devrites 7.3.1 → 7.3.2

package/engine/internal/overhaul/records/consistency.go

@@ -115,6 +115,24 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if err != nil {
 		return err
 	}
+	inputs := ovio.Obj(sc["inputs"])
+	for _, input := range []struct{ key, file string }{
+		{"rubric_sha256", join(run, str(ovio.Obj(ovio.Obj(R["run.json"]["revisions"])["rubric"]), "file"))},
+		{"results_sha256", join(genDir, results)},
+		{"gates_sha256", join(genDir, "gates.json")},
+	} {
+		if !isFile(input.file) {
+			add("scorecard: %s input is missing", input.key)
+			continue
+		}
+		digest, err := sha(input.file)
+		if err != nil {
+			return err
+		}
+		if !eq(inputs[input.key], digest) {
+			add("scorecard: %s does not match the selected calculator input", input.key)
+		}
+	}
 	gates := ovio.Obj(sc["gates"])
 	claims := func(g string) bool { return str(gates, g) == "PASS" }
 	for _, it := range fs {
@@ -131,10 +149,10 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	if !claims("G-COVERAGE") {
 		return nil
 	}
-	admitted := map[string]bool{}
+	admitted := map[string]map[string]any{}
 	for _, it := range ovio.List(R["dispatch.json"]["attempts"]) {
 		if x := ovio.Obj(it); str(x, "status") == "admitted" {
-			admitted[str(x, "receipt")] = true
+			admitted[str(x, "receipt")] = x
 		}
 	}
 	if len(cells) == 0 {
@@ -147,8 +165,8 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 		case "blocked":
 			add("scorecard: G-COVERAGE is PASS but applicability %s is blocked", key)
 		case "applicable":
-			if !checkedBy(run, str(c, "domain"), ovio.List(c["receipts"]), admitted) {
-				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked", key, str(c, "domain"))
+			if !checkedBy(run, str(c, "domain"), str(c, "lane"), ovio.List(c["receipts"]), admitted) {
+				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked for its lane", key, str(c, "domain"))
 			}
 		}
 	}
@@ -169,18 +187,26 @@ func consistency(run, genDir string, R map[string]map[string]any, add func(strin
 	return nil
 }
 
-// checkedBy reports whether any admitted, non-gap receipt records domain in
-// domains_checked.
-func checkedBy(run, domain string, receipts []any, admitted map[string]bool) bool {
+// checkedBy requires the receipt's domain and lane to match the cell and its
+// identity to match the admitted dispatch attempt.
+func checkedBy(run, domain, lane string, receipts []any, admitted map[string]map[string]any) bool {
 	for _, r := range receipts {
 		p := ovio.Str(r)
-		if !admitted[p] || !inside(run, p) || !isFile(join(run, p)) {
+		attempt := admitted[p]
+		if attempt == nil || str(attempt, "lane") != lane || !inside(run, p) || !isFile(join(run, p)) {
 			continue
 		}
 		rc, err := ovio.LoadObject(join(run, p))
 		if err != nil || str(rc, "outcome") == "gap" {
 			continue
 		}
+		matches := true
+		for _, k := range []string{"task_id", "attempt_id", "role", "lane", "snapshot"} {
+			matches = matches && str(attempt, k) != "" && eq(rc[k], attempt[k])
+		}
+		if !matches {
+			continue
+		}
 		if slices.ContainsFunc(ovio.List(rc["domains_checked"]), func(d any) bool { return d == any(domain) }) {
 			return true
 		}

