devrites 7.2.6 → 7.2.8

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
+
+### Fixed
+
+* **no-release:** close installer evidence and recovery integrity gaps ([#200](https://github.com/ViktorsBaikers/DevRites/issues/200)) ([edb8754](https://github.com/ViktorsBaikers/DevRites/commit/edb8754ecf80d4a0dd83590c5b346787c3647244))
+* **no-release:** select exact OMP specialists and preserve reviewer roles ([#199](https://github.com/ViktorsBaikers/DevRites/issues/199)) ([b31814a](https://github.com/ViktorsBaikers/DevRites/commit/b31814a37d80c45a27d5470ab5464cd93c91f76a))
+* **release:** publish pending installer fixes ([dfd2192](https://github.com/ViktorsBaikers/DevRites/commit/dfd2192d1b7d9da1b0111603760c5eb8f246b9a4))
+
+## [7.2.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.6...v7.2.7) (2026-10-31)
+
+### Fixed
+
+* **skills:** keep lookahead planning through false stops ([#192](https://github.com/ViktorsBaikers/DevRites/issues/192)) ([1185459](https://github.com/ViktorsBaikers/DevRites/commit/1185459e0477fe7fc9ee6b8e32e3ef315100ae15))
+
 ## [7.2.6](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.5...v7.2.6) (2026-10-31)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.6`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.6): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.2.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -382,6 +382,11 @@ with `--force`; legacy manifests without hashes also require `--force`.
 `--force --dry-run` lists the exact destructive actions. Every settings and
 marker merge is checked before the first write, so a rejected merge (such as a
 Codex config that already sets top-level `default_permissions`) leaves the project untouched.
+Unmerges receive the same preflight: malformed settings or legacy hooks JSON
+blocks uninstall and dropped-host pruning, including dry runs, before writes.
+Existing files retain their permission bits. Claude permission ownership is
+recorded before settings replacement, so interrupted merges retain the records
+needed to remove installer-added grants on retry and uninstall.
 Marker-merged files keep user content outside the DevRites block, and
 `.devrites/` runtime state stays in place. `update` reuses the install flags
 recorded in the manifest; flags you pass explicitly win and are recorded. The installer refuses symlinks, junctions, and paths that

package/SECURITY.md

@@ -218,13 +218,17 @@ hosts or their makers. codebase-memory-mcp, ego-lite, browser-harness, and
 Playwright MCP are optional user-selected tools that DevRites calls through
 their documented interfaces rather than bundling them.
 
-Repository npm-audit exceptions are temporary trust records, not claims that an
-upstream issue is fixed. Each entry in `scripts/npm-audit-exceptions.json` is
-restricted to an exact advisory, package range, installed node path, owner,
-reason, source, and near-term expiry; validation re-audits the live dependency
-graph and fails stale, broadened, unmatched, expired, or inside-the-7-day
-refresh-horizon entries. Prefer pinning a patched ancestor (see
-`package.json` `overrides`) over extending an expiry.
+Advisories whose only installed copy is inside the npm CLI tarball
+(`node_modules/npm/node_modules/`) are not blocking. Overrides cannot replace
+those copies, and the publish plugin cannot take a newer npm that still bundles
+them. The same advisory installed anywhere else still blocks. Any other
+npm-audit exception is a temporary trust record, not a claim that an upstream
+issue is fixed. Each entry in `scripts/npm-audit-exceptions.json` is restricted
+to an exact advisory, package range, installed node path, owner, reason, source,
+and near-term expiry; validation re-audits the live dependency graph and fails
+stale, broadened, unmatched, expired, or inside-the-7-day-refresh-horizon
+entries. Prefer pinning a patched ancestor (see `package.json` `overrides`)
+over extending an expiry.
 
