devrites 7.1.2 → 7.2.0

package/pack/generated/dsh/skills/rite-adopt/reference/anti-patterns.md

@@ -0,0 +1,19 @@
+# /rite-adopt: anti-patterns
+
+Start with the universal table in [`../../devrites-lib/reference/standards/anti-patterns.md`](../../devrites-lib/reference/standards/anti-patterns.md).
+Below are the rationalizations specific to onboarding an existing codebase.
+
+## Adoption-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll improve this messy bit while I document it." | Adoption *documents* what exists; it changes nothing. A cleanup is the *next* feature through the normal lifecycle: recording it as a drive-by here hides the baseline and balloons the diff. |
+| "This looks like the convention, so I'll seed it." | Seed only what the code *and consistently* follows. A guessed seed becomes a high-confidence-looking prior that steers the first slice wrong. Observe it in ≥2 places, with nonconforming sites counted per [`adoption.md`](adoption.md), or leave it out. |
+| "I'll spec the ideal architecture, not the current one." | The spec's baseline is *current behavior*. Aspirations go in the next objective, not the baseline: otherwise every later slice drifts against a spec that never matched reality. |
+| "Whole repo in one adopt." | Onboard the area you'll work in. A repo-wide adopt produces an unfocused spec and a ledger full of conventions no slice will touch. |
+
+## Red flags
+
+- A seeded convention with no concrete code location behind it.
+- `spec.md` describing behavior the code does **not** currently have (that's the next feature, not the baseline).
+- Editing source during adoption: adoption writes `.devrites/` + the ledger, never project code.

package/pack/generated/dsh/skills/rite-autocomplete/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: rite-autocomplete
+description: Run the full DevRites lifecycle unattended; --ship continues to the final Git approval boundary. Use for one-shot autonomous work; not for a single phase.
+argument-hint: "[idea] [--ship|--yolo] [--max-slices N] [--parallel N] [--full] [--cross-model] [--lookahead]"
+user-invocable: true
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/one-shot-actions.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/standards/acceptance-preserving-reslice.md","rite-autocomplete/reference/decision-policy.md","rite-autocomplete/reference/loop.md","rite-autocomplete/reference/stop-conditions.md"],"triggers":{"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"lookahead":["rite-autocomplete/reference/lookahead.md"]},"workspace":["state.md","spec.md","plan.md","tasks.md","questions.md","decisions.md","drift.md","evidence.md","test-plan.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/standards/workflow-artifacts.md","rite-autocomplete/reference/lookahead.md"]} -->
+> Read-set manifest: `devrites-engine context --skills-root .dsh/skills <slug> --phase autocomplete` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-autocomplete: full lifecycle, unattended
+
+Run every phase after one clarification window. Irreversible-risk,
+escalating,<!-- pack-scan-ignore: negated statement: gates are NOT disabled -->
+access, unanswered blocking with no recommended option, and remaining NO-GO
+still pause. Open blocking questions that already name a ranked recommended
+option auto-resolve; they are not a user handoff, except a question whose answer
+would add acceptance or product scope, which a recommended option never resolves.
+Use the Standard native
+profile by default and Full for high-risk scope or explicit `--full`; see
+[`orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+
+## Required rules
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md) and [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) first. Read
+[`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md) before any stop/continue or execution decision involving a
+consumptive action. Before honoring a terminal cursor that names missing
+executable controller/harness/bundle bytes or a missing writer, read
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md)
+(trigger `workflow-artifacts` — only when a workspace declares them). Before classifying any Reslice, read `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Invariants
+
+- Use one initial human window: Spec, topology-first Clarify, and
+  `Decision coverage: CLEAR`. Only then arm AFK. Record later reversible choices
+  under [decision policy](reference/decision-policy.md).
+- Safety is not bypassable. `--ship`/`--yolo` reaches only the exact-plan
+  literal-GO and native-approval boundary; it never authorizes Git.
+- **Treat technical readiness as routing, not completion.** `NEEDS REPLAN` is a backward edge
+  to Plan repair and narrow Vet. `NEEDS REPLAN` cold resume follows a valid
+  technical return cursor before forward work or any reply. Clarification is
+  likewise internal when current authority resolves it.
