devrites 7.0.17 → 7.1.0

package/pack/.claude/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,25 @@ One contract builds one slice: preserve TDD, exact paths and independent judgmen
 ## Proof tiers
 
 With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and every
-other row; feature gates run once per parallel landing, on control, while worktree
-wrights continue. The next landing and Prove wait for them; red is a fingerprint
-against slices landed since the last green run. Serial same-worktree mode, and plans
+other row; feature gates run once per landing train, on control, while worktree
+wrights continue: land every green sibling together, run the suite once, and bisect only
+on red. The next train and Prove wait for them; red is a fingerprint against slices
+landed since the last green run. Serial same-worktree mode, and plans
 without the section, run every row each round. Run gate, benchmark and proof commands
 through the host's shell tool, never a code-evaluation subprocess, whose environment
 can lack the owner's exported variables.
 
+Wrights run only the tests their changed paths reach, resolved from the merge base
+against the plan's baseline rather than the last commit; Prove and Seal always run the
+full suite. Resolve that narrow set with
+`devrites-engine check affected <changed path...>`, which expands a changed package to its
+dependent packages and widens on its own when a path is a module manifest, a generated
+artifact, CI config, shared testdata, or one it cannot classify. Widen to the full suite
+inside Build the moment a slice touches `go.mod` or a
+lockfile, generated artifacts, CI config, a shared test harness, or whenever no test can
+be named for a changed path. When selection is uncertain, run the full suite: the narrow
+set is an optimisation, never a substitute.
+
 ## Independent Build review
 
 After inspection, freeze full slice scope and cumulative baseline diff with

package/pack/.claude/skills/rite-define/SKILL.md

@@ -175,9 +175,11 @@ Pull these via `Read` when shaping the plan:
    buildable AC/REQ maps to an existing slice/proof, every slice maps to real
    acceptance, and names/prose agree. Missing, duplicate, contradictory, or
    meaning-changing mappings block. Then run
-   `devrites-engine check task-graph <slug>`; a malformed dependency graph blocks
+   `devrites-engine check task-graph <slug> --strict`; a malformed dependency graph, or a
+   shared path written by `hubAdvisoryMin`+ slices with no `Serial rationale:`, blocks
    before Vet rather than spending a reviewer context on invalid tasks. Resolve each
-   `ADVISORY size:`/`hub:` line now (split or seam slice, or a rationale); never blocking.
+   `ADVISORY size:`/`hub:`/`chain:` line now (split or seam slice, or a rationale);
+   `--strict` refuses the contended plan, the default run only advises.
 7. **Readiness gate** (`plan-template.md`): require CLEAR coverage; complete acceptance,
    wiring, shared-contract proof, applicable outputs, and rollback; risk-first acyclic order;
    justified deviations; and every horizon item present, with blockers resolved, planning

package/pack/.claude/skills/rite-plan/reference/slicing.md

@@ -172,8 +172,12 @@ cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.
 
 Slices sharing a file never build side by side: put a hub file's shared edit
 (registry, command table, test harness) in one seam slice the others depend on.
-`check task-graph` prints the `schedule:` and `ADVISORY hub:` lines; inseparable
-writes get `Serial rationale: <why>`. Never merge slices or drop acceptance to widen it.
+`check task-graph` prints the `schedule:`, `ADVISORY hub:` and `ADVISORY chain:` lines.
+A `chain` line means only one slice was ever ready, so the DAG rather than the cap
+serializes: cut a slice that stands alone, or record `Serial rationale: <why>`.
+`check task-graph <slug> --strict` refuses a plan whose shared path carries `ADVISORY hub:`
+writers, so a contended plan must split disjointly instead of widening the cap.
+Never merge slices or drop acceptance to widen it.
 
 ## Deferred slice
 A slice with `Satisfies: none` is an optional follow-up: plan-invented hardening or

package/pack/generated/claude/agents/devrites-upgrade-planner.md

@@ -23,7 +23,8 @@ Read named paths only. Accept released v1/v2 bullet or v3 table `state.md` under
 `.devrites/work/<slug>/`. Reject aliases, release scripts/markers, and conversion.
 