 ### Agentic trust boundaries
 

package/docs/command-map.md

@@ -50,6 +50,10 @@ The Go surface is intentionally closed and deterministic:
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
 
+`state apply-bundle` merges workspace-relative path aliases into one target:
+`plan.md`, `./plan.md`, and `refs/../plan.md` share base pins and patch hunks.
+Conflicting replacements or base hashes block the entire bundle without writes.
+
 `devrites-engine help` exhaustively lists the operational engine commands.
 Standard `help`, `-h`, `--help`, `version`, and `--version` forms remain
 available; each operational command and subcommand also accepts `-h` / `--help`.

package/docs/engine/commands.md

@@ -17,7 +17,7 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies state.md checks `built`, with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (`none*`, existing, or no-new prose without a coordinate). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies are built (state.md checkbox, or an evidence.md heading that says that slice was checkpointed plus a `Checkpoint: <sha>` line), with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (module path, npm scope, backticked name, or a non-toolchain version). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
 | `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
@@ -37,8 +37,8 @@ workflow strategy.
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips; in Build also `eligible_now:`, `batch:` and the `select-command:` (`parallel select --root <project> --slug <slug> --cap N --from-plan`, N = AFK max_parallel else 10) that reproduces the batch. Prints `blocked: unattributed root edit: ...` after `open-questions:` and exits `3` while the ADR-0038 tripwire flags a product path; the rest of the output still prints. |
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
-| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a first-round build wright wave narrower than the `parallel select --from-plan` batch exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; repair rounds, lease siblings and HITL runs are never refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
+| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
 | `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
@@ -58,6 +58,13 @@ workflow strategy.
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
+the base specialist's contract, workspace read-set, and role-specific rules.
+The full label remains in bundle filenames and attribution. Reviewer
+`dispatch return` requires `--result <file>` or an explicit
+`--outcome findings|no-findings|gap`; omitting both refuses the return without
+changing the wave or releasing its claim. Non-reviewer returns are unchanged.
+
 `help`, `-h`, and `--help` print this operational inventory. Each operational
 command and subcommand also accepts `-h` / `--help` and prints that command's
 usage to stdout without requiring a workspace. `version` and `--version` print
@@ -66,6 +73,21 @@ engine has no compatibility aliases or tombstones. The `add`/`upgrade`/`remove`
 conveniences belong only to the `npx devrites` adapter, not to the engine
 command namespace.
 
+## State and evidence safety
+
+- `state set` resolves known cursor aliases before checking protected fields
+  and duplicate keys. Underscore variants cannot bypass phase, schema, or
+  saved-return-cursor protections; extension keys retain their spelling.
+- `state resolve` ignores fenced examples when matching and removing an
+  Awaiting-human section. Resolving another question leaves the live wait intact.
+- `state close` reads the physical `ACTIVE` pointer under the feature lock;
+  `DEVRITES_WORKSPACE` cannot make it clear another feature's pointer.
+- `gates run` and `reverify` snapshot every declared `INPUTS` dependency around
+  the actual shared CHECK execution, recheck during locked writeback, and
+  invalidate earlier passes if later checks move their inputs.
+  Missing or changed inputs cannot certify a pass. Execution, discarded-result,
+  or evidence-write failures exit `3`, even if an older ledger still reads met.
+
 ## Check boundary
 
 The candidate gate validates and hashes path/state/type/mode/content identity;

package/docs/orchestration.md

@@ -37,6 +37,15 @@ Skills name the exact role and bounded task in normal language. The host owns
 internal spawn fields, scheduling, waiting, follow-ups, and result delivery.
 DevRites does not parse rollout logs or maintain dispatch receipts.
 
+On OMP, each `task` item selects its specialist through `agent`, including every
+item in a `tasks[]` batch: `devrites-code-reviewer`, `devrites-test-analyst`, or
+`devrites-slice-wright` for those roles. Writing “you are…” in a task or naming it
+after a specialist does not select that profile. Lane suffixes stay on engine
+role labels, not native profile names. Check the actual host selector before
+admitting results: the engine records declared roles and host handles, not
+authenticated native profile identity. A missing profile remains a gap, not
+permission to select a generic/default child.
+
 Quick, Standard, and Full select evidence/review depth only; they are not agent
 API versions or execution tiers. The shared contract lives in
 [`orchestration-profiles.md`](../pack/.claude/skills/devrites-lib/reference/orchestration-profiles.md).

