devrites 7.3.0 → 7.3.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.1](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.0...v7.3.1) (2026-11-01)
+
+### Fixed
+
+* **devrites:** keep workspace frontier active across phase waits ([#204](https://github.com/ViktorsBaikers/DevRites/issues/204)) ([56006f4](https://github.com/ViktorsBaikers/DevRites/commit/56006f4ca0545b4ede1ed81b0373e61b7cd7ce7d))
+
 ## [7.3.0](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.8...v7.3.0) (2026-11-01)
 
 ### Added
@@ -33,6 +39,10 @@ All notable changes to DevRites are documented here. The format follows [Keep a
 - Audit underfilled parallel frontiers through acceptance-preserving Plan/Vet;
   separate independently provable capabilities without dropping producer, proof
   or authority gates.
+- Recompute archived predecessor readiness in place without restoring historical
+  workspaces or reviving their controller leases.
+- Execute Autocomplete's global frontier at cold Prove/Vet/Review and native wait
+  boundaries; preserve frozen candidates, standalone scope, and non-green gates.
 
 ## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
 

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 

package/docs/engine/commands.md

@@ -82,6 +82,12 @@ command namespace.
   Awaiting-human section. Resolving another question leaves the live wait intact.
 - `state close` reads the physical `ACTIVE` pointer under the feature lock;
   `DEVRITES_WORKSPACE` cannot make it clear another feature's pointer.
+- Read-only readiness bindings and input introspection resolve explicit sources
+  live first, then safely archived bytes only when the live workspace is absent.
+  `check readiness --emit-binding <slug>` recomputes archived inputs in place;
+  cached binding records do not establish freshness. Active workspace commands
+  remain live-only. Never restore an archive merely to hash it: copied historical
+  leases can become live controllers.
 - `gates run` and `reverify` snapshot every declared `INPUTS` dependency around
   the actual shared CHECK execution, recheck during locked writeback, and
   invalidate earlier passes if later checks move their inputs.

package/engine/internal/gate/readiness_binding.go

@@ -40,8 +40,9 @@ var readinessInputs = [...]readinessInput{
 }
 
 // ReadinessBinding returns the exact line Vet records in eng-review.md.
+// Explicit sources resolve live first, then safely archived planning bytes.
 func ReadinessBinding(root, slug string) (string, error) {
-	observation, err := state.ObserveWorkspace(root, slug)
+	observation, err := state.ObserveReferencedWorkspace(root, slug)
 	if err != nil {
 		return "", err
 	}
@@ -180,9 +181,9 @@ func withoutReviewedIdentity(content []byte) []byte {
 // ReadinessInputDigests returns each readiness input's content digest plus the
 // aggregate binding line Vet records in eng-review.md. A required input that
 // is missing, or any unreadable input, is an error — the same refusal the
-// readiness gate applies.
+// readiness gate applies. Source selection matches ReadinessBinding.
 func ReadinessInputDigests(root, slug string) ([]ReadinessInputDigest, string, error) {
-	observation, err := state.ObserveWorkspace(root, slug)
+	observation, err := state.ObserveReferencedWorkspace(root, slug)
 	if err != nil {
 		return nil, "", err
 	}

package/engine/internal/state/observation.go

@@ -244,11 +244,40 @@ func ObserveWorkspace(root, slug string) (*WorkspaceObservation, error) {
 	return observeWorkspace(root, slug, nil)
 }
 
