devrites 7.2.7 → 7.3.0

package/engine/internal/install/merge.go

@@ -17,11 +17,18 @@ import (
 )
 
 func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
+	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, claudeSettingsMarkerText(state))
+}
+
+func claudeSettingsMarkerText(state claudeSettingsMerge) string {
 	var b strings.Builder
 	b.WriteString(hostpack.ClaudeSettingsMerge.MarkerText + "\n" + claudeRulesAddedLine)
 	if state.created {
 		b.WriteString("\n" + claudeSettingsCreatedLine)
 	}
+	if state.defaultModeOwned {
+		b.WriteString("\ndefault-mode=added")
+	}
 	rules := make([]string, 0, len(state.added))
 	for rule := range state.added {
 		rules = append(rules, rule)
@@ -30,7 +37,7 @@ func (r *runner) installClaudeSettingsMarker(state claudeSettingsMerge) error {
 	for _, rule := range rules {
 		b.WriteString("\nrule:" + rule)
 	}
-	return r.installMarker(hostpack.ClaudeSettingsMerge.MarkerRel, b.String())
+	return b.String()
 }
 
 const (
@@ -364,16 +371,45 @@ func (r *runner) mergeClaudeSettings(merge hostpack.JSONMerge) error {
 		return fmt.Errorf("encode merged Claude settings: %w", err)
 	}
 	data = append(data, '\n')
+	// Publish ownership before grants; keep retired ownership until settings land.
+	pending := r.pendingClaudeSettingsOwnership(state)
+	if err := r.installClaudeSettingsMarker(pending); err != nil {
+		return err
+	}
+	if r.records[merge.MarkerRel] == "" {
+		return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", merge.TargetRel, merge.MarkerRel)
+	}
+	if err := r.recheckPath(merge.TargetRel); err != nil {
+		return err
+	}
 	if err := r.writeConfined(dest, data, 0o644); err != nil {
 		return fmt.Errorf("cannot write %s: %w", merge.TargetRel, err)
 	}
-	return r.installClaudeSettingsMarker(state)
+	if pending.defaultModeOwned || len(pending.added) != len(state.added) {
+		if err := r.refreshPreflight(merge.MarkerRel); err != nil {
+			return err
+		}
+		return r.installClaudeSettingsMarker(state)
+	}
+	return nil
 }
 
 // claudeSettingsMerge is what the settings marker records about a merge.
 type claudeSettingsMerge struct {
-	created bool
-	added   map[string]bool
+	created          bool
+	added            map[string]bool
+	defaultModeOwned bool
+}
+
+func (r *runner) pendingClaudeSettingsOwnership(next claudeSettingsMerge) claudeSettingsMerge {
+	pending := claudeSettingsMerge{
+		created: next.created, added: r.managedClaudePermissionRules(),
+		defaultModeOwned: r.claudeDefaultModeOwned(),
+	}
+	for rule := range next.added {
+		pending.added[rule] = true
+	}
+	return pending
 }
 
 // claudeSettingsNext returns the merged .claude/settings.json without
@@ -433,6 +469,12 @@ func stripHooksWith(path string, write func([]byte) error, remove func() error)
 }
 
 func (r *runner) stripClaudeSettings(path string) error {
+	return r.stripClaudeSettingsWith(path, func(data []byte) error {
+		return r.writeConfined(path, data, 0o644)
+	}, func() error { return r.removeConfined(path) })
+}
+
+func (r *runner) stripClaudeSettingsWith(path string, write func([]byte) error, remove func() error) error {
 	current, err := readJSON(path)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
@@ -442,14 +484,14 @@ func (r *runner) stripClaudeSettings(path string) error {
 	}
 	next := stripDevritesSettings(current, r.claudeDefaultModeOwned(), r.managedClaudePermissionRules())
 	if len(next) == 0 && r.claudeSettingsCreated() {
-		return r.removeConfined(path)
+		return remove()
 	}
 	data, err := json.MarshalIndent(next, "", "  ")
 	if err != nil {
 		return fmt.Errorf("encode Claude settings: %w", err)
 	}
 	data = append(data, '\n')
-	return r.writeConfined(path, data, 0o644)
+	return write(data)
 }
 