package/engine/internal/acceptance/cli.go

@@ -160,12 +160,12 @@ func cmdStatus(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
 		return ExitBlocked
 	}
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, false, stdout, stderr)
 }
 
 // reportStatus prints the stable greppable reduction. It returns ExitOK only
-// for a parse-clean ledger with every gate met and none abandoned.
-func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Writer) int {
+// for a parse-clean ledger with every gate met, none abandoned and no failed attempt.
+func reportStatus(slug, ledgerPath, testPlanPath string, attemptFailed bool, stdout, stderr io.Writer) int {
 	text, err := ReadLedgerFile(ledgerPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
@@ -191,7 +191,7 @@ func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Write
 	case reduction.HandoffRequired():
 		fmt.Fprintln(stdout, "result: handoff")
 		return ExitBlocked
-	case !reduction.AllMet():
+	case attemptFailed || !reduction.AllMet():
 		fmt.Fprintln(stdout, "result: not-met")
 		return ExitBlocked
 	default:
@@ -269,6 +269,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 	}
 	var ran []GateResult
 	var ranDoc *Document
+	attemptFailed := false
 
 	// The gates lock serializes check execution; the feature lock is held only
 	// to read inputs and per writeback, so dispatch and other workspace writers
@@ -294,6 +295,9 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		}
 		ran, ranDoc = RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock), doc
 		for _, result := range ran {
+			if result.Ran && !result.Passed || result.Discarded || result.WriteErr != nil {
+				attemptFailed = true
+			}
 			switch {
 			case !result.Ran:
 				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)
@@ -320,7 +324,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		}
 	}
 	fmt.Fprintln(stdout, "---")
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, attemptFailed, stdout, stderr)
 }
 
