devrites 7.2.6 → 7.2.7

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.2.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.6...v7.2.7) (2026-10-31)
+
+### Fixed
+
+* **skills:** keep lookahead planning through false stops ([#192](https://github.com/ViktorsBaikers/DevRites/issues/192)) ([1185459](https://github.com/ViktorsBaikers/DevRites/commit/1185459e0477fe7fc9ee6b8e32e3ef315100ae15))
+
 ## [7.2.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.5...v7.2.6) (2026-10-31)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.2.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/SECURITY.md

@@ -218,13 +218,17 @@ hosts or their makers. codebase-memory-mcp, ego-lite, browser-harness, and
 Playwright MCP are optional user-selected tools that DevRites calls through
 their documented interfaces rather than bundling them.
 
-Repository npm-audit exceptions are temporary trust records, not claims that an
-upstream issue is fixed. Each entry in `scripts/npm-audit-exceptions.json` is
-restricted to an exact advisory, package range, installed node path, owner,
-reason, source, and near-term expiry; validation re-audits the live dependency
-graph and fails stale, broadened, unmatched, expired, or inside-the-7-day
-refresh-horizon entries. Prefer pinning a patched ancestor (see
-`package.json` `overrides`) over extending an expiry.
+Advisories whose only installed copy is inside the npm CLI tarball
+(`node_modules/npm/node_modules/`) are not blocking. Overrides cannot replace
+those copies, and the publish plugin cannot take a newer npm that still bundles
+them. The same advisory installed anywhere else still blocks. Any other
+npm-audit exception is a temporary trust record, not a claim that an upstream
+issue is fixed. Each entry in `scripts/npm-audit-exceptions.json` is restricted
+to an exact advisory, package range, installed node path, owner, reason, source,
+and near-term expiry; validation re-audits the live dependency graph and fails
+stale, broadened, unmatched, expired, or inside-the-7-day-refresh-horizon
+entries. Prefer pinning a patched ancestor (see `package.json` `overrides`)
+over extending an expiry.
 
 ### Agentic trust boundaries
 

package/docs/engine/commands.md

@@ -17,7 +17,7 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies state.md checks `built`, with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (`none*`, existing, or no-new prose without a coordinate). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies are built (state.md checkbox, or an evidence.md heading that says that slice was checkpointed plus a `Checkpoint: <sha>` line), with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (module path, npm scope, backticked name, or a non-toolchain version). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
 | `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
@@ -37,8 +37,8 @@ workflow strategy.
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
-| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
+| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
 | `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |

package/engine/internal/lib/context.go

@@ -57,7 +57,9 @@ every ID the block cites).
 Repeat --slice for a recheck that spans several slices. In phase build a
 --role bundle other than slice-wright requires --slice (exit 3). A root
 build or autocomplete bundle (no --role, no --slice) defaults to --slice
-<active_slice> when state.md names one present in tasks.md; --whole opts out.
+<active_slice> when state.md names one present in tasks.md, unless
+.devrites/AFK max_parallel is 2 or more or a parallel lease is running
+(the bundle stays whole so the other slices stay visible); --whole opts out.
 --recheck <inventory> (phase build, with --role and --slice) builds a
 bounded recheck bundle: the inventory file (relative to the workspace)
 and core.md are inlined; every other pack file becomes a by-reference
@@ -91,10 +93,11 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 			return 2
 		}
 	}
-	// The root's own build/autocomplete bundle holds one slice at a time;
-	// whole tasks/plan/decisions ride every later turn otherwise.
+	// One active slice per bundle, except a parallel batch: the root has to
+	// see the other slices to start them. Whole tasks/plan/decisions ride
+	// that batch's turns; serial runs stay scoped.
 	autoScope := false
-	if featureDir != "" && opts.role == "" && opts.slice == "" && !opts.whole && (opts.phase == "build" || opts.phase == "autocomplete") {
+	if featureDir != "" && opts.role == "" && opts.slice == "" && !opts.whole && (opts.phase == "build" || opts.phase == "autocomplete") && !parallelPlanVisible(root, opts.slug) {
 		if id := activeSliceScope(featureDir); id != "" {
 			opts.slices, opts.slice, autoScope = []string{id}, id, true
 		}