 func (r *runner) stripMarkerConfined(path, begin, end string) error {

package/engine/internal/install/preflight.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,6 +23,7 @@ func (r *runner) preflightInstall() error {
 		return fmt.Errorf("preflight install paths: %w", err)
 	}
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for rel := range desired {
 		snapshot, err := r.rememberPath(rel)
 		if err != nil {
@@ -34,7 +36,8 @@ func (r *runner) preflightInstall() error {
 			}
 		}
 	}
-	for rel, record := range r.prev {
+	for _, rel := range slices.Sorted(maps.Keys(r.prev)) {
+		record := r.prev[rel]
 		if desired[rel] || hostpack.PreserveOnPrune(rel) {
 			continue
 		}
@@ -58,7 +61,7 @@ func (r *runner) preflightInstall() error {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
-			if err := dryRunStripMarker(map[string][]byte{}, r.target, merge); err != nil {
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
 				return err
 			}
 		}
@@ -104,19 +107,34 @@ func (r *runner) preflightMerges() error {
 			return fmt.Errorf("merge %s: %w", hostpack.CodexConfigMerge.TargetRel, err)
 		}
 	}
-	if _, _, err := r.claudeSettingsNext(); err != nil {
+	_, settings, err := r.claudeSettingsNext()
+	if err != nil {
 		return fmt.Errorf("seed claude settings: %w", err)
 	}
+	marker := hostpack.ClaudeSettingsMerge.MarkerRel
+	if snapshot := r.preflight[marker]; !snapshot.missing && !r.opts.Force {
+		if _, managed := r.prev[marker]; !managed {
+			text := claudeSettingsMarkerText(r.pendingClaudeSettingsOwnership(settings)) + "\n"
+			sum := sha256.Sum256([]byte(text))
+			if snapshot.hash != fmt.Sprintf("sha256:%x", sum[:]) {
+				return fmt.Errorf("cannot merge %s without owning %s; use --force to replace the marker", hostpack.ClaudeSettingsMerge.TargetRel, marker)
+			}
+		}
+	}
 	return nil
 }
 
 func (r *runner) preflightUninstall(entries []string) error {
 	var conflicts []string
+	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		if merge, ok := hostpack.ManagedMergeForMarker(rel); ok {
 			if _, err := r.rememberPath(merge.TargetRel); err != nil {
 				return err
 			}
+			if err := r.dryRunStripMarker(dryTree, merge); err != nil {
+				return err
+			}
 		}
 		if !hostpack.ShouldRemoveOnUninstall(rel, entries) {
 			continue

package/engine/internal/install/uninstall.go

@@ -35,18 +35,12 @@ func (r *runner) uninstall() error {
 		return err
 	}
 
-	// Per-path would-be content for a dry run; a nil value means the file
-	// would be removed.
-	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		merge, ok := hostpack.ManagedMergeForMarker(rel)
 		if !ok {
 			continue
 		}
 		if r.opts.DryRun {
-			if err := dryRunStripMarker(dryTree, r.target, merge); err != nil {
-				return err
-			}
 			fmt.Fprintf(r.opts.Stdout, "  [merge-remove] %s\n", merge.DryRun)
 			continue
 		}
@@ -142,11 +136,16 @@ func (r *runner) uninstall() error {
 // dryRunStripMarker runs the real marker strip against an in-memory view of
 // the target (tree), so a dry run follows the same sequence as the real
 // uninstall and reports the same errors without writing anything.
-func dryRunStripMarker(tree map[string][]byte, target string, merge hostpack.ManagedMerge) error {
-	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel || merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
-		return nil
+func (r *runner) dryRunStripMarker(tree map[string][]byte, merge hostpack.ManagedMerge) error {
+	path := filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))
+	write := func(data []byte) error { tree[path] = data; return nil }
+	remove := func() error { tree[path] = nil; return nil }
+	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
+		return stripHooksWith(path, write, remove)
+	}
+	if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
+		return r.stripClaudeSettingsWith(path, write, remove)
 	}
-	path := filepath.Join(target, filepath.FromSlash(merge.TargetRel))
 	data, seen := tree[path]
 	if !seen {
 		var err error

