping authority or a checkpoint.
 
+<!-- root-only -->
 ## Agents
 
 | Agent |
@@ -34,7 +37,9 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 | `devrites-slice-wright` |
 
 Files own briefs; [`parallel-dispatch.md`](../parallel-dispatch.md) owns rosters.
+<!-- /root-only -->
 
+<!-- root-only -->
 ## Native invocation
 
 Skills name exact fresh roles, omit native fields;
@@ -47,6 +52,7 @@ dispatch <slug> open|start|seal|return` (a solo dispatch is a wave of one;
 start/return auto-record metrics). Without a workspace the plain host dispatch
 contract above applies and no engine tracking is required.
 Workflow-named skills (e.g. devrites-source-driven) are invoked inline in the root context, never dispatched as agents.
+<!-- /root-only -->
 
 ## Source-writing boundary
 
@@ -59,22 +65,24 @@ Each job gets objective/exclusions, exact paths/immutable candidate, rubric/resu
 **Same-tree concurrent sessions claim first.** Worktree dispatch isolates
 parallel batch siblings, but two agent *sessions* (two hosts, two features, or
 a human plus an agent) can share one working tree. Before a same-tree writer
-starts, it records an advisory claim — `devrites-engine claim add --session
-<id> <paths>` — retains the returned `<claim-id>`, then checks the same paths
-with `devrites-engine claim check --session <id> <paths>`; a held claim from a
+starts, its `dispatch open` records an advisory claim with `--claim-session <id>
+--claim <path>...` and fails, creating no wave, while a live foreign session holds
+a path (without a wave: `claim add --session <id> <paths>`, keep its `<claim-id>`,
+then `claim check`); a held claim from a
 live foreign session is never merged later or overridden. Unattended, skip only
-work that needs those paths, run independent work, and re-check `claim list --all`
-before stopping; stop and report the holder only when nothing independent remains. On every
-host-confirmed terminal path after `add` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)) — return,
-rejected result, stop, or a launch refused with no handle — run
+work that needs those paths, run independent work, and re-check `claim list`
+before stopping; stop and report the holder only when nothing independent remains.
+On every host-confirmed terminal path after `add` or a claimed `dispatch open` ([unknown outcomes keep it](../parallel-dispatch.md#cancellation-and-terminal-reconciliation)),
+the wave's completing `return` releases its claim, `dispatch abandon --release`
+releases it on any other (a stop or a refused launch), and a `claim add` claim runs
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
 Claims cover product paths only; root-authored `.devrites/**` files use
 [`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
-Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
+Expiry is not proof the holder stopped: size `--claim-ttl` or `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
-read `claim list --all` — a foreign `expired` claim on overlapping paths whose
+read `claim list` — a foreign `expired` claim on overlapping paths whose
 session is not proven terminal counts as held (stop and report). `dead` (engine-proven
 exited holder) or `released` is terminal: reconcile per
 [§ Cancellation](../parallel-dispatch.md#cancellation-and-terminal-reconciliation). **Failing case:**
@@ -102,22 +110,25 @@ Each required reviewer/analyst/auditor starts with exactly one:
 
 ```text
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
-Finding: <severity> conf <n> | <file:line or artifact section> | <observed quote/result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
+Finding: <severity> conf <n> | <file:line or artifact section> | `<quoted cited line>` <observed result> | when <input/state/sequence> → <effect> | breaks <ID or standard §> "<quoted line>" | <minimum fix>
 Basis: <files read · commands run to reach this finding>
 ```
 
 - **`findings`:** each row uses the shape above; confidence 1–10 on Critical/Important.
   Critical/Important requires 7+, exact evidence, concrete impact, and a non-empty
   `Basis` — a correct verdict reached by an unrecorded inspection path is unproven.
-  A Critical/Important row carries `conf <n>` in its severity cell and writes impact
-  as `when <input/state/sequence> → <effect>`; missing either, root admits it as
+  A Critical/Important row carries `conf <n>` in its severity cell, opens its observed
+  cell with the cited line's quote in backticks, and writes impact
+  as `when <input/state/sequence> → <effect>`; missing conf or trigger, root admits it as
   `Unverified: <claim> — missing trigger` (stays `gap`).
 - **Proportionality:** a Critical/Important row's `breaks` quotes the line it violates:
   a spec ID (`AC`/`REQ`/`INV`/`PROH`/`DEC`/`EDGE`) or a shipped standard rule
   (`<standard>.md § <section>`: security, regression, principles). Root anchors the
-  quote like the `file:line` quote. A repair contract, recheck packet or earlier
-  finding only restates a prior claim and is never an anchor. No anchor, or one
+  quote like the `file:line` quote. A repair contract, recheck packet, earlier
+  finding or plan item (`plan.md`, `tasks.md`, `architecture.md`, `test-plan.md`)
+  only restates root's own claim and is never an anchor; quote the spec ID or
+  standard rule it traces to. No anchor, or one
   the defect does not break,
   admits the row as Suggestion logged `Deferred: <claim> — no spec anchor` for an
   optional follow-up slice; it never drives a repair round. Hardening no spec line
@@ -147,10 +158,12 @@ Basis: <files read · commands run to reach this finding>
   and `/rite-doctor`. Never design capture or retention machinery around it.
 