+// ObserveReferencedWorkspace acquires a read-only planning source, live first
+// and archived only when its canonical live directory is absent. A different
+// valid active-workspace override never redirects this explicit source.
+func ObserveReferencedWorkspace(root, slug string) (*WorkspaceObservation, error) {
+	return observeWorkspaceSource(root, slug, true, nil)
+}
+
 func observeWorkspace(root, slug string, callback observationCallback) (*WorkspaceObservation, error) {
-	if !observationWorkspaceOverrideValid(root, slug) {
+	return observeWorkspaceSource(root, slug, false, callback)
+}
+
+func observeWorkspaceSource(root, slug string, allowArchive bool, callback observationCallback) (*WorkspaceObservation, error) {
+	override := os.Getenv("DEVRITES_WORKSPACE")
+	overrideSlug := slug
+	if allowArchive && override != "" {
+		overrideSlug = filepath.Base(filepath.Clean(override))
+	}
+	if !observationWorkspaceOverrideValid(root, overrideSlug) {
 		return nil, ObservationWorkspaceInvalid
 	}
-	workspacePath, err := devritespaths.ExistingFeatureDirChecked(root, slug)
+	workspacePath, err := devritespaths.ExistingFeatureDirChecked(root, overrideSlug)
+	canArchive := allowArchive && override == ""
+	if overrideSlug != slug {
+		if err != nil {
+			return nil, ObservationWorkspaceInvalid
+		}
+		workspacePath, err = devritespaths.ExistingCanonicalFeatureDirChecked(root, slug)
+		canArchive = allowArchive
+	}
+	archived := false
+	if err != nil && canArchive && errors.Is(err, fs.ErrNotExist) {
+		workspacePath, err = devritespaths.ExistingArchivedFeatureDirChecked(root, slug)
+		archived = err == nil
+	}
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
@@ -270,6 +299,9 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	}
 	defer func() { _ = roots.devrites.Close() }()
 	defer func() { _ = roots.workspace.Close() }()
+	if archived && !liveWorkspaceAbsent(roots.devrites, slug) {
+		return nil, ObservationWorkspaceInvalid
+	}
 
 	inventory := observationInventory()
 	facts := make([]ArtifactFact, 0, len(inventory))
@@ -315,9 +347,24 @@ func observeWorkspace(root, slug string, callback observationCallback) (*Workspa
 	if err != nil {
 		return nil, ObservationWorkspaceInvalid
 	}
+	if archived && !liveWorkspaceAbsent(roots.devrites, slug) {
+		return nil, ObservationConcurrentChange
+	}
 	return &WorkspaceObservation{slug: slug, facts: facts, index: index, rootFiles: rootFiles}, nil
 }
 
+func liveWorkspaceAbsent(root *os.Root, slug string) bool {
+	work := inspectEntry(root, "work")
+	if work.state == entryAbsent {
+		return true
+	}
+	if work.state != entryPresent || work.info.Mode()&os.ModeSymlink != 0 || !work.info.IsDir() {
+		return false
+	}
+	workspace := inspectEntry(root, filepath.Join("work", slug))
+	return workspace.state == entryAbsent && sameObservedEntry(work, inspectEntry(root, "work"))
+}
+
 // readRootFiles lists the workspace directory's regular entries through the
 // already-verified root handle, so the list describes the same snapshot as the
 // artifact facts.

package/pack/.claude/skills/devrites-lib/reference/parallel-workspaces.md

@@ -69,6 +69,9 @@ incomplete, stale or human-blocked future work is a planning/repair/blocked
 opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
 bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
 predecessor assumptions, then record current bindings; never auto-refresh a digest.
+Read archived predecessors in place through the engine's referenced read-only
+readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
+that can resurrect stale controller leases and claims.
 
 ## Recover avoidable serialization
 
@@ -106,13 +109,28 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-At entry, each landing, planning/review return and before any wait or final reply:
+Autocomplete executes this bounded pass at every phase entry (including cold
+Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
+return, and immediately before a native wait or final reply. A nested phase
+returns scheduling to Autocomplete; its source-local phase/recovery return cursor
+and pending native reviewer handles remain intact. This is not a second phase
+controller or a persistent frontier artifact.
 
 1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Scan all stages, not only the owner's next local slice. While writers
-   run, root advances authorized Spec → Clarify → Temper → Define/Plan → Vet,
-   including narrow repair/re-Vet of prepared targets, under unchanged approval
-   and safety rules. Missing human authority blocks that target, not safe siblings.
+   sequence. Examine every recorded authorized source once per pass, not only
+   the owner's next local slice or first blocked child. Prepare absent targets
+   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
+   and re-Vet current readiness of prepared targets now, not after owner Seal.
+   Assess actual source gates, claims and explicit planning/Build restrictions
+   before routing. Owner-local red/human/access gates withhold that owner or its
+   actual consumers, not independent authorized planning; true whole-run safety,
+   access and claim constraints still bind. Retain concrete actions or blockers
+   in existing source artifacts under normal write authority.
+   Yield a child at its pending reviewer/phase boundary back to this controller;
+   never recursively wait for child completion while parent returns are pending.
+   Reconcile available parent returns before another pass. A native wait is
+   justified only after concrete authorized actions/blockers across the pool
+   have been examined; reading later phase skills is not pending Plan/Vet work.
    If an explicit/AFK capacity change differs from retained capacity, reconcile it
    before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
    with stdin `[]`. This changes capacity only, not workers or a complete lease's
@@ -137,11 +155,14 @@ At entry, each landing, planning/review return and before any wait or final repl
    Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
    handoff, never early same-tree foreign Build or concurrent same-worktree writers.
 4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run. Land each individually green
-   sibling through Build review/proof and `parallel integrate --slice <key>`;
-   refill immediately from the whole authorized pool. A red sibling repairs in
-   place and holds its slot/paths; it does not delay independent green landings.
-   Never satisfy a producer edge on writer return or green-but-unlanded work.
+   planning and independent review while they run, including while the owner
+   awaits Prove/Vet/Review accounts. Apply the protected window below before any
+   landing: defer control mutations while frozen validation is pending. Outside
+   that window, land each individually green sibling through Build review/proof
+   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
+   A red sibling repairs in place and holds its slot/paths; it does not delay
+   independent safe landings. Never satisfy a producer edge on writer return or
+   green-but-unlanded work.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
@@ -182,8 +203,17 @@ controller bookkeeping nor sibling proof closes a child's acceptance.
 