+- Always follow agent-owned backward edges through repair, affected Vet,
+  correction, and proof. A nested `STOP`/`Next step` is not a user handoff.
+  Pause only for a shared human/safety/access condition.
+- **Do not confuse an action budget with recovery exhaustion.** Spent action
+  authority blocks another real execution, not offline correction of retained
+  Critical/Important evidence. Stop for fresh GO only after changed conditions
+  and READY Vet.
+- Every exact causal fingerprint gets three no-progress corrections per strategy.
+  A spent strategy escalates to a new correction class inline; after three
+  escalations it parks while independent work continues. Never ask permission to
+  retry. Closing one is progress; a distinct Critical/Important invariant has its
+  own budget. Lower severity cannot prolong recovery.
+- Do not stop on `--max-slices`, sentinel `max_slices`, `max_agents`,
+  `max_minutes`, or `max_review_queue`. Count failed, malformed, and
+  unavailable leaf calls.
+- Never end the turn with a progress note while a wave runs or a next step
+  exists: on a headless host a text-only reply ends the session and kills
+  running children. Wait with the host's wait tool and keep working; end only
+  at a recorded stop. A host reminder or rule notice (style rule, advisory) is
+  not a stop either: follow it in your next tool call, never in a text-only
+  acknowledgement.
+- Parse flags only from this invocation. `--ship`, `--yolo`, `--max-slices`,
+  `--parallel`, `--full`, `--cross-model`, and `--lookahead` activate only as exact standalone
+  tokens in `$ARGUMENTS`; examples or earlier messages can never arm them.
+  `--max-slices` must occur once and be followed by a positive base-10 integer;
+  `--parallel` must occur once and be followed by a base-10 integer in `1`–`10`.
+  Missing, repeated, malformed, or conflicting values stop before any write.
+- Temper always runs after Clarify. Auto-apply `hold-rigor`, `reduce-to-MVP` or a skip;
+  record the ADR and fold via Spec Drift Guard. `expand` and extra acceptance never
+  auto-apply: ask through `ask_user_question`, hold the fold, and stop until a human
+  resolves the qid. Irreversible-risk still pauses.
+- Vet every plan. Cross-model is off unless the current invocation arms it.
+
+## Workflow
+
+With `--lookahead` (trigger `lookahead`), follow
+[`lookahead.md`](reference/lookahead.md) instead of the steps below: plan the
+next sequence continuation through Vet in a second session, then stop.
+
+1. **Orient and parse.** Resolve the explicit or active slug; when a workspace exists,
+   require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before honoring `blocked` with terminal `next_action`,
+   reconcile retained consumptive evidence and fingerprint attempts from
+   `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
+   recovery, and this new invocation reopens each parked fingerprint.
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"lifecycle cursor encounters admitted set or resumable journal","action":"invoke classifier; execute returned route internally","return":"saved phase/action; zero intermediate reply"} -->
+   Reconstruct a missing return cursor only from
+   the current phase and exact approved action in `test-plan.md`/evidence, never
+   from chat. After compaction or a resumed session, always run `devrites-engine
+   handoff <slug> --resume` first (slug from `.devrites/ACTIVE`) and open only the
+   `read_next` artifacts it names, per [`context-hygiene.md`](../devrites-lib/reference/standards/context-hygiene.md) § Compaction fallback.
+   Normalize current arguments to idea, `ship_preflight: yes|no`,
+   `max_slices: unlimited`, `parallel: N|default`, `profile: standard|full`,
+   and `cross_model: yes|no`.
+   **Completion:** normalized state is unambiguous and no sentinel or workspace file has been written.
+2. **Specify and clarify.** Run `devrites-interview`, `/rite-spec`, and
+   `/rite-clarify` as one window. `open` material coverage never arms
+   AFK. **Completion:** `Decision coverage: CLEAR` is durable.