package/engine/internal/overhaul/records/run.go

@@ -111,15 +111,24 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		return nil, nil, err
 	}
 	var errs []string
-	files, revs := ovio.Obj(m["files"]), ovio.Obj(m["revisions"])
-	check := func(src map[string]any) error {
+	files, revs, receipts := ovio.Obj(m["files"]), ovio.Obj(m["revisions"]), ovio.Obj(m["receipts"])
+	if receipts == nil {
+		errs = append(errs, "manifest: receipts must record admitted receipt digests")
+	}
+	dispatch, err := ovio.LoadObject(join(genDir, "dispatch.json"))
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		if str(attempt, "status") == "admitted" && str(receipts, str(attempt, "receipt")) == "" {
+			errs = append(errs, "manifest: admitted receipt digest missing: "+str(attempt, "receipt"))
+		}
+	}
+	check := func(src map[string]any, base string) error {
 		for _, rel := range sortedKeys(src) {
-			base := run
-			if _, ok := files[rel]; ok {
-				base = genDir
-			}
 			p := join(base, rel)
-			ok := isFile(p)
+			ok := inside(base, rel) && isFile(p)
 			if ok {
 				d, err := sha(p)
 				if err != nil {
@@ -133,10 +142,13 @@ func manifestOK(run, genDir string) ([]string, map[string]any, error) {
 		}
 		return nil
 	}
-	if err := check(files); err != nil {
+	if err := check(files, genDir); err != nil {
+		return nil, nil, err
+	}
+	if err := check(revs, run); err != nil {
 		return nil, nil, err
 	}
-	if err := check(revs); err != nil {
+	if err := check(receipts, run); err != nil {
 		return nil, nil, err
 	}
 	return errs, m, nil
@@ -273,13 +285,22 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	revs := map[string]any{}
+	revs, receipts := map[string]any{}, map[string]any{}
+	settledReceipts := map[string]string{}
 	if prevDir != "" {
 		pmErrs, pm, err := manifestOK(run, prevDir)
 		if err != nil {
 			return 0, err
 		}
 		errs = append(errs, pmErrs...)
+		for rel, digest := range ovio.Obj(pm["receipts"]) {
+			receipts[rel] = digest
+			rc, err := ovio.LoadObject(join(run, rel))
+			if err != nil {
+				return 0, err
+			}
+			settledReceipts[Repr([]any{rc["task_id"], rc["attempt_id"]})] = rel
+		}
 		prevRevs := ovio.Obj(pm["revisions"])
 		for _, rel := range sortedKeys(prevRevs) {
 			p := join(run, rel)
@@ -308,6 +329,29 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		}
 		revs["revisions/"+e.Name()] = d
 	}
+	dispatch, err := ovio.LoadObject(join(tmp, "dispatch.json"))
+	if err != nil {
+		return 0, err
+	}
+	for _, it := range ovio.List(dispatch["attempts"]) {
+		attempt := ovio.Obj(it)
+		rel := str(attempt, "receipt")
+		if str(attempt, "status") != "admitted" || !inside(run, rel) || !isFile(join(run, rel)) {
+			continue
+		}
+		if prior, settled := settledReceipts[Repr([]any{attempt["task_id"], attempt["attempt_id"]})]; settled && prior != rel {
+			errs = append(errs, "settled admitted attempt changed receipt: "+PyStr(attempt["task_id"])+"#"+PyStr(attempt["attempt_id"]))
+			continue
+		}
+		if _, settled := receipts[rel]; settled {
+			continue
+		}
+		digest, err := sha(join(run, rel))
+		if err != nil {
+			return 0, err
+		}
+		receipts[rel] = digest
+	}
 	if len(errs) > 0 {
 		for _, e := range errs {
 			fmt.Fprintln(stdout, "VIOLATION: "+e)
@@ -342,7 +386,7 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 		previous = prev
 	}
 	manifest := map[string]any{"schema": "overhaul.manifest/1", "generation": gen, "previous": previous,
-		"files": files, "revisions": revs}
+		"files": files, "revisions": revs, "receipts": receipts}
 	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o644); err != nil {
 		return 0, err
 	}

package/engine/internal/parallel/landing.go

@@ -199,6 +199,23 @@ func acceptedRetry(root string, lease *Lease, selector string) (string, error) {
 }
 
 func protectRawLease(current, next *Lease) error {
+	for _, candidate := range next.Slices {
+		if candidate.WrightStatus != WrightIntegrated {
+			continue
+		}
+		found := false
+		if current != nil {
+			for _, sl := range current.Slices {
+				if sl.WrightStatus == WrightIntegrated && reflect.DeepEqual(sl, candidate) {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			return fmt.Errorf("lease-write cannot introduce integrated slice %s; use integrate", SliceKey(candidate.Workspace, candidate.ID))
+		}
+	}
 	if current == nil {
 		if next.PendingLanding != nil || next.LastLanding != nil {
 			return fmt.Errorf("lease-write cannot fabricate landing evidence")