 Cite current rule plus workspace evidence for each applicable axis: cursor/topology,
-phase artifacts, decisions, planning/traceability/proof, built-code/intent, protected
+phase artifacts, decisions, planning/traceability/proof (including a `check task-graph`
+`ADVISORY chain:` schedule that no parallel cap can widen), built-code/intent, protected
 history, artifact budgets/feature ceiling (the supplied `devrites-engine orient`
 `artifact_budgets`/`bulk_files` and `task_graph.slice_count` against
 [`workspace-artifact-schema.md`](../skills/devrites-lib/reference/workspace-artifact-schema.md) and [`slicing.md`](../skills/rite-plan/reference/slicing.md) § Feature ceiling),

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -118,13 +118,13 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Build runs the path-disjoint batch `parallel select --from-plan` picks (cap: this invocation's
-   `--parallel N`, else sentinel `max_parallel`, else 10) and refills a slot
-   per landing until no pending slice remains; a one-slice round is serial for that round only, then
-   selection runs again (host isolation still forces serial when concurrent writers
-   cannot be separated). When `--parallel N`
-   is present, pass it into `/rite-build` and do not consult leftover sentinel
-   `max_parallel`.
+   Build uses `parallel select --from-plan` (cap: explicit `--parallel N`, else
+   sentinel `max_parallel`, else 10), refilling per landing until none pending;
+   a one-slice round is serial for that round only; reselect afterward. Host
+   isolation may force serial. If `--parallel N` is explicit,
+   pass it into `/rite-build` and ignore leftover sentinel `max_parallel`.
+   Otherwise pass the resolved sentinel/default cap into `/rite-build` as
+   `--parallel N`, never bare `/rite-build`.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/claude/skills/rite-build/SKILL.md

@@ -14,7 +14,7 @@ user-invocable: true
 HITL stops; a later user invocation starts the next slice.
 Explicit `.devrites/AFK` alone lets the controlling root chain under green proof,
 caps and pause rules. Every wright returns after one slice.
-**Opt-in:** `/rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
+**HITL:** `/rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
@@ -45,8 +45,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 
 ## Invariants
 
-- Default: one slice; writers serial on control (core.md #5). Parallel only via
-  `--parallel N` under [`reference/parallel-batch.md`](reference/parallel-batch.md).
+- Standalone HITL default: serial on control (core.md #5). AFK/`--parallel N`
+  uses [`parallel-batch.md`](reference/parallel-batch.md).
   Same-worktree multi-writer / root-emulated concurrency forbidden.
   Native-worktree pilot = single-slice isolation when `wright-dispatch.md`
   preflight + reconcile hold.
@@ -80,7 +80,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
+HITL default/explicit `1` ≡ serial; AFK inherits cap.
+`2`–`10` is a **cap** — the root runs an eligible
 path-disjoint set it can start now (`N_eff`, from `parallel select --from-plan`), takes fewer when the cap cannot be
 filled, and refills a slot per landing (serial slice or one sibling) until
 no pending slice remains

package/pack/generated/claude/skills/rite-build/reference/parallel-batch.md

@@ -37,13 +37,15 @@ Select **greedily in plan order** with
 reads the ready set (tasks.md dependencies checked `built` in `state.md`, minus
 running-lease slices) and each slice's Writer allowlist (else `Files likely
 touched`), plus its manifest/lockfile when `External dependencies:` is not none;
-in Build, `next` prints the same `eligible_now:`/`batch:`. `N_eff ≥ 2` → parallel batch;
-`N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
-is normal: take fewer. Serial is this round's size, not the rest of the run.
+`next` prints `eligible_now:`/`batch:`. `n_eff` counts new picks only.
+With a running lease, a single new pick still uses `parallel add`;
+`n_eff=0` with a running lease waits for siblings, not Prove. Without one:
+≥2 → parallel batch, 1 → serial, none pending → Prove.
+Serial is this round only; a cap need not be filled.
 