 Root treats results as claims; verifies proposed Critical/Important blockers
-against candidate, first anchoring each row's quote at its cited `file:line` on the
-frozen digest: exact → admit; found at exactly one other location → relocate,
+against candidate, first running `devrites-engine check anchors <slug> <return-file>`,
+which anchors each row's quote at its cited `file:line` on the live candidate and its
+`breaks` quote, and prints the digest root confirms equals the reviewed packet's: exact → admit; found at exactly one other location → relocate,
 keeping both locations; not found or found at several → `Unverified: <claim> —
-anchor lost|ambiguous`, a gap that is never a finding or a dismissal. A leaf result
+anchor lost|ambiguous`, a gap that is never a finding, a dismissal or a repair-round
+input (exit 3). A leaf result
 produced by spawning a nested agent is `gap`, and each hidden child counts toward
 the concurrent pool and `max_agents`. Missing fields become
 `Unverified: <claim> — missing <proof>` and stay `gap` until verified/rejected
@@ -167,6 +180,15 @@ return is the bundle the root writes) and the wright's change evidence.
 
 - Lead with the result line (`Outcome:` for reviewers, the role's own status line
   otherwise), then `Counts:` with the number of rows per severity or kind.
+- A reviewer, auditor or test-analyst head is strict: line 1 is
+  `Outcome: findings|no-findings|gap` (no title line above it), line 2 is
+  `Counts: key=N ...` with keys from the role's closed vocabulary:
+  `critical important suggestion nit fyi gap`, plus `contract mechanism` for
+  `devrites-plan-reviewer`, only `suggestion nit fyi gap` for
+  `devrites-simplifier-reviewer`. `findings` needs a non-`gap` count above 0;
+  `no-findings` needs every count at 0. `dispatch return --result <file>` stores
+  the return and records a malformed or inconsistent head as `gap`, never
+  `no-findings`.
 - No restated task, preamble, approach narrative or closing summary. An optional
   `Notes:` block carries at most five lines that no row can hold.
 - Point, don't paste: cite `file:line` with at most one quoted line (160
@@ -177,6 +199,7 @@ return is the bundle the root writes) and the wright's change evidence.
   never rewrites, merges or summarizes a row; deduplication references rows by
   position or ID instead of rewording them.
 
+<!-- root-only -->
 ## Reconciliation
 
 Root rejects stale/out-of-scope work, dedupes by root cause, records
@@ -189,3 +212,4 @@ Route defects before correction: product/acceptance → Spec Drift Guard/Clarify
 architecture/slicing/proof → Plan/Vet; source/test → wright;
 external/pre-existing → blocker/defer. Never patch downstream to hide an upstream
 defect.
+<!-- /root-only -->

package/pack/.claude/skills/devrites-lib/reference/standards/architecture-health.md

@@ -11,7 +11,7 @@ and never substitutes for review.
 ## When to measure
 
 Compute a score only when a code index covers the repo (see
-[`code-navigation.md`](code-navigation.md) § Index freshness). With no index,
+[`code-index.md`](code-index.md) § Preflight). With no index,
 report `unmeasured` — a placeholder number presented as a measurement is a
 false pass. **Failing case:** an audit reports "health: 100/100" on a repo the
 instrument could not parse.