+3. **Arm AFK once.** Apply the loop's
+   [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
+   existing bytes or create the sentinel once (`allow_gates: [advisory, validating]`); never
+   rewrite it after Vet except to write or replace only `max_parallel: N` when
+   this invocation contains `--parallel N`. Preserve an existing sentinel
+   byte-for-byte otherwise. **Failing case:** leftover `max_parallel: 1` keeps
+   the run serial after `--parallel 5`.
+   **Completion:** a valid read-only AFK sentinel exists.
+4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
+   `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
+   `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
+   `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
+   chat, carry state. Apply the mutable post-vet budget before first Build.
+   Build uses `parallel select --from-plan` (cap: explicit `--parallel N`, else
+   sentinel `max_parallel`, else 10), refilling per landing until none pending;
+   a one-slice round is serial for that round only; reselect afterward. Host
+   isolation may force serial. If `--parallel N` is explicit,
+   pass it into `/rite-build` and ignore leftover sentinel `max_parallel`.
+   Otherwise pass the resolved sentinel/default cap into `/rite-build` as
+   `--parallel N`, never bare `/rite-build`.
+   **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
+5. **Apply stops.** At every gate use
+   [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:
+   route agent-owned red results through bounded recovery.
+   Red gates block forward advancement and enter caller-owned recovery. Stop on
+   hard risk, escalating, irreversible-risk, access, blocking with no
+   recommended option, remaining NO-GO, or parked fingerprints with no
+   independent work left. An open blocking question that already names a ranked recommended
+   option (`proposed` or option 1 labelled Recommended) auto-resolves through
+   `devrites-engine state resolve` and continues (a missing or failing resolver is
+   the bounded resolver-failure stop); do not emit `/rite-resolve` as
+   a user handoff. Exception: a question whose answer would add acceptance or
+   product scope is never auto-resolved by a recommended option; it stops for a human.
+   A spent strategy escalates; parked recovery records
+   `Next step: /rite-autocomplete`, never a routine phase command. **Completion:** no stop is active, or its cursor and reason are durable.
+6. **Seal boundary.** With or without a ship flag, leave intermediate sealed
+   workspaces unshipped and open the next recorded continuation
+   ([loop.md § Sequence continuation](reference/loop.md#sequence-continuation))
+   unless `continue_sequence: false`, the sequence budget is spent, or no entry
+   remains. At that boundary without a ship flag, stop at Seal GO with `/rite-ship`.
+   Report sequence position at every stop. Only at that boundary, with a ship flag, perform Ship preflight,
+   disclose the exact Git plan, and stop for fresh literal `GO` plus native approval. **Completion:** performed no Git action before fresh literal `GO` plus native approval.
+
+## Reply and resume
+
+HITL Build returns after one slice; Autocomplete ignores `--max-slices`, chaining
+pending slices. Each Autocomplete invocation owns internal backtracking. Context pressure, compaction, or a nested completion footer does
+not create a stop; persist and resume the cursor.
+
+Reply only at final state: text-only turns end the run. Keep
+calling tools after compaction or phase changes. Use one line:
+
+```text
+Autocomplete: <slug>
+spec <done|stopped> · clarify <clear|stopped> · temper <done|stopped> · define <done|stopped> · vet <ready|stopped> · build <n/N|stopped> · prove <done|stopped> · polish <done|stopped> · review <done|stopped> · seal <GO|NO-GO|stopped>
+```
+
+Final state: `Shipped`, `Stopped`, `Awaiting human`, `NO-GO`, or `GO`; no narrative
+recap. Require clean or accepted baseline; land local unpushed checkpoints after
+each green check; never auto-pass red gates.

package/pack/generated/dsh/skills/rite-autocomplete/reference/decision-policy.md

@@ -0,0 +1,44 @@
+# Decision policy: how autocomplete "chooses the best option"
+
+Unattended ≠ careless. Every discretionary choice is made the way a senior engineer
+would, then **recorded** so the seal can audit it. The difference from interactive mode
+is only *who answers* a discretionary question, not whether it's reasoned.
+
+Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## The rule
+
+For each non-trivial choice, pick the option the **relevant specialist favours**, and
+write the choice + the one-line rationale to `decisions.md`. Do not coin-flip, and do
+not pick the option that's merely easiest to implement.
