devrites 7.3.1 → 7.3.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [7.3.2](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.1...v7.3.2) (2026-11-02)
+
+### Fixed
+
+* **devrites:** harden lifecycle, installer and host safety ([#205](https://github.com/ViktorsBaikers/DevRites/issues/205)) ([cac2f8a](https://github.com/ViktorsBaikers/DevRites/commit/cac2f8ab657bbe0d44198ed587413779cf5ac44d))
+
 ## [7.3.1](https://github.com/ViktorsBaikers/DevRites/compare/v7.3.0...v7.3.1) (2026-11-01)
 
 ### Fixed
@@ -43,6 +49,22 @@ All notable changes to DevRites are documented here. The format follows [Keep a
   workspaces or reviving their controller leases.
 - Execute Autocomplete's global frontier at cold Prove/Vet/Review and native wait
   boundaries; preserve frozen candidates, standalone scope, and non-green gates.
+- Preserve selected workspace identity across native command forms, resolver
+  resumes, and handoffs; reject empty answers and invalid wait transitions before
+  publishing question changes.
+- Keep candidate and next-step observations read-only, and retain unfinished Build
+  and Polish work even when their required documents already exist.
+- Confine installer reads and mutations to the validated project root; acquire
+  shared-marker ownership before changing configuration, replay disabled-host
+  update flags, and reject linked pin destinations outside the project.
+- Preserve uninstall ownership after binary-removal failures so ordinary retries
+  work without touching another installation. Stage Windows launcher uninstalls
+  outside the installed image; refuse direct self-removal before project changes.
+- Bind Overhaul scorecards to current calculator inputs and admitted receipts to
+  immutable generation hashes; require complete writer reservations and
+  lane-matched coverage proof.
+- Serialize Overhaul's shared-tree writer observation windows without filtering
+  away unauthorized changes; retain parallel read-only review on immutable inputs.
 
 ## [7.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v7.2.7...v7.2.8) (2026-10-31)
 

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v7.3.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v7.3.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v7.3.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -288,6 +288,12 @@ npx devrites@latest uninstall
 npx devrites@latest uninstall --keep-binary
 ```
 
+On Windows, use `npx devrites@latest uninstall` or the Bash `uninstall.sh`
+launcher to remove the shared engine binary. These launchers run a private
+temporary copy so Windows can delete the original installed executable.
+Direct `devrites-engine uninstall` cannot delete its own running image and
+refuses before changing project files; use the launcher or `--keep-binary`.
+
 Run `npx devrites@latest --help` for common flags and
 `npx devrites@latest <command> --help` for command-specific flags.
 
@@ -387,6 +393,10 @@ blocks uninstall and dropped-host pruning, including dry runs, before writes.
 Existing files retain their permission bits. Claude permission ownership is
 recorded before settings replacement, so interrupted merges retain the records
 needed to remove installer-added grants on retry and uninstall.
+User-pinned aliases keep their recorded ownership hashes; refreshing does not
+silently adopt local edits. Shared-config marker collisions fail before writes.
+Legacy hook cleanup matches known shipped commands, not user commands that merely
+mention DevRites.
 Marker-merged files keep user content outside the DevRites block, and
 `.devrites/` runtime state stays in place. `update` reuses the install flags
 recorded in the manifest; flags you pass explicitly win and are recorded. The installer refuses symlinks, junctions, and paths that
@@ -395,8 +405,11 @@ escape the target.
 The optional shared `devrites-engine` binary is the only artifact installed
 outside the project. Before replacement, the staged release binary must report
 the requested version; after installation, the binary at its final path must
-report it again in a new process. The installer keeps a backup until the
-second check passes and restores it on failure.
+report it again in a new process. The selected binary is installed after merge
+preflight but before project payload and version publication, so binary failure
+leaves an ordinary update retry possible. The installer keeps a backup until the
+second check passes and restores it on failure. If restoration also fails, it
+retains the backup and reports its recovery path.
 
 `devrites-engine update` resolves the latest stable release, acquires its
 bundle and platform binary, and hands local paths to the downloaded engine, so
@@ -549,6 +562,9 @@ npm test
 (cd engine && go test ./... -count=1)
 ```
 
+Native Windows launcher integration tests also require Node and Git for Windows
+(including Git Bash). They exercise the real installed engine through both launchers.
+
 Canonical pack changes belong in `pack/.claude/`. Rebuild host payloads with
 `bash scripts/build-host-artifacts.sh` instead of editing `pack/generated/`.
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the development workflow and

package/bin/devrites.mjs

@@ -2,10 +2,10 @@
 // devrites - npx entry point for the engine-owned DevRites installer.
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { chmodSync, createReadStream, existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { chmodSync, copyFileSync, createReadStream, existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { constants as osConstants, tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -108,6 +108,31 @@ function runEngine(command, args, env) {
   });
 }
 
