devrites 7.3.0 → 7.3.2

package/pack/generated/dsh/skills/overhaul/references/records.md

@@ -70,8 +70,8 @@ and every admission and settlement is recorded before the run leaves `RUNNING`
    revision as a new file under `revisions/`; never rewrite an existing one.
 3. Render views into the staged generation with `devrites-engine overhaul render`.
 4. `devrites-engine overhaul records publish <run>` validates the staged generation
-   against the previous one, writes `manifest.json` (SHA-256 of every generation file
-   and every revision), renames the directory, then replaces `CURRENT` last.
+   against the previous one, writes `manifest.json` (SHA-256 of every generation file,
+   revision and admitted receipt), renames the directory, then replaces `CURRENT` last.
 5. Any reader runs `validate <run>` first. A mismatch between `CURRENT`, the manifest
    and file bytes is a mixed generation: stop applying and republish.
 
@@ -79,6 +79,16 @@ A crash leaves an incomplete `g<N+1>.tmp` or a complete `g<N+1>` not yet current
 `validate` reports both, `stage` refuses until you inspect it, and the previous
 generation stays intact. One atomic rename is not a transaction; readers verify
 digests.
+
+Publishing first seals each admitted receipt's exact bytes in `manifest.receipts`.
+Later generations retain those digests and each settled task/attempt's original
+receipt path, even when the attempt leaves the dispatch ledger. Receipt changes
+invalidate both `validate` and the next `publish`; a caller's new path or digest
+cannot replace settled authority. Preserve the original receipt and record new work
+as a new attempt. A manifest without receipt bindings is not trusted.
+`admit receipt` remains read-only: settlement is recorded in the stage and sealed by
+`publish`, not by changing the current generation during admission.
+
 Give run files restrictive permissions, redact secrets before storing evidence, and
 never store credentials, tokens or private keys.
 
@@ -122,20 +132,23 @@ for needs-validation, evidence for decided findings, `verified_by` naming an adm
 verifier attempt, repository-relative locations (external ones are labels, never
 host paths); `revisions.plan.file` equal to `revisions/plan-r<rev>.json`, required
 once approvals or writers exist; plan digest pins; known, acyclic dependencies;
-allowed paths that are exact files inside the repository (no `*` or `?`, no
+non-empty arrays of allowed paths that are exact files inside the repository (no `*` or `?`, no
 directories, no `.git` component or run-area path in any letter case or through a
 symlink, no symlink or traversal escape); a separate verifier role;
 approval and `accept-degradation` events with quote and trusted channel, approvals
 matching the plan digest, closure and current revision, none active after a later
-stop; a scorecard only with `revisions.rubric` and the same verdict as `run.json`;
+stop; a scorecard only with `revisions.rubric`, the same verdict as `run.json`, and
+`inputs` digests matching the exact selected rubric, results and gates bytes;
 `READY_FOR_USER_REVIEW` only with a scorecard whose verdict is `MEETS_TARGETS`, and
 `COMPLETED_WITH_APPROVED_DEGRADATION` only with `MEETS_TARGETS_WITH_APPROVED_DEGRADATION`,
 each listing every audit gate (plus every repair gate outside assessment-only runs) as
 `PASS` or `NOT_APPLICABLE` (`G-CONCURRENCY` may be `WAIVED_OPERATIONAL` for the degraded outcome);
 no approval or writer in an assessment-only run; unchanged `run_id`, `repo_root`,
 `mode` and `assessment_only`; writers authorized for their task; one live writer
-per path (case-folded, symlink-resolved); every attempt `admitted`, `rejected` or
-`cancelled` once the outcome leaves `RUNNING` (`timed-out` and `unknown` are not settled); one outcome per approved task at the end;
+per authoritative task path (case-folded, symlink-resolved), reserving the whole
+approved `allowed_paths` scope even when `write_paths` is omitted or narrower;
+every attempt `admitted`, `rejected` or `cancelled` once the outcome leaves `RUNNING`
+(`timed-out` and `unknown` are not settled); one outcome per approved task at the end;
 a coverage denominator that never shrinks; append-only cycles, findings history and
 approval events; immutable revisions; view stamps; manifest integrity; stale stages
 and interrupted publishes. Across records: every finding's `domain` is a score key;
@@ -146,8 +159,10 @@ inside the run; coverage ranges use the seven coverage states; a scorecard's
 `G-NO-CRITICAL-HIGH` PASS needs no open critical or high finding,
 `G-NO-OPEN-SERIOUS-LEAD` PASS no open lead with critical or high potential impact,
 and `G-COVERAGE` PASS a non-empty matrix with no blocked cell, every applicable cell
-closed by an admitted, non-gap receipt whose `domains_checked` lists its domain, and every range of
-every eligible file reviewed or excluded.
+closed by an admitted, non-gap receipt whose `domains_checked` lists its domain and
+whose lane matches the cell, with receipt schema, run, task, attempt, role, lane and
+snapshot matching the admitted dispatch identity; every range of every eligible file
+reviewed or excluded.
 