+
+| Choice type | Defer to | Then |
+|---|---|---|
+| Uncertain framework / library behaviour | `devrites-source-driven` (check the docs/source) | record the source in `evidence.md` |
+| Risky boundary / data-model / API decision | `devrites-doubt` (+ `devrites-doubt-reviewer`) | record the trade-off in `decisions.md` |
+| Cross-boundary contract (FE/BE split, API shape) | `devrites-api-interface` | contract-first slice |
+| UI surface / states / a11y | `devrites-frontend-craft` | shape before code |
+| Two reasonable designs, no clear winner | the simpler one that meets acceptance | note why in `decisions.md` |
+
+## Defaults autocomplete may assume (record them)
+
+- Follow the project's existing conventions, components, and test commands: always.
+- Prefer the smallest vertical slice that proves the acceptance criterion.
+- Reuse → extend → build new, in that order ([`coding-style.md`](../../devrites-lib/reference/standards/coding-style.md)).
+- When two options are equivalent on the evidence, choose the lower-risk / more
+  reversible one.
+
+## When a choice is NOT autocomplete's to make
+
+Irreversible-risk, escalating, access, and blocking questions with no ranked
+recommended option stay human. A blocking question that already names option 1
+`(Recommended)` or `proposed:` is autocomplete's to resolve: pick that option
+via `devrites-engine state resolve` and continue. Recommended temper
+`expand` and extra acceptance are never auto-picked: they stop for a human through
+`ask_user_question`; do not invent product intent.

package/pack/generated/dsh/skills/rite-autocomplete/reference/lookahead.md

@@ -0,0 +1,50 @@
+# Sequence lookahead (`--lookahead`)
+
+> Root-only: not inlined in --role bundles.
+
+A second session plans the next sequence continuation while the active
+workspace builds, so the child's Spec → Vet overlaps its predecessor's
+Build → Seal. The main loop later resumes the planned child instead of
+specifying it again.
+
+## Start and target
+
+The operator starts the second host session with `/rite-autocomplete
+--lookahead` once the `.devrites/ACTIVE` workspace is in Build or later. The
+agent never launches a session itself. The target is the next recorded
+continuation after the active workspace: the entry
+[sequence continuation](loop.md#sequence-continuation) would open. Stop with
+nothing to do when the active workspace is before Build, no entry remains,
+`continue_sequence: false`, or the sequence budget is spent.
+
+## Lease
+
+Before any write, take the workspace lease:
+`devrites-engine claim add --session lookahead-<target> --ttl 240 --workspace <target> --reason lookahead`.
+Exit 3 means another session holds the target: stop. Re-add the lease with the
+same session at each phase start, and release it with `devrites-engine claim
+release` on every stop. A crashed session's lease reads `dead` and frees itself.
+
+## Rules
+
+- Never read or write `.devrites/ACTIVE`. Pass the target slug explicitly to every
+  skill and engine command, including `/rite-spec <target> "<objective>"` and
+  `devrites-engine handoff <target> --resume`.
+- After the workspace exists, run `devrites-engine state set <target> sequence_lookahead=yes`.
+- Run Spec → Clarify → Temper → Define → Plan → Vet as the main loop does.
+  Define and Plan read the predecessor's current tree and plan. Record an
+  assumption for each predecessor interface the plan relies on.
+- At Vet, beside the readiness binding, record exactly one line
+  `Predecessor readiness: <active-slug> <digest>` in `eng-review.md`. `<digest>`
+  is the hex that `devrites-engine check readiness --emit-binding <active-slug>`
+  prints. When the predecessor later changes its planning inputs, the child's
+  readiness check blocks with `DRV-GATE-READINESS-STALE` and the main loop
+  re-vets the child before Build.
+- Never Build, never write product source or tests, never commit, and never
+  arm or rewrite `.devrites/AFK`. Owner questions go to the target's
+  `questions.md` and stop the lookahead.
+- Stop at Vet `READY` with `next_action: build after predecessor Seal GO`, at a
+  human gate, or when the target's lease is lost.