+function windowsInstalledEngine() {
+  const dirs = (process.env.PATH || '').split(';');
+  if (process.env.NoDefaultCurrentDirectoryInExePath === undefined) dirs.unshift(process.cwd());
+  for (const dir of dirs) {
+    if (!dir) continue;
+    const candidate = resolve(dir.replace(/^"|"$/g, ''), 'devrites-engine.exe');
+    try {
+      if (statSync(candidate, { throwIfNoEntry: false })?.isFile()) return candidate;
+    } catch {}
+  }
+  return null;
+}
+
+function stageWindowsUninstall(engine) {
+  if (!engine || command !== 'uninstall' || process.platform !== 'win32' || temporaryDirs.has(dirname(engine))) return engine;
+  try {
+    // Windows cannot unlink the running installed image; launch a private copy.
+    const staged = join(privateTempDir(), 'devrites-engine.exe');
+    copyFileSync(engine, staged);
+    return staged;
+  } catch (error) {
+    throw new Error(`could not stage devrites-engine for Windows uninstall: ${error.message}`);
+  }
+}
+
 async function acquireEngine() {
   const repo = process.env.DEVRITES_REPO || 'ViktorsBaikers/DevRites';
   const tag = normalizeReleaseTag(process.env.DEVRITES_REF || pkgVersion());
@@ -123,7 +148,8 @@ async function acquireEngine() {
     acquisitionFailure = `${envEngine} reports version '${got}', want ${tag}`;
     return null;
   }
-  if (command === 'uninstall' && spawnSync('devrites-engine', ['uninstall', '-h'], { stdio: 'ignore' }).status === 0) return 'devrites-engine';
+  const installedEngine = command === 'uninstall' && process.platform === 'win32' ? windowsInstalledEngine() : 'devrites-engine';
+  if (command === 'uninstall' && installedEngine && spawnSync(installedEngine, ['uninstall', '-h'], { stdio: 'ignore' }).status === 0) return installedEngine;
 
   // A git checkout's payload can be ahead of the published engine of the same
   // version, so a checkout builds its own engine before downloading one.
@@ -135,7 +161,7 @@ async function acquireEngine() {
   const built = checkout ? null : buildEngine(tag);
   if (built) return built;
 
-  if (command === 'uninstall') return 'devrites-engine';
+  if (command === 'uninstall') return installedEngine;
   const probe = spawnSync('devrites-engine', ['version'], { encoding: 'utf8' });
   if (!probe.error && probe.status === 0 && String(probe.stdout).trim().replace(/^v/, '') === tag.slice(1)) return 'devrites-engine';
   return null;
@@ -316,7 +342,7 @@ if (first && SUBCOMMAND_ALIASES.has(first)) {
 
 let engine;
 try {
-  engine = await acquireEngine();
+  engine = stageWindowsUninstall(await acquireEngine());
 } catch (error) {
   console.error(`devrites: ${error.message}`);
   process.exit(1);