 **Refill per landing; never wait for the batch.** Each sibling lands alone when
-green ([Lifecycle](#lifecycle) step 6). Then re-read `state.md`, pending slices, and
-the tree and run `parallel select --slug <slug> --cap N --from-plan`: unlanded siblings hold
+green ([Lifecycle](#lifecycle) step 6). Re-read state, pending slices, and the
+tree; reselect: unlanded siblings hold
 their slots and paths, landed ones count as built, and only new picks print;
 `parallel add` starts each from the control tip and its wright dispatches at once.
 No lease → plain `select` + `create`. AFK/autocomplete is one run; HITL stops after
@@ -116,6 +118,10 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
+
+   A recheck round is one dispatch per changed surface, not one per checklist: the
+   recheck agent carries every open checklist (code, test, doubt) for that diff and
+   answers each by name. Merging cuts dispatches; dropping a checklist does not.
    Reviewer fan-out for a batch is itself batched under
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
    (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
@@ -137,11 +143,11 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 7. Each landing: FF control (the branch that held `HEAD` when the batch started —
    often `main`/`master`, otherwise whatever the user was on) by one local commit,
    never pushed; union that sibling's paths into `touched-files.md`; update
-   state/evidence; AFK +1 for that sibling; optional `check candidate`. Then
-   refill ([Dynamic selection](#dynamic-selection-and-re-batching)) and start the
-   feature gates on control
-   ([Proof tiers](phase-contract.md#proof-tiers)); the next landing waits for them
-   to pass, the refilled wrights do not.
+   state/evidence; AFK +1; optional `check candidate`. Land every green sibling,
+   refill ([Dynamic selection](#dynamic-selection-and-re-batching)), then run the
+   feature gates once for the train
+   ([Proof tiers](phase-contract.md#proof-tiers)); the next train waits, the
+   refilled wrights do not.
 8. Cleanup runs only after the last landing marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
@@ -223,13 +229,13 @@ devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug
 #   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-`integrate` without `--apply-to-control` stages the per-sibling commits, leaves
-the lease `running` and control at `B`; cleanup still refuses — the commits
-cannot be lost. `record-green` and `integrate` also accept an `integrate-failed`
-lease, so a failed integrate retries after repair. `--apply-to-control`
-refuses when control moved past `B` or holds uncommitted changes on slice
-paths — stop for the human (never stash or commit their work); the batch is
-untouched. Go is SSOT; never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages commits; lease stays `running`,
+control stays at its expected tip, cleanup refuses. `record-green` and `integrate`
+accept `integrate-failed` for retry. Applied landings advance `control_tip`
+(initially `B`), permitting landings/refill. External control movement or
+uncommitted slice-path edits with `--apply-to-control` cause refusal:
+stop for the human (never stash or commit their work); the batch is untouched.
+Go is SSOT; never ad-hoc git/bash orchestration.
 
 ## Runtime isolation
 

package/pack/generated/claude/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,25 @@ One contract builds one slice: preserve TDD, exact paths and independent judgmen
 ## Proof tiers
 
 With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and every
-other row; feature gates run once per parallel landing, on control, while worktree
-wrights continue. The next landing and Prove wait for them; red is a fingerprint
-against slices landed since the last green run. Serial same-worktree mode, and plans
+other row; feature gates run once per landing train, on control, while worktree
+wrights continue: land every green sibling together, run the suite once, and bisect only
+on red. The next train and Prove wait for them; red is a fingerprint against slices
+landed since the last green run. Serial same-worktree mode, and plans
 without the section, run every row each round. Run gate, benchmark and proof commands
 through the host's shell tool, never a code-evaluation subprocess, whose environment
 can lack the owner's exported variables.
 
+Wrights run only the tests their changed paths reach, resolved from the merge base
+against the plan's baseline rather than the last commit; Prove and Seal always run the
+full suite. Resolve that narrow set with
+`devrites-engine check affected <changed path...>`, which expands a changed package to its
+dependent packages and widens on its own when a path is a module manifest, a generated
+artifact, CI config, shared testdata, or one it cannot classify. Widen to the full suite
+inside Build the moment a slice touches `go.mod` or a
+lockfile, generated artifacts, CI config, a shared test harness, or whenever no test can
+be named for a changed path. When selection is uncertain, run the full suite: the narrow
+set is an optimisation, never a substitute.
+
 ## Independent Build review
 
 After inspection, freeze full slice scope and cumulative baseline diff with

package/pack/generated/claude/skills/rite-define/SKILL.md

@@ -175,9 +175,11 @@ Pull these via `Read` when shaping the plan:
    buildable AC/REQ maps to an existing slice/proof, every slice maps to real
    acceptance, and names/prose agree. Missing, duplicate, contradictory, or
    meaning-changing mappings block. Then run
-   `devrites-engine check task-graph <slug>`; a malformed dependency graph blocks
+   `devrites-engine check task-graph <slug> --strict`; a malformed dependency graph, or a
+   shared path written by `hubAdvisoryMin`+ slices with no `Serial rationale:`, blocks
    before Vet rather than spending a reviewer context on invalid tasks. Resolve each
-   `ADVISORY size:`/`hub:` line now (split or seam slice, or a rationale); never blocking.
+   `ADVISORY size:`/`hub:`/`chain:` line now (split or seam slice, or a rationale);
+   `--strict` refuses the contended plan, the default run only advises.
 7. **Readiness gate** (`plan-template.md`): require CLEAR coverage; complete acceptance,
    wiring, shared-contract proof, applicable outputs, and rollback; risk-first acyclic order;
    justified deviations; and every horizon item present, with blockers resolved, planning