package/engine/internal/lib/apply_bundle.go

@@ -210,7 +210,12 @@ func collectBundleTargets(slug string, bundles []candidateBundle) ([]*bundleTarg
 		}
 		pins := map[string]string{}
 		for path, hash := range bundle.BaseHashes {
-			pins[strings.TrimPrefix(filepath.ToSlash(path), prefix)] = strings.ToLower(strings.TrimPrefix(strings.TrimSpace(hash), "sha256:"))
+			rel := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(filepath.ToSlash(path), prefix)))
+			pin := strings.ToLower(strings.TrimPrefix(strings.TrimSpace(hash), "sha256:"))
+			if previous, ok := pins[rel]; ok && previous != pin {
+				problems = append(problems, fmt.Sprintf("bundle %d %s: conflicting base hashes for the same file", bi+1, path))
+			}
+			pins[rel] = pin
 		}
 		for _, file := range bundle.CandidateFiles {
 			rel := strings.TrimPrefix(filepath.ToSlash(file.Path), prefix)
@@ -219,6 +224,7 @@ func collectBundleTargets(slug string, bundles []candidateBundle) ([]*bundleTarg
 				problems = append(problems, where+": path must be a Markdown file inside the "+slug+" workspace")
 				continue
 			}
+			rel = filepath.ToSlash(filepath.Clean(rel))
 			op := strings.ToLower(strings.TrimSpace(file.Operation))
 			switch op {
 			case "create", "replace":

package/engine/internal/lib/candidate.go

@@ -38,6 +38,7 @@ type candidateRow struct {
 	executable bool
 	size       int64
 	info       os.FileInfo
+	fileDigest string
 }
 
 type candidateIdentity struct {
@@ -72,7 +73,7 @@ func loadCandidateIdentity(root, slug string) (candidateIdentity, error) {
 	if err := validateCandidateRows(project, rows); err != nil {
 		return candidateIdentity{}, err
 	}
-	digest, err := hashCandidate(project, rows)
+	digest, err := hashCandidate(project, rows, false)
 	if err != nil {
 		return candidateIdentity{}, err
 	}
@@ -407,15 +408,18 @@ func candidatePathInfo(project, name string) (os.FileInfo, bool, error) {
 	return nil, false, errors.New("path is empty")
 }
 
-func hashCandidate(project string, rows []candidateRow) (string, error) {
+func hashCandidate(project string, rows []candidateRow, perFile bool) (string, error) {
 	digest := sha256.New()
 	writeCandidateField(digest, candidateDigestDomain)
 	writeCandidateField(digest, candidateDigestVersion)
 	writeCandidateField(digest, fmt.Sprintf("%d", len(rows)))
-	for _, row := range rows {
+	for i, row := range rows {
 		writeCandidateField(digest, row.state)
 		writeCandidateField(digest, row.path)
 		if row.state == "deleted" {
+			if err := validateCandidateRow(project, &row); err != nil {
+				return "", fmt.Errorf("candidate %q: %w", row.path, err)
+			}
 			writeCandidateField(digest, "absent")
 			writeCandidateField(digest, "0")
 			writeCandidateLength(digest, 0)
@@ -428,9 +432,18 @@ func hashCandidate(project string, rows []candidateRow) (string, error) {
 			writeCandidateField(digest, "0")
 		}
 		writeCandidateLength(digest, uint64(row.size)) // #nosec G115 -- validateCandidateRow bounds size to 0..64 MiB
-		if err := hashCandidateFile(digest, project, row); err != nil {
+		var writer io.Writer = digest
+		var fileDigest hash.Hash
+		if perFile {
+			fileDigest = sha256.New()
+			writer = io.MultiWriter(digest, fileDigest)
+		}
+		if err := hashCandidateFile(writer, project, row); err != nil {
 			return "", fmt.Errorf("candidate %q: %w", row.path, err)
 		}
+		if perFile {
+			rows[i].fileDigest = hex.EncodeToString(fileDigest.Sum(nil))
+		}
 	}
 	return hex.EncodeToString(digest.Sum(nil)), nil
 }
@@ -446,7 +459,7 @@ func writeCandidateLength(writer hash.Hash, size uint64) {
 	_, _ = writer.Write(encoded[:])
 }
 