package/docs/engine/commands.md

@@ -38,7 +38,7 @@ workflow strategy.
 | `handoff [slug] [--resume]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, in-flight dispatch waves (`inflight_wave:` lines: phase, state, pending roles, slices), missing required files, the canonical read-next order, and the same `continuation:` lines as `check continuation`. Read-only unless `--resume`, which appends one `resume` event (role root) to `metrics.jsonl`; `metrics summary` then reports minutes from each resume to the next dispatch. The `/rite-handoff` spine and the compaction-fallback entry point. |
 | `recall --paths <p1,p2,...> [--limit n]` | Read-time query over `.devrites/archive/`: list archived features whose `touched-files.md` candidate manifest covers a queried project-relative path (exact or directory prefix, case-folded), ranked by overlap count, then newest archive-directory mtime, then slug (default 10 features). Each feature prints up to 8 `archive/<slug>/<file>:<line>` pointers, then `+N more`: `decisions.md` `DEC-###` entries and `## Carry-forward constraints` bullets whose `Files:` overlap (or a constraint naming no files), plus `review.md`/`seal.md`/`drift.md` lines that mention a queried path; fenced examples are ignored. Never writes, caches, or indexes (no metric either); symlinked archive entries are refused. An unreadable archive file prints `unreadable:` and the scan continues. Exit `0` (including `recall: no archive`), `1` invalid archive directory, `2` usage. |
 | `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--recheck <inventory>] [--trigger a,b] [--inline-contract] [--whole]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A root `--phase build\|autocomplete` bundle (no `--role`, no `--slice`) defaults to `--slice <active_slice>` while the state.md cursor phase is `build` and active_slice names a slice present in tasks.md (prints `scope: slice SLICE-### (auto from state.md) ...`), unless `.devrites/AFK` `max_parallel` is 2 or more or a parallel lease is `running` (the bundle stays whole); `--whole` opts out. Every bundle opens, after its header comments, with a table of contents: one `L<start>-<end> <section label>` line per `===== label =====` section, giving its exact line range in the bundle file. A bundle without `--role` (the root's own read) gives over-budget artifacts as by-reference indexes; a `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. When the contract resolves under `.claude/agents`, `.omp/agents`, or `.codex/agents` (the host loads it as the agent's system prompt), the bundle writes one header line naming its path, size, and SHA-256 instead of the body; other layouts (pi, devin, unknown) and `--inline-contract` (only with `--role`) inline the body, and a missing contract still exits `3`. Inside inlined files, a `--role` bundle replaces each `<!-- root-only -->`…`<!-- /root-only -->` block with a one-line stub naming the omitted heading, and does the same for each `<!-- model-surface -->` block unless the role is `security-auditor`, the feature has an `ai-spec.md`, or `spec.md`/`plan.md`/`tasks.md`/`design-brief.md` are absent or (outside the spec template's `AI-SPEC annex`) name a model, agent, RAG, or tool surface; an unbalanced or headingless marker exits `2`. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact, and each artifact over 16 KiB except `spec.md`, into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. In phase `build`, a `--role` bundle other than `slice-wright` without `--slice` exits `3` (`unscoped build reviewer bundle`). `--recheck <inventory>` (phase `build`, with `--role` and `--slice`; path relative to the workspace) writes `<phase>-<role>.<slice>.recheck.bundle.md`: the inventory file and `core.md` inline whole, every other non-`rootOnly` pack file becomes a by-reference index (path, SHA-256, headings with line numbers) followed by each section the inventory cites as `<file>.md § <heading>`; workspace handling matches `--slice`. A missing or empty inventory exits `2`. First reviews, full-inventory rechecks, Vet, `/rite-review`, and Seal do not use it. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); re-opening an abandoned wave inherits its kept claim or, with new claim flags, replaces and releases it; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon\|attribute>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; the start that gives the last role its handle seals the wave, and an explicit seal on a sealed wave is a no-op; `open --claim-session <id> --claim <path>... [--claim-ttl <minutes>]` records one file claim for the wave in claims.jsonl and exits `3`, creating no wave and no claim, while a live foreign session holds an overlapping path; the return that completes the wave releases that claim; `abandon --release` releases it on any other host-confirmed terminal path (a stop or a refused launch); wave IDs are single-use, including after abandonment; a new attempt needs a new ID, and retained overlapping writer claims require explicit release or host-grounded termination rather than TTL expiry or session reuse; claim flags apply to open only and `--release` to abandon only; start/return auto-record metrics, `return --outcome findings|no-findings|gap` records the role's Outcome line, and `abandon` records its reason, so `metrics summary` shows per-role yield and lost waves. Bare `status` prints every open, sealed, or abandoned wave and folds complete waves into one `N complete wave(s) (use --all)` line; `--all` lists every wave; it still exits nonzero while any wave is open or sealed. For a reviewer, auditor, or test-analyst role, `return --result <file>` stores the return verbatim as `packets/<wave>-<role>.return.md` (exit `3` if that file exists), derives the outcome from its `Outcome:`/`Counts:` head (a malformed or inconsistent head records `gap` with a warning, never `no-findings`), exits `3` when an explicit `--outcome` disagrees, and records each `Finding:` row's `role|slice|file|section|severity` key, so `metrics summary` adds per-role `resolution: resolved re-raised open late` counts. A `--result` file that already is that `packets/` path is kept as the stored return. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; a reviewer-only wave (for example a Build slice review) may take it, uncapped, so its `Finding:` keys name that slice; a reviewer, auditor, or test-analyst wave needs `--packet <file>` and `open` exits `3` on a packet that seeds a conclusion (gate `*-PASS` token, `no-findings`, an `Outcome:`/`Counts:` line, an "already passed" claim, or zero Critical/Important counts) or tells the agent to read an installed `agents/devrites-*.md`/`.toml` role contract (on the line or under a "Read …" heading or label; canonical `pack/` paths excepted), and a wright wave's `--contract` gets the same role-contract check; a Review or Seal reviewer wave also exits `3` unless the packet names an existing non-empty `.diff`/`.patch` file and the manifest covers every checkpointed path; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. `open` also warns when an earlier wave for the same slice never returned. Under `.devrites/AFK` max_parallel >= 2, a build wright wave that leaves `parallel select --from-plan` picks unstarted exits `3` (printing the batch, the command and the parallel-batch lifecycle) until evidence.md records `serial: <skipped ids> — <reason>`; a repair round or a running lease slice does not waive those picks, and a reason that only says the skipped slice is repairing, already started, or in a wave does not count. A wave naming two or more slices needs one `--role slice-wright.<SLICE-ID>` per slice; one shared role exits `3`. HITL runs are never width-refused. A build wright `--contract` must name `gates precheck` under `Writer-safe checks:` when gates.md has a `RUN: writer` gate. `open` exits `3` when a `--role` names no pack agent in a project-level install (a `.<lane>` suffix is allowed), and lints a reviewer packet against the wave's roles, so a recheck may name its own role's fingerprint. Root-edit tripwire (ADR-0038): the first `open` records `<feature>/tree-baseline.json`, which maps dirty product paths outside `.devrites/` and `.scratch/` to their mode plus SHA-256, accepted as user work. The return that completes a wright wave (any phase) adds its slice write sets and claim paths. `open` exits `3` with `unattributed root edit: <paths>` while a dirty product path differs from that baseline and no live claim or in-flight wright wave covers it, unless the new wright wave covers the path through `--claim` or a slice write set. `attribute --reason <evidence> --path <path>...` records owner work, gate output, a standalone wright, or a sanctioned root write for flagged paths only. Each finding writes an `unattributed-edit` metrics row. The engine never reverts a file, and a workspace without the baseline is never blocked. |