+
+**Failing case:** the lookahead passes Vet and starts Build while the
+predecessor is still sealing, so two root sessions write one tree.

package/pack/generated/dsh/skills/rite-autocomplete/reference/loop.md

@@ -0,0 +1,164 @@
+# The autocomplete loop: arm AFK, drive every phase
+
+Autocomplete chains existing `/rite-*` workflows without routine-phase pauses. Acceptance-preserving Reslice authority is
+`.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Arm AFK once
+
+```yaml
+allow_gates: [advisory, validating]
+# max_slices / max_agents / max_minutes / max_review_queue omitted: unlimited
+# continue_sequence: false         # opt out; default chains after Seal GO
+# max_workspaces: 5                # sequence budget when chaining
+# max_parallel: 10                 # default cap when this invocation omits `--parallel N`; `--parallel N` wins and rewrites only this field
+# max_tokens: <N>
+# max_cost_usd: <amount>
+# notify: "<cmd>"
+```
+
+Read existing sentinel first. Preserve valid bytes, except
+when this invocation contains `--parallel N`: then write or replace only
+`max_parallel: N` and leave every other key unchanged. Stop if the sentinel is
+malformed. Do not stop because it names `max_slices` / `max_agents` /
+`max_minutes` / `max_review_queue` or only `[advisory]`. If absent, write it
+once after clarity, and include `max_parallel: N` when that flag is present.
+Never write `max_slices` from `--max-slices`. It is otherwise read-only: never rewrite it after Vet or reset it on resume. Leftover `expires_at` is ignored
+and never rewritten. **Failing case:** leftover `max_parallel: 1` keeps the run
+serial after `--parallel 5`.
+
+### Derive the mutable post-vet budget
+
+After Vet, seed `afk_slices_remaining` from the pending count so every pending
+slice can run. Ignore `--max-slices`, sentinel `max_slices`, and leftover
+remaining. AFK configuration itself stays unchanged.
+
+### Admit each unattended cycle
+
+Before each phase, review fan-out, recovery, or writer dispatch: cheapest
+readiness check first; reject overlap. Do not stop on `max_agents`,
+`max_minutes`, or `max_review_queue`. Count every leaf result. New activations reset activation-local counters, retaining durable slice/recovery state.
+
+[Build return](../../rite-build/reference/output.md#caller-owned-continuation).
+Pass `--parallel N`; ignore leftover cap/headroom, remaining-0,
+and `--max-slices` stops. Agent-invented dispatch, wait, tool-call, or turn budgets are not stop conditions.
+An explicit human request to pause or run only a bounded subset still wins.
+Path collisions serialize work; they do not end the run.
+Resolve ranked validating/blocking picks via `devrites-engine state resolve`;
+never hand `/rite-resolve` to the user. Escalating, irreversible-risk, access, blocking
+without recommendations, and Seal judgment (`slice: seal`) still pause.
+
+## Phase arc
+
+Workspace files, not chat, carry state. Read/execute each phase skill:
+
+| Step | Phase | Completion / edge |
+| --- | --- | --- |
+| 1 | `/rite-spec` | investigate and write testable intent |
+| 2 | `/rite-clarify` | topology-first scan; require `Decision coverage: CLEAR`, then arm AFK |
+| 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
+| 4 | `/rite-define` | approved plan/tasks/traceability |
+| 5 | `/rite-vet` | every plan; derive mutable budget after READY |
+| 6 | `/rite-build` batch loop | largest eligible path-disjoint set (cap: this invocation's `--parallel N`, else sentinel `max_parallel`, else 10; serial if <2 eligible); refill per landing; charge once per landed slice |
+| 7 | `/rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
+| 8 | `/rite-polish` | re-prove after code edits |
+| 9 | `/rite-review` | in-scope correction then fresh proof |
+| 10 | `/rite-seal` | GO/NO-GO; no Git |
+| 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
+
+Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
+pass evidence after source edits. Re-read active workspace before each phase. On a cold resume or
+new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a
+durable fact lost since the last checkpoint — restore or route it through its
+owning phase before continuing; `unproven` does not block. After each phase's
+durable advance lands (green check loop, checkpoint commit), run
+`devrites-engine check regression <slug> --update` to ratchet the progress
+floor; `--update` never excuses an unreconciled regression.