-func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error {
+func hashCandidateFile(digest io.Writer, project string, row candidateRow) error {
 	if _, exists, err := candidatePathInfo(project, row.path); err != nil || !exists {
 		if err != nil {
 			return err
@@ -464,7 +477,7 @@ func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error
 	if err != nil {
 		return err
 	}
-	if !opened.Mode().IsRegular() || opened.Size() != row.size || (opened.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(row.info, opened) {
+	if !opened.Mode().IsRegular() || opened.Size() != row.size || (opened.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(row.info, opened) || !row.info.ModTime().Equal(opened.ModTime()) {
 		return errors.New("file changed size or type before reading")
 	}
 	written, err := io.CopyN(digest, file, row.size)
@@ -483,7 +496,7 @@ func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error
 	if err != nil {
 		return err
 	}
-	if !exists || !after.Mode().IsRegular() || after.Size() != row.size || (after.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(opened, after) || !os.SameFile(opened, current) {
+	if !exists || !after.Mode().IsRegular() || after.Size() != row.size || current.Size() != row.size || (after.Mode().Perm()&0o111 != 0) != row.executable || (current.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(opened, after) || !os.SameFile(opened, current) || !opened.ModTime().Equal(after.ModTime()) || !opened.ModTime().Equal(current.ModTime()) {
 		return errors.New("file changed size or type while reading")
 	}
 	return nil

package/engine/internal/lib/candidate_coverage.go

@@ -1,9 +1,7 @@
 package lib
 
 import (
-	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -118,7 +116,7 @@ func omissionError(omitted []string) error {
 		len(omitted), strings.Join(shown, ", "), more)
 }
 
-var diffPathRE = regexp.MustCompile(`[A-Za-z0-9_./@+-]+\.(?:diff|patch)\b`)
+var diffPathRE = regexp.MustCompile(`(?:[A-Za-z]:/)?[A-Za-z0-9_./@+-]+\.(?:diff|patch)\b`)
 
 // lintReviewCandidate gates a Review or Seal reviewer wave: the candidate
 // manifest must cover every path the feature's checkpoints changed, and the
@@ -128,20 +126,5 @@ func lintReviewCandidate(root, slug, packet string) error {
 	if err := CheckCandidateCoverage(root, slug); err != nil {
 		return err
 	}
-	raw, err := readBoundedRegularFile(packet, maxContractBytes)
-	if err != nil {
-		return fmt.Errorf("reviewer packet %s: %w", packet, err)
-	}
-	for _, name := range diffPathRE.FindAllString(string(raw), -1) {
-		for _, dir := range []string{projectDir(root), featureDir(root, slug), ""} {
-			candidate := name
-			if dir != "" {
-				candidate = filepath.Join(dir, filepath.FromSlash(name))
-			}
-			if info, err := os.Stat(candidate); err == nil && info.Mode().IsRegular() && info.Size() > 0 {
-				return nil
-			}
-		}
-	}
-	return errors.New("a Review or Seal reviewer packet must name the frozen candidate diff (an existing non-empty .diff or .patch file); reviewers cannot judge a digest alone")
+	return lintPacketDiffs(root, slug, packet, true)
 }

package/engine/internal/lib/closeout.go

@@ -10,6 +10,7 @@ import (
 	"runtime"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -62,11 +63,6 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	archDisplay := filepath.ToSlash(filepath.Join("archive", slug))
 	active := filepath.Join(dv, "ACTIVE")
 
-	activeSlug, err := devritespaths.ActiveSlug(dv)
-	if err != nil {
-		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
-		return 1
-	}
 	// A broken symlink at the destination still counts as "already there", so use
 	// Lstat rather than Stat to avoid silently overwriting it.
 	if _, err := os.Lstat(arch); err == nil {
@@ -83,11 +79,22 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	// re-create work/<slug>. Windows cannot rename a directory that holds an
 	// open file, so there the lock is released just before the rename.
 	code := 1
-	if err := state.WithFeatureLockRelease(dv, slug, func(release func()) error {
-		code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, activeSlug, slug, stdout, stderr)
-		return nil
+	if err := parallel.WithControlLock(dv, func() error {
+		leased, err := parallel.WorkspaceLeased(dv, slug)
+		if err != nil {
+			return err
+		}
+		if leased {
+			fmt.Fprintf(stderr, "state close: BLOCKED: %s is named by a retained parallel lease; finish and clean up the controller lease before archiving\n", slug)
+			code = 3
+			return nil
+		}
+		return state.WithFeatureLockRelease(dv, slug, func(release func()) error {
+			code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
+			return nil
+		})
 	}); err != nil {
-		fmt.Fprintf(stderr, "state close: cannot lock feature %s: %v\n", slug, err)
+		fmt.Fprintf(stderr, "state close: %v\n", err)
 		return 1
 	}
 	return code
@@ -96,7 +103,12 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 // closeOutLocked performs the rename and the conditional ACTIVE clear. It runs
 // under the feature lock held by CloseOut and reports an exit code rather than
 // an error, preserving CloseOut's documented exit codes.
-func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, activeSlug, slug string, stdout, stderr io.Writer) int {
+func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+	activeSlug, err := devritespaths.PhysicalActiveSlug(filepath.Dir(active))
+	if err != nil {
+		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
+		return 1
+	}
 	// Fail closed: if the move does not happen, leave the cursor alone and do not
 	// claim success: a lost audit trail must never look like a clean close-out.
 	if err := os.MkdirAll(archiveDir, 0o755); err != nil {