 Prove/Polish/Review/Seal remain per workspace with fresh candidate bindings. Shared
 durable Polish outputs serialize; source changes invalidate affected evidence.
-Before any non-lease product correction, shared durable Polish write or control
-checkpoint, freeze new writer admissions, drain/reconcile retained writers, land
+From candidate freeze/validator dispatch through account admission, preserve the
+exact candidate, control tip and all consumed metadata/validator inputs. Independent
+authorized planning and isolated writers may proceed only without changing those
+inputs or shared runtime resources. Defer integration, checkpoints, cross-source
+corrections and consumed-artifact edits until the window closes; retained green
+workers keep their identities/slots. Recheck candidate, control-tip identity and
+consumed inputs before accepting each account; drift invalidates affected accounts
+and requires native fresh validation, never acceptance against a moving tip.
+After any protected validation window closes, before a non-lease product correction,
+shared durable Polish write or control checkpoint, freeze new writer admissions,
+drain/reconcile retained writers, land
 safe green work and cleanup the lease. Preserve blocked work; never force-clean
 it merely to advance a phase. Perform phase-owned correction/proof/checkpoint,
 then resume the pool from new HEAD. Never accept unrelated commits as expected
@@ -192,6 +222,10 @@ ControlTip or invent phase slices. Read-only frozen proof/review and planning-on
 Normal ordered handoff reuses the same controller and prepared child cursor.
 Never archive controller/source while retained lease owns it; clean up owned
 workers first, preserving salvage and unknown outcomes.
+Global scheduling is not global gating or ordered handoff. Unmet or abandoned
+owner gates remain non-green: an owner request to defer obligations routes Spec
+Drift Guard → Plan → affected Vet under existing authority, or retains the blocked
+source. It never becomes Prove green or Seal GO merely to reach another source.
 
 Early child WIPs can interleave with parent WIPs. Parent-only Ship must not absorb
 those commits as if parent alone were sealed. Deferred release waits for every

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -86,6 +86,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before phase-local cold recovery, execute the bounded
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
+   retain this source's return cursor and pending reviewer handles.
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -116,16 +119,12 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute [`parallel-workspaces.md`](../devrites-lib/reference/parallel-workspaces.md):
-   continuously scan the authorized recorded sequence across stages, preparing
-   and re-Vetting future targets while writers run. Build queries the global
-   pool with `parallel select --from-plan --slug <controller> --workspaces
-   <controller,authorized-source,...> --cap N`; N is explicit `--parallel N`, else
-   sentinel `max_parallel`, else 10 — one global writer cap, including explicit 1.
-   Always pass resolved `--parallel N` to Build. Cap>1 uses an isolated first
-   writer even when initially alone; refill globally per landing and planning/
-   review return. Unsupported host stays serial. No local ready slice is not
-   completion while authorized planning, repair/re-Vet or independent work remains.
+   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   at phase entry, before recovery, on returns and before native waits, not only
+   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
+   retains repository scheduling. Apply its protected validation window before
+   landings/checkpoints and account admission. Pass resolved `--parallel N` to
+   Build under its one global cap and existing admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/.claude/skills/rite-autocomplete/reference/loop.md