package/engine/internal/lib/dispatch.go

@@ -57,9 +57,11 @@ which keys its --result findings on that slice. A --result file may already
 be the packets/ path; it is then kept as the stored return. Every 5 rounds of one kind on one slice, the
 next open is blocked until --reslice-review names a drift.md
 "## <DRIFT-ID>" heading for that slice. Under .devrites/AFK max_parallel >= 2,
-a first-round build wright wave narrower than the parallel select --from-plan
-batch is blocked until evidence.md records "serial: <skipped ids> — <reason>";
-repair rounds and lease siblings are never blocked.
+a build wright wave that leaves parallel select --from-plan picks unstarted is
+blocked until evidence.md records "serial: <skipped ids> — <reason>". A repair
+round or a running lease slice does not waive those picks. A wave naming two
+or more slices needs one slice-wright.<SLICE-ID> role per slice; one shared
+role has one handle, so the other slices never start. HITL is never width-blocked.
 
 Root-edit tripwire (ADR-0038): the first open records tree-baseline.json
 (dirty product paths outside .devrites/ and .scratch/, accepted as user work);
@@ -742,7 +744,6 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 		}
 	}
 	var lines, overCap []string
-	firstRound := true
 	for _, id := range w.Slices {
 		prior, reviews := 0, 0
 		var unreturned []string
@@ -762,7 +763,6 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 			}
 		}
 		round := prior + 1
-		firstRound = firstRound && prior == 0
 		if round > wrightRoundsPerReview*(1+reviews) {
 			overCap = append(overCap, id)
 		}
@@ -780,7 +780,11 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 			fmt.Fprintf(stderr, "dispatch: --reslice-review given but no slice has reached its %d-round cap\n", wrightRoundsPerReview)
 			return nil, 2
 		}
-		if kind == "wright" && firstRound {
+		if kind == "wright" {
+			if refusal := wrightFanoutRefusal(w); refusal != "" {
+				fmt.Fprintln(stderr, refusal)
+				return nil, 3
+			}
 			if refusal := widerBatchRefusal(root, slug, w.Slices); refusal != "" {
 				fmt.Fprintln(stderr, refusal)
 				return nil, 3
@@ -816,36 +820,88 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 }
 
 // serialRecordRe matches an evidence.md `serial: <ids> — <reason>` record
-// (the reason may open with a code span, never be empty); group 1 holds the ids.
-var serialRecordRe = regexp.MustCompile("(?mi)^[ \\t]*(?:[-*][ \\t]+)?`?serial:([^\\n]*?)(?:[ \\t]*[—–]|[ \\t]+--?[ \\t])[ \\t]*(?:[^\\s`]|`[^\\s`])")
+// (the reason may open with a code span, never be empty). Group 1 holds the
+// ids; group 2 holds the reason.
+var serialRecordRe = regexp.MustCompile("(?mi)^[ \\t]*(?:[-*][ \\t]+)?`?serial:([^\\n]*?)(?:[ \\t]*[—–]|[ \\t]+--?[ \\t])[ \\t]*([^\\s`][^\\n]*|`[^\\s`][^\\n]*)")
+
+// A repair, an open wave, or "already started" is not a shared surface.
+// Those reasons do not waive a pick unless they also name a path.
+var transientSerialReasonRe = regexp.MustCompile(`(?i)\b(?:repairs?|repairing|repaired|already started|in flight|open wave|sealed wave|running lease|in the lease)\b`)
+var serialSurfaceRe = regexp.MustCompile("`[^`\\n]*\\.[^`\\n]+`|(?i)\\b[\\w./-]+\\.[a-z0-9]+\\b")
+
+func serialReasonWaives(reason string) bool {
+	if transientSerialReasonRe.MatchString(reason) && !serialSurfaceRe.MatchString(reason) {
+		return false
+	}
+	return true
+}
 
 var sliceTokenRe = regexp.MustCompile(`(?i)\bSLICE-\d+\b`)
 
