devrites 7.3.1 → 7.3.2

package/engine/internal/lib/context_io.go

@@ -3,6 +3,7 @@ package lib
 import (
 	"bytes"
 	"crypto/sha256"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -34,10 +35,8 @@ func (s *contextSources) read(name string) ([]byte, error) {
 	if source, ok := s.files[name]; ok {
 		return source.data, source.err
 	}
-	var source contextSource
-	if source.err = contextParents(s.dir, name); source.err == nil {
-		source.data, source.err = readBoundedRegularFile(filepath.Join(s.dir, name), workspaceArtifactLimit)
-	}
+	source := contextSource{}
+	source.data, source.err = readContextArtifact(s.dir, name)
 	if source.err != nil {
 		source.err = fmt.Errorf("workspace artifact %s: %w", name, source.err)
 	}
@@ -48,6 +47,64 @@ func (s *contextSources) read(name string) ([]byte, error) {
 	return source.data, source.err
 }
 
+// Acquire workspace leaves through a confined root, not a checked absolute path.
+func readContextArtifact(dir, name string) ([]byte, error) {
+	if !filepath.IsLocal(name) {
+		return nil, fmt.Errorf("workspace artifact %q escapes workspace", name)
+	}
+	if err := contextParents(dir, name); err != nil {
+		return nil, err
+	}
+	ws, err := os.OpenRoot(dir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = ws.Close() }()
+	before, err := ws.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !before.Mode().IsRegular() {
+		return nil, errors.New("artifact is not a regular file")
+	}
+	if before.Size() < 0 || before.Size() > workspaceArtifactLimit {
+		return nil, fmt.Errorf("artifact exceeds %s limit", byteLimitName(workspaceArtifactLimit))
+	}
+	file, err := ws.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !opened.Mode().IsRegular() || opened.Size() != before.Size() || !os.SameFile(before, opened) {
+		return nil, errors.New("artifact changed type while opening")
+	}
+	body, err := io.ReadAll(io.LimitReader(file, workspaceArtifactLimit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(body)) > workspaceArtifactLimit {
+		return nil, fmt.Errorf("artifact exceeds %s limit", byteLimitName(workspaceArtifactLimit))
+	}
+	after, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	current, err := ws.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !after.Mode().IsRegular() || after.Size() != opened.Size() || after.Size() != int64(len(body)) ||
+		!os.SameFile(opened, after) || !current.Mode().IsRegular() || !os.SameFile(opened, current) ||
+		current.Size() != after.Size() {
+		return nil, errors.New("artifact changed size or type while reading")
+	}
+	return body, nil
+}
+
 // Reject even in-workspace parent links: managed paths name actual directories.
 func contextParents(dir, rel string) error {
 	parent := filepath.Dir(rel)
@@ -169,3 +226,30 @@ func publishContext(featureDir string, opts contextOpts, body []byte) (out strin
 	}
 	return out, false, nil
 }
+
+// Caller holds the feature lock; a wave/role read-set is never replaced.
+func retainPacketContext(workspace, name string, body []byte) error {
+	rel := filepath.Join("packets", name)
+	if err := contextParents(workspace, rel); err != nil {
+		return err
+	}
+	prior, err := (&contextSources{dir: workspace}).read(rel)
+	if err == nil {
+		if !bytes.Equal(prior, body) {
+			return fmt.Errorf("%s already retains a different context; render the new read-set under a new wave", rel)
+		}
+		return nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	ws, err := os.OpenRoot(workspace)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = ws.Close() }()
+	if err := ws.MkdirAll("packets", 0o755); err != nil {
+		return err
+	}
+	return fsutil.WriteFileAtomicIn(ws, rel, body, 0o600)
+}

package/engine/internal/lib/continuation.go

@@ -5,39 +5,25 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/gate"
 	"github.com/devrites/devrites/internal/state"
+	"github.com/devrites/devrites/internal/workflow"
 )
 
 // ContinuationUsage is the help text for `check continuation`.
 const ContinuationUsage = "usage: devrites-engine check continuation [slug]"
 