package/engine/internal/state/acceptance.go

@@ -11,7 +11,8 @@ import (
 var (
 	acceptanceHeadingRE = regexp.MustCompile(`(?i)^##\s+Acceptance criteria\s*$`)
 	canonicalACRE       = regexp.MustCompile(`\bAC-\d{3}\b`)
-	h2HeadingRE         = regexp.MustCompile(`^##\s+`)
+	acceptanceEndRE     = regexp.MustCompile(`^#{1,2}\s+`)
+	acDeclarationRE     = regexp.MustCompile("^\\s*(?:#{1,6}\\s+|[-+*]\\s+(?:\\[[ xX]\\]\\s+)?|\\d+[.)]\\s+|\\|\\s*)?(?:\\*\\*|__|`)?(AC-\\d{3})(?:\\*\\*|__|`)?(?:\\s*[:|]|[ \\t]+[-–—])")
 )
 
 // AcceptanceMapResult is the deterministic ID-presence check from spec.md
@@ -50,11 +51,40 @@ func ParseAcceptanceMap(spec, tasks, testPlan []byte, requireTasks, requireTestP
 }
 
 func acceptanceSection(spec []byte) string {
-	structural, err := markdowntext.Structural(spec)
+	structural, err := markdowntext.Prose(spec)
 	if err != nil {
 		return ""
 	}
 	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	if start < 0 {
+		return ""
+	}
+	return strings.Join(lines[start:end], "\n")
+}
+
+// AcceptanceDeclarationsOutsideSection identifies definitions, not prose
+// references, that the canonical section parser would otherwise silently skip.
+func AcceptanceDeclarationsOutsideSection(spec []byte) []string {
+	structural, err := markdowntext.Prose(spec)
+	if err != nil {
+		return nil
+	}
+	lines := strings.Split(strings.ReplaceAll(string(structural), "\r\n", "\n"), "\n")
+	start, end := acceptanceSectionBounds(lines)
+	var ids []string
+	for i, line := range lines {
+		if start >= 0 && i >= start && i < end {
+			continue
+		}
+		if match := acDeclarationRE.FindStringSubmatch(line); match != nil {
+			ids = append(ids, match[1])
+		}
+	}
+	return ids
+}
+
+func acceptanceSectionBounds(lines []string) (int, int) {
 	start := -1
 	for i, line := range lines {
 		if acceptanceHeadingRE.MatchString(strings.TrimSpace(line)) {
@@ -63,16 +93,16 @@ func acceptanceSection(spec []byte) string {
 		}
 	}
 	if start < 0 {
-		return ""
+		return -1, -1
 	}
 	end := len(lines)
 	for i := start; i < len(lines); i++ {
-		if h2HeadingRE.MatchString(lines[i]) {
+		if acceptanceEndRE.MatchString(strings.TrimSpace(lines[i])) {
 			end = i
 			break
 		}
 	}
-	return strings.Join(lines[start:end], "\n")
+	return start, end
 }
 
 func uniqueCanonicalACs(text string) []string {

package/engine/internal/state/feature.go

@@ -63,12 +63,13 @@ func regularFileExists(path string) bool {
 	return err == nil && info.Mode().IsRegular()
 }
 
-func firstPhaseWord(value string) string {
+// CanonicalPhase reads the leading phase name, ignoring case and trailing annotations.
+func CanonicalPhase(value string) Phase {
 	word := strings.ToLower(strings.TrimSpace(value))
 	if i := strings.IndexAny(word, " 	"); i > 0 {
 		word = word[:i]
 	}
-	return word
+	return Phase(word)
 }
 