 func cmdLint(root string, args []string, stdout, stderr io.Writer) int {

package/engine/internal/acceptance/run.go

@@ -28,7 +28,7 @@ type GateResult struct {
 	Ran       bool
 	Passed    bool
 	Detail    string // exit/match/timeout/approval diagnostic
-	Discarded bool   // result dropped: ledger changed under the run
+	Discarded bool   // result dropped: bound oracle or inputs changed during the run
 	WriteErr  error  // evidence writeback failed for a reason other than drift
 	Reused    bool   // met gate kept because its INPUTS are unchanged
 	Inputs    string // INPUTS content digest at run time, when declared
@@ -77,13 +77,24 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 // execute; writeResult re-verifies the gate's oracle before it writes.
 func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
 	var results []GateResult
-	outcomes := map[string]RunOutcome{}
-	spans := map[string][2]time.Time{}
-	write := func(gate *Gate, evidence string, checked bool) error {
-		if writeLock == nil {
-			return writeResult(ledgerPath, gate, evidence, checked)
+	executions := map[string]struct {
+		ran     bool
+		outcome RunOutcome
+		span    [2]time.Time
+		inputs  map[string]string
+	}{}
+	// Collect every dependent INPUTS spec before any shared command can run.
+	for _, gate := range doc.Gates {
+		if gate.Check == "" || gate.Inputs == "" {
+			continue
+		}
+		key := gate.Check + "\x00" + filepath.Join(root, filepath.FromSlash(gate.Cwd))
+		execution := executions[key]
+		if execution.inputs == nil {
+			execution.inputs = map[string]string{}
 		}
-		return writeLock(func() error { return writeResult(ledgerPath, gate, evidence, checked) })
+		execution.inputs[gate.Inputs] = ""
+		executions[key] = execution
 	}
 	for _, gate := range doc.Gates {
 		if _, abandoned := doc.Abandoned[gate.ID]; abandoned {
@@ -95,15 +106,15 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			continue
 		}
 		inputs := ""
-		if gate.Inputs != "" {
-			// An unreadable or unmatched spec yields "", which never matches, so the gate re-executes.
-			inputs, _ = InputsDigest(root, gate.Inputs)
-		}
 		if GateState(gate, doc) == StateMet {
 			if gate.Inputs == "" && !reverify {
 				results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "already met"})
 				continue
 			}
+			if gate.Inputs != "" {
+				// An unreadable or unmatched spec never matches recorded evidence.
+				inputs, _ = InputsDigest(root, gate.Inputs)
+			}
 			// A gate that declares INPUTS is reused, under run and reverify alike,
 			// exactly while the files it depends on are byte-identical; any change re-executes it.
 			if inputs != "" && inputs == recordedInputs(gate) {
@@ -120,36 +131,84 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Detail: err.Error()})
 			continue
 		}
-		cwd := root
-		if gate.Cwd != "" {
-			cwd = filepath.Join(root, filepath.FromSlash(gate.Cwd))
-		}
+		cwd := filepath.Join(root, filepath.FromSlash(gate.Cwd))
 		key := gate.Check + "\x00" + cwd
-		outcome, ran := outcomes[key]
-		if !ran {
+		execution := executions[key]
+		if !execution.ran {
+			for spec := range execution.inputs {
+				execution.inputs[spec], _ = InputsDigest(root, spec)
+			}
 			started := time.Now().UTC()
-			outcome = Execute(ctx, gate.Check, cwd, timeout)
-			outcomes[key] = outcome
-			spans[key] = [2]time.Time{started, time.Now().UTC()}
-		}
-		span := spans[key]
-		if outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output) {
-			evidence := withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
-			writeErr := write(gate, evidence, true)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true, Passed: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, "pass"),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			execution.outcome = Execute(ctx, gate.Check, cwd, timeout)
+			execution.span = [2]time.Time{started, time.Now().UTC()}
+			for spec, before := range execution.inputs {
+				after, _ := InputsDigest(root, spec)
+				if after != before {
+					execution.inputs[spec] = ""
+				}
+			}
+			execution.ran = true
+			executions[key] = execution
+		}
+		outcome := execution.outcome
+		inputs = execution.inputs[gate.Inputs]
+		passed := outcome.Err == nil && outcome.ExitCode == 0 && expectation.Matches(outcome.Output)
+		detail := "pass"
+		if !passed {
+			detail = failDetail(outcome, expectation)
+		}
+		write := func() error {
+			if passed && gate.Inputs != "" {
+				// Earlier writebacks may have moved files since execution.
+				current, _ := InputsDigest(root, gate.Inputs)
+				if inputs == "" || current != inputs {
+					passed = false
+					detail = "INPUTS changed or could not be read during the run"
+				}
+			}
+			evidence := "pending"
+			if passed {
+				evidence = withInputs(FormatEvidence(gate, OutputDigest(outcome.Output), outcome.OutputBytes, time.Now().UTC().Format(time.RFC3339)), inputs)
+			}
+			return writeResult(ledgerPath, gate, evidence, passed)
+		}
+		var writeErr error
+		if writeLock == nil {
+			writeErr = write()
+		} else {
+			writeErr = writeLock(write)
+		}
+		results = append(results, GateResult{
+			ID: gate.ID, Ran: true, Passed: passed,
+			Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
+			Detail: resultDetail(writeErr, detail),
+			Inputs: inputs, Outcome: outcome, Started: execution.span[0], Ended: execution.span[1],
+		})
+	}
+	// Later checks may invalidate an earlier execution or reused pass.
+	for i, gate := range doc.Gates {
+		result := &results[i]
+		if !result.Passed || result.Discarded || result.WriteErr != nil || gate.Inputs == "" {
+			continue
+		}
+		validate := func() error {
+			current, _ := InputsDigest(root, gate.Inputs)
+			if current != "" && current == result.Inputs {
+				return nil
+			}
+			result.Passed, result.Reused, result.Discarded = false, false, true
+			result.Detail = "INPUTS changed or could not be read after a later check"
+			return writeResult(ledgerPath, gate, "pending", false)
+		}
+		var err error
+		if writeLock == nil {
+			err = validate()
 		} else {
-			writeErr := write(gate, "pending", false)
-			results = append(results, GateResult{
-				ID: gate.ID, Ran: true,
-				Discarded: errors.Is(writeErr, ErrOracleMoved), WriteErr: writeErr,
-				Detail: resultDetail(writeErr, failDetail(outcome, expectation)),
-				Inputs: inputs, Outcome: outcome, Started: span[0], Ended: span[1],
-			})
+			err = writeLock(validate)
+		}
+		if err != nil {
+			result.WriteErr = err
+			result.Detail = resultDetail(err, result.Detail)
 		}
 	}
 	return results

package/engine/internal/devritespaths/paths.go

@@ -194,14 +194,19 @@ func checkedCanonicalDir(root, candidate, parent, slug string) (string, error) {
 	return filepath.Clean(candidate), nil
 }
 