-// internalPhaseVerbs are autocomplete phase edges. /rite-ship and
-// /rite-autocomplete stay user-facing (fresh GO, parked reopen).
-var internalPhaseVerbs = map[string]bool{
-	"/rite-spec":     true,
-	"/rite-clarify":  true,
-	"/rite-temper":   true,
-	"/rite-define":   true,
-	"/rite-plan":     true,
-	"/rite-vet":      true,
-	"/rite-build":    true,
-	"/rite-prove":    true,
-	"/rite-polish":   true,
-	"/rite-review":   true,
-	"/rite-converge": true,
-	"/rite-seal":     true,
-}
-
 // continuationVerdict is the cursor-shaped answer to "may autocomplete reply?".
 // Required is an internal phase edge, not a human pause (exit stays 0).
 // shortcut: a host that ends the turn without running this check still stops; no Stop hook (ADR-0015). Upgrade if a host can block stop without a DevRites hook payload.
 type continuationVerdict struct {
 	Required bool
 	Invoke   string
+	Source   string
 	Reason   string
 }
 
@@ -71,6 +57,10 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 	if err != nil {
 		return continuationVerdict{}, err
 	}
+	invoke, internal, err := internalPhaseEdge(report.NextAction, slug)
+	if err != nil {
+		return continuationVerdict{}, err
+	}
 	if !afkPresent(root) {
 		return continuationVerdict{Reason: "no AFK sentinel"}, nil
 	}
@@ -100,11 +90,10 @@ func classifyContinuation(root, slug string) (continuationVerdict, error) {
 			}
 		}
 	}
-	invoke, ok := internalPhaseEdge(report.NextAction)
-	if !ok {
+	if !internal {
 		return continuationVerdict{Reason: "next_action is not an internal phase edge"}, nil
 	}
-	return continuationVerdict{Required: true, Invoke: invoke, Reason: "AFK status=running internal phase edge"}, nil
+	return continuationVerdict{Required: true, Invoke: invoke, Source: slug, Reason: "AFK status=running internal phase edge"}, nil
 }
 
 func afkPresent(root string) bool {
@@ -112,18 +101,116 @@ func afkPresent(root string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
-func internalPhaseEdge(action string) (string, bool) {
+func internalPhaseEdge(action, slug string) (string, bool, error) {
+	command := workflow.ForAction(action)
+	policy, known := state.PolicyFor(state.Phase(command.Verb))
+	if !known || policy.Target == state.PhaseFrame || policy.Target == state.PhaseShip || policy.ResumeVerb == "" {
+		return "", false, nil
+	}
 	fields := strings.Fields(action)
-	if len(fields) == 0 || !internalPhaseVerbs[strings.ToLower(fields[0])] {
-		return "", false
+	if len(fields) == 0 || fields[0] != command.Claude && fields[0] != command.Codex && fields[0] != command.Skill {
+		return "", false, fmt.Errorf("next_action must start with one native phase invocation")
+	}
+	if workflow.ForAction(strings.Join(fields[1:], " ")).Verb != "" {
+		return "", false, fmt.Errorf("next_action must contain only one phase invocation")
+	}
+	for i, field := range fields[1:] {
+		if field == "—" {
+			fields = fields[:i+1]
+			break
+		}
+	}
+	args, err := continuationArguments(command, fields[1:], slug)
+	if err != nil {
+		return "", false, err
+	}
+	return strings.Join(append(fields[:1], args...), " "), true, nil
+}
+
+func continuationArguments(command workflow.Command, args []string, slug string) ([]string, error) {
+	badArgs := func() ([]string, error) {
+		return nil, fmt.Errorf("invalid next_action arguments for %s: %q", command.Claude, strings.Join(args, " "))
+	}
+	var positional []string
+	for i := 0; i < len(args); i++ {
+		arg := args[i]
+		switch {
+		case arg == "--full" && (command.Verb == "vet" || command.Verb == "review" || command.Verb == "seal"):
+		case arg == "--cross-model" && command.Verb == "vet":
+		case arg == "--lookahead" && command.Verb == "spec":
+		case arg == "--mode" && command.Verb == "temper":
+			i++
+			if i >= len(args) {
+				return badArgs()
+			}
+			switch args[i] {
+			case "expand", "selective", "hold-rigor", "reduce-to-MVP":
+			default:
+				return badArgs()
+			}
+		case arg == "--parallel" && command.Verb == "build":
+			i++
+			if i >= len(args) {
+				return badArgs()
+			}
+			n, err := strconv.Atoi(args[i])
+			if err != nil || n < 1 || n > 10 {
+				return badArgs()
+			}
+		case strings.HasPrefix(arg, "-"):
+			return badArgs()
+		default:
+			positional = append(positional, arg)
+		}
+	}
+	if command.SourceIsFirstArgument() {
+		if len(positional) > 1 {
+			return badArgs()
+		}
+		if len(positional) == 1 && positional[0] != slug {
+			return nil, fmt.Errorf("next_action targets workspace %q, not selected source %q", positional[0], slug)
+		}
+		if len(positional) == 0 {
+			args = append(args, slug)
+		}
+		return args, nil
+	}
+	switch command.Verb {
+	case "build", "polish":
+		// Build's positional argument is a slice number/name, not a workspace.
+		return args, nil
+	case "plan":
+		if len(positional) == 0 {
+			return args, nil
+		}
+		if len(positional) <= 2 {
+			switch positional[0] {
+			case "decompose", "reslice", "repair", "reorder", "split", "unblock", "course-correct", "revise":
+				if len(positional) == 2 && positional[1] != slug {
+					return nil, fmt.Errorf("next_action targets workspace %q, not selected source %q", positional[1], slug)
+				}
+				return args, nil
+			}
+		}
+	case "review":
+		if len(positional) == 0 || len(positional) == 1 && positional[0] == "feature" {
+			return args, nil
+		}
+		if len(positional) == 2 && positional[0] == "slice" {
+			n, err := strconv.Atoi(positional[1])
+			if err == nil && n > 0 || state.ValidSliceID(positional[1]) {
+				return args, nil
+			}
+		}
 	}
-	return strings.Join(fields, " "), true
+	return badArgs()
 }
 