 // blankOrHash reports whether a trimmed line carries no meaningful content: it

package/engine/internal/state/observation.go

@@ -148,7 +148,7 @@ func (o *WorkspaceObservation) DeclaredPhase() (Phase, error) {
 	if !ok {
 		return "", fmt.Errorf("feature %q: no phase in %s ledger; record phase in state.md and retry", o.slug, LedgerFile)
 	}
-	phase := Phase(firstPhaseWord(value))
+	phase := CanonicalPhase(value)
 	policy, ok := PolicyFor(phase)
 	if !ok {
 		return "", fmt.Errorf("feature %q: unknown phase %q; record a known phase in state.md and retry", o.slug, phase)

package/engine/internal/state/write.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"sync"
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/fsutil"
@@ -77,57 +76,34 @@ func AppendLog(path, record string) error {
 // is released automatically even if the process dies mid-operation (crash-safe);
 // see lock_unix.go / lock_other.go.
 func WithFeatureLock(root, slug string, fn func() error) error {
-	lockPath, err := featureLockPath(root, slug)
-	if err != nil {
-		return err
+	if !devritespaths.ValidSlug(slug) {
+		return fmt.Errorf("lock feature %q: not a feature slug", slug)
+	}
+	// Keep the lock outside the movable workspace; never unlink it on release.
+	lockDir := filepath.Join(root, ".locks", "features", slug)
+	if err := os.MkdirAll(lockDir, 0o755); err != nil {
+		return fmt.Errorf("lock feature %q: %w", slug, err)
 	}
-	return WithLock(lockPath, fn)
+	return WithLock(filepath.Join(lockDir, ".lock"), func() error {
+		if _, err := os.Lstat(filepath.Join(root, "archive", slug)); err == nil {
+			return fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
+		} else if !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("lock feature %q: %w", slug, err)
+		}
+		if err := os.MkdirAll(featureDir(root, slug), 0o755); err != nil {
+			return fmt.Errorf("lock feature %q: %w", slug, err)
+		}
+		return fn()
+	})
 }
 
 // WithLock runs fn while holding the same exclusive advisory lock as
 // WithFeatureLock, keyed on lockPath, for shared ledgers outside one feature.
 func WithLock(lockPath string, fn func() error) error {
-	return withLock(lockPath, func(func()) error { return fn() })
-}
-
-// WithFeatureLockRelease is WithFeatureLock for a caller that must drop the lock
-// before fn returns, for example because the platform refuses to rename the
-// directory that holds the open lock file. fn receives release, which is safe to
-// call more than once; the lock is also released when fn returns.
-func WithFeatureLockRelease(root, slug string, fn func(release func()) error) error {
-	lockPath, err := featureLockPath(root, slug)
-	if err != nil {
-		return err
-	}
-	return withLock(lockPath, fn)
-}
-
-// featureLockPath validates slug and creates the feature directory, returning
-// the lock file path inside it. A closed workspace (work/<slug> gone, archive/<slug>
-// present) is refused rather than resurrected by a late lock.
-func featureLockPath(root, slug string) (string, error) {
-	if !devritespaths.ValidSlug(slug) {
-		return "", fmt.Errorf("lock feature %q: not a feature slug", slug)
-	}
-	dir := featureDir(root, slug)
-	if _, err := os.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
-		if _, archErr := os.Lstat(filepath.Join(root, "archive", slug)); archErr == nil {
-			return "", fmt.Errorf("lock feature %q: workspace is closed (archived)", slug)
-		}
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return "", fmt.Errorf("lock feature %q: %w", slug, err)
-	}
-	return filepath.Join(dir, ".lock"), nil
-}
-
-func withLock(lockPath string, fn func(release func()) error) error {
 	l, err := acquireLock(lockPath)
 	if err != nil {
 		return fmt.Errorf("lock %s: %w", lockPath, err)
 	}
-	var once sync.Once
-	release := func() { once.Do(func() { _ = l.release() }) }
-	defer release()
-	return fn(release)
+	defer func() { _ = l.release() }()
+	return fn()
 }

package/engine/internal/workflow/commands.go

@@ -10,18 +10,20 @@ type Command struct {
 	Verb   string
 	Claude string
 	Codex  string
+	Skill  string
 }
 