+
+## Sequence continuation
+
+Unless `continue_sequence: false`, while sequence budget remains
+([sentinel](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces)),
+step 10 does not end the run: leave the sealed workspace unshipped with its
+`Next step: /rite-ship`, then invoke the next recorded continuation
+(`/rite-spec <parent>-<n> "<objective>"` from the parent's `decisions.md` sequence)
+and re-enter step 1. Spend one workspace per opened continuation.
+
+For a child already planned by [lookahead](lookahead.md), do not re-specify.
+Wait while `devrites-engine claim check --workspace <child>` exits 3 (live
+lookahead), then set `.devrites/ACTIVE` to the child and resume its cursor at
+step 1. A predecessor replan since its Vet blocks child readiness with
+`DRV-GATE-READINESS-STALE`; route to `/rite-vet` before Build.
+
+Before invoking a continuation, require durable `state.md`
+`sequence_workspaces_remaining > 0`; if absent, first write
+`max_workspaces - 1` and `sequence_position: 1`. `/rite-spec` seeds the child's sequence cursor at creation per the
+[continuation contract](../../rite-plan/reference/slicing.md#continuation-workspaces);
+verify the created child's `state.md`: `sequence_parent` = current slug,
+`sequence_position` = parent position + 1,
+`sequence_workspaces_remaining` = parent remaining − 1, and — when the recorded
+entry is the sequence's release milestone — `sequence_role: release` (gates then
+require the union manifest). On resume, re-seed missing child fields from its `brief.md` parent/position and
+parent counter (same values, no second charge). No recorded parent/position
+means no sequence membership: stop the chain.
+
+Stop sequence continuation when: `continue_sequence: false`; no recorded next
+entry (the final milestone); the `max_workspaces` cap is reached; or a genuine
+human-owned, safety, access, or parked-recovery stop fires. `max_review_queue`
+never stops Autocomplete; agent-owned Seal `NO-GO` enters recovery, not a handoff.
+Intermediate sealed milestones continue without `--ship` and without Git mutation. On stop, report sequence position, sealed/unshipped workspaces, and
+one release command (`/rite-autocomplete <release milestone> --ship`, or
+`/rite-ship` for the current sealed workspace when the sequence is complete).
+
+## Backtrack without handing off
+
+Autocomplete remains caller for agent-owned earlier-phase gaps:
+
+1. Save the originating phase/action unless a valid native return cursor exists.
+2. On cold resume, reconcile the terminal cursor against durable fingerprint
+   accounting. Restore `return_next_action` only from the approved
+   `test-plan.md`/evidence action; ambiguity returns to Vet and never licenses
+   execution.
+3. Invoke required Plan repair, affected Vet, remediation, and proof inline.
+   Recovery Vet is a narrow Vet recheck of prior findings, changed paths/criteria,
+   and affected evidence; it never restarts unaffected axes. A nested `STOP`
+   ends that phase only; do not hand the intermediate command to the user.
+4. Re-read state after each nested phase. Reconcile exact causal fingerprints
+   from `drift.md`/`evidence.md`. A closed reproduction is progress. A different
+   Critical/Important invariant gets a separate budget; Suggestion/Nit/FYI does
+   not prolong the chain. Only a no-progress result charges the same fingerprint.
+5. For failed consumptive action, spent authorization blocks only another real
+   execution. Use retained evidence for offline diagnosis, repair, and narrow
+   Vet; after READY, pause for fresh authorization.
+6. Restore and consume the original cursor when prerequisites are green.
+
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"loop tick sees Workflow Artifact trigger/state","action":"invoke classifier once under owner lock; no actor-history migration","return":"same loop cursor; no budget charge for verify/rerun"} -->
+Ask only for a human-owned decision or mandatory safety/access action. An open
+blocking question with `proposed` or option 1 labelled Recommended is not that
+decision: resolve it and continue. Three no-progress corrections of one exact
+fingerprint spend only its strategy: escalate inline per the
+[retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+and park it after three escalations while independent work continues.