 Receipt admission and quote anchoring live in `devrites-engine overhaul admit`
 ([`orchestration.md`](orchestration.md#admission-tool)).

package/pack/generated/dsh/skills/overhaul/references/scope-and-safety.md

@@ -201,8 +201,13 @@ read-only (`GIT_OPTIONAL_LOCKS=0`, `diff.autoRefreshIndex=false`, no external di
 drivers or textconv, fixed `a/` `b/` prefixes), never stashes, never commits and
 leaves `.git/index` byte-identical; it refuses an index with unmerged entries.
 Submodules and nested repositories are recorded as boundaries, never read. The plan
-pins the baseline manifest digest, so approval binds it. Use `state` before and
-`delta` after each writer attempt to observe exactly the paths that attempt changed.
+pins the baseline manifest digest, so approval binds it. Per-attempt `state`/`delta`
+observe whole-repository changes, not writer attribution. Serialize each shared-root
+target-mutating writer from its before-capture through stopping, after-capture and
+receipt admission before starting another writer, even for disjoint task paths.
+Preserve the full delta, including user changes; changes outside the approved task
+scope reject admission rather than being filtered out. Read-only review and
+verification may overlap on immutable inputs when their resources permit.
 
 Re-fingerprint before each edit and after each check. When user edits touch an
 assigned path or its decisive assumptions (`verify` reports changes outside

package/pack/generated/dsh/skills/overhaul/references/scoring.md

@@ -259,3 +259,9 @@ written. `G-THRESHOLDS` and `G-MANDATORY` are computed; `validate` rejects a
 scorecard whose `G-NO-CRITICAL-HIGH`, `G-NO-OPEN-SERIOUS-LEAD` or `G-COVERAGE` PASS
 contradicts `findings.json` or `coverage.json`, and a control recorded PASS while a
 linked finding is still open ([`records.md`](records.md#enforced-versus-review-only)).
+`publish` and `validate` bind `scorecard.json.inputs.{rubric_sha256,results_sha256,gates_sha256}`
+to the exact file bytes read by the calculator: `run.json.revisions.rubric.file`,
+the selected generation's `results-candidate.json` when present (otherwise
+`results-baseline.json`), and that generation's `gates.json`. Calculate from those
+paths before publication. Missing or mismatched inputs reject the generation;
+records never recalculate a card or replace its digests to make it current.

package/pack/generated/dsh/skills/rite-autocomplete/SKILL.md

@@ -88,6 +88,9 @@ next sequence continuation through Vet in a second session, then stop.
 
 1. **Orient and parse.** Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding); when a workspace exists,
    require its `state.md` and read its cursor; a fresh idea starts empty at step 2.
+   Before phase-local cold recovery, execute the bounded
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier);
+   retain this source's return cursor and pending reviewer handles.
    Before honoring `blocked` with terminal `next_action`,
    reconcile retained consumptive evidence and fingerprint attempts from
    `drift.md`/`evidence.md`; a retained fingerprint below its cap resumes offline
@@ -118,16 +121,12 @@ next sequence continuation through Vet in a second session, then stop.
    `/rite-build` batch loop → `/rite-prove` → `/rite-polish` →
    `/rite-review` → `/rite-seal`. Read and execute each skill; durable files, not
    chat, carry state. Apply the mutable post-vet budget before first Build.
-   Execute [`parallel-workspaces.md`](../devrites-lib/reference/parallel-workspaces.md):
-   continuously scan the authorized recorded sequence across stages, preparing
-   and re-Vetting future targets while writers run. Build queries the global
-   pool with `parallel select --from-plan --slug <controller> --workspaces
-   <controller,authorized-source,...> --cap N`; N is explicit `--parallel N`, else
-   sentinel `max_parallel`, else 10 — one global writer cap, including explicit 1.
-   Always pass resolved `--parallel N` to Build. Cap>1 uses an isolated first
-   writer even when initially alone; refill globally per landing and planning/
-   review return. Unsupported host stays serial. No local ready slice is not
-   completion while authorized planning, repair/re-Vet or independent work remains.
+   Execute the shared [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   at phase entry, before recovery, on returns and before native waits, not only
+   during Build or after Seal. Preserve source-local phase cursors; Autocomplete
+   retains repository scheduling. Apply its protected validation window before
+   landings/checkpoints and account admission. Pass resolved `--parallel N` to
+   Build under its one global cap and existing admission/isolation gates.
    **Completion:** loop reaches Seal GO or persists a valid stop before any later phase.
 5. **Apply stops.** At every gate use
    [stop-conditions.md](reference/stop-conditions.md). A `blocked` label alone is not a stop condition:

