devrites 7.2.8 → 7.3.0

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.0](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.8...v7.3.0) (2026-11-01)
+
+### Added
+
+* **devrites:** improve parallel throughput and proof integrity ([#203](https://github.com/ViktorsBaikers/DevRites/issues/203)) ([ac9c404](https://github.com/ViktorsBaikers/DevRites/commit/ac9c404908f3b709bfb76205aae0574e89bfcfe3))
+
+## Unreleased
+
+### Added
+
+- Pool independent, currently vetted continuation slices under one repository-wide
+  parallel controller, with rolling landings and refills across workspace sources.
+- Prune clean integrated worker checkouts without discarding transfer branches,
+  proof identities, retained lease rows, or running siblings.
+
+### Fixed
+
+- Recover exact recorded parallel landings after interrupted lease persistence;
+  preserve late worker edits, ignored data, extra commits, and missing-checkout
+  Git metadata during cleanup.
+- Exclude explicitly deferred slices from runnable work; stop inventing integration
+  suites from language manifests alone.
+- Verify cached context bytes and frozen review diffs, publish complete artifacts
+  atomically, and isolate concurrent freeze/render attempts.
+- Recover missing executed gate transcripts without rerunning valid scoped proof;
+  redact sensitive transcript metadata as well as command output.
+- Keep timed-out tests failed even when graceful termination exits successfully.
+- Support drive-qualified Windows paths in reviewer diff bindings.
+- Audit underfilled parallel frontiers through acceptance-preserving Plan/Vet;
+  separate independently provable capabilities without dropping producer, proof
+  or authority gates.
+
 ## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.2.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.2.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/candidate-integrity.md

@@ -116,6 +116,16 @@ Candidate and Seal. A mismatch stops; it is never reinterpreted as equivalent.
 Fresh literal `GO` and native host approval remain required for each disclosed
 Git attempt.
 
+## Concurrent workspaces
+
+Mixed-workspace execution shares a controller, not a candidate or proof ledger.
+Every landing uses `WIP(<source>):` and updates only that source's manifest and
+evidence. Interleaved child checkpoints do not authorize parent-only Ship to
+absorb unfinished child work. The deferred release waits for participating
+workspaces' final proof/Review/Seal, generates the recorded sequence's union
+manifest, and checks exact staged bytes and scope under fresh literal `GO`.
+Retained controller/source leases must be cleaned before archival.
+
 ## Older workspaces
 
 Released v1/v2/v3 unfinished workspaces use read-only `/rite-upgrade`. A missing

package/docs/cli.md

@@ -304,7 +304,7 @@ selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
 - Atomic state operations retain their documented operation-specific nonzero
   results.
 - `state close` exits `4` for usage or a missing workspace.
-- `state close` exits `3` for a schema refusal.
+- `state close` exits `3` for a schema refusal or a retained controller/source lease.
 - `state close` exits `5` when an archive already exists.
 - `state close` exits `1` for an invalid workspace, archive directory, or ACTIVE cursor.
 
@@ -313,6 +313,12 @@ selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
 `DEVRITES_ROOT` selects a project root or `.devrites/` directory.
 `DEVRITES_WORKSPACE` may select one explicit contained workspace. Mutating
 commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
+Explicit producer dependencies resolve safely within the selected `DEVRITES_ROOT`
+without changing or redirecting the consumer's workspace override.
+Global controller queries use explicit source slugs in a per-invocation environment
+without a worker's `DEVRITES_WORKSPACE`; conflicting overrides fail closed rather
+than redirecting another workspace's reads. Workspace parallelism keeps one
+controller lease and global writer capacity; it does not broaden Ship approval.
 
 Install, update application, and uninstall remain manifest-owned local
 operations. Direct engine update, shell, and npm may acquire a release candidate;

package/docs/command-map.md

@@ -248,8 +248,11 @@ See [`flow.md`](flow.md) for the Mermaid diagrams. The text form is:
 only the exact-plan Ship approval boundary and never authorizes Git.