-// widerBatchRefusal refuses a first-round AFK build wright wave when
-// `parallel select --from-plan` picks more slices than the wave holds and
-// evidence.md has no `serial:` record naming each skipped pick. HITL runs,
-// lease siblings, slices the plan does not list as eligible, and selection
-// errors are never refused: the check widens batches, it never stops a build.
+// wrightFanoutRefusal refuses a build wright wave that names several slices
+// but not one slice-wright role per slice. One role has one host handle, so
+// the other slices would never start.
+func wrightFanoutRefusal(w *dispatchWave) string {
+	if len(w.Slices) < 2 {
+		return ""
+	}
+	lanes := map[string]bool{}
+	bare := 0
+	for role := range w.Roles {
+		if roleBase(role) != "slice-wright" {
+			continue
+		}
+		lane, ok := wrightLane(role)
+		if !ok {
+			bare++
+			continue
+		}
+		lanes[sliceNumber(lane)] = true
+	}
+	if bare > 0 || len(lanes) != len(w.Slices) {
+		return fmt.Sprintf("dispatch: BLOCKED: %d slices need one `--role slice-wright.<SLICE-ID>` each so every writer gets a handle; one shared slice-wright role starts only one agent", len(w.Slices))
+	}
+	for _, id := range w.Slices {
+		if !lanes[sliceNumber(id)] {
+			return fmt.Sprintf("dispatch: BLOCKED: %s has no `--role slice-wright.%s`", id, id)
+		}
+	}
+	return ""
+}
+
+// wrightLane is the SLICE-### suffix of a slice-wright.<SLICE-ID> role.
+func wrightLane(role string) (string, bool) {
+	base, lane, ok := strings.Cut(strings.TrimPrefix(role, "devrites-"), ".")
+	if !ok || base != "slice-wright" || !state.ValidSliceID(lane) {
+		return "", false
+	}
+	return lane, true
+}
+
+// widerBatchRefusal refuses an AFK build wright wave when
+// `parallel select --from-plan` still picks slices this wave does not start
+// and evidence.md has no `serial:` record for each. A repair round or a
+// running lease slice does not waive those picks. HITL runs and selection
+// errors are never refused: the check widens the batch, it never stops a
+// wave that already starts every remaining pick.
 func widerBatchRefusal(root, slug string, wave []string) string {
 	capN := min(afkMaxParallel(root), parallel.MaxParallelSlices)
 	if capN < 2 {
 		return ""
 	}
-	eligible, batch, err := planBatch(root, slug, capN)
-	if err != nil || len(batch) <= len(wave) {
+	_, batch, err := planBatch(root, slug, capN)
+	if err != nil || len(batch) == 0 {
 		return ""
 	}
-	for _, id := range wave {
-		if !containsSlice(eligible, id) {
-			return ""
-		}
-	}
 	var recorded []string
 	if raw, err := readWorkspaceArtifact(root, slug, "evidence.md"); err == nil {
 		if visible, err := markdowntext.Structural(raw); err == nil {
 			raw = visible
 		}
 		for _, m := range serialRecordRe.FindAllStringSubmatch(string(raw), -1) {
+			if len(m) < 3 || !serialReasonWaives(m[2]) {
+				continue
+			}
 			recorded = append(recorded, sliceTokenRe.FindAllString(m[1], -1)...)
 		}
 	}
@@ -858,7 +914,7 @@ func widerBatchRefusal(root, slug string, wave []string) string {
 	if len(missing) == 0 {
 		return ""
 	}
-	return fmt.Sprintf("dispatch: BLOCKED: AFK max_parallel %d: `%s` picks %s, wider than this wave (%s); run that batch per rite-build/reference/parallel-batch.md (`parallel create`, then one wave with a --slice per sibling), or record `serial: %s — <shared surface or reason>` in evidence.md",
+	return fmt.Sprintf("dispatch: BLOCKED: AFK max_parallel %d: `%s` picks %s, wider than this wave (%s); start those picks (`parallel create`, or `parallel add` while a lease runs) and dispatch them, or record `serial: %s — <shared surface or reason>` in evidence.md",
 		capN, planSelectCommand(filepath.Dir(root), slug, capN), strings.Join(batch, ","), strings.Join(wave, ","), strings.Join(missing, ","))
 }
 

package/engine/internal/lib/taskgraph.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -195,10 +196,10 @@ func PrecheckSkips(root, slug, slice string, gateIDs []string) (map[string]strin
 	return skips, nil
 }
 