package/pack/generated/claude/skills/rite-plan/reference/slicing.md

@@ -172,8 +172,12 @@ cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.
 
 Slices sharing a file never build side by side: put a hub file's shared edit
 (registry, command table, test harness) in one seam slice the others depend on.
-`check task-graph` prints the `schedule:` and `ADVISORY hub:` lines; inseparable
-writes get `Serial rationale: <why>`. Never merge slices or drop acceptance to widen it.
+`check task-graph` prints the `schedule:`, `ADVISORY hub:` and `ADVISORY chain:` lines.
+A `chain` line means only one slice was ever ready, so the DAG rather than the cap
+serializes: cut a slice that stands alone, or record `Serial rationale: <why>`.
+`check task-graph <slug> --strict` refuses a plan whose shared path carries `ADVISORY hub:`
+writers, so a contended plan must split disjointly instead of widening the cap.
+Never merge slices or drop acceptance to widen it.
 
 ## Deferred slice
 A slice with `Satisfies: none` is an optional follow-up: plan-invented hardening or

package/pack/generated/codex/agents/devrites-upgrade-planner.toml

@@ -21,7 +21,8 @@ Read named paths only. Accept released v1/v2 bullet or v3 table `state.md` under
 `.devrites/work/<slug>/`. Reject aliases, release scripts/markers, and conversion.
 
 Cite current rule plus workspace evidence for each applicable axis: cursor/topology,
-phase artifacts, decisions, planning/traceability/proof, built-code/intent, protected
+phase artifacts, decisions, planning/traceability/proof (including a `check task-graph`
+`ADVISORY chain:` schedule that no parallel cap can widen), built-code/intent, protected
 history, artifact budgets/feature ceiling (the supplied `devrites-engine orient`
 `artifact_budgets`/`bulk_files` and `task_graph.slice_count` against
 [`workspace-artifact-schema.md`](.agents/skills/devrites-lib/reference/workspace-artifact-schema.md) and [`slicing.md`](.agents/skills/rite-plan/reference/slicing.md) § Feature ceiling),

package/pack/generated/codex/skills/rite-autocomplete/SKILL.md

@@ -118,13 +118,13 @@ next sequence continuation through Vet in a second session, then stop.
    `$rite-build` batch loop → `$rite-prove` → `$rite-polish` →
    `$rite-review` → `$rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Build runs the path-disjoint batch `parallel select --from-plan` picks (cap: this invocation's
-   `--parallel N`, else sentinel `max_parallel`, else 10) and refills a slot
-   per landing until no pending slice remains; a one-slice round is serial for that round only, then
-   selection runs again (host isolation still forces serial when concurrent writers
-   cannot be separated). When `--parallel N`
-   is present, pass it into `$rite-build` and do not consult leftover sentinel
-   `max_parallel`.
+   Build uses `parallel select --from-plan` (cap: explicit `--parallel N`, else
+   sentinel `max_parallel`, else 10), refilling per landing until none pending;
+   a one-slice round is serial for that round only; reselect afterward. Host
+   isolation may force serial. If `--parallel N` is explicit,
+   pass it into `$rite-build` and ignore leftover sentinel `max_parallel`.
+   Otherwise pass the resolved sentinel/default cap into `$rite-build` as
+   `--parallel N`, never bare `$rite-build`.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/codex/skills/rite-build/SKILL.md

@@ -14,7 +14,7 @@ user-invocable: true
 HITL stops; a later user invocation starts the next slice.
 Explicit `.devrites/AFK` alone lets the controlling root chain under green proof,
 caps and pause rules. Every wright returns after one slice.
-**Opt-in:** `$rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
+**HITL:** `$rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
@@ -45,8 +45,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 
 ## Invariants
 