 ```
 
-- Every phase **reads the active workspace first**; if none, it stops and tells
-  the user to run `/rite-spec <feature>`.
+- Every phase resolves its explicit source workspace before the ACTIVE default.
+  Autocomplete keeps ACTIVE on the ordered lifecycle owner while preparing or
+  building authorized independent future slices through one global controller.
+  Existing `--parallel N` spans those workspaces; no second feature flag is needed.
+  See [cross-workspace admission](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md).
 - **Spec Drift Guard** lives in build/prove/polish/review/seal: on drift, stop,
   record in `drift.md`, and classify. Objective implementation and tool defects
   use bounded recovery; a wrong durable plan uses `/rite-plan repair`; only a

package/docs/engine/commands.md

@@ -17,8 +17,8 @@ workflow strategy.
 | `check preconditions <slug> [--slice SLICE-###] [--timeout N]` | Run the `test-plan.md` Build-entry preflight rows whose optional `Run at` cell is `vet` (with `--slice`, `pre-dispatch <SLICE>`); `action` rows and rows without the cell never run. Writes one candidate-bound transcript per row under `references/gates/preflight-*/`; a row passes on exit 0. A `pre-dispatch` row whose newest transcript passed is kept, not re-run: it is a pre-edit baseline, so a re-dispatch never runs it against the slice's own edits; changing its command or cwd retires the pass. Exit `3` on any failure or an invalid `Run at` value. |
 | `check seal <slug>` | Check files required by target Phase `seal`, open human gates, the `tasks.md` slice graph, canonical `AC-###` presence when `tasks.md`/`test-plan.md` are required, the stable Build-input binding, and exact candidate bindings. `check readiness` and `check seal` also block a `scripts/` test driver that a tasks.md Writer allowlist plans or touched-files.md lists when no gates.md `CHECK` runs it and no `Driver waiver: <path> — DEC-### <reason>` line cites a recorded decision; waived drivers print as `note: unexecuted driver (waived by DEC-###): <path>` lines, on pass or block. |
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
-| `parallel select --cap <1-10> [--root <dir>] [--slug <slug>] [--from-plan \| <json-file> \| -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices, or with `--from-plan` (needs `--slug`) from the plan: tasks.md slices whose dependencies are built (state.md checkbox, or an evidence.md heading that says that slice was checkpointed plus a `Checkpoint: <sha>` line), with Writer allowlist (else Files likely touched) paths plus the nearest manifest/lockfile when `External dependencies:` names a package (module path, npm scope, backticked name, or a non-toolchain version). With `--slug` and a running lease, the lease's not-yet-landed slices hold cap slots and paths, slices it names are never picked, and only new picks print. |
-| `parallel <create\|add\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. A lease is a pipeline: `integrate --slice <id> --apply-to-control` lands one green sibling onto control (refusing if anything but this lease moved control), and `add` starts new path-disjoint siblings from the current control tip while others still run. |
+| `parallel select --cap <1-10> [--root <dir>] [--slug <controller>] [--from-plan [--workspaces <slug,...>] \| <json-file> \| -]` | Choose a plan-order path-disjoint ready subset, seeded by all retained repository-controller slots and paths. `--from-plan` uses canonical built checkpoints, local and declared workspace producer dependencies, exact write sets and required dependency manifests. The internal `--workspaces` data-source parameter pools recorded forward continuations with current readiness and explicit native-vetted per-slice declarations; blocked/stale/missing candidates print scoped notices without hiding other ready work. Foreign identities print `<workspace>/<slice>`. |
+| `parallel <create\|add\|integrate\|prune\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | One repository controller owns isolated workers across source workspaces. `create` accepts a single initial worker; `create`/`add --cap N` persist the global admission capacity. Explicit `add --cap N --json -` with stdin `[]` updates capacity only; lowering below active count refuses without canceling workers. A completed retained lease can refill at unchanged control tip. `record-green` and per-slice `integrate --slice <workspace/id> --apply-to-control` target source-qualified lanes (bare IDs mean controller lanes); integration keeps exact ancestry/path/dirty-work checks and lands `WIP(<source>):`. `prune` removes only verified clean integrated checkouts, retaining branches, proof identities, lease rows and controller. Status exposes the retained controller and pending landing; cleanup preserves salvage/unknown work. |