 | `candidate freeze <slug> --wave <w> (--slice <SLICE-ID> \| --paths <path>...) [--base <ref>] [--worktree <path>]` | Writes packets/<w>.diff (tracked changes vs base, default HEAD, plus untracked files as /dev/null diffs) and packets/<w>.sha256 (base, diff digest, per-file sha256, aggregate check-candidate digest); never replaces a wave's frozen candidate with a different one. `--worktree <path>` (requires `--base`) reads the same path set from a parallel sibling's linked worktree before it lands: the path must be a symlink-free worktree top level that `git worktree list` names, shares the control repository, and is neither a submodule nor the control checkout. It exits `3` on uncommitted path-set changes there and adds a `head <sha>` row naming the worktree HEAD (the transfer commit); packets stay in the control workspace. |
 | `packet <slug> --wave <w> --phase <p> --role <r> [--slice <SLICE-ID>] [--recheck] [--checks <G-ID,...>] [--focus <file>]` | Renders one reviewer/auditor/test-analyst or same-worktree slice-wright by-reference packet (packets/<w>.<role>.md, or packets/<w>.contract.md for a wright) naming the context bundle (the .recheck bundle with `--recheck`) and frozen diff. It copies packets/<w>.sha256 (header rows only when large), lists a wright slice's tasks.md `Tests/proof` as its first writer-safe check, resolves `--checks` through gates.md and approved preflight rows (adding `gates precheck` for `RUN: writer` gates), and accepts only anchored `--focus` rows (a doubt-reviewer's 1-3 row claim is required). It runs the dispatch open lints on a draft and never replaces a prior packet with a refused one (exit `3`). |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
@@ -47,10 +47,10 @@ workflow strategy.
 | `note <add\|list\|check\|rm> <slug> ...` | Anchored workspace notes in `notes.md`: `add <slug> <subject> <quote> <title> [body]` binds a note to a verbatim quote in one repository file and assigns `NOTE-###`; `list` and `check` regrade each anchor `exact`/`moved`/`stale`/`ambiguous`/`lost` by searching the repo for the quote (dependency and workspace trees excluded); `check --repair` rewrites a `moved` subject to its new file; `rm` deletes by ID. `check seal` refuses a malformed `notes.md` and any non-`exact` anchor. |
 | `gates <scaffold\|status\|run\|reverify\|lint\|precheck\|attest\|abandon> <slug>` | Operate the `gates.md` acceptance ledger: seed per-AC gates, execute runnable gates bound to `test-plan.md` preflight rows, attest manual gates, and reduce to `all-met`/`not-met`/`handoff`/`malformed`. A gate with `INPUTS:` records its files' content digest and is reused by `run` and `reverify` while they are unchanged. `run`/`reverify --transcripts` atomically publishes a private redacted v2 executed transcript, or returns its verified originating record unchanged, under `references/gates/<gate-id>/`; legacy v1/reuse-only logs cannot authorize reuse. `precheck <slug> --worktree <path> [--slice <SLICE-ID>]` runs every `RUN: writer` gate and `check windows` against the wright's worktree (with `--slice`, it prints `SKIP <gate-id>` for a gate whose id only other unbuilt slices name in `tasks.md`, since gate ids reuse `AC-###` ids; a gate no slice names still runs), prints PASS/FAIL per gate id, exits `3` on any FAIL or on a malformed ledger, and writes no ledger, EVIDENCE line or transcript (`check windows` still appends its metric event); its output is never evidence. |
 | `state resolve <qid> "<answer>"` | Resolve an open question and update `questions.md` plus `state.md` atomically. |
-| `state merge-manifest <slug> [pred...]` | Fold the recorded predecessor chain's manifests into the release candidate manifest. |
+| `state merge-manifest <slug> [pred...]` | Fold the complete recorded predecessor chain's manifests into the release candidate manifest. Numbered sequences must reach position 1 through consecutive, unique positive positions; explicit predecessor lists cannot omit recorded members. Fully unnumbered legacy chains remain supported. Invalid or missing members leave the manifest unchanged. |
 | `state set <slug> <key>=<value>... [--unset <key>]...` | Write `state.md` cursor fields all-or-nothing under the feature lock. Refuses an unknown `phase`, the engine-owned `schema` row, a pipe or line break in a value, and an overwrite of a saved `return_phase`/`return_next_action`. Setting `status=awaiting_human` under `.devrites/AFK` prints each open question the sentinel's `allow_gates` auto-picks. |
 | `state append <slug> <ledger.md> --heading "<text>" --body-file <path\|->` | Append one `## <heading>` section to `assumptions.md`, `decisions.md`, `drift.md`, `evidence.md`, or `questions.md` atomically. Refuses a heading that already exists outside fenced code and a body line that opens another `#`/`##` section; for a new `questions.md` `q-` entry, also refuses a non-open status, a missing or unknown gate, a raised_at that is not a full RFC 3339 timestamp, options outside 2-4 concrete choices plus the closing "Something else" escape hatch, `(Recommended)` on any option but 1, and `proposed:` without a `(Recommended)` option 1 (or option 1 without `proposed:`); question or entry length is advisory only; reports an advisory when the ledger passes its line budget, and blocks (exit 3, nothing written) when a ledger other than evidence.md would land at or above 1.5x its line or byte budget without a covering `Budget override: <=N lines; <reason>` (N at most 2x the line budget). |
-| `state close <slug>` | Archive a shipped workspace and clear matching `ACTIVE`. |
+| `state close <slug>` | Archive a workspace and clear matching `ACTIVE`. Final phases/statuses enforce Seal structure, candidate freshness, release-union integrity, retained reviewer settlement, and runnable gate origins before mutation. Explicit nonfinal exits remain physical archival, not proof of delivery. |
 | `migrate <slug> [--dry-run] [--answer id=choice]` | Normalize a pre-v5 workspace to the current schema; fail-closed, one-shot. |
 | `secret-scan [--staged] [--stdin] [slug]` | Scan exact staged blobs, stdin, or touched regular files for credential material. |
 | `open-visual <path-or-name> [--slug <slug>] [--no-open]` | Resolve a local visual HTML file, optionally open it in the OS browser, warn if the sibling outline is missing or inventory ids are absent from HTML, and print agent path tips. No network. |
@@ -65,6 +65,38 @@ The full label remains in bundle filenames and attribution. Reviewer
 `--outcome findings|no-findings|gap`; omitting both refuses the return without
 changing the wave or releasing its claim. Non-reviewer returns are unchanged.
 