-- Default: one slice; writers serial on control (core.md #5). Parallel only via
-  `--parallel N` under [`reference/parallel-batch.md`](reference/parallel-batch.md).
+- Standalone HITL default: serial on control (core.md #5). AFK/`--parallel N`
+  uses [`parallel-batch.md`](reference/parallel-batch.md).
   Same-worktree multi-writer / root-emulated concurrency forbidden.
   Native-worktree pilot = single-slice isolation when `wright-dispatch.md`
   preflight + reconcile hold.
@@ -80,7 +80,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
+HITL default/explicit `1` ≡ serial; AFK inherits cap.
+`2`–`10` is a **cap** — the root runs an eligible
 path-disjoint set it can start now (`N_eff`, from `parallel select --from-plan`), takes fewer when the cap cannot be
 filled, and refills a slot per landing (serial slice or one sibling) until
 no pending slice remains

package/pack/generated/codex/skills/rite-build/reference/parallel-batch.md

@@ -37,13 +37,15 @@ Select **greedily in plan order** with
 reads the ready set (tasks.md dependencies checked `built` in `state.md`, minus
 running-lease slices) and each slice's Writer allowlist (else `Files likely
 touched`), plus its manifest/lockfile when `External dependencies:` is not none;
-in Build, `next` prints the same `eligible_now:`/`batch:`. `N_eff ≥ 2` → parallel batch;
-`N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
-is normal: take fewer. Serial is this round's size, not the rest of the run.
+`next` prints `eligible_now:`/`batch:`. `n_eff` counts new picks only.
+With a running lease, a single new pick still uses `parallel add`;
+`n_eff=0` with a running lease waits for siblings, not Prove. Without one:
+≥2 → parallel batch, 1 → serial, none pending → Prove.
+Serial is this round only; a cap need not be filled.
 
 **Refill per landing; never wait for the batch.** Each sibling lands alone when
-green ([Lifecycle](#lifecycle) step 6). Then re-read `state.md`, pending slices, and
-the tree and run `parallel select --slug <slug> --cap N --from-plan`: unlanded siblings hold
+green ([Lifecycle](#lifecycle) step 6). Re-read state, pending slices, and the
+tree; reselect: unlanded siblings hold
 their slots and paths, landed ones count as built, and only new picks print;
 `parallel add` starts each from the control tip and its wright dispatches at once.
 No lease → plain `select` + `create`. AFK/autocomplete is one run; HITL stops after
@@ -116,6 +118,10 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
+
+   A recheck round is one dispatch per changed surface, not one per checklist: the
+   recheck agent carries every open checklist (code, test, doubt) for that diff and
+   answers each by name. Merging cuts dispatches; dropping a checklist does not.
    Reviewer fan-out for a batch is itself batched under
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
    (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
@@ -137,11 +143,11 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 7. Each landing: FF control (the branch that held `HEAD` when the batch started —
    often `main`/`master`, otherwise whatever the user was on) by one local commit,
    never pushed; union that sibling's paths into `touched-files.md`; update
-   state/evidence; AFK +1 for that sibling; optional `check candidate`. Then
-   refill ([Dynamic selection](#dynamic-selection-and-re-batching)) and start the
-   feature gates on control
-   ([Proof tiers](phase-contract.md#proof-tiers)); the next landing waits for them
-   to pass, the refilled wrights do not.
+   state/evidence; AFK +1; optional `check candidate`. Land every green sibling,
+   refill ([Dynamic selection](#dynamic-selection-and-re-batching)), then run the
+   feature gates once for the train
+   ([Proof tiers](phase-contract.md#proof-tiers)); the next train waits, the
+   refilled wrights do not.
 8. Cleanup runs only after the last landing marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
@@ -223,13 +229,13 @@ devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug
 #   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-`integrate` without `--apply-to-control` stages the per-sibling commits, leaves
-the lease `running` and control at `B`; cleanup still refuses — the commits
-cannot be lost. `record-green` and `integrate` also accept an `integrate-failed`
-lease, so a failed integrate retries after repair. `--apply-to-control`
-refuses when control moved past `B` or holds uncommitted changes on slice
-paths — stop for the human (never stash or commit their work); the batch is
-untouched. Go is SSOT; never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages commits; lease stays `running`,
+control stays at its expected tip, cleanup refuses. `record-green` and `integrate`
+accept `integrate-failed` for retry. Applied landings advance `control_tip`
+(initially `B`), permitting landings/refill. External control movement or
+uncommitted slice-path edits with `--apply-to-control` cause refusal:
+stop for the human (never stash or commit their work); the batch is untouched.
+Go is SSOT; never ad-hoc git/bash orchestration.
 