 | `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. A `Dependencies` ID may carry a `(via <interface>)` suffix (empty or unclosed is a malformed token); prints a non-blocking `ADVISORY edge:` line (and records an `edge-advisory` metric) for each edge with no via, or whose via text is not a case-insensitive substring of the dependency's `Consumes / Produces:`. Prints `schedule: <n> slices in <r> build rounds at cap 10` (the `/rite-build` batch selection replayed over each slice's Writer allowlist, else Files likely touched, plus the manifest parallel select reserves; omitted when a slice has no path) and a non-blocking `ADVISORY hub:` line (top five; records a `hub-advisory` metric) for each path, compared case-folded, that three or more slices without `Serial rationale:` write. Advisories print only when the graph is valid. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
 | `check continuation [slug]` | Print whether an armed AFK run must invoke its cursor instead of replying. `continuation: required` plus `invoke: <next_action>` when `.devrites/AFK` is a regular file, `status` is `running`, `question_id` is empty, no blocking or escalating question is open, and `next_action` is an internal phase command (`/rite-spec` through `/rite-seal`, including `/rite-plan`, not `/rite-ship` or `/rite-autocomplete`). Otherwise `continuation: clear` with a one-line `reason`. Exit `0` either way. `handoff` prints the same lines. |
@@ -45,7 +45,7 @@ workflow strategy.
 | `metrics summary [slug] [--by-slice]` | Reduce `metrics.jsonl` into a per-phase roll-up. `--by-slice` reads `dispatch.json` instead: per slice, build wright rounds, slice-bound Vet rechecks, and agent-minutes (role start to `returned_at`; abandoned waves excluded). When the ledger has `resume` events it adds `resumes count=N minutes_to_dispatch=...` (each resume timed to the next `dispatch` event; `none` when another resume came first, `open` when none followed). |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows every unreleased claim (live, expired, dead) plus one `N released (use --all)` count; `--all` includes released rows; a claim whose holding session has provably exited on this host shows `dead` and no longer conflicts. `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
-| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` writes a redacted, candidate-bound transcript per executed or reused gate under `references/gates/<gate-id>/`. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
+| `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` atomically publishes a private redacted v2 executed transcript, or returns its verified originating record unchanged, under `references/gates/<gate-id>/`; legacy v1/reuse-only logs cannot authorize reuse. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
 | `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
@@ -54,7 +54,7 @@ workflow strategy.
 | `migrate <slug> [--dry-run] [--answer id=choice]` | Normalize a pre-v5 workspace to the current schema; fail-closed, one-shot. |
 | `secret-scan [--staged] [--stdin] [slug]` | Scan exact staged blobs, stdin, or touched regular files for credential material. |
 | `open-visual <path-or-name> [--slug <slug>] [--no-open]` | Resolve a local visual HTML file, optionally open it in the OS browser, warn if the sibling outline is missing or inventory ids are absent from HTML, and print agent path tips. No network. |
-| `detect commands [--root <dir>] [--json]` | Resolve the repository's own test/lint/vet/build commands: explicit Makefile targets first, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager. Read-only, no installs, no execution. |
+| `detect commands [--root <dir>] [--json]` | Resolve the repository's own test/lint/vet/build commands: explicit Makefile targets first, then `package.json` scripts, then language-manifest fallbacks, plus the lockfile-derived package manager. Integration stays unresolved without an explicit repository target or script; a language manifest does not prove a separate integration suite. Read-only, no installs, no execution. |
 | `overhaul <records\|admit\|snapshot\|score\|bench\|render> ...` | Deterministic tools behind the standalone `/overhaul` skill: run-record generations and cross-record validation, worker-receipt admission and quote anchoring, index-safe baseline snapshots and per-attempt deltas, exact-rational readiness scoring, benchmark ratio intervals, and escaped offline review/report views. Operates only on explicit run-area and repository paths. See [Overhaul tools](#overhaul-tools). |
 | `version` | Print the engine version. |
 
@@ -87,6 +87,30 @@ command namespace.
   invalidate earlier passes if later checks move their inputs.