 func writeContinuation(stdout io.Writer, verdict continuationVerdict) {
 	if verdict.Required {
 		fmt.Fprintln(stdout, "continuation: required")
 		fmt.Fprintf(stdout, "invoke: %s\n", verdict.Invoke)
+		fmt.Fprintf(stdout, "source: %s\n", verdict.Source)
 	} else {
 		fmt.Fprintln(stdout, "continuation: clear")
 	}

package/engine/internal/lib/dispatch.go

@@ -38,7 +38,20 @@ open --claim-session --claim records one file claim for the wave and fails,
 creating no wave, while a live foreign session holds a path; the return that
 completes the wave releases it, and abandon keeps it unless --release (any
 host-confirmed terminal path without a completing return, such as a stop or a
-refused launch). Re-opening an abandoned wave keeps or replaces its claim.
+refused launch). Wave IDs are single-use, including abandoned waves; retries
+need a fresh ID and never inherit or release an earlier wave's claim.
+Native starts, returns and abandonment retain subsecond timestamps. abandon
+--release also retains host-terminal confirmation, even without a claim or when
+its owned claim was already released; a failed release does not certify termination.
+Finalization requires every launched
+role to settle, and abandoned writers need actual returns or this confirmation.
+An abandoned reviewer or proof-runner still needs a later complete account in
+the same phase, role and slice subject; rerun abandon on a legacy record to
+record reconciliation time first.
+An abandoned writer's unreleased claim blocks overlapping writers across every
+live or archived feature in this repository, even in the same session or after
+TTL expiry, until explicit release or proven host termination.
+return --handle, when supplied, must match the role's recorded host handle.
 status --wave exits
 nonzero until that wave is complete; bare status lists every open, sealed,
 or abandoned wave, folds complete waves into one count line (--all lists
@@ -93,6 +106,8 @@ type dispatchWave struct {
 	Phase           string                   `json:"phase"`
 	State           string                   `json:"state"` // open, sealed, abandoned, complete
 	Reason          string                   `json:"reason,omitempty"`
+	AbandonedAt     string                   `json:"abandoned_at,omitempty"`
+	TerminalAt      string                   `json:"terminal_at,omitempty"`
 	Roles           map[string]*dispatchRole `json:"roles"`
 	Slices          []string                 `json:"slices,omitempty"`
 	ResliceReview   string                   `json:"reslice_review,omitempty"`
@@ -131,7 +146,10 @@ func dispatchPath(root, slug string) string {
 }
 