 ## Runtime isolation
 

package/pack/generated/codex/skills/rite-build/reference/phase-contract.md

@@ -73,13 +73,25 @@ One contract builds one slice: preserve TDD, exact paths and independent judgmen
 ## Proof tiers
 
 With a `test-plan.md` `## Feature gates` section, step 6 runs `Tests/proof` and every
-other row; feature gates run once per parallel landing, on control, while worktree
-wrights continue. The next landing and Prove wait for them; red is a fingerprint
-against slices landed since the last green run. Serial same-worktree mode, and plans
+other row; feature gates run once per landing train, on control, while worktree
+wrights continue: land every green sibling together, run the suite once, and bisect only
+on red. The next train and Prove wait for them; red is a fingerprint against slices
+landed since the last green run. Serial same-worktree mode, and plans
 without the section, run every row each round. Run gate, benchmark and proof commands
 through the host's shell tool, never a code-evaluation subprocess, whose environment
 can lack the owner's exported variables.
 
+Wrights run only the tests their changed paths reach, resolved from the merge base
+against the plan's baseline rather than the last commit; Prove and Seal always run the
+full suite. Resolve that narrow set with
+`devrites-engine check affected <changed path...>`, which expands a changed package to its
+dependent packages and widens on its own when a path is a module manifest, a generated
+artifact, CI config, shared testdata, or one it cannot classify. Widen to the full suite
+inside Build the moment a slice touches `go.mod` or a
+lockfile, generated artifacts, CI config, a shared test harness, or whenever no test can
+be named for a changed path. When selection is uncertain, run the full suite: the narrow
+set is an optimisation, never a substitute.
+
 ## Independent Build review
 
 After inspection, freeze full slice scope and cumulative baseline diff with

package/pack/generated/codex/skills/rite-define/SKILL.md

@@ -175,9 +175,11 @@ Pull these via `Read` when shaping the plan:
    buildable AC/REQ maps to an existing slice/proof, every slice maps to real
    acceptance, and names/prose agree. Missing, duplicate, contradictory, or
    meaning-changing mappings block. Then run
-   `devrites-engine check task-graph <slug>`; a malformed dependency graph blocks
+   `devrites-engine check task-graph <slug> --strict`; a malformed dependency graph, or a
+   shared path written by `hubAdvisoryMin`+ slices with no `Serial rationale:`, blocks
    before Vet rather than spending a reviewer context on invalid tasks. Resolve each
-   `ADVISORY size:`/`hub:` line now (split or seam slice, or a rationale); never blocking.
+   `ADVISORY size:`/`hub:`/`chain:` line now (split or seam slice, or a rationale);
+   `--strict` refuses the contended plan, the default run only advises.
 7. **Readiness gate** (`plan-template.md`): require CLEAR coverage; complete acceptance,
    wiring, shared-contract proof, applicable outputs, and rollback; risk-first acyclic order;
    justified deviations; and every horizon item present, with blockers resolved, planning

package/pack/generated/codex/skills/rite-plan/reference/slicing.md

@@ -172,8 +172,12 @@ cannot name what crosses, drop the edge; a shallow, wide graph runs in parallel.
 
 Slices sharing a file never build side by side: put a hub file's shared edit
 (registry, command table, test harness) in one seam slice the others depend on.
-`check task-graph` prints the `schedule:` and `ADVISORY hub:` lines; inseparable
-writes get `Serial rationale: <why>`. Never merge slices or drop acceptance to widen it.
+`check task-graph` prints the `schedule:`, `ADVISORY hub:` and `ADVISORY chain:` lines.
+A `chain` line means only one slice was ever ready, so the DAG rather than the cap
+serializes: cut a slice that stands alone, or record `Serial rationale: <why>`.
+`check task-graph <slug> --strict` refuses a plan whose shared path carries `ADVISORY hub:`
+writers, so a contended plan must split disjointly instead of widening the cap.
+Never merge slices or drop acceptance to widen it.
 
 ## Deferred slice
 A slice with `Satisfies: none` is an optional follow-up: plan-invented hardening or

package/pack/generated/devin/agents/devrites-upgrade-planner.md

@@ -25,7 +25,8 @@ Read named paths only. Accept released v1/v2 bullet or v3 table `state.md` under
 `.devrites/work/<slug>/`. Reject aliases, release scripts/markers, and conversion.
 
