devrites 7.2.7 → 7.3.0

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.0](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.8...v7.3.0) (2026-11-01)
+
+### Added
+
+* **devrites:** improve parallel throughput and proof integrity ([#203](https://github.com/ViktorsBaikers/DevRites/issues/203)) ([ac9c404](https://github.com/ViktorsBaikers/DevRites/commit/ac9c404908f3b709bfb76205aae0574e89bfcfe3))
+
+## Unreleased
+
+### Added
+
+- Pool independent, currently vetted continuation slices under one repository-wide
+  parallel controller, with rolling landings and refills across workspace sources.
+- Prune clean integrated worker checkouts without discarding transfer branches,
+  proof identities, retained lease rows, or running siblings.
+
+### Fixed
+
+- Recover exact recorded parallel landings after interrupted lease persistence;
+  preserve late worker edits, ignored data, extra commits, and missing-checkout
+  Git metadata during cleanup.
+- Exclude explicitly deferred slices from runnable work; stop inventing integration
+  suites from language manifests alone.
+- Verify cached context bytes and frozen review diffs, publish complete artifacts
+  atomically, and isolate concurrent freeze/render attempts.
+- Recover missing executed gate transcripts without rerunning valid scoped proof;
+  redact sensitive transcript metadata as well as command output.
+- Keep timed-out tests failed even when graceful termination exits successfully.
+- Support drive-qualified Windows paths in reviewer diff bindings.
+- Audit underfilled parallel frontiers through acceptance-preserving Plan/Vet;
+  separate independently provable capabilities without dropping producer, proof
+  or authority gates.
+
+## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
+
+### Fixed
+
+* **no-release:** close installer evidence and recovery integrity gaps ([#200](https://github.com/ViktorsBaikers/DevRites/issues/200)) ([edb8754](https://github.com/ViktorsBaikers/DevRites/commit/edb8754ecf80d4a0dd83590c5b346787c3647244))
+* **no-release:** select exact OMP specialists and preserve reviewer roles ([#199](https://github.com/ViktorsBaikers/DevRites/issues/199)) ([b31814a](https://github.com/ViktorsBaikers/DevRites/commit/b31814a37d80c45a27d5470ab5464cd93c91f76a))
+* **release:** publish pending installer fixes ([dfd2192](https://github.com/ViktorsBaikers/DevRites/commit/dfd2192d1b7d9da1b0111603760c5eb8f246b9a4))
+
 ## [7.2.7](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.6...v7.2.7) (2026-10-31)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.7`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.7): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -382,6 +382,11 @@ with `--force`; legacy manifests without hashes also require `--force`.
 `--force --dry-run` lists the exact destructive actions. Every settings and
 marker merge is checked before the first write, so a rejected merge (such as a
 Codex config that already sets top-level `default_permissions`) leaves the project untouched.
+Unmerges receive the same preflight: malformed settings or legacy hooks JSON
+blocks uninstall and dropped-host pruning, including dry runs, before writes.
+Existing files retain their permission bits. Claude permission ownership is
+recorded before settings replacement, so interrupted merges retain the records
+needed to remove installer-added grants on retry and uninstall.
 Marker-merged files keep user content outside the DevRites block, and
 `.devrites/` runtime state stays in place. `update` reuses the install flags
 recorded in the manifest; flags you pass explicitly win and are recorded. The installer refuses symlinks, junctions, and paths that

package/docs/candidate-integrity.md

@@ -116,6 +116,16 @@ Candidate and Seal. A mismatch stops; it is never reinterpreted as equivalent.
 Fresh literal `GO` and native host approval remain required for each disclosed
 Git attempt.
 
+## Concurrent workspaces
+
+Mixed-workspace execution shares a controller, not a candidate or proof ledger.
+Every landing uses `WIP(<source>):` and updates only that source's manifest and
+evidence. Interleaved child checkpoints do not authorize parent-only Ship to
+absorb unfinished child work. The deferred release waits for participating
+workspaces' final proof/Review/Seal, generates the recorded sequence's union
+manifest, and checks exact staged bytes and scope under fresh literal `GO`.
+Retained controller/source leases must be cleaned before archival.
+
 ## Older workspaces
 
 Released v1/v2/v3 unfinished workspaces use read-only `/rite-upgrade`. A missing

package/docs/cli.md

@@ -304,7 +304,7 @@ selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
 - Atomic state operations retain their documented operation-specific nonzero
   results.
 - `state close` exits `4` for usage or a missing workspace.
-- `state close` exits `3` for a schema refusal.
+- `state close` exits `3` for a schema refusal or a retained controller/source lease.
 - `state close` exits `5` when an archive already exists.
 - `state close` exits `1` for an invalid workspace, archive directory, or ACTIVE cursor.
 