-// planReady lists, in plan order, the tasks.md slices state.md does not check
-// built whose dependencies it all checks built, each with its sliceWritePaths
-// plus its dependency manifest and lockfile when it declares external
-// dependencies. root is the .devrites directory.
+// planReady lists, in plan order, the tasks.md slices that are not built whose
+// dependencies are all built, each with its sliceWritePaths plus its dependency
+// manifest and lockfile when it declares external dependencies. root is the
+// .devrites directory.
 func planReady(root, slug string) ([]parallel.SlicePaths, error) {
 	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
 	if err != nil {
@@ -233,8 +234,11 @@ func planReady(root, slug string) ([]parallel.SlicePaths, error) {
 // builtWordRe marks a checked state.md item as a built checkpoint.
 var builtWordRe = regexp.MustCompile(`(?i)\bbuilt\b`)
 
-// builtSlices returns the slice numbers state.md checks built (`- [x] SLICE-004
-// built — <sha>`, or `- [x] Slice 4: <name> — built`), outside fenced examples.
+// builtSlices returns the slice numbers that are built, outside fenced examples.
+// A state.md checkbox (`- [x] SLICE-004 built — <sha>`, or `- [x] Slice 4:
+// <name> — built`) counts. So does an evidence.md heading that says that slice
+// was checkpointed and whose section has a `Checkpoint: <sha>` line — a missed
+// checkbox must not keep dependents out of the ready set.
 func builtSlices(root, slug string) (map[string]bool, error) {
 	raw, err := readWorkspaceArtifact(root, slug, "state.md")
 	if err != nil {
@@ -253,35 +257,86 @@ func builtSlices(root, slug string) (map[string]bool, error) {
 			built[strings.TrimLeft(m[1], "0")] = true
 		}
 	}
+	extra, err := evidenceBuilt(root, slug)
+	if err != nil {
+		return nil, err
+	}
+	for id := range extra {
+		built[id] = true
+	}
 	return built, nil
 }
 
-// manifestDenialRe is prose that says the slice adds no dependency.
-var manifestDenialRe = regexp.MustCompile(`(?i)\b(?:no new|no product|existing|already-admitted|already admitted|stdlib)\b`)
+var (
+	checkpointedHeadingRe = regexp.MustCompile(`(?i)\bcheckpointed\b`)
+	notCheckpointedRe     = regexp.MustCompile(`(?i)\bnot checkpointed\b|\bcheckpoint (?:refused|reverted|failed)\b`)
+	checkpointSHARe       = regexp.MustCompile(`(?m)^[ \t]*Checkpoint: [0-9a-fA-F]{7,40}\b`)
+)
+
+// evidenceBuilt reads evidence.md checkpoint sections. A missing file is none.
+func evidenceBuilt(root, slug string) (map[string]bool, error) {
+	raw, err := readWorkspaceArtifact(root, slug, "evidence.md")
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return map[string]bool{}, nil
+		}
+		return nil, err
+	}
+	masked, err := markdowntext.Structural(raw)
+	if err != nil {
+		return nil, fmt.Errorf("evidence.md: %w", err)
+	}
+	text := string(masked)
+	if strings.HasPrefix(text, "## ") {
+		text = "\n" + text
+	}
+	built := map[string]bool{}
+	for part := range strings.SplitSeq(text, "\n## ") {
+		heading, body, _ := strings.Cut(part, "\n")
+		var ids []string
+		for _, id := range sliceTokenRe.FindAllString(heading, -1) {
+			ids = append(ids, sliceNumber(id))
+		}
+		if len(ids) == 0 {
+			continue
+		}
+		if notCheckpointedRe.MatchString(heading) {
+			for _, id := range ids {
+				delete(built, id)
+			}
+			continue
+		}
+		if checkpointedHeadingRe.MatchString(heading) && checkpointSHARe.MatchString(body) {
+			for _, id := range ids {
+				built[id] = true
+			}
+		}
+	}
+	return built, nil
+}
 