 Cite current rule plus workspace evidence for each applicable axis: cursor/topology,
-phase artifacts, decisions, planning/traceability/proof, built-code/intent, protected
+phase artifacts, decisions, planning/traceability/proof (including a `check task-graph`
+`ADVISORY chain:` schedule that no parallel cap can widen), built-code/intent, protected
 history, artifact budgets/feature ceiling (the supplied `devrites-engine orient`
 `artifact_budgets`/`bulk_files` and `task_graph.slice_count` against
 [`workspace-artifact-schema.md`](../skills/devrites-lib/reference/workspace-artifact-schema.md) and [`slicing.md`](../skills/rite-plan/reference/slicing.md) § Feature ceiling),

package/pack/generated/devin/skills/rite-autocomplete/SKILL.md

@@ -117,13 +117,13 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Build runs the path-disjoint batch `parallel select --from-plan` picks (cap: this invocation's
-   `--parallel N`, else sentinel `max_parallel`, else 10) and refills a slot
-   per landing until no pending slice remains; a one-slice round is serial for that round only, then
-   selection runs again (host isolation still forces serial when concurrent writers
-   cannot be separated). When `--parallel N`
-   is present, pass it into `/rite-build` and do not consult leftover sentinel
-   `max_parallel`.
+   Build uses `parallel select --from-plan` (cap: explicit `--parallel N`, else
+   sentinel `max_parallel`, else 10), refilling per landing until none pending;
+   a one-slice round is serial for that round only; reselect afterward. Host
+   isolation may force serial. If `--parallel N` is explicit,
+   pass it into `/rite-build` and ignore leftover sentinel `max_parallel`.
+   Otherwise pass the resolved sentinel/default cap into `/rite-build` as
+   `--parallel N`, never bare `/rite-build`.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/devin/skills/rite-build/SKILL.md

@@ -13,7 +13,7 @@ argument-hint: "[--parallel N] [slice number or name]"
 HITL stops; a later user invocation starts the next slice.
 Explicit `.devrites/AFK` alone lets the controlling root chain under green proof,
 caps and pause rules. Every wright returns after one slice.
-**Opt-in:** `/rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
+**HITL:** `/rite-build --parallel N` (2≤N≤10; N=1≡serial) follows
 [`reference/parallel-batch.md`](reference/parallel-batch.md)
 ([`one-slice-cycle.md`](reference/one-slice-cycle.md)).
 
@@ -44,8 +44,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 
 ## Invariants
 
-- Default: one slice; writers serial on control (core.md #5). Parallel only via
-  `--parallel N` under [`reference/parallel-batch.md`](reference/parallel-batch.md).
+- Standalone HITL default: serial on control (core.md #5). AFK/`--parallel N`
+  uses [`parallel-batch.md`](reference/parallel-batch.md).
   Same-worktree multi-writer / root-emulated concurrency forbidden.
   Native-worktree pilot = single-slice isolation when `wright-dispatch.md`
   preflight + reconcile hold.
@@ -79,7 +79,8 @@ Wright applies anti-slop; root verifies returns and never patches source. Refuse
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"Vet-ready admitted bytes require root authorship outside product wright","action":"ROOT_TRANSACTION; root writes only admitted .devrites/** targets","return":"saved Build slice cursor; wright product allowlist unchanged"} -->
 ## `--parallel N` (opt-in)
 
-Omitted/`1` ≡ serial; `2`–`10` is a **cap** — the root runs the largest eligible
+HITL default/explicit `1` ≡ serial; AFK inherits cap.
+`2`–`10` is a **cap** — the root runs an eligible
 path-disjoint set it can start now (`N_eff`, from `parallel select --from-plan`), takes fewer when the cap cannot be
 filled, and refills a slot per landing (serial slice or one sibling) until
 no pending slice remains

package/pack/generated/devin/skills/rite-build/reference/parallel-batch.md

@@ -37,13 +37,15 @@ Select **greedily in plan order** with
 reads the ready set (tasks.md dependencies checked `built` in `state.md`, minus
 running-lease slices) and each slice's Writer allowlist (else `Files likely
 touched`), plus its manifest/lockfile when `External dependencies:` is not none;
-in Build, `next` prints the same `eligible_now:`/`batch:`. `N_eff ≥ 2` → parallel batch;
-`N_eff = 1` → one serial round; nothing pending → Prove. A cap that cannot be filled
-is normal: take fewer. Serial is this round's size, not the rest of the run.
+`next` prints `eligible_now:`/`batch:`. `n_eff` counts new picks only.
+With a running lease, a single new pick still uses `parallel add`;
+`n_eff=0` with a running lease waits for siblings, not Prove. Without one:
+≥2 → parallel batch, 1 → serial, none pending → Prove.
+Serial is this round only; a cap need not be filled.
 