@@ -313,6 +313,12 @@ selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
 `DEVRITES_ROOT` selects a project root or `.devrites/` directory.
 `DEVRITES_WORKSPACE` may select one explicit contained workspace. Mutating
 commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
+Explicit producer dependencies resolve safely within the selected `DEVRITES_ROOT`
+without changing or redirecting the consumer's workspace override.
+Global controller queries use explicit source slugs in a per-invocation environment
+without a worker's `DEVRITES_WORKSPACE`; conflicting overrides fail closed rather
+than redirecting another workspace's reads. Workspace parallelism keeps one
+controller lease and global writer capacity; it does not broaden Ship approval.
 
 Install, update application, and uninstall remain manifest-owned local
 operations. Direct engine update, shell, and npm may acquire a release candidate;

package/docs/command-map.md

@@ -50,6 +50,10 @@ The Go surface is intentionally closed and deterministic:
 | Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
 
+`state apply-bundle` merges workspace-relative path aliases into one target:
+`plan.md`, `./plan.md`, and `refs/../plan.md` share base pins and patch hunks.
+Conflicting replacements or base hashes block the entire bundle without writes.
+
 `devrites-engine help` exhaustively lists the operational engine commands.
 Standard `help`, `-h`, `--help`, `version`, and `--version` forms remain
 available; each operational command and subcommand also accepts `-h` / `--help`.
@@ -244,8 +248,11 @@ See [`flow.md`](flow.md) for the Mermaid diagrams. The text form is:
 only the exact-plan Ship approval boundary and never authorizes Git.
 ```
 
-- Every phase **reads the active workspace first**; if none, it stops and tells
-  the user to run `/rite-spec <feature>`.
+- Every phase resolves its explicit source workspace before the ACTIVE default.
+  Autocomplete keeps ACTIVE on the ordered lifecycle owner while preparing or
+  building authorized independent future slices through one global controller.
+  Existing `--parallel N` spans those workspaces; no second feature flag is needed.
+  See [cross-workspace admission](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md).
 - **Spec Drift Guard** lives in build/prove/polish/review/seal: on drift, stop,
   record in `drift.md`, and classify. Objective implementation and tool defects
   use bounded recovery; a wrong durable plan uses `/rite-plan repair`; only a

package/docs/engine/commands.md

@@ -17,8 +17,8 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies are built (state.md checkbox, or an evidence.md heading that says that slice was checkpointed plus a `Checkpoint: <sha>` line), with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (module path, npm scope, backticked name, or a non-toolchain version). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
-| `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
+| `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
 | `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
@@ -45,7 +45,7 @@ workflow strategy.
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
-| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
+| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` atomically publishes a private redacted v2 executed transcript, or returns its verified originating record unchanged, under `references/gates/<gate-id>/`; legacy v1/reuse-only logs cannot authorize reuse. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
 | `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
@@ -54,10 +54,17 @@ workflow strategy.
 | `migrate <slug> [--dry-run] [--answer id=choice]` | Normalize a pre-v5 workspace to the current schema; fail-closed, one-shot. |
 | `secret-scan [--staged] [--stdin] [slug]` | Scan exact staged blobs, stdin, or touched regular files for credential material. |
 | `open-visual <path-or-name> [--slug <slug>] [--no-open]` | Resolve a local visual HTML file, optionally open it in the OS browser, warn if the sibling outline is missing or inventory ids are absent from HTML, and print agent path tips. No network. |
-| `detect commands [--root <dir>] [--json]` | Resolve the repository's own test/lint/vet/build commands: explicit Makefile targets first, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager. Read-only, no installs, no execution. |
+| `detect commands [--root <dir>] [--json]` | Resolve the repository's own test/lint/vet/build commands: explicit Makefile targets first, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager. Integration stays unresolved without an explicit repository target or script; a language manifest does not prove a separate integration suite. Read-only, no installs, no execution. |