   Missing or changed inputs cannot certify a pass. Execution, discarded-result,
   or evidence-write failures exit `3`, even if an older ledger still reads met.
+- Parallel integration records exact landing intent before control FF. A matching
+  retry reconciles that landing once; external HEAD/ref movement still blocks.
+  Pending intent cannot be replaced or cleared through raw lease commands.
+  `prune` and normal/forced cleanup preserve late edits, ignored/untracked data,
+  unexpected worker tips and unknown checkouts rather than forcing their removal.
+  Missing registered checkouts retain their Git index and metadata; completed
+  cleanup releases the lease and reports recovery rather than discarding them.
+- Context cache reuse verifies the actual regular bundle bytes and private mode,
+  not the digest sidecar alone. Workspace sources are bounded and acquired once
+  per invocation; unsafe reads fail instead of becoming omitted guidance.
+  Managed output stays confined; explicit external `--out` remains supported.
+  Windows cannot prove POSIX owner-only mode through Go's `FileMode`; repeat
+  context requests rebuild instead of falsely certifying a private cache hit.
+- Frozen diff bytes must match their recorded SHA-256 at packet and dispatch
+  validation. Manually authored final reviewer packets may still name `.diff`
+  or `.patch` files, but must include `diff <64hex> <path>` binding rows.
+  Binding paths use `/` on every host, including drive-qualified Windows paths.
+  Same-wave freeze publication is serialized; each renderer owns its lint draft.
+- `gates run`/`reverify --transcripts` reuse only a complete passing executed
+  origin matching the gate definition, recorded output identity and declared
+  inputs. Missing origin reruns only affected approved checks; missing approval
+  blocks instead of borrowing an old checkbox. Valid redacted/truncated origins
+  remain reusable, with their historical candidate identity. Transcript metadata
+  and output are redacted; publication is atomic and private.
 
 ## Check boundary
 

package/docs/orchestration.md

@@ -141,19 +141,32 @@ base before native transfer, then re-proves the reconciled candidate. Missing tr
 conflict, extra paths, moved base, or cleanup failure stops with worktree evidence
 preserved. No ad hoc copy/cherry-pick/merge occurs from the read-only root.
 
-Isolation does not authorize same-worktree throughput. Parallel writers are allowed
-**only** under the `/rite-build` batch path when path-disjoint eligibility, abort-batch,
-and a control `parallel-lease.md` apply. `--parallel N` on `/rite-autocomplete`
-or `/rite-build` is the batch cap for that run and wins over leftover sentinel
-`max_parallel`; `/rite-autocomplete --parallel N` also writes or replaces only
-that field. Absent the flag, the sentinel (default cap 10 under
-`/rite-autocomplete`) is a **cap**: the run fills it
-with the largest eligible set, lands each sibling as soon as its review and proof are
-green, refills the freed slot (`parallel add`), and repeats until no pending slice
-remains; a one-slice round is serial for that round only (see
-[`parallel-batch.md`](../pack/.claude/skills/rite-build/reference/parallel-batch.md)).
-Same-worktree multi-writer and root-emulated worktrees remain forbidden; default
-`/rite-build` stays one writer across linked worktrees.
+Parallel writers use the `/rite-build` worktree lifecycle: independently vetted
+contracts, disjoint declared/hidden write surfaces, one retained controller lease,
+and per-sibling review/proof before serialized integration. `--parallel N` on
+Autocomplete is one global active-writer cap across authorized sequence workspaces;
+without the flag it uses AFK `max_parallel`, retained lease capacity on resume,
+else 10. No additional user flag is needed. Standalone Build remains scoped to
+its requested workspace.