+Generated packets bind an immutable wave/role context snapshot and its actual
+SHA-256, not a mutable generic or recheck bundle. Workspace overrides retain their
+validated metadata namespace; foreign paths, escapes, and linked context parents
+cannot replace that authority.
+
+Seal and final closeout require settled native accounts for every launched role;
+open/sealed proof, custom, and writer roles block too. At least one actual reviewer
+account remains required. Abandoned proof/reviewer accounts need a genuinely newer
+settled account with the same canonical phase, role, and exact unordered slice set,
+a distinct native handle, and valid start/return times. An abandoned writer or
+claim-holder instead needs its actual native returns or host-confirmed termination
+recorded by `dispatch abandon --release`; replacement work alone cannot prove death.
+That command records `terminal_at` even for a claimless or refused launch, without
+fabricating returned work or review approval. A failed claim release cannot stamp it.
+An empty, missing, or malformed dispatch ledger cannot establish settlement.
+Every met runnable gate must retain its approved, bound execution origin, including
+complete v2 metadata/footer and matching body bytes when unredacted and untruncated.
+These final checks do not rerun proof commands.
+
+Feature mutation locks live at `.devrites/.locks/features/<slug>/.lock`, outside
+movable workspace directories, and remain held through archival and `ACTIVE`
+updates. A closed slug cannot recreate a work directory through a stale writer.
+Stop existing controllers before upgrading, then restart them together; old and
+new lock protocols must not run concurrently.
+
+Vet readiness identities bind normalized `gates.md` definitions: gate membership,
+IDs, titles, `CHECK`, `EXPECT`, `CWD`, `INPUTS`, and `RUN`. Checkbox, evidence, and
+progress changes do not invalidate Vet; changing an oracle or converting a
+runnable gate to manual requires Plan repair and re-Vet. Older identities that
+omitted these definitions require normal re-Vet after upgrade, never a manual
+hash refresh or inferred approval.
+
 `help`, `-h`, and `--help` print this operational inventory. Each operational
 command and subcommand also accepts `-h` / `--help` and prints that command's
 usage to stdout without requiring a workspace. `version` and `--version` print