-// ForVerb returns the Claude and Codex forms for a public rite verb. The empty
+// ForVerb returns native invocation forms for a public rite verb. The empty
 // verb returns an empty command so callers can omit suggestions safely.
 func ForVerb(verb string) Command {
 	verb = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(verb, "/"), "$"))
+	verb = strings.TrimPrefix(verb, "skill:")
 	verb = strings.TrimPrefix(verb, "rite-")
 	if verb == "" {
 		return Command{}
 	}
 	name := "rite-" + verb
-	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name}
+	return Command{Verb: verb, Claude: "/" + name, Codex: "$" + name, Skill: "/skill:" + name}
 }
 
 // ForAction extracts the first explicit rite invocation from a cursor action.
@@ -29,13 +31,33 @@ func ForVerb(verb string) Command {
 func ForAction(action string) Command {
 	for _, field := range strings.Fields(action) {
 		field = strings.Trim(field, "`'\"()[]{}<>,.;:")
-		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") {
+		if strings.HasPrefix(field, "/rite-") || strings.HasPrefix(field, "$rite-") || strings.HasPrefix(field, "/skill:rite-") {
 			return ForVerb(field)
 		}
 	}
 	return Command{}
 }
 
+// SourceIsFirstArgument distinguishes workspace slugs from phase-local
+// slice/mode/scope/target arguments. Plan's optional source follows its mode.
+func (c Command) SourceIsFirstArgument() bool {
+	switch c.Verb {
+	case "", "build", "plan", "review", "polish":
+		return false
+	default:
+		return true
+	}
+}
+
+// SourceInvocation renders an executable cursor command, never display prose.
+// Commands without a slug argument retain the caller's selected SOURCE.
+func (c Command) SourceInvocation(source string) string {
+	if source != "" && c.SourceIsFirstArgument() {
+		return c.Claude + " " + source
+	}
+	return c.Claude
+}
+
 // Both renders a command in host-neutral prose for engine stderr/stdout messages.
 func (c Command) Both() string {
 	if c.Verb == "" {

package/engine/main.go

@@ -334,6 +334,21 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 		fmt.Fprintln(stdout, binding)
 		return exitOK
 	}
+	if kind == gate.Seal {
+		code := exitBlocked
+		if err := state.WithFeatureLock(root, args[0], func() error {
+			code = cmdGateLocked(root, kind, args, stdout, stderr)
+			return nil
+		}); err != nil {
+			fmt.Fprintf(stderr, "seal: BLOCKED: %v\n", err)
+			return exitBlocked
+		}
+		return code
+	}
+	return cmdGateLocked(root, kind, args, stdout, stderr)
+}
+
+func cmdGateLocked(root string, kind gate.Kind, args []string, stdout, stderr io.Writer) int {
 	result, err := gate.Check(kind, root, args[0])
 	if err != nil {
 		fmt.Fprintf(stderr, "devrites: %v\n", err)
@@ -369,6 +384,10 @@ func cmdGate(root string, kind gate.Kind, args []string, stdout, stderr io.Write
 			fmt.Fprintf(stdout, "release-union: BLOCKED: %v\n", err)
 			return sealBlocked()
 		}
+		if err := lib.CheckFinalPrerequisites(root, args[0]); err != nil {
+			fmt.Fprintf(stdout, "final-prerequisites: BLOCKED: %v\n", err)
+			return sealBlocked()
+		}
 		code := lib.EvidenceFresh(root, []string{args[0]}, stdout, stderr)
 		if code == exitUsage {
 			return exitUsage