package/pack/generated/dsh/skills/rite-autocomplete/reference/loop.md

@@ -67,13 +67,20 @@ Workspace files, not chat, carry state. Read/execute each phase skill:
 | 3 | `/rite-temper` | harden or reduce; `expand` and extra acceptance stop for a human; irreversible risk still pauses |
 | 4 | `/rite-define` | approved plan/tasks/traceability |
 | 5 | `/rite-vet` | every plan; derive mutable budget after READY |
-| 6 | `/rite-build` global frontier | execute [shared controller workflow](../../devrites-lib/reference/parallel-workspaces.md); scan authorized stages and repair/re-Vet while writers run, refill per landing under one global cap; charge each source once per landed slice |
+| 6 | `/rite-build` | execute shared controller selection/admission; charge each source once per landed slice |
 | 7 | `/rite-prove` | all slices built except deferred (`Satisfies: none`); approved proof; recovery on red |
 | 8 | `/rite-polish` | re-prove after code edits |
 | 9 | `/rite-review` | in-scope correction then fresh proof |
 | 10 | `/rite-seal` | GO/NO-GO; no Git |
 | 11 | `/rite-ship` | only after GO; `--ship` never authorizes Git; stop at literal-GO/native approval |
 
+At every phase entry, before cold/local recovery, on reviewer/planning returns and
+before native waits, Autocomplete executes the bounded
+[global frontier pass](../../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier).
+Keep source-local return cursors and pending handles; apply its protected
+validation window before accepting accounts or landing work. This scheduling
+precedes owner Seal and does not change ordered handoff below.
+
 Check [stop-conditions.md](stop-conditions.md) before advancing. Discard stale
 pass evidence after source edits. Re-read the selected source before each phase per [phase target binding](../../devrites-lib/reference/parallel-workspaces.md#phase-target-binding). On a cold resume or
 new activation, run `devrites-engine check regression <slug>`: `BLOCKED` names a

package/pack/generated/dsh/skills/rite-build/reference/wright-dispatch.md

@@ -99,26 +99,26 @@ Same-worktree multi-writer / root-emulated worktrees stay forbidden.
 
 ## Run
 
-Same-worktree (non-isolated) dispatch claims before writing: the `dispatch open`
-below adds `--claim-session <id>`, one `--claim <path>` per task path, and
-`--claim-ttl <minutes>` sized to the write; it runs the
-`claim check --session <id> <task-paths>` test, and a live foreign holder fails the
-open with no wave and no claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
-is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Before same-tree writing, `dispatch open` adds `--claim-session <id>`,
+`--claim <path>` per task path, and `--claim-ttl <minutes>` sized to the write.
+It runs `claim check --session <id> <task-paths>`. Live foreign or abandoned
+unreleased/nonterminal claims (even same-session/expired) refuse without a wave
+or new claim, per [`agents.md`](../../devrites-lib/reference/standards/agents.md).
+`.devrites/**` is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
 Render the contract with `devrites-engine packet <slug> --wave <wave> --phase build
 --role slice-wright --slice <SLICE-ID> [--checks <G-ID,...>] [--focus <file>]` (it
 writes the linted same-worktree `packets/<wave>.contract.md`; a native-worktree pilot
-writes its own contract with `Isolation`, `worktree_base`, and subject) and hand the wright that text verbatim. Reviewers read
-that file, so `--focus` rows state each defect to fix with its anchor, never a reviewer's verdict,
-count, or pass status ("code review is no-findings" voids the next review). Ask the host
-for the exact writer in fresh context; a repair round on the same slice whose
-returned wright the host can still continue goes to that wright on its existing
-handle instead, so it does not re-read the slice from scratch. Wait, and track it
-through the launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
-<slice-id> --role slice-wright --slice <SLICE-ID> --contract <file>` (it refuses a
+writes its own contract with `Isolation`, `worktree_base`, and subject). Give it
+verbatim. Reviewers read it: `--focus` names defect + anchor, never a prior
+verdict, count, or pass claim. Ask the exact writer in fresh context; a repair
+may continue the returned wright's existing handle if the host supports it,
+avoiding a reread. Track the launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
+<wave-id> --role slice-wright --slice <SLICE-ID> --contract <file>` (it refuses a
 contract that forbids writer-safe checks or names none), then `start` with the host handle
-(the last start seals the wave) and `return` on completion (auto-records dispatch/return metrics). Every 5 wright
+(the last start seals the wave) and `return --wave <wave-id> --role slice-wright
+--handle <id>` on completion (auto-records dispatch/return metrics). Every wave ID
+is single-use: use a fresh ID for each repair or retry, even after abandonment;
+the earlier wave keeps its handles, history, and any unreleased claim. Every 5 wright
 rounds on one slice, `open` blocks for a reslice review. First re-admit each
 finding still driving rounds under the Proportionality rule of
 [agents.md § Result admission](../../devrites-lib/reference/standards/agents.md#result-admission): one without a broken anchor or a reachable trigger becomes a
@@ -129,7 +129,7 @@ open findings move to the new slice owning their paths), or record
 `## <DRIFT-ID> — <SLICE-ID> reslice review` with why no smaller split exists and
 a spec trace of the slice's obligations (hardening no AC/INV/PROH requires moves to
 a sibling slice dependents do not need, still gated before Seal), and
-reopen with `--reslice-review <DRIFT-ID>`. Same-worktree stays one writer.
+open a fresh wave with `--reslice-review <DRIFT-ID>`. Same-worktree stays one writer.
 Never run two writers in one worktree, mix isolated and same-worktree writers,
 or substitute a generic agent. Sanctioned parallel dispatch uses one exact
 wright per worktree, source-local `slice-wright.<SLICE-ID>` roles and starts