@@ -65,13 +65,20 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` global frontier | execute [shared controller workflow](../../devrites-lib/reference/parallel-workspaces.md); scan authorized stages and repair/re-Vet while writers run, refill per landing under one global cap; charge each source once per landed slice |
+| 6 | `/rite-build` | execute shared controller selection/admission; charge each source once per landed slice |
 | 7 | `/rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
+At every phase entry, before cold/local recovery, on reviewer/planning returns and
+before native waits, Autocomplete executes the bounded
+[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Keep source-local return cursors and pending handles; apply its protected
+validation window before accepting accounts or landing work. This scheduling
+precedes owner Seal and does not change ordered handoff below.
+
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
 new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a

package/pack/.claude/skills/rite-prove/SKILL.md

@@ -35,8 +35,9 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
 - Root runs vetted gates/browser and records immutable evidence; proof runner
   validates it. Only the bounded wright fixes product source/tests.
-- **Prove remains the controlling caller** during technical backtracking. Save
-  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+- **Prove remains the source-local controlling caller** during technical backtracking;
+  under Autocomplete, repository scheduling stays with Autocomplete. Save
+  Prove's cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. A strategy is spent after
   three no-progress attempts on the exact same fingerprint; escalate it per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
@@ -60,12 +61,15 @@ test changes.
 ## Workflow
 
 1. **Orient.** Read core, resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding), require `state.md`, and read its
-   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
-   and no-progress corrections before accepting terminal none; a distinct
-   fingerprint below cap resumes offline triage without another real action.
+   cursor. Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Prove's source-local return cursor.
+   On blocked Prove cold resume, reconcile retained consumptive evidence and
+   no-progress corrections before accepting terminal none; a distinct fingerprint
+   below cap resumes offline triage without another real action.
 2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
-   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
-   caller) and resumes here; it never authorizes ad hoc proof.
+   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the source-local
+   controlling caller) and resumes here; it never authorizes ad hoc proof.
 3. **Approve commands.** If absent, use
    [test-command-discovery](reference/test-command-discovery.md) over repository
    manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
@@ -119,6 +123,10 @@ test changes.
 7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
    `devrites-spec-reviewer`, in one parallel wave, judge the same candidate/commands/evidence/acceptance map.
    Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass, retaining both validator handles. Standalone Prove stays source-local.
+   Apply the shared protected validation window and recheck identities before
+   admitting accounts.
 8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
    Every criterion/scenario/interaction/key link needs discriminating evidence or a
    blocker, including critical-path, observability, developer and wiring branches.

package/pack/.claude/skills/rite-review/SKILL.md

@@ -62,6 +62,9 @@ Pull these via `Read` when the diff demands them:
 0. Read `.claude/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding) before loading workspace artifacts.
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery, preserving Review's source-local return cursor.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -127,6 +130,10 @@ Pull these via `Read` when the diff demands them:
      [[`agents.md`](../devrites-lib/reference/standards/agents.md) § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
      Either `Outcome: gap` stops Review; silence, failure, or malformed output never
      becomes an empty findings list.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass with cohort handles retained; standalone Review stays source-local. Apply
+   the shared protected validation window and identity recheck before account
+   admission.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already

package/pack/.claude/skills/rite-vet/SKILL.md

@@ -76,6 +76,9 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Vet's source-local return cursor.
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
    record engineering verdict and test-plan coverage. Valid Recovery rechecks
    retain prior depth; enter 1b.
@@ -85,12 +88,18 @@ plan declares a root-authored executable workflow file, read
    parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
    read-only passes on one frozen candidate. Missing required account blocks.
    Meanwhile run root steps 2–4, including step 3 preflight commands, on that
-   candidate; reconcile returned accounts.
+   candidate. Under Autocomplete, before native wait return scheduling to its
+   global frontier pass with reviewer handles retained; standalone Vet stays
+   source-local. Apply the shared protected validation window and identity
+   recheck before reconciling returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
    Freeze that packet and dispatch each exact owning reviewer once,
    fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Under Autocomplete, before native wait use the same controller pass and retained
+   handles as step 1a; standalone Vet stays source-local. Apply the same
+   protected-window account admission.
    Do not rerun broad inventory or unaffected reviewers. Close the prior
    fingerprint only with discriminating evidence plus an explicit
    correction-created regression verdict on the touched invariants (acyclic

package/pack/generated/claude/skills/devrites-lib/reference/parallel-workspaces.md

@@ -69,6 +69,9 @@ incomplete, stale or human-blocked future work is a planning/repair/blocked
 opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
 bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
 predecessor assumptions, then record current bindings; never auto-refresh a digest.
+Read archived predecessors in place through the engine's referenced read-only
+readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
+that can resurrect stale controller leases and claims.
 