package/pack/.claude/skills/devrites-lib/reference/parallel-dispatch.md

@@ -55,28 +55,27 @@ If the candidate diff has no matching surfaces, record
    The `agents` dispatch contract needs no flag: `--role` auto-fires it
    (`auto=[agents]` in the output). The command prints `unselected=[...]`; an
    omitted applicable trigger is a gap, not a shortcut.
-3. Enforce the launch barrier through the engine, not prose. Open the wave
-   (`devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`;
-   a reviewer, auditor, or test-analyst wave adds `--packet <file>`, any one of the
-   wave's rendered `packets/<w>.<role>.md` (hand each agent its own file unedited), and `open` refuses one that seeds a gate result, outcome,
-   count, or "already passed" claim; a Build reviewer wave adds `--slice <SLICE-ID>`
-   so its findings key on that slice; at Review and Seal it also needs the packet to
-   name the frozen candidate diff and the manifest to cover every checkpointed path;
-   a same-tree writer wave adds `--claim-session <id> --claim <path>...` per
-   [`wright-dispatch.md`](../../rite-build/reference/wright-dispatch.md#run)), launch every native agent nonblocking through the host's own agent
-   tool (never a shell-launched host CLI such as `omp -p` or `claude -p`: that is a
-   dispatch bridge, its PID handle dies with the session, and its return is a `gap`),
-   record each returned host handle
-   (`dispatch ... start --wave <w> --role <r> --handle <id>`) — the last start
-   seals the wave (an explicit `seal` is a no-op), which makes a
-   serial launch-then-wait pattern impossible to record. Record each completion
-   with `dispatch ... return`; a reviewer adds `--result <file>` holding its return verbatim (the engine stores it as `packets/<wave>-<role>.return.md`, derives the outcome from its head, and records its `Finding:` keys; a file already at that path is kept), or `--outcome <findings|no-findings|gap>` when the host cannot hand the return over as a file; `return` refuses before seal. `dispatch status`
-   exits nonzero while the wave is open, sealed, or abandoned. `start`/`return`
-   auto-record the dispatch/return metrics events — no separate ledger call. If
-   an opened wave cannot obtain every handle or reach `seal`, run
-   `devrites-engine dispatch <slug> abandon --wave <w> --reason <reason>` (with
-   `--release` on a host-confirmed stop or refused launch) before
-   recording the gap; never leave an open wave to block a retry.
+3. Open a single-use wave; every retry needs a fresh ID:
+   `devrites-engine dispatch <slug> open --phase <p> --wave <w> --role <r>...`.
+   Reviewer/auditor/test-analyst waves add `--packet <file>` naming any rendered
+   `packets/<w>.<role>.md`; give each agent its own packet unedited. `open` rejects
+   seeded gate results, outcomes, counts, or pass claims. Build reviewers add
+   `--slice <SLICE-ID>`; Review/Seal packets bind the frozen diff and a manifest
+   covering every checkpointed path. Same-tree writers add `--claim-session <id>
+   --claim <path>...` per [`wright-dispatch.md`](../../rite-build/reference/wright-dispatch.md#run).
+   Launch all native agents nonblocking through the host tool before waiting.
+   Never shell-launch host CLIs (`omp -p`, `claude -p`): that bridge's handle dies
+   with the session and its return is a gap. Record every host handle with
+   `dispatch ... start --wave <w> --role <r> --handle <id>`; the last seals the wave
+   (explicit `seal` then does nothing). Return only after seal, with the recorded
+   handle: `dispatch ... return --wave <w> --role <r> --handle <id>`.
+   Reviewers add `--result <file>`: retain it verbatim at
+   `packets/<wave>-<role>.return.md` (keep an existing file), derive outcome and
+   `Finding:` keys. If the host cannot provide a file, use explicit
+   `--outcome findings|no-findings|gap`. Status is nonzero for open/sealed/abandoned
+   waves; start/return record metrics. If handles/seal cannot be obtained,
+   `dispatch ... abandon --wave <w> --reason <reason>` before recording the gap;
+   add `--release` only after host-confirmed stop/refused launch.
 4. Ask for each exact named agent in fresh context; omit native syntax and
    `agent_type`/`task_name`/`fork_turns` from the instruction.
 5. Every dispatch reaches a terminal classification before reconciliation:
@@ -144,32 +143,35 @@ the client renames a field its mocked test still passes, and the verdict reads c
 
 ## Cancellation and terminal reconciliation
 
-Cancellation acknowledgement means the host accepted a request, not that the
-child stopped. A transport timeout likewise leaves execution unknown. Keep the
-child's handle, path/resource ownership and capacity reservation until the
-native host confirms a terminal state and returned work has been reconciled.
-Query or wait on that handle; do not replace the child, release its slot, or
-reuse its resources while it may still run. If terminal state cannot be
-established, record a gap and retain ownership; for a child launched by an earlier
-session, the claim proof below settles it. A result classification alone
-does not prove host termination.
+Cancellation acknowledgement or timeout leaves execution unknown. Keep handles,
+path/resource ownership, and capacity until the native host confirms termination
+and returned work is reconciled. Query/wait; never replace children, release slots,
+or reuse resources prematurely. If unproven, record a gap and retain ownership;
+earlier-session claim proof follows. Outcome classification alone proves no death.
 