package/pack/generated/dsh/skills/rite-clarify/SKILL.md

@@ -59,34 +59,34 @@ dispatch uses
    remains.
 5. **Write the verdict.** Write `Decision coverage: CLEAR` only after re-reading all inputs and confirming
    every material row has current evidence and an owner. Normal flow sets `phase=clarify` and
-   `next_action=/rite-temper`. A low-stakes spec — the significance trigger temper itself
-   skips (rite-temper step 1) — sets `next_action=/rite-define` instead. A contract-neutral later-phase return uses
-   the native restore below; changed behavior or acceptance routes to
-   `/rite-plan repair` instead. Stop without starting the next phase.
+   `next_action=/rite-temper`, or `/rite-define` for low-stakes specs temper skips.
+   Later-phase entries follow the ownership protocol below. Return inline verdicts
+   to the controlling caller; otherwise stop before starting the next phase.
 
 ## Native clarify cursor protocol
 
-The controlling root edits only cursor rows in `state.md`; it must preserve unrelated Markdown and the file's existing table/bullet presentation.
-
-- **Normal entry from Spec:** set `phase=clarify`, `status=running`, and
-  `next_action=/rite-clarify <slug>`; omit both return fields.
-- **Already in Clarify:** no-op. Do not overwrite an existing valid return
-  cursor.
-- **Later-phase entry:** only `temper`, `define`, `plan`, `vet`, `build`,
-  `converge`, `prove`, `polish`, `review`, `seal`, or `ship` may return. First
-  copy the current `phase` and non-empty `next_action` to `return_phase` and
-  `return_next_action`; then set `phase=clarify`, `status=running`, and
-  `next_action=/rite-clarify <slug>`. Missing/unknown cursor values fail closed
-  before any write.
-- **Contract-neutral restore:** after a fresh `Decision coverage: CLEAR`, require
-  `phase=clarify`, both return fields, a recognized later `return_phase`, and a
-  non-empty `return_next_action`. Restore those values to `phase` and
-  `next_action`, set `status=running`, and remove both return fields in the same
-  rewrite. Re-read the cursor and confirm the return rows are absent.
-- **Contract changed:** do not restore the saved cursor. Record drift and route
-  through `/rite-plan repair`, which owns the changed plan and next action.
-
-Never normalize or rewrite the rest of `state.md` while applying this protocol.
+Edit only cursor rows; preserve unrelated Markdown and table/bullet presentation.
+
+- **Validate before writes:** require no return fields or a complete pair:
+  recognized later `return_phase`, non-empty `return_next_action`. Invalid/half
+  pairs fail closed. Later phases: `temper`, `define`, `plan`, `vet`, `build`,
+  `converge`, `prove`, `polish`, `review`, `seal`, `ship`.
+- **Spec entry:** set `phase=clarify`, `status=running`,
+  `next_action=/rite-clarify <slug>`; omit return fields.
+- **Caller-owned pair:** pair with `phase!=clarify` requires a native
+  controlling caller; otherwise stop for ownership recovery. Run bounded Clarify
+  inline, preserve all cursor rows, and return its verdict to caller.
+  Contract changes require Plan repair and Vet before outer resume.
+- **Clarify-owned pair:** standalone later-phase entry without a pair saves current
+  phase/non-empty next action as the pair, then sets `phase=clarify`,
+  `status=running`, `next_action=/rite-clarify <slug>`. Missing/unknown values
+  fail closed. `phase=clarify` resumes without writes; its pair belongs to
+  standalone Clarify, not a nested caller.
+- **Restore:** after fresh `CLEAR`, only the owner restores its pair.
+  Contract-neutral standalone Clarify restores phase/next action, sets
+  `status=running`, atomically unsets both return fields, and re-reads to verify.
+  Contract changes retain the pair through Plan repair and Vet; only its owner
+  consumes it after readiness. Preserve caller pairs.
 