package/docs/release.md

@@ -24,8 +24,11 @@ version and run these steps:
 
 The release archive
 consumes the validated generated files from the same Git index as the rest of
-its payload. Package and release installs validate and copy
-`pack/generated/{claude,codex,omp,pi,devin}`. When a shell install or update shim runs from a
+its payload. Prior build outputs under `engine/dist/` remain excluded even when
+indexed.
+
+Package and release installs validate and copy
+`pack/generated/{claude,codex,omp,pi,devin,dsh}`. When a shell install or update shim runs from a
 source checkout whose generated payload is incomplete, the shim may regenerate
 the missing host payload before handing that local candidate to the engine. The
 engine itself only validates and copies host payloads; it never generates them.

package/engine/Makefile

@@ -1,7 +1,7 @@
 BINARY  := devrites
 DIST    := dist
-# darwin/amd64 kept for Intel Macs; the five targets the release matrix ships.
-PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64
+# darwin/amd64 kept for Intel Macs; the six targets the release matrix ships.
+PLATFORMS := darwin/arm64 darwin/amd64 linux/amd64 linux/arm64 windows/amd64 windows/arm64
 
 .PHONY: build test test-race vet quality govulncheck lint cover crosscompile clean
 

package/engine/internal/acceptance/newfinal_origins.go

@@ -0,0 +1,39 @@
+package acceptance
+
+import "fmt"
+
+// CheckRetainedOrigins checks current runnable met gates without executing commands.
+// Historical candidate labels remain valid when the definition and INPUTS match.
+func CheckRetainedOrigins(root, slug string) error {
+	work, ledgerPath, testPlanPath, project, err := featurePaths(root, slug)
+	if err != nil {
+		return err
+	}
+	text, err := ReadLedgerFile(ledgerPath)
+	if err != nil {
+		return err
+	}
+	doc := ParseLedger(text)
+	if len(doc.Errors) != 0 {
+		return fmt.Errorf("retained gate origins: invalid %s: %v", GatesFile, doc.Errors)
+	}
+	approved := loadTestPlan(testPlanPath)
+	for _, gate := range doc.Gates {
+		if gate.Check == "" || GateState(gate, doc) != StateMet {
+			continue
+		}
+		if !Approved(gate.Check, gate.Cwd, approved) {
+			return fmt.Errorf("gate %s: CHECK/CWD is not approved by current test-plan.md; restore the approved definition and record its passing origin", gate.ID)
+		}
+		if gate.Inputs != "" {
+			inputs, err := InputsDigest(project, gate.Inputs)
+			if err != nil || inputs == "" || inputs != recordedInputs(gate) {
+				return fmt.Errorf("gate %s: retained origin does not match current INPUTS; record a passing approved check against current inputs", gate.ID)
+			}
+		}
+		if passingOrigin(work, gate) == "" {
+			return fmt.Errorf("gate %s: no usable retained passing origin; record the approved check with gates run --transcripts", gate.ID)
+		}
+	}
+	return nil
+}

package/engine/internal/acceptance/preconditions.go

@@ -44,13 +44,20 @@ func PreflightRowsPassed(root, slug string, rows []PreflightRow) (bool, error) {
 	return true, nil
 }
 
-// PreflightPassed reports whether the row's newest transcript under
-// <work>/references/gates/ records RESULT: pass. The transcript records its
-// candidate but the lookup does not compare it: Vet writes workspace artifacts
-// after the run, and only a change to the row's command or cwd retires a pass.
+// PreflightPassed requires the newest transcript to be a complete passing record
+// for this row. Historical candidate labels do not retire an unchanged row.
 func PreflightPassed(work string, row PreflightRow) bool {
-	dir := filepath.Join(work, "references", "gates", transcriptGateName(PreflightGateID(row)))
-	entries, err := os.ReadDir(dir)
+	dir, err := transcriptDirectory(work, PreflightGateID(row), false)
+	if err != nil {
+		return false
+	}
+	defer func() { _ = dir.Close() }()
+	listing, err := dir.Open(".")
+	if err != nil {
+		return false
+	}
+	entries, err := listing.ReadDir(-1)
+	_ = listing.Close()
 	if err != nil {
 		return false
 	}
@@ -67,11 +74,10 @@ func PreflightPassed(work string, row PreflightRow) bool {
 	if newest == "" {
 		return false
 	}
-	// #nosec G304 -- transcript path built from the workspace and a sanitized row id
-	body, err := os.ReadFile(filepath.Join(dir, newest))
-	// Only the header counts: command output could print the verdict line.
-	header, _, _ := strings.Cut(string(body), "--- OUTPUT ---")
-	return err == nil && strings.Contains(header, "\nRESULT: pass\n")
+	body, err := readTranscript(dir, newest)
+	gate := &Gate{ID: PreflightGateID(row), Title: row.Gate, Check: row.Command, Cwd: row.Cwd,
+		Expect: "exit 0 (Expected: " + valueOr(row.Expected, "unstated") + ")"}
+	return err == nil && validTranscript(string(body), gate, nil)
 }
 
 // RunPreconditions is `check preconditions <slug> [--slice S]`: it executes

package/engine/internal/acceptance/transcript.go

@@ -236,6 +236,11 @@ func readTranscript(dir *os.Root, name string) ([]byte, error) {
 }
 