 **Refill per landing; never wait for the batch.** Each sibling lands alone when
-green ([Lifecycle](#lifecycle) step 6). Then re-read `state.md`, pending slices, and
-the tree and run `parallel select --slug <slug> --cap N --from-plan`: unlanded siblings hold
+green ([Lifecycle](#lifecycle) step 6). Re-read state, pending slices, and the
+tree; reselect: unlanded siblings hold
 their slots and paths, landed ones count as built, and only new picks print;
 `parallel add` starts each from the control tip and its wright dispatches at once.
 No lease → plain `select` + `create`. AFK/autocomplete is one run; HITL stops after
@@ -116,6 +118,10 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
    full inventory, then bounded owning-role rechecks after repairs. Run approved
    proof in the same window as that review. Gap or Critical/Important → `gap`;
    else proof → `green|red|gap`.
+
+   A recheck round is one dispatch per changed surface, not one per checklist: the
+   recheck agent carries every open checklist (code, test, doubt) for that diff and
+   answers each by name. Merging cuts dispatches; dropping a checklist does not.
    Reviewer fan-out for a batch is itself batched under
    [`parallel-dispatch.md`](../../devrites-lib/reference/parallel-dispatch.md#scale-limits)
    (≈4 concurrent read-only reviewers, 8 only with disjoint paths), and `max_agents`
@@ -137,11 +143,11 @@ Lease: `batch_id`, `created_at`, `base_sha`, `n`,
 7. Each landing: FF control (the branch that held `HEAD` when the batch started —
    often `main`/`master`, otherwise whatever the user was on) by one local commit,
    never pushed; union that sibling's paths into `touched-files.md`; update
-   state/evidence; AFK +1 for that sibling; optional `check candidate`. Then
-   refill ([Dynamic selection](#dynamic-selection-and-re-batching)) and start the
-   feature gates on control
-   ([Proof tiers](phase-contract.md#proof-tiers)); the next landing waits for them
-   to pass, the refilled wrights do not.
+   state/evidence; AFK +1; optional `check candidate`. Land every green sibling,
+   refill ([Dynamic selection](#dynamic-selection-and-re-batching)), then run the
+   feature gates once for the train
+   ([Proof tiers](phase-contract.md#proof-tiers)); the next train waits, the
+   refilled wrights do not.
 8. Cleanup runs only after the last landing marks the lease `complete` — work
    landed in control, so `parallel cleanup` removes worktrees/branches.
    Blocked/human-stopped batches keep lease, worktrees, branches — nothing is
@@ -223,13 +229,13 @@ devrites-engine parallel lease-write|lease-read|lease-clear --root <repo> --slug
 #   parallel cleanup --root <repo> --slug <slug> --force   (salvages, prints retained refs)
 ```
 
-`integrate` without `--apply-to-control` stages the per-sibling commits, leaves
-the lease `running` and control at `B`; cleanup still refuses — the commits
-cannot be lost. `record-green` and `integrate` also accept an `integrate-failed`
-lease, so a failed integrate retries after repair. `--apply-to-control`
-refuses when control moved past `B` or holds uncommitted changes on slice
-paths — stop for the human (never stash or commit their work); the batch is
-untouched. Go is SSOT; never ad-hoc git/bash orchestration.
+`integrate` without `--apply-to-control` stages commits; lease stays `running`,
+control stays at its expected tip, cleanup refuses. `record-green` and `integrate`
+accept `integrate-failed` for retry. Applied landings advance `control_tip`
+(initially `B`), permitting landings/refill. External control movement or
+uncommitted slice-path edits with `--apply-to-control` cause refusal:
+stop for the human (never stash or commit their work); the batch is untouched.
+Go is SSOT; never ad-hoc git/bash orchestration.
 
 ## Runtime isolation