 ## Output
 

package/pack/generated/dsh/skills/rite-prove/SKILL.md

@@ -35,8 +35,9 @@ TTHW, and exact signal-bearing errors; never assert DX (trigger `devex`).
   grammar/hashing. Spec Drift Guard owns revealed contract drift.
 - Root runs vetted gates/browser and records immutable evidence; proof runner
   validates it. Only the bounded wright fixes product source/tests.
-- **Prove remains the controlling caller** during technical backtracking. Save
-  its cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
+- **Prove remains the source-local controlling caller** during technical backtracking;
+  under Autocomplete, repository scheduling stays with Autocomplete. Save
+  Prove's cursor; run Plan repair, Recovery Vet, remediation, and re-proof inline;
   consume nested boundaries; resume the failed rung. A strategy is spent after
   three no-progress attempts on the exact same fingerprint; escalate it per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)
@@ -60,12 +61,15 @@ test changes.
 ## Workflow
 
 1. **Orient.** Read core, resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding), require `state.md`, and read its
-   cursor. On blocked Prove cold resume, reconcile retained consumptive evidence
-   and no-progress corrections before accepting terminal none; a distinct
-   fingerprint below cap resumes offline triage without another real action.
+   cursor. Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Prove's source-local return cursor.
+   On blocked Prove cold resume, reconcile retained consumptive evidence and
+   no-progress corrections before accepting terminal none; a distinct fingerprint
+   below cap resumes offline triage without another real action.
 2. **Freeze scope.** Read spec, tasks, state, test plan, and full diff. Require
-   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the controlling
-   caller) and resumes here; it never authorizes ad hoc proof.
+   every slice built except a [deferred slice](../rite-plan/reference/slicing.md#deferred-slice). Missing `test-plan.md` returns to Vet inline (Prove stays the source-local
+   controlling caller) and resumes here; it never authorizes ad hoc proof.
 3. **Approve commands.** If absent, use
    [test-command-discovery](reference/test-command-discovery.md) over repository
    manifests/CI. Discovery is evidence only: `test-plan.md` is the sole approved runtime
@@ -119,6 +123,10 @@ test changes.
 7. **Independent validation.** Fresh read-only `devrites-proof-runner` and
    `devrites-spec-reviewer`, in one parallel wave, judge the same candidate/commands/evidence/acceptance map.
    Neither runs commands; reject missing/stale, invented-ID, label-only or self-attested reports.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass, retaining both validator handles. Standalone Prove stays source-local.
+   Apply the shared protected validation window and recheck identities before
+   admitting accounts.
 8. **Map proof.** Reconcile verdicts under [acceptance-proof.md](reference/acceptance-proof.md).
    Every criterion/scenario/interaction/key link needs discriminating evidence or a
    blocker, including critical-path, observability, developer and wiring branches.

package/pack/generated/dsh/skills/rite-review/SKILL.md

@@ -62,6 +62,9 @@ Pull these via `Read` when the diff demands them:
 0. Read `.dsh/skills/devrites-lib/reference/standards/core.md` first (the always-on operating rules); pull the
    on-demand rules above as the diff demands them.
    Resolve source per [phase target binding](../devrites-lib/reference/parallel-workspaces.md#phase-target-binding) before loading workspace artifacts.
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery, preserving Review's source-local return cursor.
 1. Read `spec.md`, `tasks.md`, `state.md`, `decisions.md`,
    `touched-files.md`, `.devrites/principles.md` (if present: the binding invariants to score
    the diff against), and the `git diff`. For "what would this change break"
@@ -127,6 +130,10 @@ Pull these via `Read` when the diff demands them:
      [[`agents.md`](../devrites-lib/reference/standards/agents.md) § Result admission](../devrites-lib/reference/standards/agents.md#result-admission).
      Either `Outcome: gap` stops Review; silence, failure, or malformed output never
      becomes an empty findings list.
+   Under Autocomplete, before native wait return scheduling to its global frontier
+   pass with cohort handles retained; standalone Review stays source-local. Apply
+   the shared protected validation window and identity recheck before account
+   admission.
 4. **Reconcile, don't re-review.** With the two parallel reports in hand, the inline
    lead reconciles. It does **not** re-run the code-review axes over correctness /
    readability / architecture / maintainability that `devrites-code-reviewer` already