 // A backtick name, module path, npm scope, or x.y.z pin. go.mod/go.sum is not a module path.
+// A toolchain version (Go 1.22.0) is not a package add.
 var (
-	backtickPkgRe  = regexp.MustCompile("`([^`]+)`")
-	modulePathRe   = regexp.MustCompile(`(?i)(?:[a-z0-9-]+\.)+[a-z]{2,}/[a-z0-9._@~+-]+`)
-	npmScopeRe     = regexp.MustCompile(`(?i)@[a-z0-9._-]+/[a-z0-9._-]+`)
-	versionPinRe   = regexp.MustCompile(`(?i)\bv?\d+\.\d+\.\d+\b`)
-	manifestHostRe = regexp.MustCompile(`(?i)\.(?:mod|sum|json|toml|yaml|yml|lock|lockb)$`)
+	backtickPkgRe      = regexp.MustCompile("`([^`]+)`")
+	modulePathRe       = regexp.MustCompile(`(?i)(?:[a-z0-9-]+\.)+[a-z]{2,}/[a-z0-9._@~+-]+`)
+	npmScopeRe         = regexp.MustCompile(`(?i)@[a-z0-9._-]+/[a-z0-9._-]+`)
+	versionPinRe       = regexp.MustCompile(`(?i)\bv?\d+\.\d+\.\d+\b`)
+	toolchainVersionRe = regexp.MustCompile(`(?i)\b(?:go|golang|node|bun|npm|pnpm|yarn|rustc|python|ruby|java)\s+v?\d+\.\d+\.\d+\b`)
+	manifestHostRe     = regexp.MustCompile(`(?i)\.(?:mod|sum|json|toml|yaml|yml|lock|lockb)$`)
 )
 
 // externalClaimsManifest reports whether External dependencies names a package
 // add, so parallel select reserves the nearest manifest. A none prefix does
-// not. shortcut: existing/no-new prose with no package coordinate does not
-// either; name the module, version, scope, or `package` when the slice edits one.
+// not. Prose with no module path, npm scope, `package`, or non-toolchain
+// version pin does not either. shortcut: name the package when the slice
+// edits a manifest; "Go 1.22.0" or "standard library" is not a package add.
 func externalClaimsManifest(external string) bool {
 	ext := strings.ToLower(strings.Trim(strings.TrimSpace(external), "`"))
 	if ext == "" || ext == "-" || ext == "n/a" || strings.HasPrefix(ext, "none") {
 		return false
 	}
-	raw := strings.TrimSpace(external)
-	if manifestDenialRe.MatchString(raw) && !namesPackage(raw) {
-		return false
-	}
-	return true
+	return namesPackage(strings.TrimSpace(external))
 }
 
 // namesPackage reports a module path, version pin, npm scope, or `package`
@@ -293,7 +348,7 @@ func namesPackage(raw string) bool {
 			return true
 		}
 	}
-	if npmScopeRe.MatchString(raw) || versionPinRe.MatchString(raw) {
+	if npmScopeRe.MatchString(raw) || versionPinRe.MatchString(toolchainVersionRe.ReplaceAllString(raw, " ")) {
 		return true
 	}
 	for _, loc := range modulePathRe.FindAllStringIndex(raw, -1) {
@@ -396,6 +451,24 @@ func afkMaxParallel(root string) int {
 	return n
 }
 
+// parallelPlanVisible reports that the root must see every slice. An
+// unattended cap above 1, or a running parallel lease, is a batch: scoping
+// the bundle to active_slice hides the siblings that batch is supposed to start.
+func parallelPlanVisible(devritesRoot, slug string) bool {
+	if afkMaxParallel(devritesRoot) >= 2 {
+		return true
+	}
+	if slug == "" {
+		return false
+	}
+	path, err := parallel.LeasePath(filepath.Dir(devritesRoot), slug)
+	if err != nil {
+		return false
+	}
+	lease, err := parallel.ReadLease(path)
+	return err == nil && lease.Status == parallel.StatusRunning
+}
+
 func allDone(ids []string, done map[string]bool) bool {
 	for _, id := range ids {
 		if !done[id] {

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -169,9 +169,9 @@ named in the re-dispatch contract; changes outside task paths stop for the human
 
 ## Scale limits
 
-The role table bounds rosters. Use roughly four concurrent read-only reviewers,
-counting children any leaf spawned; eight only with disjoint paths/resources.
-Refuse unbounded swarms and role substitution: sharpen scope or use a bounded second pass when coverage is missing.
+The role table bounds rosters. Use up to ten concurrent read-only reviewers,
+the same cap as a writer batch, counting children any leaf spawned.
+Refuse a larger swarm and role substitution: sharpen scope or use a bounded second pass when coverage is missing.
 Overlapping reviewers increase duplicate findings and reconciliation work.
 