package/pack/.claude/skills/devrites-lib/reference/standards/code-index.md

@@ -0,0 +1,111 @@
+# Code index
+
+> Root-only: not inlined in --role bundles.
+
+> Applies when: choosing structural search tools (code index vs grep) before exploring.
+
+Decision tree for structural questions. Load with [`tooling.md`](tooling.md);
+this file is the pack-canonical routing table agents cite in Build, Vet, and
+Review. Edit-safety rules that hold with or without an index live in
+[`code-navigation.md`](code-navigation.md). The one supported code index is
+**codebase-memory-mcp**. Every call takes `project`: pass the absolute
+repository root (it resolves to the indexed project that contains it); never
+guess a project name.
+
+## Preflight
+
+Once per agent, before the first structural claim:
+
+1. `index_status` (`project` = repo root). An error or "not indexed" means no
+   index. The **root** session may run `index_repository` once (`repo_path` =
+   repo root, default mode, never `persistence: true`, which writes
+   `.codebase-memory/` into the repo), then re-check. A subagent never indexes:
+   it records `index: unavailable` and uses the fallback column.
+2. `status: ready` only means the graph has nodes; it is not freshness. When
+   the response carries `watch.watched: true`, auto-sync keeps it current.
+   Otherwise, if files changed after `indexed_at`, the root may re-run
+   `index_repository`; everyone else relies on the coverage check below.
+
+## Route by question
+
+| Question | First call | Fallback |
+| --- | --- | --- |
+| Orient in an area, architecture | `get_architecture` (`aspects: ["overview"]`, `path`) | Glob + targeted `Read` |
+| Where is X | `search_graph` (`name_pattern` regex, or BM25 `query`) | Grep |
+| Does a similar implementation already exist? | `search_graph` with `semantic_query: [purpose words]`, then `name_pattern` variants | Grep on purpose-words |
+| Callers, callees, call paths across files | `search_graph` for the exact name, then `trace_path` (`direction` `inbound`/`outbound`/`both`, `depth` 1-3) | LSP references + Grep |
+| Which tests reach a symbol | `trace_path` (`direction: "inbound"`, `include_tests: true`); direct tests: `query_graph` on `TESTS` edges | Grep test files for the name |
+| Value/taint flow | `trace_path` (`mode: "data_flow"`), then read each hop ([`tooling.md`](tooling.md) route table) | `cannot_verify` |
+| Blast radius of a diff | `detect_changes` (`base_branch` = feature base, always explicit; `scope: "impact"`, `depth: 2`) | `git diff --name-only` + `trace_path` per changed symbol |
+| Exact symbol body before edit | `get_code_snippet` (`qualified_name` from `search_graph`) | Targeted `Read` |
+| File outline | `get_file_outline` | `Read` |
+| Multi-hop structure | `query_graph` (read-only Cypher, always with `LIMIT`) | Split into `trace_path` calls |
+| Rename, references, diagnostics | LSP (`lsp` rename/references) when available | `trace_path` + Grep |
+| Known file, one-line fix | `Read` at offset/limit | — |
+| Literal string, config value, non-code file | `Grep` | — |
+
+Exact values matter: an unknown `mode` silently becomes `calls`, and an
+unknown `detect_changes` `scope` silently returns files only. `semantic_query`
+is an array, cannot combine with `query`, and needs a `full`/`moderate` index.
+`detect_changes` covers commits since the merge base plus unstaged, staged, and
+untracked files; `scope: "tests"` exists only from v0.12. Results page: check
+`has_more` and continue with `offset`/`cursor`.
+
+## Coverage before citing
+
+After the candidate paths are known, call `check_index_coverage` once with every
+path the claim relies on (`paths`, max 128), plus `scopes` for negative or
+exhaustive claims ("no other callers", "dead"). `no_recorded_issue` is best
+effort, not proof. For `freshness` other than `metadata_match`, or `status`
+`partial`/`excluded`/`skipped`/`coverage_unavailable`, read or grep those files
+directly and qualify the claim.
+
+## Query budget
+
+Spend the minimum that settles the question:
+
+- Minimal output first — pass the smallest detail/scope option a tool offers;
+  escalate to a fuller answer only when the minimal one cannot decide.
+- One structural question ≈ five index calls. The sixth means the question needs
+  re-scoping or a file read, not another query.
+- Stop at sufficiency: an index answer that names the symbols and their source
+  ends the search; re-verifying it with grep is waste, not diligence.
+
+## Index location
+
+The index lives in the server's store (`~/.cache/codebase-memory-mcp`, or
+`$CBM_CACHE_DIR`), not in the repository. `devrites-engine check indexes` only
+detects an in-repo `.codebase-memory/` artifact; `index_status` is
+authoritative.
+
+## Tool availability
+
+- **MCP:** Claude hosts expose `mcp__codebase-memory-mcp__<tool>` (allowlisted
+  in `.claude/settings.json` and agent `tools:` lines). omp subagents and
+  Codex children inherit every MCP server of the parent session (omp names
+  the tools `mcp__codebase_memory_mcp_<tool>`; a Codex agent file cannot add
+  servers). Generated Pi agents list none: pi-subagents fails a child whose
+  `tools:` names a tool it cannot load. A missing server offers no tools — use
+  the fallback column.
+- **CLI** when the host exposes no MCP tools (e.g. Devin agents via `exec`,
+  Pi agents via `bash`):
+  `codebase-memory-mcp cli <tool> --project <repo root> --format json` with
+  kebab-case flags (`--function-name X --direction inbound --include-tests`);
+  repeat a flag for array values. Exit 1 means the tool returned an error.
+- **Read-only sandbox** or no tool route at all: the CLI cannot run in a
+  read-only sandbox (it writes daemon locks outside the workspace). Use
+  **parent handoff**: the root runs the queries and puts the
+  project, each query, its raw rows, cited paths, and coverage status in the
+  dispatch packet. Raw query output is input, like a diff; never add the root's
+  interpretation ([`agents.md`](agents.md) seeding rule). A child whose packet
+  lacks what it needs returns the exact query for the root to run instead of
+  guessing.
+- Forbidden index calls are listed in
+  [`code-navigation.md`](code-navigation.md) § Anti-patterns.
+
+## Anti-patterns
+
+- Duplicate graph queries for reassurance.
+- Whole-file reads when `get_code_snippet` or `get_file_outline` suffices.
+- `trace_path` on a guessed name instead of the exact name from `search_graph`.
+- Citing a graph result without `check_index_coverage` on the cited paths.