 On resume (compaction or a new session), run `devrites-engine dispatch <slug>
 status`, `parallel status`, and `claim list` before any dispatch. A read-only
 wave whose handles this session cannot query: `abandon` it, record each unreturned
-role `gap`, and re-dispatch fresh on the current digest; its late returns are
-`stale`. A writer keeps its claim and lease — no relaunch on those paths until the
-claim is released or its holder is proven terminal. For an unqueryable writer,
-`claim list` showing its claim `dead` (the engine proved the holding session
-exited on this host), or `claim list --all --session <id>` showing it `released`
-(bare `list` only counts released rows), is that proof: `abandon` the wave, record the
-role `gap`, claim the paths, and re-dispatch without waiting on the launching
-session. `live` or `expired` stays held. A wright that never returned an
+role `gap`, and re-dispatch under a fresh wave ID on the current digest; its late
+returns are `stale`. A writer retains claim/lease: no relaunch under a fresh wave,
+same session, or expired TTL until release or proven termination. For an
+unqueryable writer, `claim list` `dead` proves its holding session exited on this
+host; `claim list --all --session <id>` shows `released` (bare `list` counts it).
+After that proof, `dispatch <slug> abandon --wave <w> --release --reason <reason>`
+stamps `terminal_at` even without a claim, not a return. Record `gap`, reclaim
+paths, and re-dispatch. `live`/`expired` stays held; cancellation acknowledgement,
+timeout, ordinary abandonment, or replacement cannot prove writer death.
+A wright that never returned an
 admitted result leaves unadmitted bytes: task-path changes since its pre-dispatch
 `git diff --name-only` baseline are never cited as built nor discarded, and are
 named in the re-dispatch contract; changes outside task paths stop for the human
 (Converge side: [`rite-converge`](../../rite-converge/SKILL.md)).
 
+Finalization settles every launched role, including proof/custom/writer roles.
+Abandoned proof/reviewer replacement needs a newer settled account, same canonical
+phase/role/exact unordered slice set, and distinct handle. Writer termination
+admits no bytes and bypasses no candidate, admission, review or proof gate.
+
 ## Scale limits
 
 The role table bounds rosters. Use up to ten concurrent read-only reviewers,

package/pack/.claude/skills/overhaul/SKILL.md

@@ -143,10 +143,14 @@ deployment, or anything the user did not start with this command.
    reconfirmation otherwise), the re-hashed plan digest, the task closure, the current
    plan revision, no later stop, and for PR or branch scope a checked-out `HEAD` equal
    to the pinned head. Record it in `approval.json`.
-2. Execute the approved DAG with [`overhaul-implementer`](../../agents/overhaul-implementer.md): one
-   writer per path, independent frontend and backend tasks concurrently, TDD per
-   [`references/repair-and-measurement.md`](references/repair-and-measurement.md).
-   Admit patches only when observed changed paths equal the contract.
+2. Execute the approved DAG with [`overhaul-implementer`](../../agents/overhaul-implementer.md)
+   and TDD per [`references/repair-and-measurement.md`](references/repair-and-measurement.md).
+   Serialize shared-repository target writes, even for independent frontend/backend
+   tasks: whole-repository before-capture → target writer stops → full delta →
+   receipt admission, then start the next writer. Preserve one owner per physical
+   task path; admit only observed changes within the approved contract. Read-only
+   reviews and verification may overlap on immutable inputs when resources permit
+   ([observation windows](references/orchestration.md#single-writer-budgets-and-cancellation)).
 3. Verify each fix independently (`repair-verify`), test the assembled candidate,
    remeasure approved targets, rescore, publish, and follow the convergence table in
    [`references/lifecycle.md`](references/lifecycle.md) — continuing automatically