+
+While a writer runs, Autocomplete prepares or re-Vets recorded continuations and
+refills from the whole eligible pool. A future slice needs an explicit, current
+Plan/Vet `Workspace dependencies` declaration; absent or stale declarations never
+become independence merely because files differ. Only durable integrated producer
+checkpoints release dependent work. Human/access/safety gates retain their scope.
+
+Each worker keeps its source workspace identity, isolated cwd, candidate, proof,
+state and `WIP(<source>):` checkpoint. Even a lone initial writer is isolated when
+using a parallel-capable controller, so later work can refill without creating
+same-tree co-writers. Explicit `--parallel 1` remains one writer total. Unsupported
+host isolation falls back truthfully to serial execution.
+
+The controller drains and cleans its lease before non-lease product corrections,
+shared Polish writes or checkpoints; unrelated control commits are never blessed
+as a new expected tip. Final per-workspace proof/Seal and exact release-union Ship
+approval remain mandatory. See the
+[controller workflow](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md)
+and [worktree lifecycle](../pack/.claude/skills/rite-build/reference/parallel-batch.md).
 
 ## Engine boundary
 

package/docs/skills.md

@@ -194,6 +194,11 @@ and `Shipped`. Utility commands keep the same compact labels and one-next-action
 | [`devrites-api-interface`](../pack/.claude/skills/devrites-api-interface/SKILL.md) | Design stable API / interface contracts: REST/GraphQL, module boundaries, type contracts, FE/BE split. | A slice crosses a boundary or defines a public interface. |
 | [`devrites-debug-recovery`](../pack/.claude/skills/devrites-debug-recovery/SKILL.md) | Reproduce → ranked hypotheses → instrument → fix in scope → regression-test. Caller and recovery count at most three failures per causal fingerprint from context and Dead ends/evidence. | Tests, builds, or runtime checks fail. |
 
+Under Autocomplete, existing parallel capacity spans authorized sequence
+workspaces. It overlaps future planning/re-Vet with isolated, independently
+admitted writers; standalone Build stays scoped. See the
+[global controller](../pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md).
+
 ### Prove: collect evidence, including browser evidence
 
 | Skill | What It Does | Use When |

package/engine/internal/acceptance/cli.go

@@ -27,11 +27,13 @@ Subcommands:
   scaffold <slug>            Create gates.md from spec.md AC ids (only when absent)
   status <slug>              Reduce the ledger without executing; exit 3 unless ALL MET
   run <slug> [--timeout N] [--transcripts]
-                             Execute unmet runnable gates and record evidence
+                             Execute unmet gates; reuse unchanged INPUTS evidence
   reverify <slug> [--timeout N] [--transcripts]
-                             Re-execute every runnable gate, demoting stale passes
-                             (--transcripts writes one redacted, candidate-bound
-                             file per gate under references/gates/<gate-id>/)
+                             Re-run runnable gates except valid unchanged INPUTS proof
+                             --transcripts requires current approval and complete
+                             passing executed origins for reuse; recover missing
+                             origins by executing only affected approved gates.