 func loadDispatch(root, slug string) (*dispatchFile, string, error) {
-	path := dispatchPath(root, slug)
+	return loadDispatchFile(dispatchPath(root, slug))
+}
+
+func loadDispatchFile(path string) (*dispatchFile, string, error) {
 	f := &dispatchFile{Waves: map[string]*dispatchWave{}}
 	data, err := os.ReadFile(path) // #nosec G304 -- path is a validated feature workspace artifact
 	if os.IsNotExist(err) {
@@ -140,16 +158,75 @@ func loadDispatch(root, slug string) (*dispatchFile, string, error) {
 	if err != nil {
 		return nil, path, err
 	}
+	f = &dispatchFile{}
 	if err := json.Unmarshal(data, f); err != nil {
 		return nil, path, fmt.Errorf("dispatch.json is not valid JSON: %w", err)
 	}
 	if f.Waves == nil {
-		f.Waves = map[string]*dispatchWave{}
+		return nil, path, fmt.Errorf("dispatch.json is malformed (missing waves)")
 	}
-	// Fail closed on hand-edited impossible state.
+	// Validate every account before any caller can use or mutate the ledger.
 	for name, w := range f.Waves {
-		if w.Roles == nil || w.State == "" {
-			return nil, path, fmt.Errorf("wave %q is malformed (missing state or roles)", name)
+		if w == nil || strings.TrimSpace(name) == "" || strings.TrimSpace(w.Phase) == "" || len(w.Roles) == 0 ||
+			!slices.Contains([]string{"open", "sealed", "complete", "abandoned"}, w.State) {
+			return nil, path, fmt.Errorf("wave %q is malformed (invalid phase, state or roles)", name)
+		}
+		handles := map[string]bool{}
+		allStarted, allReturned := true, true
+		for role, r := range w.Roles {
+			if r == nil || strings.TrimSpace(role) == "" {
+				return nil, path, fmt.Errorf("wave %q role %q is malformed (missing account)", name, role)
+			}
+			started := r.Handle != ""
+			if started != (r.StartedAt != "") || r.Returned != (r.ReturnedAt != "") ||
+				(r.Returned && !started) || (started && handles[r.Handle]) ||
+				(w.State == "open" && r.Returned) ||
+				((w.State == "sealed" || w.State == "complete") && !started) ||
+				(w.State == "complete" && !r.Returned) {
+				return nil, path, fmt.Errorf("wave %q role %q is malformed (inconsistent start or return)", name, role)
+			}
+			allStarted = allStarted && started
+			allReturned = allReturned && r.Returned
+			if started {
+				start, startErr := time.Parse(time.RFC3339Nano, r.StartedAt)
+				if startErr != nil {
+					return nil, path, fmt.Errorf("wave %q role %q is malformed (invalid start timestamp)", name, role)
+				}
+				if r.Returned {
+					end, endErr := time.Parse(time.RFC3339Nano, r.ReturnedAt)
+					if endErr != nil || end.Before(start) {
+						return nil, path, fmt.Errorf("wave %q role %q is malformed (invalid return timestamp)", name, role)
+					}
+				}
+			}
+			if started {
+				handles[r.Handle] = true
+			}
+		}
+		if (w.State == "open" && allStarted) || (w.State == "sealed" && allReturned) {
+			return nil, path, fmt.Errorf("wave %q is malformed (inconsistent barrier state)", name)
+		}
+		if w.AbandonedAt != "" {
+			if _, err := time.Parse(time.RFC3339Nano, w.AbandonedAt); err != nil || w.State != "abandoned" {
+				return nil, path, fmt.Errorf("wave %q is malformed (invalid abandonment timestamp)", name)
+			}
+		}
+		if w.TerminalAt != "" {
+			terminal, err := time.Parse(time.RFC3339Nano, w.TerminalAt)
+			abandoned, abandonErr := time.Parse(time.RFC3339Nano, w.AbandonedAt)
+			if err != nil || abandonErr != nil || w.State != "abandoned" || terminal.Before(abandoned) {
+				return nil, path, fmt.Errorf("wave %q is malformed (invalid terminal timestamp)", name)
+			}
+			for _, account := range w.Roles {
+				for _, stamp := range []string{account.StartedAt, account.ReturnedAt} {
+					if stamp != "" {
+						at, _ := time.Parse(time.RFC3339Nano, stamp)
+						if terminal.Before(at) {
+							return nil, path, fmt.Errorf("wave %q is malformed (terminal timestamp precedes account)", name)
+						}
+					}
+				}
+			}
 		}
 	}
 	return f, path, nil
@@ -166,7 +243,7 @@ func saveDispatch(path string, f *dispatchFile) error {
 	return state.AtomicWrite(path, data, 0o600)
 }
 