 ## Recover avoidable serialization
 
@@ -106,13 +109,28 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-At entry, each landing, planning/review return and before any wait or final reply:
+Autocomplete executes this bounded pass at every phase entry (including cold
+Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
+return, and immediately before a native wait or final reply. A nested phase
+returns scheduling to Autocomplete; its source-local phase/recovery return cursor
+and pending native reviewer handles remain intact. This is not a second phase
+controller or a persistent frontier artifact.
 
 1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Scan all stages, not only the owner's next local slice. While writers
-   run, root advances authorized Spec → Clarify → Temper → Define/Plan → Vet,
-   including narrow repair/re-Vet of prepared targets, under unchanged approval
-   and safety rules. Missing human authority blocks that target, not safe siblings.
+   sequence. Examine every recorded authorized source once per pass, not only
+   the owner's next local slice or first blocked child. Prepare absent targets
+   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
+   and re-Vet current readiness of prepared targets now, not after owner Seal.
+   Assess actual source gates, claims and explicit planning/Build restrictions
+   before routing. Owner-local red/human/access gates withhold that owner or its
+   actual consumers, not independent authorized planning; true whole-run safety,
+   access and claim constraints still bind. Retain concrete actions or blockers
+   in existing source artifacts under normal write authority.
+   Yield a child at its pending reviewer/phase boundary back to this controller;
+   never recursively wait for child completion while parent returns are pending.
+   Reconcile available parent returns before another pass. A native wait is
+   justified only after concrete authorized actions/blockers across the pool
+   have been examined; reading later phase skills is not pending Plan/Vet work.
    If an explicit/AFK capacity change differs from retained capacity, reconcile it
    before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
    with stdin `[]`. This changes capacity only, not workers or a complete lease's
@@ -137,11 +155,14 @@ At entry, each landing, planning/review return and before any wait or final repl
    Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
    handoff, never early same-tree foreign Build or concurrent same-worktree writers.
 4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run. Land each individually green
-   sibling through Build review/proof and `parallel integrate --slice <key>`;
-   refill immediately from the whole authorized pool. A red sibling repairs in
-   place and holds its slot/paths; it does not delay independent green landings.
-   Never satisfy a producer edge on writer return or green-but-unlanded work.
+   planning and independent review while they run, including while the owner
+   awaits Prove/Vet/Review accounts. Apply the protected window below before any
+   landing: defer control mutations while frozen validation is pending. Outside
+   that window, land each individually green sibling through Build review/proof
+   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
+   A red sibling repairs in place and holds its slot/paths; it does not delay
+   independent safe landings. Never satisfy a producer edge on writer return or
+   green-but-unlanded work.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
@@ -182,8 +203,17 @@ controller bookkeeping nor sibling proof closes a child's acceptance.
 
 Prove/Polish/Review/Seal remain per workspace with fresh candidate bindings. Shared
 durable Polish outputs serialize; source changes invalidate affected evidence.
-Before any non-lease product correction, shared durable Polish write or control
-checkpoint, freeze new writer admissions, drain/reconcile retained writers, land
+From candidate freeze/validator dispatch through account admission, preserve the
+exact candidate, control tip and all consumed metadata/validator inputs. Independent
+authorized planning and isolated writers may proceed only without changing those
+inputs or shared runtime resources. Defer integration, checkpoints, cross-source
+corrections and consumed-artifact edits until the window closes; retained green
+workers keep their identities/slots. Recheck candidate, control-tip identity and
+consumed inputs before accepting each account; drift invalidates affected accounts
+and requires native fresh validation, never acceptance against a moving tip.
+After any protected validation window closes, before a non-lease product correction,
+shared durable Polish write or control checkpoint, freeze new writer admissions,
+drain/reconcile retained writers, land
 safe green work and cleanup the lease. Preserve blocked work; never force-clean
 it merely to advance a phase. Perform phase-owned correction/proof/checkpoint,
 then resume the pool from new HEAD. Never accept unrelated commits as expected
@@ -192,6 +222,10 @@ ControlTip or invent phase slices. Read-only frozen proof/review and planning-on
 Normal ordered handoff reuses the same controller and prepared child cursor.
 Never archive controller/source while retained lease owns it; clean up owned
 workers first, preserving salvage and unknown outcomes.
+Global scheduling is not global gating or ordered handoff. Unmet or abandoned
+owner gates remain non-green: an owner request to defer obligations routes Spec
+Drift Guard → Plan → affected Vet under existing authority, or retains the blocked
+source. It never becomes Prove green or Seal GO merely to reach another source.
 