-// ActiveSlug reads and trims the active-feature pointer. A missing pointer file
-// is not an error; it yields the empty slug.
+// ActiveSlug resolves the workspace override, or reads the active-feature pointer.
+// A missing pointer file is not an error; it yields the empty slug.
 func ActiveSlug(root string) (string, error) {
 	if ws, err := WorkspaceOverrideChecked(root, ""); err != nil {
 		return "", err
 	} else if ws != "" {
 		return filepath.Base(ws), nil
 	}
+	return PhysicalActiveSlug(root)
+}
+
+// PhysicalActiveSlug reads the validated ACTIVE pointer without workspace overrides.
+func PhysicalActiveSlug(root string) (string, error) {
 	activePath := filepath.Join(root, "ACTIVE")
 	if info, err := os.Lstat(activePath); err == nil && info.Mode()&os.ModeSymlink != 0 {
 		return "", fmt.Errorf("DRV-ACTIVE-SYMLINK: ACTIVE is a symlink; run `rm -f %q`", activePath)

package/engine/internal/install/apply.go

@@ -231,6 +231,11 @@ func (r *runner) writeConfined(dest string, data []byte, perm fs.FileMode) error
 		return err
 	}
 	defer func() { _ = root.Close() }()
+	if info, err := root.Stat(rel); err == nil {
+		perm = info.Mode().Perm()
+	} else if !os.IsNotExist(err) {
+		return err
+	}
 	return fsutil.WriteFileAtomicIn(root, rel, data, perm)
 }
 

package/engine/internal/install/merge.go

@@ -17,11 +17,18 @@ import (
 )
 
 func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
+	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, claudeSettingsMarkerText(state))
+}
+
+func claudeSettingsMarkerText(state claudeSettingsMerge) string {
 	var b strings.Builder
 	b.WriteString(hostpack.ClaudeSettingsMerge.MarkerText + "\n" + claudeRulesAddedLine)
 	if state.created {
 		b.WriteString("\n" + claudeSettingsCreatedLine)
 	}
+	if state.defaultModeOwned {
+		b.WriteString("\ndefault-mode=added")
+	}
 	rules := make([]string, 0, len(state.added))
 	for rule := range state.added {
 		rules = append(rules, rule)
@@ -30,7 +37,7 @@ func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
 	for _, rule := range rules {
 		b.WriteString("\nrule:" + rule)
 	}
-	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, b.String())
+	return b.String()
 }
 
 const (
@@ -364,16 +371,45 @@ func (r *runner) mergeClaudeSettings(merge hostpack.JSONMerge) error {
 		return fmt.Errorf("encode merged Claude settings: %w", err)
 	}
 	data = append(data, '\n')
+	// Publish ownership before grants; keep retired ownership until settings land.
+	pending := r.pendingClaudeSettingsOwnership(state)
+	if err := r.installClaudeSettingsMarker(pending); err != nil {
+		return err
+	}
+	if r.records[merge.MarkerRel] == "" {
+		return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", merge.TargetRel, merge.MarkerRel)
+	}
+	if err := r.recheckPath(merge.TargetRel); err != nil {
+		return err
+	}
 	if err := r.writeConfined(dest, data, 0o644); err != nil {
 		return fmt.Errorf("cannot write %s: %w", merge.TargetRel, err)
 	}
-	return r.installClaudeSettingsMarker(state)
+	if pending.defaultModeOwned || len(pending.added) != len(state.added) {
+		if err := r.refreshPreflight(merge.MarkerRel); err != nil {
+			return err
+		}
+		return r.installClaudeSettingsMarker(state)
+	}
+	return nil
 }
 