package/pack/generated/dsh/skills/rite-vet/SKILL.md

@@ -78,6 +78,9 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+   Under Autocomplete, return scheduling for its
+   [global frontier pass](../devrites-lib/reference/parallel-workspaces.md#continuous-global-frontier)
+   before cold/local recovery; preserve Vet's source-local return cursor.
 1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
    record engineering verdict and test-plan coverage. Valid Recovery rechecks
    retain prior depth; enter 1b.
@@ -87,12 +90,18 @@ plan declares a root-authored executable workflow file, read
    parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
    read-only passes on one frozen candidate. Missing required account blocks.
    Meanwhile run root steps 2–4, including step 3 preflight commands, on that
-   candidate; reconcile returned accounts.
+   candidate. Under Autocomplete, before native wait return scheduling to its
+   global frontier pass with reviewer handles retained; standalone Vet stays
+   source-local. Apply the shared protected validation window and identity
+   recheck before reconciling returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
    Freeze that packet and dispatch each exact owning reviewer once,
    fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Under Autocomplete, before native wait use the same controller pass and retained
+   handles as step 1a; standalone Vet stays source-local. Apply the same
+   protected-window account admission.
    Do not rerun broad inventory or unaffected reviewers. Close the prior
    fingerprint only with discriminating evidence plus an explicit
    correction-created regression verdict on the touched invariants (acyclic

package/pack/generated/omp/skills/devrites-lib/reference/parallel-dispatch.md

@@ -55,28 +55,27 @@ If the candidate diff has no matching surfaces, record
    The `agents` dispatch contract needs no flag: `--role` auto-fires it
    (`auto=[agents]` in the output). The command prints `unselected=[...]`; an
    omitted applicable trigger is a gap, not a shortcut.
-3. Enforce the launch barrier through the engine, not prose. Open the wave
-   (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`;
-   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, any one of the
-   wave's rendered `packets/<w>.<role>.md` (hand each agent its own file unedited), and `open` refuses one that seeds a gate result, outcome,
-   count, or "already passed" claim; a Build reviewer wave adds `--slice <SLICE-ID>`
-   so its findings key on that slice; at Review and Seal it also needs the packet to
-   name the frozen candidate diff and the manifest to cover every checkpointed path;
-   a same-tree writer wave adds `--claim-session <id> --claim <path>...` per
-   [`wright-dispatch.md`](skill://rite-build/reference/wright-dispatch.md#run)), launch every native agent nonblocking through the host's own agent
-   tool (never a shell-launched host CLI such as `omp -p` or `claude -p`: that is a
-   dispatch bridge, its PID handle dies with the session, and its return is a `gap`),
-   record each returned host handle
-   (`dispatch ... start --wave <w> --role <r> --handle <id>`) — the last start
-   seals the wave (an explicit `seal` is a no-op), which makes a
-   serial launch-then-wait pattern impossible to record. Record each completion
-   with `dispatch ... return`; a reviewer adds `--result <file>` holding its return verbatim (the engine stores it as `packets/<wave>-<role>.return.md`, derives the outcome from its head, and records its `Finding:` keys; a file already at that path is kept), or `--outcome <findings|no-findings|gap>` when the host cannot hand the return over as a file; `return` refuses before seal. `dispatch status`
-   exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
-   auto-record the dispatch/return metrics events — no separate ledger call. If
-   an opened wave cannot obtain every handle or reach `seal`, run
-   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` (with
-   `--release` on a host-confirmed stop or refused launch) before
-   recording the gap; never leave an open wave to block a retry.
+3. Open a single-use wave; every retry needs a fresh ID:
+   `devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`.
+   Reviewer/auditor/test-analyst waves add `--packet <file>` naming any rendered
+   `packets/<w>.<role>.md`; give each agent its own packet unedited. `open` rejects
+   seeded gate results, outcomes, counts, or pass claims. Build reviewers add
+   `--slice <SLICE-ID>`; Review/Seal packets bind the frozen diff and a manifest
+   covering every checkpointed path. Same-tree writers add `--claim-session <id>
+   --claim <path>...` per [`wright-dispatch.md`](skill://rite-build/reference/wright-dispatch.md#run).
+   Launch all native agents nonblocking through the host tool before waiting.
+   Never shell-launch host CLIs (`omp -p`, `claude -p`): that bridge's handle dies
+   with the session and its return is a gap. Record every host handle with
+   `dispatch ... start --wave <w> --role <r> --handle <id>`; the last seals the wave
+   (explicit `seal` then does nothing). Return only after seal, with the recorded
+   handle: `dispatch ... return --wave <w> --role <r> --handle <id>`.
+   Reviewers add `--result <file>`: retain it verbatim at
+   `packets/<wave>-<role>.return.md` (keep an existing file), derive outcome and
+   `Finding:` keys. If the host cannot provide a file, use explicit
+   `--outcome findings|no-findings|gap`. Status is nonzero for open/sealed/abandoned
+   waves; start/return record metrics. If handles/seal cannot be obtained,
+   `dispatch ... abandon --wave <w> --reason <reason>` before recording the gap;
+   add `--release` only after host-confirmed stop/refused launch.
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
 5. Every dispatch reaches a terminal classification before reconciliation:
@@ -144,32 +143,35 @@ the client renames a field its mocked test still passes, and the verdict reads c
 