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
+For `context --role`, optional `devrites-` prefixes and `.lane` suffixes resolve
+the base specialist's contract, workspace read-set, and role-specific rules.
+The full label remains in bundle filenames and attribution. Reviewer
+`dispatch return` requires `--result <file>` or an explicit
+`--outcome findings|no-findings|gap`; omitting both refuses the return without
+changing the wave or releasing its claim. Non-reviewer returns are unchanged.
+
 `help`, `-h`, and `--help` print this operational inventory. Each operational
 command and subcommand also accepts `-h` / `--help` and prints that command's
 usage to stdout without requiring a workspace. `version` and `--version` print
@@ -66,6 +73,45 @@ engine has no compatibility aliases or tombstones. The `add`/`upgrade`/`remove`
 conveniences belong only to the `npx devrites` adapter, not to the engine
 command namespace.
 
+## State and evidence safety
+
+- `state set` resolves known cursor aliases before checking protected fields
+  and duplicate keys. Underscore variants cannot bypass phase, schema, or
+  saved-return-cursor protections; extension keys retain their spelling.
+- `state resolve` ignores fenced examples when matching and removing an
+  Awaiting-human section. Resolving another question leaves the live wait intact.
+- `state close` reads the physical `ACTIVE` pointer under the feature lock;
+  `DEVRITES_WORKSPACE` cannot make it clear another feature's pointer.
+- `gates run` and `reverify` snapshot every declared `INPUTS` dependency around
+  the actual shared CHECK execution, recheck during locked writeback, and
+  invalidate earlier passes if later checks move their inputs.
+  Missing or changed inputs cannot certify a pass. Execution, discarded-result,
+  or evidence-write failures exit `3`, even if an older ledger still reads met.
+- Parallel integration records exact landing intent before control FF. A matching
+  retry reconciles that landing once; external HEAD/ref movement still blocks.
+  Pending intent cannot be replaced or cleared through raw lease commands.
+  `prune` and normal/forced cleanup preserve late edits, ignored/untracked data,
+  unexpected worker tips and unknown checkouts rather than forcing their removal.
+  Missing registered checkouts retain their Git index and metadata; completed
+  cleanup releases the lease and reports recovery rather than discarding them.
+- Context cache reuse verifies the actual regular bundle bytes and private mode,
+  not the digest sidecar alone. Workspace sources are bounded and acquired once
+  per invocation; unsafe reads fail instead of becoming omitted guidance.
+  Managed output stays confined; explicit external `--out` remains supported.
+  Windows cannot prove POSIX owner-only mode through Go's `FileMode`; repeat
+  context requests rebuild instead of falsely certifying a private cache hit.
+- Frozen diff bytes must match their recorded SHA-256 at packet and dispatch
+  validation. Manually authored final reviewer packets may still name `.diff`
+  or `.patch` files, but must include `diff <64hex> <path>` binding rows.
+  Binding paths use `/` on every host, including drive-qualified Windows paths.
+  Same-wave freeze publication is serialized; each renderer owns its lint draft.
+- `gates run`/`reverify --transcripts` reuse only a complete passing executed
+  origin matching the gate definition, recorded output identity and declared
+  inputs. Missing origin reruns only affected approved checks; missing approval
+  blocks instead of borrowing an old checkbox. Valid redacted/truncated origins
+  remain reusable, with their historical candidate identity. Transcript metadata
+  and output are redacted; publication is atomic and private.
+
 ## Check boundary
 
 The candidate gate validates and hashes path/state/type/mode/content identity;

package/docs/orchestration.md

@@ -37,6 +37,15 @@ Skills name the exact role and bounded task in normal language. The host owns
 internal spawn fields, scheduling, waiting, follow-ups, and result delivery.
 DevRites does not parse rollout logs or maintain dispatch receipts.
 
+On OMP, each `task` item selects its specialist through `agent`, including every
+item in a `tasks[]` batch: `devrites-code-reviewer`, `devrites-test-analyst`, or
+`devrites-slice-wright` for those roles. Writing “you are…” in a task or naming it
+after a specialist does not select that profile. Lane suffixes stay on engine
+role labels, not native profile names. Check the actual host selector before
+admitting results: the engine records declared roles and host handles, not
+authenticated native profile identity. A missing profile remains a gap, not
+permission to select a generic/default child.
+