+
+## Continuous caller obligation
+
+Green slice/phase checkpoints consume their recorded `next_action` internally;
+only the caller replies finally at completion or a genuine stop.
+No user-facing reply is permitted while durable state contains agent-owned
+`NEEDS_REPLAN`, an intermediate Plan/Vet action, a distinct retained
+Critical/Important fingerprint below its cap or with an escalation left, runnable
+work independent of a parked fingerprint, or an open blocking question that
+already names a ranked recommended option. Invoke the next internal repair or
+`devrites-engine state resolve` immediately, unless that writer already hit the
+[resolver-failure stop](stop-conditions.md#other-stop-classes). **Failing case:**
+`state resolve` exits 1 on every call and the loop re-invokes it without end. A narrow reviewer closing one finding and exposing another
+Critical/Important invariant is progress, not exhaustion.
+
+The number of completed repair/Vet cycles, context pressure, compaction, session
+duration, and nested completion never turn checkpoints into handoffs. Persist and
+resume to the requested rest point or shared human/safety/access/parked-recovery stop.

package/pack/generated/dsh/skills/rite-autocomplete/reference/stop-conditions.md

@@ -0,0 +1,118 @@
+# Stop conditions: when autocomplete pauses
+
+On real stops, persist `state.md` `awaiting_human` or `blocked`, reason, and one
+resume command. Agent-owned recovery never ends the run: spent strategies
+escalate; fully escalated fingerprints park while other work continues ([retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)).
+`--ship` never bypasses a stop.
+
+Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → keep Plan repair/affected Vet internal; no stop solely for topology/count.
+- `GUARD_AND_REPAIR` → enter Spec Drift Guard/Clarify; pause only at an existing human-owned gate; resume Plan/Vet internally.
+- `BLOCKED_INPUT` → no planning writes; stop internal branch; exact diagnostic; recover authority; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Always stop
+
+Flags/AFK ceiling never override:
+
+- destructive data migration;
+- auth/authz boundary change;
+- public API break;
+- external-service contract change; or
+- filesystem destruction outside the workspace.
+
+Red proof cannot advance. Run bounded Debug Recovery; escalate spent strategies.
+Fully escalated fingerprints park unless remaining owner is human.
+
+## Not stops: internal technical routing
+
+`NEEDS_REPLAN` is not a stop condition under active Autocomplete. It blocks
+forward work, persists the return cursor, and invokes Plan repair plus Recovery
+Vet inline. The same applies to nested `STOP`/`Next step` when its decision is
+agent-owned.
+
+Agent-owned backtracking is not a stop condition while its exact causal
+fingerprint has budget: invoke earlier phase, affected Vet, remediation, proof;
+resume origin. Three no-progress corrections spend only that fingerprint's current
+strategy: escalate inline to the next class (shared root cause, diagnostic
+amplification, boundary redesign) with fresh budget, without permission. After
+three escalations per activation it parks; finish independent work, then stop once.
+Preserve reproduction, attempts, and dead ends; never offer `/rite-plan unblock`
+or another routine phase command. A new user-issued `/rite-autocomplete`
+reopens parked fingerprints with fresh escalation; wakes and compaction do not.
+Closure is progress; a separately evidenced Critical/Important invariant starts
+its own cap and cannot extend the closed one.
+
+Spent consumptive-action authorization is not technical-recovery exhaustion.
+It blocks another execution; retained new Critical/Important evidence still
+enters offline recovery. After affected Vet is READY, pause for fresh action
+authorization and never reuse old GO.
+
+Past evidence being irretrievable is not by itself terminal. If an in-scope trusted seam
+uniquely discriminates the next failure, run diagnostic-amplification Plan repair
+and narrow Vet inline; pause for fresh GO before one evidence-acquisition attempt.
+Without a safe seam, escalate or park; only a real human/risk/scope gate stops for a human.