 Early child WIPs can interleave with parent WIPs. Parent-only Ship must not absorb
 those commits as if parent alone were sealed. Deferred release waits for every

package/pack/generated/claude/skills/rite-autocomplete/SKILL.md

@@ -88,6 +88,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before phase-local cold recovery, execute the bounded
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
+   retain this source's return cursor and pending reviewer handles.
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -118,16 +121,12 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute [`parallel-workspaces.md`](../devrites-lib/reference/parallel-workspaces.md):
-   continuously scan the authorized recorded sequence across stages, preparing
-   and re-Vetting future targets while writers run. Build queries the global
-   pool with `parallel select --from-plan --slug <controller> --workspaces
-   <controller,authorized-source,...> --cap N`; N is explicit `--parallel N`, else
-   sentinel `max_parallel`, else 10 — one global writer cap, including explicit 1.
-   Always pass resolved `--parallel N` to Build. Cap>1 uses an isolated first
-   writer even when initially alone; refill globally per landing and planning/
-   review return. Unsupported host stays serial. No local ready slice is not
-   completion while authorized planning, repair/re-Vet or independent work remains.
+   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   at phase entry, before recovery, on returns and before native waits, not only
+   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
+   retains repository scheduling. Apply its protected validation window before
+   landings/checkpoints and account admission. Pass resolved `--parallel N` to
+   Build under its one global cap and existing admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/claude/skills/rite-autocomplete/reference/loop.md

@@ -67,13 +67,20 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` global frontier | execute [shared controller workflow](../../devrites-lib/reference/parallel-workspaces.md); scan authorized stages and repair/re-Vet while writers run, refill per landing under one global cap; charge each source once per landed slice |
+| 6 | `/rite-build` | execute shared controller selection/admission; charge each source once per landed slice |
 | 7 | `/rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
+At every phase entry, before cold/local recovery, on reviewer/planning returns and
+before native waits, Autocomplete executes the bounded
+[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Keep source-local return cursors and pending handles; apply its protected
+validation window before accepting accounts or landing work. This scheduling
+precedes owner Seal and does not change ordered handoff below.
+
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
 new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a

package/pack/generated/claude/skills/rite-prove/SKILL.md

@@ -35,8 +35,9 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
 - Root runs vetted gates/browser and records immutable evidence; proof runner
   validates it. Only the bounded wright fixes product source/tests.
-- **Prove remains the controlling caller** during technical backtracking. Save
-  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+- **Prove remains the source-local controlling caller** during technical backtracking;
+  under Autocomplete, repository scheduling stays with Autocomplete. Save
+  Prove's cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. A strategy is spent after
   three no-progress attempts on the exact same fingerprint; escalate it per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
@@ -60,12 +61,15 @@ test changes.
 ## Workflow
 
 1. **Orient.** Read core, resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding), require `state.md`, and read its
-   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
-   and no-progress corrections before accepting terminal none; a distinct
-   fingerprint below cap resumes offline triage without another real action.
+   cursor. Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Prove's source-local return cursor.
+   On blocked Prove cold resume, reconcile retained consumptive evidence and
+   no-progress corrections before accepting terminal none; a distinct fingerprint
+   below cap resumes offline triage without another real action.
 2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
-   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
-   caller) and resumes here; it never authorizes ad hoc proof.
+   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the source-local
+   controlling caller) and resumes here; it never authorizes ad hoc proof.
 3. **Approve commands.** If absent, use
    [test-command-discovery](reference/test-command-discovery.md) over repository
    manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
@@ -119,6 +123,10 @@ test changes.
 7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
    `devrites-spec-reviewer`, in one parallel wave, judge the same candidate/commands/evidence/acceptance map.
    Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass, retaining both validator handles. Standalone Prove stays source-local.
+   Apply the shared protected validation window and recheck identities before
+   admitting accounts.
 8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
    Every criterion/scenario/interaction/key link needs discriminating evidence or a
    blocker, including critical-path, observability, developer and wiring branches.