+                             New private redacted records: references/gates/<gate-id>/
   lint <slug> [--strict]     Audit oracle quality without executing
   precheck <slug> --worktree <path> [--slice <SLICE-ID>]
                              Run every RUN: writer gate, then check windows, in
@@ -263,12 +265,6 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, err)
 		return ExitBlocked
 	}
-	before := ""
-	if transcripts {
-		before = candidateLabel(root, slug)
-	}
-	var ran []GateResult
-	var ranDoc *Document
 	attemptFailed := false
 
 	// The gates lock serializes check execution; the feature lock is held only
@@ -293,18 +289,33 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 			}
 			return nil
 		}
-		ran, ranDoc = RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, featureLock), doc
-		for _, result := range ran {
-			if result.Ran && !result.Passed || result.Discarded || result.WriteErr != nil {
+		options := &RunOptions{WriteLock: featureLock}
+		before := ""
+		if transcripts {
+			options.TranscriptWork = work
+			before = candidateLabel(root, slug)
+		}
+		ran := RunGates(context.Background(), project, ledgerPath, doc, approved, reverify, timeout, options)
+		for i, result := range ran {
+			if result.Ran && !result.Passed || result.Discarded || result.WriteErr != nil || transcripts && doc.Gates[i].Check != "" && !result.Passed {
 				attemptFailed = true
 			}
 			switch {
 			case !result.Ran:
-				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", result.ID, result.Detail)
+				fmt.Fprintf(stdout, "gate %s: skipped (%s)\n", transcriptMetadata(result.ID), transcriptMetadata(result.Detail))
 			case result.Passed && !result.Discarded && result.WriteErr == nil:
-				fmt.Fprintf(stdout, "gate %s: pass\n", result.ID)
+				fmt.Fprintf(stdout, "gate %s: pass\n", transcriptMetadata(result.ID))
 			default:
-				fmt.Fprintf(stdout, "gate %s: fail (%s)\n", result.ID, result.Detail)
+				fmt.Fprintf(stdout, "gate %s: fail (%s)\n", transcriptMetadata(result.ID), transcriptMetadata(result.Detail))
+			}
+		}
+		if transcripts {
+			paths, err := writeTranscripts(work, doc, ran, before, candidateLabel(root, slug))
+			for _, path := range paths {
+				fmt.Fprintf(stdout, "transcript: %s\n", path)
+			}
+			if err != nil {
+				return fmt.Errorf("transcript: %w", err)
 			}
 		}
 		return nil
@@ -313,16 +324,6 @@ func cmdRun(root string, args []string, reverify bool, stdout, stderr io.Writer)
 		fmt.Fprintf(stderr, "gates %s: %v\n", verb, lockErr)
 		return ExitBlocked
 	}
-	if transcripts && ranDoc != nil {
-		paths, err := writeTranscripts(work, ranDoc, ran, before, candidateLabel(root, slug))
-		for _, path := range paths {
-			fmt.Fprintf(stdout, "transcript: %s\n", path)
-		}
-		if err != nil {
-			fmt.Fprintf(stderr, "gates %s: transcript: %v\n", verb, err)
-			return ExitBlocked
-		}
-	}
 	fmt.Fprintln(stdout, "---")
 	return reportStatus(slug, ledgerPath, testPlanPath, attemptFailed, stdout, stderr)
 }

package/engine/internal/acceptance/preconditions.go

@@ -49,7 +49,7 @@ func PreflightRowsPassed(root, slug string, rows []PreflightRow) (bool, error) {
 // candidate but the lookup does not compare it: Vet writes workspace artifacts
 // after the run, and only a change to the row's command or cwd retires a pass.
 func PreflightPassed(work string, row PreflightRow) bool {
-	dir := filepath.Join(work, "references", "gates", unsafeNameRE.ReplaceAllString(PreflightGateID(row), "_"))
+	dir := filepath.Join(work, "references", "gates", transcriptGateName(PreflightGateID(row)))
 	entries, err := os.ReadDir(dir)
 	if err != nil {
 		return false

package/engine/internal/acceptance/run.go

@@ -30,8 +30,9 @@ type GateResult struct {
 	Detail    string // exit/match/timeout/approval diagnostic
 	Discarded bool   // result dropped: bound oracle or inputs changed during the run
 	WriteErr  error  // evidence writeback failed for a reason other than drift
-	Reused    bool   // met gate kept because its INPUTS are unchanged
+	Reused    bool   // met gate kept under the selected reuse policy
 	Inputs    string // INPUTS content digest at run time, when declared
+	Origin    string // complete executed transcript retained when proof is reused
 	// Outcome, Started and Ended describe the execution this result judged;
 	// they are zero when the gate did not execute.
 	Outcome        RunOutcome
@@ -63,19 +64,33 @@ func ReadLedgerFile(ledgerPath string) (string, error) {
 	return string(raw), nil
 }
 
-// RunGates executes the runnable gates of ledgerPath. reverify re-runs every
-// runnable gate including already-met ones; the normal mode runs only unmet
-// runnable gates. approved is the vetted command set from test-plan.md; a
+// RunOptions controls evidence reuse and short ledger writeback locking.