package/engine/internal/lib/context.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"crypto/sha256"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -80,7 +81,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	// A Build reviewer judges one slice; an unscoped bundle inlines whole
 	// plan/tasks/architecture into every dispatch.
-	if opts.phase == "build" && opts.role != "" && opts.role != "slice-wright" && opts.slice == "" {
+	if opts.phase == "build" && opts.role != "" && roleBase(opts.role) != "slice-wright" && opts.slice == "" {
 		fmt.Fprintf(stderr, "context: BLOCKED: unscoped build reviewer bundle: --role %s in phase build needs --slice <SLICE-ID>\n", opts.role)
 		return 3
 	}
@@ -93,12 +94,18 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 			return 2
 		}
 	}
+	sources := contextSources{dir: featureDir}
 	// One active slice per bundle, except a parallel batch: the root has to
 	// see the other slices to start them. Whole tasks/plan/decisions ride
 	// that batch's turns; serial runs stay scoped.
 	autoScope := false
 	if featureDir != "" && opts.role == "" && opts.slice == "" && !opts.whole && (opts.phase == "build" || opts.phase == "autocomplete") && !parallelPlanVisible(root, opts.slug) {
-		if id := activeSliceScope(featureDir); id != "" {
+		id, err := activeSliceScope(&sources)
+		if err != nil {
+			fmt.Fprintf(stderr, "context: %v\n", err)
+			return 2
+		}
+		if id != "" {
 			opts.slices, opts.slice, autoScope = []string{id}, id, true
 		}
 	}
@@ -110,10 +117,21 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	var inventory []byte
 	recheckPath := opts.recheck
 	if recheckPath != "" {
-		if !filepath.IsAbs(recheckPath) {
+		if filepath.IsAbs(recheckPath) {
+			absoluteFeature, absErr := filepath.Abs(featureDir)
+			if absErr != nil {
+				fmt.Fprintf(stderr, "context: --recheck: %v\n", absErr)
+				return 2
+			}
+			if rel, relErr := filepath.Rel(absoluteFeature, recheckPath); relErr == nil && filepath.IsLocal(rel) {
+				inventory, err = sources.read(rel)
+			} else {
+				inventory, err = readBoundedRegularFile(recheckPath, workspaceArtifactLimit)
+			}
+		} else {
+			inventory, err = sources.read(recheckPath)
 			recheckPath = filepath.Join(featureDir, filepath.FromSlash(recheckPath))
 		}
-		inventory, err = os.ReadFile(recheckPath) // #nosec G304 -- the root names its own recheck inventory file
 		if err == nil && len(bytes.TrimSpace(inventory)) == 0 {
 			err = fmt.Errorf("%s is empty", opts.recheck)
 		}
@@ -141,7 +159,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	var sliceBlock string
 	var sliceIDs []citedID
 	if opts.slice != "" {
-		raw, err := os.ReadFile(filepath.Join(featureDir, "tasks.md")) // #nosec G304 -- featureDir is the validated feature workspace
+		raw, err := sources.read("tasks.md")
 		if err != nil {
 			fmt.Fprintf(stderr, "context: %v\n", err)
 			return 2
@@ -238,12 +256,17 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	// The open findings lead a recheck bundle, before any reference text.
 	if inventory != nil {
-		writeContextEntry(&bundle, recheckPath, "recheck inventory: "+opts.recheck, seen, false)
+		writeContextData(&bundle, recheckPath, "recheck inventory: "+opts.recheck, inventory, nil, seen, false)
 		loaded++
 	}
 	var rootOnly []string
 	citedSections, packByReference := 0, 0
-	keepModel := opts.role == "" || keepModelSurface(opts.role, gatherTriggerFacts(root, featureDir, opts.role))
+	facts, err := gatherTriggerFacts(root, opts.role, &sources)
+	if err != nil {
+		fmt.Fprintf(stderr, "context: %v\n", err)
+		return 2
+	}
+	keepModel := opts.role == "" || keepModelSurface(opts.role, facts)
 	for _, rel := range files {
 		abs := filepath.Join(skillsRoot, filepath.FromSlash(rel))
 		if seen[abs] {
@@ -297,16 +320,21 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 		}
 		for _, rel := range workspaceList {
 			abs := filepath.Join(featureDir, filepath.FromSlash(rel))
+			data, err := sources.read(rel)
+			if err != nil && !errors.Is(err, os.ErrNotExist) {
+				fmt.Fprintf(stderr, "context: %v\n", err)
+				return 2
+			}
 			// Role bundles without --slice (full Vet, Review, Seal) read