-func nowStamp() string { return time.Now().UTC().Format(time.RFC3339) }
+func nowStamp() string { return time.Now().UTC().Format(time.RFC3339Nano) }
 
 // RunDispatch implements the dispatch wave state machine.
 func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
@@ -259,8 +336,11 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	// an update and strand the wave short of complete.
 	code := 0
 	if err := state.WithFeatureLock(root, slug, func() error {
-		code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, contract, packet, outcome, result, all, claim, stdout, stderr)
-		return nil
+		// Feature → claims is the lock order; never acquire another feature.
+		return state.WithLock(claimsPath(root)+".lock", func() error {
+			code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, contract, packet, outcome, result, all, claim, stdout, stderr)
+			return nil
+		})
 	}); err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
 		return 3
@@ -293,8 +373,7 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 			fmt.Fprint(stderr, dispatchUsage)
 			return 2
 		}
-		prev := getWave()
-		if prev != nil && prev.State != "abandoned" {
+		if prev := getWave(); prev != nil {
 			return fail("wave %q already exists (state %s)", wave, prev.State)
 		}
 		w := &dispatchWave{Phase: phase, State: "open", Roles: map[string]*dispatchRole{}, Slices: sliceIDs}
@@ -315,6 +394,9 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 			if err := lintWrightContractFor(root, slug, contract); err != nil {
 				return fail("BLOCKED: %v", err)
 			}
+			if err := lintPacketDiffs(root, slug, contract, false); err != nil {
+				return fail("BLOCKED: %v", err)
+			}
 		}
 		for _, r := range roles {
 			if isReviewerRole(r) {
@@ -331,6 +413,22 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 				break
 			}
 		}
+		var claimPaths []string
+		if len(claim.paths) > 0 {
+			claimPaths, err = normalizeClaimPaths(claim.paths)
+			if err != nil {
+				return fail("%v", err)
+			}
+		}
+		admissionPaths := slices.Clone(claimPaths)
+		if isWrightWave(w) {
+			admissionPaths = append(admissionPaths, sliceWriteSet(root, slug, w.Slices)...)
+		}
+		if len(claimPaths) == 0 {
+			if err := checkAbandonedWriterClaims(root, admissionPaths); err != nil {
+				return fail("BLOCKED: %v", err)
+			}
+		}
 		if err := openTripwire(root, slug, w, claim.paths); err != nil {
 			return fail("BLOCKED: %v", err)
 		}
@@ -339,15 +437,16 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 				fmt.Fprintln(stderr, "dispatch: --claim-session and --claim go together (--claim-ttl needs both)")
 				return 2
 			}
-			// The claim goes last so a refused open never leaves one behind.
-			id, code := addClaim(root, claim.session, "dispatch wave "+wave, cmp.Or(claim.ttl, claimDefaultTTL), claim.paths, stdout, stderr)
+			if !validSession(claim.session) {
+				fmt.Fprintln(stderr, "claim: --session is required (1-128 chars: letters, digits, - _ . : /)")
+				return 2
+			}
+			// The ledger lock spans admission, claim append, and publication.
+			id, code := claimAddLocked(claimsPath(root), claim.session, "dispatch wave "+wave, cmp.Or(claim.ttl, claimDefaultTTL), claimPaths, admissionPaths, stdout, stderr)
 			if code != 0 {
 				return code
 			}
 			w.Claim, w.ClaimSession = id, claim.session
-		} else if prev != nil {
-			// Inherit the abandoned wave's kept claim so the completing return releases it.
-			w.Claim, w.ClaimSession = prev.Claim, prev.ClaimSession
 		}
 		if project, _, ok := treeProject(root); ok && isBuildWrightWave(w) {
 			// Uncommitted rounds look like additions against HEAD; this snapshot
@@ -358,10 +457,9 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 				w.Tree = tree
 			}
 		}
-		superseded := prev != nil && prev.Claim != "" && prev.Claim != w.Claim
 		f.Waves[wave] = w
 		if err := saveDispatch(path, f); err != nil {
-			if w.Claim != "" && (prev == nil || w.Claim != prev.Claim) {
+			if w.Claim != "" {
 				_, _ = releaseClaim(root, w.ClaimSession, w.Claim)
 			}
 			return fail("%v", err)
@@ -370,9 +468,6 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if err := ensureTreeBaseline(root, slug, stdout); err != nil {
 			fmt.Fprintf(stderr, "dispatch: WARNING: %s not recorded: %v\n", treeBaselineFile, err)
 		}
-		if superseded {
-			releaseWaveClaim(root, wave, prev, stdout, stderr)
-		}
 		for _, line := range rounds {
 			fmt.Fprintln(stdout, line)
 		}
@@ -455,6 +550,9 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if r == nil {
 			return fail("role %q not declared in wave %q", role, wave)
 		}
+		if handle != "" && handle != r.Handle {
+			return fail("handle %q does not match role %q's recorded handle %q", handle, role, r.Handle)
+		}
 		if r.Returned {
 			return fail("role %q already returned", role)
 		}
@@ -569,14 +667,23 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		already := w.State == "abandoned"
 		w.State = "abandoned"
 		w.Reason = reason
+		if w.AbandonedAt == "" {
+			w.AbandonedAt = nowStamp()
+		}
 		// A timeout or unknown outcome keeps the claim; --release is for any
 		// host-confirmed terminal path without a completing return (a stop or a
 		// refused launch), including a re-run once a timed-out child is confirmed.
 		if claim.release {
 			if w.Claim == "" {
 				fmt.Fprintf(stderr, "dispatch: --release: wave %s holds no claim\n", wave)
+				if w.TerminalAt == "" {
+					w.TerminalAt = nowStamp()
+				}
 			} else if releaseWaveClaim(root, wave, w, stdout, stderr) {
 				w.Claim, w.ClaimSession = "", ""
+				if w.TerminalAt == "" {
+					w.TerminalAt = nowStamp()
+				}
 			}
 		}
 		if err := saveDispatch(path, f); err != nil {
@@ -592,10 +699,36 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 	return 2
 }
 