 ## Children are tools, not peers

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -8,7 +8,7 @@ Follow DevRites policy and [`depth profiles`](../orchestration-profiles.md).
 
 <!-- root-only -->
 - Root owns scope, questions/decisions/results, `.devrites/**`, phase transitions — not product source/tests; vetted executable workflow artifacts follow [`workflow-artifacts.md`](workflow-artifacts.md).
-- Every named role runs; unavailable → HITL, never skip/substitute.
+- Every named role runs; unavailable → HITL, never skip/substitute. `sequence_lookahead: yes` with no spawn tool defers the role, records the gap, and keeps planning. Not gate `access`, not a verdict. Admit the role before Build.
 <!-- /root-only -->
 - Among lifecycle `devrites-*` specialists, only bounded wright writes product
   source/tests; others inspect an immutable candidate. The independent `/rite-fast`
@@ -145,11 +145,8 @@ Basis: <files read · commands run to reach this finding>
   asks for is a Suggestion, however plausible. The `when` must also be reachable:
   a hostile actor enters only through a trust boundary the feature really has
   (users, network, external systems, untrusted files). A trigger that needs one it
-  never faces — the code under test forging its own evidence, a tampering second
-  user on a single-owner dev host, a swapped remote daemon under a local dev tool —
-  is a Suggestion too. So is an environment state the feature's declared
-  environment does not have (a mount option, kernel setting or daemon location
-  absent from the target host): guard against it only when the spec names it.
+  never faces — forged test evidence, a second user on a single-owner host, or a swapped local daemon —
+  is a Suggestion too. So is an undeclared host setting (mount, kernel, daemon path): guard it only when the spec names it.
   A finding never pulls a deferred slice's scope forward.
 - **`no-findings`:** `No-findings:` names checks and inspected evidence. Bare
   pass, empty list, or “looks good” is malformed.

package/pack/.claude/skills/devrites-lib/reference/standards/principles.md

@@ -47,10 +47,9 @@ unaudited.
 
 ## Gate
 
-At plan, build, review, and seal, compare the proposed or actual change with each
-in-scope principle. An unexcepted violation is a Critical finding and blocks the
-phase. A missing or empty principles file passes silently.
+At plan, build, review, and seal, compare the change with each in-scope principle.
+An unexcepted violation is Critical and blocks. A missing or empty file passes.
 
-Adding, changing, retiring, or excepting a principle is a deliberate human-owned
-decision recorded in the file's governance history. Agents may propose wording;
-they do not ratify it.
+Adding, changing, retiring, or excepting a principle is human-owned. Date it in
+the governance history. Agents do not ratify it. Comply by changing the spec.
+Ask for an exception only when the objective cannot be met without the violation.

package/pack/.claude/skills/rite-autocomplete/reference/decision-policy.md

@@ -39,4 +39,6 @@ recommended option stay human. A blocking question that already names option 1
 `(Recommended)` or `proposed:` is autocomplete's to resolve: pick that option
 via `devrites-engine state resolve` and continue. Recommended temper
 `expand` and extra acceptance are never auto-picked: they stop for a human through
-`AskUserQuestion`; do not invent product intent.
+`AskUserQuestion`; do not invent product intent. A principle
+conflict complies by changing the spec. Except a principle when the
+objective cannot be met without the violation.

package/pack/.claude/skills/rite-autocomplete/reference/lookahead.md

@@ -2,49 +2,32 @@
 
 > Root-only: not inlined in --role bundles.
 
-A second session plans the next sequence continuation while the active
-workspace builds, so the child's Spec → Vet overlaps its predecessor's
-Build → Seal. The main loop later resumes the planned child instead of
-specifying it again.
+Plans the next continuation while the active workspace builds. Spec → Vet
+overlaps the predecessor's Build → Seal.
 