 // claudeSettingsMerge is what the settings marker records about a merge.
 type claudeSettingsMerge struct {
-	created bool
-	added   map[string]bool
+	created          bool
+	added            map[string]bool
+	defaultModeOwned bool
+}
+
+func (r *runner) pendingClaudeSettingsOwnership(next claudeSettingsMerge) claudeSettingsMerge {
+	pending := claudeSettingsMerge{
+		created: next.created, added: r.managedClaudePermissionRules(),
+		defaultModeOwned: r.claudeDefaultModeOwned(),
+	}
+	for rule := range next.added {
+		pending.added[rule] = true
+	}
+	return pending
 }
 
 // claudeSettingsNext returns the merged .claude/settings.json without
@@ -433,6 +469,12 @@ func stripHooksWith(path string, write func([]byte) error, remove func() error)
 }
 
 func (r *runner) stripClaudeSettings(path string) error {
+	return r.stripClaudeSettingsWith(path, func(data []byte) error {
+		return r.writeConfined(path, data, 0o644)
+	}, func() error { return r.removeConfined(path) })
+}
+
+func (r *runner) stripClaudeSettingsWith(path string, write func([]byte) error, remove func() error) error {
 	current, err := readJSON(path)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
@@ -442,14 +484,14 @@ func (r *runner) stripClaudeSettings(path string) error {
 	}
 	next := stripDevritesSettings(current, r.claudeDefaultModeOwned(), r.managedClaudePermissionRules())
 	if len(next) == 0 && r.claudeSettingsCreated() {
-		return r.removeConfined(path)
+		return remove()
 	}
 	data, err := json.MarshalIndent(next, "", "  ")
 	if err != nil {
 		return fmt.Errorf("encode Claude settings: %w", err)
 	}
 	data = append(data, '\n')
-	return r.writeConfined(path, data, 0o644)
+	return write(data)
 }
 
 func (r *runner) stripMarkerConfined(path, begin, end string) error {

package/engine/internal/install/preflight.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,6 +23,7 @@ func (r *runner) preflightInstall() error {
 		return fmt.Errorf("preflight install paths: %w", err)
 	}
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for rel := range desired {
 		snapshot, err := r.rememberPath(rel)
 		if err != nil {
@@ -34,7 +36,8 @@ func (r *runner) preflightInstall() error {
 			}
 		}
 	}
-	for rel, record := range r.prev {
+	for _, rel := range slices.Sorted(maps.Keys(r.prev)) {
+		record := r.prev[rel]
 		if desired[rel] || hostpack.PreserveOnPrune(rel) {
 			continue
 		}
@@ -58,7 +61,7 @@ func (r *runner) preflightInstall() error {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
-			if err := dryRunStripMarker(map[string][]byte{}, r.target, merge); err != nil {
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
 				return err
 			}
 		}
@@ -104,19 +107,34 @@ func (r *runner) preflightMerges() error {
 			return fmt.Errorf("merge %s: %w", hostpack.CodexConfigMerge.TargetRel, err)
 		}
 	}
-	if _, _, err := r.claudeSettingsNext(); err != nil {
+	_, settings, err := r.claudeSettingsNext()
+	if err != nil {
 		return fmt.Errorf("seed claude settings: %w", err)
 	}
+	marker := hostpack.ClaudeSettingsMerge.MarkerRel
+	if snapshot := r.preflight[marker]; !snapshot.missing && !r.opts.Force {
+		if _, managed := r.prev[marker]; !managed {
+			text := claudeSettingsMarkerText(r.pendingClaudeSettingsOwnership(settings)) + "\n"
+			sum := sha256.Sum256([]byte(text))
+			if snapshot.hash != fmt.Sprintf("sha256:%x", sum[:]) {
+				return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", hostpack.ClaudeSettingsMerge.TargetRel, marker)
+			}
+		}
+	}
 	return nil
 }
 
 func (r *runner) preflightUninstall(entries []string) error {
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		if merge, ok := hostpack.ManagedMergeForMarker(rel); ok {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
+				return err
+			}
 		}
 		if !hostpack.ShouldRemoveOnUninstall(rel, entries) {
 			continue