-// releaseWaveClaim releases w's claim and reports whether it did. A failure
-// only warns: the wave state change does not depend on it.
+// Caller holds the repository claims lock through new-wave publication.
+func checkAbandonedWriterClaims(root string, paths []string) error {
+	if len(paths) == 0 {
+		return nil
+	}
+	latest, _, bad, err := readClaims(claimsPath(root))
+	if err != nil {
+		return err
+	}
+	if bad > 0 {
+		return fmt.Errorf("%d unparsed ledger line(s); cannot rule out an abandoned writer claim", bad)
+	}
+	conflicts, err := retainedWriterConflicts(root, latest, paths, newHolderProbe())
+	if err != nil {
+		return err
+	}
+	if len(conflicts) > 0 {
+		return fmt.Errorf("abandoned writer still holds claim %s on %s; confirm host termination and use dispatch abandon --release before retrying", conflicts[0].ID, strings.Join(conflicts[0].Paths, ","))
+	}
+	return nil
+}
+
+// releaseWaveClaim releases w's claim; explicit terminal abandonment also
+// reconciles a verified prior release. A failure only warns.
 func releaseWaveClaim(root, wave string, w *dispatchWave, stdout, stderr io.Writer) bool {
 	n, err := releaseClaim(root, w.ClaimSession, w.Claim)
+	if w.State == "abandoned" && errors.Is(err, errClaimAlreadyReleased) {
+		fmt.Fprintf(stdout, "dispatch: wave %s claim %s already released\n", wave, w.Claim)
+		return true
+	}
 	if err != nil {
 		fmt.Fprintf(stderr, "dispatch: WARNING: wave %s claim not released: %v\n", wave, err)
 		return false
@@ -799,7 +932,7 @@ func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, revi
 		return lines, 0
 	}
 	if review == "" {
-		fmt.Fprintf(stderr, "dispatch: BLOCKED: %s reached %d %s rounds; run a reslice review (acceptance-preserving split or simpler proof seam, or a drift.md entry recording why neither applies) and reopen with --reslice-review <DRIFT-ID>\n",
+		fmt.Fprintf(stderr, "dispatch: BLOCKED: %s reached %d %s rounds; run a reslice review (acceptance-preserving split or simpler proof seam, or a drift.md entry recording why neither applies) and open a fresh wave with --reslice-review <DRIFT-ID>\n",
 			strings.Join(overCap, ","), wrightRoundsPerReview, kind)
 		return nil, 3
 	}