 func validOrigin(raw string, gate *Gate, evidence []string) bool {
+	return validTranscript(raw, gate, evidence)
+}
+
+// validTranscript validates complete executed records; evidence additionally binds ledger proof.
+func validTranscript(raw string, gate *Gate, evidence []string) bool {
 	const footer = "TRANSCRIPT_SHA256: "
 	end := strings.LastIndex(raw, footer)
 	if end < 0 || raw[end:] != footer+OutputDigest(raw[:end])+"\n" {
@@ -261,14 +266,25 @@ func validOrigin(raw string, gate *Gate, evidence []string) bool {
 	for key, want := range map[string]string{
 		"GATE": transcriptMetadata(gate.ID), "TITLE": transcriptMetadata(gate.Title),
 		"COMMAND": transcriptMetadata(gate.Check), "CWD": transcriptMetadata(valueOr(gate.Cwd, ".")),
-		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": evidence[1],
-		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")), "INPUTS_SHA256": valueOr(evidence[4], "none"),
-		"RESULT": "pass", "EXIT": "0", "OUTPUT_SHA256": evidence[2], "OUTPUT_BYTES": evidence[3],
+		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": DefinitionDigest(gate),
+		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")),
+		"RESULT": "pass", "EXIT": "0",
 	} {
 		if got, exists := fields[key]; !exists || got != want {
 			return false
 		}
 	}
+	if evidence != nil && (fields["DEFINITION_SHA256"] != evidence[1] || fields["OUTPUT_SHA256"] != evidence[2] ||
+		fields["OUTPUT_BYTES"] != evidence[3] || fields["INPUTS_SHA256"] != valueOr(evidence[4], "none")) {
+		return false
+	}
+	if fields["INPUTS_SHA256"] != "none" && !transcriptDigestRE.MatchString(fields["INPUTS_SHA256"]) {
+		return false
+	}
+	bytes, err := strconv.ParseInt(fields["OUTPUT_BYTES"], 10, 64)
+	if err != nil || bytes < 0 || !transcriptDigestRE.MatchString(fields["OUTPUT_SHA256"]) {
+		return false
+	}
 	started, err := time.Parse(time.RFC3339Nano, fields["STARTED"])
 	if err != nil || started.IsZero() {
 		return false
@@ -286,7 +302,10 @@ func validOrigin(raw string, gate *Gate, evidence []string) bool {
 		return false
 	}
 	truncated, err := strconv.ParseBool(fields["TRUNCATED"])
-	return err == nil && len(output) <= maxTranscriptOutput && (!truncated || len(output) == maxTranscriptOutput)
+	if err != nil || len(output) > maxTranscriptOutput || (truncated && len(output) != maxTranscriptOutput) {
+		return false
+	}
+	return redactions != 0 || truncated || (bytes == int64(len(output)) && fields["OUTPUT_SHA256"] == OutputDigest(output))
 }
 
 func exitLabel(outcome RunOutcome) string {

package/engine/internal/gate/gate.go

@@ -316,23 +316,25 @@ var (
 	specAcceptanceClaimRE       = regexp.MustCompile(`(?im)^\s{0,3}#{1,6}\s+.*acceptance criteria|\bAC-\d+\b`)
 )
 
-// specClaimsAcceptance reports whether structural (unfenced) spec text looks
+// specClaimsAcceptance reports whether spec prose looks
 // like it carries acceptance criteria, so a parse that finds none is a defect
 // in the spec rather than a spec with nothing to map.
 func specClaimsAcceptance(spec []byte) bool {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	return err == nil && specAcceptanceClaimRE.Match(structural)
 }
 
-// specUnreadAcceptanceProblems names acceptance text the parser skips: ids that
-// are not exactly three digits and acceptance headings after the first
-// canonical one, which would otherwise escape the coverage check.
+// specUnreadAcceptanceProblems names acceptance text the parser skips:
+// noncanonical ids/headings and declarations outside the canonical section.
 func specUnreadAcceptanceProblems(spec []byte) []string {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	if err != nil {
 		return nil
 	}
 	var problems []string
+	for _, id := range state.AcceptanceDeclarationsOutsideSection(spec) {
+		problems = append(problems, fmt.Sprintf("spec.md declares %s outside the first `## Acceptance criteria` section, so the gate does not check it", id))
+	}
 	seen := map[string]bool{}
 	readHeading := false
 	for _, line := range strings.Split(string(structural), "\n") {

package/engine/internal/gate/readiness_binding.go

@@ -1,15 +1,18 @@
 package gate
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"encoding/binary"
 	"encoding/hex"
 	"errors"
 	"fmt"
-	"hash"
+	"io"
 	"regexp"
+	"slices"
 	"strings"
 
+	"github.com/devrites/devrites/internal/acceptance"
 	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 )
@@ -17,7 +20,7 @@ import (
 const (
 	readinessBindingLabel   = "Readiness inputs SHA-256: "
 	readinessBindingDomain  = "devrites-readiness-inputs"
-	readinessBindingVersion = "1"
+	readinessBindingVersion = "2"
 )
 
 type readinessInput struct {
@@ -37,10 +40,13 @@ var readinessInputs = [...]readinessInput{
 	{logical: "design-brief.md"},
 	{logical: "ai-spec.md"},
 	{logical: ".devrites/principles.md"},
+	{logical: acceptance.GatesFile},
 }
 
 // ReadinessBinding returns the exact line Vet records in eng-review.md.
 // Explicit sources resolve live first, then safely archived planning bytes.
+// Gate definitions are bound independently of proof progress. Older bindings
+// omitted those definitions and require normal re-Vet, never automatic refresh.
 func ReadinessBinding(root, slug string) (string, error) {
 	observation, err := state.ObserveReferencedWorkspace(root, slug)
 	if err != nil {
@@ -50,10 +56,6 @@ func ReadinessBinding(root, slug string) (string, error) {
 }
 