 ## Cancellation and terminal reconciliation
 
-Cancellation acknowledgement means the host accepted a request, not that the
-child stopped. A transport timeout likewise leaves execution unknown. Keep the
-child's handle, path/resource ownership and capacity reservation until the
-native host confirms a terminal state and returned work has been reconciled.
-Query or wait on that handle; do not replace the child, release its slot, or
-reuse its resources while it may still run. If terminal state cannot be
-established, record a gap and retain ownership; for a child launched by an earlier
-session, the claim proof below settles it. A result classification alone
-does not prove host termination.
+Cancellation acknowledgement or timeout leaves execution unknown. Keep handles,
+path/resource ownership, and capacity until the native host confirms termination
+and returned work is reconciled. Query/wait; never replace children, release slots,
+or reuse resources prematurely. If unproven, record a gap and retain ownership;
+earlier-session claim proof follows. Outcome classification alone proves no death.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
 status`, `parallel status`, and `claim list` before any dispatch. A read-only
 wave whose handles this session cannot query: `abandon` it, record each unreturned
-role `gap`, and re-dispatch fresh on the current digest; its late returns are
-`stale`. A writer keeps its claim and lease — no relaunch on those paths until the
-claim is released or its holder is proven terminal. For an unqueryable writer,
-`claim list` showing its claim `dead` (the engine proved the holding session
-exited on this host), or `claim list --all --session <id>` showing it `released`
-(bare `list` only counts released rows), is that proof: `abandon` the wave, record the
-role `gap`, claim the paths, and re-dispatch without waiting on the launching
-session. `live` or `expired` stays held. A wright that never returned an
+role `gap`, and re-dispatch under a fresh wave ID on the current digest; its late
+returns are `stale`. A writer retains claim/lease: no relaunch under a fresh wave,
+same session, or expired TTL until release or proven termination. For an
+unqueryable writer, `claim list` `dead` proves its holding session exited on this
+host; `claim list --all --session <id>` shows `released` (bare `list` counts it).
+After that proof, `dispatch <slug> abandon --wave <w> --release --reason <reason>`
+stamps `terminal_at` even without a claim, not a return. Record `gap`, reclaim
+paths, and re-dispatch. `live`/`expired` stays held; cancellation acknowledgement,
+timeout, ordinary abandonment, or replacement cannot prove writer death.
+A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch
 `git diff --name-only` baseline are never cited as built nor discarded, and are
 named in the re-dispatch contract; changes outside task paths stop for the human
 (Converge side: [`rite-converge`](skill://rite-converge/SKILL.md)).
 
+Finalization settles every launched role, including proof/custom/writer roles.
+Abandoned proof/reviewer replacement needs a newer settled account, same canonical
+phase/role/exact unordered slice set, and distinct handle. Writer termination
+admits no bytes and bypasses no candidate, admission, review or proof gate.
+
 ## Scale limits
 
 The role table bounds rosters. Use up to ten concurrent read-only reviewers,

package/pack/generated/omp/skills/devrites-lib/reference/parallel-workspaces.md

@@ -69,6 +69,9 @@ incomplete, stale or human-blocked future work is a planning/repair/blocked
 opportunity, not a fatal pool failure. Retain every readiness reason: fixing stale
 bindings does not waive a coexisting human/access/safety gate. Re-Vet affected
 predecessor assumptions, then record current bindings; never auto-refresh a digest.
+Read archived predecessors in place through the engine's referenced read-only
+readiness lookup. Never copy an archive into live `work/` merely to read/hash it:
+that can resurrect stale controller leases and claims.
 
 ## Recover avoidable serialization
 
@@ -106,13 +109,28 @@ reslicing unchanged work.
 
 ## Continuous global frontier
 
-At entry, each landing, planning/review return and before any wait or final reply:
+Autocomplete executes this bounded pass at every phase entry (including cold
+Prove/Vet/Review), before phase-local recovery, on each landing/planning/review
+return, and immediately before a native wait or final reply. A nested phase
+returns scheduling to Autocomplete; its source-local phase/recovery return cursor
+and pending native reviewer handles remain intact. This is not a second phase
+controller or a persistent frontier artifact.
 