 			// everything; root and --slice bundles take over-budget
 			// artifacts by anchor.
 			if opts.slice == "" && opts.role != "" {
-				if writeContextEntry(&bundle, abs, "workspace/"+rel, seen, false) {
+				if writeContextData(&bundle, abs, "workspace/"+rel, data, err, seen, false) {
 					loaded++
 				}
 				continue
 			}
-			ok, byRef := writeSliceEntry(&bundle, filepath.Dir(root), abs, "workspace/"+rel, opts.slice, sliceBlock, sliceIDs, seen)
+			ok, byRef := writeSliceEntry(&bundle, filepath.Dir(root), abs, "workspace/"+rel, data, err, opts.slice, sliceBlock, sliceIDs, seen)
 			if ok {
 				loaded++
 			}
@@ -322,34 +350,11 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	withTOC := insertSectionTOC(bundle.String())
 	bundle.Reset()
 	bundle.WriteString(withTOC)
-	out := opts.out
-	if out == "" {
-		out = filepath.Join(featureDir, "ctx", bundleName(opts))
-	} else if !filepath.IsAbs(out) && featureDir != "" {
-		out = filepath.Join(featureDir, filepath.FromSlash(out))
-	}
-	if err := os.MkdirAll(filepath.Dir(out), 0o755); err != nil {
+	out, unchanged, err := publishContext(featureDir, opts, []byte(bundle.String()))
+	if err != nil {
 		fmt.Fprintf(stderr, "context: %v\n", err)
 		return 2
 	}
-	digestPath := out + ".sha256"
-	digest := fmt.Sprintf("%x", sha256.Sum256([]byte(bundle.String())))
-	unchanged := false
-	if prev, err := os.ReadFile(digestPath); err == nil && strings.TrimSpace(string(prev)) == digest { // #nosec G304 -- digestPath is generated under the feature workspace
-		if _, err := os.Stat(out); err == nil {
-			unchanged = true
-		}
-	}
-	if !unchanged {
-		if err := os.WriteFile(out, []byte(bundle.String()), 0o600); err != nil {
-			fmt.Fprintf(stderr, "context: %v\n", err)
-			return 2
-		}
-		if err := os.WriteFile(digestPath, []byte(digest+"\n"), 0o600); err != nil {
-			fmt.Fprintf(stderr, "context: %v\n", err)
-			return 2
-		}
-	}
 	if opts.slug != "" {
 		phaseLabel := opts.phase
 		if phaseLabel == "" {
@@ -396,7 +401,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 			fmt.Fprintf(stdout, "triggers: auto=[%s] (fired by --role dispatch)\n",
 				strings.Join(autoTriggers, ","))
 		}
-		if suggested := suggestTriggers(manifest, root, featureDir, opts); len(suggested) > 0 {
+		if suggested := suggestTriggers(manifest, opts, facts); len(suggested) > 0 {
 			fmt.Fprintf(stdout, "triggers: suggested=[%s] (advisory — confirm each before use)\n",
 				strings.Join(suggested, ","))
 			// The advisory list is only actionable if the agent is told how to
@@ -455,7 +460,7 @@ func workspaceReadSet(manifest loadsManifest, role string) ([]string, bool) {
 	if role == "" {
 		return manifest.Workspace, false
 	}
-	if list, ok := manifest.WorkspaceByRole[role]; ok {
+	if list, ok := manifest.WorkspaceByRole[roleBase(role)]; ok {
 		return list, true
 	}
 	return manifest.Workspace, false
@@ -558,11 +563,10 @@ const sliceInlineMaxBytes = 16 << 10
 // other artifact but spec.md over sliceInlineMaxBytes as a by-reference index;
 // any canonical artifact over its line/byte budget as a by-reference index;
 // everything else whole.
-func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block string, ids []citedID, seen map[string]bool) (loaded, byRef bool) {
+func writeSliceEntry(bundle *strings.Builder, project, abs, label string, data []byte, err error, slice, block string, ids []citedID, seen map[string]bool) (loaded, byRef bool) {
 	if seen[abs] {
 		return false, false
 	}
-	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated feature workspace
 	name := filepath.Base(abs)
 	if err == nil && name == "tasks.md" && slice != "" {
 		seen[abs] = true
@@ -570,7 +574,7 @@ func writeSliceEntry(bundle *strings.Builder, project, abs, label, slice, block
 	} else if err == nil && slice != "" && name != "spec.md" && len(data) > sliceInlineMaxBytes {
 		seen[abs] = true
 	} else if status, ok := state.ArtifactBudget(name, data); err != nil || !ok || !status.Over {
-		return writeContextEntry(bundle, abs, label, seen, false), false
+		return writeContextData(bundle, abs, label, data, err, seen, false), false
 	} else {
 		seen[abs] = true
 	}
@@ -726,12 +730,19 @@ func clipRunes(s string, n int) string {
 }
 