 Quick, Standard, and Full select evidence/review depth only; they are not agent
 API versions or execution tiers. The shared contract lives in
 [`orchestration-profiles.md`](../pack/.claude/skills/devrites-lib/reference/orchestration-profiles.md).
@@ -132,19 +141,32 @@ base before native transfer, then re-proves the reconciled candidate. Missing tr
 conflict, extra paths, moved base, or cleanup failure stops with worktree evidence
 preserved. No ad hoc copy/cherry-pick/merge occurs from the read-only root.
 
-Isolation does not authorize same-worktree throughput. Parallel writers are allowed
-**only** under the `/rite-build` batch path when path-disjoint eligibility, abort-batch,
-and a control `parallel-lease.md` apply. `--parallel N` on `/rite-autocomplete`
-or `/rite-build` is the batch cap for that run and wins over leftover sentinel
-`max_parallel`; `/rite-autocomplete --parallel N` also writes or replaces only
-that field. Absent the flag, the sentinel (default cap 10 under
-`/rite-autocomplete`) is a **cap**: the run fills it
-with the largest eligible set, lands each sibling as soon as its review and proof are
-green, refills the freed slot (`parallel add`), and repeats until no pending slice
-remains; a one-slice round is serial for that round only (see
-[`parallel-batch.md`](../pack/.claude/skills/rite-build/reference/parallel-batch.md)).
-Same-worktree multi-writer and root-emulated worktrees remain forbidden; default
-`/rite-build` stays one writer across linked worktrees.
+Parallel writers use the `/rite-build` worktree lifecycle: independently vetted
+contracts, disjoint declared/hidden write surfaces, one retained controller lease,
+and per-sibling review/proof before serialized integration. `--parallel N` on
+Autocomplete is one global active-writer cap across authorized sequence workspaces;
+without the flag it uses AFK `max_parallel`, retained lease capacity on resume,
+else 10. No additional user flag is needed. Standalone Build remains scoped to
+its requested workspace.
+
+While a writer runs, Autocomplete prepares or re-Vets recorded continuations and
+refills from the whole eligible pool. A future slice needs an explicit, current
+Plan/Vet `Workspace dependencies` declaration; absent or stale declarations never
+become independence merely because files differ. Only durable integrated producer
+checkpoints release dependent work. Human/access/safety gates retain their scope.
+
+Each worker keeps its source workspace identity, isolated cwd, candidate, proof,
+state and `WIP(<source>):` checkpoint. Even a lone initial writer is isolated when
+using a parallel-capable controller, so later work can refill without creating
+same-tree co-writers. Explicit `--parallel 1` remains one writer total. Unsupported
+host isolation falls back truthfully to serial execution.
+
+The controller drains and cleans its lease before non-lease product corrections,
+shared Polish writes or checkpoints; unrelated control commits are never blessed
+as a new expected tip. Final per-workspace proof/Seal and exact release-union Ship
+approval remain mandatory. See the
+[controller workflow](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md)
+and [worktree lifecycle](../pack/.claude/skills/rite-build/reference/parallel-batch.md).
 
 ## Engine boundary
 

package/docs/skills.md

@@ -194,6 +194,11 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
 
+Under Autocomplete, existing parallel capacity spans authorized sequence
+workspaces. It overlaps future planning/re-Vet with isolated, independently
+admitted writers; standalone Build stays scoped. See the
+[global controller](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md).
+
 ### Prove: collect evidence, including browser evidence
 
 | Skill | What It Does | Use When |

package/engine/internal/acceptance/cli.go

@@ -27,11 +27,13 @@ Subcommands:
   scaffold <slug>            Create gates.md from spec.md AC ids (only when absent)
   status <slug>              Reduce the ledger without executing; exit 3 unless ALL MET
   run <slug> [--timeout N] [--transcripts]
-                             Execute unmet runnable gates and record evidence
+                             Execute unmet gates; reuse unchanged INPUTS evidence
   reverify <slug> [--timeout N] [--transcripts]
-                             Re-execute every runnable gate, demoting stale passes
-                             (--transcripts writes one redacted, candidate-bound
-                             file per gate under references/gates/<gate-id>/)
+                             Re-run runnable gates except valid unchanged INPUTS proof
+                             --transcripts requires current approval and complete
+                             passing executed origins for reuse; recover missing