+
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"escalate BLOCKED_EXHAUSTED; on WAIT_ACTIVE_OWNER run independent work and recheck; stop on exact BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
+## Other stop classes
+
+- **Gate severity:** escalating always stops. Blocking with a ranked recommended
+  option (`proposed` or option 1 labelled Recommended): auto-pick via
+  `devrites-engine state resolve`, then continue internally (including Spec Drift
+  Guard when the answer changes ownership or acceptance). Exception: a question whose answer
+  would add acceptance or product scope is never auto-picked, even with a
+  recommended option; it stops for a human. Blocking with no
+  recommended option still stops. Validating: auto-pick the recommended option,
+  close the question, continue — except Seal's judgment-only acceptance question
+  (`slice: seal`), which only a human answers; it stops.
+- **Temper:** `expand` and extra acceptance stop: ask through `ask_user_question`, hold the
+  fold, and continue only after a human resolves the qid (an ADR is not that answer).
+  Irreversible-risk still pauses. `hold-rigor`, `reduce-to-MVP`, and a skip do not pause.
+- **Clarify:** material `open`/unowned decision coverage or a
+  low-confidence high-consequence assumption. Continue the initial interview;
+  never arm AFK early.
+- **Seal:** report remaining NO-GO with every blocker/fix direction; never round
+  up to GO. Resolve recommended-option blocking questions internally; recover
+  agent-owned findings and re-enter Seal. A first NO-GO is not a stop:
+  recover every agent-owned blocker (missing or unbound proof, a reviewer gap root
+  can close, a finding with a fix direction, a missing `review.md` verdict), then
+  re-enter Seal. The unattended `N` to accepting Important risks means repair, not
+  stop. Stop only for blockers that need a human: accepting a risk, changing scope
+  or an acceptance criterion, or access. Record each one as a question.
+- **Reslice:** execute its marked action before deciding continue/stop.
+- **Slice budget:** do not stop on `--max-slices`. Leftover
+  pre-existing remaining value, explicit flag, sentinel cap, or post-vet pending count
+  does not stop. Zero with no pending slices is normal completion.
+  Malformed flag stops before any write.
+- **Foreign writer:** a `live`/`expired` claim or `WAIT_ACTIVE_OWNER` held by
+  another session blocks only work on those paths; run independent work, re-check,
+  and stop only when nothing independent remains. `released`/`dead` claims are
+  reconciled per [§ Cancellation](../../devrites-lib/reference/parallel-dispatch.md#cancellation-and-terminal-reconciliation).
+- **Resource envelope:** overlapping run or missing AFK after arm still stops.
+  Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
+- **Confidence:** intent still cannot become testable acceptance after interview.
+- **Repeated failure:** not a stop. Escalate; fully escalated fingerprints park.
+  Stop only when no independent work remains.
+- **Resolver failure:** `devrites-engine state resolve` missing or nonzero.
+  Never hand-edit `questions.md`/`state.md` instead. Missing stops immediately;
+  nonzero permits one identical re-run (fingerprint: command + exit code + decisive
+  stderr line; unchanged re-run is no correction, no further attempts). Then stop
+  `blocked`: exact command, exit code, stderr line; resume via `/rite-doctor`.
+
+## Final GO and durable stop
+
+With a recorded continuation, no opt-out, and workspace budget, Seal GO stays
+internal: continue without `--ship`, leaving milestones sealed/unshipped. Only the
+final milestone, explicit `continue_sequence: false`, or exhausted sequence cap
+ends green sequence continuation.
+
+There, `--ship`/`--yolo` requires [Ship preflight](../../rite-ship/reference/git-ship.md#before-type-go):
+disclose exact plan; stop for fresh literal `GO` plus native approval.
+Without flags, stop at Seal GO with `/rite-ship`. Seal GO never authorizes Git
+or satisfies Ship approval; neither do AFK, prior approval, or flags.
+
+Record cold-resumable `state.md` stops: status, exact reason, one resume action
+(human-owned or `/rite-autocomplete` to reopen parked fingerprints). Explain in
+owning question/drift/seal entry. Tell user what stopped and any required human action.