 func writeContextEntry(bundle *strings.Builder, abs, label string, seen map[string]bool, expand bool) bool {
+	if seen[abs] {
+		return false
+	}
+	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated context source set
+	return writeContextData(bundle, abs, label, data, err, seen, expand)
+}
+
+func writeContextData(bundle *strings.Builder, abs, label string, data []byte, err error, seen map[string]bool, expand bool) bool {
 	if seen[abs] {
 		return false
 	}
 	seen[abs] = true
 	fmt.Fprintf(bundle, "===== %s =====\n", label)
-	data, err := os.ReadFile(abs) // #nosec G304 -- abs is resolved from the validated context source set
 	if err != nil {
 		fmt.Fprintf(bundle, "MISSING: %s\n\n", label)
 		return false
@@ -915,6 +926,7 @@ func parseLoadsManifest(text string) (loadsManifest, bool, error) {
 }
 
 func roleAgentPath(manifest loadsManifest, role string) string {
+	role = roleBase(role)
 	if manifest.Agents != nil {
 		if rel, ok := manifest.Agents[role]; ok {
 			return rel
@@ -925,20 +937,28 @@ func roleAgentPath(manifest loadsManifest, role string) string {
 
 // activeSliceScope is state.md's active_slice when it names a slice block in
 // tasks.md, else "" (unset, "none", or stale cursors keep the whole bundle).
-func activeSliceScope(featureDir string) string {
-	lines := strings.Split(string(readWorkspaceFile(featureDir, "state.md")), "\n")
+func activeSliceScope(sources *contextSources) (string, error) {
+	raw, err := sources.read("state.md")
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
+	}
+	lines := strings.Split(string(raw), "\n")
 	// active_slice outlives Build; after it the root's autocomplete bundle stays whole.
 	if phase, _ := state.CursorField(lines, state.CursorPhase); strings.TrimSpace(phase) != "build" {
-		return ""
+		return "", nil
 	}
 	id, _ := state.CursorField(lines, state.CursorActiveSlice)
 	if id = strings.TrimSpace(id); !state.ValidSliceID(id) {
-		return ""
+		return "", nil
+	}
+	tasks, err := sources.read("tasks.md")
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
 	}
-	if _, ok := state.ExtractTaskSlice(readWorkspaceFile(featureDir, "tasks.md"), id); !ok {
-		return ""
+	if _, ok := state.ExtractTaskSlice(tasks, id); !ok {
+		return "", nil
 	}
-	return id
+	return id, nil
 }
 
 func bundleName(opts contextOpts) string {