+// TranscriptWork requires a usable executed origin before a met gate can skip.
+// The caller holds the gates execution lock through transcript publication.
+type RunOptions struct {
+	WriteLock      func(func() error) error
+	TranscriptWork string
+}
+
+// RunGates executes the runnable gates of ledgerPath. reverify also runs met
+// gates without INPUTS; met gates with unchanged INPUTS reuse their proof in
+// either mode, subject to options.TranscriptWork's executed-origin requirement.
+// approved is the vetted command set from test-plan.md; a
 // CHECK outside it never executes, and neither does one outside a surface that
 // could not be determined — an absent preflight is a refusal, not permission.
 // Each pass writes definition-bound evidence; each failure clears the box and
 // restores EVIDENCE: pending.
 //
 // Gates sharing one CHECK and CWD execute once per call; each matches its own
-// EXPECT against that shared output. writeLock, when non-nil, wraps every
+// EXPECT against that shared output. options.WriteLock, when non-nil, wraps every
 // ledger writeback so the caller need not hold the feature lock while checks
 // execute; writeResult re-verifies the gate's oracle before it writes.
-func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, writeLock func(func() error) error) []GateResult {
+func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, approved []ApprovedCommand, reverify bool, timeout time.Duration, options *RunOptions) []GateResult {
+	var writeLock func(func() error) error
+	transcriptWork := ""
+	if options != nil {
+		writeLock, transcriptWork = options.WriteLock, options.TranscriptWork
+	}
 	var results []GateResult
 	executions := map[string]struct {
 		ran     bool
@@ -105,24 +120,35 @@ func RunGates(ctx context.Context, root, ledgerPath string, doc *Document, appro
 			results = append(results, GateResult{ID: gate.ID, Detail: "manual gate; evidence is judged, not executed"})
 			continue
 		}
+		isApproved := Approved(gate.Check, gate.Cwd, approved)
+		if transcriptWork != "" && !isApproved {
+			results = append(results, GateResult{ID: gate.ID, Detail: "CHECK/CWD is not an approved test-plan.md preflight row; not executed"})
+			continue
+		}
 		inputs := ""
 		if GateState(gate, doc) == StateMet {
-			if gate.Inputs == "" && !reverify {
-				results = append(results, GateResult{ID: gate.ID, Passed: true, Detail: "already met"})
-				continue
-			}
+			canReuse := gate.Inputs == "" && !reverify
 			if gate.Inputs != "" {
 				// An unreadable or unmatched spec never matches recorded evidence.
 				inputs, _ = InputsDigest(root, gate.Inputs)
+				canReuse = inputs != "" && inputs == recordedInputs(gate)
 			}
-			// A gate that declares INPUTS is reused, under run and reverify alike,
-			// exactly while the files it depends on are byte-identical; any change re-executes it.
-			if inputs != "" && inputs == recordedInputs(gate) {
-				results = append(results, GateResult{ID: gate.ID, Passed: true, Reused: true, Inputs: inputs, Detail: "reused: inputs unchanged"})
-				continue
+			if canReuse {
+				origin := ""
+				if transcriptWork != "" {
+					origin = passingOrigin(transcriptWork, gate)
+				}
+				if transcriptWork == "" || origin != "" {
+					detail := "already met"
+					if gate.Inputs != "" {
+						detail = "reused: inputs unchanged"
+					}
+					results = append(results, GateResult{ID: gate.ID, Passed: true, Reused: gate.Inputs != "" || origin != "", Inputs: inputs, Origin: origin, Detail: detail})
+					continue
+				}
 			}
 		}
-		if !Approved(gate.Check, gate.Cwd, approved) {
+		if !isApproved {
 			results = append(results, GateResult{ID: gate.ID, Detail: "CHECK/CWD is not an approved test-plan.md preflight row; not executed"})
 			continue
 		}