 func readinessBindingFromObservation(observation *state.WorkspaceObservation) (string, error) {
-	return bindReadinessInputs(observation, true)
-}
-
-func bindReadinessInputs(observation *state.WorkspaceObservation, blankProgress bool) (string, error) {
 	digest := sha256.New()
 	writeReadinessField(digest, readinessBindingDomain)
 	writeReadinessField(digest, readinessBindingVersion)
@@ -63,7 +65,7 @@ func bindReadinessInputs(observation *state.WorkspaceObservation, blankProgress
 		if err != nil {
 			return "", err
 		}
-		if blankProgress && input.logical == "traceability.md" {
+		if input.logical == "traceability.md" {
 			content = withoutProgressCells(content)
 		}
 		writeReadinessField(digest, string(input.logical))
@@ -85,12 +87,26 @@ func retainedReadinessInput(observation *state.WorkspaceObservation, input readi
 	}
 	switch fact.State() {
 	case state.ArtifactAbsent:
-		if input.required {
+		required := input.required
+		if input.logical == acceptance.GatesFile {
+			phase, err := observation.DeclaredPhase()
+			if err != nil {
+				return nil, false, err
+			}
+			policy, _ := state.PolicyFor(phase)
+			required = policyRequires(policy, input.logical)
+		}
+		if required {
 			return nil, false, fmt.Errorf("readiness input %s is missing", input.logical)
 		}
 		return nil, false, nil
 	case state.ArtifactEmpty, state.ArtifactPresent:
-		return fact.Bytes(), true, nil
+		content := fact.Bytes()
+		if input.logical == acceptance.GatesFile {
+			content, err := normalizedReadinessGates(content)
+			return content, true, err
+		}
+		return content, true, nil
 	case state.ArtifactMalformed, state.ArtifactUnsafe, state.ArtifactUnreadable:
 		diagnostic, _ := fact.Diagnostic()
 		return nil, false, readinessDiagnosticError(diagnostic)
@@ -99,6 +115,25 @@ func retainedReadinessInput(observation *state.WorkspaceObservation, input readi
 	}
 }
 
+// Vet approves obligations, not their checkbox, evidence, or progress prose.
+func normalizedReadinessGates(content []byte) ([]byte, error) {
+	doc := acceptance.ParseLedger(string(content))
+	if len(doc.Errors) > 0 {
+		return nil, fmt.Errorf("readiness input gates.md is malformed: %s", strings.Join(doc.Errors, "; "))
+	}
+	slices.SortFunc(doc.Gates, func(a, b *acceptance.Gate) int {
+		return strings.Compare(a.ID, b.ID)
+	})
+	var normalized bytes.Buffer
+	writeReadinessLength(&normalized, uint64(len(doc.Gates)))
+	for _, gate := range doc.Gates {
+		for _, field := range [...]string{gate.ID, gate.Title, gate.Check, gate.Expect, gate.Cwd, gate.Inputs, gate.Run} {
+			writeReadinessField(&normalized, field)
+		}
+	}
+	return normalized.Bytes(), nil
+}
+
 func readinessDiagnostics(observation *state.WorkspaceObservation) []state.ArtifactDiagnostic {
 	var diagnostics []state.ArtifactDiagnostic
 	for _, input := range readinessInputs {
@@ -118,12 +153,6 @@ func verifyReadinessBinding(observation *state.WorkspaceObservation) (string, er
 	if err != nil {
 		return "", err
 	}
-	// A line recorded over the raw bytes, before progress cells were blanked,
-	// still verifies while those bytes are unchanged.
-	legacy, err := bindReadinessInputs(observation, false)
-	if err != nil {
-		return "", err
-	}
 	fact, ok := observation.Fact("eng-review.md")
 	if !ok || fact.State() == state.ArtifactAbsent {
 		return expected, errors.New("readiness input eng-review.md is missing")
@@ -144,7 +173,7 @@ func verifyReadinessBinding(observation *state.WorkspaceObservation) (string, er
 			continue
 		}
 		attempts++
-		if line == expected || line == legacy {
+		if line == expected {
 			matches++
 		}
 	}
@@ -155,9 +184,9 @@ func verifyReadinessBinding(observation *state.WorkspaceObservation) (string, er
 }
 
 // ReadinessInputDigest is one readiness input's content identity at a moment
-// in time. The aggregate binding answers "did anything change"; the per-input
-// digest answers "which artifact changed", which is what a drift diagnosis and
-// a re-vet route need.
+// in time (canonical definitions only for gates.md). The aggregate binding
+// answers "did anything change"; the per-input digest answers "which artifact
+// changed", which is what a drift diagnosis and a re-vet route need.
 type ReadinessInputDigest struct {
 	Path    string `json:"path"`
 	Present bool   `json:"present"`
@@ -322,12 +351,12 @@ func policyRequires(policy state.PhasePolicy, name state.ArtifactPath) bool {
 	return false
 }
 
-func writeReadinessField(digest hash.Hash, value string) {
+func writeReadinessField(digest io.Writer, value string) {
 	writeReadinessLength(digest, uint64(len(value)))
 	_, _ = digest.Write([]byte(value))
 }
 
-func writeReadinessLength(digest hash.Hash, value uint64) {
+func writeReadinessLength(digest io.Writer, value uint64) {
 	var encoded [8]byte
 	binary.BigEndian.PutUint64(encoded[:], value)
 	_, _ = digest.Write(encoded[:])