 1. Re-read controller lease, per-source state/questions/readiness and authorized
-   sequence. Scan all stages, not only the owner's next local slice. While writers
-   run, root advances authorized Spec → Clarify → Temper → Define/Plan → Vet,
-   including narrow repair/re-Vet of prepared targets, under unchanged approval
-   and safety rules. Missing human authority blocks that target, not safe siblings.
+   sequence. Examine every recorded authorized source once per pass, not only
+   the owner's next local slice or first blocked child. Prepare absent targets
+   through authorized native Spec → Clarify → Temper → Define/Plan → Vet; repair
+   and re-Vet current readiness of prepared targets now, not after owner Seal.
+   Assess actual source gates, claims and explicit planning/Build restrictions
+   before routing. Owner-local red/human/access gates withhold that owner or its
+   actual consumers, not independent authorized planning; true whole-run safety,
+   access and claim constraints still bind. Retain concrete actions or blockers
+   in existing source artifacts under normal write authority.
+   Yield a child at its pending reviewer/phase boundary back to this controller;
+   never recursively wait for child completion while parent returns are pending.
+   Reconcile available parent returns before another pass. A native wait is
+   justified only after concrete authorized actions/blockers across the pool
+   have been examined; reading later phase skills is not pending Plan/Vet work.
    If an explicit/AFK capacity change differs from retained capacity, reconcile it
    before selection using `parallel add --root <repo> --slug <controller> --cap N --json -`
    with stdin `[]`. This changes capacity only, not workers or a complete lease's
@@ -137,11 +155,14 @@ At entry, each landing, planning/review return and before any wait or final repl
    Unsupported isolation uses truthful serial owner dispatch and ordinary ordered
    handoff, never early same-tree foreign Build or concurrent same-worktree writers.
 4. Launch every selected native writer before waiting on any; keep scheduling
-   planning and independent review while they run. Land each individually green
-   sibling through Build review/proof and `parallel integrate --slice <key>`;
-   refill immediately from the whole authorized pool. A red sibling repairs in
-   place and holds its slot/paths; it does not delay independent green landings.
-   Never satisfy a producer edge on writer return or green-but-unlanded work.
+   planning and independent review while they run, including while the owner
+   awaits Prove/Vet/Review accounts. Apply the protected window below before any
+   landing: defer control mutations while frozen validation is pending. Outside
+   that window, land each individually green sibling through Build review/proof
+   and `parallel integrate --slice <key>`; refill immediately from the whole pool.
+   A red sibling repairs in place and holds its slot/paths; it does not delay
+   independent safe landings. Never satisfy a producer edge on writer return or
+   green-but-unlanded work.
    After worker-bound review/proof and source bookkeeping finish, prune only
    verified clean integrated checkouts with `parallel prune --root <repo>
    --slug <controller>`. Retain transfer refs/lease identities; dirty or ignored
@@ -182,8 +203,17 @@ controller bookkeeping nor sibling proof closes a child's acceptance.
 
 Prove/Polish/Review/Seal remain per workspace with fresh candidate bindings. Shared
 durable Polish outputs serialize; source changes invalidate affected evidence.
-Before any non-lease product correction, shared durable Polish write or control
-checkpoint, freeze new writer admissions, drain/reconcile retained writers, land
+From candidate freeze/validator dispatch through account admission, preserve the
+exact candidate, control tip and all consumed metadata/validator inputs. Independent
+authorized planning and isolated writers may proceed only without changing those
+inputs or shared runtime resources. Defer integration, checkpoints, cross-source
+corrections and consumed-artifact edits until the window closes; retained green
+workers keep their identities/slots. Recheck candidate, control-tip identity and
+consumed inputs before accepting each account; drift invalidates affected accounts
+and requires native fresh validation, never acceptance against a moving tip.
+After any protected validation window closes, before a non-lease product correction,
+shared durable Polish write or control checkpoint, freeze new writer admissions,
+drain/reconcile retained writers, land
 safe green work and cleanup the lease. Preserve blocked work; never force-clean
 it merely to advance a phase. Perform phase-owned correction/proof/checkpoint,
 then resume the pool from new HEAD. Never accept unrelated commits as expected
@@ -192,6 +222,10 @@ ControlTip or invent phase slices. Read-only frozen proof/review and planning-on
 Normal ordered handoff reuses the same controller and prepared child cursor.
 Never archive controller/source while retained lease owns it; clean up owned
 workers first, preserving salvage and unknown outcomes.
+Global scheduling is not global gating or ordered handoff. Unmet or abandoned
+owner gates remain non-green: an owner request to defer obligations routes Spec
+Drift Guard → Plan → affected Vet under existing authority, or retains the blocked
+source. It never becomes Prove green or Seal GO merely to reach another source.
 
 Early child WIPs can interleave with parent WIPs. Parent-only Ship must not absorb
 those commits as if parent alone were sealed. Deferred release waits for every