+                             origins by executing only affected approved gates.
+                             New private redacted records: references/gates/<gate-id>/
   lint <slug> [--strict]     Audit oracle quality without executing
   precheck <slug> --worktree <path> [--slice <SLICE-ID>]
                              Run every RUN: writer gate, then check windows, in
@@ -160,12 +162,12 @@ func cmdStatus(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
 		return ExitBlocked
 	}
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, false, stdout, stderr)
 }
 
 // reportStatus prints the stable greppable reduction. It returns ExitOK only
-// for a parse-clean ledger with every gate met and none abandoned.
-func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Writer) int {
+// for a parse-clean ledger with every gate met, none abandoned and no failed attempt.
+func reportStatus(slug, ledgerPath, testPlanPath string, attemptFailed bool, stdout, stderr io.Writer) int {
 	text, err := ReadLedgerFile(ledgerPath)
 	if err != nil {
 		fmt.Fprintf(stderr, "gates status: %v\n", err)
@@ -191,7 +193,7 @@ func reportStatus(slug, ledgerPath, testPlanPath string, stdout, stderr io.Write
 	case reduction.HandoffRequired():
 		fmt.Fprintln(stdout, "result: handoff")
 		return ExitBlocked
-	case !reduction.AllMet():
+	case attemptFailed || !reduction.AllMet():
 		fmt.Fprintln(stdout, "result: not-met")
 		return ExitBlocked
 	default:
@@ -263,12 +265,7 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, err)
 		return ExitBlocked
 	}
-	before := ""
-	if transcripts {
-		before = candidateLabel(root, slug)
-	}
-	var ran []GateResult
-	var ranDoc *Document
+	attemptFailed := false
 
 	// The gates lock serializes check execution; the feature lock is held only
 	// to read inputs and per writeback, so dispatch and other workspace writers
@@ -292,15 +289,33 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 			}
 			return nil
 		}
-		ran, ranDoc = RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock), doc
-		for _, result := range ran {
+		options := &RunOptions{WriteLock: featureLock}
+		before := ""
+		if transcripts {
+			options.TranscriptWork = work
+			before = candidateLabel(root, slug)
+		}
+		ran := RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, options)
+		for i, result := range ran {
+			if result.Ran && !result.Passed || result.Discarded || result.WriteErr != nil || transcripts && doc.Gates[i].Check != "" && !result.Passed {
+				attemptFailed = true
+			}
 			switch {
 			case !result.Ran:
-				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)
+				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", transcriptMetadata(result.ID), transcriptMetadata(result.Detail))
 			case result.Passed && !result.Discarded && result.WriteErr == nil:
-				fmt.Fprintf(stdout, "gate %s: pass\n", result.ID)
+				fmt.Fprintf(stdout, "gate %s: pass\n", transcriptMetadata(result.ID))
 			default:
-				fmt.Fprintf(stdout, "gate %s: fail (%s)\n", result.ID, result.Detail)
+				fmt.Fprintf(stdout, "gate %s: fail (%s)\n", transcriptMetadata(result.ID), transcriptMetadata(result.Detail))
+			}
+		}
+		if transcripts {
+			paths, err := writeTranscripts(work, doc, ran, before, candidateLabel(root, slug))
+			for _, path := range paths {
+				fmt.Fprintf(stdout, "transcript: %s\n", path)
+			}
+			if err != nil {
+				return fmt.Errorf("transcript: %w", err)
 			}
 		}
 		return nil
@@ -309,18 +324,8 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, lockErr)
 		return ExitBlocked
 	}
-	if transcripts && ranDoc != nil {
-		paths, err := writeTranscripts(work, ranDoc, ran, before, candidateLabel(root, slug))
-		for _, path := range paths {
-			fmt.Fprintf(stdout, "transcript: %s\n", path)
-		}
-		if err != nil {
-			fmt.Fprintf(stderr, "gates %s: transcript: %v\n", verb, err)
-			return ExitBlocked
-		}
-	}
 	fmt.Fprintln(stdout, "---")
-	return reportStatus(slug, ledgerPath, testPlanPath, stdout, stderr)
+	return reportStatus(slug, ledgerPath, testPlanPath, attemptFailed, stdout, stderr)
 }
 
 func cmdLint(root string, args []string, stdout, stderr io.Writer) int {

package/engine/internal/acceptance/preconditions.go

@@ -49,7 +49,7 @@ func PreflightRowsPassed(root, slug string, rows []PreflightRow) (bool, error) {
 // candidate but the lookup does not compare it: Vet writes workspace artifacts
 // after the run, and only a change to the row's command or cwd retires a pass.
 func PreflightPassed(work string, row PreflightRow) bool {
-	dir := filepath.Join(work, "references", "gates", unsafeNameRE.ReplaceAllString(PreflightGateID(row), "_"))
+	dir := filepath.Join(work, "references", "gates", transcriptGateName(PreflightGateID(row)))
 	entries, err := os.ReadDir(dir)
 	if err != nil {
 		return false