 ## Start and target
 
-The operator starts the second host session with `/rite-autocomplete
---lookahead` once the `.devrites/ACTIVE` workspace is in Build or later. The
-agent never launches a session itself. The target is the next recorded
-continuation after the active workspace: the entry
-[sequence continuation](loop.md#sequence-continuation) would open. Stop with
-nothing to do when the active workspace is before Build, no entry remains,
-`continue_sequence: false`, or the sequence budget is spent.
+Start `/rite-autocomplete --lookahead` once `.devrites/ACTIVE` is in Build or later. The agent never launches a session. Target: the next continuation
+([sequence continuation](loop.md#sequence-continuation)). Stop when that workspace
+is before Build, no entry remains, `continue_sequence: false`, or the budget is spent.
 
 ## Lease
 
-Before any write, take the workspace lease:
+Before any write:
 `devrites-engine claim add --session lookahead-<target> --ttl 240 --workspace <target> --reason lookahead`.
-Exit 3 means another session holds the target: stop. Re-add the lease with the
-same session at each phase start, and release it with `devrites-engine claim
-release` on every stop. A crashed session's lease reads `dead` and frees itself.
+Exit 3: held, stop. Re-add the same session each phase. Release with `devrites-engine claim release` on stop. A `dead` lease frees itself.
 
 ## Rules
 
-- Never read or write `.devrites/ACTIVE`. Pass the target slug explicitly to every
-  skill and engine command, including `/rite-spec <target> "<objective>"` and
-  `devrites-engine handoff <target> --resume`.
+- Never read or write `.devrites/ACTIVE`. Pass the slug to `/rite-spec <target> "<objective>"` and `devrites-engine handoff <target> --resume`.
 - After the workspace exists, run `devrites-engine state set <target> sequence_lookahead=yes`.
-- Run Spec → Clarify → Temper → Define → Plan → Vet as the main loop does.
-  Define and Plan read the predecessor's current tree and plan. Record an
-  assumption for each predecessor interface the plan relies on.
-- At Vet, beside the readiness binding, record exactly one line
-  `Predecessor readiness: <active-slug> <digest>` in `eng-review.md`. `<digest>`
-  is the hex that `devrites-engine check readiness --emit-binding <active-slug>`
-  prints. When the predecessor later changes its planning inputs, the child's
-  readiness check blocks with `DRV-GATE-READINESS-STALE` and the main loop
-  re-vets the child before Build.
-- Never Build, never write product source or tests, never commit, and never
-  arm or rewrite `.devrites/AFK`. Owner questions go to the target's
-  `questions.md` and stop the lookahead.
-- Stop at Vet `READY` with `next_action: build after predecessor Seal GO`, at a
-  human gate, or when the target's lease is lost.
-
-**Failing case:** the lookahead passes Vet and starts Build while the
-predecessor is still sealing, so two root sessions write one tree.
+- Run Spec → Clarify → Temper → Define → Plan → Vet. Define and Plan read the predecessor tree and plan. Record one assumption per predecessor interface used.
+- At Vet record `Predecessor readiness: <active-slug> <digest>` in `eng-review.md` (the `--emit-binding` hex). A later planning change blocks `DRV-GATE-READINESS-STALE`; re-vet before Build.
+- Predecessor still in Build or later forbids only Build, product source, tests, commits, and `.devrites/AFK`. It does not skip Define, Plan, or Vet, and is not `awaiting_human`. Acceptance, scope, and irreversible risk still stop.
+- No spawn tool is not gate `access` or `awaiting_human`. Root writes Define and Plan. No Vet `READY` until those roles are admitted; else stop `running`, `next_action: /rite-vet`.
+- On every entry, re-read `state.md` and `questions.md`. Do not report a stop from chat. `continuation: clear` with `awaiting_human` is not done: fold resolved decisions into the spec, then continue. An except-principle or change-the-spec question complies: change the spec and resolve it. Ask only when the approved objective cannot comply.
+- Stop at Vet `READY` with `next_action: build after predecessor Seal GO`, at a real human gate, or when the lease is lost.
+
+**Failing case:** Vet then Build while the predecessor is still sealing, so two sessions write one tree. Or Define, Plan, and Vet skipped because the predecessor is still Build, or a missing strategy-reviewer spawn recorded as gate `access`.
+
+**Failing case:** stops to except a principle the spec can avoid.